CONDUIT BROWSER HIJACK & SEARCH IN FIREFOX

Hi

I've used this site a couple of times before when my PC has become infected, both with full success, and hope it'll be third time lucky!

I'm running Firefox 13.0.1 on a Windows 7 machine, and for the last week or so have noticed that whenever I open a second tab in Firefox in defaults to a Conduit search page (rather than my default Google). And yesterday it even took over my default home page of google.co.uk. I've had a look on-line and this seems a common problem, but none of the solutions suggested have worked. I've also uninstalled, and re-installed Firefox, but the problem remains.

Here's my Hijack.this log, and I'd be most grateful for any assistance in removing this troublesome beastie.

Many thanks in anticipation

zlobber

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:22:51, on 17/07/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16447)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe
C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe
C:\Program Files (x86)\Norton 360\Engine\6.2.1.5\ccSvcHst.exe
C:\Program Files (x86)\CaptureWiz\Pro\CaptureWiz.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe
C:\Users\NickandAnne\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/USCON/2
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by blueyonder
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
R3 - URLSearchHook: (no name) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\6.2.1.5\coIEPlg.dll
O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\6.2.1.5\IPS\IPSBHO.DLL
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: RoboForm BHO - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MIF5BA~1\Office14\GROOVEEX.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\6.2.1.5\coIEPlg.dll
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O4 - Startup: CaptureWiz.lnk = C:\Program Files (x86)\CaptureWiz\Pro\CaptureWiz.exe
O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Customize Menu - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Show RoboForm Toolbar - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra 'Tools' menuitem: Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra button: PICgrabber - {4964E240-D53C-11D5-BDA9-444553540000} - C:\Program Files (x86)\PICgrabber\PICGRABBER.EXE (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: PICgrabber - Movie&Image Search/Download Software - {4964E240-D53C-11D5-BDA9-444553540000} - C:\Program Files (x86)\PICgrabber\PICGRABBER.EXE (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files (x86)\Norton 360\Engine\6.2.1.5\ccSvcHst.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SoftThinks Agent Service (SftService) - SoftThinks SAS - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 11550 bytes

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post





Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• Press Start Scan
  
  • Only if Malicious objects are found then ensure Cure is selected
    If suspicious objects are found select skip
  • Then click Continue > Reboot now
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

• Download OTL to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Check the boxes beside LOP Check and Purity Check.
• Under Custom Scan paste this in
  
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  /md5stop
  C:\Windows\assembly\tmp\U\*.* /s
  CREATERESTOREPOINT
  
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
• You may need two posts to fit them both in.

