bunicuta
Topic Starter
Hello,
I have vGrabber toolbar on my computer and I can't get rid of it. I have tried to delete it/uninstall, but now I can't even find it on the computer. I have read many post in different forums until I found your forum, now I have some hope, because on one of your older posts you helped another "victim" to clean his computer from this "computer disease". Please help, I would really appreciate it!
I Downloaded and run OTL and Run aswMBR, followed the steps you described. Bellow you will find the Logs.
OTL.txt
OTL logfile created on: 7/10/2012 7:51:12 AM - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\user\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.89 Gb Total Physical Memory | 1.99 Gb Available Physical Memory | 51.21% Memory free
7.78 Gb Paging File | 5.71 Gb Available in Paging File | 73.37% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 455.87 Gb Total Space | 402.97 Gb Free Space | 88.39% Space Free | Partition Type: NTFS
Drive D: | 9.79 Gb Total Space | 1.20 Gb Free Space | 12.28% Space Free | Partition Type: NTFS
Computer Name: LOLLY-PC | User Name: user | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\user\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Web Assistant\ExtensionUpdaterService.exe ()
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
PRC - C:\Program Files (x86)\uTorrent\uTorrent.exe (BitTorrent, Inc.)
PRC - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe ()
PRC - C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe ()
PRC - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe (DigitalPersona, Inc.)
PRC - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe (Hewlett-Packard)
PRC - c:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe (Hewlett-Packard)
PRC - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe (Brother Industries, Ltd.)
PRC - C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe (Brother Industries, Ltd.)
PRC - C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.)
PRC - C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
PRC - C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
PRC - C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe (Nuance Communications, Inc.)
PRC - C:\Program Files (x86)\Browny02\BrYNSvc.exe (Brother Industries, Ltd.)
PRC - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
PRC - C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe (Citrix Systems, Inc.)
PRC - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard)
========== Modules (No Company Name) ==========
MOD - C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\ppgooglenaclpluginchrome.dll ()
MOD - C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\pdf.dll ()
MOD - C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\libglesv2.dll ()
MOD - C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\libegl.dll ()
MOD - C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\avutil-51.dll ()
MOD - C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\avformat-54.dll ()
MOD - C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\avcodec-54.dll ()
MOD - C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\gcswf32.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe ()
MOD - C:\Windows\SysWOW64\flcdlmsg.dll ()
MOD - C:\Program Files (x86)\ControlCenter4\BrImgProc.dll ()
MOD - C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll ()
========== Win32 Services (SafeList) ==========
SRV:64bit: - (Web Assistant Updater) – C:\Program Files\Web Assistant\ExtensionUpdaterService.exe ()
SRV:64bit: - (McAfee Endpoint Encryption Agent) – C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe ()
SRV:64bit: - (DpHost) – c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe (DigitalPersona, Inc.)
SRV:64bit: - (Intel® PROSet Monitoring Service) Intel® – C:\Windows\SysNative\IPROSetMonitor.exe (Intel Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (SmcService) – C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\Smc.exe (Symantec Corporation)
SRV - (SNAC) – C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\snac64.exe (Symantec Corporation)
SRV - (SepMasterService) – C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe (Symantec Corporation)
SRV - (HP Support Assistant Service) – C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company)
SRV - (HPFSService) – c:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe (Hewlett-Packard)
SRV - (HPDrvMntSvc.exe) – C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Company)
SRV - (FLCDLOCK) – c:\Windows\SysWOW64\flcdlock.exe (Hewlett-Packard Company)
SRV - (jhi_service) Intel® – C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe (Intel Corporation)
SRV - (UNS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (PDFProFiltSrvPP) – C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
SRV - (SwitchBoard) – C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (BrYNSvc) – C:\Program Files (x86)\Browny02\BrYNSvc.exe (Brother Industries, Ltd.)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (SymEvent) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (pmxdrv) – C:\Windows\SysNative\drivers\pmxdrv.sys ()
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (vpcvmm) – C:\Windows\SysNative\drivers\vpcvmm.sys (Microsoft Corporation)
DRV:64bit: - (vpcbus) – C:\Windows\SysNative\drivers\vpchbus.sys (Microsoft Corporation)
DRV:64bit: - (vpcusb) – C:\Windows\SysNative\drivers\vpcusb.sys (Microsoft Corporation)
DRV:64bit: - (vpcnfltr) – C:\Windows\SysNative\drivers\vpcnfltr.sys (Microsoft Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (SymIRON) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\Ironx64.sys (Symantec Corporation)
DRV:64bit: - (SYMNETS) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\symnets.sys (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\SymEFA64.sys (Symantec Corporation)
DRV:64bit: - (Teefer2) – C:\Windows\SysNative\drivers\Teefer.sys (Symantec Corporation)
DRV:64bit: - (Netaapl) – C:\Windows\SysNative\drivers\netaapl64.sys (Apple Inc.)
DRV:64bit: - (MfeEpeOpal) – C:\Windows\SysNative\drivers\MfeEpeOpal.sys (McAfee, Inc.)
DRV:64bit: - (MfeEpePc) – C:\Windows\SysNative\drivers\MfeEpePc.sys (McAfee, Inc.)
DRV:64bit: - (e1cexpress) Intel® – C:\Windows\SysNative\drivers\e1c62x64.sys (Intel Corporation)
DRV:64bit: - (SymDS) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\SymDS64.sys (Symantec Corporation)
DRV:64bit: - (DAMDrv) – C:\Windows\SysNative\drivers\DAMDrv64.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) – C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (MEIx64) Intel® – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) Intel® – C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (IFCoEVB) – C:\Windows\SysNative\drivers\ifP52x64.sys (Intel® Corporation)
DRV:64bit: - (IFCoEMP) – C:\Windows\SysNative\drivers\ifM52x64.sys (Intel® Corporation)
DRV:64bit: - (Impcd) – C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (BrSerIb) Brother Serial Interface Driver(WDM) – C:\Windows\SysNative\drivers\BrSerIb.sys (Brother Industries Ltd.)
DRV:64bit: - (BrUsbSIb) Brother Serial USB Driver(WDM) – C:\Windows\SysNative\drivers\BrUsbSib.sys (Brother Industries Ltd.)
DRV:64bit: - (ctxusbm) – C:\Windows\SysNative\drivers\ctxusbm.sys (Citrix Systems, Inc.)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (TPM) – C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (netr28ux) – C:\Windows\SysNative\drivers\netr28ux.sys (Ralink Technology Corp.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (WDC_SAM) – C:\Windows\SysNative\drivers\wdcsam64.sys (Western Digital Technologies)
DRV - (IDSVia64) – C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\IPSDefs\20120705.002\IDSviA64.sys (Symantec Corporation)
DRV - (BHDrvx64) – C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\BASHDefs\20120620.012\BHDrvx64.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\VirusDefs\20120709.003\ex64.sys (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\VirusDefs\20120709.003\eng64.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPCOM/19
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPCOM/19
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://search.ask.com/web?q={searchterms}&…is&o;=CMDTDF
IE:64bit: - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=CMDTDF
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPCOM/19
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPCOM/19
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://search.ask.com/web?q={searchterms}&…is&o;=CMDTDF
IE - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=CMDTDF
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPCOM/19
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredibar.com/mb167?a=6R8yvYfAqS&i;=26
IE - HKCU\..\URLSearchHook: {b2ed7faf-72a0-46d1-9d9d-602226f5cb9f} - No CLSID value found
IE - HKCU\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://search.ask.com/web?q={searchterms}&…is&o;=CMDTDF
IE - HKCU\..\SearchScopes\{A1335A65-16DD-4275-ABDF-99A6DBAE777F}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT3059010
IE - HKCU\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=CMDTDF
IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredibar.com/mb167/?searc…vYfAqS&i;=26
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\user\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\user\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX [2012/07/09 18:26:40 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\ [2011/10/12 17:41:26 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\IPSFFPlgn\ [2012/07/10 06:38:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012/07/09 18:26:40 | 000,000,000 | —D | M]
[2012/01/16 18:30:44 | 000,000,000 | —D | M] (No name found) – C:\Users\user\AppData\Roaming\Mozilla\Firefox\extensions
[2012/01/16 18:30:44 | 000,000,000 | —D | M] (uTorrentBar Community Toolbar) – C:\Users\user\AppData\Roaming\Mozilla\Firefox\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2012/07/09 18:27:00 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
========== Chrome ==========
CHR - default_search_provider: MyStart Search (Enabled)
CHR - default_search_provider: search_url = http://mystart.incredibar.com/mb167/?loc=I…vYfAqS&i;=26
CHR - default_search_provider: suggest_url =
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\user\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\user\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Gmail = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2009/06/10 15:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension64.dll ()
O2 - BHO: (File Sanitizer for HP ProtectTools) - {3134413B-49B4-425C-98A5-893C1F195601} - c:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension32.dll ()
O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\bin\PlusIEContextMenu.dll (Zeon Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\IPS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {00000000-0000-0000-0000-000000000000} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [hpsysdrv] c:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [MfeEpePcMonitor] C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe ()
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [BrStsMon00] C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [ControlCenter4] C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [File Sanitizer] c:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe (Hewlett-Packard)
O4 - HKLM..\Run: [IMSS] C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe (Intel Corporation)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDF5 Registry Controller] C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDFHook] C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PPort12reminder] Disable_By_"C:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\12\Config\Ereg\Ereg.ini" File not found
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - HKCU..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - HKCU..\Run: [uTorrent] C:\Program Files (x86)\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Open with PDF Viewer Plus - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Open with PDF Viewer Plus - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6B4AFE0C-EB82-4C11-938E-45C40E4BC511}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C16ACAF2-478C-4BB9-8831-C57926DF1060}: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
O20:64bit: - AppInit_DLLs: (acaptuser64.dll) - C:\Windows\SysNative\acaptuser64.dll (Adobe Systems, Inc.)
