atieclxx.exe Virus [Closed]

Hello,

I run windows 7 on an hp laptop. Yesterday I accidentally downloaded a virus from a link and ran the .exe. Since then I have had several processes running on my computer- winlogon.exe, csrss.exe, and atieclxx.exe. I know from reading posts about similar problems that the first two are normal system processes and that the third is is used with an ATI graphics card, HOWEVER, I use an AMD Radeon graphics card. These there processes are often reported together as indicating a virus infection. I have run malwarebytes and MSE and found nothing. Other people have posted similar circumstances and found trojans, so I am concerned.

The OTL report follows.

Thank you,
Mycah

OTL logfile created on: 7/30/2012 2:18:24 PM - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\Mycah Braxton\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.60 Gb Total Physical Memory | 2.43 Gb Available Physical Memory | 67.56% Memory free
7.20 Gb Paging File | 5.32 Gb Available in Paging File | 73.79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 439.35 Gb Total Space | 379.78 Gb Free Space | 86.44% Space Free | Partition Type: NTFS
Drive D: | 22.24 Gb Total Space | 2.39 Gb Free Space | 10.74% Space Free | Partition Type: NTFS
Drive E: | 3.96 Gb Total Space | 1.08 Gb Free Space | 27.27% Space Free | Partition Type: FAT32
Drive F: | 3.80 Gb Total Space | 2.77 Gb Free Space | 72.91% Space Free | Partition Type: FAT32
Drive G: | 626.26 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: BASTION | User Name: Mycah Braxton | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Mycah Braxton\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_257_ActiveX.exe (Adobe Systems Incorporated)
PRC - C:\Users\Mycah Braxton\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe (IBM Corp.)
PRC - C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClientUI.exe (IBM Corp.)
PRC - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe (Hewlett-Packard Company)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (CyberLink)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)


========== Modules (No Company Name) ==========

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\HP.SupportFramework\1.0.0.0__2a4860322af7ba08\HP.SupportFramework.dll ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (NisSrv) – c:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (btwdins) – C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV:64bit: - (STacSV) – C:\Program Files\IDT\WDM\stacsv64.exe (IDT, Inc.)
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (hpsrv) – C:\Windows\SysNative\hpservice.exe (Hewlett-Packard Company)
SRV:64bit: - (HPAuto) – C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe (Hewlett-Packard)
SRV:64bit: - (HPClientSvc) – C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (Hewlett-Packard Company)
SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AESTFilters) – C:\Program Files\IDT\WDM\AESTSr64.exe (Andrea Electronics Corporation)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (BESClient) – C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe (IBM Corp.)
SRV - (HPDrvMntSvc.exe) – C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Company)
SRV - (HPWMISVC) – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
SRV - (HP Support Assistant Service) – C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (GamesAppService) – C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (dtsoftbus01) – C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (RSUSBSTOR) – C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (BCM43XX) – C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation)
DRV:64bit: - (NisDrv) – C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (btwampfl) – C:\Windows\SysNative\drivers\btwampfl.sys (Broadcom Corporation.)
DRV:64bit: - (bcbtums) – C:\Windows\SysNative\drivers\bcbtums.sys (Broadcom Corporation.)
DRV:64bit: - (BTWDPAN) – C:\Windows\SysNative\drivers\btwdpan.sys (Broadcom Corporation.)
DRV:64bit: - (btwavdt) – C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)
DRV:64bit: - (btwaudio) – C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)
DRV:64bit: - (btwl2cap) – C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV:64bit: - (btwrchid) – C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)
DRV:64bit: - (usbfilter) – C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)
DRV:64bit: - (STHDA) – C:\Windows\SysNative\drivers\stwrt64.sys (IDT, Inc.)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (Accelerometer) – C:\Windows\SysNative\drivers\Accelerometer.sys (Hewlett-Packard Company)
DRV:64bit: - (hpdskflt) – C:\Windows\SysNative\drivers\hpdskflt.sys (Hewlett-Packard Company)
DRV:64bit: - (amd_sata) – C:\Windows\SysNative\drivers\amd_sata.sys (Advanced Micro Devices)
DRV:64bit: - (amd_xata) – C:\Windows\SysNative\drivers\amd_xata.sys (Advanced Micro Devices)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) – C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (AtiHDAudioService) – C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (clwvd) – C:\Windows\SysNative\drivers\clwvd.sys (CyberLink Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (SrvHsfV92) – C:\Windows\SysNative\drivers\VSTDPV6.SYS (Conexant Systems, Inc.)
DRV:64bit: - (SrvHsfWinac) – C:\Windows\SysNative\drivers\VSTCNXT6.SYS (Conexant Systems, Inc.)
DRV:64bit: - (SrvHsfHDA) – C:\Windows\SysNative\drivers\VSTAZL6.SYS (Conexant Systems, Inc.)
DRV:64bit: - (NVENETFD) – C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://search.ask.com/web?q={searchterms}&…is&o;=HPNTDF
IE:64bit: - HKLM\..\SearchScopes\{96838AE9-27C3-4011-9F66-BD438FE95D07}: "URL" = http://www.amazon.com/s/ref=azs_osd_iea?ie…s={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=HPNTDF
IE:64bit: - HKLM\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = http://en.wikipedia.org/wiki/Special:Searc…h={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-30572-11…w={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
IE - HKLM\..\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://search.ask.com/web?q={searchterms}&…is&o;=HPNTDF
IE - HKLM\..\SearchScopes\{96838AE9-27C3-4011-9F66-BD438FE95D07}: "URL" = http://www.amazon.com/s/ref=azs_osd_iea?ie…s={searchTerms}
IE - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=HPNTDF
IE - HKLM\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = http://en.wikipedia.org/wiki/Special:Searc…h={searchTerms}
IE - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-30572-11…w={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
IE - HKCU\..\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://search.ask.com/web?q={searchterms}&…is&o;=HPNTDF
IE - HKCU\..\SearchScopes\{96838AE9-27C3-4011-9F66-BD438FE95D07}: "URL" = http://www.amazon.com/s/ref=azs_osd_iea?ie…s={searchTerms}
IE - HKCU\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=HPNTDF
IE - HKCU\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = http://en.wikipedia.org/wiki/Special:Searc…h={searchTerms}
IE - HKCU\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-30572-11…w={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = do-net.doshisha.ac.jp;do-netmac.doshisha.ac.jp;
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = proxy.doshisha.ac.jp:8080