Many thanks mowman

Here's the log from TDSSKiller.exe

09:54:34.0770 5164 TDSS rootkit removing tool [removed] Jul 16 2012 22:10:11
09:54:35.0440 5164 ============================================================
09:54:35.0440 5164 Current date / time: 2012/07/18 09:54:35.0440
09:54:35.0440 5164 SystemInfo:
09:54:35.0440 5164
09:54:35.0440 5164 OS Version: 6.1.7601 ServicePack: 1.0
09:54:35.0440 5164 Product type: Workstation
09:54:35.0440 5164 ComputerName: DELLOCT10
09:54:35.0440 5164 UserName: NickandAnne
09:54:35.0440 5164 Windows directory: C:\Windows
09:54:35.0440 5164 System windows directory: C:\Windows
09:54:35.0440 5164 Running under WOW64
09:54:35.0440 5164 Processor architecture: Intel x64
09:54:35.0440 5164 Number of processors: 4
09:54:35.0440 5164 Page size: 0x1000
09:54:35.0440 5164 Boot type: Normal boot
09:54:35.0440 5164 ============================================================
09:54:36.0959 5164 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
09:54:37.0068 5164 Drive \Device\Harddisk6\DR7 - Size: 0xC1238000 (3.02 Gb), SectorSize: 0x200, Cylinders: 0x189, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
09:54:37.0068 5164 ============================================================
09:54:37.0068 5164 \Device\Harddisk0\DR0:
09:54:37.0068 5164 MBR partitions:
09:54:37.0068 5164 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x27800, BlocksNum 0x16E3000
09:54:37.0068 5164 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x170A800, BlocksNum 0x3ABAD800
09:54:37.0084 5164 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x3C2B9000, BlocksNum 0x7530000
09:54:37.0099 5164 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x437E9800, BlocksNum 0x61A8000
09:54:37.0115 5164 \Device\Harddisk0\DR0\Partition4: MBR, Type 0x7, StartLBA 0x49992000, BlocksNum 0xF424000
09:54:37.0131 5164 \Device\Harddisk0\DR0\Partition5: MBR, Type 0x7, StartLBA 0x58DB6800, BlocksNum 0xC350000
09:54:37.0146 5164 \Device\Harddisk0\DR0\Partition6: MBR, Type 0x7, StartLBA 0x65107000, BlocksNum 0x2EE0000
09:54:37.0146 5164 \Device\Harddisk6\DR7:
09:54:37.0146 5164 MBR partitions:
09:54:37.0146 5164 \Device\Harddisk6\DR7\Partition0: MBR, Type 0xB, StartLBA 0x10, BlocksNum 0x6091B0
09:54:37.0146 5164 ============================================================
09:54:37.0240 5164 C: <-> \Device\Harddisk0\DR0\Partition1
09:54:37.0474 5164 I: <-> \Device\Harddisk0\DR0\Partition2
09:54:37.0505 5164 J: <-> \Device\Harddisk0\DR0\Partition3
09:54:37.0536 5164 K: <-> \Device\Harddisk0\DR0\Partition4
09:54:37.0552 5164 L: <-> \Device\Harddisk0\DR0\Partition5
09:54:37.0614 5164 N: <-> \Device\Harddisk0\DR0\Partition6
09:54:37.0614 5164 ============================================================
09:54:37.0614 5164 Initialize success
09:54:37.0614 5164 ============================================================
09:54:48.0643 2792 ============================================================
09:54:48.0643 2792 Scan started
09:54:48.0643 2792 Mode: Manual;
09:54:48.0643 2792 ============================================================
09:54:50.0375 2792 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
09:54:50.0375 2792 1394ohci - ok
09:54:50.0422 2792 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
09:54:50.0422 2792 ACPI - ok
09:54:50.0437 2792 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
09:54:50.0437 2792 AcpiPmi - ok
09:54:50.0593 2792 AdobeActiveFileMonitor7.0 (3fd8dc2c9735c2aa70155102cfb93eda) C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
09:54:50.0609 2792 AdobeActiveFileMonitor7.0 - ok
09:54:50.0703 2792 AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
09:54:50.0703 2792 AdobeARMservice - ok
09:54:50.0874 2792 AdobeFlashPlayerUpdateSvc (5e1a953c6472e7bb644892a4d0df5e72) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
09:54:50.0874 2792 AdobeFlashPlayerUpdateSvc - ok
09:54:50.0968 2792 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
09:54:50.0983 2792 adp94xx - ok
09:54:51.0015 2792 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
09:54:51.0030 2792 adpahci - ok
09:54:51.0061 2792 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
09:54:51.0061 2792 adpu320 - ok
09:54:51.0077 2792 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
09:54:51.0077 2792 AeLookupSvc - ok
09:54:51.0186 2792 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
09:54:51.0186 2792 AFD - ok
09:54:51.0202 2792 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
09:54:51.0202 2792 agp440 - ok
09:54:51.0217 2792 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
09:54:51.0217 2792 ALG - ok
09:54:51.0233 2792 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
09:54:51.0233 2792 aliide - ok
09:54:51.0249 2792 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
09:54:51.0249 2792 amdide - ok
09:54:51.0264 2792 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
09:54:51.0264 2792 AmdK8 - ok
09:54:51.0280 2792 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
09:54:51.0280 2792 AmdPPM - ok
09:54:51.0311 2792 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
09:54:51.0327 2792 amdsata - ok
09:54:51.0358 2792 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
09:54:51.0358 2792 amdsbs - ok
09:54:51.0373 2792 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
09:54:51.0373 2792 amdxata - ok
09:54:51.0405 2792 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
09:54:51.0405 2792 AppID - ok
09:54:51.0420 2792 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
09:54:51.0436 2792 AppIDSvc - ok
09:54:51.0467 2792 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
09:54:51.0467 2792 Appinfo - ok
09:54:51.0545 2792 Apple Mobile Device (f401929ee0cc92bfe7f15161ca535383) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
09:54:51.0545 2792 Apple Mobile Device - ok
09:54:51.0561 2792 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
09:54:51.0561 2792 arc - ok
09:54:51.0576 2792 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
09:54:51.0576 2792 arcsas - ok
09:54:51.0685 2792 aspnet_state (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
09:54:51.0717 2792 aspnet_state - ok
09:54:51.0732 2792 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
09:54:51.0732 2792 AsyncMac - ok
09:54:51.0748 2792 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
09:54:51.0748 2792 atapi - ok
09:54:51.0763 2792 AtiPcie (7c5d273e29dcc5505469b299c6f29163) C:\Windows\system32\DRIVERS\AtiPcie.sys
09:54:51.0779 2792 AtiPcie - ok
09:54:51.0873 2792 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
09:54:51.0888 2792 AudioEndpointBuilder - ok
09:54:51.0888 2792 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
09:54:51.0888 2792 AudioSrv - ok
09:54:51.0951 2792 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
09:54:51.0951 2792 AxInstSV - ok
09:54:52.0029 2792 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
09:54:52.0044 2792 b06bdrv - ok
09:54:52.0107 2792 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
09:54:52.0122 2792 b57nd60a - ok
09:54:52.0138 2792 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
09:54:52.0138 2792 BDESVC - ok
09:54:52.0325 2792 BecHelperService (553e94ae71d233c14a8c8b4af9286ed0) C:\Program Files (x86)\3 Mobile Broadband\3Connect\BecHelperService.exe
09:54:52.0372 2792 BecHelperService - ok
09:54:52.0481 2792 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
09:54:52.0481 2792 Beep - ok
09:54:52.0575 2792 BFE (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
09:54:52.0575 2792 BFE - ok
09:54:52.0809 2792 BHDrvx64 (c8ab71a5102d0fc103f6dfc750005137) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.1.2.10\Definitions\BASHDefs\20120711.002\BHDrvx64.sys
09:54:52.0824 2792 BHDrvx64 - ok
09:54:52.0934 2792 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
09:54:52.0949 2792 BITS - ok
09:54:52.0965 2792 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
09:54:52.0965 2792 blbdrive - ok
09:54:53.0058 2792 Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe
09:54:53.0058 2792 Bonjour Service - ok
09:54:53.0105 2792 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
09:54:53.0105 2792 bowser - ok
09:54:53.0121 2792 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
09:54:53.0121 2792 BrFiltLo - ok
09:54:53.0136 2792 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
09:54:53.0136 2792 BrFiltUp - ok
09:54:53.0183 2792 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
09:54:53.0199 2792 Browser - ok
09:54:53.0230 2792 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
09:54:53.0246 2792 Brserid - ok
09:54:53.0246 2792 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
09:54:53.0246 2792 BrSerWdm - ok
09:54:53.0261 2792 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
09:54:53.0277 2792 BrUsbMdm - ok
09:54:53.0277 2792 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
09:54:53.0277 2792 BrUsbSer - ok
09:54:53.0292 2792 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
09:54:53.0308 2792 BTHMODEM - ok
09:54:53.0308 2792 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
09:54:53.0308 2792 bthserv - ok
09:54:53.0386 2792 ccSet_N360 (0e1737a63aec0f6de231bb59836c0a11) C:\Windows\system32\drivers\N360x64\0602010.005\ccSetx64.sys
09:54:53.0386 2792 ccSet_N360 - ok
09:54:53.0417 2792 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
09:54:53.0417 2792 cdfs - ok
09:54:53.0448 2792 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
09:54:53.0448 2792 cdrom - ok
09:54:53.0495 2792 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
09:54:53.0495 2792 CertPropSvc - ok
09:54:53.0526 2792 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
09:54:53.0526 2792 circlass - ok
09:54:53.0573 2792 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
09:54:53.0604 2792 CLFS - ok
09:54:53.0651 2792 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
09:54:53.0651 2792 clr_optimization_v2.0.50727_32 - ok
09:54:53.0698 2792 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
09:54:53.0698 2792 clr_optimization_v2.0.50727_64 - ok
09:54:53.0760 2792 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
09:54:53.0792 2792 clr_optimization_v4.0.30319_32 - ok
09:54:53.0870 2792 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
09:54:53.0885 2792 clr_optimization_v4.0.30319_64 - ok
09:54:53.0901 2792 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
09:54:53.0901 2792 CmBatt - ok
09:54:53.0916 2792 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
09:54:53.0916 2792 cmdide - ok
09:54:53.0979 2792 CNG (9ac4f97c2d3e93367e2148ea940cd2cd) C:\Windows\system32\Drivers\cng.sys
09:54:53.0994 2792 CNG - ok
09:54:54.0010 2792 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
09:54:54.0010 2792 Compbatt - ok
09:54:54.0057 2792 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
09:54:54.0057 2792 CompositeBus - ok
09:54:54.0072 2792 COMSysApp - ok
09:54:54.0088 2792 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
09:54:54.0104 2792 crcdisk - ok
09:54:54.0150 2792 CryptSvc (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll
09:54:54.0166 2792 CryptSvc - ok
09:54:54.0244 2792 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
09:54:54.0244 2792 DcomLaunch - ok
09:54:54.0291 2792 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
09:54:54.0291 2792 defragsvc - ok
09:54:54.0338 2792 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
09:54:54.0338 2792 DfsC - ok
09:54:54.0431 2792 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
09:54:54.0431 2792 Dhcp - ok
09:54:54.0447 2792 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
09:54:54.0447 2792 discache - ok
09:54:54.0447 2792 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
09:54:54.0447 2792 Disk - ok
09:54:54.0494 2792 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
09:54:54.0494 2792 Dnscache - ok
09:54:54.0572 2792 DockLoginService (0840abbbdf438691ee65a20040635cbe) C:\Program Files\Dell\DellDock\DockLogin.exe
09:54:54.0572 2792 DockLoginService - ok
09:54:54.0618 2792 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
09:54:54.0618 2792 dot3svc - ok
09:54:54.0665 2792 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
09:54:54.0665 2792 DPS - ok
09:54:54.0696 2792 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
09:54:54.0696 2792 drmkaud - ok
09:54:54.0821 2792 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
09:54:54.0821 2792 DXGKrnl - ok
09:54:54.0852 2792 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
09:54:54.0852 2792 EapHost - ok
09:54:55.0071 2792 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
09:54:55.0133 2792 ebdrv - ok
09:54:55.0258 2792 eeCtrl (ba6420c1f7070ed8f1ba372844f3e1ec) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
09:54:55.0274 2792 eeCtrl - ok
09:54:55.0398 2792 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
09:54:55.0398 2792 EFS - ok
09:54:55.0492 2792 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
09:54:55.0508 2792 ehRecvr - ok
09:54:55.0554 2792 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
09:54:55.0554 2792 ehSched - ok
09:54:55.0632 2792 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
09:54:55.0648 2792 elxstor - ok
09:54:55.0710 2792 EraserUtilRebootDrv (1343df3451bc0c442dc69837c6fba21b) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
09:54:55.0726 2792 EraserUtilRebootDrv - ok
09:54:55.0742 2792 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
09:54:55.0757 2792 ErrDev - ok
09:54:55.0804 2792 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
09:54:55.0820 2792 EventSystem - ok
09:54:55.0866 2792 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
09:54:55.0882 2792 exfat - ok
09:54:55.0913 2792 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
09:54:55.0929 2792 fastfat - ok
09:54:56.0007 2792 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
09:54:56.0022 2792 Fax - ok
09:54:56.0038 2792 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
09:54:56.0038 2792 fdc - ok
09:54:56.0054 2792 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
09:54:56.0054 2792 fdPHost - ok
09:54:56.0069 2792 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
09:54:56.0069 2792 FDResPub - ok
09:54:56.0100 2792 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
09:54:56.0100 2792 FileInfo - ok
09:54:56.0116 2792 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
09:54:56.0116 2792 Filetrace - ok
09:54:56.0225 2792 FLEXnet Licensing Service (f76d04f7413b07daa029f6520b64b4e8) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
09:54:56.0241 2792 FLEXnet Licensing Service - ok
09:54:56.0256 2792 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
09:54:56.0256 2792 flpydisk - ok
09:54:56.0319 2792 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
09:54:56.0319 2792 FltMgr - ok
09:54:56.0428 2792 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
09:54:56.0444 2792 FontCache - ok
09:54:56.0490 2792 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
09:54:56.0490 2792 FontCache3.0.0.0 - ok
09:54:56.0522 2792 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
09:54:56.0522 2792 FsDepends - ok
09:54:56.0553 2792 Fs_Rec (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
09:54:56.0568 2792 Fs_Rec - ok
09:54:56.0631 2792 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
09:54:56.0631 2792 fvevol - ok
09:54:56.0662 2792 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
09:54:56.0662 2792 gagp30kx - ok
09:54:56.0709 2792 GEARAspiWDM (af4dee5531395dee72b35b36c9671fd0) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
09:54:56.0709 2792 GEARAspiWDM - ok
09:54:56.0818 2792 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
09:54:56.0818 2792 gpsvc - ok
09:54:56.0880 2792 grmnusb (2ed7ff3e1ada4092632393781518b3a7) C:\Windows\system32\drivers\grmnusb.sys
09:54:56.0880 2792 grmnusb - ok
09:54:56.0974 2792 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
09:54:56.0974 2792 gupdate - ok
09:54:56.0990 2792 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
09:54:56.0990 2792 gupdatem - ok
09:54:57.0036 2792 gusvc (c1b577b2169900f4cf7190c39f085794) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
09:54:57.0052 2792 gusvc - ok
09:54:57.0068 2792 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
09:54:57.0083 2792 hcw85cir - ok
09:54:57.0161 2792 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
09:54:57.0161 2792 HdAudAddService - ok
09:54:57.0208 2792 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
09:54:57.0224 2792 HDAudBus - ok
09:54:57.0239 2792 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
09:54:57.0239 2792 HidBatt - ok
09:54:57.0270 2792 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
09:54:57.0270 2792 HidBth - ok
09:54:57.0302 2792 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
09:54:57.0302 2792 HidIr - ok
09:54:57.0348 2792 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
09:54:57.0348 2792 hidserv - ok
09:54:57.0364 2792 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
09:54:57.0364 2792 HidUsb - ok
09:54:57.0411 2792 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
09:54:57.0426 2792 hkmsvc - ok
09:54:57.0473 2792 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
09:54:57.0489 2792 HomeGroupListener - ok
09:54:57.0520 2792 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
09:54:57.0536 2792 HomeGroupProvider - ok
09:54:57.0567 2792 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
09:54:57.0567 2792 HpSAMD - ok
09:54:57.0660 2792 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
09:54:57.0676 2792 HTTP - ok
09:54:57.0723 2792 hwdatacard (8f9b0fc4ec3a8194bd4cbc5ed3e7abeb) C:\Windows\system32\DRIVERS\ewusbmdm.sys
09:54:57.0738 2792 hwdatacard - ok
09:54:57.0754 2792 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
09:54:57.0754 2792 hwpolicy - ok
09:54:57.0801 2792 hwusbdev (b45b3647ba32749b94fa689175ec8c26) C:\Windows\system32\DRIVERS\ewusbdev.sys
09:54:57.0801 2792 hwusbdev - ok
09:54:57.0801 2792 hwusbfake - ok
09:54:57.0832 2792 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
09:54:57.0832 2792 i8042prt - ok
09:54:57.0894 2792 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
09:54:57.0894 2792 iaStorV - ok
09:54:58.0004 2792 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
09:54:58.0019 2792 idsvc - ok
09:54:58.0238 2792 IDSVia64 (ce0bf35c79e03bb89da6b14fac838605) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.1.2.10\Definitions\IPSDefs\20120715.001\IDSvia64.sys
09:54:58.0253 2792 IDSVia64 - ok
09:54:58.0347 2792 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
09:54:58.0347 2792 iirsp - ok
09:54:58.0440 2792 IJPLMSVC (a06efd4965f8a3f97a8c9a291d032678) C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
09:54:58.0440 2792 IJPLMSVC - ok
09:54:58.0565 2792 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
09:54:58.0565 2792 IKEEXT - ok
09:54:58.0581 2792 IntcAzAudAddService - ok
09:54:58.0596 2792 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
09:54:58.0596 2792 intelide - ok
09:54:58.0612 2792 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
09:54:58.0612 2792 intelppm - ok
09:54:58.0643 2792 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
09:54:58.0659 2792 IPBusEnum - ok
09:54:58.0690 2792 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
09:54:58.0706 2792 IpFilterDriver - ok
09:54:58.0784 2792 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
09:54:58.0799 2792 iphlpsvc - ok
09:54:58.0799 2792 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
09:54:58.0815 2792 IPMIDRV - ok
09:54:58.0830 2792 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
09:54:58.0830 2792 IPNAT - ok
09:54:59.0002 2792 iPod Service (a9ab99ee7d39725eafec82732d2b3271) C:\Program Files\iPod\bin\iPodService.exe
09:54:59.0018 2792 iPod Service - ok
09:54:59.0033 2792 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
09:54:59.0033 2792 IRENUM - ok
09:54:59.0049 2792 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
09:54:59.0049 2792 isapnp - ok
09:54:59.0080 2792 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
09:54:59.0080 2792 iScsiPrt - ok
09:54:59.0142 2792 k57nd60a (d85f3f18e44f7447b5f1ba5c85baeb7c) C:\Windows\system32\DRIVERS\k57nd60a.sys
09:54:59.0142 2792 k57nd60a - ok
09:54:59.0174 2792 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
09:54:59.0174 2792 kbdclass - ok
09:54:59.0189 2792 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
09:54:59.0205 2792 kbdhid - ok
09:54:59.0220 2792 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
09:54:59.0220 2792 KeyIso - ok
09:54:59.0267 2792 KSecDD (97a7070aea4c058b6418519e869a63b4) C:\Windows\system32\Drivers\ksecdd.sys
09:54:59.0267 2792 KSecDD - ok
09:54:59.0283 2792 KSecPkg (26c43a7c2862447ec59deda188d1da07) C:\Windows\system32\Drivers\ksecpkg.sys
09:54:59.0298 2792 KSecPkg - ok
09:54:59.0298 2792 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
09:54:59.0298 2792 ksthunk - ok
09:54:59.0345 2792 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
09:54:59.0345 2792 KtmRm - ok
09:54:59.0376 2792 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
09:54:59.0376 2792 LanmanServer - ok
09:54:59.0423 2792 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
09:54:59.0423 2792 LanmanWorkstation - ok
09:54:59.0423 2792 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
09:54:59.0439 2792 lltdio - ok
09:54:59.0470 2792 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
09:54:59.0470 2792 lltdsvc - ok
09:54:59.0486 2792 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
09:54:59.0486 2792 lmhosts - ok
09:54:59.0532 2792 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
09:54:59.0532 2792 LSI_FC - ok
09:54:59.0548 2792 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
09:54:59.0548 2792 LSI_SAS - ok
09:54:59.0564 2792 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
09:54:59.0564 2792 LSI_SAS2 - ok
09:54:59.0579 2792 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
09:54:59.0579 2792 LSI_SCSI - ok
09:54:59.0595 2792 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
09:54:59.0595 2792 luafv - ok
09:54:59.0642 2792 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
09:54:59.0642 2792 Mcx2Svc - ok
09:54:59.0657 2792 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
09:54:59.0673 2792 megasas - ok
09:54:59.0720 2792 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
09:54:59.0735 2792 MegaSR - ok
09:54:59.0813 2792 Microsoft SharePoint Workspace Audit Service - ok
09:54:59.0844 2792 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
09:54:59.0844 2792 MMCSS - ok
09:54:59.0860 2792 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
09:54:59.0876 2792 Modem - ok
09:54:59.0907 2792 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
09:54:59.0907 2792 monitor - ok
09:54:59.0922 2792 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
09:54:59.0922 2792 mouclass - ok
09:54:59.0954 2792 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
09:54:59.0954 2792 mouhid - ok
09:54:59.0985 2792 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
09:54:59.0985 2792 mountmgr - ok
09:55:00.0078 2792 MozillaMaintenance (46297fa8e30a6007f14118fc2b942fbc) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
09:55:00.0078 2792 MozillaMaintenance - ok
09:55:00.0141 2792 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
09:55:00.0156 2792 mpio - ok
09:55:00.0203 2792 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
09:55:00.0203 2792 mpsdrv - ok
09:55:00.0312 2792 MpsSvc (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
09:55:00.0312 2792 MpsSvc - ok
09:55:00.0359 2792 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
09:55:00.0359 2792 MRxDAV - ok
09:55:00.0406 2792 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
09:55:00.0422 2792 mrxsmb - ok
09:55:00.0468 2792 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
09:55:00.0484 2792 mrxsmb10 - ok
09:55:00.0500 2792 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
09:55:00.0500 2792 mrxsmb20 - ok
09:55:00.0515 2792 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
09:55:00.0515 2792 msahci - ok
09:55:00.0562 2792 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
09:55:00.0578 2792 msdsm - ok
09:55:00.0609 2792 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
09:55:00.0609 2792 MSDTC - ok
09:55:00.0624 2792 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
09:55:00.0624 2792 Msfs - ok
09:55:00.0640 2792 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
09:55:00.0656 2792 mshidkmdf - ok
09:55:00.0656 2792 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
09:55:00.0656 2792 msisadrv - ok
09:55:00.0671 2792 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
09:55:00.0687 2792 MSiSCSI - ok
09:55:00.0687 2792 msiserver - ok
09:55:00.0702 2792 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
09:55:00.0702 2792 MSKSSRV - ok
09:55:00.0718 2792 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
09:55:00.0718 2792 MSPCLOCK - ok
09:55:00.0734 2792 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
09:55:00.0734 2792 MSPQM - ok
09:55:00.0796 2792 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
09:55:00.0812 2792 MsRPC - ok
09:55:00.0827 2792 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
09:55:00.0827 2792 mssmbios - ok
09:55:00.0843 2792 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
09:55:00.0843 2792 MSTEE - ok
09:55:00.0843 2792 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
09:55:00.0843 2792 MTConfig - ok
09:55:00.0874 2792 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
09:55:00.0874 2792 Mup - ok
09:55:00.0968 2792 N360 (c6948f034d7edabcfa2234d399fc78bc) C:\Program Files (x86)\Norton 360\Engine\6.2.1.5\ccSvcHst.exe
09:55:00.0968 2792 N360 - ok
09:55:01.0030 2792 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
09:55:01.0046 2792 napagent - ok
09:55:01.0092 2792 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
09:55:01.0108 2792 NativeWifiP - ok
09:55:01.0280 2792 NAVENG (8043d41f881d6ace40b854ad6e32217f) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.1.2.10\Definitions\VirusDefs\20120717.018\ENG64.SYS
09:55:01.0280 2792 NAVENG - ok
09:55:01.0467 2792 NAVEX15 (9a9ab2fc45d701daed465d14980f1305) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.1.2.10\Definitions\VirusDefs\20120717.018\EX64.SYS
09:55:01.0482 2792 NAVEX15 - ok
09:55:01.0623 2792 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
09:55:01.0638 2792 NDIS - ok
09:55:01.0654 2792 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
09:55:01.0654 2792 NdisCap - ok
09:55:01.0670 2792 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
09:55:01.0670 2792 NdisTapi - ok
09:55:01.0701 2792 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
09:55:01.0701 2792 Ndisuio - ok
09:55:01.0763 2792 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
09:55:01.0763 2792 NdisWan - ok
09:55:01.0794 2792 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
09:55:01.0794 2792 NDProxy - ok
09:55:01.0841 2792 Netaapl (6f4607e2333fe21e9e3ff8133a88b35b) C:\Windows\system32\DRIVERS\netaapl64.sys
09:55:01.0857 2792 Netaapl - ok
09:55:01.0888 2792 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
09:55:01.0888 2792 NetBIOS - ok
09:55:01.0950 2792 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
09:55:01.0966 2792 NetBT - ok
09:55:01.0997 2792 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
09:55:01.0997 2792 Netlogon - ok
09:55:02.0060 2792 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
09:55:02.0075 2792 Netman - ok
09:55:02.0169 2792 NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
09:55:02.0200 2792 NetMsmqActivator - ok
09:55:02.0216 2792 NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
09:55:02.0216 2792 NetPipeActivator - ok
09:55:02.0247 2792 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
09:55:02.0262 2792 netprofm - ok
09:55:02.0278 2792 NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
09:55:02.0278 2792 NetTcpActivator - ok
09:55:02.0278 2792 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
09:55:02.0278 2792 NetTcpPortSharing - ok
09:55:02.0309 2792 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
09:55:02.0309 2792 nfrd960 - ok
09:55:02.0356 2792 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
09:55:02.0372 2792 NlaSvc - ok
09:55:02.0387 2792 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
09:55:02.0387 2792 Npfs - ok
09:55:02.0403 2792 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
09:55:02.0403 2792 nsi - ok
09:55:02.0418 2792 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
09:55:02.0418 2792 nsiproxy - ok
09:55:02.0574 2792 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
09:55:02.0590 2792 Ntfs - ok
09:55:02.0684 2792 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
09:55:02.0684 2792 Null - ok
09:55:02.0715 2792 NVHDA (cddd4478757288df4bb1494bfd084259) C:\Windows\system32\drivers\nvhda64v.sys
09:55:02.0715 2792 NVHDA - ok
09:55:03.0417 2792 nvlddmkm (a5d0603cae6c334b1386204d94393c04) C:\Windows\system32\DRIVERS\nvlddmkm.sys
09:55:03.0557 2792 nvlddmkm - ok
09:55:03.0682 2792 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
09:55:03.0698 2792 nvraid - ok
09:55:03.0744 2792 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
09:55:03.0744 2792 nvstor - ok
09:55:03.0822 2792 nvsvc (268d382fcc6a8a568aab7c6dc8c71bb3) C:\Windows\system32\nvvsvc.exe
09:55:03.0822 2792 nvsvc - ok
09:55:03.0854 2792 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
09:55:03.0854 2792 nv_agp - ok
09:55:03.0885 2792 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
09:55:03.0885 2792 ohci1394 - ok
09:55:03.0978 2792 ose64 (4965b005492cba7719e82b71e3245495) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
09:55:03.0994 2792 ose64 - ok
09:55:04.0368 2792 osppsvc (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
09:55:04.0478 2792 osppsvc - ok
09:55:04.0587 2792 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
09:55:04.0602 2792 p2pimsvc - ok
09:55:04.0634 2792 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
09:55:04.0634 2792 p2psvc - ok
09:55:04.0665 2792 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
09:55:04.0680 2792 Parport - ok
09:55:04.0712 2792 partmgr (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
09:55:04.0712 2792 partmgr - ok
09:55:04.0743 2792 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
09:55:04.0743 2792 PcaSvc - ok
09:55:04.0774 2792 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
09:55:04.0774 2792 pci - ok
09:55:04.0790 2792 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
09:55:04.0790 2792 pciide - ok
09:55:04.0821 2792 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
09:55:04.0836 2792 pcmcia - ok
09:55:04.0852 2792 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
09:55:04.0852 2792 pcw - ok
09:55:04.0914 2792 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
09:55:04.0914 2792 PEAUTH - ok
09:55:05.0008 2792 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
09:55:05.0008 2792 PerfHost - ok
09:55:05.0148 2792 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
09:55:05.0164 2792 pla - ok
09:55:05.0226 2792 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
09:55:05.0226 2792 PlugPlay - ok
09:55:05.0242 2792 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
09:55:05.0242 2792 PNRPAutoReg - ok
09:55:05.0273 2792 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
09:55:05.0273 2792 PNRPsvc - ok
09:55:05.0336 2792 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
09:55:05.0351 2792 PolicyAgent - ok
09:55:05.0382 2792 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
09:55:05.0382 2792 Power - ok
09:55:05.0429 2792 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
09:55:05.0429 2792 PptpMiniport - ok
09:55:05.0445 2792 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
09:55:05.0460 2792 Processor - ok
09:55:05.0492 2792 ProfSvc (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
09:55:05.0492 2792 ProfSvc - ok
09:55:05.0523 2792 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
09:55:05.0523 2792 ProtectedStorage - ok
09:55:05.0570 2792 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
09:55:05.0585 2792 Psched - ok
09:55:05.0632 2792 PxHlpa64 (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys
09:55:05.0632 2792 PxHlpa64 - ok
09:55:05.0772 2792 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
09:55:05.0788 2792 ql2300 - ok
09:55:05.0913 2792 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
09:55:05.0928 2792 ql40xx - ok
09:55:05.0975 2792 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
09:55:05.0975 2792 QWAVE - ok
09:55:05.0991 2792 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
09:55:05.0991 2792 QWAVEdrv - ok
09:55:06.0147 2792 RapportCerberus_34302 (5e0459ed0a8f540d2f7b6e52da12c9d4) C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\34302\RapportCerberus64_34302.sys
09:55:06.0162 2792 RapportCerberus_34302 - ok
09:55:06.0225 2792 RapportEI64 (54bcd50f96236f28cefea58b30b26591) C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys
09:55:06.0225 2792 RapportEI64 - ok
09:55:06.0272 2792 RapportKE64 (fffbcf4d62276dd719a2e29e54d34760) C:\Windows\system32\Drivers\RapportKE64.sys
09:55:06.0272 2792 RapportKE64 - ok
09:55:06.0412 2792 RapportMgmtService (c862053be4168c0bb6191af76b9fc878) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe
09:55:06.0412 2792 RapportMgmtService - ok
09:55:06.0474 2792 RapportPG64 (f23ca0cd061363f7664a76313dde26e0) C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys
09:55:06.0537 2792 RapportPG64 - ok
09:55:06.0630 2792 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
09:55:06.0630 2792 RasAcd - ok
09:55:06.0677 2792 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
09:55:06.0677 2792 RasAgileVpn - ok
09:55:06.0708 2792 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
09:55:06.0708 2792 RasAuto - ok
09:55:06.0755 2792 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
09:55:06.0786 2792 Rasl2tp - ok
09:55:06.0864 2792 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
09:55:06.0864 2792 RasMan - ok
09:55:06.0880 2792 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
09:55:06.0880 2792 RasPppoe - ok
09:55:06.0911 2792 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
09:55:06.0911 2792 RasSstp - ok
09:55:06.0942 2792 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
09:55:06.0942 2792 rdbss - ok
09:55:06.0958 2792 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
09:55:06.0958 2792 rdpbus - ok
09:55:06.0989 2792 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
09:55:06.0989 2792 RDPCDD - ok
09:55:07.0005 2792 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
09:55:07.0005 2792 RDPENCDD - ok
09:55:07.0005 2792 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
09:55:07.0005 2792 RDPREFMP - ok
09:55:07.0067 2792 RDPWD (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys
09:55:07.0083 2792 RDPWD - ok
09:55:07.0114 2792 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
09:55:07.0130 2792 rdyboost - ok
09:55:07.0145 2792 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
09:55:07.0176 2792 RemoteAccess - ok
09:55:07.0208 2792 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
09:55:07.0239 2792 RemoteRegistry - ok
09:55:07.0254 2792 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
09:55:07.0270 2792 RpcEptMapper - ok
09:55:07.0286 2792 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
09:55:07.0286 2792 RpcLocator - ok
09:55:07.0348 2792 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
09:55:07.0348 2792 RpcSs - ok
09:55:07.0364 2792 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
09:55:07.0364 2792 rspndr - ok
09:55:07.0395 2792 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
09:55:07.0395 2792 SamSs - ok
09:55:07.0426 2792 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
09:55:07.0426 2792 sbp2port - ok
09:55:07.0457 2792 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
09:55:07.0473 2792 SCardSvr - ok
09:55:07.0520 2792 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
09:55:07.0520 2792 scfilter - ok
09:55:07.0629 2792 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
09:55:07.0644 2792 Schedule - ok
09:55:07.0676 2792 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
09:55:07.0676 2792 SCPolicySvc - ok
09:55:07.0722 2792 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
09:55:07.0738 2792 SDRSVC - ok
09:55:07.0863 2792 SeaPort (16a252022535b680046f6e34e136d378) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
09:55:07.0863 2792 SeaPort - ok
09:55:07.0910 2792 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
09:55:07.0910 2792 secdrv - ok
09:55:07.0925 2792 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
09:55:07.0941 2792 seclogon - ok
09:55:07.0941 2792 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
09:55:07.0941 2792 SENS - ok
09:55:07.0956 2792 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
09:55:07.0972 2792 SensrSvc - ok
09:55:07.0972 2792 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
09:55:07.0972 2792 Serenum - ok
09:55:08.0019 2792 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
09:55:08.0019 2792 Serial - ok
09:55:08.0050 2792 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
09:55:08.0050 2792 sermouse - ok
09:55:08.0097 2792 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
09:55:08.0112 2792 SessionEnv - ok
09:55:08.0128 2792 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
09:55:08.0128 2792 sffdisk - ok
09:55:08.0159 2792 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
09:55:08.0159 2792 sffp_mmc - ok
09:55:08.0175 2792 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
09:55:08.0175 2792 sffp_sd - ok
09:55:08.0190 2792 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
09:55:08.0190 2792 sfloppy - ok
09:55:08.0284 2792 SftService (e1974a92ac0914a3859359a0a8c82c68) C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
09:55:08.0300 2792 SftService - ok
09:55:08.0346 2792 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
09:55:08.0346 2792 SharedAccess - ok
09:55:08.0409 2792 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
09:55:08.0424 2792 ShellHWDetection - ok
09:55:08.0440 2792 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
09:55:08.0440 2792 SiSRaid2 - ok
09:55:08.0456 2792 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
09:55:08.0456 2792 SiSRaid4 - ok
09:55:08.0487 2792 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
09:55:08.0487 2792 Smb - ok
09:55:08.0502 2792 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
09:55:08.0502 2792 SNMPTRAP - ok
09:55:08.0518 2792 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
09:55:08.0518 2792 spldr - ok
09:55:08.0596 2792 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
09:55:08.0612 2792 Spooler - ok
09:55:08.0892 2792 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
09:55:08.0939 2792 sppsvc - ok
09:55:09.0033 2792 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
09:55:09.0033 2792 sppuinotify - ok
09:55:09.0204 2792 SRTSP (06b9a7ba94356ec5207c5ddb59540378) C:\Windows\System32\Drivers\N360x64\0602010.005\SRTSP64.SYS
09:55:09.0204 2792 SRTSP - ok
09:55:09.0251 2792 SRTSPX (fbb8945a61e55a2345d12487c74a9d76) C:\Windows\system32\drivers\N360x64\0602010.005\SRTSPX64.SYS
09:55:09.0251 2792 SRTSPX - ok
09:55:09.0345 2792 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
09:55:09.0345 2792 srv - ok
09:55:09.0376 2792 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
09:55:09.0392 2792 srv2 - ok
09:55:09.0407 2792 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
09:55:09.0423 2792 srvnet - ok
09:55:09.0454 2792 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
09:55:09.0470 2792 SSDPSRV - ok
09:55:09.0485 2792 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
09:55:09.0485 2792 SstpSvc - ok
09:55:09.0501 2792 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
09:55:09.0516 2792 stexstor - ok
09:55:09.0594 2792 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
09:55:09.0594 2792 stisvc - ok
09:55:09.0626 2792 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
09:55:09.0626 2792 swenum - ok
09:55:09.0688 2792 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
09:55:09.0688 2792 swprv - ok
09:55:09.0766 2792 SymDS (8b2430762099598da40686f754632efd) C:\Windows\system32\drivers\N360x64\0602010.005\SYMDS64.SYS
09:55:09.0766 2792 SymDS - ok
09:55:09.0906 2792 SymEFA (f90c7a190399165d3ab2245048d34786) C:\Windows\system32\drivers\N360x64\0602010.005\SYMEFA64.SYS
09:55:09.0922 2792 SymEFA - ok
09:55:09.0969 2792 SymEvent (898bb48c797483420df523b2bbc1ecdb) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
09:55:09.0984 2792 SymEvent - ok
09:55:10.0047 2792 SymIRON (5013a76caaa1d7cf1c55214b490b4e35) C:\Windows\system32\drivers\N360x64\0602010.005\Ironx64.SYS
09:55:10.0062 2792 SymIRON - ok
09:55:10.0140 2792 SymNetS (3911bd0e68c010e5438a87706abbe9ab) C:\Windows\System32\Drivers\N360x64\0602010.005\SYMNETS.SYS
09:55:10.0140 2792 SymNetS - ok
09:55:10.0281 2792 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
09:55:10.0296 2792 SysMain - ok
09:55:10.0437 2792 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
09:55:10.0452 2792 TabletInputService - ok
09:55:10.0515 2792 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
09:55:10.0530 2792 TapiSrv - ok
09:55:10.0530 2792 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
09:55:10.0530 2792 TBS - ok
09:55:10.0702 2792 Tcpip (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
09:55:10.0733 2792 Tcpip - ok
09:55:10.0952 2792 TCPIP6 (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
09:55:10.0952 2792 TCPIP6 - ok
09:55:11.0030 2792 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
09:55:11.0045 2792 tcpipreg - ok
09:55:11.0076 2792 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
09:55:11.0076 2792 TDPIPE - ok
09:55:11.0108 2792 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
09:55:11.0123 2792 TDTCP - ok
09:55:11.0154 2792 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
09:55:11.0154 2792 tdx - ok
09:55:11.0154 2792 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
09:55:11.0154 2792 TermDD - ok
09:55:11.0217 2792 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
09:55:11.0232 2792 TermService - ok
09:55:11.0248 2792 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
09:55:11.0248 2792 Themes - ok
09:55:11.0264 2792 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
09:55:11.0264 2792 THREADORDER - ok
09:55:11.0279 2792 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
09:55:11.0279 2792 TrkWks - ok
09:55:11.0326 2792 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
09:55:11.0342 2792 TrustedInstaller - ok
09:55:11.0388 2792 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
09:55:11.0388 2792 tssecsrv - ok
09:55:11.0420 2792 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
09:55:11.0435 2792 TsUsbFlt - ok
09:55:11.0482 2792 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
09:55:11.0498 2792 tunnel - ok
09:55:11.0529 2792 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
09:55:11.0529 2792 uagp35 - ok
09:55:11.0576 2792 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
09:55:11.0591 2792 udfs - ok
09:55:11.0591 2792 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
09:55:11.0591 2792 UI0Detect - ok
09:55:11.0622 2792 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
09:55:11.0622 2792 uliagpkx - ok
09:55:11.0654 2792 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
09:55:11.0654 2792 umbus - ok
09:55:11.0685 2792 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
09:55:11.0685 2792 UmPass - ok
09:55:11.0732 2792 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
09:55:11.0732 2792 upnphost - ok
09:55:11.0747 2792 USBAAPL64 (fb251567f41bc61988b26731dec19e4b) C:\Windows\system32\Drivers\usbaapl64.sys
09:55:11.0747 2792 USBAAPL64 - ok
09:55:11.0794 2792 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
09:55:11.0794 2792 usbccgp - ok
09:55:11.0841 2792 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
09:55:11.0856 2792 usbcir - ok
09:55:11.0903 2792 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
09:55:11.0903 2792 usbehci - ok
09:55:11.0966 2792 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
09:55:11.0997 2792 usbhub - ok
09:55:12.0012 2792 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys
09:55:12.0012 2792 usbohci - ok
09:55:12.0044 2792 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
09:55:12.0059 2792 usbprint - ok
09:55:12.0090 2792 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
09:55:12.0090 2792 usbscan - ok
09:55:12.0122 2792 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
09:55:12.0122 2792 USBSTOR - ok
09:55:12.0137 2792 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys
09:55:12.0137 2792 usbuhci - ok
09:55:12.0153 2792 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
09:55:12.0153 2792 UxSms - ok
09:55:12.0168 2792 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
09:55:12.0184 2792 VaultSvc - ok
09:55:12.0200 2792 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
09:55:12.0200 2792 vdrvroot - ok
09:55:12.0246 2792 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
09:55:12.0262 2792 vds - ok
09:55:12.0278 2792 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
09:55:12.0278 2792 vga - ok
09:55:12.0293 2792 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
09:55:12.0293 2792 VgaSave - ok
09:55:12.0324 2792 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
09:55:12.0340 2792 vhdmp - ok
09:55:12.0356 2792 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
09:55:12.0356 2792 viaide - ok
09:55:12.0371 2792 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
09:55:12.0371 2792 volmgr - ok
09:55:12.0434 2792 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
09:55:12.0449 2792 volmgrx - ok
09:55:12.0480 2792 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
09:55:12.0480 2792 volsnap - ok
09:55:12.0512 2792 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
09:55:12.0512 2792 vsmraid - ok
09:55:12.0636 2792 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
09:55:12.0652 2792 VSS - ok
09:55:12.0761 2792 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
09:55:12.0761 2792 vwifibus - ok
09:55:12.0792 2792 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
09:55:12.0808 2792 W32Time - ok
09:55:12.0824 2792 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
09:55:12.0824 2792 WacomPen - ok
09:55:12.0855 2792 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
09:55:12.0855 2792 WANARP - ok
09:55:12.0855 2792 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
09:55:12.0870 2792 Wanarpv6 - ok
09:55:12.0995 2792 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
09:55:13.0011 2792 WatAdminSvc - ok
09:55:13.0151 2792 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
09:55:13.0167 2792 wbengine - ok
09:55:13.0245 2792 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
09:55:13.0260 2792 WbioSrvc - ok
09:55:13.0323 2792 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
09:55:13.0323 2792 wcncsvc - ok
09:55:13.0338 2792 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
09:55:13.0338 2792 WcsPlugInService - ok
09:55:13.0370 2792 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
09:55:13.0370 2792 Wd - ok
09:55:13.0448 2792 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
09:55:13.0463 2792 Wdf01000 - ok
09:55:13.0479 2792 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
09:55:13.0479 2792 WdiServiceHost - ok
09:55:13.0479 2792 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
09:55:13.0479 2792 WdiSystemHost - ok
09:55:13.0510 2792 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
09:55:13.0526 2792 WebClient - ok
09:55:13.0541 2792 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
09:55:13.0557 2792 Wecsvc - ok
09:55:13.0572 2792 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
09:55:13.0572 2792 wercplsupport - ok
09:55:13.0604 2792 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
09:55:13.0604 2792 WerSvc - ok
09:55:13.0619 2792 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
09:55:13.0619 2792 WfpLwf - ok
09:55:13.0682 2792 WimFltr (b14ef15bd757fa488f9c970eee9c0d35) C:\Windows\system32\DRIVERS\wimfltr.sys
09:55:13.0682 2792 WimFltr - ok
09:55:13.0697 2792 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
09:55:13.0697 2792 WIMMount - ok
09:55:13.0713 2792 WinDefend - ok
09:55:13.0728 2792 WinHttpAutoProxySvc - ok
09:55:13.0791 2792 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
09:55:13.0791 2792 Winmgmt - ok
09:55:13.0962 2792 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
09:55:13.0978 2792 WinRM - ok
09:55:14.0072 2792 winusb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
09:55:14.0072 2792 winusb - ok
09:55:14.0165 2792 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
09:55:14.0181 2792 Wlansvc - ok
09:55:14.0399 2792 wlidsvc (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
09:55:14.0446 2792 wlidsvc - ok
09:55:14.0508 2792 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
09:55:14.0508 2792 WmiAcpi - ok
09:55:14.0540 2792 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
09:55:14.0555 2792 wmiApSrv - ok
09:55:14.0571 2792 WMPNetworkSvc - ok
09:55:14.0586 2792 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
09:55:14.0602 2792 WPCSvc - ok
09:55:14.0649 2792 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
09:55:14.0664 2792 WPDBusEnum - ok
09:55:14.0680 2792 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
09:55:14.0680 2792 ws2ifsl - ok
09:55:14.0696 2792 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
09:55:14.0696 2792 wscsvc - ok
09:55:14.0696 2792 WSearch - ok
09:55:14.0914 2792 wuauserv (d9ef901dca379cfe914e9fa13b73b4c4) C:\Windows\system32\wuaueng.dll
09:55:14.0961 2792 wuauserv - ok
09:55:15.0054 2792 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
09:55:15.0054 2792 WudfPf - ok
09:55:15.0101 2792 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
09:55:15.0117 2792 WUDFRd - ok
09:55:15.0164 2792 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
09:55:15.0179 2792 wudfsvc - ok
09:55:15.0242 2792 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
09:55:15.0242 2792 WwanSvc - ok
09:55:15.0288 2792 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
09:55:15.0600 2792 \Device\Harddisk0\DR0 - ok
09:55:15.0616 2792 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk6\DR7
09:55:15.0632 2792 \Device\Harddisk6\DR7 - ok
09:55:15.0647 2792 Boot (0x1200) (8f9eb09539558a533f6b60d954c04366) \Device\Harddisk0\DR0\Partition0
09:55:15.0647 2792 \Device\Harddisk0\DR0\Partition0 - ok
09:55:15.0647 2792 Boot (0x1200) (09c73b215e673f3c90dd23a09be5c568) \Device\Harddisk0\DR0\Partition1
09:55:15.0647 2792 \Device\Harddisk0\DR0\Partition1 - ok
09:55:15.0678 2792 Boot (0x1200) (0b7143a8831cf51e265ddce58cd13427) \Device\Harddisk0\DR0\Partition2
09:55:15.0678 2792 \Device\Harddisk0\DR0\Partition2 - ok
09:55:15.0694 2792 Boot (0x1200) (9007126983688f30521b3180e6f97fae) \Device\Harddisk0\DR0\Partition3
09:55:15.0694 2792 \Device\Harddisk0\DR0\Partition3 - ok
09:55:15.0710 2792 Boot (0x1200) (8ebeb491b1db21a9d43ae7cb8eb09a33) \Device\Harddisk0\DR0\Partition4
09:55:15.0710 2792 \Device\Harddisk0\DR0\Partition4 - ok
09:55:15.0741 2792 Boot (0x1200) (d84e0fe21e29a0b3a75faea3fd9da0f7) \Device\Harddisk0\DR0\Partition5
09:55:15.0741 2792 \Device\Harddisk0\DR0\Partition5 - ok
09:55:15.0756 2792 Boot (0x1200) (189ec079378a788e7a0e8488bb81b77a) \Device\Harddisk0\DR0\Partition6
09:55:15.0756 2792 \Device\Harddisk0\DR0\Partition6 - ok
09:55:15.0756 2792 Boot (0x1200) (45f14ca200c9785ac4185e068a80863d) \Device\Harddisk6\DR7\Partition0
09:55:15.0756 2792 \Device\Harddisk6\DR7\Partition0 - ok
09:55:15.0772 2792 ============================================================
09:55:15.0772 2792 Scan finished
09:55:15.0772 2792 ============================================================
09:55:15.0772 5520 Detected object count: 0
09:55:15.0772 5520 Actual detected object count: 0