O20 - AppInit_DLLs: (acaptuser32.dll) - C:\Windows\SysWow64\acaptuser32.dll (Adobe Systems, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe) - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe (DigitalPersona, Inc.)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\DeviceNP: DllName - (DeviceNP.dll) - C:\Windows\SysWow64\DeviceNP.dll (Hewlett-Packard Company)
O20 - Winlogon\Notify\SEP: DllName - (C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\WinLogoutNotifier.dll) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{89324066-818c-11e1-9811-2c41389561f8}\Shell - "" = AutoRun
O33 - MountPoints2\{89324066-818c-11e1-9811-2c41389561f8}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2012/07/09 18:27:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Perion
[2012/07/09 18:27:00 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2012/07/09 18:26:39 | 000,000,000 | —D | C] – C:\Program Files\Web Assistant
[2012/06/28 14:56:54 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012/06/28 14:56:52 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2012/06/26 11:33:35 | 000,000,000 | —D | C] – C:\Users\user\Documents\Table numbers
[2012/06/23 06:31:51 | 000,000,000 | —D | C] – C:\Users\user\Documents\Adobe Scripts
[2012/06/22 17:50:48 | 000,000,000 | —D | C] – C:\Users\user\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012/06/22 16:30:51 | 000,000,000 | —D | C] – C:\ProgramData\regid.1986-12.com.adobe
[2012/06/22 16:29:43 | 000,000,000 | —D | C] – C:\Program Files\Adobe
[2012/06/22 16:26:08 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2012/06/22 16:10:38 | 000,000,000 | —D | C] – C:\Users\user\CS6 Design and Web Premium
[2012/06/22 12:04:12 | 000,000,000 | —D | C] – C:\Users\user\Adobe Illustrator CS6
[2012/06/22 12:03:01 | 000,000,000 | —D | C] – C:\Users\user\Adobe Photoshop CS6
[2012/06/22 12:00:23 | 000,000,000 | —D | C] – C:\Users\user\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2012/06/22 11:58:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\Adobe Download Assistant
[2012/06/22 11:58:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Adobe AIR
[2012/06/22 11:46:04 | 000,000,000 | —D | C] – C:\Users\user\AppData\Local\CRE
[2012/06/22 08:34:43 | 000,000,000 | —D | C] – C:\Users\user\AppData\Local\Ilivid Player
[2012/06/22 00:05:16 | 002,622,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wucltux.dll
[2012/06/22 00:05:16 | 000,057,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuauclt.exe
[2012/06/22 00:05:16 | 000,044,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups2.dll
[2012/06/22 00:05:07 | 000,701,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapi.dll
[2012/06/22 00:05:07 | 000,099,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wudriver.dll
[2012/06/22 00:05:07 | 000,038,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups.dll
[2012/06/22 00:04:58 | 000,186,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuwebv.dll
[2012/06/22 00:04:58 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapp.exe
[2012/06/14 03:00:39 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/06/14 03:00:39 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/06/14 03:00:39 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/06/14 03:00:39 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/06/14 03:00:38 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/06/14 03:00:38 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/06/14 03:00:37 | 002,311,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/06/14 03:00:37 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/06/14 03:00:37 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/06/14 03:00:37 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/06/14 03:00:37 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/06/14 03:00:36 | 000,818,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/06/14 03:00:36 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/06/13 17:35:31 | 005,559,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2012/06/13 17:35:31 | 003,913,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntoskrnl.exe
[2012/06/13 17:35:30 | 003,968,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntkrnlpa.exe
[2012/06/13 17:29:53 | 000,149,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpcorekmts.dll
[2012/06/13 17:29:53 | 000,077,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpwsx.dll
[2012/06/13 17:29:53 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdrmemptylst.exe
[2012/06/13 17:16:57 | 003,216,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msi.dll
[2012/06/13 17:16:54 | 001,462,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\crypt32.dll
[2012/06/13 17:16:54 | 000,140,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cryptnet.dll
[2012/06/13 06:27:52 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/06/13 06:27:30 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2012/06/13 06:27:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2012/06/13 06:27:30 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2012/06/13 06:12:01 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012/06/13 06:11:58 | 000,000,000 | —D | C] – C:\Program Files (x86)\QuickTime
========== Files - Modified Within 30 Days ==========
[2012/07/10 07:47:00 | 000,000,904 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3657083141-290413805-2333710366-1001UA.job
[2012/07/10 07:32:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/07/10 06:45:51 | 000,027,568 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/10 06:45:51 | 000,027,568 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/10 06:42:41 | 000,778,834 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/07/10 06:42:41 | 000,661,680 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/07/10 06:42:41 | 000,121,598 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/07/10 06:38:05 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/07/10 06:38:01 | 005,032,320 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/07/10 06:37:34 | 3133,157,376 | -HS- | M] () – C:\hiberfil.sys
[2012/07/09 18:43:01 | 000,259,031 | —- | M] () – C:\Users\user\Desktop\Untitled-5_1.jpg
[2012/07/09 18:41:04 | 000,415,470 | —- | M] () – C:\Users\user\Desktop\Untitled-5.jpg
[2012/07/09 18:27:03 | 000,000,448 | —- | M] () – C:\user.js
[2012/07/09 17:49:34 | 000,158,289 | —- | M] () – C:\Users\user\Desktop\Untitled-2-1.jpg
[2012/07/09 17:48:29 | 000,581,685 | —- | M] () – C:\Users\user\Desktop\Untitled-2.jpg
[2012/07/09 17:43:18 | 005,948,893 | —- | M] () – C:\Users\user\Desktop\Untitled-2.pdf
[2012/07/08 21:47:00 | 000,000,852 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3657083141-290413805-2333710366-1001Core.job
[2012/07/05 07:34:15 | 000,000,328 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForuser.job
[2012/07/03 08:56:42 | 005,183,715 | R— | M] () – C:\Users\user\Desktop\Dover Road Bi-Weekly Progress Report June 26 2012.pdf
[2012/06/30 19:10:25 | 000,002,356 | —- | M] () – C:\Users\user\Desktop\Google Chrome.lnk
[2012/06/28 16:34:26 | 000,000,021 | —- | M] () – C:\Windows\tpcsd
[2012/06/28 14:56:54 | 000,000,824 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2012/06/28 14:44:15 | 000,001,111 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/26 14:05:42 | 004,076,231 | —- | M] () – C:\Users\user\Documents\Untitled-1.psd
[2012/06/26 14:05:36 | 005,021,504 | —- | M] () – C:\Users\user\Documents\Table 1-4.pdf
[2012/06/26 14:05:36 | 000,994,840 | —- | M] () – C:\Users\user\Documents\Untitled-2.psd
[2012/06/26 10:37:56 | 000,106,010 | —- | M] () – C:\Users\user\Documents\Table 1 - 4.jpg
[2012/06/25 15:43:09 | 000,270,120 | —- | M] () – C:\Users\user\Documents\Incercare - table number_.psd
[2012/06/25 15:13:41 | 000,257,520 | —- | M] () – C:\Users\user\Documents\Incercare - table number.psd
[2012/06/25 13:51:29 | 002,737,182 | —- | M] () – C:\Users\user\Documents\incercarea 2.psd
[2012/06/25 13:46:25 | 000,288,089 | —- | M] () – C:\Users\user\Documents\incercarea 2.jpg
[2012/06/23 08:08:03 | 000,000,342 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForLOLLY-PC$.job
[2012/06/22 11:58:55 | 000,001,033 | —- | M] () – C:\Users\Public\Desktop\Adobe Download Assistant.lnk
[2012/06/22 11:19:18 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/06/22 11:19:18 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/06/14 14:06:44 | 007,833,563 | —- | M] () – C:\Users\user\Desktop\garnet pollard06142012_0000.pdf
[2012/06/13 13:19:24 | 001,063,669 | —- | M] () – C:\Users\user\Desktop\PDF13062012_00000.pdf
[2012/06/13 06:27:52 | 000,001,785 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/06/13 06:12:02 | 000,001,847 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
========== Files Created - No Company Name ==========
[2012/07/09 18:43:01 | 000,259,031 | —- | C] () – C:\Users\user\Desktop\Untitled-5_1.jpg
[2012/07/09 18:41:01 | 000,415,470 | —- | C] () – C:\Users\user\Desktop\Untitled-5.jpg
[2012/07/09 18:27:01 | 000,000,448 | —- | C] () – C:\user.js
[2012/07/09 17:49:34 | 000,158,289 | —- | C] () – C:\Users\user\Desktop\Untitled-2-1.jpg
[2012/07/09 17:48:25 | 000,581,685 | —- | C] () – C:\Users\user\Desktop\Untitled-2.jpg
[2012/07/09 17:43:13 | 005,948,893 | —- | C] () – C:\Users\user\Desktop\Untitled-2.pdf
[2012/07/04 01:23:22 | 000,000,328 | —- | C] () – C:\Windows\tasks\HPCeeScheduleForuser.job
[2012/07/03 08:58:33 | 005,183,715 | R— | C] () – C:\Users\user\Desktop\Dover Road Bi-Weekly Progress Report June 26 2012.pdf
[2012/06/28 16:34:26 | 000,000,021 | —- | C] () – C:\Windows\tpcsd
[2012/06/28 14:56:54 | 000,000,824 | —- | C] () – C:\Users\Public\Desktop\CCleaner.lnk
[2012/06/28 14:44:15 | 000,001,111 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/26 14:05:40 | 004,076,231 | —- | C] () – C:\Users\user\Documents\Untitled-1.psd
[2012/06/26 14:05:29 | 005,021,504 | —- | C] () – C:\Users\user\Documents\Table 1-4.pdf
[2012/06/26 11:01:54 | 000,994,840 | —- | C] () – C:\Users\user\Documents\Untitled-2.psd
[2012/06/26 10:37:52 | 000,106,010 | —- | C] () – C:\Users\user\Documents\Table 1 - 4.jpg
[2012/06/25 15:17:45 | 000,270,120 | —- | C] () – C:\Users\user\Documents\Incercare - table number_.psd
[2012/06/25 15:13:38 | 000,257,520 | —- | C] () – C:\Users\user\Documents\Incercare - table number.psd
[2012/06/25 13:51:28 | 002,737,182 | —- | C] () – C:\Users\user\Documents\incercarea 2.psd
[2012/06/25 13:46:25 | 000,288,089 | —- | C] () – C:\Users\user\Documents\incercarea 2.jpg
[2012/06/22 16:30:46 | 000,001,077 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk
[2012/06/22 16:30:25 | 000,001,209 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6.lnk
[2012/06/22 16:29:48 | 000,001,039 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk
[2012/06/22 16:29:33 | 000,001,171 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6.lnk
[2012/06/22 16:28:17 | 000,001,355 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk
[2012/06/22 16:28:14 | 000,001,521 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk
[2012/06/22 11:58:55 | 000,001,045 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Download Assistant.lnk
[2012/06/22 11:58:55 | 000,001,033 | —- | C] () – C:\Users\Public\Desktop\Adobe Download Assistant.lnk
[2012/06/15 10:09:04 | 000,033,216 | —- | C] () – C:\Users\user\Desktop\Riddle.ttf
[2012/06/14 14:06:43 | 007,833,563 | —- | C] () – C:\Users\user\Desktop\garnet pollard06142012_0000.pdf
[2012/06/13 10:14:29 | 001,063,669 | —- | C] () – C:\Users\user\Desktop\PDF13062012_00000.pdf
[2012/06/13 06:27:52 | 000,001,785 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/06/13 06:12:01 | 000,001,847 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2012/05/21 05:44:02 | 000,004,096 | -H– | C] () – C:\Users\user\AppData\Local\keyfile3.drm
[2012/01/22 01:25:20 | 000,000,848 | -HS- | C] () – C:\ProgramData\KGyGaAvL.sys
[2011/12/31 09:48:54 | 000,000,855 | —- | C] () – C:\Windows\Brpfx04a.ini
[2011/12/31 09:48:54 | 000,000,159 | —- | C] () – C:\Windows\brpcfx.ini
[2011/12/31 09:48:33 | 000,002,944 | —- | C] () – C:\Windows\BRPARAM.INI
[2011/12/31 09:44:21 | 000,000,066 | —- | C] () – C:\Windows\Brfaxrx.ini
[2011/12/31 09:44:21 | 000,000,000 | —- | C] () – C:\Windows\brdfxspd.dat
[2011/12/31 09:44:17 | 000,045,056 | —- | C] () – C:\Windows\SysWow64\BRTCPCON.DLL
[2011/12/31 09:44:14 | 000,000,114 | —- | C] () – C:\Windows\SysWow64\BRLMW03A.INI
[2011/12/14 14:07:24 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2011/10/21 18:27:54 | 000,963,116 | —- | C] () – C:\Windows\SysWow64\igkrng600.bin
[2011/10/21 18:27:54 | 000,217,536 | —- | C] () – C:\Windows\SysWow64\igfcg600m.bin
[2011/10/21 18:22:54 | 000,056,832 | —- | C] () – C:\Windows\SysWow64\igdde32.dll
[2011/10/21 18:03:04 | 013,903,872 | —- | C] () – C:\Windows\SysWow64\ig4icd32.dll
[2011/10/12 17:33:38 | 000,145,804 | —- | C] () – C:\Windows\SysWow64\igcompkrng600.bin
[2011/07/06 15:15:16 | 000,000,256 | R— | C] () – C:\Windows\SysWow64\DPSCEL.dll.hpsign
[2011/07/06 15:15:16 | 000,000,256 | R— | C] () – C:\Windows\SysWow64\DPFPApi.dll.hpsign
[2011/07/06 15:15:16 | 000,000,256 | R— | C] () – C:\Windows\SysWow64\DPClback.dll.hpsign
[2011/07/06 15:05:12 | 000,000,256 | R— | C] () – C:\Windows\SysWow64\DPPassFilter.dll.hpsign
[2011/07/06 15:05:12 | 000,000,256 | R— | C] () – C:\Windows\SysWow64\DPCrProv.dll.hpsign
[2011/07/06 15:05:08 | 000,000,256 | R— | C] () – C:\Windows\SysWow64\DPLic.dll.hpsign
[2011/07/06 14:55:34 | 000,000,256 | R— | C] () – C:\Windows\SysWow64\DPFPApiUI.dll.hpsign
[2011/05/09 16:43:26 | 000,366,136 | —- | C] () – C:\Windows\SysWow64\flcdlmsg.dll
[2011/02/11 14:29:00 | 000,774,812 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
========== LOP Check ==========
[2012/06/22 12:00:23 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2011/12/31 15:46:50 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\ControlCenter4
[2011/12/14 13:05:55 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\DigitalPersona
[2012/01/04 16:19:37 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\ICAClient
[2011/12/31 15:42:21 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\Nuance
[2012/01/16 11:48:24 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\PC-FAX TX
[2012/06/22 17:50:48 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012/07/10 07:55:04 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\uTorrent
[2012/02/03 19:35:55 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\WinBatch
[2011/12/31 15:42:23 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\Zeon
[2009/07/13 23:08:49 | 000,018,404 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.* >
[2011/02/11 14:13:06 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2012/07/10 06:37:34 | 3133,157,376 | -HS- | M] () – C:\hiberfil.sys
[2011/10/12 17:16:34 | 000,000,000 | RHS- | M] () – C:\OS
[2012/07/10 06:37:37 | 4177,543,168 | -HS- | M] () – C:\pagefile.sys
[2010/08/06 19:26:40 | 000,047,104 | -HS- | M] () – C:\Thumbs.db
[2012/07/09 18:27:03 | 000,000,448 | —- | M] () – C:\user.js
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
< %systemroot%\REPAIR\*.bak1 >
< %systemroot%\REPAIR\*.ini >
< %systemroot%\system32\*.jpg >
< %systemroot%\*.jpg >
< %systemroot%\*.png >
< %systemroot%\*.scr >
< %systemroot%\*._sy >
< %APPDATA%\Adobe\Update\*.* >
< %ALLUSERSPROFILE%\Favorites\*.* >
< %APPDATA%\Microsoft\*.* >
< %PROGRAMFILES%\*.* >
[2009/07/13 22:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini
< %APPDATA%\Update\*.* >
< %systemroot%\*. /mp /s >
< %systemroot%\System32\config\*.sav >
< %PROGRAMFILES%\bak. /s >
< %systemroot%\system32\bak. /s >
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
< %systemroot%\system32\config\systemprofile\*.dat /x >
< %systemroot%\*.config >
< %systemroot%\system32\*.db >
< %PROGRAMFILES%\Internet Explorer\*.dat >
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/12/14 13:32:00 | 000,000,221 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
< %USERPROFILE%\Desktop\*.exe >
< %PROGRAMFILES%\Common Files\*.* >
< %systemroot%\*.src >
< %systemroot%\install\*.* >
< %systemroot%\system32\DLL\*.* >
< %systemroot%\system32\HelpFiles\*.* >
< %systemroot%\system32\rundll\*.* >
< %systemroot%\winn32\*.* >
< %systemroot%\Java\*.* >
< %systemroot%\system32\test\*.* >
< %systemroot%\system32\Rundll32\*.* >
< %systemroot%\AppPatch\Custom\*.* >
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< %appdata%\Microsoft\Windows\Start Menu\*.* /s >
[2012/02/15 06:41:24 | 000,000,174 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
[2012/02/15 06:41:24 | 000,000,476 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
[2011/12/14 13:12:24 | 000,001,411 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2011/12/14 13:12:24 | 000,001,445 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2009/07/13 22:54:27 | 000,001,280 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk
[2009/07/13 22:54:32 | 000,000,678 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini
[2009/07/13 22:54:32 | 000,001,304 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk
[2009/07/13 22:49:38 | 000,000,262 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Run.lnk