========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Mycah Braxton\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Mycah Braxton\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)


[2012/05/12 14:33:37 | 000,000,000 | —D | M] (No name found) – C:\Users\Mycah Braxton\AppData\Roaming\Mozilla\Firefox\extensions
[2012/05/12 14:33:40 | 000,000,000 | —D | M] (uTorrentControl2 Community Toolbar) – C:\Users\Mycah Braxton\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}

========== Chrome ==========

CHR - homepage: http://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl;={language}&q;={searchTerms},
CHR - homepage: http://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Mycah Braxton\AppData\Local\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Mycah Braxton\AppData\Local\Google\Chrome\Application\20.0.1132.57\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Mycah Braxton\AppData\Local\Google\Chrome\Application\20.0.1132.57\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Mycah Braxton\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: WildTangent Games App Presence Detector (Enabled) = C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Mycah Braxton\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - Extension: KanjiHybrid = C:\Users\Mycah Braxton\AppData\Local\Google\Chrome\User Data\Default\Extensions\aogggenppchomkpdoplakfjkfjeilmkn\1.5_0\
CHR - Extension: Cloud Reader = C:\Users\Mycah Braxton\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjnkloegafmkhgpjglcbldhaokjpandj\1.0.0.0_0\
CHR - Extension: YouTube = C:\Users\Mycah Braxton\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Mycah Braxton\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Kanji Plus = C:\Users\Mycah Braxton\AppData\Local\Google\Chrome\User Data\Default\Extensions\hamegjfmkdfedhjnpojefpfmogfckojb\0.3_0\
CHR - Extension: rikaikun = C:\Users\Mycah Braxton\AppData\Local\Google\Chrome\User Data\Default\Extensions\jipdnfibhldikgcjhfnomkfpcebammhp\0.8.5_0\
CHR - Extension: Gmail = C:\Users\Mycah Braxton\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (uTorrentControl2 Toolbar) - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll (Conduit Ltd.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (uTorrentControl2 Toolbar) - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (uTorrentControl2 Toolbar) - {687578B9-7132-4A7A-80E4-30EE31099E03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [SetDefault] C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe (Hewlett-Packard Development Company, L.P.)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [HP CoolSense] C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [HPQuickWebProxy] C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_257_ActiveX.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Users\Mycah Braxton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Mycah Braxton\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\SearchExtensions: InternetExtensionAction = http://hp.digitalriver.com/DRHM/store?Acti…amp;keywords=%w
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\SearchExtensions: InternetExtensionName = Find Software on HP Download Store (Microsoft Corporation)
O8:64bit: - Extra context menu item: Send image to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: Send page to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Send image to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Send to &Bluetooth; Device… - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 172.30.31.252 8.8.8.8 8.8.4.4
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{808E6E79-9EE2-49BE-91B9-A5576EBFB07E}: DhcpNameServer = 172.30.31.252 8.8.8.8 8.8.4.4
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C646145F-B32D-497A-88CB-75E328180417}: DhcpNameServer = 10.130.0.1 [removed] [removed]
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/11 21:58:52 | 000,000,059 | R— | M] () - G:\Autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)


Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/07/30 14:17:19 | 000,597,504 | —- | C] (OldTimer Tools) – C:\Users\Mycah Braxton\Desktop\OTL.exe
[2012/07/29 13:34:47 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2012/07/29 13:23:38 | 000,000,000 | —D | C] – C:\Users\Mycah Braxton\AppData\Roaming\Malwarebytes
[2012/07/29 13:23:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/07/29 13:23:29 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/07/29 13:23:28 | 000,024,904 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2012/07/29 13:23:28 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/07/29 12:35:49 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/07/29 12:19:28 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/07/29 09:49:28 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/07/29 09:49:25 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/07/29 09:48:18 | 000,000,000 | —D | C] – C:\Qoobox
[2012/07/29 09:47:02 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2012/07/29 09:03:44 | 000,000,000 | —D | C] – C:\Program Files (x86)\smartdl
[2012/07/28 19:04:19 | 000,000,000 | —D | C] – C:\Users\Mycah Braxton\AppData\Roaming\.minecraft
[2012/07/28 19:01:05 | 000,000,000 | —D | C] – C:\Program Files (x86)\Oracle
[2012/07/28 18:56:10 | 000,687,544 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\deployJava1.dll
[2012/07/28 18:56:08 | 000,772,544 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\npDeployJava1.dll
[2012/07/28 18:56:07 | 000,227,760 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2012/07/28 18:55:14 | 000,174,064 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2012/07/28 18:55:14 | 000,174,064 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2012/07/28 18:54:45 | 000,000,000 | —D | C] – C:\Program Files (x86)\Java
[2012/07/28 18:53:38 | 000,000,000 | —D | C] – C:\ProgramData\McAfee
[2012/07/22 18:48:07 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2012/07/22 17:10:00 | 000,000,000 | —D | C] – C:\Users\Mycah Braxton\Documents\Old Vocab
[2012/07/22 00:12:16 | 000,000,000 | —D | C] – C:\Users\Mycah Braxton\AppData\Local\Windows Live
[2012/07/22 00:12:00 | 000,000,000 | —D | C] – C:\Users\Mycah Braxton\AppData\Local\{E41C7D66-3486-42ED-B62C-29E65D4B58AE}
[2012/07/22 00:12:00 | 000,000,000 | —D | C] – C:\Users\Mycah Braxton\AppData\Local\{CE481764-9B65-4FD6-BF0E-0DEF376B0E2F}
[2012/07/22 00:11:50 | 000,000,000 | —D | C] – C:\Users\Mycah Braxton\AppData\Roaming\Windows Live Writer
[2012/07/22 00:11:50 | 000,000,000 | —D | C] – C:\Users\Mycah Braxton\AppData\Local\Windows Live Writer
[2012/07/16 21:43:14 | 000,000,000 | —D | C] – C:\Users\Mycah Braxton\Desktop\Japan Pictures MATSURI
[2012/07/12 16:52:41 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/07/12 16:52:41 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/07/12 16:52:39 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/07/12 16:52:39 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/07/12 16:52:36 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/07/12 16:52:35 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/07/12 16:52:34 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/07/12 16:52:34 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/07/12 16:52:31 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/07/12 16:52:30 | 002,311,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/07/12 16:52:30 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/07/12 16:52:29 | 000,818,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/07/12 16:52:29 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/07/12 07:03:28 | 000,000,000 | -H-D | C] – C:\ProgramData\CanonBJ
[2012/07/12 05:12:49 | 000,000,000 | —D | C] – C:\Users\Mycah Braxton\Documents\IUC Yokohama
[2012/07/11 17:38:30 | 000,307,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncrypt.dll
[2012/07/11 17:32:35 | 000,805,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\cdosys.dll
[2012/07/11 17:32:33 | 001,133,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cdosys.dll
[2012/07/11 09:17:29 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msxml3r.dll
[2012/07/11 09:17:29 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msxml3r.dll
[2012/07/07 18:51:58 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2012/07/07 18:47:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Works
[2012/07/07 18:47:08 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Visual Studio
[2012/07/07 18:47:07 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\DESIGNER
[2012/07/07 18:45:22 | 000,000,000 | —D | C] – C:\Windows\PCHEALTH
[2012/07/07 18:42:08 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2012/07/07 18:41:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Visual Studio 8
[2012/07/07 18:41:17 | 000,000,000 | —D | C] – C:\Windows\SHELLNEW
[2012/07/07 18:40:48 | 000,000,000 | —D | C] – C:\Users\Mycah Braxton\AppData\Local\Microsoft Help
[2012/07/07 18:40:32 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft Help
[2012/07/07 18:39:54 | 000,000,000 | R–D | C] – C:\MSOCache
[2012/07/07 18:36:55 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
[2012/07/07 18:35:42 | 000,283,200 | —- | C] (DT Soft Ltd) – C:\Windows\SysNative\drivers\dtsoftbus01.sys
[2012/07/07 18:35:26 | 000,000,000 | —D | C] – C:\Users\Mycah Braxton\AppData\Roaming\DAEMON Tools Lite
[2012/07/07 18:35:16 | 000,000,000 | —D | C] – C:\Program Files (x86)\DAEMON Tools Lite
[2012/07/07 18:34:38 | 000,000,000 | —D | C] – C:\ProgramData\DAEMON Tools Lite
[2012/07/07 18:15:03 | 000,000,000 | —D | C] – C:\Users\Mycah Braxton\Desktop\MS Office Pro Plus 2007
[2012/07/03 11:17:28 | 000,000,000 | —D | C] – C:\Users\Mycah Braxton\Documents\art