and here's the OTL text log

OTL logfile created on: 18/07/2012 10:11:15 - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\NickandAnne\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

6.00 Gb Total Physical Memory | 4.26 Gb Available Physical Memory | 71.09% Memory free
12.00 Gb Paging File | 10.18 Gb Available in Paging File | 84.87% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 469.84 Gb Total Space | 369.07 Gb Free Space | 78.55% Space Free | Partition Type: NTFS
Drive I: | 58.59 Gb Total Space | 39.01 Gb Free Space | 66.58% Space Free | Partition Type: NTFS
Drive J: | 48.83 Gb Total Space | 15.13 Gb Free Space | 30.98% Space Free | Partition Type: NTFS
Drive K: | 122.07 Gb Total Space | 87.25 Gb Free Space | 71.47% Space Free | Partition Type: NTFS
Drive L: | 97.66 Gb Total Space | 44.84 Gb Free Space | 45.92% Space Free | Partition Type: NTFS
Drive M: | 3.01 Gb Total Space | 3.00 Gb Free Space | 99.48% Space Free | Partition Type: FAT32
Drive N: | 23.44 Gb Total Space | 20.46 Gb Free Space | 87.28% Space Free | Partition Type: NTFS

Computer Name: DELLOCT10 | User Name: NickandAnne | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\NickandAnne\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe (Siber Systems)
PRC - C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
PRC - C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe (Trusteer Ltd.)
PRC - C:\Program Files (x86)\Norton 360\Engine\6.2.1.5\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe (SoftThinks SAS)
PRC - C:\Program Files (x86)\CaptureWiz\Pro\CaptureWiz.exe (PixelMetrics)
PRC - C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
PRC - C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe ()


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
MOD - C:\ProgramData\Trusteer\Rapport\store\exts\RapportMS\39624\RapportMS.dll ()
MOD - C:\Program Files (x86)\Trusteer\Rapport\bin\js32.dll ()
MOD - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF ()
MOD - C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (DockLoginService) – C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (RapportMgmtService) – C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
SRV - (N360) – C:\Program Files (x86)\Norton 360\Engine\6.2.1.5\ccSvcHst.exe (Symantec Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SftService) – C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe (SoftThinks SAS)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (BecHelperService) – C:\Program Files (x86)\3 Mobile Broadband\3Connect\BecHelperService.exe ()
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (IJPLMSVC) – C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe ()
SRV - (AdobeActiveFileMonitor7.0) – C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)


========== Driver Services (SafeList) ==========

DRV:64bit: - (RapportKE64) – C:\Windows\SysNative\drivers\RapportKE64.sys (Trusteer Ltd.)
DRV:64bit: - (SymEvent) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\drivers\N360x64\0602010.005\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\SysNative\drivers\N360x64\0602010.005\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (SymNetS) – C:\Windows\SysNative\drivers\N360x64\0602010.005\symnets.sys (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\N360x64\0602010.005\symefa64.sys (Symantec Corporation)
DRV:64bit: - (SymDS) – C:\Windows\SysNative\drivers\N360x64\0602010.005\symds64.sys (Symantec Corporation)
DRV:64bit: - (SymIRON) – C:\Windows\SysNative\drivers\N360x64\0602010.005\ironx64.sys (Symantec Corporation)
DRV:64bit: - (ccSet_N360) – C:\Windows\SysNative\drivers\N360x64\0602010.005\ccsetx64.sys (Symantec Corporation)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Netaapl) – C:\Windows\SysNative\drivers\netaapl64.sys (Apple Inc.)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (NVHDA) – C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (hwdatacard) – C:\Windows\SysNative\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV:64bit: - (hwusbdev) – C:\Windows\SysNative\drivers\ewusbdev.sys (Huawei Technologies Co., Ltd.)
DRV:64bit: - (k57nd60a) Broadcom NetLink ™ – C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (grmnusb) – C:\Windows\SysNative\drivers\grmnusb.sys (GARMIN Corp.)
DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) – C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (WimFltr) – C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.1.2.10\Definitions\VirusDefs\20120717.018\ex64.sys (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.1.2.10\Definitions\VirusDefs\20120717.018\eng64.sys (Symantec Corporation)
DRV - (RapportEI64) – C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys (Trusteer Ltd.)
DRV - (RapportPG64) – C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys (Trusteer Ltd.)
DRV - (BHDrvx64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.1.2.10\Definitions\BASHDefs\20120711.002\BHDrvx64.sys (Symantec Corporation)
DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.1.2.10\Definitions\IPSDefs\20120715.001\IDSviA64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (RapportCerberus_34302) – C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\34302\RapportCerberus64_34302.sys ()
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE:64bit: - HKLM\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?&o;=101881&l;…q={SEARCHTERMS}
IE:64bit: - HKLM\..\SearchScopes\{F7F1BDBB-D120-40E1-82E5-ACBB0E066D28}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {D90F7767-63BE-43B2-B318-A17AF68FEF6A}
IE - HKLM\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?&o;=101881&l;…q={SEARCHTERMS}
IE - HKLM\..\SearchScopes\{D90F7767-63BE-43B2-B318-A17AF68FEF6A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/USCON/2
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - No CLSID value found
IE - HKCU\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}…000b8ac6fbd0645
IE - HKCU\..\SearchScopes\{544497C5-6480-417e-8A75-3C6EEBED0759}: "URL" = http://search.speedbit.com/searchresults.a…q={searchTerms}
IE - HKCU\..\SearchScopes\{6281480D-AD58-4DAF-BE6F-2B39990E87C7}: "URL" = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searclts.a…q={searchTerms}
IE - HKCU\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?&o;=101881&l;…q={SEARCHTERMS}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1;*.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.order.2: "Google"
FF - prefs.js..browser.startup.homepage: "www.google.co.uk"
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@logitech.com/HarmonyRemote,version=1.0.0: C:\Program Files (x86)\Logitech\Harmony Remote Driver\NprtHarmonyPlugin.dll (Logitech Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nosltd.com/getPlus+®,version=1.6.2.91: C:\Program Files (x86)\NOS\bin\np_gp.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\NickandAnne\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.1.2.10\IPSFFPlgn\ [2012/04/19 16:50:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.1.2.10\coFFPlgn\ [2012/07/18 10:03:55 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files (x86)\Siber Systems\AI RoboForm\Firefox [2012/07/08 12:24:34 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/07/18 09:47:03 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/05/29 07:27:52 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/07/18 09:47:03 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/05/29 07:27:52 | 000,000,000 | —D | M]