[2009/07/13 22:49:38 | 000,001,228 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk
[2009/07/13 22:54:02 | 000,000,704 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini
[2009/07/13 22:54:01 | 000,001,358 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk
[2009/07/13 22:54:00 | 000,001,258 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk
[2009/07/13 22:54:02 | 000,001,262 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk
[2009/07/13 22:54:00 | 000,001,250 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk
[2009/07/13 22:49:38 | 000,000,262 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\computer.lnk
[2009/07/13 22:49:38 | 000,000,262 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Control Panel.lnk
[2011/12/14 13:12:24 | 000,000,738 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini
[2011/12/14 13:12:24 | 000,001,495 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
[2009/07/13 22:54:59 | 000,001,306 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk
[2012/02/15 06:41:24 | 000,000,174 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
[2012/06/30 19:10:25 | 000,002,370 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
[2012/06/30 19:10:25 | 000,002,482 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Uninstall Google Chrome.lnk
[2009/07/13 22:49:38 | 000,000,318 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini
[2009/07/13 22:49:38 | 000,000,262 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Help.lnk
[2012/02/15 06:41:24 | 000,000,174 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
[2012/03/03 09:17:40 | 000,000,994 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk
[2012/03/03 09:17:40 | 000,001,013 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk
[2012/03/03 09:17:40 | 000,001,013 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk
< %programdata%\Microsoft\Windows\Start Menu\*.* /s >
[2009/07/13 23:01:14 | 000,001,282 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
[2009/07/13 23:01:14 | 000,000,442 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini
[2011/12/14 14:07:57 | 000,002,599 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\New Office Document.lnk
[2011/12/14 14:07:57 | 000,002,609 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Open Office Document.lnk
[2011/12/31 09:41:05 | 000,001,868 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Software Updates.lnk
[2011/10/12 17:48:53 | 000,002,358 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Theft Recovery.lnk
[2009/07/13 22:49:40 | 000,001,266 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
[2012/01/16 18:50:27 | 000,000,951 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\µTorrent.lnk
[2011/12/14 14:54:47 | 000,002,465 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Distiller 9.lnk
[2011/12/14 14:54:30 | 000,002,270 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe 3D Reviewer.lnk
[2011/12/14 14:54:47 | 000,002,471 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat 9 Pro Extended.lnk
[2012/06/22 16:29:48 | 000,001,039 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk
[2012/06/22 16:29:33 | 000,001,171 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6.lnk
[2012/06/22 11:58:56 | 000,001,045 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Download Assistant.lnk
[2012/06/22 16:28:14 | 000,001,521 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk
[2012/06/22 16:28:17 | 000,001,355 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk
[2011/12/14 14:54:30 | 000,002,173 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle Designer ES 8.2.lnk
[2012/06/22 16:30:46 | 000,001,077 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk
[2012/06/22 16:30:25 | 000,001,209 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6.lnk
[2012/01/04 16:26:34 | 000,002,519 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2011/10/12 18:03:04 | 000,001,130 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
[2011/10/12 17:49:11 | 000,002,499 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Install Embedded Security for HP ProtectTools.lnk
[2011/10/12 17:47:19 | 000,002,359 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Install HP Power Assistant.lnk
[2011/02/11 14:17:43 | 000,001,345 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012/05/15 07:45:50 | 000,002,503 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Safari.lnk
[2009/07/13 22:57:08 | 000,001,330 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2011/10/12 17:42:52 | 000,001,854 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SRS Audio Control Panel.lnk
[2011/12/14 13:06:08 | 000,001,817 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Warranty.lnk
[2009/07/13 22:57:09 | 000,001,352 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2011/02/11 14:17:43 | 000,001,326 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2009/07/13 22:54:59 | 000,001,210 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2011/10/12 18:03:04 | 000,001,547 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2009/07/13 22:57:08 | 000,001,246 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2009/07/13 22:55:00 | 000,001,230 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk
[2011/02/11 14:17:43 | 000,001,854 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini
[2009/07/13 22:54:23 | 000,001,266 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk
[2011/02/11 14:17:43 | 000,001,364 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Math Input Panel.lnk
[2011/02/11 14:17:29 | 000,001,238 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Mobility Center.lnk
[2011/02/11 14:17:29 | 000,001,242 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\NetworkProjection.lnk
[2009/07/13 22:54:32 | 000,001,242 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk
[2009/07/13 22:53:55 | 000,001,367 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk
[2011/02/11 14:17:36 | 000,001,272 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk
[2009/07/13 22:57:08 | 000,001,330 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sound Recorder.lnk
[2011/02/11 14:17:30 | 000,001,351 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk
[2009/07/13 22:54:58 | 000,001,254 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sync Center.lnk
[2009/07/13 22:57:09 | 000,001,579 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk
[2009/07/13 22:54:58 | 000,001,322 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Wordpad.lnk
[2009/07/13 22:57:07 | 000,000,370 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini
[2009/07/13 22:57:07 | 000,001,388 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Speech Recognition.lnk
[2009/07/13 22:55:00 | 000,001,248 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk
[2009/07/13 22:57:09 | 000,001,338 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini
[2009/07/13 22:54:25 | 000,001,290 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\dfrgui.lnk
[2009/07/13 22:54:58 | 000,001,252 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Disk Cleanup.lnk
[2009/07/13 22:53:50 | 000,001,242 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Resource Monitor.lnk
[2009/07/13 22:53:33 | 000,001,250 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\System Information.lnk
[2009/07/13 22:54:57 | 000,001,246 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\System Restore.lnk
[2009/07/13 22:54:29 | 000,001,268 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Task Scheduler.lnk
[2009/07/13 22:57:09 | 000,001,320 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer Reports.lnk
[2009/07/13 22:57:09 | 000,001,316 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer.lnk
[2011/02/11 14:17:33 | 000,000,343 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini
[2011/02/11 14:17:33 | 000,001,436 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\ShapeCollector.lnk
[2011/02/11 14:17:33 | 000,001,386 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\TabTip.lnk
[2011/02/11 14:17:30 | 000,001,316 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Windows Journal.lnk
[2009/07/13 22:57:13 | 000,000,216 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini
[2009/07/13 23:32:31 | 000,001,989 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell (x86).lnk
[2009/07/13 22:57:13 | 000,001,468 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell ISE (x86).lnk
[2009/07/13 22:57:13 | 000,001,468 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell ISE.lnk
[2009/07/13 23:32:31 | 000,001,899 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
[2009/07/13 22:57:13 | 000,001,242 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk
[2009/07/13 22:54:21 | 000,001,294 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk
[2009/07/13 22:53:52 | 000,001,270 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Data Sources (ODBC).lnk
[2011/02/11 14:17:36 | 000,001,958 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
[2009/07/13 22:54:29 | 000,001,298 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk
[2009/07/13 22:54:22 | 000,001,274 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk
[2009/07/13 22:53:33 | 000,001,268 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk
[2009/07/13 22:53:50 | 000,001,232 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Performance Monitor.lnk
[2011/02/11 14:17:26 | 000,001,262 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Print Management.lnk
[2011/02/11 14:17:36 | 000,001,248 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Security Configuration Management.lnk
[2009/07/13 22:54:05 | 000,001,288 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009/07/13 22:53:33 | 000,001,246 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk
[2009/07/13 22:54:29 | 000,001,262 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk
[2009/07/13 22:53:58 | 000,001,274 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows Firewall with Advanced Security.lnk
[2009/07/13 23:32:31 | 000,002,741 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows PowerShell Modules.lnk
[2011/12/31 09:49:14 | 000,000,078 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\Brother Creative Center.url
[2011/12/31 09:49:06 | 000,002,007 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\ControlCenter4.lnk
[2011/12/31 09:49:10 | 000,002,073 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\Installation Diagnostics.lnk
[2011/12/31 09:49:12 | 000,000,102 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\On-line help and FAQ's.url
[2011/12/31 09:49:11 | 000,002,231 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\On-Line Registration.lnk
[2011/12/31 09:49:09 | 000,002,056 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\Read Me.lnk
[2011/12/31 09:49:05 | 000,002,085 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\Remote Setup.lnk
[2011/12/31 09:49:07 | 000,002,137 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\Status Monitor.lnk
[2011/12/31 09:49:08 | 000,002,469 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\UnInstall.lnk
[2011/12/31 09:49:13 | 000,000,102 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\User's Guides in PDF format.url
[2011/12/31 09:49:03 | 000,002,104 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\PC-FAX Receiving\How to use PC-FAX Receiving.lnk
[2011/12/31 09:49:04 | 000,002,076 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\PC-FAX Receiving\Receive.lnk
[2011/12/31 09:49:00 | 000,002,118 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\PC-FAX Sending\How to use PC-FAX Sending.lnk
[2011/12/31 09:49:01 | 000,002,075 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\PC-FAX Sending\PC-FAX Address Book.lnk
[2011/12/31 09:49:02 | 000,002,058 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\PC-FAX Sending\PC-FAX Setup.lnk
[2011/12/31 09:49:10 | 000,002,055 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\Scanner Settings\Read Me.lnk
[2011/12/31 09:49:10 | 000,002,055 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\Scanner Settings\Scanner Utility.lnk
[2011/12/31 09:49:10 | 000,001,866 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\Scanner Settings\Scanners and Cameras.lnk
[2012/06/28 14:56:54 | 000,000,082 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner Homepage.url
[2012/06/28 14:56:54 | 000,000,842 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner.lnk
[2012/06/28 14:56:54 | 000,000,603 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\Uninstall CCleaner.lnk
[2011/12/14 13:06:19 | 000,000,081 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eReaders and Document Viewers\desktop.ini
[2010/11/21 01:16:53 | 000,000,520 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini
[2009/07/13 22:54:59 | 000,000,258 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\GameExplorer.lnk
[2011/12/14 13:06:19 | 000,000,170 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support\desktop.ini
[2012/02/03 19:37:59 | 000,002,199 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support\HP Support Assistant.lnk
[2009/11/10 15:55:10 | 000,001,707 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support\HP support information.lnk
[2011/12/14 13:05:59 | 000,001,867 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP User Manuals\Getting Started.lnk
[2011/12/14 13:06:03 | 000,001,892 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP User Manuals\Hardware Reference Guide.lnk
[2011/12/14 13:06:01 | 000,001,874 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP User Manuals\HP ProtectTools.lnk
[2011/12/14 13:06:06 | 000,001,885 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP User Manuals\Safety and Comfort Guide.lnk
[2011/12/14 13:06:06 | 000,001,903 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP User Manuals\Safety and Regulatory Information.lnk
[2011/10/12 17:41:31 | 000,000,210 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\desktop.ini
[2011/10/12 17:41:31 | 000,001,474 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP ProtectTools Administrative Console.lnk
[2011/10/12 17:41:31 | 000,001,469 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP ProtectTools Security Manager.lnk
[2011/10/12 17:46:44 | 000,002,240 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HPCA_Preload\HP CA Management Agent Install.lnk
[2011/10/12 17:46:44 | 000,002,254 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HPCA_Preload\HP CA Management Agent Readme EN.lnk
[2011/10/12 17:46:44 | 000,002,254 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HPCA_Preload\HP CA Management Agent Readme FR.lnk
[2011/10/12 17:46:44 | 000,002,254 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HPCA_Preload\HP CA Management Agent Readme GR.lnk
[2011/10/12 17:46:44 | 000,002,254 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HPCA_Preload\HP CA Management Agent Readme IT.lnk
[2011/10/12 17:46:44 | 000,002,254 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HPCA_Preload\HP CA Management Agent Readme JP.lnk
[2011/10/12 17:46:44 | 000,002,254 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HPCA_Preload\HP CA Management Agent Readme SP.lnk
[2011/10/12 17:46:44 | 000,002,402 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HPCA_Preload\HPCA-RMA.lnk
[2011/10/12 17:48:01 | 000,000,103 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel\desktop.ini
[2011/10/12 17:48:01 | 000,001,426 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel\Intel Control Center.lnk
[2011/10/12 17:47:57 | 000,000,217 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel\Intel® Management Engine Components\desktop.ini
[2011/10/12 17:47:57 | 000,001,673 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel\Intel® Management Engine Components\Intel® Management and Security Status.lnk
[2012/06/13 06:27:52 | 000,002,107 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\About iTunes.lnk
[2012/06/13 06:27:52 | 000,001,803 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\iTunes.lnk
[2009/07/13 22:57:07 | 000,001,304 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Backup and Restore Center.lnk
[2009/07/13 22:57:07 | 000,001,248 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Create Recovery Disc.lnk
[2009/07/13 22:57:09 | 000,000,606 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini
[2009/07/13 22:57:09 | 000,001,212 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Remote Assistance.lnk
[2012/06/28 14:44:15 | 000,001,129 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware Help.lnk
[2012/06/28 14:44:15 | 000,001,129 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware.lnk
[2012/06/28 14:44:15 | 000,001,153 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Uninstall Malwarebytes Anti-Malware.lnk
[2012/06/28 14:44:15 | 000,001,302 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk
[2011/12/14 14:06:52 | 000,002,643 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Access 2003.lnk
[2011/12/14 14:06:52 | 000,002,677 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Excel 2003.lnk
[2011/12/14 14:06:52 | 000,002,695 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office InfoPath 2003.lnk