========== Files - Modified Within 30 Days ==========

[2012/07/30 14:16:04 | 000,597,504 | —- | M] (OldTimer Tools) – C:\Users\Mycah Braxton\Desktop\OTL.exe
[2012/07/30 14:14:52 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/07/30 14:05:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/07/30 13:49:33 | 000,000,940 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1681252267-347641421-554505533-1000UA.job
[2012/07/30 13:29:42 | 000,000,364 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForMycah Braxton.job
[2012/07/30 09:45:29 | 000,000,888 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1681252267-347641421-554505533-1000Core.job
[2012/07/29 12:36:19 | 000,729,688 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/07/29 12:36:19 | 000,626,278 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/07/29 12:36:19 | 000,107,522 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/07/29 12:16:55 | 000,032,064 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/29 12:16:55 | 000,032,064 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/29 12:07:35 | 2901,467,136 | -HS- | M] () – C:\hiberfil.sys
[2012/07/29 09:09:48 | 000,001,081 | —- | M] () – C:\Users\Mycah Braxton\Documents\Documents - Shortcut.lnk
[2012/07/28 20:04:37 | 000,000,340 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForBASTION$.job
[2012/07/28 18:54:49 | 000,174,064 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2012/07/28 18:54:49 | 000,174,064 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2012/07/27 12:56:36 | 000,568,722 | —- | M] () – C:\torrent.exe
[2012/07/22 18:34:20 | 349,131,270 | —- | M] () – C:\Windows\MEMORY.DMP
[2012/07/12 17:26:11 | 000,413,312 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/07/12 17:21:46 | 001,048,576 | —- | M] () – C:\Users\Mycah Braxton\Documents\Contemporary Japanese Artists.accdb
[2012/07/12 08:11:22 | 000,002,399 | —- | M] () – C:\Users\Mycah Braxton\Desktop\Google Chrome.lnk
[2012/07/07 18:35:42 | 000,283,200 | —- | M] (DT Soft Ltd) – C:\Windows\SysNative\drivers\dtsoftbus01.sys
[2012/07/05 22:06:48 | 000,227,760 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2012/07/05 22:06:30 | 000,772,544 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\npDeployJava1.dll
[2012/07/05 22:06:20 | 000,687,544 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\deployJava1.dll
[2012/07/03 13:46:44 | 000,024,904 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2012/07/01 09:17:25 | 000,000,218 | —- | M] () – C:\Users\Mycah Braxton\.recently-used.xbel

========== Files Created - No Company Name ==========

[2012/07/29 09:49:35 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/07/29 09:49:28 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/07/29 09:49:27 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/07/29 09:49:26 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/07/29 09:49:26 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/07/29 09:09:48 | 000,001,081 | —- | C] () – C:\Users\Mycah Braxton\Documents\Documents - Shortcut.lnk
[2012/07/27 12:56:36 | 000,568,722 | —- | C] () – C:\torrent.exe
[2012/07/22 18:34:20 | 349,131,270 | —- | C] () – C:\Windows\MEMORY.DMP
[2012/07/11 07:14:15 | 000,000,340 | —- | C] () – C:\Windows\tasks\HPCeeScheduleForBASTION$.job
[2012/07/07 19:16:14 | 001,048,576 | —- | C] () – C:\Users\Mycah Braxton\Documents\Contemporary Japanese Artists.accdb
[2012/07/01 09:17:25 | 000,000,218 | —- | C] () – C:\Users\Mycah Braxton\.recently-used.xbel
[2012/04/16 20:13:24 | 000,744,400 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2012/02/02 05:12:41 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2011/09/06 16:34:28 | 000,007,736 | —- | C] () – C:\Windows\hpDSTRES.DLL
[2011/06/29 03:32:24 | 000,059,904 | —- | C] () – C:\Windows\SysWow64\OVDecode.dll
[2011/06/20 22:51:14 | 000,066,856 | —- | C] () – C:\Windows\SysWow64\SynTPEnhPS.dll
[2011/03/18 05:51:44 | 000,003,929 | —- | C] () – C:\Windows\SysWow64\atipblag.dat

