google redirecting and other problems [Closed]

I've got a Dell Insperion 560. 6Gb 64 bit OS. Google redirects me to other search engines. Sometimes I get redirected to other places when I go directly to a site without google.
I have an HJT log. Please help fix me. lol

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:41:08 PM, on 11/28/2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe
C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files (x86)\Intuit\QuickBooks 2011\QBW32.EXE
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
C:\Program Files (x86)\Dell\DellComms\bin\sprtcmd.exe
C:\Program Files (x86)\Nova Development\Print Artist Platinum\ReminderApp.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Shop To Win\ShopToWin.exe
C:\Users\Ray\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q2340YFE\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://74.125.224.50/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {bde6f3a2-2ce8-4430-94e0-cd4ce39eeb0d} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Freecause Shopping BHO - {6AE00F2C-62F7-41B5-83A6-B0CC6959CBC4} - C:\Program Files (x86)\Shop to Win 21\Shop to Win 21.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MIF5BA~1\Office14\GROOVEEX.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - (no file)
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: NetAssistantBHO - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files (x86)\Freeze.com\NetAssistant\NetAssistant.dll (file missing)
O3 - Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - (no file)
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"
O4 - HKLM\..\Run: [DellComms] "C:\Program Files (x86)\Dell\DellComms\bin\sprtcmd.exe" /P DellComms
O4 - HKLM\..\Run: [AddressBookReminderApp] C:\Program Files (x86)\Nova Development\Print Artist Platinum\ReminderApp.exe
O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"
O4 - HKCU\..\Run: [OfficeSyncProcess] "C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE"
O4 - HKCU\..\Run: [OfficeSyncProcess] "C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE"
O4 - HKCU\..\Run: [Shop To Win] C:\Program Files (x86)\Shop To Win\ShopToWin.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3944627005-4227386435-1527120253-1003\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'QBDataServiceUser21')
O4 - HKUS\S-1-5-21-3944627005-4227386435-1527120253-1003\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'QBDataServiceUser21')
O4 - S-1-5-21-3944627005-4227386435-1527120253-1003 User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'QBDataServiceUser21')
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Intuit Data Protect.lnk = C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: QuickBooks_Standard_21.lnk = C:\Program Files (x86)\Intuit\QuickBooks 2011\QBW32.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O12 - Plugin for .spop: C:\Program Files (x86)\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab
O16 - DPF: {8A5BE387-D09A-4DFA-A56B-DCB89BD11468} (20-20 3D Viewer for WEB) - https://lowes.2020.net/planner/Core/Player/…X_WEB_Win32.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: intu-help-qb4 - {ACE22922-D07C-4860-B51B-8CF472FEC2CB} - C:\Program Files (x86)\Intuit\QuickBooks 2011\HelpAsyncPluggableProtocol.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V8 (AdobeActiveFileMonitor8.0) - Adobe Systems Incorporated - c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: McciCMService - Alcatel-Lucent - C:\Program Files (x86)\Common Files\Motive\McciCMService.exe
O23 - Service: McciCMService64 - Alcatel-Lucent - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: QBIDPService (QBVSS) - Intuit Inc. - C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe
O23 - Service: QuickBooksDB21 - Intuit, Inc. - C:\PROGRA~2\Intuit\QUICKB~1\QBDBMgrN.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SupportSoft Sprocket Service (DellComms) (sprtsvc_DellComms) - SupportSoft, Inc. - C:\Program Files (x86)\Dell\DellComms\bin\sprtsvc.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 14227 bytes

OTL logfile created on: 11/29/2011 9:33:43 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Ray\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.97 Gb Total Physical Memory | 4.60 Gb Available Physical Memory | 77.11% Memory free
11.93 Gb Paging File | 10.29 Gb Available in Paging File | 86.29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 686.57 Gb Total Space | 631.80 Gb Free Space | 92.02% Space Free | Partition Type: NTFS

Computer Name: RAY-PC | User Name: Ray | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/11/29 09:23:52 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Ray\Desktop\OTL.exe
PRC - [2011/11/03 15:21:22 | 002,175,488 | —- | M] (Jackpot Rewards) – C:\Program Files (x86)\Shop To Win\ShopToWin.exe
PRC - [2011/09/05 18:31:06 | 005,842,776 | —- | M] (Intuit Inc.) – C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe
PRC - [2011/07/06 12:47:16 | 001,156,968 | —- | M] (Intuit Inc.) – C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
PRC - [2011/07/06 12:45:32 | 001,178,984 | —- | M] (Intuit Inc.) – C:\Program Files (x86)\Intuit\QuickBooks 2011\QBW32.EXE
PRC - [2011/07/06 11:39:58 | 000,045,056 | —- | M] (Intuit) – C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
PRC - [2011/06/30 12:25:52 | 001,248,256 | —- | M] (Intuit Inc.) – C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe
PRC - [2011/06/06 11:55:28 | 000,064,952 | —- | M] (Adobe Systems Incorporated) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2010/09/14 04:45:56 | 000,219,496 | —- | M] (Microsoft Corporation) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2010/09/14 04:45:44 | 000,508,264 | —- | M] (Microsoft Corporation) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2010/04/27 23:36:44 | 000,679,936 | —- | M] (Intuit, Inc.) – C:\Program Files (x86)\Intuit\QuickBooks 2011\QBDBMgrN.exe
PRC - [2010/03/03 20:16:06 | 000,013,336 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010/03/03 20:16:04 | 000,284,696 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
PRC - [2010/02/25 11:43:16 | 000,144,672 | —- | M] () – C:\Program Files (x86)\Nova Development\Print Artist Platinum\ReminderApp.exe
PRC - [2009/12/29 16:35:38 | 000,140,520 | —- | M] (CyberLink Corp.) – C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
PRC - [2009/10/15 03:10:28 | 000,498,160 | —- | M] () – C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
PRC - [2009/09/18 04:54:20 | 000,169,312 | —- | M] (Adobe Systems Incorporated) – c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
PRC - [2009/06/09 09:11:14 | 000,155,648 | —- | M] (Stardock Corporation) – C:\Program Files\Dell\DellDock\DockLogin.exe
PRC - [2009/05/05 05:39:18 | 000,206,064 | —- | M] (SupportSoft, Inc.) – C:\Program Files (x86)\Dell\DellComms\bin\sprtsvc.exe
PRC - [2009/05/05 05:39:18 | 000,206,064 | —- | M] (SupportSoft, Inc.) – C:\Program Files (x86)\Dell\DellComms\bin\sprtcmd.exe