[2011/12/14 14:06:52 | 000,002,693 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Outlook 2003.lnk
[2011/12/14 14:06:52 | 000,002,645 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office PowerPoint 2003.lnk
[2011/12/14 14:07:57 | 000,002,651 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Project 2003.lnk
[2011/12/14 14:06:52 | 000,002,611 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Publisher 2003.lnk
[2011/12/14 14:08:50 | 000,002,563 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Visio 2003.lnk
[2011/12/14 14:06:52 | 000,002,675 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Word 2003.lnk
[2011/12/14 14:08:50 | 000,002,647 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Digital Certificate for VBA Projects.lnk
[2011/12/14 14:08:50 | 000,002,627 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Clip Organizer.lnk
[2011/12/14 14:08:50 | 000,002,527 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office 2003 Language Settings.lnk
[2011/12/14 14:08:50 | 000,002,547 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office 2003 Save My Settings Wizard.lnk
[2011/12/14 14:06:52 | 000,002,645 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Access Snapshot Viewer.lnk
[2011/12/14 14:08:50 | 000,002,501 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Application Recovery.lnk
[2011/12/14 14:06:52 | 000,002,797 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Document Imaging.lnk
[2011/12/14 14:06:52 | 000,002,799 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Document Scanning.lnk
[2011/12/14 14:06:52 | 000,002,603 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Picture Manager.lnk
[2011/12/14 14:07:57 | 000,002,717 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Project Server Accounts.lnk
[2011/10/12 17:47:39 | 000,002,270 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight\Microsoft Silverlight.lnk
[2011/12/31 09:41:05 | 000,001,935 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nuance PaperPort 12\ImageViewer.lnk
[2011/12/31 09:41:05 | 000,001,999 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nuance PaperPort 12\PaperPort.lnk
[2011/12/31 09:42:41 | 000,001,102 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nuance PaperPort 12\PDF Viewer Plus.lnk
[2011/12/31 09:41:05 | 000,002,095 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nuance PaperPort 12\Scanner Setup Wizard.lnk
[2011/12/14 14:16:24 | 000,001,265 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook Connector for MDaemon Plug-in\License Agreement.lnk
[2011/12/14 14:16:24 | 000,001,312 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook Connector for MDaemon Plug-in\Outlook Connector Plug-in User's Manual.lnk
[2011/12/14 14:16:24 | 000,001,272 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook Connector for MDaemon Plug-in\Registration File.lnk
[2011/12/14 14:16:24 | 000,001,272 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook Connector for MDaemon Plug-in\Release Notes.lnk
[2011/12/14 14:16:24 | 000,001,260 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook Connector for MDaemon Plug-in\Uninstall Outlook Connector for MDaemon Plug-in.lnk
[2011/10/12 17:40:52 | 000,001,273 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Help & Tools\HP Vision Diagnostics Disc Creation.lnk
[2011/12/14 13:06:19 | 000,000,081 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Productivity and Tools\desktop.ini
[2012/06/13 06:12:01 | 000,002,441 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime\About QuickTime.lnk
[2012/06/13 06:12:01 | 000,002,471 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime\PictureViewer.lnk
[2012/06/13 06:12:01 | 000,002,441 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime\QuickTime Player.lnk
[2012/06/13 06:12:02 | 000,001,818 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime\Uninstall QuickTime.lnk
[2011/10/12 17:45:42 | 000,000,288 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recovery Manager\desktop.ini
[2011/10/12 17:45:42 | 000,002,119 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recovery Manager\Recovery Disc Creation.lnk
[2011/10/12 17:45:42 | 000,002,129 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recovery Manager\Recovery Manager.lnk
[2012/03/16 06:25:23 | 000,002,533 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype\Skype.lnk
[2009/07/13 22:54:24 | 000,000,174 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
[2011/12/14 15:01:18 | 000,001,467 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Symantec Endpoint Protection\Symantec Endpoint Protection Help.lnk
[2011/12/14 15:01:17 | 000,001,353 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Symantec Endpoint Protection\Symantec Endpoint Protection.lnk
[2012/01/17 07:42:27 | 000,001,142 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Documentation.lnk
[2012/01/17 07:42:27 | 000,001,093 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Release Notes.lnk
[2012/01/17 07:42:27 | 000,001,182 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Reset VLC media player preferences and cache files.lnk
[2012/01/17 07:42:27 | 000,001,157 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VideoLAN Website.lnk
[2012/01/17 07:42:27 | 000,001,102 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player skinned.lnk
[2012/01/17 07:42:27 | 000,001,086 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player.lnk
[2011/10/12 17:37:05 | 000,000,266 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Virtual PC\desktop.ini
[2011/10/12 17:37:04 | 000,001,401 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Virtual PC\Virtual Machines.lnk
[2011/10/12 17:37:05 | 000,001,523 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Virtual PC\Virtual Windows XP.lnk
[2012/03/03 09:17:40 | 000,000,976 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk
[2012/03/03 09:17:40 | 000,000,995 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk
[2012/03/03 09:17:40 | 000,000,995 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk
[2011/10/12 17:47:11 | 000,002,336 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip\WinZip 15.0.lnk
< End of report >
Extras.txt
OTL Extras logfile created on: 7/10/2012 7:51:12 AM - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\user\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.89 Gb Total Physical Memory | 1.99 Gb Available Physical Memory | 51.21% Memory free
7.78 Gb Paging File | 5.71 Gb Available in Paging File | 73.37% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 455.87 Gb Total Space | 402.97 Gb Free Space | 88.39% Space Free | Partition Type: NTFS
Drive D: | 9.79 Gb Total Space | 1.20 Gb Free Space | 12.28% Space Free | Partition Type: NTFS
Computer Name: LOLLY-PC | User Name: user | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [Bridge] – C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [Bridge] – C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00FCF189-3DA0-4C0B-9F7B-6DFAF76836E3}" = lport=137 | protocol=17 | dir=in | app=system |
"{026B28DB-23DA-41D3-9E1E-798B8EBC6CF7}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{10C4A4DC-DC10-4D70-8DEE-4B5D2B3B2248}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{4B30BD22-876B-42A4-BA06-1E04F3155059}" = rport=137 | protocol=17 | dir=out | app=system |
"{5C9CE510-EF96-41CF-B1D1-9CA8EADEBF01}" = lport=139 | protocol=6 | dir=in | app=system |
"{753C413B-484F-49FF-8FE0-D186C86A48A2}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{883B9B0C-7746-4735-8162-28700006E4F9}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{943BA433-585C-43E1-9E6E-CEEAD1B90270}" = lport=445 | protocol=6 | dir=in | app=system |
"{98061B86-6C65-40DC-B044-75D92969C98B}" = rport=138 | protocol=17 | dir=out | app=system |
"{A44CCA03-676E-4032-944C-673655BC72C3}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AA09BAB6-44E6-4BB3-B483-D346114690E6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AA8DB21C-B124-489E-BA10-E12EF4014D7C}" = rport=139 | protocol=6 | dir=out | app=system |
"{BF5BEA1C-8A50-44D6-B095-F9F0C1523695}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{EE9077CF-439E-4125-8D1B-70B115B3C77D}" = lport=138 | protocol=17 | dir=in | app=system |
"{F1CCB519-AC7C-4ECD-8515-48B04086CDD1}" = rport=445 | protocol=6 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07C35E4A-8224-4F0A-B6BF-036AF54D09B3}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{13FB5996-9B8D-4588-9AD3-1A58157F6F96}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{1D75FF70-9674-4047-9965-24BD54B0FD4B}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{2CE9A091-D833-4DCE-9E3A-0B8E388BABFF}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{4102B6A2-D554-4F9C-B12E-02C8325F785C}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{59D45492-1528-4DD7-B13D-AD6116E82949}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{5AEB75A3-0900-41B1-A49D-B5FE6BD6A84A}" = protocol=6 | dir=in | app=c:\program files (x86)\symantec\symantec endpoint protection\12.1.1000.157.105\bin64\smc.exe |
"{83793826-FABB-4206-8975-0F0946DFBA64}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{89DFD712-7C20-4A22-AD02-567F9C45DF33}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{9B7E5BBC-CFFA-4F7E-86C3-02BC7FB85959}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{9BE4B3DB-D2C0-43F1-9C02-A1D0285193DA}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{AD390CDF-A617-4BE6-BC9F-D6F337B44FC9}" = protocol=17 | dir=in | app=c:\program files (x86)\symantec\symantec endpoint protection\12.1.1000.157.105\bin64\snac64.exe |
"{B459DA82-D6B0-4CB6-8CDA-48CFDAED530B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{B5989C53-F975-4B3B-8346-5AA440CF294D}" = protocol=6 | dir=in | app=c:\program files (x86)\symantec\symantec endpoint protection\12.1.1000.157.105\bin64\snac64.exe |
"{D6B1A2E8-77C3-4E90-8CE1-1032335DD234}" = protocol=17 | dir=in | app=c:\program files (x86)\symantec\symantec endpoint protection\12.1.1000.157.105\bin64\smc.exe |
"{DA49DCB5-1A18-4227-B106-4947E13FA9B3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F814B082-AC73-4B7D-AFF6-410FA89047F7}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{19B62EDC-C108-4393-B3F1-8A813096CC8E}" = Symantec Endpoint Protection
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{336D0C35-8A85-403a-B9D2-65C292C39087}_is1" = Web Assistant 2.0.0.462
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5476AB75-E584-4497-80AF-7F205D8F6F54}" = Privacy Manager for HP ProtectTools
"{55B52830-024A-443E-AF61-61E1E71AFA1B}" = Device Access Manager for HP ProtectTools
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}" = PaperPort Image Printer 64-bit
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}" = iTunes
"{847B4A60-5D82-45E8-BE7A-327F09325FF4}" = HP ProtectTools Security Manager
"{8A0041CD-277C-4C1F-BFE4-7AC508B20B4C}" = Drive Encryption For HP ProtectTools
"{8B485965-8EFE-464A-842F-CF8F18C3DFD7}" = iCloud
"{8C9B6B1F-0A8E-402A-A60C-110BBB38D67E}" = Intel® Network Connections [removed]
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{AC76BA86-1033-0000-0064-0003D0000004}" = Adobe Acrobat 9 Pro Extended 64-bit Add-On
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{CC4D56B7-6F18-470B-8734-ABCD75BCF4F1}" = HP Auto
"{D79A02E9-6713-4335-9668-AAC7474C0C0E}" = HP Vision Hardware Diagnostics
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"HPProtectTools" = HP ProtectTools Security Manager
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"PROSetDX" = Intel® Network Connections 15.7.176.0
"WinRAR archiver" = WinRAR 4.00 (64-bit)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05BA6A83-C7A7-4F85-88F1-150142305229}" = HP Setup
"{068724F8-D8BE-4B43-8DDD-B9FE9E49FD76}" = Scansoft PDF Professional
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0BCA9EFD-F2D6-4638-B053-8693BA0404BE}" = Citrix online plug-in (Web)
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{17795164-3BC1-4D4F-8ADA-65C895EBFC9A}" = Brother MFL-Pro Suite MFC-J6910DW
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{28656860-4728-433C-8AD4-D1A930437BC8}" = Nuance PDF Viewer Plus
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = Recovery Manager
"{55392E52-1AAD-44C4-BE49-258FFE72434F}" = Citrix online plug-in (USB)
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{65CB4C08-C47B-4A7E-A6A4-50C06ADA5FC6}" = Adobe AIR
"{6C0A559F-8583-4B5A-8B50-20BEE15D8E64}" = Nuance PaperPort 12
"{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}" = File Sanitizer For HP ProtectTools
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.1.2.0
"{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}" = HP Support Assistant
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}" = Adobe Photoshop CS6
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{812424AC-A8B5-44E6-8D48-07E939D1AD9A}" = Citrix online plug-in (HDX)
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DC069E7-893C-41E1-9442-DE89FEC33371}" = Xobni Core
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{903B0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Project Professional 2003
"{90510409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Visio Professional 2003
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9866E5F0-121F-E018-E2D1-2E1770847ABF}" = Adobe Download Assistant
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AC76BA86-1033-F400-7761-000000000004}_920" = Adobe Acrobat 9.2.0 - CPSID_50026
"{AC76BA86-1033-F400-7761-000000000004}{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{ADC70B7A-530B-46E3-8384-48D22681A41E}" = Theft Recovery for HP ProtectTools
"{B2B7B1C8-7C8B-476C-BE2C-049731C55992}" = HP Support Information
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B8AC1A89-FFD1-4F97-8051-E505A160F562}" = HP Odometer
"{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}" = PDF Settings CS6
"{C01A86F5-56E7-101F-9BC9-E3F1025EB779}" = Intel® Identity Protection Technology 1.1.2.0
"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240C1}" = WinZip 15.0
"{CF53CF7C-D996-43EB-9904-DBED57C25625}" = Citrix online plug-in (DV)
"{DF2035BE-5820-4965-BD97-7FAF8D4A7879}" = Microsoft_VC90_CRT_x86
"{E9E34215-82EF-4909-BE2F-F581F0DC9062}" = DirectX for Managed Code Update (Summer 2004)
"{EDA5714F-352C-4AD5-A47B-B6BA8046B75F}" = ACSA Audit
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Processor Graphics
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel® Control Center
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"CitrixOnlinePluginPackWeb" = Citrix online plug-in - web
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"InstallShield_{ADC70B7A-530B-46E3-8384-48D22681A41E}" = Theft Recovery for HP ProtectTools
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"Outlook Connector for MDaemon Plug-in" = Outlook Connector for MDaemon Plug-in
"uTorrent" = µTorrent
"VIP Access SDK" = VIP Access SDK (1.0.1.4)
"VLC media player" = VLC media player 1.1.11
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 6/8/2012 2:36:57 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
Error - 6/8/2012 3:34:49 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
Error - 6/9/2012 2:52:00 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
Error - 6/10/2012 2:32:57 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
Error - 6/10/2012 3:44:50 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
Error - 6/11/2012 3:35:54 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
Error - 6/12/2012 2:31:34 AM | Computer Name = Lolly-PC | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Program Files (x86)\Adobe\Acrobat
9.0\Designer 8.2\FormDesigner.exe".Error in manifest or policy file "" on line
. A component version required by the application conflicts with another component
version already active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error - 6/12/2012 3:39:18 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
Error - 6/12/2012 3:47:55 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
Error - 6/13/2012 3:32:22 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
[ System Events ]
Error - 7/6/2012 7:56:55 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:02:05 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:07:15 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:12:25 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:17:35 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:22:45 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:27:55 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:33:05 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:38:16 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:43:26 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
< End of report >
I have vGrabber toolbar on my computer and I can't get rid of it. I have tried to delete it/uninstall, but now I can't even find it on the computer. I have read many post in different forums until I found your forum, now I have some hope, because on one of your older posts you helped another "victim" to clean his computer from this "computer disease". Please help, I would really appreciate it!