========== LOP Check ==========

[2012/07/25 09:12:23 | 000,000,000 | —D | M] – C:\Users\Mycah Braxton\AppData\Roaming\.anki
[2012/07/28 19:16:22 | 000,000,000 | —D | M] – C:\Users\Mycah Braxton\AppData\Roaming\.minecraft
[2012/07/07 18:38:00 | 000,000,000 | —D | M] – C:\Users\Mycah Braxton\AppData\Roaming\DAEMON Tools Lite
[2012/07/29 12:33:33 | 000,000,000 | —D | M] – C:\Users\Mycah Braxton\AppData\Roaming\Dropbox
[2012/06/21 19:19:57 | 000,000,000 | —D | M] – C:\Users\Mycah Braxton\AppData\Roaming\DT
[2012/07/07 18:17:49 | 000,000,000 | —D | M] – C:\Users\Mycah Braxton\AppData\Roaming\SoftGrid Client
[2012/04/16 19:40:11 | 000,000,000 | —D | M] – C:\Users\Mycah Braxton\AppData\Roaming\Stanford
[2012/04/16 17:42:17 | 000,000,000 | —D | M] – C:\Users\Mycah Braxton\AppData\Roaming\Synaptics
[2012/04/16 22:07:32 | 000,000,000 | —D | M] – C:\Users\Mycah Braxton\AppData\Roaming\TP
[2012/05/12 15:01:04 | 000,000,000 | —D | M] – C:\Users\Mycah Braxton\AppData\Roaming\uTorrent
[2012/07/22 00:11:50 | 000,000,000 | —D | M] – C:\Users\Mycah Braxton\AppData\Roaming\Windows Live Writer
[2009/07/14 01:08:49 | 000,013,378 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/11/20 23:23:51 | 000,383,786 | RHS- | M] () – C:\bootmgr
[2012/07/29 12:35:47 | 000,022,496 | —- | M] () – C:\ComboFix.txt
[2012/07/29 12:07:35 | 2901,467,136 | -HS- | M] () – C:\hiberfil.sys
[2012/07/29 12:07:36 | 3868,622,848 | -HS- | M] () – C:\pagefile.sys
[2012/07/27 12:56:36 | 000,568,722 | —- | M] () – C:\torrent.exe

< %systemroot%\Fonts\*.com >
[2009/07/14 01:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 01:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 01:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 01:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 16:49:50 | 000,000,065 | -H– | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/05/13 18:42:24 | 000,302,448 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 00:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2012/04/16 17:43:07 | 000,000,221 | -HS- | M] () – C:\Users\Mycah Braxton\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2012/07/30 14:16:04 | 000,597,504 | —- | M] (OldTimer Tools) – C:\Users\Mycah Braxton\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >
[2012/06/11 12:24:00 | 000,002,162 | —- | M] () – C:\Windows\AppPatch\Custom\{06b2b7ed-809a-44e6-8538-ca0f5b74ecc4}.sdb
[2012/06/11 12:24:00 | 000,555,200 | —- | M] () – C:\Windows\AppPatch\Custom\{29447369-6968-4e86-a208-603f6f0771a6}.sdb
[2012/06/11 12:24:14 | 000,125,876 | —- | M] () – C:\Windows\AppPatch\Custom\{f300e352-12de-4e7f-ace3-a376874402b6}.sdb

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Files - Unicode (All) ==========
[2012/06/28 19:23:22 | 000,013,773 | —- | M] ()(C:\Users\Mycah Braxton\Documents\???????.docx) – C:\Users\Mycah Braxton\Documents\マイカ大飯原発.docx
[2012/06/28 19:23:20 | 000,013,773 | —- | C] ()(C:\Users\Mycah Braxton\Documents\???????.docx) – C:\Users\Mycah Braxton\Documents\マイカ大飯原発.docx
[2012/06/15 23:01:00 | 000,014,431 | —- | M] ()(C:\Users\Mycah Braxton\Documents\??????.docx) – C:\Users\Mycah Braxton\Documents\大阪の心斎橋.docx
[2012/06/15 23:01:00 | 000,000,162 | -H– | M] ()(C:\Users\Mycah Braxton\Documents\~$??????.docx) – C:\Users\Mycah Braxton\Documents\~$大阪の心斎橋.docx
[2012/06/15 23:01:00 | 000,000,162 | -H– | C] ()(C:\Users\Mycah Braxton\Documents\~$??????.docx) – C:\Users\Mycah Braxton\Documents\~$大阪の心斎橋.docx
[2012/06/15 23:00:59 | 000,014,431 | —- | C] ()(C:\Users\Mycah Braxton\Documents\??????.docx) – C:\Users\Mycah Braxton\Documents\大阪の心斎橋.docx
[2012/06/15 22:44:58 | 000,014,265 | —- | M] ()(C:\Users\Mycah Braxton\Documents\????.docx) – C:\Users\Mycah Braxton\Documents\大阪駅で.docx
[2012/06/15 06:03:29 | 000,014,265 | —- | C] ()(C:\Users\Mycah Braxton\Documents\????.docx) – C:\Users\Mycah Braxton\Documents\大阪駅で.docx
[2012/06/07 19:01:50 | 000,013,735 | —- | M] ()(C:\Users\Mycah Braxton\Documents\???????????.docx) – C:\Users\Mycah Braxton\Documents\マイかニュースについて.docx
[2012/06/07 19:01:49 | 000,013,735 | —- | C] ()(C:\Users\Mycah Braxton\Documents\???????????.docx) – C:\Users\Mycah Braxton\Documents\マイかニュースについて.docx
[2012/06/06 17:25:16 | 000,013,953 | —- | M] ()(C:\Users\Mycah Braxton\Documents\???-?????????.docx) – C:\Users\Mycah Braxton\Documents\マイか-ニュース単語リスト.docx
[2012/06/06 17:23:47 | 000,000,162 | -H– | M] ()(C:\Users\Mycah Braxton\Documents\~$?-?????????.docx) – C:\Users\Mycah Braxton\Documents\~$か-ニュース単語リスト.docx
[2012/06/06 17:23:47 | 000,000,162 | -H– | C] ()(C:\Users\Mycah Braxton\Documents\~$?-?????????.docx) – C:\Users\Mycah Braxton\Documents\~$か-ニュース単語リスト.docx
[2012/06/06 17:17:28 | 000,013,953 | —- | C] ()(C:\Users\Mycah Braxton\Documents\???-?????????.docx) – C:\Users\Mycah Braxton\Documents\マイか-ニュース単語リスト.docx