========== Modules (No Company Name) ==========

MOD - [2011/10/14 07:59:33 | 017,478,656 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\64ef7169e1266b6a98131b82bddd234b\System.ServiceModel.ni.dll
MOD - [2011/10/14 07:59:06 | 000,452,608 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\3c8f9ba115087754b5b1d8394fc818ba\IAStorUtil.ni.dll
MOD - [2011/10/14 07:57:23 | 002,297,856 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\dd56ffc9d534de278c79420dcce058a4\System.Core.ni.dll
MOD - [2011/10/14 07:40:48 | 000,368,128 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\07cdef1a740151932dcf161f3306bd9c\PresentationFramework.Aero.ni.dll
MOD - [2011/10/14 07:40:41 | 001,840,640 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\a512243ee9900e621fb8cd990a9c679d\System.Web.Services.ni.dll
MOD - [2011/10/14 07:40:40 | 011,819,520 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\8e7909ef6b5f953d49244c6b9f5f5100\System.Web.ni.dll
MOD - [2011/10/14 07:40:35 | 000,771,584 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b2622080e047040fa044dd21a04ff10d\System.Runtime.Remoting.ni.dll
MOD - [2011/10/14 07:40:34 | 000,628,224 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\dfe859829abd7f108aa5d82382251690\System.EnterpriseServices.ni.dll
MOD - [2011/10/14 07:40:34 | 000,627,200 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\f5659a792c1f6832d9a45c1509d03497\System.Transactions.ni.dll
MOD - [2011/10/14 07:40:33 | 006,611,456 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\f8196c3588c2229e84516af4b6a0ee60\System.Data.ni.dll
MOD - [2011/10/14 07:40:25 | 014,339,072 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\70e2ca33ffa52c743285dc5b4910a229\PresentationFramework.ni.dll
MOD - [2011/10/14 07:40:12 | 012,433,408 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll
MOD - [2011/10/14 07:40:06 | 001,587,200 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll
MOD - [2011/10/14 07:40:04 | 000,060,928 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\bb1d36ae26e7cadf563061596682e747\UIAutomationProvider.ni.dll
MOD - [2011/10/14 07:40:03 | 012,234,752 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\7c94a121334aeca7553c7f01290740f0\PresentationCore.ni.dll
MOD - [2011/10/14 07:39:52 | 003,347,968 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\d7a64c28cf0c90e6c48af4f7d6f9ed41\WindowsBase.ni.dll
MOD - [2011/10/14 07:39:48 | 005,453,312 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\130ad4d9719e566ca933ac7158a04203\System.Xml.ni.dll
MOD - [2011/10/14 07:39:44 | 000,971,264 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\2d5bcbeb9475ef62189f605bcca1cec6\System.Configuration.ni.dll
MOD - [2011/10/14 07:39:43 | 007,963,648 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll
MOD - [2011/10/14 07:38:58 | 011,490,304 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll
MOD - [2011/09/14 10:24:49 | 000,271,440 | —- | M] () – C:\Windows\assembly\GAC_MSIL\System.Data.SqlServerCe\3.5.1.0__89845dcd8080cc91\System.Data.SqlServerCe.dll
MOD - [2011/09/05 18:31:06 | 000,083,800 | —- | M] () – C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.XmlSerializers.dll
MOD - [2011/07/06 12:46:36 | 000,100,712 | —- | M] () – C:\Program Files (x86)\Intuit\QuickBooks 2011\ReportBridge.DLL
MOD - [2011/07/06 12:46:14 | 000,125,288 | —- | M] () – C:\Program Files (x86)\Intuit\QuickBooks 2011\QBMAPILibrary.dll
MOD - [2011/07/06 12:46:12 | 000,069,992 | —- | M] () – C:\Program Files (x86)\Intuit\QuickBooks 2011\QB2WPFBridge.dll
MOD - [2011/07/06 12:46:12 | 000,020,840 | —- | M] () – C:\Program Files (x86)\Intuit\QuickBooks 2011\QBCompressor.DLL
MOD - [2011/07/06 12:45:56 | 000,093,032 | —- | M] () – C:\Program Files (x86)\Intuit\QuickBooks 2011\IPDWidgetInterop.dll
MOD - [2011/07/06 12:45:56 | 000,069,480 | —- | M] () – C:\Program Files (x86)\Intuit\QuickBooks 2011\IPDWidgetBridge.DLL
MOD - [2011/07/06 12:45:56 | 000,042,344 | —- | M] () – C:\Program Files (x86)\Intuit\QuickBooks 2011\mbpopup.dll
MOD - [2011/07/06 12:45:54 | 000,057,704 | —- | M] () – C:\Program Files (x86)\Intuit\QuickBooks 2011\htmlhelper.dll
MOD - [2011/07/06 12:45:38 | 000,268,648 | —- | M] () – C:\Program Files (x86)\Intuit\QuickBooks 2011\boost_regex-vc90-mt-p-1_33.dll
MOD - [2011/07/06 12:45:38 | 000,176,488 | —- | M] () – C:\Program Files (x86)\Intuit\QuickBooks 2011\boost_serialization-vc90-mt-p-1_33.dll
MOD - [2011/07/06 12:45:36 | 000,346,984 | —- | M] () – C:\Program Files (x86)\Intuit\QuickBooks 2011\BackupLib.dll
MOD - [2011/07/06 09:46:58 | 000,097,640 | —- | M] () – C:\Program Files (x86)\Intuit\QuickBooks 2011\Webification.DLL
MOD - [2010/11/04 20:58:05 | 002,927,616 | —- | M] () – C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2010/02/25 11:43:20 | 000,152,864 | —- | M] () – C:\Program Files (x86)\Nova Development\Print Artist Platinum\en-US\ReminderApp.resources.dll
MOD - [2010/02/25 11:43:16 | 000,144,672 | —- | M] () – C:\Program Files (x86)\Nova Development\Print Artist Platinum\ReminderApp.exe
MOD - [2010/02/25 11:43:16 | 000,087,328 | —- | M] () – C:\Program Files (x86)\Nova Development\Print Artist Platinum\AddressBookCore.dll
MOD - [2009/10/15 03:10:28 | 000,498,160 | —- | M] () – C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
MOD - [2009/06/10 16:23:19 | 000,261,632 | —- | M] () – C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2005/07/19 23:18:00 | 000,059,904 | —- | M] () – C:\Program Files (x86)\Intuit\QuickBooks 2011\zlib1.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/04/27 16:21:18 | 000,288,272 | —- | M] (Microsoft Corporation) [On_Demand | Running] – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe – (NisSrv)
SRV:64bit: - [2011/04/27 16:21:18 | 000,012,784 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe – (MsMpSvc)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV:64bit: - [2009/06/09 09:11:14 | 000,155,648 | —- | M] (Stardock Corporation) [Auto | Running] – C:\Program Files\Dell\DellDock\DockLogin.exe – (DockLoginService)
SRV - [2011/07/06 11:39:58 | 000,045,056 | —- | M] (Intuit) [Auto | Running] – C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe – (QBCFMonitorService)
SRV - [2011/06/30 12:25:52 | 001,248,256 | —- | M] (Intuit Inc.) [Auto | Running] – C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe – (QBVSS)
SRV - [2011/06/06 11:55:28 | 000,064,952 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe – (AdobeARMservice)
SRV - [2011/01/13 14:37:02 | 000,705,856 | —- | M] (SoftThinks SAS) [Disabled | Stopped] – C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE – (SftService)
SRV - [2010/09/14 04:45:56 | 000,219,496 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe – (sftvsa)
SRV - [2010/09/14 04:45:44 | 000,508,264 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe – (sftlist)
SRV - [2010/07/26 20:08:18 | 000,867,080 | —- | M] (Acresso Software Inc.) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe – (FLEXnet Licensing Service)
SRV - [2010/04/27 23:36:44 | 000,679,936 | —- | M] (Intuit, Inc.) [On_Demand | Running] – C:\Program Files (x86)\Intuit\QuickBooks 2011\QBDBMgrN.exe – (QuickBooksDB21)
SRV - [2010/03/18 12:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2010/03/03 20:16:06 | 000,013,336 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe – (IAStorDataMgrSvc) Intel®
SRV - [2009/09/18 04:54:20 | 000,169,312 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe – (AdobeActiveFileMonitor8.0)
SRV - [2009/07/23 21:10:38 | 000,061,440 | —- | M] (Intuit Inc.) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe – (QBFCService)
SRV - [2009/06/10 16:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)
SRV - [2009/05/05 05:39:18 | 000,206,064 | —- | M] (SupportSoft, Inc.) [Auto | Running] – C:\Program Files (x86)\Dell\DellComms\bin\sprtsvc.exe – (sprtsvc_DellComms) SupportSoft Sprocket Service (DellComms)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011/06/10 05:34:52 | 000,539,240 | —- | M] (Realtek ) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Rt64win7.sys – (RTL8167)
DRV:64bit: - [2011/05/18 07:08:32 | 000,047,616 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\dc3d.sys – (dc3d) MS Hardware Device Detection Driver (USB)
DRV:64bit: - [2011/04/27 14:25:24 | 000,084,864 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\NisDrvWFP.sys – (NisDrv)
DRV:64bit: - [2011/03/11 01:41:12 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/03/11 01:41:12 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2011/02/11 18:16:38 | 010,628,640 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\igdkmd64.sys – (igfx)
DRV:64bit: - [2010/11/20 08:33:35 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2010/11/20 06:07:05 | 000,059,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2010/09/14 04:45:52 | 000,022,376 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Sftvollh.sys – (Sftvol)
DRV:64bit: - [2010/09/14 04:45:50 | 000,025,960 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Running] – C:\Windows\SysNative\drivers\Sftredirlh.sys – (Sftredir)
DRV:64bit: - [2010/09/14 04:45:48 | 000,268,648 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Sftplaylh.sys – (Sftplay)
DRV:64bit: - [2010/09/14 04:45:44 | 000,760,168 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Sftfslh.sys – (Sftfs)
DRV:64bit: - [2009/12/18 11:13:02 | 000,025,600 | —- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\NwUsbCdFil64.sys – (NWUSBCDFIL64)
DRV:64bit: - [2009/12/18 11:13:00 | 000,257,536 | —- | M] (Novatel Wireless Inc) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\NWADIenum.sys – (NWADI)
DRV:64bit: - [2009/12/18 11:12:58 | 000,213,376 | —- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\nwusbser2.sys – (NWUSBPort2)
DRV:64bit: - [2009/12/18 11:12:58 | 000,213,376 | —- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\nwusbser.sys – (NWUSBPort)
DRV:64bit: - [2009/12/18 11:12:58 | 000,213,376 | —- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\nwusbmdm.sys – (NWUSBModem)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/07/09 03:00:00 | 000,055,280 | —- | M] (Sonic Solutions) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\PxHlpa64.sys – (PxHlpa64)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009/06/04 21:54:36 | 000,408,600 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\iaStor.sys – (iaStor)
DRV:64bit: - [2009/05/26 07:13:10 | 000,138,752 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\IntcHdmi.sys – (IntcHdmiAddService) Intel®
DRV:64bit: - [2008/05/06 16:06:00 | 000,014,464 | —- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\wdcsam64.sys – (WDC_SAM)
DRV:64bit: - [2006/11/01 12:51:00 | 000,151,656 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysNative\drivers\WimFltr.sys – (WimFltr)
DRV - [2010/05/04 10:51:46 | 000,020,096 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Motive\MRESP50.sys – (MRESP50)
DRV - [2010/05/04 10:50:54 | 000,021,248 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Motive\MREMP50.sys – (MREMP50)
DRV - [2009/07/13 20:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)
DRV - [2009/05/25 14:43:58 | 000,043,032 | —- | M] (Smith Micro Inc.) [Kernel | On_Demand | Stopped] – C:\Program Files (x86)\Verizon Wireless\VZAccess Manager\SMSIVZAM5X64.sys – (SMSIVZAM5X64)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-3944627005-4227386435-1527120253-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKU\S-1-5-21-3944627005-4227386435-1527120253-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://74.125.224.50/
IE - HKU\S-1-5-21-3944627005-4227386435-1527120253-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.search.yahoo.com/?fr=w3i&ty…147,16898,0,8,0
IE - HKU\S-1-5-21-3944627005-4227386435-1527120253-1000\..\URLSearchHook: {bde6f3a2-2ce8-4430-94e0-cd4ce39eeb0d} - No CLSID value found
IE - HKU\S-1-5-21-3944627005-4227386435-1527120253-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files (x86)\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011/02/14 03:00:59 | 000,000,000 | —D | M]