[2010/10/30 13:36:39 | 000,000,000 | —D | M] (No name found) – C:\Users\NickandAnne\AppData\Roaming\Mozilla\Extensions
[2012/06/01 18:56:08 | 000,000,000 | —D | M] (No name found) – C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\iugy5fdg.default\extensions
[2012/06/01 18:56:08 | 000,000,000 | —D | M] (Complitly - Speed up your search with your personal search suggestions tool) – C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\iugy5fdg.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516}
[2012/07/17 10:03:35 | 000,000,000 | —D | M] (No name found) – C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions
[2012/07/16 10:46:04 | 000,000,000 | —D | M] (Freecorder) – C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}
[2010/10/30 14:06:18 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/06/01 18:56:08 | 000,000,000 | —D | M] (Complitly - Speed up your search with your personal search suggestions tool) – C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516}
[2011/02/13 23:27:35 | 000,000,000 | —D | M] (PDF Download) – C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}
[2012/07/17 10:03:35 | 000,000,000 | —D | M] (uTorrentBar Community Toolbar) – C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2011/02/19 10:52:33 | 000,000,000 | —D | M] (No name found) – C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\nostmp
[2012/07/17 10:03:14 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/04/12 13:05:10 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions\[removed]
[2011/03/05 10:43:17 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions\[removed]
[2012/07/18 09:47:03 | 000,136,672 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010/09/15 04:50:38 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012/06/14 23:19:40 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/06/14 23:19:40 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http:\/\/www.google.com
CHR - homepage: http:\/\/www.google.com
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.46\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.46\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.46\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\NickandAnne\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll
CHR - plugin: Chrome DAP extension (Enabled) = C:\Users\NickandAnne\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffdcfjdljhbehggjdkdioajnknjcpbjb\2.0.9_0\lib\/npdapchrome.dll
CHR - plugin: Norton Confidential (Enabled) = C:\Users\NickandAnne\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.3.7_0\npcoplgn.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U22 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Download Accelerator Plus (DAP) Opera\/NS6 plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdap.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: getPlusPlus for Adobe 16291 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np_gp.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL
CHR - plugin: CANON iMAGE GATEWAY Album Plugin Utility (Enabled) = C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
CHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.2.183.23\npGoogleOneClick8.dll
CHR - plugin: Harmony Firefox Plugin (Enabled) = C:\Program Files (x86)\Logitech\Harmony Remote Driver\NprtHarmonyPlugin.dll
CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\NickandAnne\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\NickandAnne\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\
CHR - Extension: Google Search = C:\Users\NickandAnne\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
CHR - Extension: Download Accelerator Plus (DAP) = C:\Users\NickandAnne\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffdcfjdljhbehggjdkdioajnknjcpbjb\2.0.9_0\
CHR - Extension: Norton Identity Protection = C:\Users\NickandAnne\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.3.7_0\
CHR - Extension: Gmail = C:\Users\NickandAnne\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\

O1 HOSTS File: ([2012/06/12 12:19:25 | 000,442,883 | R— | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 www.123fporn.info
O1 - Hosts: 15214 more lines…
O2:64bit: - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\6.2.1.5\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\6.2.1.5\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (&RoboForm; Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (&RoboForm; Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\6.2.1.5\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4 - HKCU..\Run: [RoboForm] C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - Startup: C:\Users\NickandAnne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CaptureWiz.lnk = C:\Program Files (x86)\CaptureWiz\Pro\CaptureWiz.exe (PixelMetrics)
O4 - Startup: C:\Users\NickandAnne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver; - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8:64bit: - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8:64bit: - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8:64bit: - Extra context menu item: Show RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: Show RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9:64bit: - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: //@surf.mar@/ ([]money in Local intranet)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{143CD88C-FAAD-4C33-9FD4-AACF78D5D8A9}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A07D06BD-9D31-4669-A98E-F6A6470C4FD7}: DhcpNameServer = 172.30.139.17 172.30.139.17
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{2bbeb73a-0200-11e1-a9fa-b8ac6fbd0645}\Shell - "" = AutoRun
O33 - MountPoints2\{2bbeb73a-0200-11e1-a9fa-b8ac6fbd0645}\Shell\AutoRun\command - "" = M:\AutoRun.exe
O33 - MountPoints2\{2bbeb84d-0200-11e1-a9fa-b8ac6fbd0645}\Shell - "" = AutoRun
O33 - MountPoints2\{2bbeb84d-0200-11e1-a9fa-b8ac6fbd0645}\Shell\AutoRun\command - "" = M:\AutoRun.exe
O33 - MountPoints2\{2bbeb9aa-0200-11e1-a9fa-b8ac6fbd0645}\Shell - "" = AutoRun
O33 - MountPoints2\{2bbeb9aa-0200-11e1-a9fa-b8ac6fbd0645}\Shell\AutoRun\command - "" = M:\AutoRun.exe
O33 - MountPoints2\{75a5a1b4-5992-11e0-825a-b8ac6fbd0645}\Shell - "" = AutoRun
O33 - MountPoints2\{75a5a1b4-5992-11e0-825a-b8ac6fbd0645}\Shell\AutoRun\command - "" = O:\AutoRun.exe
O33 - MountPoints2\{75a5a2c8-5992-11e0-825a-b8ac6fbd0645}\Shell - "" = AutoRun
O33 - MountPoints2\{75a5a2c8-5992-11e0-825a-b8ac6fbd0645}\Shell\AutoRun\command - "" = O:\AutoRun.exe
O33 - MountPoints2\{b1e8f6e3-021c-11e1-8c3a-b8ac6fbd0645}\Shell - "" = AutoRun
O33 - MountPoints2\{b1e8f6e3-021c-11e1-8c3a-b8ac6fbd0645}\Shell\AutoRun\command - "" = O:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)


CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/07/17 10:03:17 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Maintenance Service
[2012/07/12 19:24:05 | 000,000,000 | —D | C] – C:\Users\NickandAnne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The Keepers 2 Survey
[2012/07/12 19:24:05 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Keepers 2 Survey
[2012/07/12 19:24:05 | 000,000,000 | —D | C] – C:\Program Files (x86)\The Keepers 2 Survey
[2012/07/12 03:02:16 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/07/12 03:02:16 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/07/12 03:02:15 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/07/12 03:02:15 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/07/12 03:02:14 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/07/12 03:02:14 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/07/12 03:02:14 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/07/12 03:02:14 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/07/12 03:02:13 | 002,311,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/07/12 03:02:13 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/07/12 03:02:13 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/07/12 03:02:13 | 000,818,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/07/12 03:02:13 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/07/11 07:30:02 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msxml3r.dll
[2012/07/11 07:30:02 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msxml3r.dll
[2012/07/11 07:29:56 | 000,307,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncrypt.dll
[2012/07/11 07:29:41 | 001,462,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\crypt32.dll
[2012/07/11 07:29:41 | 000,140,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cryptnet.dll
[2012/07/11 07:29:16 | 000,805,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\cdosys.dll
[2012/07/11 07:29:15 | 001,133,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cdosys.dll
[2012/07/09 22:25:37 | 000,000,000 | —D | C] – C:\Users\NickandAnne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spirits of Mystery - Song of the Phoenix
[2012/07/09 22:25:37 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spirits of Mystery - Song of the Phoenix
[2012/07/09 22:25:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Spirits of Mystery - Song of the Phoenix
[2012/07/08 07:41:20 | 000,000,000 | —D | C] – C:\Users\NickandAnne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spirits of Mystery - Song of the Phoenix Collector's Edition
[2012/07/08 07:41:20 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spirits of Mystery - Song of the Phoenix Collector's Edition
[2012/07/08 07:41:20 | 000,000,000 | —D | C] – C:\Program Files (x86)\Spirits of Mystery - Song of the Phoenix Collector's Edition
[2012/07/03 20:23:31 | 000,000,000 | —D | C] – C:\Users\NickandAnne\Desktop\VICKY1
[2012/07/03 16:07:54 | 000,055,384 | —- | C] (Sunbelt Software) – C:\Windows\SysNative\drivers\SBREDrv.sys
[2012/07/03 16:05:40 | 000,000,000 | —D | C] – C:\ProgramData\Lavasoft
[2012/07/03 16:05:40 | 000,000,000 | —D | C] – C:\Program Files (x86)\Lavasoft
[2012/07/03 15:56:50 | 000,000,000 | —D | C] – C:\ProgramData\GFI Software
[2012/06/24 12:37:48 | 000,000,000 | —D | C] – C:\Users\NickandAnne\Desktop\Powerpoint Week 3
[2012/06/22 09:35:38 | 000,057,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuauclt.exe
[2012/06/22 09:35:38 | 000,044,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups2.dll
[2012/06/22 09:35:37 | 002,622,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wucltux.dll
[2012/06/22 09:35:24 | 000,701,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapi.dll
[2012/06/22 09:35:24 | 000,099,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wudriver.dll
[2012/06/22 09:35:24 | 000,038,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups.dll
[2012/06/22 09:34:53 | 000,186,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuwebv.dll
[2012/06/22 09:34:53 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapp.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/18 10:09:47 | 000,014,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/18 10:09:47 | 000,014,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/18 10:02:28 | 000,000,904 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/18 10:02:18 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/07/18 10:02:12 | 536,063,999 | -HS- | M] () – C:\hiberfil.sys
[2012/07/18 09:50:07 | 000,778,278 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/07/18 09:50:07 | 000,664,054 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/07/18 09:50:07 | 000,124,790 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/07/18 09:46:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/07/18 09:44:00 | 000,000,908 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/07/17 09:06:57 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/07/17 09:06:57 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/07/12 19:25:04 | 000,020,971 | —- | M] () – C:\Windows\WININIT.INI
[2012/07/12 19:25:02 | 000,001,975 | —- | M] () – C:\Users\Public\Desktop\Play The Keepers 2 Survey.lnk
[2012/07/12 19:25:02 | 000,001,270 | —- | M] () – C:\Users\Public\Desktop\More Great Games.lnk
[2012/07/12 08:46:16 | 000,002,306 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2012/07/12 03:40:58 | 000,415,624 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/07/10 16:08:01 | 000,000,064 | —- | M] () – C:\Windows\SysWow64\rp_stats.dat
[2012/07/10 16:08:01 | 000,000,044 | —- | M] () – C:\Windows\SysWow64\rp_rules.dat
[2012/07/09 22:27:29 | 000,002,199 | —- | M] () – C:\Users\Public\Desktop\Play Spirits of Mystery - Song of the Phoenix.lnk
[2012/07/08 07:42:14 | 000,002,383 | —- | M] () – C:\Users\Public\Desktop\Play Spirits of Mystery - Song of the Phoenix Collector's Edition.lnk
[2012/07/08 07:19:18 | 000,101,464 | —- | M] (Trusteer Ltd.) – C:\Windows\SysNative\drivers\RapportKE64.sys
[2012/07/03 16:07:54 | 000,055,384 | —- | M] (Sunbelt Software) – C:\Windows\SysNative\drivers\SBREDrv.sys
[2012/07/03 13:46:44 | 000,024,904 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2012/06/24 15:08:17 | 000,000,529 | —- | M] () – C:\Users\NickandAnne\Desktop\PowerPoint 2010 Animating Text and Objects - Lesson 16.website
[2012/06/22 22:47:18 | 000,002,603 | —- | M] () – C:\Users\NickandAnne\Desktop\dino.jpg
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/17 10:03:22 | 000,001,108 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/07/12 19:25:02 | 000,001,270 | —- | C] () – C:\Users\Public\Desktop\More Great Games.lnk
[2012/07/12 19:25:01 | 000,001,975 | —- | C] () – C:\Users\Public\Desktop\Play The Keepers 2 Survey.lnk
[2012/07/09 22:27:28 | 000,002,199 | —- | C] () – C:\Users\Public\Desktop\Play Spirits of Mystery - Song of the Phoenix.lnk
[2012/07/08 07:42:13 | 000,002,383 | —- | C] () – C:\Users\Public\Desktop\Play Spirits of Mystery - Song of the Phoenix Collector's Edition.lnk
[2012/07/06 21:02:55 | 000,000,064 | —- | C] () – C:\Windows\SysWow64\rp_stats.dat
[2012/07/06 21:02:55 | 000,000,044 | —- | C] () – C:\Windows\SysWow64\rp_rules.dat
[2012/06/22 22:47:18 | 000,002,603 | —- | C] () – C:\Users\NickandAnne\Desktop\dino.jpg
[2012/05/29 07:26:02 | 000,002,560 | —- | C] () – C:\Windows\_MSRSTRT.EXE
[2012/05/14 17:45:42 | 000,763,706 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/12/01 13:08:17 | 000,020,971 | —- | C] () – C:\Windows\WININIT.INI
[2011/10/27 14:12:49 | 000,109,216 | —- | C] () – C:\Windows\SysWow64\EasyHook64.dll
[2011/06/10 20:25:25 | 000,000,048 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2011/04/30 13:34:54 | 000,084,480 | —- | C] () – C:\Windows\SysWow64\EasyHook32.dll
[2011/04/09 19:12:59 | 000,071,259 | —- | C] () – C:\Windows\Huawei ModemsUninstall.exe
[2011/03/08 20:46:34 | 000,000,031 | —- | C] () – C:\Windows\QUICKEN.INI
[2010/11/28 19:01:43 | 000,033,792 | —- | C] () – C:\Users\NickandAnne\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/31 17:42:15 | 000,000,550 | —- | C] () – C:\Users\NickandAnne\AppData\Roaming\prefsdb.dat
[2010/10/31 16:58:01 | 000,038,439 | —- | C] () – C:\Users\NickandAnne\AppData\Roaming\Comma Separated Values (DOS).ADR
[2010/10/30 16:47:50 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2010/10/30 13:36:32 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat

========== LOP Check ==========

[2012/04/07 16:26:49 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\4 Friends Games
[2011/04/30 23:33:31 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\A Gypsy's Tale - The Tower of Secrets
[2011/05/07 11:53:39 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\ACASystems
[2010/11/04 19:14:23 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Aerohills
[2011/02/06 22:47:45 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Alawar
[2012/04/10 20:34:41 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\AlawarEntertainment
[2012/03/17 17:49:18 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Amaranth Games
[2011/12/22 01:47:18 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Amazon
[2011/01/16 21:04:39 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Anarchy
[2010/12/28 22:59:02 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Artifex Mundi
[2012/04/28 17:12:37 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Artogon
[2012/06/01 19:53:22 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Audacity
[2011/02/20 16:17:00 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Aveyond 3
[2010/12/28 01:01:15 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Awem
[2012/03/18 15:35:25 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Big Fish Games
[2011/10/29 09:23:13 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Birdstep Technology
[2010/12/27 01:34:48 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\BloodTies
[2012/04/16 20:21:21 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Blue Tea Games
[2011/08/10 15:46:05 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Boolat Games
[2012/02/11 09:58:51 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Boomzap
[2012/05/02 09:18:44 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Canon
[2010/12/27 13:33:02 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Casual Arts
[2011/10/29 18:51:12 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Casual Box
[2011/03/19 14:06:21 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\CursedOnboard
[2011/07/03 18:28:47 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\DailyMagic
[2010/10/31 23:50:42 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\DarkParablesBriarRoseSE_BFG
[2012/03/13 01:28:05 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\DragonsEye Studios
[2011/02/20 16:02:42 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Dying for Daylight
[2011/02/20 00:36:33 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Dying for Daylight Shared
[2010/12/26 16:38:32 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\EleFun Games
[2012/04/09 20:13:47 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Elephant Games
[2011/09/04 09:18:47 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Enki Games
[2011/01/26 23:05:09 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Enlightenus2SE_BFG
[2011/02/24 22:29:09 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\ERS G-Studio
[2012/07/08 07:43:05 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\ERS Game Studios
[2012/03/18 15:58:32 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\EscapeTheMuseum2
[2011/11/13 18:19:26 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Fanda Games
[2011/08/31 21:20:06 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Fenomen Games
[2010/11/09 19:20:41 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Floodlight Games
[2011/12/22 14:54:18 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\FlyWheelGames
[2011/02/22 23:49:14 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Foxit Software
[2011/05/15 22:12:24 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Freeze Tag
[2012/04/09 18:20:33 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Friday's games
[2012/03/25 09:13:35 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Frogwares
[2011/03/19 19:33:37 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\funkitron
[2011/05/07 19:01:08 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Fuzzy Bug Interactive
[2012/04/07 12:58:57 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\GameInvest
[2012/04/06 13:10:54 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\GameMill Entertainment
[2011/03/10 13:01:54 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\GAMEON
[2011/02/26 23:58:45 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\GAMGO
[2011/10/27 10:22:55 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Garmin
[2011/02/09 20:15:15 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Gestalt Games
[2011/08/29 11:18:43 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\gogii
[2011/09/04 09:01:30 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Gogii Games
[2011/12/07 23:05:15 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\GoldSunGames
[2011/08/09 17:15:42 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\GoodSync
[2011/11/29 16:34:06 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\GrayTech
[2012/05/14 17:49:35 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\HandBrake
[2011/11/13 18:07:57 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\HdO Adventure
[2012/03/31 15:08:58 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\HitPoint Studios
[2011/02/24 22:14:51 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\iMaxGen
[2012/04/07 16:10:00 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\IrfanView
[2012/03/06 12:19:18 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\JAM Software
[2012/03/17 17:36:05 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Jetdogs Studios
[2011/05/01 18:47:28 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\KeePass
[2011/04/23 18:32:46 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\KranX Productions
[2011/04/22 16:46:00 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Lazy Turtle Games
[2011/07/24 10:47:22 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Listing Factory 2011
[2010/11/13 17:48:02 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\MA2
[2011/04/10 23:00:29 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\MagicIndie
[2011/03/10 18:45:10 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\margrave3_full
[2011/04/13 17:38:18 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\margrave3_se
[2012/02/09 19:07:59 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Mariaglorum
[2012/04/25 21:20:25 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\MB-Ruler
[2011/04/03 11:39:28 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\md studio
[2012/07/18 09:52:48 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\MediaMonkey
[2012/02/12 12:31:20 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\MumboJumbo
[2012/03/31 17:34:59 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\My Games
[2010/12/22 00:21:26 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Mystery of Mortlake Mansion
[2011/01/24 21:39:59 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Namco
[2012/04/07 14:19:52 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Orneon
[2011/05/25 17:17:29 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\PCDr
[2010/10/31 17:50:00 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\perfect future studio
[2011/01/08 17:40:10 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Phantasmat_bf_ce1
[2010/10/30 18:33:36 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\PixelMetrics
[2011/11/20 21:01:09 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\PlayFirst
[2011/12/09 22:35:41 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\playmink
[2011/03/05 10:43:46 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\PlayPond
[2011/08/10 16:21:07 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\PoBros
[2011/01/13 20:35:31 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Private Moon Studios
[2011/11/19 12:55:59 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\quickclick
[2010/10/30 17:11:27 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\RoboForm
[2011/04/23 16:57:59 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Samsung
[2010/11/13 20:57:19 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\ShinyTales
[2011/03/20 15:01:11 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Silverback Productions
[2012/04/15 12:12:27 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Skunk Studios
[2011/12/07 22:11:41 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Spark Plug Games
[2011/03/10 15:12:32 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Specialbit
[2011/02/25 17:31:22 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\SulusGames
[2010/12/07 22:10:12 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Supermarket Mania 2
[2011/05/29 20:28:59 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Ten Heavens
[2011/04/21 17:15:49 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\TikisLab
[2011/08/26 19:00:20 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\TitanicMystery
[2011/04/12 12:45:05 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\TOMI3
[2011/12/09 21:35:26 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Top Evidence
[2010/10/31 20:18:17 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Trusteer
[2011/09/11 23:21:31 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Vast Studios
[2011/04/18 23:52:29 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\VendelGAMES
[2012/02/14 18:29:19 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Virtual Prophecy
[2011/05/14 19:08:09 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\Vogat Interactive
[2011/02/13 10:59:40 | 000,000,000 | —D | M] – C:\Users\NickandAnne\AppData\Roaming\WhiteBirdsProductions
[2012/01/18 04:17:23 | 000,032,628 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2007/11/07 09:03:18 | 000,562,688 | —- | M] (Microsoft Corporation) – C:\install.exe
[1 C:\*.tmp files -> C:\*.tmp -> ]