I Downloaded and run OTL and Run aswMBR, followed the steps you described. Bellow you will find the Logs.
OTL.txt
OTL logfile created on: 7/10/2012 7:51:12 AM - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\user\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.89 Gb Total Physical Memory | 1.99 Gb Available Physical Memory | 51.21% Memory free
7.78 Gb Paging File | 5.71 Gb Available in Paging File | 73.37% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 455.87 Gb Total Space | 402.97 Gb Free Space | 88.39% Space Free | Partition Type: NTFS
Drive D: | 9.79 Gb Total Space | 1.20 Gb Free Space | 12.28% Space Free | Partition Type: NTFS
Computer Name: LOLLY-PC | User Name: user | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\user\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Web Assistant\ExtensionUpdaterService.exe ()
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
PRC - C:\Program Files (x86)\uTorrent\uTorrent.exe (BitTorrent, Inc.)
PRC - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe ()
PRC - C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe ()
PRC - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe (DigitalPersona, Inc.)
PRC - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe (Hewlett-Packard)
PRC - c:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe (Hewlett-Packard)
PRC - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe (Brother Industries, Ltd.)
PRC - C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe (Brother Industries, Ltd.)
PRC - C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.)
PRC - C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
PRC - C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
PRC - C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe (Nuance Communications, Inc.)
PRC - C:\Program Files (x86)\Browny02\BrYNSvc.exe (Brother Industries, Ltd.)
PRC - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
PRC - C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe (Citrix Systems, Inc.)
PRC - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard)
========== Modules (No Company Name) ==========
MOD - C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\ppgooglenaclpluginchrome.dll ()
MOD - C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\pdf.dll ()
MOD - C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\libglesv2.dll ()
MOD - C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\libegl.dll ()
MOD - C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\avutil-51.dll ()
MOD - C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\avformat-54.dll ()
MOD - C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\avcodec-54.dll ()
MOD - C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\gcswf32.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe ()
MOD - C:\Windows\SysWOW64\flcdlmsg.dll ()
MOD - C:\Program Files (x86)\ControlCenter4\BrImgProc.dll ()
MOD - C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll ()
========== Win32 Services (SafeList) ==========
SRV:64bit: - (Web Assistant Updater) – C:\Program Files\Web Assistant\ExtensionUpdaterService.exe ()
SRV:64bit: - (McAfee Endpoint Encryption Agent) – C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe ()
SRV:64bit: - (DpHost) – c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe (DigitalPersona, Inc.)
SRV:64bit: - (Intel® PROSet Monitoring Service) Intel® – C:\Windows\SysNative\IPROSetMonitor.exe (Intel Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (SmcService) – C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\Smc.exe (Symantec Corporation)
SRV - (SNAC) – C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\snac64.exe (Symantec Corporation)
SRV - (SepMasterService) – C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe (Symantec Corporation)
SRV - (HP Support Assistant Service) – C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company)
SRV - (HPFSService) – c:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe (Hewlett-Packard)
SRV - (HPDrvMntSvc.exe) – C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Company)
SRV - (FLCDLOCK) – c:\Windows\SysWOW64\flcdlock.exe (Hewlett-Packard Company)
SRV - (jhi_service) Intel® – C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe (Intel Corporation)
SRV - (UNS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (PDFProFiltSrvPP) – C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
SRV - (SwitchBoard) – C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (BrYNSvc) – C:\Program Files (x86)\Browny02\BrYNSvc.exe (Brother Industries, Ltd.)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (SymEvent) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (pmxdrv) – C:\Windows\SysNative\drivers\pmxdrv.sys ()
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (vpcvmm) – C:\Windows\SysNative\drivers\vpcvmm.sys (Microsoft Corporation)
DRV:64bit: - (vpcbus) – C:\Windows\SysNative\drivers\vpchbus.sys (Microsoft Corporation)
DRV:64bit: - (vpcusb) – C:\Windows\SysNative\drivers\vpcusb.sys (Microsoft Corporation)
DRV:64bit: - (vpcnfltr) – C:\Windows\SysNative\drivers\vpcnfltr.sys (Microsoft Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (SymIRON) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\Ironx64.sys (Symantec Corporation)
DRV:64bit: - (SYMNETS) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\symnets.sys (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\SymEFA64.sys (Symantec Corporation)
DRV:64bit: - (Teefer2) – C:\Windows\SysNative\drivers\Teefer.sys (Symantec Corporation)
DRV:64bit: - (Netaapl) – C:\Windows\SysNative\drivers\netaapl64.sys (Apple Inc.)
DRV:64bit: - (MfeEpeOpal) – C:\Windows\SysNative\drivers\MfeEpeOpal.sys (McAfee, Inc.)
DRV:64bit: - (MfeEpePc) – C:\Windows\SysNative\drivers\MfeEpePc.sys (McAfee, Inc.)
DRV:64bit: - (e1cexpress) Intel® – C:\Windows\SysNative\drivers\e1c62x64.sys (Intel Corporation)
DRV:64bit: - (SymDS) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\SymDS64.sys (Symantec Corporation)
DRV:64bit: - (DAMDrv) – C:\Windows\SysNative\drivers\DAMDrv64.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) – C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (MEIx64) Intel® – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) Intel® – C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (IFCoEVB) – C:\Windows\SysNative\drivers\ifP52x64.sys (Intel® Corporation)
DRV:64bit: - (IFCoEMP) – C:\Windows\SysNative\drivers\ifM52x64.sys (Intel® Corporation)
DRV:64bit: - (Impcd) – C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (BrSerIb) Brother Serial Interface Driver(WDM) – C:\Windows\SysNative\drivers\BrSerIb.sys (Brother Industries Ltd.)
DRV:64bit: - (BrUsbSIb) Brother Serial USB Driver(WDM) – C:\Windows\SysNative\drivers\BrUsbSib.sys (Brother Industries Ltd.)
DRV:64bit: - (ctxusbm) – C:\Windows\SysNative\drivers\ctxusbm.sys (Citrix Systems, Inc.)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (TPM) – C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (netr28ux) – C:\Windows\SysNative\drivers\netr28ux.sys (Ralink Technology Corp.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (WDC_SAM) – C:\Windows\SysNative\drivers\wdcsam64.sys (Western Digital Technologies)
DRV - (IDSVia64) – C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\IPSDefs\20120705.002\IDSviA64.sys (Symantec Corporation)
DRV - (BHDrvx64) – C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\BASHDefs\20120620.012\BHDrvx64.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\VirusDefs\20120709.003\ex64.sys (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\VirusDefs\20120709.003\eng64.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPCOM/19
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPCOM/19
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://search.ask.com/web?q={searchterms}&…is&o;=CMDTDF
IE:64bit: - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=CMDTDF
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPCOM/19
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPCOM/19
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://search.ask.com/web?q={searchterms}&…is&o;=CMDTDF
IE - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=CMDTDF
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPCOM/19
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredibar.com/mb167?a=6R8yvYfAqS&i;=26
IE - HKCU\..\URLSearchHook: {b2ed7faf-72a0-46d1-9d9d-602226f5cb9f} - No CLSID value found
IE - HKCU\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://search.ask.com/web?q={searchterms}&…is&o;=CMDTDF
IE - HKCU\..\SearchScopes\{A1335A65-16DD-4275-ABDF-99A6DBAE777F}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT3059010
IE - HKCU\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=CMDTDF
IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredibar.com/mb167/?searc…vYfAqS&i;=26
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\user\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\user\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX [2012/07/09 18:26:40 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\ [2011/10/12 17:41:26 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\IPSFFPlgn\ [2012/07/10 06:38:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012/07/09 18:26:40 | 000,000,000 | —D | M]
[2012/01/16 18:30:44 | 000,000,000 | —D | M] (No name found) – C:\Users\user\AppData\Roaming\Mozilla\Firefox\extensions
[2012/01/16 18:30:44 | 000,000,000 | —D | M] (uTorrentBar Community Toolbar) – C:\Users\user\AppData\Roaming\Mozilla\Firefox\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2012/07/09 18:27:00 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
========== Chrome ==========
CHR - default_search_provider: MyStart Search (Enabled)
CHR - default_search_provider: search_url = http://mystart.incredibar.com/mb167/?loc=I…vYfAqS&i;=26
CHR - default_search_provider: suggest_url =
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\user\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\user\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Gmail = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2009/06/10 15:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension64.dll ()
O2 - BHO: (File Sanitizer for HP ProtectTools) - {3134413B-49B4-425C-98A5-893C1F195601} - c:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension32.dll ()
O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\bin\PlusIEContextMenu.dll (Zeon Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\IPS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {00000000-0000-0000-0000-000000000000} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [hpsysdrv] c:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [MfeEpePcMonitor] C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe ()
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [BrStsMon00] C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [ControlCenter4] C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [File Sanitizer] c:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe (Hewlett-Packard)
O4 - HKLM..\Run: [IMSS] C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe (Intel Corporation)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDF5 Registry Controller] C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDFHook] C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PPort12reminder] Disable_By_"C:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\12\Config\Ereg\Ereg.ini" File not found
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - HKCU..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - HKCU..\Run: [uTorrent] C:\Program Files (x86)\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Open with PDF Viewer Plus - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Open with PDF Viewer Plus - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6B4AFE0C-EB82-4C11-938E-45C40E4BC511}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C16ACAF2-478C-4BB9-8831-C57926DF1060}: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
O20:64bit: - AppInit_DLLs: (acaptuser64.dll) - C:\Windows\SysNative\acaptuser64.dll (Adobe Systems, Inc.)
O20 - AppInit_DLLs: (acaptuser32.dll) - C:\Windows\SysWow64\acaptuser32.dll (Adobe Systems, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe) - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe (DigitalPersona, Inc.)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\DeviceNP: DllName - (DeviceNP.dll) - C:\Windows\SysWow64\DeviceNP.dll (Hewlett-Packard Company)
O20 - Winlogon\Notify\SEP: DllName - (C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\WinLogoutNotifier.dll) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{89324066-818c-11e1-9811-2c41389561f8}\Shell - "" = AutoRun
O33 - MountPoints2\{89324066-818c-11e1-9811-2c41389561f8}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2012/07/09 18:27:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Perion
[2012/07/09 18:27:00 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2012/07/09 18:26:39 | 000,000,000 | —D | C] – C:\Program Files\Web Assistant
[2012/06/28 14:56:54 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012/06/28 14:56:52 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2012/06/26 11:33:35 | 000,000,000 | —D | C] – C:\Users\user\Documents\Table numbers
[2012/06/23 06:31:51 | 000,000,000 | —D | C] – C:\Users\user\Documents\Adobe Scripts
[2012/06/22 17:50:48 | 000,000,000 | —D | C] – C:\Users\user\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012/06/22 16:30:51 | 000,000,000 | —D | C] – C:\ProgramData\regid.1986-12.com.adobe
[2012/06/22 16:29:43 | 000,000,000 | —D | C] – C:\Program Files\Adobe
[2012/06/22 16:26:08 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2012/06/22 16:10:38 | 000,000,000 | —D | C] – C:\Users\user\CS6 Design and Web Premium
[2012/06/22 12:04:12 | 000,000,000 | —D | C] – C:\Users\user\Adobe Illustrator CS6
[2012/06/22 12:03:01 | 000,000,000 | —D | C] – C:\Users\user\Adobe Photoshop CS6
[2012/06/22 12:00:23 | 000,000,000 | —D | C] – C:\Users\user\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2012/06/22 11:58:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\Adobe Download Assistant
[2012/06/22 11:58:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Adobe AIR
[2012/06/22 11:46:04 | 000,000,000 | —D | C] – C:\Users\user\AppData\Local\CRE
[2012/06/22 08:34:43 | 000,000,000 | —D | C] – C:\Users\user\AppData\Local\Ilivid Player
[2012/06/22 00:05:16 | 002,622,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wucltux.dll
[2012/06/22 00:05:16 | 000,057,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuauclt.exe
[2012/06/22 00:05:16 | 000,044,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups2.dll
[2012/06/22 00:05:07 | 000,701,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapi.dll
[2012/06/22 00:05:07 | 000,099,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wudriver.dll
[2012/06/22 00:05:07 | 000,038,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups.dll
[2012/06/22 00:04:58 | 000,186,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuwebv.dll
[2012/06/22 00:04:58 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapp.exe
[2012/06/14 03:00:39 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/06/14 03:00:39 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/06/14 03:00:39 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/06/14 03:00:39 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/06/14 03:00:38 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/06/14 03:00:38 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/06/14 03:00:37 | 002,311,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/06/14 03:00:37 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/06/14 03:00:37 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/06/14 03:00:37 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/06/14 03:00:37 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/06/14 03:00:36 | 000,818,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/06/14 03:00:36 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/06/13 17:35:31 | 005,559,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2012/06/13 17:35:31 | 003,913,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntoskrnl.exe