O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Shop to Win) - {6AE00F2C-62F7-41B5-83A6-B0CC6959CBC4} - C:\Program Files (x86)\Shop to Win 21\Shop to Win 21.dll (Shop To Win, LLC)
O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O2 - BHO: (NetAssistantBHO Class) - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - C:\Program Files (x86)\Freeze.com\NetAssistant\NetAssistant.dll File not found
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3944627005-4227386435-1527120253-1000\..\Toolbar\WebBrowser: (no name) - {00000000-0000-0000-0000-000000000000} - No CLSID value found.
O3 - HKU\S-1-5-21-3944627005-4227386435-1527120253-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-3944627005-4227386435-1527120253-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-3944627005-4227386435-1527120253-1000\..\Toolbar\WebBrowser: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKU\S-1-5-21-3944627005-4227386435-1527120253-1000\..\Toolbar\WebBrowser: (no name) - {BDE6F3A2-2CE8-4430-94E0-CD4CE39EEB0D} - No CLSID value found.
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AddressBookReminderApp] C:\Program Files (x86)\Nova Development\Print Artist Platinum\ReminderApp.exe ()
O4 - HKLM..\Run: [DellComms] C:\Program Files (x86)\Dell\DellComms\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [Desktop Disc Tool] c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe ()
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [Intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe (Intuit Inc. All rights reserved.)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3944627005-4227386435-1527120253-1000..\Run: [Shop To Win] C:\Program Files (x86)\Shop To Win\ShopToWin.exe (Jackpot Rewards)
O4 - HKU\S-1-5-21-3944627005-4227386435-1527120253-1003..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe (Dell)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-3944627005-4227386435-1527120253-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not found
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not found
O4 - Startup: C:\Users\QBDataServiceUser21\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not found
O4 - Startup: C:\Users\Ray\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8:64bit: - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O12 - Plugin for: .spop - C:\Program Files (x86)\Internet Explorer\Plugins\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Plugin Control)
O16 - DPF: {8A5BE387-D09A-4DFA-A56B-DCB89BD11468} https://lowes.2020.net/planner/Core/Player/…X_WEB_Win32.cab (20-20 3D Viewer for WEB)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{79D115A9-ECBC-49A5-A7E8-DAF3DF9A9D23}: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\intu-help-qb4 - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\qbwc - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\intu-help-qb4 {ACE22922-D07C-4860-B51B-8CF472FEC2CB} - C:\Program Files (x86)\Intuit\QuickBooks 2011\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{29024955-e5e2-11e0-a69b-002564897437}\Shell - "" = AutoRun
O33 - MountPoints2\{29024955-e5e2-11e0-a69b-002564897437}\Shell\AutoRun\command - "" = K:\LaunchU3.exe -a
O33 - MountPoints2\{8ab7d99c-0f8c-11e1-a6a5-002564897437}\Shell - "" = AutoRun
O33 - MountPoints2\{8ab7d99c-0f8c-11e1-a6a5-002564897437}\Shell\AutoRun\command - "" = "E:\WD SmartWare.exe" autoplay=true
O33 - MountPoints2\{becf763f-b476-11df-a8f6-002564897437}\Shell - "" = AutoRun
O33 - MountPoints2\{becf763f-b476-11df-a8f6-002564897437}\Shell\AutoRun\command - "" = I:\VZAccess_Manager.exe /z detect
O33 - MountPoints2\{becf765d-b476-11df-a8f6-002564897437}\Shell - "" = AutoRun
O33 - MountPoints2\{becf765d-b476-11df-a8f6-002564897437}\Shell\AutoRun\command - "" = J:\VZAccess_Manager.exe /z detect
O33 - MountPoints2\{c02b82dc-bac0-11df-a770-002564897437}\Shell - "" = AutoRun
O33 - MountPoints2\{c02b82dc-bac0-11df-a770-002564897437}\Shell\AutoRun\command - "" = E:\VZAccess_Manager.exe /z detect
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\VZAccess_Manager.exe /z detect
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*


CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/11/29 09:23:52 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\Ray\Desktop\OTL.exe
[2011/11/28 16:09:41 | 000,000,000 | —D | C] – C:\Users\Ray\Desktop\tdsskiller
[2011/11/28 16:08:14 | 000,111,408 | —- | C] (Kaspersky Lab, GERT) – C:\Windows\SysNative\drivers\72224224.sys
[2011/11/28 16:04:33 | 000,000,000 | —D | C] – C:\Users\Ray\Desktop\GooredFix Backups
[2011/11/28 14:39:36 | 000,000,000 | —D | C] – C:\Users\Ray\Documents\ShopToWin
[2011/11/28 14:39:34 | 000,000,000 | —D | C] – C:\Users\Ray\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Shop to Win 21
[2011/11/28 14:39:31 | 000,000,000 | —D | C] – C:\Program Files (x86)\Shop to Win 21
[2011/11/28 14:39:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\Shop To Win
[2011/11/28 14:39:27 | 000,000,000 | —D | C] – C:\Users\Ray\AppData\Roaming\Systweak
[2011/11/28 14:39:24 | 000,018,816 | —- | C] (Systweak Inc., (www.systweak.com)) – C:\Windows\SysNative\roboot64.exe
[2011/11/28 14:39:23 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro
[2011/11/28 14:39:20 | 000,000,000 | —D | C] – C:\Program Files (x86)\RegClean Pro
[2011/11/28 11:46:46 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Rentals
[2011/11/24 12:33:42 | 001,566,512 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Ray\Desktop\TDSSKiller.exe
[2011/11/22 09:18:42 | 000,000,000 | —D | C] – C:\Users\Ray\AppData\Local\Apps
[2011/11/21 09:05:53 | 000,000,000 | —D | C] – C:\Users\Ray\AppData\Roaming\Mozilla
[2011/11/19 09:24:14 | 000,000,000 | —D | C] – C:\Program Files (x86)\FunWebProducts
[2011/11/16 14:57:43 | 000,000,000 | —D | C] – C:\Program Files (x86)\Avanquest update
[2011/11/16 14:57:34 | 000,000,000 | —D | C] – C:\ProgramData\BVRP Software
[2011/11/16 14:57:06 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MySoftware
[2011/11/16 14:57:05 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\MySoftware
[2011/11/16 14:57:01 | 000,000,000 | —D | C] – C:\Program Files (x86)\MySoftware
[2011/11/16 14:52:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Conduit
[2011/11/16 14:52:34 | 000,000,000 | —D | C] – C:\Users\Ray\AppData\Local\Conduit
[2011/11/16 12:53:51 | 000,000,000 | —D | C] – C:\Program Files\Common Files\MySoftware
[2011/11/16 12:45:06 | 000,000,000 | —D | C] – C:\Program Files\CheckDesigner
[2011/11/16 11:52:03 | 000,000,000 | —D | C] – C:\Users\Ray\Documents\G7SysInfo6
[2011/11/16 11:52:03 | 000,000,000 | —D | C] – C:\Users\Ray\AppData\Roaming\G7SysInfo6
[2011/11/16 11:52:03 | 000,000,000 | —D | C] – C:\Users\Public\Documents\G7SysInfo6
[2011/11/16 11:52:03 | 000,000,000 | —D | C] – C:\ProgramData\G7SysInfo6
[2011/11/14 10:09:39 | 000,000,000 | —D | C] – C:\Windows\Sun
[2011/11/03 14:02:30 | 000,000,000 | —D | C] – C:\Users\Ray\AppData\Roaming\Motive
[2011/11/03 14:02:18 | 000,000,000 | —D | C] – C:\Program Files\ATT-HSI
[2011/11/03 14:02:03 | 000,000,000 | —D | C] – C:\Program Files (x86)\ATT-HSI
[2011/11/03 14:01:51 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Motive
[2011/11/03 14:01:49 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Motive
[2011/11/03 14:01:19 | 000,000,000 | —D | C] – C:\ProgramData\Motive

========== Files - Modified Within 30 Days ==========

[2011/11/29 09:23:52 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Ray\Desktop\OTL.exe
[2011/11/29 09:19:37 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011/11/29 08:15:16 | 000,014,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/11/29 08:15:16 | 000,014,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/11/29 08:13:22 | 000,744,592 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2011/11/29 08:13:22 | 000,635,648 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2011/11/29 08:13:22 | 000,111,924 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2011/11/29 08:07:52 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/11/29 08:07:47 | 509,333,503 | -HS- | M] () – C:\hiberfil.sys
[2011/11/28 16:09:28 | 001,547,774 | —- | M] () – C:\Users\Ray\Desktop\tdsskiller.zip
[2011/11/28 16:08:14 | 000,111,408 | —- | M] (Kaspersky Lab, GERT) – C:\Windows\SysNative\drivers\72224224.sys
[2011/11/28 16:07:56 | 001,566,512 | —- | M] (Kaspersky Lab ZAO) – C:\Users\Ray\Desktop\TDSSKiller.exe
[2011/11/28 16:02:33 | 000,000,280 | —- | M] () – C:\Windows\tasks\RegClean Pro_UPDATES.job
[2011/11/28 15:02:11 | 000,000,272 | —- | M] () – C:\Windows\tasks\RegClean Pro_DEFAULT.job
[2011/11/28 14:39:24 | 000,001,096 | —- | M] () – C:\Users\Public\Desktop\RegClean Pro.lnk
[2011/11/28 14:01:44 | 000,001,296 | —- | M] () – C:\Users\Ray\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/11/23 15:14:52 | 000,258,825 | —- | M] () – C:\Users\Ray\Desktop\monkey_multiplication_gameboard.pdf
[2011/11/16 14:57:33 | 000,002,180 | —- | M] () – C:\Users\Public\Desktop\CardService.lnk
[2011/11/16 14:57:06 | 000,001,812 | —- | M] () – C:\Users\Public\Desktop\Check Designer.lnk
[2011/11/16 14:47:28 | 000,001,474 | —- | M] () – C:\Users\Ray\Desktop\CheckDesigner.exe - Shortcut.lnk
[2011/11/14 16:29:12 | 000,510,104 | —- | M] () – C:\Users\Ray\Desktop\Rays Rentals Register.zip
[2011/11/14 10:31:57 | 000,499,824 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2011/11/11 12:37:31 | 000,000,162 | -H– | M] () – C:\Users\Ray\Desktop\~$cument.rtf
[2011/11/02 14:57:09 | 000,006,144 | —- | M] () – C:\Users\Ray\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/10/31 10:00:33 | 000,003,021 | —- | M] () – C:\Users\Ray\Desktop\Microsoft Word 2010.lnk

========== Files Created - No Company Name ==========

[2011/11/29 09:19:37 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011/11/28 16:09:26 | 001,547,774 | —- | C] () – C:\Users\Ray\Desktop\tdsskiller.zip
[2011/11/28 14:39:33 | 000,000,272 | —- | C] () – C:\Windows\tasks\RegClean Pro_DEFAULT.job
[2011/11/28 14:39:31 | 000,000,280 | —- | C] () – C:\Windows\tasks\RegClean Pro_UPDATES.job
[2011/11/28 14:39:24 | 000,001,096 | —- | C] () – C:\Users\Public\Desktop\RegClean Pro.lnk
[2011/11/23 15:14:52 | 000,258,825 | —- | C] () – C:\Users\Ray\Desktop\monkey_multiplication_gameboard.pdf
[2011/11/16 14:57:33 | 000,002,180 | —- | C] () – C:\Users\Public\Desktop\CardService.lnk
[2011/11/16 14:57:06 | 000,001,812 | —- | C] () – C:\Users\Public\Desktop\Check Designer.lnk
[2011/11/16 12:47:41 | 000,001,474 | —- | C] () – C:\Users\Ray\Desktop\CheckDesigner.exe - Shortcut.lnk
[2011/11/14 15:58:37 | 000,510,104 | —- | C] () – C:\Users\Ray\Desktop\Rays Rentals Register.zip
[2011/11/11 12:37:31 | 000,000,162 | -H– | C] () – C:\Users\Ray\Desktop\~$cument.rtf
[2011/11/02 14:57:05 | 000,006,144 | —- | C] () – C:\Users\Ray\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/10/31 10:00:33 | 000,003,021 | —- | C] () – C:\Users\Ray\Desktop\Microsoft Word 2010.lnk
[2011/10/10 13:05:55 | 000,000,091 | —- | C] () – C:\Users\Ray\AppData\Local\fusioncache.dat
[2011/09/26 09:58:31 | 000,000,000 | —- | C] () – C:\Windows\HPMProp.INI
[2010/12/21 20:08:27 | 000,000,090 | —- | C] () – C:\Windows\QBChanUtil_Trigger.ini
[2010/10/27 18:27:19 | 000,760,484 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010/09/03 17:15:00 | 000,016,384 | —- | C] () – C:\Windows\SysWow64\FileOps.exe
[2010/08/25 19:34:30 | 000,982,240 | —- | C] () – C:\Windows\SysWow64\igkrng500.bin
[2010/08/25 19:34:30 | 000,439,308 | —- | C] () – C:\Windows\SysWow64\igcompkrng500.bin
[2010/08/25 19:34:30 | 000,092,356 | —- | C] () – C:\Windows\SysWow64\igfcg500m.bin
[2010/07/26 22:35:27 | 000,134,592 | —- | C] () – C:\Windows\SysWow64\igfcg500.bin
[2009/07/14 00:38:36 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | —- | C] () – C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | —- | C] () – C:\Windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | —- | C] () – C:\Windows\SysWow64\mlang.dat
[2006/05/17 18:48:48 | 000,000,106 | —- | C] () – C:\Windows\SysWow64\PSNCon.ini