< MD5 for: EXPLORER.EXE >
[2010/10/14 04:44:53 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=00B0358734CAA32C39D181FE6916B178 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_b8b0208ee0ce1889\explorer.exe
[2011/02/26 07:23:14 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 06:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/14 02:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 06:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2010/10/14 04:45:03 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 06:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 07:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011/02/25 07:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 07:14:34 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 13:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2010/10/14 04:44:53 | 002,868,736 | —- | M] (Microsoft Corporation) MD5=6D4F9E4B640B413C6F73414327484C80 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_addea9f19345cd81\explorer.exe
[2010/10/14 04:44:56 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 06:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011/02/25 06:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/10/14 04:45:03 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2010/10/14 04:44:56 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 14:24:45 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2010/10/14 04:45:03 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2010/10/14 04:44:56 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/14 02:39:10 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2010/10/14 04:45:03 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2010/10/14 04:44:53 | 002,868,736 | —- | M] (Microsoft Corporation) MD5=CA17F8620815267DC838E30B68CB5052 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_ae5b763cac6d568e\explorer.exe
[2011/02/26 07:26:45 | 002,870,784 | —- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2010/10/14 04:44:56 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[2010/10/14 04:44:53 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=FC89FACA0473641CB625EDA9277D0885 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_b8335443c7a68f7c\explorer.exe

< MD5 for: SVCHOST.EXE >
[2009/07/14 02:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\SysWOW64\svchost.exe
[2009/07/14 02:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2012/07/03 13:46:42 | 000,217,672 | —- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2009/07/14 02:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\SysNative\svchost.exe
[2009/07/14 02:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 13:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\SysWOW64\userinit.exe
[2010/11/20 13:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/14 02:14:43 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/14 02:39:48 | 000,030,208 | —- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 14:25:24 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\SysNative\userinit.exe
[2010/11/20 14:25:24 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/20 14:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SysNative\winlogon.exe
[2010/11/20 14:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/14 02:39:52 | 000,389,120 | —- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012/07/03 13:46:42 | 000,217,672 | —- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010/10/14 04:45:03 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2010/10/14 04:45:03 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

========== Alternate Data Streams ==========

@Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP:E690114B
@Alternate Data Stream - 253 bytes -> C:\ProgramData\TEMP:11590865
@Alternate Data Stream - 241 bytes -> C:\ProgramData\TEMP:AAA06E15
@Alternate Data Stream - 238 bytes -> C:\ProgramData\TEMP:2211E7A0
@Alternate Data Stream - 237 bytes -> C:\ProgramData\TEMP:B6E6C4EA
@Alternate Data Stream - 236 bytes -> C:\ProgramData\TEMP:EDDBC69E
@Alternate Data Stream - 236 bytes -> C:\ProgramData\TEMP:A88BE334
@Alternate Data Stream - 234 bytes -> C:\ProgramData\TEMP:24FECE50
@Alternate Data Stream - 232 bytes -> C:\ProgramData\TEMP:B54E4B5A
@Alternate Data Stream - 232 bytes -> C:\ProgramData\TEMP:B1786630
@Alternate Data Stream - 232 bytes -> C:\ProgramData\TEMP:488F7244
@Alternate Data Stream - 230 bytes -> C:\ProgramData\TEMP:2AE74FF9
@Alternate Data Stream - 228 bytes -> C:\ProgramData\TEMP:D6D084A5
@Alternate Data Stream - 226 bytes -> C:\ProgramData\TEMP:BEE39E9B
@Alternate Data Stream - 225 bytes -> C:\ProgramData\TEMP:59465B40
@Alternate Data Stream - 224 bytes -> C:\ProgramData\TEMP:C0893153
@Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:E87AB4E3
@Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:8B4B9596
@Alternate Data Stream - 222 bytes -> C:\ProgramData\TEMP:F5B51004
@Alternate Data Stream - 222 bytes -> C:\ProgramData\TEMP:3DB6F365
@Alternate Data Stream - 220 bytes -> C:\ProgramData\TEMP:C0A9B815
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:E80802C7
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:C22674B6
@Alternate Data Stream - 218 bytes -> C:\ProgramData\TEMP:BCFEA004
@Alternate Data Stream - 218 bytes -> C:\ProgramData\TEMP:B139DDF3
@Alternate Data Stream - 218 bytes -> C:\ProgramData\TEMP:9BAC4211
@Alternate Data Stream - 218 bytes -> C:\ProgramData\TEMP:0EC7A545
@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:041C0562
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMP:DE875C30
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMP:C370B84F
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMP:8BE7A048
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMP:76987FE5
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMP:5A2E8BBF
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP:1ECED34B
@Alternate Data Stream - 212 bytes -> C:\ProgramData\TEMP:59846E5E
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:CAC06C34
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:C7F08EA3
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:1416AAA6
@Alternate Data Stream - 204 bytes -> C:\ProgramData\TEMP:47FE7AB7
@Alternate Data Stream - 200 bytes -> C:\ProgramData\TEMP:260575F1
@Alternate Data Stream - 197 bytes -> C:\ProgramData\TEMP:D8139E6A
@Alternate Data Stream - 195 bytes -> C:\ProgramData\TEMP:0AC32449
@Alternate Data Stream - 153 bytes -> C:\ProgramData\TEMP:B8791731
@Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:B190BE3A
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:E8C44CB4
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:AD020DC3
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:378824DE
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:0A74923C
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:3AD6342E
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:1234ADAE
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:0785072C
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:05670151
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:F1F936DF
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:C5DC2B0C
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:BF6C81B2
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:7BFAAE70
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:1E17A249
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:1B96CF22
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:19474103
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:AABECEFB
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:84BD8B63
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:4F7FE589
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:491270B8
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:3D6B89CE
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:1A15E356
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:FC70A22A
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:689AB7E9
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:2CC32B31
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:2CB9631F
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:1C201DEB
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:012BC84F
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:EFF3C3C8
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:5C0940F1
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:474022C7
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:3969ACF7
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:160ADF0B
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:F142DBA9
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:EBCF5924
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:A4E7D25F
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:88C0A705
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:2E3F04BC
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:EB4FEEF5
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:B6D84F71
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:A6F30843
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:79875988
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:3EC5BC08
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:3E200C29
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:397D67BA
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:F135A76C
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:C72A744C
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:A4AF8D0D
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:8BE8BFCD
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:5E73E1C2
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:1B389835
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:A5584049
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:8AE92FD3
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:88E8CC2E
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:4C8FA829
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:29F0CA7D
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:E894A3ED
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:B0456F0C
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:AA0017FD
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:697DDE2B
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:6294B369
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:E6708F08
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:D9656460
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:A0921B2C
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:0588E665
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:9F3CEEE6
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:961B84C5
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:6ED8B881
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:2D133896
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:014BC3B4
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:BF6A2C54
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:BE6B5FC3
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:A8185163
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:5A9F1AE5
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:553056F1
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:2E636DD9
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:2AF322BF
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:12383CAE
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:08801FDB
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:EA1919C7
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:E6C6EB3B
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:DC7EDF41
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:65B8AF94
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:53B8C5D2
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:31C9BA96
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:C0BCE04B
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:B3196E8D
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:9FD757A9
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:700B9342
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:58E38390
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:BE0654D6
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:AED33A42
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:9D6EAEC3
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:905BCB57
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:16A4620C
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:BBCB4421
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:852F2262
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:834DD57E
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:46CBC45C
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:B8EB1B99
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:A9056F42
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:5133A494
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:A5241382
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:64170090
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:51E66512
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:3B454A5C
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:23834E1E
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:C9B27A06
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:A6D6E537
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:52C24010
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:090FB735
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:B1381B34
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:96AFAB10
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:4B1195DD
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:7A032A04
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:2C86E2AD
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:C186F20B
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:FC2D0F32
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:E51234A9
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:E2CFA9CD
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:CA23BCFD
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:74176932
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:71612023
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:6DD124E2
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:A798AA1A
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:3E06C78F
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:3086B95F
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:27C3CD07
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:2216A431
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:1E68D1C6
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:7ADB695A
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:774A0E14
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:6CF828C2
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:61AF2B29
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:2B11E0DF
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:24C072FF
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:4EEC7800
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:14A1BBE3
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:82529191
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:71F04C26
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:40EE25BB
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:109734F6
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:8E5EA40F
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:5A15BCD4
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:A6D89509
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:72A1B66A
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:4DDE401B
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:BD34FFC5
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:9EE6560D
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:598E0FFA
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:553CA6CA
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:D226A81A

< End of report >

and here's the Extras.txt log

OTL Extras logfile created on: 18/07/2012 10:11:15 - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\NickandAnne\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

6.00 Gb Total Physical Memory | 4.26 Gb Available Physical Memory | 71.09% Memory free
12.00 Gb Paging File | 10.18 Gb Available in Paging File | 84.87% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 469.84 Gb Total Space | 369.07 Gb Free Space | 78.55% Space Free | Partition Type: NTFS
Drive I: | 58.59 Gb Total Space | 39.01 Gb Free Space | 66.58% Space Free | Partition Type: NTFS
Drive J: | 48.83 Gb Total Space | 15.13 Gb Free Space | 30.98% Space Free | Partition Type: NTFS
Drive K: | 122.07 Gb Total Space | 87.25 Gb Free Space | 71.47% Space Free | Partition Type: NTFS
Drive L: | 97.66 Gb Total Space | 44.84 Gb Free Space | 45.92% Space Free | Partition Type: NTFS
Drive M: | 3.01 Gb Total Space | 3.00 Gb Free Space | 99.48% Space Free | Partition Type: FAT32
Drive N: | 23.44 Gb Total Space | 20.46 Gb Free Space | 87.28% Space Free | Partition Type: NTFS

Computer Name: DELLOCT10 | User Name: NickandAnne | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = ChromeHTML] – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
http [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [MediaMonkey.1Play] – "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)
Directory [MediaMonkey.2PlayNext] – "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)
Directory [MediaMonkey.3Enqueue] – "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
http [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [MediaMonkey.1Play] – "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)
Directory [MediaMonkey.2PlayNext] – "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)
Directory [MediaMonkey.3Enqueue] – "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{040CD19F-4A4D-4003-A69A-E15276349D83}" = rport=139 | protocol=6 | dir=out | app=system |
"{0C29CAF4-A575-4B63-A0BF-A419A466728B}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{17F05F0D-6B08-4965-ADE1-435D60F61666}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{21C67AB8-CBBB-43C6-B5E5-AD09F6BB35D6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{32F3A5F3-15BF-4151-94E0-09701E2CFE53}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{3AB89E16-7094-48FA-9A0B-3912F51D9EB5}" = lport=139 | protocol=6 | dir=in | app=system |
"{59C044CA-4BF2-42CC-999C-9AF33CED18E6}" = rport=445 | protocol=6 | dir=out | app=system |
"{5FBAF3FC-3CD7-479F-A7FC-115B4F65089A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{68540515-0EF8-4324-A0C5-407F03EEB980}" = rport=137 | protocol=17 | dir=out | app=system |
"{6FDBF7FF-0ADF-4E51-AA95-71079264D0A5}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7994FE06-B0B1-4004-AAFE-CC2584126303}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7E9DE781-8D7F-4BE7-B721-71E566A2EFDD}" = lport=2869 | protocol=6 | dir=in | app=system |
"{8F2EA190-EA4B-440B-BA38-900824013876}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{92AE8EE3-9CAF-46BC-A57D-B85D94861C24}" = lport=138 | protocol=17 | dir=in | app=system |
"{9966BFED-2DC0-4A2B-B934-E5A90FC8FE70}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{9A66DD30-EACA-4E02-9435-E23C676D2466}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9C9181B5-DD3E-4873-8060-903C95412EC6}" = lport=137 | protocol=17 | dir=in | app=system |
"{A41EA54C-7ABF-4515-9E5E-788F51FB26D8}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{ACB2435E-F0CF-42F2-B110-2C4D9AABFB9D}" = lport=10243 | protocol=6 | dir=in | app=system |
"{C4E56637-28DE-4BA2-AB82-AF08FCD68C49}" = lport=445 | protocol=6 | dir=in | app=system |
"{C5DD33FB-51BA-413A-9DF3-32582928FC51}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C788C285-C12D-4D47-BE4E-F37232F47D6D}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe |
"{C9FFA643-300E-4ABE-8708-3E2EAE9C7569}" = rport=138 | protocol=17 | dir=out | app=system |
"{CA20E5D9-69F1-48BA-95A5-195711B801CE}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D776A70E-5007-4C72-A5EC-2CCAED566B74}" = lport=2869 | protocol=6 | dir=in | app=system |
"{DD559C3F-39AB-4FB0-BC30-C07765D97120}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{E09DAE5C-5081-4F8B-860C-386F1C2246D1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{EEF9E689-6466-48F7-9316-49EA4E10FD16}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{EFFA343D-89B9-40A9-8C66-FF29822D0EB2}" = rport=10243 | protocol=6 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{127F06C7-50D8-47F4-9937-BFC3331A0120}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{19E4CD29-2AA0-42F0-88F9-C5444D061B0E}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{22C857D4-7565-43D6-9CE6-8A3EFD19F2DE}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{23418407-1FA4-4715-9652-F6EC1D01F463}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{23D184CB-7796-4939-8213-B8B8FCEF7777}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2554D16C-72DC-4F23-98D7-9BDBF1BE5DBB}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{2F03016B-7DC5-46C9-9E52-9A4B66448169}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{35DEB9EA-E6F7-4400-A365-52D94A649498}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{365C6B16-3BA5-4ED6-8A21-70957A302102}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{3A950816-ED59-4D05-8038-F5B8AFFB07F2}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3BCBB30F-C9DA-4C6F-8D99-5D7D304F40EB}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{41EFC01F-F4DF-4921-BC09-0453D63B5037}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{455ACF72-A924-46C6-8EC4-04B96913455E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4A9298F3-0918-4E13-B2E0-F3FE4D0898A8}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
"{4C527ADF-AB25-4E2C-9ECC-21EB6D1DA573}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{54281479-4288-4CF8-A6A6-961A37A393C5}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{71FA56E3-1FD8-4F39-BBF8-28363E69699B}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{72DFD32E-BDEC-4C14-8E37-6434D1B87C3D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{73C13529-0084-4873-A689-11654FE0969E}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{751EBD2C-F989-4300-BB0D-7A2D70C71E5A}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{84AFA0D5-6CEF-4676-913A-D4940429A8F7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{89469EDF-6E41-449B-91ED-81ADE35C0C26}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{A4745302-987C-40C9-AAE7-D6CA87BDF07C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{BEC7C46D-799E-4936-9FD5-D3C13117E849}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{CAAF019D-1488-43ED-87B3-A6FB1875628C}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{D71F8F3D-F6F3-4FE9-AFBE-B89215AD7C5E}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{DE8490E5-4A85-422F-8B11-02CF48B73037}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{EB92146A-DA1B-41DF-9C34-55D0D8DC8703}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{EEB2D89D-A0AC-479D-AD76-5BEA81B895BA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F039A83A-4692-4881-B5B6-A47647D05216}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F34F6699-C084-4B05-8065-FA2D5C1EABF5}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{F460E815-E5CE-4AED-98D4-C0EF583B3D59}" = protocol=6 | dir=out | app=system |
"{F503DF1B-E13D-43A4-BDDC-211D847E31FD}" = dir=in | app=c:\users\nickandanne\appdata\local\facebook\video\skype\facebookvideocalling.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0090A87C-3E0E-43D4-AA71-A71B06563A4A}" = Dell Support Center
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP640_series" = Canon MP640 series MP Drivers
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1DD81E7D-0D28-4CEB-87B2-C041A4FCB215}" = Rapport
"{26A24AE4-039D-4CA4-87B4-2F86416020FF}" = Java™ 6 Update 20 (64-bit)
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}" = iTunes
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}" = Dell Edoc Viewer
"{90140000-0015-0409-1000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0015-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-1000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0016-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0018-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-0019-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001A-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-1000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001B-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{0242505C-4E90-407F-9299-B5B275F50D86}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-1000-0000000FF1CE}_Office14.PROPLUSR_{B51389C8-2890-4633-81D8-47D2A7402274}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-1000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-1000-0000000FF1CE}_Office14.PROPLUSR_{1779650B-2E44-4A19-8DF6-3866D645764A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-1000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{270CA0B9-9881-44DB-BC3B-37C7E66A044A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010
"{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{E8B6D35B-0B6F-4DCE-9493-859BF3809A7F}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0409-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (English) 2010
"{90140000-0043-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{FCD1C311-8B02-4DBD-BA46-1079C629577E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0409-1000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-0044-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-1000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{516CA4A9-98E6-4F77-A863-CBD8487368E4}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00A1-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0409-1000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-00BA-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-1000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{516CA4A9-98E6-4F77-A863-CBD8487368E4}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0117-0409-1000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-0117-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{91140000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{C73A3942-84C8-4597-9F9B-EE227DCBA758}" = Dell Dock
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"CCleaner" = CCleaner
"Dell Support Center" = Dell Support Center
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"WinRAR archiver" = WinRAR 4.01 (64-bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = Dell DataSafe Local Backup
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{13766F76-6C8C-4E57-A9F3-3212D1C6E0D1}" = Dell DataSafe Online
"{144A1586-E16C-448D-910D-E12ACD65DD98}" = Keyboard Lock Status
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1D643CD0-4DD6-11D7-A4E0-000874180BB3}" = Microsoft Money
"{1DD81E7D-0D28-4CEB-87B2-C041A4FCB215}" = Rapport
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 22
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{48BCA9A6-1D2A-4E4B-BB55-F82A888CE344}" = Garmin POI Loader
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{510D2239-6C2E-457B-9590-485EC552D94D}" = Garmin USB Drivers
"{634F79E1-2A41-4C40-9E8D-89EC740AC9D6}" = Logitech Harmony Remote Software
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7363206E-C7BD-45CD-89A0-792B28409811}_is1" = MB-Ruler
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{7F1B3341-A94E-4F5C-B587-CA0EB964221E}" = Microsoft Money Shared Libraries
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C64E149-54BA-11D6-91B1-00500462BE80}" = Microsoft Money System Pack
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A33E7B0C-B99C-4EC9-B702-8A328B161AF9}" = Roxio Burn
"{A899DA1F-D626-401C-8651-F2921E3B4CB3}" = 3Connect
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = Dell DataSafe Local Backup - Support Software
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.3)
"{B2E47DE7-800B-40BB-BD1F-9F221C3AEE87}" = Roxio Burn
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{CB6075D9-F912-40AE-BEA6-E590DA24F16B}" = Adobe Photoshop Elements 7.0
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DBCC73BA-C69A-4BF5-B4BF-F07501EE7039}" = AnswerWorks 5.0 English Runtime
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E312B20A-7074-44E4-BDE6-27F68A5D48C3}" = Sonocaddie V500 Driver
"{E92DC44A-A688-4F4D-8825-E4B19F266275}" = Dell Touch Zone
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 7" = Adobe Photoshop Elements 7.0
"AI RoboForm" = RoboForm 7-7-8-8 (All Users)
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.9
"BFG-Autumn's Treasures - The Jade Coin" = Autumn's Treasures: The Jade Coin
"BFG-Awakening - Moonfell Wood" = Awakening: Moonfell Wood
"BFGC" = Big Fish Games: Game Manager
"BFG-Columbus - Ghost of the Mystery Stone" = Columbus: Ghost of the Mystery Stone
"BFG-Dark Parables - Curse of Briar Rose" = Dark Parables: Curse of Briar Rose
"BFG-Dark Parables - Rise of the Snow Queen Collector's Edition" = Dark Parables: Rise of the Snow Queen Collector's Edition
"BFG-Dark Parables - The Exiled Prince" = Dark Parables: The Exiled Prince
"BFG-Dark Tales - Edgar Allan Poe's The Black Cat" = Dark Tales: ™ Edgar Allan Poe's The Black Cat
"BFG-Dark Tales - Edgar Allan Poe's The Premature Burial" = Dark Tales: Edgar Allan Poe's The Premature Burial
"BFG-Death at Fairing Point - A Dana Knightstone Novel" = Death at Fairing Point: A Dana Knightstone Novel
"BFG-Dream Chronicles - The Book of Water" = Dream Chronicles: The Book of Water
"BFG-Dream Chronicles 2 - The Eternal Maze" = Dream Chronicles ™ 2: The Eternal Maze
"BFG-Echoes of the Past - Royal House of Stone" = Echoes of the Past: Royal House of Stone
"BFG-Echoes of the Past - The Castle of Shadows" = Echoes of the Past: The Castle of Shadows
"BFG-Echoes of the Past - The Citadels of Time" = Echoes of the Past: The Citadels of Time
"BFG-Elixir of Immortality" = Elixir of Immortality
"BFG-Enchanted Cavern" = Enchanted Cavern
"BFG-Fairy Treasure" = Fairy Treasure
"BFG-Gravely Silent - House of Deadlock" = Gravely Silent: House of Deadlock
"BFG-Hallowed Legends - Samhain" = Hallowed Legends: Samhain
"BFG-Haunted Legends - The Queen of Spades" = Haunted Legends: The Queen of Spades
"BFG-Hidden Expedition - Amazon" = Hidden Expedition: Amazon ™
"BFG-Love Chronicles - The Spell" = Love Chronicles: The Spell
"BFG-Love Chronicles - The Sword and The Rose" = Love Chronicles: The Sword and The Rose
"BFG-Magic Match The Genie's Journey" = Magic Match The Genie`s Journey
"BFG-Midnight Mysteries 3 - Devil on the Mississippi" = Midnight Mysteries 3: Devil on the Mississippi
"BFG-Murder Island - Secret of Tantalus" = Murder Island: Secret of Tantalus
"BFG-Mystery Case Files - 13th Skull" = Mystery Case Files ®: 13th Skull ™
"BFG-Mystery Case Files - Ravenhearst" = Mystery Case Files: Ravenhearst ®
"BFG-Mystery Case Files - Return to Ravenhearst" = Mystery Case Files: Return to Ravenhearst ™
"BFG-Mystery Valley" = Mystery Valley
"BFG-Mystic Gateways - The Celestial Quest" = Mystic Gateways: The Celestial Quest
"BFG-PuppetShow - Lost Town" = PuppetShow: Lost Town
"BFG-Redemption Cemetery - Childrens Plight" = Redemption Cemetery: Children's Plight
"BFG-Redemption Cemetery - Curse of the Raven" = Redemption Cemetery: Curse of the Raven
"BFG-Redrum - Time Lies" = Redrum: Time Lies
"BFG-Reincarnations - Uncover the Past" = Reincarnations: Uncover the Past
"BFG-Sacra Terra - Angelic Night" = Sacra Terra: Angelic Night
"BFG-Shadow Wolf Mysteries - Curse of the Full Moon" = Shadow Wolf Mysteries: Curse of the Full Moon
"BFG-Spirit Seasons - Little Ghost Story" = Spirit Seasons: Little Ghost Story
"BFG-Spirits of Mystery - Amber Maiden" = Spirits of Mystery: Amber Maiden
"BFG-Spirits of Mystery - Song of the Phoenix" = Spirits of Mystery: Song of the Phoenix
"BFG-Spirits of Mystery - Song of the Phoenix Collector's Edition" = Spirits of Mystery: Song of the Phoenix Collector's Edition
"BFG-The Keepers 2 Survey" = The Keepers 2 Survey
"BFG-Time Mysteries - Inheritance" = Time Mysteries: Inheritance
"BFG-Treasure Seekers - Follow the Ghosts" = Treasure Seekers: Follow the Ghosts
"Canon MP640 series User Registration" = Canon MP640 series User Registration
"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CaptureWiz" = CaptureWizPro 4.50
"Dell Dock" = Dell Dock
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"Foxit Reader" = Foxit Reader
"Google Chrome" = Google Chrome
"HandBrake" = HandBrake 0.9.6
"Huawei Modems" = Huawei modem
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"MediaMonkey_is1" = MediaMonkey 4.0
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Money2008b" = Microsoft Money Plus
"Mozilla Firefox 14.0.1 (x86 en-US)" = Mozilla Firefox 14.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 3.0" = Canon MP Navigator EX 3.0
"N360" = Norton 360
"Picasa 3" = Picasa 3
"Rapport_msi" = Rapport
"TreeSize Free_is1" = TreeSize Free V2.7
"VLC media player" = VLC media player 2.0.1
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f031ef6ac137efc5" = Dell Driver Download Manager