[2012/06/13 17:35:30 | 003,968,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntkrnlpa.exe
[2012/06/13 17:29:53 | 000,149,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpcorekmts.dll
[2012/06/13 17:29:53 | 000,077,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpwsx.dll
[2012/06/13 17:29:53 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdrmemptylst.exe
[2012/06/13 17:16:57 | 003,216,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msi.dll
[2012/06/13 17:16:54 | 001,462,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\crypt32.dll
[2012/06/13 17:16:54 | 000,140,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cryptnet.dll
[2012/06/13 06:27:52 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/06/13 06:27:30 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2012/06/13 06:27:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2012/06/13 06:27:30 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2012/06/13 06:12:01 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012/06/13 06:11:58 | 000,000,000 | —D | C] – C:\Program Files (x86)\QuickTime
========== Files - Modified Within 30 Days ==========
[2012/07/10 07:47:00 | 000,000,904 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3657083141-290413805-2333710366-1001UA.job
[2012/07/10 07:32:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/07/10 06:45:51 | 000,027,568 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/10 06:45:51 | 000,027,568 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/10 06:42:41 | 000,778,834 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/07/10 06:42:41 | 000,661,680 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/07/10 06:42:41 | 000,121,598 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/07/10 06:38:05 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/07/10 06:38:01 | 005,032,320 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/07/10 06:37:34 | 3133,157,376 | -HS- | M] () – C:\hiberfil.sys
[2012/07/09 18:43:01 | 000,259,031 | —- | M] () – C:\Users\user\Desktop\Untitled-5_1.jpg
[2012/07/09 18:41:04 | 000,415,470 | —- | M] () – C:\Users\user\Desktop\Untitled-5.jpg
[2012/07/09 18:27:03 | 000,000,448 | —- | M] () – C:\user.js
[2012/07/09 17:49:34 | 000,158,289 | —- | M] () – C:\Users\user\Desktop\Untitled-2-1.jpg
[2012/07/09 17:48:29 | 000,581,685 | —- | M] () – C:\Users\user\Desktop\Untitled-2.jpg
[2012/07/09 17:43:18 | 005,948,893 | —- | M] () – C:\Users\user\Desktop\Untitled-2.pdf
[2012/07/08 21:47:00 | 000,000,852 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3657083141-290413805-2333710366-1001Core.job
[2012/07/05 07:34:15 | 000,000,328 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForuser.job
[2012/07/03 08:56:42 | 005,183,715 | R— | M] () – C:\Users\user\Desktop\Dover Road Bi-Weekly Progress Report June 26 2012.pdf
[2012/06/30 19:10:25 | 000,002,356 | —- | M] () – C:\Users\user\Desktop\Google Chrome.lnk
[2012/06/28 16:34:26 | 000,000,021 | —- | M] () – C:\Windows\tpcsd
[2012/06/28 14:56:54 | 000,000,824 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2012/06/28 14:44:15 | 000,001,111 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/26 14:05:42 | 004,076,231 | —- | M] () – C:\Users\user\Documents\Untitled-1.psd
[2012/06/26 14:05:36 | 005,021,504 | —- | M] () – C:\Users\user\Documents\Table 1-4.pdf
[2012/06/26 14:05:36 | 000,994,840 | —- | M] () – C:\Users\user\Documents\Untitled-2.psd
[2012/06/26 10:37:56 | 000,106,010 | —- | M] () – C:\Users\user\Documents\Table 1 - 4.jpg
[2012/06/25 15:43:09 | 000,270,120 | —- | M] () – C:\Users\user\Documents\Incercare - table number_.psd
[2012/06/25 15:13:41 | 000,257,520 | —- | M] () – C:\Users\user\Documents\Incercare - table number.psd
[2012/06/25 13:51:29 | 002,737,182 | —- | M] () – C:\Users\user\Documents\incercarea 2.psd
[2012/06/25 13:46:25 | 000,288,089 | —- | M] () – C:\Users\user\Documents\incercarea 2.jpg
[2012/06/23 08:08:03 | 000,000,342 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForLOLLY-PC$.job
[2012/06/22 11:58:55 | 000,001,033 | —- | M] () – C:\Users\Public\Desktop\Adobe Download Assistant.lnk
[2012/06/22 11:19:18 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/06/22 11:19:18 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/06/14 14:06:44 | 007,833,563 | —- | M] () – C:\Users\user\Desktop\garnet pollard06142012_0000.pdf
[2012/06/13 13:19:24 | 001,063,669 | —- | M] () – C:\Users\user\Desktop\PDF13062012_00000.pdf
[2012/06/13 06:27:52 | 000,001,785 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/06/13 06:12:02 | 000,001,847 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
========== Files Created - No Company Name ==========
[2012/07/09 18:43:01 | 000,259,031 | —- | C] () – C:\Users\user\Desktop\Untitled-5_1.jpg
[2012/07/09 18:41:01 | 000,415,470 | —- | C] () – C:\Users\user\Desktop\Untitled-5.jpg
[2012/07/09 18:27:01 | 000,000,448 | —- | C] () – C:\user.js
[2012/07/09 17:49:34 | 000,158,289 | —- | C] () – C:\Users\user\Desktop\Untitled-2-1.jpg
[2012/07/09 17:48:25 | 000,581,685 | —- | C] () – C:\Users\user\Desktop\Untitled-2.jpg
[2012/07/09 17:43:13 | 005,948,893 | —- | C] () – C:\Users\user\Desktop\Untitled-2.pdf
[2012/07/04 01:23:22 | 000,000,328 | —- | C] () – C:\Windows\tasks\HPCeeScheduleForuser.job
[2012/07/03 08:58:33 | 005,183,715 | R— | C] () – C:\Users\user\Desktop\Dover Road Bi-Weekly Progress Report June 26 2012.pdf
[2012/06/28 16:34:26 | 000,000,021 | —- | C] () – C:\Windows\tpcsd
[2012/06/28 14:56:54 | 000,000,824 | —- | C] () – C:\Users\Public\Desktop\CCleaner.lnk
[2012/06/28 14:44:15 | 000,001,111 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/26 14:05:40 | 004,076,231 | —- | C] () – C:\Users\user\Documents\Untitled-1.psd
[2012/06/26 14:05:29 | 005,021,504 | —- | C] () – C:\Users\user\Documents\Table 1-4.pdf
[2012/06/26 11:01:54 | 000,994,840 | —- | C] () – C:\Users\user\Documents\Untitled-2.psd
[2012/06/26 10:37:52 | 000,106,010 | —- | C] () – C:\Users\user\Documents\Table 1 - 4.jpg
[2012/06/25 15:17:45 | 000,270,120 | —- | C] () – C:\Users\user\Documents\Incercare - table number_.psd
[2012/06/25 15:13:38 | 000,257,520 | —- | C] () – C:\Users\user\Documents\Incercare - table number.psd
[2012/06/25 13:51:28 | 002,737,182 | —- | C] () – C:\Users\user\Documents\incercarea 2.psd
[2012/06/25 13:46:25 | 000,288,089 | —- | C] () – C:\Users\user\Documents\incercarea 2.jpg
[2012/06/22 16:30:46 | 000,001,077 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk
[2012/06/22 16:30:25 | 000,001,209 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6.lnk
[2012/06/22 16:29:48 | 000,001,039 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk
[2012/06/22 16:29:33 | 000,001,171 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6.lnk
[2012/06/22 16:28:17 | 000,001,355 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk
[2012/06/22 16:28:14 | 000,001,521 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk
[2012/06/22 11:58:55 | 000,001,045 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Download Assistant.lnk
[2012/06/22 11:58:55 | 000,001,033 | —- | C] () – C:\Users\Public\Desktop\Adobe Download Assistant.lnk
[2012/06/15 10:09:04 | 000,033,216 | —- | C] () – C:\Users\user\Desktop\Riddle.ttf
[2012/06/14 14:06:43 | 007,833,563 | —- | C] () – C:\Users\user\Desktop\garnet pollard06142012_0000.pdf
[2012/06/13 10:14:29 | 001,063,669 | —- | C] () – C:\Users\user\Desktop\PDF13062012_00000.pdf
[2012/06/13 06:27:52 | 000,001,785 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/06/13 06:12:01 | 000,001,847 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2012/05/21 05:44:02 | 000,004,096 | -H– | C] () – C:\Users\user\AppData\Local\keyfile3.drm
[2012/01/22 01:25:20 | 000,000,848 | -HS- | C] () – C:\ProgramData\KGyGaAvL.sys
[2011/12/31 09:48:54 | 000,000,855 | —- | C] () – C:\Windows\Brpfx04a.ini
[2011/12/31 09:48:54 | 000,000,159 | —- | C] () – C:\Windows\brpcfx.ini
[2011/12/31 09:48:33 | 000,002,944 | —- | C] () – C:\Windows\BRPARAM.INI
[2011/12/31 09:44:21 | 000,000,066 | —- | C] () – C:\Windows\Brfaxrx.ini
[2011/12/31 09:44:21 | 000,000,000 | —- | C] () – C:\Windows\brdfxspd.dat
[2011/12/31 09:44:17 | 000,045,056 | —- | C] () – C:\Windows\SysWow64\BRTCPCON.DLL
[2011/12/31 09:44:14 | 000,000,114 | —- | C] () – C:\Windows\SysWow64\BRLMW03A.INI
[2011/12/14 14:07:24 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2011/10/21 18:27:54 | 000,963,116 | —- | C] () – C:\Windows\SysWow64\igkrng600.bin
[2011/10/21 18:27:54 | 000,217,536 | —- | C] () – C:\Windows\SysWow64\igfcg600m.bin
[2011/10/21 18:22:54 | 000,056,832 | —- | C] () – C:\Windows\SysWow64\igdde32.dll
[2011/10/21 18:03:04 | 013,903,872 | —- | C] () – C:\Windows\SysWow64\ig4icd32.dll
[2011/10/12 17:33:38 | 000,145,804 | —- | C] () – C:\Windows\SysWow64\igcompkrng600.bin
[2011/07/06 15:15:16 | 000,000,256 | R— | C] () – C:\Windows\SysWow64\DPSCEL.dll.hpsign
[2011/07/06 15:15:16 | 000,000,256 | R— | C] () – C:\Windows\SysWow64\DPFPApi.dll.hpsign
[2011/07/06 15:15:16 | 000,000,256 | R— | C] () – C:\Windows\SysWow64\DPClback.dll.hpsign
[2011/07/06 15:05:12 | 000,000,256 | R— | C] () – C:\Windows\SysWow64\DPPassFilter.dll.hpsign
[2011/07/06 15:05:12 | 000,000,256 | R— | C] () – C:\Windows\SysWow64\DPCrProv.dll.hpsign
[2011/07/06 15:05:08 | 000,000,256 | R— | C] () – C:\Windows\SysWow64\DPLic.dll.hpsign
[2011/07/06 14:55:34 | 000,000,256 | R— | C] () – C:\Windows\SysWow64\DPFPApiUI.dll.hpsign
[2011/05/09 16:43:26 | 000,366,136 | —- | C] () – C:\Windows\SysWow64\flcdlmsg.dll
[2011/02/11 14:29:00 | 000,774,812 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
========== LOP Check ==========
[2012/06/22 12:00:23 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2011/12/31 15:46:50 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\ControlCenter4
[2011/12/14 13:05:55 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\DigitalPersona
[2012/01/04 16:19:37 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\ICAClient
[2011/12/31 15:42:21 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\Nuance
[2012/01/16 11:48:24 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\PC-FAX TX
[2012/06/22 17:50:48 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012/07/10 07:55:04 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\uTorrent
[2012/02/03 19:35:55 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\WinBatch
[2011/12/31 15:42:23 | 000,000,000 | —D | M] – C:\Users\user\AppData\Roaming\Zeon
[2009/07/13 23:08:49 | 000,018,404 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.* >
[2011/02/11 14:13:06 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2012/07/10 06:37:34 | 3133,157,376 | -HS- | M] () – C:\hiberfil.sys
[2011/10/12 17:16:34 | 000,000,000 | RHS- | M] () – C:\OS
[2012/07/10 06:37:37 | 4177,543,168 | -HS- | M] () – C:\pagefile.sys
[2010/08/06 19:26:40 | 000,047,104 | -HS- | M] () – C:\Thumbs.db
[2012/07/09 18:27:03 | 000,000,448 | —- | M] () – C:\user.js
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
< %systemroot%\REPAIR\*.bak1 >
< %systemroot%\REPAIR\*.ini >
< %systemroot%\system32\*.jpg >
< %systemroot%\*.jpg >
< %systemroot%\*.png >
< %systemroot%\*.scr >
< %systemroot%\*._sy >
< %APPDATA%\Adobe\Update\*.* >
< %ALLUSERSPROFILE%\Favorites\*.* >
< %APPDATA%\Microsoft\*.* >
< %PROGRAMFILES%\*.* >
[2009/07/13 22:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini
< %APPDATA%\Update\*.* >
< %systemroot%\*. /mp /s >
< %systemroot%\System32\config\*.sav >
< %PROGRAMFILES%\bak. /s >
< %systemroot%\system32\bak. /s >
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
< %systemroot%\system32\config\systemprofile\*.dat /x >
< %systemroot%\*.config >
< %systemroot%\system32\*.db >
< %PROGRAMFILES%\Internet Explorer\*.dat >
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/12/14 13:32:00 | 000,000,221 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
< %USERPROFILE%\Desktop\*.exe >
< %PROGRAMFILES%\Common Files\*.* >
< %systemroot%\*.src >
< %systemroot%\install\*.* >
< %systemroot%\system32\DLL\*.* >
< %systemroot%\system32\HelpFiles\*.* >
< %systemroot%\system32\rundll\*.* >
< %systemroot%\winn32\*.* >
< %systemroot%\Java\*.* >
< %systemroot%\system32\test\*.* >
< %systemroot%\system32\Rundll32\*.* >
< %systemroot%\AppPatch\Custom\*.* >
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< %appdata%\Microsoft\Windows\Start Menu\*.* /s >
[2012/02/15 06:41:24 | 000,000,174 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
[2012/02/15 06:41:24 | 000,000,476 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
[2011/12/14 13:12:24 | 000,001,411 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2011/12/14 13:12:24 | 000,001,445 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2009/07/13 22:54:27 | 000,001,280 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk
[2009/07/13 22:54:32 | 000,000,678 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini
[2009/07/13 22:54:32 | 000,001,304 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk
[2009/07/13 22:49:38 | 000,000,262 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Run.lnk
[2009/07/13 22:49:38 | 000,001,228 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk
[2009/07/13 22:54:02 | 000,000,704 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini
[2009/07/13 22:54:01 | 000,001,358 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk
[2009/07/13 22:54:00 | 000,001,258 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk
[2009/07/13 22:54:02 | 000,001,262 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk
[2009/07/13 22:54:00 | 000,001,250 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk
[2009/07/13 22:49:38 | 000,000,262 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\computer.lnk
[2009/07/13 22:49:38 | 000,000,262 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Control Panel.lnk
[2011/12/14 13:12:24 | 000,000,738 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini
[2011/12/14 13:12:24 | 000,001,495 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
[2009/07/13 22:54:59 | 000,001,306 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk
[2012/02/15 06:41:24 | 000,000,174 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
[2012/06/30 19:10:25 | 000,002,370 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
[2012/06/30 19:10:25 | 000,002,482 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Uninstall Google Chrome.lnk
[2009/07/13 22:49:38 | 000,000,318 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini
[2009/07/13 22:49:38 | 000,000,262 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Help.lnk
[2012/02/15 06:41:24 | 000,000,174 | -HS- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
[2012/03/03 09:17:40 | 000,000,994 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk
[2012/03/03 09:17:40 | 000,001,013 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk
[2012/03/03 09:17:40 | 000,001,013 | —- | M] () – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk
< %programdata%\Microsoft\Windows\Start Menu\*.* /s >
[2009/07/13 23:01:14 | 000,001,282 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
[2009/07/13 23:01:14 | 000,000,442 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini
[2011/12/14 14:07:57 | 000,002,599 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\New Office Document.lnk
[2011/12/14 14:07:57 | 000,002,609 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Open Office Document.lnk
[2011/12/31 09:41:05 | 000,001,868 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Software Updates.lnk
[2011/10/12 17:48:53 | 000,002,358 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Theft Recovery.lnk