< End of report >

Extras.txt


OTL Extras logfile created on: 7/30/2012 2:18:24 PM - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\Mycah Braxton\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.60 Gb Total Physical Memory | 2.43 Gb Available Physical Memory | 67.56% Memory free
7.20 Gb Paging File | 5.32 Gb Available in Paging File | 73.79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 439.35 Gb Total Space | 379.78 Gb Free Space | 86.44% Space Free | Partition Type: NTFS
Drive D: | 22.24 Gb Total Space | 2.39 Gb Free Space | 10.74% Space Free | Partition Type: NTFS
Drive E: | 3.96 Gb Total Space | 1.08 Gb Free Space | 27.27% Space Free | Partition Type: FAT32
Drive F: | 3.80 Gb Total Space | 2.77 Gb Free Space | 72.91% Space Free | Partition Type: FAT32
Drive G: | 626.26 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: BASTION | User Name: Mycah Braxton | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile [print] – rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1A94C039-F8D3-E944-969E-9EFEB592CEC7}" = lport=52311 | protocol=6 | dir=in | name=bigfix enterprise client (tcp) |
"{3474D590-BADB-4C00-A635-47741D3B956E}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{4493C5C2-86F6-1042-B5DD-DDCA9BEDADF3}" = lport=52311 | protocol=17 | dir=in | name=bigfix enterprise client (udp) |
"{EB04D8E9-5021-4929-8834-503ED646AA60}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
"{FBEC9E5C-79F1-4CDD-B189-F74916C48AD0}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01199D9E-5ED4-4899-A718-FE23085D5EC6}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sins of a solar empire trinity\sins of a solar empire entrenchment.exe |
"{0C652781-436B-4DBB-B3DA-22612E697168}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{1ACC3221-6E8F-4053-B2D3-20DDD7BFABEA}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{2328AE02-7A9E-426C-A080-A98F5CDCAA79}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sins of a solar empire trinity\sins of a solar empire.exe |
"{28883CD8-88F3-4506-B15B-F37F45882A0C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sins of a solar empire trinity\sins of a solar empire diplomacy.exe |
"{2FE333CC-09F5-4273-8475-46C64F50F6FE}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sins of a solar empire trinity\sins of a solar empire diplomacy.exe |
"{3BD41E0F-4937-4FD8-8FEC-A377C554A8F1}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{3BEF4114-638E-4ECE-8143-7205C40ACDEE}" = dir=in | app=c:\program files (x86)\bigfix enterprise\bes client\besclient.exe |
"{4629D7F8-5CCB-4299-94FE-28D3BB42BCD1}" = protocol=6 | dir=in | app=c:\program files (x86)\hewlett-packard\mediasmart\roxionow\rnow.exe |
"{4DDC3115-ACEE-4F80-BF21-9C2713986A6F}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{57B097FB-7714-46DD-B16B-BC31DF595A02}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sins of a solar empire trinity\sins of a solar empire entrenchment.exe |
"{598AA1F8-8CBE-4575-AA27-D52503CEF7F3}" = protocol=1 | dir=in | app=c:\program files (x86)\bigfix enterprise\bes client\besclient.exe |
"{5C9E67CE-8DCF-4907-BFFA-A4BE7C642038}" = protocol=58 | dir=in | app=c:\program files (x86)\bigfix enterprise\bes client\besclient.exe |
"{5CA2D38F-DEB8-4803-B627-64A343F7719C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sins of a solar empire trinity\sins of a solar empire.exe |
"{67D0EF4E-57B1-4E48-A57D-FE00B80A3E20}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sid meier's civilization iii complete\conquests\civ3conquests.exe |
"{6B94C2DD-0DCD-4155-AC61-F05A5F37240E}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{81FDB1D3-9F5F-40EE-A7C5-9EB1E929C2C5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{96543803-6D57-4DAB-8812-750FD26D4552}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{AE2B0DFD-3A3A-4B18-8B20-01B29B580A46}" = protocol=17 | dir=in | app=c:\program files (x86)\hewlett-packard\mediasmart\roxionow\rnow.exe |
"{B00DB0D1-A389-437C-A777-CDFBAA3B5B02}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{BC0306EE-B132-4FB5-95F9-6897CAF32FC8}" = protocol=17 | dir=in | app=c:\program files (x86)\hewlett-packard\mediasmart\roxionow\indivdrm.exe |
"{C7D6000A-83B8-454D-8E82-2B582EA03471}" = protocol=17 | dir=in | app=c:\users\mycah braxton\appdata\roaming\dropbox\bin\dropbox.exe |
"{E0CD795E-D59F-4AC6-AC82-FBF09C9661E9}" = protocol=6 | dir=in | app=c:\users\mycah braxton\appdata\roaming\dropbox\bin\dropbox.exe |
"{F89A2FA8-8DF8-4F68-9261-919674C2F40F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sid meier's civilization iii complete\conquests\civ3conquests.exe |
"{FF55AFE9-0B3E-43D3-A310-8976EF5A6997}" = protocol=6 | dir=in | app=c:\program files (x86)\hewlett-packard\mediasmart\roxionow\indivdrm.exe |
"TCP Query User{07ACF4BD-2D2F-4716-BAC1-12036E42428F}C:\users\mycah braxton\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\mycah braxton\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{21ABA8A2-5661-495B-92B0-2A093703215C}C:\windows\syswow64\dpnsvr.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\dpnsvr.exe |
"UDP Query User{BC95A836-B5FB-43A8-86D1-0B1DD7904810}C:\windows\syswow64\dpnsvr.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\dpnsvr.exe |
"UDP Query User{E1655600-C691-44B0-8AD5-528B56770F1A}C:\users\mycah braxton\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\mycah braxton\appdata\roaming\dropbox\bin\dropbox.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{015C5B35-B678-451C-9AEE-821E8D69621C}_is1" = PeerBlock 1.1 (r518)
"{0576788F-2993-455F-80CD-980114095103}" = HP Security Assistant
"{06b2b7ed-809a-44e6-8538-ca0f5b74ecc4}.sdb" = CVE-2012-1889
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{2856A1C2-70C5-4EC3-AFF7-E5B51E5530A2}" = HP Client Services
"{29447369-6968-4e86-a208-603f6f0771a6}.sdb" = CVE-2012-1889
"{393ffabe-5a1a-43b3-8e03-8f573e1e0d01}.sdb" = CVE-2012-1889
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{57DD35E9-D9BB-4089-BB05-EF933C586CB3}" = Broadcom InConcert Maestro
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6032497A-4479-462B-ADB8-A0A372BB9A23}" = HP Application Assistant
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{6E7F4CA3-B2DE-413C-A7A1-43AA5BE19EA1}" = Broadcom Bluetooth Software
"{7d32ab1f-1858-4373-a75a-b7cd8feb5d92}.sdb" = CVE-2012-1889
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9BCD5A4E-9426-0B45-5C64-37236EAB0207}" = ccc-utility64
"{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}" = Microsoft Security Client
"{BF1E75D0-E7AF-4BEA-9FBC-567F0C54BDF9}" = HP Launch Box
"{CC4D56B7-6F18-470B-8734-ABCD75BCF4F1}" = HP Auto
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{DFB497E0-CE3F-40FC-9596-FC7A48775DE4}" = HP 3D DriveGuard
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{E686FBB0-B356-96BE-A9ED-2D8286AA0386}" = ATI Catalyst Install Manager
"{EAA94988-8288-ED48-B179-F94440FA392E}" = AMD Media Foundation Decoders