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 29/01/2012 17:36:00 | Computer Name = DellOct10 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6053

Error - 29/01/2012 17:36:01 | Computer Name = DellOct10 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 29/01/2012 17:36:01 | Computer Name = DellOct10 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7051

Error - 29/01/2012 17:36:01 | Computer Name = DellOct10 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7051

Error - 29/01/2012 17:36:02 | Computer Name = DellOct10 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 29/01/2012 17:36:02 | Computer Name = DellOct10 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8050

Error - 29/01/2012 17:36:02 | Computer Name = DellOct10 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8050

Error - 29/01/2012 17:36:03 | Computer Name = DellOct10 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 29/01/2012 17:36:03 | Computer Name = DellOct10 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9048

Error - 29/01/2012 17:36:03 | Computer Name = DellOct10 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9048

[ Dell Events ]
Error - 30/10/2010 13:31:38 | Computer Name = DellOct10 | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 30/10/2010 16:02:00 | Computer Name = DellOct10 | Source = DataSafe | ID = 3
Description = The process was interrupted before completion.

Error - 30/10/2010 16:02:00 | Computer Name = DellOct10 | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 30/10/2010 16:05:01 | Computer Name = DellOct10 | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 30/10/2010 16:05:01 | Computer Name = DellOct10 | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 30/10/2010 16:06:26 | Computer Name = DellOct10 | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 30/10/2010 16:06:26 | Computer Name = DellOct10 | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 30/10/2010 16:08:54 | Computer Name = DellOct10 | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 30/10/2010 16:08:54 | Computer Name = DellOct10 | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

Error - 10/09/2011 03:43:02 | Computer Name = DellOct10 | Source = DataSafe | ID = 17
Description = The process was interrupted before completion.

[ System Events ]
Error - 15/07/2012 09:47:58 | Computer Name = DellOct10 | Source = DCOM | ID = 10016
Description =

Error - 15/07/2012 09:47:58 | Computer Name = DellOct10 | Source = DCOM | ID = 10016
Description =

Error - 15/07/2012 10:39:24 | Computer Name = DellOct10 | Source = DCOM | ID = 10016
Description =

Error - 15/07/2012 10:39:24 | Computer Name = DellOct10 | Source = DCOM | ID = 10016
Description =

Error - 15/07/2012 11:07:43 | Computer Name = DellOct10 | Source = DCOM | ID = 10016
Description =

Error - 15/07/2012 11:07:43 | Computer Name = DellOct10 | Source = DCOM | ID = 10016
Description =

Error - 17/07/2012 03:53:49 | Computer Name = DellOct10 | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the WPDBusEnum service.

Error - 17/07/2012 03:55:51 | Computer Name = DellOct10 | Source = Service Control Manager | ID = 7034
Description = The Lavasoft Ad-Aware Service service terminated unexpectedly. It
has done this 1 time(s).

Error - 17/07/2012 05:02:09 | Computer Name = DellOct10 | Source = VDS Basic Provider | ID = 33554433
Description =

Error - 17/07/2012 05:02:09 | Computer Name = DellOct10 | Source = VDS Basic Provider | ID = 33554433
Description =


< End of report >

I look forward to hearing from you!

zlobber

Many thanks mowman

OTL ran, the system re-booted, and then it gave me this log:

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Prefs.js: "Web Search" removed from browser.search.defaultenginename
Prefs.js: "Web Search" removed from browser.search.order.1
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\iugy5fdg.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516}\defaults\preferences folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\iugy5fdg.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516}\defaults folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\iugy5fdg.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516}\chrome\content folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\iugy5fdg.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516}\chrome folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\iugy5fdg.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516} folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516}\defaults\preferences folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516}\defaults folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516}\chrome\content folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516}\chrome folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516} folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\searchplugin folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\Plugins folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\modules folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\META-INF folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\defaults folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\chrome folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\[removed]\defaults\preferences folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\[removed]\defaults folder moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\[removed] folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ not found.
ADS C:\ProgramData\TEMP:E690114B deleted successfully.
ADS C:\ProgramData\TEMP:11590865 deleted successfully.
ADS C:\ProgramData\TEMP:AAA06E15 deleted successfully.
ADS C:\ProgramData\TEMP:2211E7A0 deleted successfully.
ADS C:\ProgramData\TEMP:B6E6C4EA deleted successfully.
ADS C:\ProgramData\TEMP:EDDBC69E deleted successfully.
ADS C:\ProgramData\TEMP:A88BE334 deleted successfully.
ADS C:\ProgramData\TEMP:24FECE50 deleted successfully.
ADS C:\ProgramData\TEMP:B54E4B5A deleted successfully.
ADS C:\ProgramData\TEMP:B1786630 deleted successfully.
ADS C:\ProgramData\TEMP:488F7244 deleted successfully.
ADS C:\ProgramData\TEMP:2AE74FF9 deleted successfully.
ADS C:\ProgramData\TEMP:D6D084A5 deleted successfully.
ADS C:\ProgramData\TEMP:BEE39E9B deleted successfully.
ADS C:\ProgramData\TEMP:59465B40 deleted successfully.
ADS C:\ProgramData\TEMP:C0893153 deleted successfully.
ADS C:\ProgramData\TEMP:E87AB4E3 deleted successfully.
ADS C:\ProgramData\TEMP:8B4B9596 deleted successfully.
ADS C:\ProgramData\TEMP:F5B51004 deleted successfully.
ADS C:\ProgramData\TEMP:3DB6F365 deleted successfully.
ADS C:\ProgramData\TEMP:C0A9B815 deleted successfully.
ADS C:\ProgramData\TEMP:E80802C7 deleted successfully.
ADS C:\ProgramData\TEMP:C22674B6 deleted successfully.
ADS C:\ProgramData\TEMP:BCFEA004 deleted successfully.
ADS C:\ProgramData\TEMP:B139DDF3 deleted successfully.
ADS C:\ProgramData\TEMP:9BAC4211 deleted successfully.
ADS C:\ProgramData\TEMP:0EC7A545 deleted successfully.
ADS C:\ProgramData\TEMP:041C0562 deleted successfully.
ADS C:\ProgramData\TEMP:DE875C30 deleted successfully.
ADS C:\ProgramData\TEMP:C370B84F deleted successfully.
ADS C:\ProgramData\TEMP:8BE7A048 deleted successfully.
ADS C:\ProgramData\TEMP:76987FE5 deleted successfully.
ADS C:\ProgramData\TEMP:5A2E8BBF deleted successfully.
ADS C:\ProgramData\TEMP:1ECED34B deleted successfully.
ADS C:\ProgramData\TEMP:59846E5E deleted successfully.
ADS C:\ProgramData\TEMP:CAC06C34 deleted successfully.
ADS C:\ProgramData\TEMP:C7F08EA3 deleted successfully.
ADS C:\ProgramData\TEMP:1416AAA6 deleted successfully.
ADS C:\ProgramData\TEMP:47FE7AB7 deleted successfully.
ADS C:\ProgramData\TEMP:260575F1 deleted successfully.
ADS C:\ProgramData\TEMP:D8139E6A deleted successfully.
ADS C:\ProgramData\TEMP:0AC32449 deleted successfully.
ADS C:\ProgramData\TEMP:B8791731 deleted successfully.
ADS C:\ProgramData\TEMP:B190BE3A deleted successfully.
ADS C:\ProgramData\TEMP:E8C44CB4 deleted successfully.
ADS C:\ProgramData\TEMP:AD020DC3 deleted successfully.
ADS C:\ProgramData\TEMP:378824DE deleted successfully.
ADS C:\ProgramData\TEMP:0A74923C deleted successfully.
ADS C:\ProgramData\TEMP:3AD6342E deleted successfully.
ADS C:\ProgramData\TEMP:1234ADAE deleted successfully.
ADS C:\ProgramData\TEMP:0785072C deleted successfully.
ADS C:\ProgramData\TEMP:05670151 deleted successfully.
ADS C:\ProgramData\TEMP:F1F936DF deleted successfully.
ADS C:\ProgramData\TEMP:C5DC2B0C deleted successfully.
ADS C:\ProgramData\TEMP:BF6C81B2 deleted successfully.
ADS C:\ProgramData\TEMP:7BFAAE70 deleted successfully.
ADS C:\ProgramData\TEMP:1E17A249 deleted successfully.
ADS C:\ProgramData\TEMP:1B96CF22 deleted successfully.
ADS C:\ProgramData\TEMP:19474103 deleted successfully.
ADS C:\ProgramData\TEMP:AABECEFB deleted successfully.
ADS C:\ProgramData\TEMP:84BD8B63 deleted successfully.
ADS C:\ProgramData\TEMP:4F7FE589 deleted successfully.
ADS C:\ProgramData\TEMP:491270B8 deleted successfully.
ADS C:\ProgramData\TEMP:3D6B89CE deleted successfully.
ADS C:\ProgramData\TEMP:1A15E356 deleted successfully.
ADS C:\ProgramData\TEMP:FC70A22A deleted successfully.
ADS C:\ProgramData\TEMP:689AB7E9 deleted successfully.
ADS C:\ProgramData\TEMP:2CC32B31 deleted successfully.
ADS C:\ProgramData\TEMP:2CB9631F deleted successfully.
ADS C:\ProgramData\TEMP:1C201DEB deleted successfully.
ADS C:\ProgramData\TEMP:012BC84F deleted successfully.
ADS C:\ProgramData\TEMP:EFF3C3C8 deleted successfully.
ADS C:\ProgramData\TEMP:5C0940F1 deleted successfully.
ADS C:\ProgramData\TEMP:474022C7 deleted successfully.
ADS C:\ProgramData\TEMP:3969ACF7 deleted successfully.
ADS C:\ProgramData\TEMP:160ADF0B deleted successfully.
ADS C:\ProgramData\TEMP:F142DBA9 deleted successfully.
ADS C:\ProgramData\TEMP:EBCF5924 deleted successfully.
ADS C:\ProgramData\TEMP:A4E7D25F deleted successfully.
ADS C:\ProgramData\TEMP:88C0A705 deleted successfully.
ADS C:\ProgramData\TEMP:2E3F04BC deleted successfully.
ADS C:\ProgramData\TEMP:EB4FEEF5 deleted successfully.
ADS C:\ProgramData\TEMP:B6D84F71 deleted successfully.
ADS C:\ProgramData\TEMP:A6F30843 deleted successfully.
ADS C:\ProgramData\TEMP:79875988 deleted successfully.
ADS C:\ProgramData\TEMP:3EC5BC08 deleted successfully.
ADS C:\ProgramData\TEMP:3E200C29 deleted successfully.
ADS C:\ProgramData\TEMP:397D67BA deleted successfully.
ADS C:\ProgramData\TEMP:F135A76C deleted successfully.
ADS C:\ProgramData\TEMP:C72A744C deleted successfully.
ADS C:\ProgramData\TEMP:A4AF8D0D deleted successfully.
ADS C:\ProgramData\TEMP:8BE8BFCD deleted successfully.
ADS C:\ProgramData\TEMP:5E73E1C2 deleted successfully.
ADS C:\ProgramData\TEMP:1B389835 deleted successfully.
ADS C:\ProgramData\TEMP:A5584049 deleted successfully.
ADS C:\ProgramData\TEMP:8AE92FD3 deleted successfully.
ADS C:\ProgramData\TEMP:88E8CC2E deleted successfully.
ADS C:\ProgramData\TEMP:4C8FA829 deleted successfully.
ADS C:\ProgramData\TEMP:29F0CA7D deleted successfully.
ADS C:\ProgramData\TEMP:E894A3ED deleted successfully.
ADS C:\ProgramData\TEMP:B0456F0C deleted successfully.
ADS C:\ProgramData\TEMP:AA0017FD deleted successfully.
ADS C:\ProgramData\TEMP:697DDE2B deleted successfully.
ADS C:\ProgramData\TEMP:6294B369 deleted successfully.
ADS C:\ProgramData\TEMP:E6708F08 deleted successfully.
ADS C:\ProgramData\TEMP:D9656460 deleted successfully.
ADS C:\ProgramData\TEMP:A0921B2C deleted successfully.
ADS C:\ProgramData\TEMP:0588E665 deleted successfully.
ADS C:\ProgramData\TEMP:9F3CEEE6 deleted successfully.
ADS C:\ProgramData\TEMP:961B84C5 deleted successfully.
ADS C:\ProgramData\TEMP:6ED8B881 deleted successfully.
ADS C:\ProgramData\TEMP:2D133896 deleted successfully.
ADS C:\ProgramData\TEMP:014BC3B4 deleted successfully.
ADS C:\ProgramData\TEMP:BF6A2C54 deleted successfully.
ADS C:\ProgramData\TEMP:BE6B5FC3 deleted successfully.
ADS C:\ProgramData\TEMP:A8185163 deleted successfully.
ADS C:\ProgramData\TEMP:5A9F1AE5 deleted successfully.
ADS C:\ProgramData\TEMP:553056F1 deleted successfully.
ADS C:\ProgramData\TEMP:2E636DD9 deleted successfully.
ADS C:\ProgramData\TEMP:2AF322BF deleted successfully.
ADS C:\ProgramData\TEMP:12383CAE deleted successfully.
ADS C:\ProgramData\TEMP:08801FDB deleted successfully.
ADS C:\ProgramData\TEMP:EA1919C7 deleted successfully.
ADS C:\ProgramData\TEMP:E6C6EB3B deleted successfully.
ADS C:\ProgramData\TEMP:DC7EDF41 deleted successfully.
ADS C:\ProgramData\TEMP:65B8AF94 deleted successfully.
ADS C:\ProgramData\TEMP:53B8C5D2 deleted successfully.
ADS C:\ProgramData\TEMP:31C9BA96 deleted successfully.
ADS C:\ProgramData\TEMP:C0BCE04B deleted successfully.
ADS C:\ProgramData\TEMP:B3196E8D deleted successfully.
ADS C:\ProgramData\TEMP:9FD757A9 deleted successfully.
ADS C:\ProgramData\TEMP:700B9342 deleted successfully.
ADS C:\ProgramData\TEMP:58E38390 deleted successfully.
ADS C:\ProgramData\TEMP:BE0654D6 deleted successfully.
ADS C:\ProgramData\TEMP:AED33A42 deleted successfully.
ADS C:\ProgramData\TEMP:9D6EAEC3 deleted successfully.
ADS C:\ProgramData\TEMP:905BCB57 deleted successfully.
ADS C:\ProgramData\TEMP:16A4620C deleted successfully.
ADS C:\ProgramData\TEMP:BBCB4421 deleted successfully.
ADS C:\ProgramData\TEMP:852F2262 deleted successfully.
ADS C:\ProgramData\TEMP:834DD57E deleted successfully.
ADS C:\ProgramData\TEMP:46CBC45C deleted successfully.
ADS C:\ProgramData\TEMP:B8EB1B99 deleted successfully.
ADS C:\ProgramData\TEMP:A9056F42 deleted successfully.
ADS C:\ProgramData\TEMP:5133A494 deleted successfully.
ADS C:\ProgramData\TEMP:A5241382 deleted successfully.
ADS C:\ProgramData\TEMP:64170090 deleted successfully.
ADS C:\ProgramData\TEMP:51E66512 deleted successfully.
ADS C:\ProgramData\TEMP:3B454A5C deleted successfully.
ADS C:\ProgramData\TEMP:23834E1E deleted successfully.
ADS C:\ProgramData\TEMP:C9B27A06 deleted successfully.
ADS C:\ProgramData\TEMP:A6D6E537 deleted successfully.
ADS C:\ProgramData\TEMP:52C24010 deleted successfully.
ADS C:\ProgramData\TEMP:090FB735 deleted successfully.
ADS C:\ProgramData\TEMP:B1381B34 deleted successfully.
ADS C:\ProgramData\TEMP:96AFAB10 deleted successfully.
ADS C:\ProgramData\TEMP:4B1195DD deleted successfully.
ADS C:\ProgramData\TEMP:7A032A04 deleted successfully.
ADS C:\ProgramData\TEMP:2C86E2AD deleted successfully.
ADS C:\ProgramData\TEMP:C186F20B deleted successfully.
ADS C:\ProgramData\TEMP:FC2D0F32 deleted successfully.
ADS C:\ProgramData\TEMP:E51234A9 deleted successfully.
ADS C:\ProgramData\TEMP:E2CFA9CD deleted successfully.
ADS C:\ProgramData\TEMP:CA23BCFD deleted successfully.
ADS C:\ProgramData\TEMP:74176932 deleted successfully.
ADS C:\ProgramData\TEMP:71612023 deleted successfully.
ADS C:\ProgramData\TEMP:6DD124E2 deleted successfully.
ADS C:\ProgramData\TEMP:A798AA1A deleted successfully.
ADS C:\ProgramData\TEMP:3E06C78F deleted successfully.
ADS C:\ProgramData\TEMP:3086B95F deleted successfully.
ADS C:\ProgramData\TEMP:27C3CD07 deleted successfully.
ADS C:\ProgramData\TEMP:2216A431 deleted successfully.
ADS C:\ProgramData\TEMP:1E68D1C6 deleted successfully.
ADS C:\ProgramData\TEMP:7ADB695A deleted successfully.
ADS C:\ProgramData\TEMP:774A0E14 deleted successfully.
ADS C:\ProgramData\TEMP:6CF828C2 deleted successfully.
ADS C:\ProgramData\TEMP:61AF2B29 deleted successfully.
ADS C:\ProgramData\TEMP:2B11E0DF deleted successfully.
ADS C:\ProgramData\TEMP:24C072FF deleted successfully.
ADS C:\ProgramData\TEMP:4EEC7800 deleted successfully.
ADS C:\ProgramData\TEMP:14A1BBE3 deleted successfully.
ADS C:\ProgramData\TEMP:82529191 deleted successfully.
ADS C:\ProgramData\TEMP:71F04C26 deleted successfully.
ADS C:\ProgramData\TEMP:40EE25BB deleted successfully.
ADS C:\ProgramData\TEMP:109734F6 deleted successfully.
ADS C:\ProgramData\TEMP:8E5EA40F deleted successfully.
ADS C:\ProgramData\TEMP:5A15BCD4 deleted successfully.
ADS C:\ProgramData\TEMP:A6D89509 deleted successfully.
ADS C:\ProgramData\TEMP:72A1B66A deleted successfully.
ADS C:\ProgramData\TEMP:4DDE401B deleted successfully.
ADS C:\ProgramData\TEMP:BD34FFC5 deleted successfully.
ADS C:\ProgramData\TEMP:9EE6560D deleted successfully.
ADS C:\ProgramData\TEMP:598E0FFA deleted successfully.
ADS C:\ProgramData\TEMP:553CA6CA deleted successfully.
ADS C:\ProgramData\TEMP:D226A81A deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: All Users.WINDOWS