[2009/07/13 22:49:40 | 000,001,266 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
[2012/01/16 18:50:27 | 000,000,951 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\µTorrent.lnk
[2011/12/14 14:54:47 | 000,002,465 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Distiller 9.lnk
[2011/12/14 14:54:30 | 000,002,270 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe 3D Reviewer.lnk
[2011/12/14 14:54:47 | 000,002,471 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat 9 Pro Extended.lnk
[2012/06/22 16:29:48 | 000,001,039 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk
[2012/06/22 16:29:33 | 000,001,171 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6.lnk
[2012/06/22 11:58:56 | 000,001,045 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Download Assistant.lnk
[2012/06/22 16:28:14 | 000,001,521 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk
[2012/06/22 16:28:17 | 000,001,355 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk
[2011/12/14 14:54:30 | 000,002,173 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle Designer ES 8.2.lnk
[2012/06/22 16:30:46 | 000,001,077 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk
[2012/06/22 16:30:25 | 000,001,209 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6.lnk
[2012/01/04 16:26:34 | 000,002,519 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2011/10/12 18:03:04 | 000,001,130 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
[2011/10/12 17:49:11 | 000,002,499 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Install Embedded Security for HP ProtectTools.lnk
[2011/10/12 17:47:19 | 000,002,359 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Install HP Power Assistant.lnk
[2011/02/11 14:17:43 | 000,001,345 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012/05/15 07:45:50 | 000,002,503 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Safari.lnk
[2009/07/13 22:57:08 | 000,001,330 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2011/10/12 17:42:52 | 000,001,854 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SRS Audio Control Panel.lnk
[2011/12/14 13:06:08 | 000,001,817 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Warranty.lnk
[2009/07/13 22:57:09 | 000,001,352 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2011/02/11 14:17:43 | 000,001,326 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2009/07/13 22:54:59 | 000,001,210 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2011/10/12 18:03:04 | 000,001,547 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2009/07/13 22:57:08 | 000,001,246 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2009/07/13 22:55:00 | 000,001,230 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk
[2011/02/11 14:17:43 | 000,001,854 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini
[2009/07/13 22:54:23 | 000,001,266 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk
[2011/02/11 14:17:43 | 000,001,364 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Math Input Panel.lnk
[2011/02/11 14:17:29 | 000,001,238 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Mobility Center.lnk
[2011/02/11 14:17:29 | 000,001,242 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\NetworkProjection.lnk
[2009/07/13 22:54:32 | 000,001,242 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk
[2009/07/13 22:53:55 | 000,001,367 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk
[2011/02/11 14:17:36 | 000,001,272 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk
[2009/07/13 22:57:08 | 000,001,330 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sound Recorder.lnk
[2011/02/11 14:17:30 | 000,001,351 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk
[2009/07/13 22:54:58 | 000,001,254 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sync Center.lnk
[2009/07/13 22:57:09 | 000,001,579 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk
[2009/07/13 22:54:58 | 000,001,322 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Wordpad.lnk
[2009/07/13 22:57:07 | 000,000,370 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini
[2009/07/13 22:57:07 | 000,001,388 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Speech Recognition.lnk
[2009/07/13 22:55:00 | 000,001,248 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk
[2009/07/13 22:57:09 | 000,001,338 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini
[2009/07/13 22:54:25 | 000,001,290 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\dfrgui.lnk
[2009/07/13 22:54:58 | 000,001,252 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Disk Cleanup.lnk
[2009/07/13 22:53:50 | 000,001,242 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Resource Monitor.lnk
[2009/07/13 22:53:33 | 000,001,250 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\System Information.lnk
[2009/07/13 22:54:57 | 000,001,246 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\System Restore.lnk
[2009/07/13 22:54:29 | 000,001,268 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Task Scheduler.lnk
[2009/07/13 22:57:09 | 000,001,320 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer Reports.lnk
[2009/07/13 22:57:09 | 000,001,316 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer.lnk
[2011/02/11 14:17:33 | 000,000,343 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini
[2011/02/11 14:17:33 | 000,001,436 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\ShapeCollector.lnk
[2011/02/11 14:17:33 | 000,001,386 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\TabTip.lnk
[2011/02/11 14:17:30 | 000,001,316 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Windows Journal.lnk
[2009/07/13 22:57:13 | 000,000,216 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini
[2009/07/13 23:32:31 | 000,001,989 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell (x86).lnk
[2009/07/13 22:57:13 | 000,001,468 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell ISE (x86).lnk
[2009/07/13 22:57:13 | 000,001,468 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell ISE.lnk
[2009/07/13 23:32:31 | 000,001,899 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
[2009/07/13 22:57:13 | 000,001,242 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk
[2009/07/13 22:54:21 | 000,001,294 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk
[2009/07/13 22:53:52 | 000,001,270 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Data Sources (ODBC).lnk
[2011/02/11 14:17:36 | 000,001,958 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
[2009/07/13 22:54:29 | 000,001,298 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk
[2009/07/13 22:54:22 | 000,001,274 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk
[2009/07/13 22:53:33 | 000,001,268 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk
[2009/07/13 22:53:50 | 000,001,232 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Performance Monitor.lnk
[2011/02/11 14:17:26 | 000,001,262 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Print Management.lnk
[2011/02/11 14:17:36 | 000,001,248 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Security Configuration Management.lnk
[2009/07/13 22:54:05 | 000,001,288 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009/07/13 22:53:33 | 000,001,246 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk
[2009/07/13 22:54:29 | 000,001,262 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk
[2009/07/13 22:53:58 | 000,001,274 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows Firewall with Advanced Security.lnk
[2009/07/13 23:32:31 | 000,002,741 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows PowerShell Modules.lnk
[2011/12/31 09:49:14 | 000,000,078 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\Brother Creative Center.url
[2011/12/31 09:49:06 | 000,002,007 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\ControlCenter4.lnk
[2011/12/31 09:49:10 | 000,002,073 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\Installation Diagnostics.lnk
[2011/12/31 09:49:12 | 000,000,102 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\On-line help and FAQ's.url
[2011/12/31 09:49:11 | 000,002,231 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\On-Line Registration.lnk
[2011/12/31 09:49:09 | 000,002,056 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\Read Me.lnk
[2011/12/31 09:49:05 | 000,002,085 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\Remote Setup.lnk
[2011/12/31 09:49:07 | 000,002,137 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\Status Monitor.lnk
[2011/12/31 09:49:08 | 000,002,469 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\UnInstall.lnk
[2011/12/31 09:49:13 | 000,000,102 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\User's Guides in PDF format.url
[2011/12/31 09:49:03 | 000,002,104 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\PC-FAX Receiving\How to use PC-FAX Receiving.lnk
[2011/12/31 09:49:04 | 000,002,076 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\PC-FAX Receiving\Receive.lnk
[2011/12/31 09:49:00 | 000,002,118 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\PC-FAX Sending\How to use PC-FAX Sending.lnk
[2011/12/31 09:49:01 | 000,002,075 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\PC-FAX Sending\PC-FAX Address Book.lnk
[2011/12/31 09:49:02 | 000,002,058 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\PC-FAX Sending\PC-FAX Setup.lnk
[2011/12/31 09:49:10 | 000,002,055 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\Scanner Settings\Read Me.lnk
[2011/12/31 09:49:10 | 000,002,055 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\Scanner Settings\Scanner Utility.lnk
[2011/12/31 09:49:10 | 000,001,866 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother\MFC-J6910DW\Scanner Settings\Scanners and Cameras.lnk
[2012/06/28 14:56:54 | 000,000,082 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner Homepage.url
[2012/06/28 14:56:54 | 000,000,842 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner.lnk
[2012/06/28 14:56:54 | 000,000,603 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\Uninstall CCleaner.lnk
[2011/12/14 13:06:19 | 000,000,081 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eReaders and Document Viewers\desktop.ini
[2010/11/21 01:16:53 | 000,000,520 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini
[2009/07/13 22:54:59 | 000,000,258 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\GameExplorer.lnk
[2011/12/14 13:06:19 | 000,000,170 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support\desktop.ini
[2012/02/03 19:37:59 | 000,002,199 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support\HP Support Assistant.lnk
[2009/11/10 15:55:10 | 000,001,707 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support\HP support information.lnk
[2011/12/14 13:05:59 | 000,001,867 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP User Manuals\Getting Started.lnk
[2011/12/14 13:06:03 | 000,001,892 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP User Manuals\Hardware Reference Guide.lnk
[2011/12/14 13:06:01 | 000,001,874 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP User Manuals\HP ProtectTools.lnk
[2011/12/14 13:06:06 | 000,001,885 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP User Manuals\Safety and Comfort Guide.lnk
[2011/12/14 13:06:06 | 000,001,903 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP User Manuals\Safety and Regulatory Information.lnk
[2011/10/12 17:41:31 | 000,000,210 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\desktop.ini
[2011/10/12 17:41:31 | 000,001,474 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP ProtectTools Administrative Console.lnk
[2011/10/12 17:41:31 | 000,001,469 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP ProtectTools Security Manager.lnk
[2011/10/12 17:46:44 | 000,002,240 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HPCA_Preload\HP CA Management Agent Install.lnk
[2011/10/12 17:46:44 | 000,002,254 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HPCA_Preload\HP CA Management Agent Readme EN.lnk
[2011/10/12 17:46:44 | 000,002,254 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HPCA_Preload\HP CA Management Agent Readme FR.lnk
[2011/10/12 17:46:44 | 000,002,254 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HPCA_Preload\HP CA Management Agent Readme GR.lnk
[2011/10/12 17:46:44 | 000,002,254 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HPCA_Preload\HP CA Management Agent Readme IT.lnk
[2011/10/12 17:46:44 | 000,002,254 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HPCA_Preload\HP CA Management Agent Readme JP.lnk
[2011/10/12 17:46:44 | 000,002,254 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HPCA_Preload\HP CA Management Agent Readme SP.lnk
[2011/10/12 17:46:44 | 000,002,402 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HPCA_Preload\HPCA-RMA.lnk
[2011/10/12 17:48:01 | 000,000,103 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel\desktop.ini
[2011/10/12 17:48:01 | 000,001,426 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel\Intel Control Center.lnk
[2011/10/12 17:47:57 | 000,000,217 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel\Intel® Management Engine Components\desktop.ini
[2011/10/12 17:47:57 | 000,001,673 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel\Intel® Management Engine Components\Intel® Management and Security Status.lnk
[2012/06/13 06:27:52 | 000,002,107 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\About iTunes.lnk
[2012/06/13 06:27:52 | 000,001,803 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\iTunes.lnk
[2009/07/13 22:57:07 | 000,001,304 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Backup and Restore Center.lnk
[2009/07/13 22:57:07 | 000,001,248 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Create Recovery Disc.lnk
[2009/07/13 22:57:09 | 000,000,606 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini
[2009/07/13 22:57:09 | 000,001,212 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Remote Assistance.lnk
[2012/06/28 14:44:15 | 000,001,129 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware Help.lnk
[2012/06/28 14:44:15 | 000,001,129 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware.lnk
[2012/06/28 14:44:15 | 000,001,153 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Uninstall Malwarebytes Anti-Malware.lnk
[2012/06/28 14:44:15 | 000,001,302 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk
[2011/12/14 14:06:52 | 000,002,643 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Access 2003.lnk
[2011/12/14 14:06:52 | 000,002,677 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Excel 2003.lnk
[2011/12/14 14:06:52 | 000,002,695 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office InfoPath 2003.lnk
[2011/12/14 14:06:52 | 000,002,693 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Outlook 2003.lnk
[2011/12/14 14:06:52 | 000,002,645 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office PowerPoint 2003.lnk
[2011/12/14 14:07:57 | 000,002,651 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Project 2003.lnk
[2011/12/14 14:06:52 | 000,002,611 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Publisher 2003.lnk
[2011/12/14 14:08:50 | 000,002,563 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Visio 2003.lnk
[2011/12/14 14:06:52 | 000,002,675 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Word 2003.lnk
[2011/12/14 14:08:50 | 000,002,647 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Digital Certificate for VBA Projects.lnk
[2011/12/14 14:08:50 | 000,002,627 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Clip Organizer.lnk
[2011/12/14 14:08:50 | 000,002,527 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office 2003 Language Settings.lnk
[2011/12/14 14:08:50 | 000,002,547 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office 2003 Save My Settings Wizard.lnk
[2011/12/14 14:06:52 | 000,002,645 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Access Snapshot Viewer.lnk