"{f300e352-12de-4e7f-ace3-a376874402b6}.sdb" = CVE-2012-1889
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Broadcom 802.11 Wireless LAN Adapter" = Broadcom 802.11 Wireless LAN Adapter
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"SynTPDeinstKey" = Synaptics TouchPad Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{016E1407-26B0-43ED-A5BF-5CC1992069A3}" = Tivoli Endpoint Manager Client
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{120262A6-7A4B-4889-AE85-F5E5688D3683}" = HP MovieStore
"{16B7BDA1-B967-4D2D-8B27-E12727C28350}" = HP CoolSense
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java™ 7 Update 5
"{278A1B10-A463-47A9-DE07-69EB338F14E8}" = Catalyst Control Center InstallProxy
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2E9FE55B-600D-9D6B-FFCE-8C9EB3FC5C83}" = CCC Help Russian
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3677D4D8-E5E0-49FC-B86E-06541CF00BBE}" = opensource
"{402B28F5-39D2-2372-EB02-9679D246C824}" = CCC Help Turkish
"{4D5D18BA-FF9C-40DA-A3B9-661D76EC0FB1}" = HP Documentation
"{53B17A98-5BF0-40BC-AAFF-850A357975AC}" = HP Quick Launch
"{567BA13A-0403-BA6D-6F37-7EBC88526408}" = CCC Help Norwegian
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5999E2DB-F271-4815-9BDC-0133AC527199}" = CCC Help Chinese Standard
"{5C1F73E9-1D71-71E5-719E-39CAEDAD20F9}" = CCC Help Hungarian
"{5CCEE84F-49D5-976C-8B16-3FDDFD521411}" = CCC Help French
"{5EAC5A89-A740-61C8-DB9E-615D65362041}" = CCC Help Danish
"{5F36C538-65DF-6DB5-5EEE-66A5D0B41424}" = CCC Help Polish
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{61C6E2F0-BA5B-EF69-BF55-0B46BB273B4A}" = CCC Help Korean
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6C7D31DA-1A8B-AB14-0A42-67E2FB4AB7C2}" = CCC Help Greek
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.1.2.0
"{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}" = HP Support Assistant
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp" = WildTangent Games App (HP Games)
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{741006D1-7B2B-4E33-B2B0-831F282EEF64}" = Blio
"{7A14FF9E-FB1B-EDFD-34F5-3AD2BA0A11A4}" = CCC Help English
"{7B26B870-AF03-4B0A-BDD3-52F1D2388483}}_is1" = SwitchVid 1.11.3606
"{7E9D8AFA-07EC-A3F2-95C2-C7F8DAAA3F0F}" = Catalyst Control Center Graphics Previews Common
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{891BDE9B-4DC4-F7F4-5629-D8905A2F6D3D}" = CCC Help Czech
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{9008D736-35CA-40DB-A2BE-5F32D954E5AA}" = HP MovieStore
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROPLUS_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_PROPLUS_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{92EB5804-F93B-87A8-7D38-6D9C50FA7B26}" = CCC Help Chinese Traditional
"{95140000-00AF-0409-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{962CB079-85E6-405F-8704-1C62365AE46F}" = HP Software Framework
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{98457B34-98B3-EB83-8C43-69A22284838B}" = CCC Help Italian
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A34CB3C1-E5D3-1DDA-8512-EFDE95E16FAB}" = Catalyst Control Center Localization All
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" = Adobe Reader X (10.1.0) MUI
"{AE856388-AFAD-4753-81DF-D96B19D0A17C}" = HP Setup Manager
"{B2977502-C362-54F8-A1C2-C75038BB7E6A}" = CCC Help German
"{B5124B20-3BDD-CD3B-DC11-CE9843A9CD9B}" = AMD VISION Engine Control Center
"{BB4FC2AD-DF12-4EE1-8AA7-2C0A26B5E2FB}" = HP QuickWeb
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CB020C62-566B-608B-439A-851D60C50254}" = CCC Help Spanish
"{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D8BCE5B9-67CF-4F3F-93AE-3ACC754C72EB}" = HP Power Manager
"{DBCD5E64-7379-4648-9444-8A6558DCB614}" = HP Recovery Manager
"{DC5F0450-B775-ABEC-4C33-28E5B018F02F}" = CCC Help Portuguese
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DF47ADFA-0364-AACB-F8AD-F9399E933CB8}" = CCC Help Dutch
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E36B46EF-FB85-E51D-620C-EBE5652F8A67}" = CCC Help Thai
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E96CAA2A-0244-4A2A-8403-0C3C9534778B}" = ESU for Microsoft Windows 7 SP1
"{EC7CD381-293E-A6F0-2480-DE8C437E8236}" = CCC Help Swedish
"{ED1BD69A-07E3-418C-91F1-D856582581BF}" = HP On Screen Display
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F30403FF-0146-4633-AAC5-D5CD5C50AE70}" = Catalyst Control Center - Branding
"{F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1}" = HP Setup
"{F761359C-9CED-45AE-9A51-9D6605CD55C4}" = Evernote v. 4.2.3
"{F8E1904D-BB58-7DCD-A09A-86430DC9A783}" = CCC Help Finnish
"{FCC826B2-4C6B-4528-0AA5-1B3FC2FB3E0F}" = CCC Help Japanese
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Anki" = Anki
"DAEMON Tools Lite" = DAEMON Tools Lite
"ESET Online Scanner" = ESET Online Scanner v3
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"PROPLUS" = Microsoft Office Professional Plus 2007
"Steam App 201290" = Sins of a Solar Empire: Trinity
"Steam App 3910" = Sid Meier's Civilization III: Complete
"uTorrent" = µTorrent
"uTorrentControl2 Toolbar" = uTorrentControl2 Toolbar
"WildTangent hp Master Uninstall" = HP Games
"WinLiveSuite" = Windows Live Essentials
"WTA-0549cf3d-17b9-4cdd-8232-b4fa9dc89776" = Hoyle Card Games
"WTA-079a29a1-cdc4-4f3c-934b-89410325a4ac" = Mah Jong Medley
"WTA-12da61d4-7bbb-464f-ba50-940ba777cd84" = Cradle of Rome 2
"WTA-219031dc-3366-4c1d-abb6-70a0d26038de" = John Deere Drive Green
"WTA-26ce5374-23d6-4783-826a-dbac24919605" = Jewel Match 3
"WTA-27d4fff7-b357-4591-9205-682763a643f0" = Polar Golfer
"WTA-3349660e-d589-4910-952b-978ab12ac9ed" = Bejeweled 3
"WTA-48521bd9-22fc-46cd-bf55-4aa3d54c744f" = Farmscapes
"WTA-48e53959-2787-4ef0-acb4-add6d37a7a4e" = Dora's World Adventure
"WTA-4d494d89-70d9-4eb0-bbf5-bf0517ee5b6e" = Plants vs. Zombies - Game of the Year
"WTA-4da5b40e-9e36-4af0-9539-f85ffafeded2" = Farm Frenzy
"WTA-68ae0b87-8677-40c2-8ede-27126f0c08c1" = Zuma's Revenge
"WTA-6b02a790-4612-49ee-b11f-e2d068502eab" = Polar Bowler
"WTA-7223a80e-ded2-415c-9097-3e184e964eff" = Luxor HD
"WTA-745de90d-9e59-4cb4-9d98-fa130c6fbae2" = Jewel Quest Mysteries: The Seventh Gate Collector's Edition
"WTA-7d701777-503b-4e58-b049-e56257004681" = Virtual Villagers 4 - The Tree of Life
"WTA-839a7141-1810-4a0c-94f4-eafc5848dc12" = Poker Superstars III
"WTA-8f1d7be4-83ea-432e-817d-a5613c56d54e" = Letters from Nowhere 2
"WTA-9010765d-8c2b-41ac-8659-535bda4dbcf6" = Blackhawk Striker 2
"WTA-90919767-081e-4e1e-8467-74aa8fd366b3" = Penguins!
"WTA-c4dc2fdb-e3d5-4fbe-b925-af7d4253e799" = Torchlight
"WTA-c912025e-9531-48e5-b551-333d9c99194b" = FATE
"WTA-ca3a20dd-2126-4d25-93fe-2068f785b6de" = Chuzzle Deluxe
"WTA-d433f9cf-52df-4ea0-ad0e-673ac4a20006" = Final Drive Fury
"WTA-dd951432-fcd7-461b-b981-362c53b14fc5" = RollerCoaster Tycoon 3: Platinum
"WTA-f93431df-c435-4b40-86fa-8dbf64a42e7d" = The Treasures of Mystery Island: The Ghost Ship