========== LOP Check ==========

[2010/11/18 20:55:57 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\com.w3i.musicoasis
[2011/01/18 21:43:46 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\Driver Smith
[2011/02/13 19:33:15 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\Easeware
[2011/11/16 11:52:03 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\G7SysInfo6
[2011/02/13 19:42:22 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\GetRightToGo
[2010/09/03 17:26:08 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\InterTrust
[2010/09/07 15:46:39 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\Smith Micro
[2011/11/28 09:31:50 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\SoftGrid Client
[2011/11/28 14:39:27 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\Systweak
[2010/10/27 18:27:50 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\TP
[2011/01/18 21:34:19 | 000,000,000 | —D | M] – C:\Users\Ray\AppData\Roaming\Uniblue
[2011/11/28 15:02:11 | 000,000,272 | —- | M] () – C:\Windows\Tasks\RegClean Pro_DEFAULT.job
[2011/11/28 16:02:33 | 000,000,280 | —- | M] () – C:\Windows\Tasks\RegClean Pro_UPDATES.job
[2009/07/14 00:08:49 | 000,031,234 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: EXPLORER.EXE >
[2011/02/26 00:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011/02/25 01:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011/02/25 01:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 01:14:34 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 07:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/20 08:24:45 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

< MD5 for: SVCHOST.EXE >
[2009/07/13 20:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\SysWOW64\svchost.exe
[2009/07/13 20:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2009/07/13 20:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\SysNative\svchost.exe
[2009/07/13 20:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 07:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\SysWOW64\userinit.exe
[2010/11/20 07:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010/11/20 08:25:24 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\SysNative\userinit.exe
[2010/11/20 08:25:24 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/20 08:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SysNative\winlogon.exe
[2010/11/20 08:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

< End of report >


OTL Extras logfile created on: 11/29/2011 9:33:43 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Ray\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.97 Gb Total Physical Memory | 4.60 Gb Available Physical Memory | 77.11% Memory free
11.93 Gb Paging File | 10.29 Gb Available in Paging File | 86.29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 686.57 Gb Total Space | 631.80 Gb Free Space | 92.02% Space Free | Partition Type: NTFS

Computer Name: RAY-PC | User Name: Ray | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{26A24AE4-039D-4CA4-87B4-2F86416020FF}" = Java™ 6 Update 20 (64-bit)
"{377672F0-6B8A-467D-8DDC-79338BCCD531}" = 64 Bit HP CIO Components Installer
"{42738DB0-FC3E-4672-A99B-9372F5696E30}" = Microsoft Security Client
"{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}" = Dell Edoc Viewer
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
"{90140000-006D-0409-1000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010
"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{C73A3942-84C8-4597-9F9B-EE227DCBA758}" = Dell Dock
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"HDMI" = Intel® Graphics Media Accelerator Driver
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052bac4a-6f79-46d4-a024-1ce1b4f73cd4}" = Microsoft Visual C++ 2005 Redistributable
"{06FAFD58-1C21-4C90-A2FC-C9DC5A2A9D09}" = Verizon Wireless MiFi-2200 Firmware Updates
"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = Dell DataSafe Local Backup
"{11E0AC7D-6822-4F67-865F-EE1C13D28C38}" = QuickBooks Pro 2011
"{13766F76-6C8C-4E57-A9F3-3212D1C6E0D1}" = Dell DataSafe Online
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{17DFE37C-064E-4834-AD8F-A4B2B4DF68F8}" = Adobe Photoshop Elements 8.0
"{1D70AABC-CB59-4700-A708-EA56D1CA07B0}" = QuickBooks
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 29
"{351DE0AB-7787-4497-9A7A-4AA9E3A4E290}" = Dell Communications (Support Software)
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3BB24AB3-32E0-4EB6-954F-30EFE83A7D6B}" = Check Designer
"{3D5044A5-97B8-45C0-B956-BB2376569188}" = Windows Live Movie Maker
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology
"{3FF660F4-147B-48CB-B824-2B595759D9EF}" = VZAccess Manager
"{412033BC-44CF-48D9-B813-4B835101F4D3}" = Adobe Illustrator 10.0.3
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{55D56ACA-79C3-4692-9F78-2DA5E663770C}" = Print Artist Platinum 23
"{629CCE02-041D-4577-892C-577861181771}" = Verizon Wireless USB760 Firmware Updates
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0015-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUS_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0409-1000-0000000FF1CE}_Office14.PROPLUS_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUS_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-0044-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUS_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-00BA-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUS_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0116-0409-1000-0000000FF1CE}_Office14.PROPLUS_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}_Office14.PROPLUS_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140011-0066-0409-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - English
"{91A4AD99-69CE-4745-97B7-0E0DFBECFDE5}" = Adobe Illustrator CS
"{928B06E4-DDAA-476A-926A-641620326327}" = Microsoft Search Enhancement Pack
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{A33E7B0C-B99C-4EC9-B702-8A328B161AF9}" = Roxio Burn
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = Dell DataSafe Local Backup - Support Software
"{AC2BA148-EE9C-4F1A-AFCE-F38C2C71D29B}" = Mobile Broadband Generic Drivers
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.1)
"{B2E47DE7-800B-40BB-BD1F-9F221C3AEE87}" = Roxio Burn
"{B74D4E10-1033-0000-0000-000000000001}" = Adobe Bridge 1.0
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel® Control Center
"{FD17AE81-239B-41BD-9444-BC9A8656CEAF}_is1" = Shop To Win
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"Adobe Photoshop Elements 8.0" = Adobe Photoshop Elements 8.0
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"Dell Dock" = Dell Dock
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mobile Broadband Generic Drivers" = Mobile Broadband Generic Drivers
"Office14.Click2Run" = Microsoft Office Click-to-Run 2010
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"QuickTime" = QuickTime
"RegClean Pro_is1" = RegClean Pro
"WinLiveSuite_Wave3" = Windows Live Essentials

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/26/2011 10:16:18 AM | Computer Name = Ray-PC | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks": Returning NULL QBWinInstance
Hand

Error - 11/26/2011 10:16:18 AM | Computer Name = Ray-PC | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks": Returning NULL QBWinInstance
Hand

Error - 11/26/2011 10:30:49 AM | Computer Name = Ray-PC | Source = Application Error | ID = 1000
Description = Faulting application name: WINWORDC.EXE, version: 14.0.6024.1000,
time stamp: 0x4d83e4eb Faulting module name: unknown, version: 0.0.0.0, time stamp:
0x00000000 Exception code: 0xc0000005 Fault offset: 0xf4a2ffa7 Faulting process id:
0x334 Faulting application start time: 0x01ccac47fbce3bc6 Faulting application path:
Q:\140066.enu\Office14\WINWORDC.EXE Faulting module path: unknown Report Id: 3c1547f3-183b-11e1-9c22-002564897437

Error - 11/26/2011 10:30:51 AM | Computer Name = Ray-PC | Source = Application Error | ID = 1000
Description = Faulting application name: dwwin.exe, version: 6.1.7600.16385, time
stamp: 0x4a5bc2d6 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception
code: 0xc0000005 Fault offset: 0xf101ffa7 Faulting process id: 0x72c Faulting application
start time: 0x01ccac47fe55b210 Faulting application path: C:\Windows\SysWOW64\dwwin.exe
Faulting
module path: unknown Report Id: 3d296792-183b-11e1-9c22-002564897437