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56502 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: NickandAnne
->Temp folder emptied: 3046115 bytes
->Temporary Internet Files folder emptied: 63410978 bytes
->Java cache emptied: 4931464 bytes
->FireFox cache emptied: 60287853 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 12695 bytes

User: Public

%systemdrive% .tmp files removed: 1485163900 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 13220 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50467 bytes
RecycleBin emptied: 1952992641 bytes

Total Files Cleaned = 3,405.00 mb


OTL by OldTimer - Version 3.2.54.0 log created on 07182012_120730

Files\Folders moved on Reboot…
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Vertical Slide Show 2\FrameSet.htm not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Vertical Slide Show 2\indexPage.htm not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Vertical Slide Show 2\Thumbnail.htm not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Vertical Slide Show 1\FrameSet.htm not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Vertical Slide Show 1\indexPage.htm not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Vertical Slide Show 1\Thumbnail.htm not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Table - Blue\images\bannerimage.gif not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Table - Blue\images\currentindex.gif not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Horizontal Patterned\indexPage.htm not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Horizontal Patterned\Thumbnail.htm not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Horizontal Dark\images\bannerimage.gif not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Horizontal Blue & Gray\Caption.htm not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Horizontal Blue & Gray\FrameSet.htm not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Horizontal Blue & Gray\indexPage.htm not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Horizontal Blue & Gray\SubPage.htm not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Horizontal Blue & Gray\Thumbnail.htm not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\AllowNetworkScratch_OFF_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\AllowNetworkScratch_ON.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\AllowRemovableScrtch_OFF_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\AllowRemovableScrtch_ON.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\AlwaysImportClipbd_OFF_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\AlwaysImportClipbd_ON.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\AlwaysShowPalettes_OFF_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\AlwaysShowPalettes_ON.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\BadDriverRGBBlitCheck_OFF.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\BadDriverRGBBlitCheck_ON_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\BadDriverStickyCrsr_OFF_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\BadDriverStickyCrsr_ON.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\BlitSingleScanLines_OFF_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\BlitSingleScanLines_ON.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\BrokenLargeCursors_OFF.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\BrokenLargeCursors_ON_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\ClipboardSizeLimit_OFF.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\ClipboardSizeLimit_ON_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\DisableScratchCmprs_OFF_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\DisableScratchCmprs_ON.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\ForceProgress_OFF_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\ForceProgress_ON.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\ForceVMCompression_OFF_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\ForceVMCompression_ON.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\IgnoreEXIFsRGB_OFF_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\IgnoreEXIFsRGB_ON.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\OptimizeResizeDrawing_OFF.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\OptimizeResizeDrawing_ON_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\PrintPassthrough_NORM_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\PrintPassthrough_PASS.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\PrintPassthrough_PS_PASS.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\Registry Keys Read Me.html not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\RememberSlowFiles_OFF_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\RememberSlowFiles_ON.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\ShowWindowsThumbnails_OFF.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\ShowWindowsThumbnails_ON_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\TaskDebugging_OFF_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\TaskDebugging_ON.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\UnlimitedPreviews_OFF_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\UnlimitedPreviews_ON.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\UseAsyncIO_OFF.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\UseAsyncIO_ON_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\UseAsyncScratch_OFF_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\UseAsyncScratch_ON.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\WarnSavePrefsFailure_OFF.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\WarnSavePrefsFailure_ON_D.reg not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\File Formats\File Formats Read Me.html not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Ffactory\Transparency Examples\Transparency Read Me.pdf not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Custom File Info Panels\Sample File Info Panels\CustomPanel_allWidgets.txt not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Custom File Info Panels\Sample File Info Panels\Description.txt not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Channel Mixer Presets\Special Effects\RGB Inverted Warm Brass.cha not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Channel Mixer Presets\Special Effects\RGB Sepiatone subtle color.cha not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Channel Mixer Presets\Special Effects\RGB Sepiatone subtle color2.cha not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Channel Mixer Presets\Special Effects\RGB Sepiatone subtle color3.cha not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Channel Mixer Presets\Special Effects\Yellows&Blues; (RGB or CMYK).cha not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Channel Mixer Presets\Channel Swaps\CMYK Rotate Channels Back.cha not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Channel Mixer Presets\Channel Swaps\CMYK Rotate Channels Fore.cha not found!
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Channel Mixer Presets\Channel Swaps\CMYK Swap Cyan&Magenta.cha; not found!
C:\Users\NickandAnne\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{052C39E3-8CC0-4BB2-AFBE-915D85C8FED6}.tmp moved successfully.
C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{20BF5853-B07E-4C77-961F-9B68E2A40D84}.tmp moved successfully.
C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2A471228-F116-48B1-A7BA-2397572FCD69}.tmp moved successfully.
C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D7529EE7-E165-419C-B792-CC429ACA7037}.tmp moved successfully.
C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{EBE89412-7837-4D9D-969F-4395A2510385}.tmp moved successfully.

PendingFileRenameOperations files…
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Vertical Slide Show 2\FrameSet.htm not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Vertical Slide Show 2\indexPage.htm not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Vertical Slide Show 2\Thumbnail.htm not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Vertical Slide Show 1\FrameSet.htm not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Vertical Slide Show 1\indexPage.htm not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Vertical Slide Show 1\Thumbnail.htm not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Table - Blue\images\bannerimage.gif not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Table - Blue\images\currentindex.gif not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Horizontal Patterned\indexPage.htm not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Horizontal Patterned\Thumbnail.htm not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Horizontal Dark\images\bannerimage.gif not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Horizontal Blue & Gray\Caption.htm not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Horizontal Blue & Gray\FrameSet.htm not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Horizontal Blue & Gray\indexPage.htm not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Horizontal Blue & Gray\SubPage.htm not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Web Photo Gallery Templates\Horizontal Blue & Gray\Thumbnail.htm not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\AllowNetworkScratch_OFF_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\AllowNetworkScratch_ON.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\AllowRemovableScrtch_OFF_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\AllowRemovableScrtch_ON.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\AlwaysImportClipbd_OFF_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\AlwaysImportClipbd_ON.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\AlwaysShowPalettes_OFF_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\AlwaysShowPalettes_ON.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\BadDriverRGBBlitCheck_OFF.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\BadDriverRGBBlitCheck_ON_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\BadDriverStickyCrsr_OFF_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\BadDriverStickyCrsr_ON.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\BlitSingleScanLines_OFF_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\BlitSingleScanLines_ON.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\BrokenLargeCursors_OFF.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\BrokenLargeCursors_ON_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\ClipboardSizeLimit_OFF.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\ClipboardSizeLimit_ON_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\DisableScratchCmprs_OFF_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\DisableScratchCmprs_ON.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\ForceProgress_OFF_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\ForceProgress_ON.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\ForceVMCompression_OFF_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\ForceVMCompression_ON.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\IgnoreEXIFsRGB_OFF_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\IgnoreEXIFsRGB_ON.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\OptimizeResizeDrawing_OFF.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\OptimizeResizeDrawing_ON_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\PrintPassthrough_NORM_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\PrintPassthrough_PASS.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\PrintPassthrough_PS_PASS.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\Registry Keys Read Me.html not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\RememberSlowFiles_OFF_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\RememberSlowFiles_ON.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\ShowWindowsThumbnails_OFF.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\ShowWindowsThumbnails_ON_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\TaskDebugging_OFF_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\TaskDebugging_ON.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\UnlimitedPreviews_OFF_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\UnlimitedPreviews_ON.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\UseAsyncIO_OFF.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\UseAsyncIO_ON_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\UseAsyncScratch_OFF_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\UseAsyncScratch_ON.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\WarnSavePrefsFailure_OFF.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\Optional Extensions\WarnSavePrefsFailure_ON_D.reg not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Photoshop Only\File Formats\File Formats Read Me.html not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Optional Plug-Ins\Ffactory\Transparency Examples\Transparency Read Me.pdf not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Custom File Info Panels\Sample File Info Panels\CustomPanel_allWidgets.txt not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Custom File Info Panels\Sample File Info Panels\Description.txt not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Channel Mixer Presets\Special Effects\RGB Inverted Warm Brass.cha not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Channel Mixer Presets\Special Effects\RGB Sepiatone subtle color.cha not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Channel Mixer Presets\Special Effects\RGB Sepiatone subtle color2.cha not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Channel Mixer Presets\Special Effects\RGB Sepiatone subtle color3.cha not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Channel Mixer Presets\Special Effects\Yellows&Blues; (RGB or CMYK).cha not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Channel Mixer Presets\Channel Swaps\CMYK Rotate Channels Back.cha not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Channel Mixer Presets\Channel Swaps\CMYK Rotate Channels Fore.cha not found!
File C:\Users\NickandAnne\AppData\Local\Temp\Temp1_Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==.zip\Adobe Photoshop CS2 v9.0 FinaL + KeyGeN & Activator==\Photoshop_CS2_tryout\Photoshop CS2\Goodies\Channel Mixer Presets\Channel Swaps\CMYK Swap Cyan&Magenta.cha; not found!
File C:\Users\NickandAnne\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
File C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{052C39E3-8CC0-4BB2-AFBE-915D85C8FED6}.tmp not found!
File C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{20BF5853-B07E-4C77-961F-9B68E2A40D84}.tmp not found!
File C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2A471228-F116-48B1-A7BA-2397572FCD69}.tmp not found!
File C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D7529EE7-E165-419C-B792-CC429ACA7037}.tmp not found!
File C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{EBE89412-7837-4D9D-969F-4395A2510385}.tmp not found!

Registry entries deleted on Reboot…


What comes next?

zlobber

Hi mowman

Combofix.txt as below:

ComboFix 12-07-18.01 - NickandAnne 18/07/2012 12:41:38.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.6143.4055 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Norton 360 *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton 360 *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton 360 *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\programdata\PCDr\5907\Downloads\246b20c1-8ea9-4148-a34e-d03c8a1d5a76.dll
c:\programdata\PCDr\5907\Downloads\27e5bc9a-105f-4d7f-8352-e6ef1c8933dd.dll
c:\programdata\PCDr\5907\Downloads\a2192d8a-3d73-4ff7-be9b-02134f41db63.dll
.
.
((((((((((((((((((((((((( Files Created from 2012-06-18 to 2012-07-18 )))))))))))))))))))))))))))))))
.
.
2012-07-18 11:07 . 2012-07-18 11:07 ——– d—–w- C:\_OTL
2012-07-18 01:32 . 2012-06-29 10:04 9133488 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{74B56F63-8670-41EE-89EB-E53419F39570}\mpengine.dll
2012-07-12 18:24 . 2012-07-12 18:25 ——– d—–w- c:\program files (x86)\The Keepers 2 Survey
2012-07-12 02:21 . 2012-06-12 03:08 3148800 —-a-w- c:\windows\system32\win32k.sys
2012-07-11 06:30 . 2012-06-06 06:06 2004480 —-a-w- c:\windows\system32\msxml6.dll
2012-07-11 06:30 . 2012-06-06 06:06 1881600 —-a-w- c:\windows\system32\msxml3.dll
2012-07-11 06:30 . 2012-06-06 05:05 1390080 —-a-w- c:\windows\SysWow64\msxml6.dll
2012-07-11 06:30 . 2012-06-06 05:05 1236992 —-a-w- c:\windows\SysWow64\msxml3.dll
2012-07-11 06:30 . 2010-06-26 03:55 2048 —-a-w- c:\windows\system32\msxml3r.dll
2012-07-11 06:30 . 2010-06-26 03:24 2048 —-a-w- c:\windows\SysWow64\msxml3r.dll
2012-07-09 21:25 . 2012-07-09 21:27 ——– d—–w- c:\program files (x86)\Spirits of Mystery - Song of the Phoenix
2012-07-08 06:41 . 2012-07-08 06:42 ——– d—–w- c:\program files (x86)\Spirits of Mystery - Song of the Phoenix Collector's Edition
2012-07-03 15:07 . 2012-07-03 15:07 55384 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2012-07-03 15:05 . 2012-07-17 08:08 ——– d—–w- c:\programdata\Lavasoft
2012-07-03 15:05 . 2012-07-03 15:05 ——– d—–w- c:\program files (x86)\Lavasoft
2012-07-03 14:56 . 2012-07-03 14:56 ——– d—–w- c:\programdata\GFI Software
2012-06-22 08:35 . 2012-06-02 22:19 57880 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-22 08:35 . 2012-06-02 22:19 44056 —-a-w- c:\windows\system32\wups2.dll
2012-06-22 08:35 . 2012-06-02 22:19 2428952 —-a-w- c:\windows\system32\wuaueng.dll
2012-06-22 08:35 . 2012-06-02 22:15 2622464 —-a-w- c:\windows\system32\wucltux.dll
2012-06-22 08:35 . 2012-06-02 22:19 38424 —-a-w- c:\windows\system32\wups.dll
2012-06-22 08:35 . 2012-06-02 22:19 701976 —-a-w- c:\windows\system32\wuapi.dll
2012-06-22 08:35 . 2012-06-02 22:15 99840 —-a-w- c:\windows\system32\wudriver.dll
2012-06-22 08:34 . 2012-06-02 14:19 186752 —-a-w- c:\windows\system32\wuwebv.dll
2012-06-22 08:34 . 2012-06-02 14:15 36864 —-a-w- c:\windows\system32\wuapp.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-17 08:06 . 2012-04-05 14:48 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-17 08:06 . 2011-06-12 06:02 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-08 06:19 . 2011-05-07 08:49 101464 —-a-w- c:\windows\system32\drivers\RapportKE64.sys
2012-07-03 12:46 . 2010-11-03 09:57 24904 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-05-31 11:25 . 2011-08-24 06:37 279656 ——w- c:\windows\system32\MpSigStub.exe
2012-05-29 06:26 . 2012-05-29 06:26 2560 —-a-w- c:\windows\_MSRSTRT.EXE
2012-05-04 11:06 . 2012-06-14 04:00 5559664 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 10:03 . 2012-06-14 04:00 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:03 . 2012-06-14 04:00 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-04-28 03:55 . 2012-06-14 04:00 210944 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-26 05:41 . 2012-06-14 04:00 77312 —-a-w- c:\windows\system32\rdpwsx.dll
2012-04-26 05:41 . 2012-06-14 04:00 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll
2012-04-26 05:34 . 2012-06-14 04:00 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe
2012-04-19 15:24 . 2011-10-29 10:29 175736 —-a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2012-07-08 109336]
.
c:\users\NickandAnne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CaptureWiz.lnk - c:\program files (x86)\CaptureWiz\Pro\CaptureWiz.exe [2010-10-30 3112696]
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-16 1324384]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-16 1324384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-17 136176]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-17 136176]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2010-01-28 114304]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-18 113120]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [2011-05-10 22528]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-10-30 1255736]
R4 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [2008-09-16 169312]
R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
R4 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-17 250056]
R4 BecHelperService;BecHelperService;c:\program files (x86)\3 Mobile Broadband\3Connect\BecHelperService.exe [2010-01-28 1737464]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280]
S0 RapportKE64;RapportKE64;c:\windows\System32\Drivers\RapportKE64.sys [2012-07-08 101464]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\0602010.005\SYMDS64.SYS [2012-01-17 451192]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\0602010.005\SYMEFA64.SYS [2012-01-17 1092728]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.1.2.10\Definitions\BASHDefs\20120711.002\BHDrvx64.sys [2012-06-19 1161376]
S1 ccSet_N360;Norton 360 Settings Manager;c:\windows\system32\drivers\N360x64\0602010.005\ccSetx64.sys [2011-11-29 167048]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.1.2.10\Definitions\IPSDefs\20120717.003\IDSvia64.sys [2012-06-14 509088]
S1 RapportCerberus_34302;RapportCerberus_34302;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\34302\RapportCerberus64_34302.sys [2011-12-15 397520]
S1 RapportEI64;RapportEI64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [2012-07-08 55096]
S1 RapportPG64;RapportPG64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [2012-07-08 297048]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\0602010.005\Ironx64.SYS [2012-01-17 190072]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\0602010.005\SYMNETS.SYS [2012-01-17 405624]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
S2 N360;Norton 360;c:\program files (x86)\Norton 360\Engine\6.2.1.5\ccSvcHst.exe [2012-03-27 138232]
S2 RapportMgmtService;Rapport Management Service;c:\program files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [2012-07-08 976728]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2010-08-20 689472]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-06-01 138912]
S3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2009-08-06 320040]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2010-01-28 86120]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 08:06]
.
2012-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-17 10:21]
.
2012-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-17 10:21]
.
.
——— X64 Entries ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.co.uk/
uDefault_Search_URL = hxxp://www.google.com/ie
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Customize Menu - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office14\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: Save Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: Se&nd to OneNote - c:\progra~2\MIF5BA~1\Office14\ONBttnIE.dll/105
IE: Show RoboForm Toolbar - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
TCP: DhcpNameServer = [removed] [removed]
FF - ProfilePath - c:\users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&SearchSource=2&q=
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
URLSearchHooks-{1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\N360]
"ImagePath"="\"c:\program files (x86)\Norton 360\Engine\6.2.1.5\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton 360\Engine\6.2.1.5\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
———————— Other Running Processes ————————
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Trusteer\Rapport\bin\RapportService.exe
c:\program files (x86)\Canon\IJPLM\IJPLMSVC.EXE
c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
.
**************************************************************************
.
Completion time: 2012-07-18 13:01:58 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-18 12:01
ComboFix2.txt 2010-02-13 13:30
.
Pre-Run: 399,049,457,664 bytes free
Post-Run: 398,637,215,744 bytes free
.
- - End Of File - - 5EB8A998D80F46609CA05C14C7E2EBF9