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Amazon Kindle" = Amazon Kindle
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 6/25/2012 2:39:34 AM | Computer Name = Bastion | Source = WinMgmt | ID = 10
Description =

Error - 6/26/2012 11:15:02 PM | Computer Name = Bastion | Source = CVHSVC | ID = 100
Description =

Error - 6/30/2012 8:01:19 AM | Computer Name = Bastion | Source = CVHSVC | ID = 100
Description =

Error - 6/30/2012 5:19:51 PM | Computer Name = Bastion | Source = WinMgmt | ID = 10
Description =

Error - 7/4/2012 5:17:30 AM | Computer Name = Bastion | Source = CVHSVC | ID = 100
Description =

Error - 7/4/2012 9:54:15 AM | Computer Name = Bastion | Source = Application Error | ID = 1000
Description = Faulting application name: chrome.exe, version: 20.0.1132.47, time
stamp: 0x4fec0d4d Faulting module name: chrome.dll, version: 20.0.1132.47, time
stamp: 0x4fec0cd7 Exception code: 0xc0000005 Fault offset: 0x00f8d57c Faulting process
id: 0x1254 Faulting application start time: 0x01cd57065b2abb0b Faulting application
path: C:\Users\Mycah Braxton\AppData\Local\Google\Chrome\Application\chrome.exe
Faulting
module path: C:\Users\Mycah Braxton\AppData\Local\Google\Chrome\Application\20.0.1132.47\chrome.dll
Report
Id: bd9366a5-c5df-11e1-aac2-ec9a74568345

Error - 7/4/2012 3:15:27 PM | Computer Name = Bastion | Source = WinMgmt | ID = 10
Description =

Error - 7/7/2012 5:14:12 PM | Computer Name = Bastion | Source = WinMgmt | ID = 10
Description =

Error - 7/7/2012 6:23:04 PM | Computer Name = Bastion | Source = WinMgmt | ID = 10
Description =

Error - 7/9/2012 6:01:48 PM | Computer Name = Bastion | Source = WinMgmt | ID = 10
Description =

[ Hewlett-Packard Events ]
Error - 7/3/2012 6:08:42 AM | Computer Name = Bastion | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088 at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Message: One HP Active Check Local Mode job already running. StackTrace:
at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Source: HP.ActiveCheckLocalMode.SessionManager Name: hpsa_service.exe
Version:
06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
en-US RAM: 3689 Ram Utilization: 70 TargetSite: Void UpdateAndDetect()

Error - 7/6/2012 12:03:09 PM | Computer Name = Bastion | Source = HPSF.exe | ID = 4000
Description =

Error - 7/10/2012 9:10:23 AM | Computer Name = Bastion | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088 at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Message: One HP Active Check Local Mode job already running. StackTrace:
at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Source: HP.ActiveCheckLocalMode.SessionManager Name: hpsa_service.exe
Version:
06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
en-US RAM: 3689 Ram Utilization: 50 TargetSite: Void UpdateAndDetect()

Error - 7/17/2012 7:38:02 AM | Computer Name = Bastion | Source = HPSF.exe | ID = 4000
Description =