Error - 11/26/2011 10:35:01 AM | Computer Name = Ray-PC | Source = Application Error | ID = 1000
Description = Faulting application name: cscript.exe, version: 5.8.7600.16385, time
stamp: 0x4a5bc670 Faulting module name: ntdll.dll, version: 6.1.7601.17514, time
stamp: 0x4ce7ba58 Exception code: 0xc0000005 Fault offset: 0x000223b4 Faulting process
id: 0x10f4 Faulting application start time: 0x01ccac4893dfedaa Faulting application
path: C:\Windows\SysWOW64\cscript.exe Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report
Id: d2084018-183b-11e1-9c22-002564897437

Error - 11/26/2011 11:05:01 AM | Computer Name = Ray-PC | Source = Application Error | ID = 1000
Description = Faulting application name: cscript.exe, version: 5.8.7600.16385, time
stamp: 0x4a5bc670 Faulting module name: ntdll.dll, version: 6.1.7601.17514, time
stamp: 0x4ce7ba58 Exception code: 0xc0000005 Fault offset: 0x000223b4 Faulting process
id: 0xd50 Faulting application start time: 0x01ccac4cc4edb48f Faulting application
path: C:\Windows\SysWOW64\cscript.exe Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report
Id: 02e91f29-1840-11e1-9c22-002564897437

Error - 11/26/2011 11:35:01 AM | Computer Name = Ray-PC | Source = Application Error | ID = 1000
Description = Faulting application name: cscript.exe, version: 5.8.7600.16385, time
stamp: 0x4a5bc670 Faulting module name: ntdll.dll, version: 6.1.7601.17514, time
stamp: 0x4ce7ba58 Exception code: 0xc0000005 Fault offset: 0x000223b4 Faulting process
id: 0xa6c Faulting application start time: 0x01ccac50f58e1890 Faulting application
path: C:\Windows\SysWOW64\cscript.exe Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report
Id: 33d09a22-1844-11e1-9c22-002564897437

Error - 11/26/2011 12:05:01 PM | Computer Name = Ray-PC | Source = Application Error | ID = 1000
Description = Faulting application name: cscript.exe, version: 5.8.7600.16385, time
stamp: 0x4a5bc670 Faulting module name: ntdll.dll, version: 6.1.7601.17514, time
stamp: 0x4ce7ba58 Exception code: 0xc0000005 Fault offset: 0x000223b4 Faulting process
id: 0x11d8 Faulting application start time: 0x01ccac55263fb58a Faulting application
path: C:\Windows\SysWOW64\cscript.exe Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report
Id: 64af7140-1848-11e1-9c22-002564897437

Error - 11/26/2011 12:35:01 PM | Computer Name = Ray-PC | Source = Application Error | ID = 1000
Description = Faulting application name: cscript.exe, version: 5.8.7600.16385, time
stamp: 0x4a5bc670 Faulting module name: ntdll.dll, version: 6.1.7601.17514, time
stamp: 0x4ce7ba58 Exception code: 0xc0000005 Fault offset: 0x000223b4 Faulting process
id: 0x1338 Faulting application start time: 0x01ccac5957691405 Faulting application
path: C:\Windows\SysWOW64\cscript.exe Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report
Id: 95916673-184c-11e1-9c22-002564897437

Error - 11/26/2011 1:00:21 PM | Computer Name = Ray-PC | Source = Application Error | ID = 1000
Description = Faulting application name: agcp.exe, version: 4.0.60831.0, time stamp:
0x4e5d70ea Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception
code: 0xc0000005 Fault offset: 0x6ad45ec7 Faulting process id: 0x654 Faulting application
start time: 0x01ccac5ce12bd5f2 Faulting application path: c:\Program Files (x86)\Microsoft
Silverlight\4.0.60831.0\agcp.exe Faulting module path: unknown Report Id: 1f8d4967-1850-11e1-9c22-002564897437

[ Dell Events ]
Error - 11/11/2011 8:40:17 AM | Computer Name = Ray-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 11/15/2011 1:07:40 PM | Computer Name = Ray-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 11/15/2011 1:07:40 PM | Computer Name = Ray-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 11/16/2011 1:44:30 PM | Computer Name = Ray-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 11/16/2011 1:44:30 PM | Computer Name = Ray-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 11/17/2011 9:22:38 AM | Computer Name = Ray-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 11/17/2011 9:22:38 AM | Computer Name = Ray-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 11/19/2011 10:17:03 AM | Computer Name = Ray-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 11/19/2011 10:17:03 AM | Computer Name = Ray-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 11/28/2011 10:33:06 AM | Computer Name = Ray-PC | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

[ Media Center Events ]
Error - 12/24/2010 9:12:10 AM | Computer Name = Ray-PC | Source = MCUpdate | ID = 0
Description = 8:12:10 AM - Error connecting to the internet. 8:12:10 AM - Unable
to contact server..

Error - 12/24/2010 9:58:39 PM | Computer Name = Ray-PC | Source = MCUpdate | ID = 0
Description = 8:58:39 PM - Error connecting to the internet. 8:58:39 PM - Unable
to contact server..

Error - 12/24/2010 9:58:47 PM | Computer Name = Ray-PC | Source = MCUpdate | ID = 0
Description = 8:58:44 PM - Error connecting to the internet. 8:58:44 PM - Unable
to contact server..

Error - 12/25/2010 9:01:34 AM | Computer Name = Ray-PC | Source = MCUpdate | ID = 0
Description = 8:01:34 AM - Error connecting to the internet. 8:01:34 AM - Unable
to contact server..

Error - 12/25/2010 9:01:40 AM | Computer Name = Ray-PC | Source = MCUpdate | ID = 0
Description = 8:01:39 AM - Error connecting to the internet. 8:01:39 AM - Unable
to contact server..

Error - 12/25/2010 9:17:27 PM | Computer Name = Ray-PC | Source = MCUpdate | ID = 0
Description = 8:17:27 PM - Error connecting to the internet. 8:17:27 PM - Unable
to contact server..

Error - 12/25/2010 9:17:33 PM | Computer Name = Ray-PC | Source = MCUpdate | ID = 0
Description = 8:17:32 PM - Error connecting to the internet. 8:17:32 PM - Unable
to contact server..

Error - 12/26/2010 9:54:10 AM | Computer Name = Ray-PC | Source = MCUpdate | ID = 0
Description = 8:54:10 AM - Error connecting to the internet. 8:54:10 AM - Unable
to contact server..

Error - 12/26/2010 9:54:15 AM | Computer Name = Ray-PC | Source = MCUpdate | ID = 0
Description = 8:54:15 AM - Error connecting to the internet. 8:54:15 AM - Unable
to contact server..

Error - 12/26/2010 9:30:14 PM | Computer Name = Ray-PC | Source = MCUpdate | ID = 0
Description = 8:30:14 PM - Error connecting to the internet. 8:30:14 PM - Unable
to contact server..

[ System Events ]
Error - 11/23/2011 9:48:39 AM | Computer Name = Ray-PC | Source = VDS Basic Provider | ID = 33554433
Description =

Error - 11/23/2011 9:48:39 AM | Computer Name = Ray-PC | Source = VDS Basic Provider | ID = 33554433
Description =

Error - 11/23/2011 12:06:55 PM | Computer Name = Ray-PC | Source = DCOM | ID = 10010
Description =

Error - 11/23/2011 6:01:30 PM | Computer Name = Ray-PC | Source = DCOM | ID = 10010
Description =

Error - 11/26/2011 10:45:36 AM | Computer Name = Ray-PC | Source = DCOM | ID = 10010
Description =

Error - 11/26/2011 12:42:43 PM | Computer Name = Ray-PC | Source = BROWSER | ID = 8032
Description =

Error - 11/28/2011 9:00:13 AM | Computer Name = Ray-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the ShellHWDetection service.