[2011/12/14 14:08:50 | 000,002,501 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Application Recovery.lnk
[2011/12/14 14:06:52 | 000,002,797 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Document Imaging.lnk
[2011/12/14 14:06:52 | 000,002,799 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Document Scanning.lnk
[2011/12/14 14:06:52 | 000,002,603 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Picture Manager.lnk
[2011/12/14 14:07:57 | 000,002,717 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Project Server Accounts.lnk
[2011/10/12 17:47:39 | 000,002,270 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight\Microsoft Silverlight.lnk
[2011/12/31 09:41:05 | 000,001,935 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nuance PaperPort 12\ImageViewer.lnk
[2011/12/31 09:41:05 | 000,001,999 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nuance PaperPort 12\PaperPort.lnk
[2011/12/31 09:42:41 | 000,001,102 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nuance PaperPort 12\PDF Viewer Plus.lnk
[2011/12/31 09:41:05 | 000,002,095 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nuance PaperPort 12\Scanner Setup Wizard.lnk
[2011/12/14 14:16:24 | 000,001,265 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook Connector for MDaemon Plug-in\License Agreement.lnk
[2011/12/14 14:16:24 | 000,001,312 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook Connector for MDaemon Plug-in\Outlook Connector Plug-in User's Manual.lnk
[2011/12/14 14:16:24 | 000,001,272 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook Connector for MDaemon Plug-in\Registration File.lnk
[2011/12/14 14:16:24 | 000,001,272 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook Connector for MDaemon Plug-in\Release Notes.lnk
[2011/12/14 14:16:24 | 000,001,260 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook Connector for MDaemon Plug-in\Uninstall Outlook Connector for MDaemon Plug-in.lnk
[2011/10/12 17:40:52 | 000,001,273 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Help & Tools\HP Vision Diagnostics Disc Creation.lnk
[2011/12/14 13:06:19 | 000,000,081 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Productivity and Tools\desktop.ini
[2012/06/13 06:12:01 | 000,002,441 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime\About QuickTime.lnk
[2012/06/13 06:12:01 | 000,002,471 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime\PictureViewer.lnk
[2012/06/13 06:12:01 | 000,002,441 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime\QuickTime Player.lnk
[2012/06/13 06:12:02 | 000,001,818 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime\Uninstall QuickTime.lnk
[2011/10/12 17:45:42 | 000,000,288 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recovery Manager\desktop.ini
[2011/10/12 17:45:42 | 000,002,119 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recovery Manager\Recovery Disc Creation.lnk
[2011/10/12 17:45:42 | 000,002,129 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recovery Manager\Recovery Manager.lnk
[2012/03/16 06:25:23 | 000,002,533 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype\Skype.lnk
[2009/07/13 22:54:24 | 000,000,174 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
[2011/12/14 15:01:18 | 000,001,467 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Symantec Endpoint Protection\Symantec Endpoint Protection Help.lnk
[2011/12/14 15:01:17 | 000,001,353 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Symantec Endpoint Protection\Symantec Endpoint Protection.lnk
[2012/01/17 07:42:27 | 000,001,142 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Documentation.lnk
[2012/01/17 07:42:27 | 000,001,093 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Release Notes.lnk
[2012/01/17 07:42:27 | 000,001,182 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Reset VLC media player preferences and cache files.lnk
[2012/01/17 07:42:27 | 000,001,157 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VideoLAN Website.lnk
[2012/01/17 07:42:27 | 000,001,102 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player skinned.lnk
[2012/01/17 07:42:27 | 000,001,086 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player.lnk
[2011/10/12 17:37:05 | 000,000,266 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Virtual PC\desktop.ini
[2011/10/12 17:37:04 | 000,001,401 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Virtual PC\Virtual Machines.lnk
[2011/10/12 17:37:05 | 000,001,523 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Virtual PC\Virtual Windows XP.lnk
[2012/03/03 09:17:40 | 000,000,976 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk
[2012/03/03 09:17:40 | 000,000,995 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk
[2012/03/03 09:17:40 | 000,000,995 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk
[2011/10/12 17:47:11 | 000,002,336 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip\WinZip 15.0.lnk
< End of report >
Extras.txt
OTL Extras logfile created on: 7/10/2012 7:51:12 AM - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\user\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.89 Gb Total Physical Memory | 1.99 Gb Available Physical Memory | 51.21% Memory free
7.78 Gb Paging File | 5.71 Gb Available in Paging File | 73.37% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 455.87 Gb Total Space | 402.97 Gb Free Space | 88.39% Space Free | Partition Type: NTFS
Drive D: | 9.79 Gb Total Space | 1.20 Gb Free Space | 12.28% Space Free | Partition Type: NTFS
Computer Name: LOLLY-PC | User Name: user | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [Bridge] – C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [Bridge] – C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00FCF189-3DA0-4C0B-9F7B-6DFAF76836E3}" = lport=137 | protocol=17 | dir=in | app=system |
"{026B28DB-23DA-41D3-9E1E-798B8EBC6CF7}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{10C4A4DC-DC10-4D70-8DEE-4B5D2B3B2248}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{4B30BD22-876B-42A4-BA06-1E04F3155059}" = rport=137 | protocol=17 | dir=out | app=system |
"{5C9CE510-EF96-41CF-B1D1-9CA8EADEBF01}" = lport=139 | protocol=6 | dir=in | app=system |
"{753C413B-484F-49FF-8FE0-D186C86A48A2}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{883B9B0C-7746-4735-8162-28700006E4F9}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{943BA433-585C-43E1-9E6E-CEEAD1B90270}" = lport=445 | protocol=6 | dir=in | app=system |
"{98061B86-6C65-40DC-B044-75D92969C98B}" = rport=138 | protocol=17 | dir=out | app=system |
"{A44CCA03-676E-4032-944C-673655BC72C3}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AA09BAB6-44E6-4BB3-B483-D346114690E6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AA8DB21C-B124-489E-BA10-E12EF4014D7C}" = rport=139 | protocol=6 | dir=out | app=system |
"{BF5BEA1C-8A50-44D6-B095-F9F0C1523695}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{EE9077CF-439E-4125-8D1B-70B115B3C77D}" = lport=138 | protocol=17 | dir=in | app=system |
"{F1CCB519-AC7C-4ECD-8515-48B04086CDD1}" = rport=445 | protocol=6 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07C35E4A-8224-4F0A-B6BF-036AF54D09B3}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{13FB5996-9B8D-4588-9AD3-1A58157F6F96}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{1D75FF70-9674-4047-9965-24BD54B0FD4B}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{2CE9A091-D833-4DCE-9E3A-0B8E388BABFF}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{4102B6A2-D554-4F9C-B12E-02C8325F785C}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{59D45492-1528-4DD7-B13D-AD6116E82949}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{5AEB75A3-0900-41B1-A49D-B5FE6BD6A84A}" = protocol=6 | dir=in | app=c:\program files (x86)\symantec\symantec endpoint protection\12.1.1000.157.105\bin64\smc.exe |
"{83793826-FABB-4206-8975-0F0946DFBA64}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{89DFD712-7C20-4A22-AD02-567F9C45DF33}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{9B7E5BBC-CFFA-4F7E-86C3-02BC7FB85959}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{9BE4B3DB-D2C0-43F1-9C02-A1D0285193DA}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{AD390CDF-A617-4BE6-BC9F-D6F337B44FC9}" = protocol=17 | dir=in | app=c:\program files (x86)\symantec\symantec endpoint protection\12.1.1000.157.105\bin64\snac64.exe |
"{B459DA82-D6B0-4CB6-8CDA-48CFDAED530B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{B5989C53-F975-4B3B-8346-5AA440CF294D}" = protocol=6 | dir=in | app=c:\program files (x86)\symantec\symantec endpoint protection\12.1.1000.157.105\bin64\snac64.exe |
"{D6B1A2E8-77C3-4E90-8CE1-1032335DD234}" = protocol=17 | dir=in | app=c:\program files (x86)\symantec\symantec endpoint protection\12.1.1000.157.105\bin64\smc.exe |
"{DA49DCB5-1A18-4227-B106-4947E13FA9B3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F814B082-AC73-4B7D-AFF6-410FA89047F7}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{19B62EDC-C108-4393-B3F1-8A813096CC8E}" = Symantec Endpoint Protection
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{336D0C35-8A85-403a-B9D2-65C292C39087}_is1" = Web Assistant 2.0.0.462
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5476AB75-E584-4497-80AF-7F205D8F6F54}" = Privacy Manager for HP ProtectTools
"{55B52830-024A-443E-AF61-61E1E71AFA1B}" = Device Access Manager for HP ProtectTools
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}" = PaperPort Image Printer 64-bit
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}" = iTunes
"{847B4A60-5D82-45E8-BE7A-327F09325FF4}" = HP ProtectTools Security Manager
"{8A0041CD-277C-4C1F-BFE4-7AC508B20B4C}" = Drive Encryption For HP ProtectTools
"{8B485965-8EFE-464A-842F-CF8F18C3DFD7}" = iCloud
"{8C9B6B1F-0A8E-402A-A60C-110BBB38D67E}" = Intel® Network Connections [removed]
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{AC76BA86-1033-0000-0064-0003D0000004}" = Adobe Acrobat 9 Pro Extended 64-bit Add-On
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{CC4D56B7-6F18-470B-8734-ABCD75BCF4F1}" = HP Auto
"{D79A02E9-6713-4335-9668-AAC7474C0C0E}" = HP Vision Hardware Diagnostics
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"HPProtectTools" = HP ProtectTools Security Manager
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"PROSetDX" = Intel® Network Connections 15.7.176.0
"WinRAR archiver" = WinRAR 4.00 (64-bit)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05BA6A83-C7A7-4F85-88F1-150142305229}" = HP Setup
"{068724F8-D8BE-4B43-8DDD-B9FE9E49FD76}" = Scansoft PDF Professional
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0BCA9EFD-F2D6-4638-B053-8693BA0404BE}" = Citrix online plug-in (Web)
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{17795164-3BC1-4D4F-8ADA-65C895EBFC9A}" = Brother MFL-Pro Suite MFC-J6910DW
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{28656860-4728-433C-8AD4-D1A930437BC8}" = Nuance PDF Viewer Plus
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = Recovery Manager
"{55392E52-1AAD-44C4-BE49-258FFE72434F}" = Citrix online plug-in (USB)
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{65CB4C08-C47B-4A7E-A6A4-50C06ADA5FC6}" = Adobe AIR
"{6C0A559F-8583-4B5A-8B50-20BEE15D8E64}" = Nuance PaperPort 12
"{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}" = File Sanitizer For HP ProtectTools
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.1.2.0
"{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}" = HP Support Assistant
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}" = Adobe Photoshop CS6
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{812424AC-A8B5-44E6-8D48-07E939D1AD9A}" = Citrix online plug-in (HDX)
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DC069E7-893C-41E1-9442-DE89FEC33371}" = Xobni Core
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{903B0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Project Professional 2003
"{90510409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Visio Professional 2003
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9866E5F0-121F-E018-E2D1-2E1770847ABF}" = Adobe Download Assistant
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AC76BA86-1033-F400-7761-000000000004}_920" = Adobe Acrobat 9.2.0 - CPSID_50026
"{AC76BA86-1033-F400-7761-000000000004}{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{ADC70B7A-530B-46E3-8384-48D22681A41E}" = Theft Recovery for HP ProtectTools
"{B2B7B1C8-7C8B-476C-BE2C-049731C55992}" = HP Support Information
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B8AC1A89-FFD1-4F97-8051-E505A160F562}" = HP Odometer
"{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}" = PDF Settings CS6
"{C01A86F5-56E7-101F-9BC9-E3F1025EB779}" = Intel® Identity Protection Technology 1.1.2.0
"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240C1}" = WinZip 15.0
"{CF53CF7C-D996-43EB-9904-DBED57C25625}" = Citrix online plug-in (DV)
"{DF2035BE-5820-4965-BD97-7FAF8D4A7879}" = Microsoft_VC90_CRT_x86
"{E9E34215-82EF-4909-BE2F-F581F0DC9062}" = DirectX for Managed Code Update (Summer 2004)
"{EDA5714F-352C-4AD5-A47B-B6BA8046B75F}" = ACSA Audit
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Processor Graphics
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel® Control Center
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"CitrixOnlinePluginPackWeb" = Citrix online plug-in - web
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"InstallShield_{ADC70B7A-530B-46E3-8384-48D22681A41E}" = Theft Recovery for HP ProtectTools
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"Outlook Connector for MDaemon Plug-in" = Outlook Connector for MDaemon Plug-in
"uTorrent" = µTorrent
"VIP Access SDK" = VIP Access SDK (1.0.1.4)
"VLC media player" = VLC media player 1.1.11
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 6/8/2012 2:36:57 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
Error - 6/8/2012 3:34:49 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
Error - 6/9/2012 2:52:00 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
Error - 6/10/2012 2:32:57 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
Error - 6/10/2012 3:44:50 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
Error - 6/11/2012 3:35:54 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
Error - 6/12/2012 2:31:34 AM | Computer Name = Lolly-PC | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Program Files (x86)\Adobe\Acrobat
9.0\Designer 8.2\FormDesigner.exe".Error in manifest or policy file "" on line
. A component version required by the application conflicts with another component
version already active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error - 6/12/2012 3:39:18 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
Error - 6/12/2012 3:47:55 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
Error - 6/13/2012 3:32:22 PM | Computer Name = Lolly-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Tracking Cookies in File: Cookie:[removed]/
by: Manual scan. Action: Delete succeeded. Action Description: The file was deleted
successfully.
[ System Events ]
Error - 7/6/2012 7:56:55 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:02:05 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:07:15 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:12:25 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:17:35 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:22:45 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:27:55 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:33:05 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:38:16 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
Error - 7/6/2012 8:43:26 PM | Computer Name = Lolly-PC | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 10.190.223.145. The computer with the IP address 10.190.223.135
did not allow the name to be claimed by this computer.
< End of report >
you helped me big times!