Error - 7/17/2012 9:53:41 AM | Computer Name = Bastion | Source = HPSF.exe | ID = 4000
Description = HP Error ID: -2146233087HPSF.exe Server stack trace: at System.ServiceModel.Channels.ServiceChannel.Call(String
action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[]
outs, TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannel.Call(String
action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[]
outs) at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessag
e
methodCall, ProxyOperationRuntime operation) at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage
message) Exception rethrown at [0] Message: The server did not provide a meaningful
reply; this might be caused by a contract mismatch, a premature session shutdown
or an internal server error. StackTrace: Server stack trace: at System.ServiceModel.Channels.ServiceChannel.Call(String
action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[]
outs, TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannel.Call(String
action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[]
outs) at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessag
e
methodCall, ProxyOperationRuntime operation) at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage
message) Exception rethrown at [0]: at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage
reqMsg, IMessage retMsg) at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData&
msgData, Int32 type) at HP.SupportFramework.Communicator.MessengerComm.IMessengerCommunicator.UpdateTime
r()

at HP.SupportAssistant.UI.MessengerCommunication.sendTimerUpdate() Source: mscorlib

Name:
HPSF.exe Version: 06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
Framework\HPSF.exe Format: en-US RAM: 3689 Ram Utilization: 60 TargetSite: Void HandleReturnMessage(System.Runtime.Remoting.Messaging.IMessage,
System.Runtime.Remoting.Messaging.IMessage)

Error - 7/17/2012 9:54:04 AM | Computer Name = Bastion | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088 at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Message: One HP Active Check Local Mode job already running. StackTrace:
at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Source: HP.ActiveCheckLocalMode.SessionManager Name: hpsa_service.exe
Version:
06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
en-US RAM: 3689 Ram Utilization: 60 TargetSite: Void UpdateAndDetect()

Error - 7/17/2012 9:54:37 AM | Computer Name = Bastion | Source = HPSF.exe | ID = 4000
Description =

Error - 7/21/2012 10:12:20 AM | Computer Name = Bastion | Source = HPSF.exe | ID = 4000
Description =

Error - 7/21/2012 10:12:49 AM | Computer Name = Bastion | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088hpsa_service.exe at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Message: One HP Active Check Local Mode job already running. StackTrace:
at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Source: HP.ActiveCheckLocalMode.SessionManager Name: hpsa_service.exe
Version:
06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
en-US RAM: 3689 Ram Utilization: 60 TargetSite: Void UpdateAndDetect()

Error - 7/24/2012 7:32:01 PM | Computer Name = Bastion | Source = HPSF.exe | ID = 4000
Description =

[ HP Software Framework Events ]
Error - 4/16/2012 5:39:51 PM | Computer Name = Bastion | Source = CaslWmi | ID = 5
Description = 2012/04/16 14:39:51.065|00000508|Error |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state

Error - 4/16/2012 6:49:31 PM | Computer Name = Bastion | Source = CaslWmi | ID = 5
Description = 2012/04/16 15:49:31.813|000009AC|Error |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state

Error - 4/17/2012 11:48:49 PM | Computer Name = Bastion | Source = CaslWmi | ID = 5
Description = 2012/04/17 20:48:49.623|00001D14|Error |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state

Error - 4/17/2012 11:49:02 PM | Computer Name = Bastion | Source = CaslWmi | ID = 5
Description = 2012/04/17 20:49:02.228|00001150|Error |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state

Error - 4/25/2012 2:29:09 AM | Computer Name = Bastion | Source = CaslWmi | ID = 5
Description = 2012/04/24 23:29:09.936|00002464|Error |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state

Error - 4/25/2012 2:29:18 AM | Computer Name = Bastion | Source = CaslWmi | ID = 5
Description = 2012/04/24 23:29:18.110|00002018|Error |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state

Error - 5/1/2012 10:17:15 PM | Computer Name = Bastion | Source = CaslWmi | ID = 5
Description = 2012/05/01 19:17:15.642|00000758|Error |[CaslWmi]CommandPanelBrightness::GetCurrentPanelBrightnessFromOS{hpCasl.enRetur
nCode(CaslWmi.enPanelBrightnessDataType,ushort&)}|Exception
occurred in querying WMI for WmiMonitorBrightness: 'Not supported '

Error - 5/1/2012 10:17:17 PM | Computer Name = Bastion | Source = CaslWmi | ID = 5
Description = 2012/05/01 19:17:17.586|00000758|Error |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state

Error - 5/8/2012 11:01:13 PM | Computer Name = Bastion | Source = CaslWmi | ID = 5
Description = 2012/05/08 20:01:13.992|00015ED0|Error |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state

Error - 5/8/2012 11:01:21 PM | Computer Name = Bastion | Source = CaslWmi | ID = 5
Description = 2012/05/08 20:01:21.210|000161C8|Error |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state

[ System Events ]
Error - 6/25/2012 12:46:10 AM | Computer Name = Bastion | Source = Microsoft Antimalware | ID = 2004
Description = %%860 has encountered an error trying to load signatures and will
attempt reverting back to a known-good set of signatures. Signatures Attempted: %%824

Error
Code: 0x8050800d Error description: Some history items could not be displayed. Please
wait a few minutes and try again. If that doesn't work, clear the history and then
try again. Signature version: 1.129.379.0;1.129.379.0 Engine version: 1.1.8502.0

Error - 6/25/2012 12:48:23 AM | Computer Name = Bastion | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the HPWMISVC service.

Error - 6/25/2012 12:48:38 AM | Computer Name = Bastion | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
cdrom

Error - 6/25/2012 12:49:45 AM | Computer Name = Bastion | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Steam
Client Service service to connect.

Error - 6/25/2012 12:49:45 AM | Computer Name = Bastion | Source = Service Control Manager | ID = 7000
Description = The Steam Client Service service failed to start due to the following
error: %%1053

Error - 6/25/2012 2:38:19 AM | Computer Name = Bastion | Source = EventLog | ID = 6008
Description = The previous system shutdown at 2:19:57 PM on ?6/?25/?2012 was unexpected.

Error - 6/25/2012 2:40:00 AM | Computer Name = Bastion | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the HPWMISVC service.

Error - 6/25/2012 2:40:00 AM | Computer Name = Bastion | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
cdrom

Error - 6/26/2012 5:45:36 PM | Computer Name = Bastion | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the ShellHWDetection service.

Error - 6/27/2012 12:22:56 AM | Computer Name = Bastion | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the HPWMISVC service.


< End of report >