Error - 11/28/2011 10:30:20 AM | Computer Name = Ray-PC | Source = DCOM | ID = 10010
Description =

Error - 11/28/2011 10:32:41 AM | Computer Name = Ray-PC | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%835 Error Code: 0x80004005 Error description: Unspecified error Reason: %%842

Error - 11/28/2011 11:10:51 AM | Computer Name = Ray-PC | Source = DCOM | ID = 10010
Description =


< End of report >

All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-3944627005-4227386435-1527120253-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{bde6f3a2-2ce8-4430-94e0-cd4ce39eeb0d} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bde6f3a2-2ce8-4430-94e0-cd4ce39eeb0d}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6AE00F2C-62F7-41B5-83A6-B0CC6959CBC4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6AE00F2C-62F7-41B5-83A6-B0CC6959CBC4}\ not found.
File C:\Program Files (x86)\Shop to Win 21\Shop to Win 21.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D425283-D487-4337-BAB6-AB8354A81457}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D425283-D487-4337-BAB6-AB8354A81457}\ not found.
Registry value HKEY_USERS\S-1-5-21-3944627005-4227386435-1527120253-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{00000000-0000-0000-0000-000000000000} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-0000-0000-0000-000000000000}\ not found.
Registry value HKEY_USERS\S-1-5-21-3944627005-4227386435-1527120253-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_USERS\S-1-5-21-3944627005-4227386435-1527120253-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_USERS\S-1-5-21-3944627005-4227386435-1527120253-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{9D425283-D487-4337-BAB6-AB8354A81457} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D425283-D487-4337-BAB6-AB8354A81457}\ not found.
Registry value HKEY_USERS\S-1-5-21-3944627005-4227386435-1527120253-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BDE6F3A2-2CE8-4430-94E0-CD4CE39EEB0D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDE6F3A2-2CE8-4430-94E0-CD4CE39EEB0D}\ not found.
C:\Program Files (x86)\FunWebProducts\Installr\1.bin\chrome folder moved successfully.
C:\Program Files (x86)\FunWebProducts\Installr\1.bin folder moved successfully.
C:\Program Files (x86)\FunWebProducts\Installr folder moved successfully.
C:\Program Files (x86)\FunWebProducts folder moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Ray\Desktop\tool\cmd.bat deleted successfully.
C:\Users\Ray\Desktop\tool\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 134 bytes
->Flash cache emptied: 56502 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: QBDataServiceUser21
->Temp folder emptied: 777216 bytes
->Temporary Internet Files folder emptied: 134 bytes
->Flash cache emptied: 56502 bytes

User: Ray
->Temp folder emptied: 80045941 bytes
->Temporary Internet Files folder emptied: 31748168 bytes
->Java cache emptied: 569288 bytes
->Flash cache emptied: 1566 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 76358375 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50467 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 181.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.31.0 log created on 11302011_100740

Files\Folders moved on Reboot…
C:\Users\Ray\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Ray\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\SuggestedSites.dat moved successfully.
C:\Users\Ray\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F043QPY2\iframe[1].htm moved successfully.