zlobber

Morning mowman

All 3 programs now run, and logs below:

COMBOFIX

ComboFix 12-07-18.01 - NickandAnne 19/07/2012 8:04.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.6143.4236 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\NickandAnne\Desktop\CFScript.txt
AV: Norton 360 *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton 360 *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton 360 *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-06-19 to 2012-07-19 )))))))))))))))))))))))))))))))
.
.
2012-07-19 07:13 . 2012-07-19 07:13 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-07-18 11:07 . 2012-07-18 11:07 ——– d—–w- C:\_OTL
2012-07-18 01:32 . 2012-06-29 10:04 9133488 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{74B56F63-8670-41EE-89EB-E53419F39570}\mpengine.dll
2012-07-12 18:24 . 2012-07-12 18:25 ——– d—–w- c:\program files (x86)\The Keepers 2 Survey
2012-07-12 02:21 . 2012-06-12 03:08 3148800 —-a-w- c:\windows\system32\win32k.sys
2012-07-11 06:30 . 2012-06-06 06:06 2004480 —-a-w- c:\windows\system32\msxml6.dll
2012-07-11 06:30 . 2012-06-06 06:06 1881600 —-a-w- c:\windows\system32\msxml3.dll
2012-07-11 06:30 . 2012-06-06 05:05 1390080 —-a-w- c:\windows\SysWow64\msxml6.dll
2012-07-11 06:30 . 2012-06-06 05:05 1236992 —-a-w- c:\windows\SysWow64\msxml3.dll
2012-07-11 06:30 . 2010-06-26 03:55 2048 —-a-w- c:\windows\system32\msxml3r.dll
2012-07-11 06:30 . 2010-06-26 03:24 2048 —-a-w- c:\windows\SysWow64\msxml3r.dll
2012-07-09 21:25 . 2012-07-09 21:27 ——– d—–w- c:\program files (x86)\Spirits of Mystery - Song of the Phoenix
2012-07-08 06:41 . 2012-07-08 06:42 ——– d—–w- c:\program files (x86)\Spirits of Mystery - Song of the Phoenix Collector's Edition
2012-07-03 15:07 . 2012-07-03 15:07 55384 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2012-07-03 15:05 . 2012-07-17 08:08 ——– d—–w- c:\programdata\Lavasoft
2012-07-03 15:05 . 2012-07-03 15:05 ——– d—–w- c:\program files (x86)\Lavasoft
2012-07-03 14:56 . 2012-07-03 14:56 ——– d—–w- c:\programdata\GFI Software
2012-06-22 08:35 . 2012-06-02 22:19 57880 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-22 08:35 . 2012-06-02 22:19 44056 —-a-w- c:\windows\system32\wups2.dll
2012-06-22 08:35 . 2012-06-02 22:19 2428952 —-a-w- c:\windows\system32\wuaueng.dll
2012-06-22 08:35 . 2012-06-02 22:15 2622464 —-a-w- c:\windows\system32\wucltux.dll
2012-06-22 08:35 . 2012-06-02 22:19 38424 —-a-w- c:\windows\system32\wups.dll
2012-06-22 08:35 . 2012-06-02 22:19 701976 —-a-w- c:\windows\system32\wuapi.dll
2012-06-22 08:35 . 2012-06-02 22:15 99840 —-a-w- c:\windows\system32\wudriver.dll
2012-06-22 08:34 . 2012-06-02 14:19 186752 —-a-w- c:\windows\system32\wuwebv.dll
2012-06-22 08:34 . 2012-06-02 14:15 36864 —-a-w- c:\windows\system32\wuapp.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-17 08:06 . 2012-04-05 14:48 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-17 08:06 . 2011-06-12 06:02 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-08 06:19 . 2011-05-07 08:49 101464 —-a-w- c:\windows\system32\drivers\RapportKE64.sys
2012-07-03 12:46 . 2010-11-03 09:57 24904 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-05-31 11:25 . 2011-08-24 06:37 279656 ——w- c:\windows\system32\MpSigStub.exe
2012-05-29 06:26 . 2012-05-29 06:26 2560 —-a-w- c:\windows\_MSRSTRT.EXE
2012-05-04 11:06 . 2012-06-14 04:00 5559664 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 10:03 . 2012-06-14 04:00 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:03 . 2012-06-14 04:00 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-04-28 03:55 . 2012-06-14 04:00 210944 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-26 05:41 . 2012-06-14 04:00 77312 —-a-w- c:\windows\system32\rdpwsx.dll
2012-04-26 05:41 . 2012-06-14 04:00 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll
2012-04-26 05:34 . 2012-06-14 04:00 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-07-18_11.56.50 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:54 . 2012-07-19 07:36 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-07-18 11:56 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-07-18 11:56 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-07-19 07:36 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-07-19 07:36 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2012-07-18 11:56 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-10-13 18:30 . 2012-07-18 12:22 47922 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-07-18 12:22 33264 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-10-30 12:45 . 2012-07-19 07:38 18260 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3874780637-2018472326-2013978506-1001_UserData.bin
+ 2010-10-30 12:02 . 2012-07-18 17:36 49152 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-30 12:02 . 2012-07-17 21:11 49152 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2012-07-18 17:36 . 2012-07-18 17:36 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-07-17 21:11 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-07-18 17:36 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2012-07-18 11:56 . 2012-07-18 11:56 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-07-19 07:36 . 2012-07-19 07:36 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-07-18 11:56 . 2012-07-18 11:56 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-07-19 07:36 . 2012-07-19 07:36 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-10-31 07:38 . 2012-07-19 06:24 384546 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
- 2009-07-14 05:01 . 2012-07-18 11:55 391004 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-07-19 07:35 391004 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-02-20 23:33 . 2012-07-19 07:35 4652570 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3874780637-2018472326-2013978506-1001-8192.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2012-07-08 109336]
.
c:\users\NickandAnne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CaptureWiz.lnk - c:\program files (x86)\CaptureWiz\Pro\CaptureWiz.exe [2010-10-30 3112696]
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-16 1324384]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-16 1324384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-17 136176]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-17 136176]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2010-01-28 114304]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-18 113120]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [2011-05-10 22528]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-10-30 1255736]
R4 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [2008-09-16 169312]
R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
R4 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-17 250056]
R4 BecHelperService;BecHelperService;c:\program files (x86)\3 Mobile Broadband\3Connect\BecHelperService.exe [2010-01-28 1737464]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280]
S0 RapportKE64;RapportKE64;c:\windows\System32\Drivers\RapportKE64.sys [2012-07-08 101464]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\0602010.005\SYMDS64.SYS [2012-01-17 451192]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\0602010.005\SYMEFA64.SYS [2012-01-17 1092728]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.1.2.10\Definitions\BASHDefs\20120711.002\BHDrvx64.sys [2012-06-19 1161376]
S1 ccSet_N360;Norton 360 Settings Manager;c:\windows\system32\drivers\N360x64\0602010.005\ccSetx64.sys [2011-11-29 167048]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.1.2.10\Definitions\IPSDefs\20120718.001\IDSvia64.sys [2012-06-14 509088]
S1 RapportCerberus_34302;RapportCerberus_34302;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\34302\RapportCerberus64_34302.sys [2011-12-15 397520]
S1 RapportEI64;RapportEI64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [2012-07-08 55096]
S1 RapportPG64;RapportPG64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [2012-07-08 297048]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\0602010.005\Ironx64.SYS [2012-01-17 190072]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\0602010.005\SYMNETS.SYS [2012-01-17 405624]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
S2 N360;Norton 360;c:\program files (x86)\Norton 360\Engine\6.2.1.5\ccSvcHst.exe [2012-03-27 138232]
S2 RapportMgmtService;Rapport Management Service;c:\program files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [2012-07-08 976728]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2010-08-20 689472]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-06-01 138912]
S3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2009-08-06 320040]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2010-01-28 86120]
S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 08:06]
.
2012-07-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-17 10:21]
.
2012-07-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-17 10:21]
.
.
——— X64 Entries ———–
.
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.co.uk/
uDefault_Search_URL = hxxp://www.google.com/ie
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Customize Menu - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office14\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: Save Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: Se&nd to OneNote - c:\progra~2\MIF5BA~1\Office14\ONBttnIE.dll/105
IE: Show RoboForm Toolbar - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
TCP: DhcpNameServer = [removed] [removed]
FF - ProfilePath - c:\users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\N360]
"ImagePath"="\"c:\program files (x86)\Norton 360\Engine\6.2.1.5\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton 360\Engine\6.2.1.5\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
———————— Other Running Processes ————————
.
c:\program files (x86)\Trusteer\Rapport\bin\RapportService.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Canon\IJPLM\IJPLMSVC.EXE
c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
.
**************************************************************************
.
Completion time: 2012-07-19 08:42:25 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-19 07:42
ComboFix2.txt 2012-07-18 12:01
ComboFix3.txt 2010-02-13 13:30
.
Pre-Run: 397,823,352,832 bytes free
Post-Run: 397,785,559,040 bytes free
.
- - End Of File - - CCEAE6B0313DA5045582198F692D9103

MBAM

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.19.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
NickandAnne :: DELLOCT10 [administrator]

19/07/2012 08:56:02
mbam-log-2012-07-19 (08-56-02).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 201827
Time elapsed: 3 minute(s), 29 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

and finally ESET

C:\Users\NickandAnne\Documents\My DAP Downloads\cnet_Auto_Kindle_v0_4_50_exe.exe a variant of Win32/InstallCore.D application
C:\Users\NickandAnne\Documents\My DAP Downloads\setup-converterlite-ic-1.2.0.exe a variant of Win32/InstallCore.P application

Unfortunately, whenever I open a new tab in Firefox it still opens as a Conduit page as below

[external image: Posted Image]

Grateful for your thoughts on where we go from here.

zlobber

Many thanks mowman - that seems to have removed the Conduit page whenever I open a new tab.

Now each new tab doesn't give me a repeat of my home page (the Google UK search box in the middle of the page) but I seem to have 9 empty rectangular boxes on a blank page (pse see screenshot below) - not sure what that's all about, but I can probably fix it through Firefox.

The latest OTL log is below the screen shot.

And no more Conduit is very welcome!

zlobber

[external image: Posted Image]

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{1392b8d2-5c05-419f-a8f6-b9f15a596612} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\ not found.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\Plugins folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\modules folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\META-INF folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\lib folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\defaults\preferences folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\defaults folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\skin folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\sl folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\lib folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\core folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\WEATHER\js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\WEATHER\css folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\WEATHER folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\TWITTER\resources folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\TWITTER\js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\TWITTER\img folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\TWITTER folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\TESTER_POPUP\js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\TESTER_POPUP folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\TESTER_EMBEDDED\js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\TESTER_EMBEDDED folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\TESTER_BCAPI\js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\TESTER_BCAPI\autoTest\spec folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\TESTER_BCAPI\autoTest\lib\jasmine-1.1.0 folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\TESTER_BCAPI\autoTest\lib folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\TESTER_BCAPI\autoTest folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\TESTER_BCAPI folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\SEARCH_IN_NEW_TAB folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\SEARCH\view\style\rsx folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\SEARCH\view\style folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\SEARCH\view\script folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\SEARCH\view folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\SEARCH\resources folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\SEARCH\js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\SEARCH\Css folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\SEARCH\buildSettings folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\SEARCH folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\RADIO_PLAYER\js\resources folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\RADIO_PLAYER\js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\RADIO_PLAYER\css\custom-theme folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\RADIO_PLAYER\css folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\RADIO_PLAYER folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\PRICE_GONG\menu_dlg folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\PRICE_GONG\images folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\PRICE_GONG\css\custom-theme folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\PRICE_GONG\css folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\PRICE_GONG\agreement folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\PRICE_GONG folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\Optimizer\js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\Optimizer folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\NOTIFICATION\js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\NOTIFICATION\images\light folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\NOTIFICATION\images\dark folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\NOTIFICATION\images folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\NOTIFICATION\css folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\NOTIFICATION folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\MULTI_RSS\js\resources folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\MULTI_RSS\js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\MULTI_RSS\img folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\MULTI_RSS\css folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\MULTI_RSS folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\HIGHLIGHTER\js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\HIGHLIGHTER\css folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\HIGHLIGHTER folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\EMAIL_NOTIFIER\js\plugins folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\EMAIL_NOTIFIER\js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\EMAIL_NOTIFIER\css folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\EMAIL_NOTIFIER folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\APPLICATION_BUTTON\resources folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\APPLICATION_BUTTON\Js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\APPLICATION_BUTTON folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa\404 folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\wa folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\ui\menu\js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\ui\menu\img folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\ui\menu\css folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\ui\menu folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\ui\gf\img folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\ui\gf\css folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\ui\gf folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\ui\gadgetFrame folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\ui\dlg\ftd\images folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\ui\dlg\ftd folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\ui\dlg folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\ui folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\searchProtector\searchProtectorSettingsDialog\images folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\searchProtector\searchProtectorSettingsDialog folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\searchProtector\SearchProtectorBubbleDialog\images folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\searchProtector\SearchProtectorBubbleDialog folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\searchProtector\js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\searchProtector folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\options\js\resources folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\options\js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\options\images folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\options\css folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\options folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\myStuffDialogs folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\features\js\resources folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\features\js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\features folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\api folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\ac\res folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\ac\img folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\ac\css folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\ac folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\aboutBox\js folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\aboutBox\images folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al\aboutBox folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb\al folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content\tb folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933\content folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome\CT1060933 folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\chrome folder moved successfully.
C:\Users\NickandAnne\AppData\Roaming\Mozilla\Firefox\Profiles\z2wc8exn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612} folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: All Users.WINDOWS
->Temp folder emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: NickandAnne
->Temp folder emptied: 2452372 bytes
->Temporary Internet Files folder emptied: 20383392 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 55426797 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 5648 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5334 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 75.00 mb


OTL by OldTimer - Version 3.2.54.0 log created on 07202012_222342

Files\Folders moved on Reboot…
File\Folder C:\Users\NickandAnne\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{080241D8-DFAC-421A-8A8D-E1E1C0D6E551}.tmp moved successfully.
C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4686F3BD-F790-4CA4-B22F-51896F7C6C5B}.tmp moved successfully.
C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4F575167-D9B4-44A5-AB79-1BBCD5B908CB}.tmp moved successfully.
C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{6F1CD5F3-528F-48C2-8A2B-2E77C77B3FC5}.tmp moved successfully.
C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C64B440D-1F22-451F-878B-FFBCEC2CD5E2}.tmp moved successfully.

PendingFileRenameOperations files…
File C:\Users\NickandAnne\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
File C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{080241D8-DFAC-421A-8A8D-E1E1C0D6E551}.tmp not found!
File C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4686F3BD-F790-4CA4-B22F-51896F7C6C5B}.tmp not found!
File C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4F575167-D9B4-44A5-AB79-1BBCD5B908CB}.tmp not found!
File C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{6F1CD5F3-528F-48C2-8A2B-2E77C77B3FC5}.tmp not found!
File C:\Users\NickandAnne\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C64B440D-1F22-451F-878B-FFBCEC2CD5E2}.tmp not found!

Registry entries deleted on Reboot…