Registry entries deleted on Reboot…


ComboFix 11-11-30.01 - Ray 11/30/2011 10:19:41.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6109.4678 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Shop to Win
c:\program files (x86)\Shop to Win\Test.htm
c:\users\Ray\AppData\Local\auditpol.dll
c:\users\Ray\AppData\Local\auditpol.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-10-28 to 2011-11-30 )))))))))))))))))))))))))))))))
.
.
2011-11-30 15:23 . 2011-11-30 15:23 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-11-30 15:07 . 2011-11-30 15:07 ——– d—–w- C:\_OTL
2011-11-30 14:08 . 2011-10-07 04:16 8570192 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A53547F7-4C5A-485C-A876-EA73D8691F78}\mpengine.dll
2011-11-28 21:08 . 2011-11-28 21:08 111408 —-a-w- c:\windows\system32\drivers\72224224.sys
2011-11-28 19:39 . 2011-11-29 16:16 ——– d—–w- c:\users\Ray\AppData\Roaming\Systweak
2011-11-28 19:39 . 2011-07-07 18:26 18816 —-a-w- c:\windows\system32\roboot64.exe
2011-11-28 14:07 . 2011-11-30 15:10 ——– d—–w- c:\users\QBDataServiceUser21
2011-11-22 14:18 . 2011-11-22 14:18 ——– d—–w- c:\users\Ray\AppData\Local\Apps
2011-11-22 13:24 . 2011-11-22 13:24 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-16 19:57 . 2011-11-16 19:57 ——– d—–w- c:\program files (x86)\Avanquest update
2011-11-16 19:57 . 2011-11-16 19:57 ——– d—–w- c:\programdata\BVRP Software
2011-11-16 19:57 . 2004-06-14 17:22 118784 —-a-w- c:\windows\SysWow64\Msstdfmt.dll
2011-11-16 19:57 . 2004-06-14 17:21 24576 —-a-w- c:\windows\SysWow64\Msxml3a.dll
2011-11-16 19:57 . 2004-06-14 17:21 565760 —-a-w- c:\windows\SysWow64\Msvcp50.dll
2011-11-16 19:57 . 2004-06-14 17:19 348160 —-a-w- c:\windows\SysWow64\Mfc30.dll
2011-11-16 19:57 . 2011-11-16 19:57 ——– d—–w- c:\program files (x86)\Common Files\MySoftware
2011-11-16 19:57 . 2004-06-14 01:16 13312 —-a-w- c:\windows\SysWow64\Svrapi.dll
2011-11-16 19:57 . 2011-11-16 19:57 ——– d—–w- c:\program files (x86)\MySoftware
2011-11-16 19:55 . 2006-02-07 20:44 65024 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ISBEW64.exe
2011-11-16 19:55 . 2006-02-07 20:40 204800 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iuser.dll
2011-11-16 19:55 . 2006-02-07 20:40 69715 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ctor.dll
2011-11-16 19:55 . 2006-02-07 20:40 274432 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iscript.dll
2011-11-16 19:55 . 2005-11-14 04:19 5632 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe
2011-11-16 19:55 . 2011-11-16 19:55 200836 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iGdi.dll
2011-11-16 19:55 . 2006-02-07 20:45 757760 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iKernel.dll
2011-11-16 19:55 . 2011-11-16 19:55 331908 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\setup.dll
2011-11-16 19:52 . 2011-11-16 19:52 ——– d—–w- c:\program files (x86)\Conduit
2011-11-16 19:52 . 2011-11-16 20:19 ——– d—–w- c:\users\Ray\AppData\Local\Conduit
2011-11-16 17:53 . 2011-11-16 17:53 ——– d—–w- c:\program files\Common Files\MySoftware
2011-11-16 17:45 . 2011-11-16 17:46 ——– d—–w- c:\program files\CheckDesigner
2011-11-16 16:52 . 2011-11-16 16:52 ——– d—–w- c:\users\Ray\AppData\Roaming\G7SysInfo6
2011-11-16 16:52 . 2011-11-16 16:52 ——– d—–w- c:\programdata\G7SysInfo6
2011-11-15 13:01 . 2011-11-15 13:01 ——– d—–w- c:\users\Default\AppData\Local\Microsoft Help
2011-11-14 15:09 . 2011-11-14 15:09 ——– d—–w- c:\windows\Sun
2011-11-14 15:04 . 2011-10-01 05:45 886784 —-a-w- c:\program files\Common Files\System\wab32.dll
2011-11-14 15:04 . 2011-10-01 04:37 708608 —-a-w- c:\program files (x86)\Common Files\System\wab32.dll
2011-11-14 15:04 . 2011-09-29 16:29 1923952 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-14 15:03 . 2011-09-29 04:03 3144704 —-a-w- c:\windows\system32\win32k.sys
2011-11-03 19:02 . 2011-11-04 12:15 ——– d—–w- c:\users\Ray\AppData\Roaming\Motive
2011-11-03 19:02 . 2011-11-03 19:02 ——– d—–w- c:\program files\ATT-HSI
2011-11-03 19:02 . 2011-11-03 19:02 ——– d—–w- c:\program files (x86)\ATT-HSI
2011-11-03 19:01 . 2011-11-03 19:02 ——– d—–w- c:\program files (x86)\Common Files\Motive
2011-11-03 19:01 . 2011-11-03 19:02 ——– d—–w- c:\program files\Common Files\Motive
2011-11-03 19:01 . 2011-11-03 19:01 ——– d—–w- c:\programdata\Motive
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-12 13:19 . 2011-10-12 13:19 917840 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A9B2F4AA-DF59-4D4C-8F9B-4D4D86CA4444}\gapaengine.dll
2011-10-07 04:16 . 2011-09-17 13:07 8570192 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-10-03 10:06 . 2010-07-27 00:55 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll
2011-09-17 13:07 . 2011-10-12 13:19 601424 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2011-09-15 15:52 . 2011-09-15 15:52 91648 —-a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-09-15 15:52 . 2011-09-15 15:52 89088 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-09-15 15:52 . 2011-09-15 15:52 86528 —-a-w- c:\windows\SysWow64\iesysprep.dll
2011-09-15 15:52 . 2011-09-15 15:52 85504 —-a-w- c:\windows\system32\iesetup.dll
2011-09-15 15:52 . 2011-09-15 15:52 76800 —-a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2011-09-15 15:52 . 2011-09-15 15:52 76800 —-a-w- c:\windows\system32\tdc.ocx
2011-09-15 15:52 . 2011-09-15 15:52 74752 —-a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2011-09-15 15:52 . 2011-09-15 15:52 74752 —-a-w- c:\windows\SysWow64\iesetup.dll
2011-09-15 15:52 . 2011-09-15 15:52 63488 —-a-w- c:\windows\SysWow64\tdc.ocx
2011-09-15 15:52 . 2011-09-15 15:52 603648 —-a-w- c:\windows\system32\vbscript.dll
2011-09-15 15:52 . 2011-09-15 15:52 49664 —-a-w- c:\windows\system32\imgutil.dll
2011-09-15 15:52 . 2011-09-15 15:52 48640 —-a-w- c:\windows\SysWow64\mshtmler.dll
2011-09-15 15:52 . 2011-09-15 15:52 48640 —-a-w- c:\windows\system32\mshtmler.dll
2011-09-15 15:52 . 2011-09-15 15:52 448512 —-a-w- c:\windows\system32\html.iec
2011-09-15 15:52 . 2011-09-15 15:52 420864 —-a-w- c:\windows\SysWow64\vbscript.dll
2011-09-15 15:52 . 2011-09-15 15:52 367104 —-a-w- c:\windows\SysWow64\html.iec
2011-09-15 15:52 . 2011-09-15 15:52 35840 —-a-w- c:\windows\SysWow64\imgutil.dll
2011-09-15 15:52 . 2011-09-15 15:52 30720 —-a-w- c:\windows\system32\licmgr10.dll
2011-09-15 15:52 . 2011-09-15 15:52 23552 —-a-w- c:\windows\SysWow64\licmgr10.dll
2011-09-15 15:52 . 2011-09-15 15:52 222208 —-a-w- c:\windows\system32\msls31.dll
2011-09-15 15:52 . 2011-09-15 15:52 173056 —-a-w- c:\windows\system32\ieUnatt.exe
2011-09-15 15:52 . 2011-09-15 15:52 165888 —-a-w- c:\windows\system32\iexpress.exe
2011-09-15 15:52 . 2011-09-15 15:52 161792 —-a-w- c:\windows\SysWow64\msls31.dll
2011-09-15 15:52 . 2011-09-15 15:52 160256 —-a-w- c:\windows\system32\wextract.exe
2011-09-15 15:52 . 2011-09-15 15:52 152064 —-a-w- c:\windows\SysWow64\wextract.exe
2011-09-15 15:52 . 2011-09-15 15:52 150528 —-a-w- c:\windows\SysWow64\iexpress.exe
2011-09-15 15:52 . 2011-09-15 15:52 1492992 —-a-w- c:\windows\system32\inetcpl.cpl
2011-09-15 15:52 . 2011-09-15 15:52 142848 —-a-w- c:\windows\SysWow64\ieUnatt.exe
2011-09-15 15:52 . 2011-09-15 15:52 1427456 —-a-w- c:\windows\SysWow64\inetcpl.cpl
2011-09-15 15:52 . 2011-09-15 15:52 135168 —-a-w- c:\windows\system32\IEAdvpack.dll
2011-09-15 15:52 . 2011-09-15 15:52 12288 —-a-w- c:\windows\system32\mshta.exe
2011-09-15 15:52 . 2011-09-15 15:52 11776 —-a-w- c:\windows\SysWow64\mshta.exe
2011-09-15 15:52 . 2011-09-15 15:52 114176 —-a-w- c:\windows\system32\admparse.dll
2011-09-15 15:52 . 2011-09-15 15:52 111616 —-a-w- c:\windows\system32\iesysprep.dll
2011-09-15 15:52 . 2011-09-15 15:52 110592 —-a-w- c:\windows\SysWow64\IEAdvpack.dll
2011-09-15 15:52 . 2011-09-15 15:52 101888 —-a-w- c:\windows\SysWow64\admparse.dll
2011-09-15 15:28 . 2009-07-14 02:36 152576 —-a-w- c:\windows\SysWow64\msclmd.dll
2011-09-15 15:28 . 2009-07-14 02:36 175616 —-a-w- c:\windows\system32\msclmd.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-12-29 140520]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160]
"DellComms"="c:\program files (x86)\Dell\DellComms\bin\sprtcmd.exe" [2009-05-05 206064]
"AddressBookReminderApp"="c:\program files (x86)\Nova Development\Print Artist Platinum\ReminderApp.exe" [2010-02-25 144672]
"Intuit SyncManager"="c:\program files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2011-06-14 1527128]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"="c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [2011-10-07 559616]
.
c:\users\Ray\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-9-3 110592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-9-3 110592]
Intuit Data Protect.lnk - c:\program files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe [2010-12-2 5842776]
QuickBooks Update Agent.lnk - c:\program files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2011-7-6 1156968]
QuickBooks_Standard_21.lnk - c:\program files (x86)\Intuit\QuickBooks 2011\QBW32.EXE [2011-7-6 1178984]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
R3 NWUSBCDFIL64;Novatel Wireless Installation CD;c:\windows\system32\DRIVERS\NwUsbCdFil64.sys [x]
R3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\DRIVERS\nwusbser2.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 SMSIVZAM5X64;SMSIVZAM5X64 NDIS Protocol Driver;c:\progra~2\VERIZO~1\VZACCE~1\SMSIVZAM5X64.SYS [2009-05-25 43032]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [x]
R4 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-01-13 705856]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-09-18 169312]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
S2 McciCMService64;McciCMService64;c:\program files\Common Files\Motive\McciCMService.exe [2010-05-04 517632]
S2 QBVSS;QBIDPService;c:\program files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [2011-06-30 1248256]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-09-14 508264]
S2 sprtsvc_DellComms;SupportSoft Sprocket Service (DellComms);c:\program files (x86)\Dell\DellComms\bin\sprtsvc.exe [2009-05-05 206064]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [x]
S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [x]
S3 QuickBooksDB21;QuickBooksDB21;c:\progra~2\Intuit\QUICKB~1\QBDBMgrN.exe [2010-04-28 679936]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-09-14 219496]
.
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-21 8306208]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 162328]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 417304]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://74.125.224.50/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport; to Microsoft Excel - c:\progra~2\MIF5BA~1\Office14\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: Se&nd; to OneNote - c:\progra~2\MIF5BA~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.254
DPF: {8A5BE387-D09A-4DFA-A56B-DCB89BD11468} - hxxps://lowes.2020.net/planner/Core/Player/2020PlayerAX_WEB_Win32.cab
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - c:\program files (x86)\Freeze.com\NetAssistant\NetAssistant.dll
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
———————— Other Running Processes ————————
.
c:\program files (x86)\Common Files\Motive\McciCMService.exe
c:\program files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
.
**************************************************************************
.
Completion time: 2011-11-30 10:27:34 - machine was rebooted
ComboFix-quarantined-files.txt 2011-11-30 15:27
.
Pre-Run: 677,153,742,848 bytes free
Post-Run: 676,985,868,288 bytes free
.
- - End Of File - - F47B3465C8D604E06F9B4B6CBCDE9638