What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Browser Redirect and email links opening "IN PRIVATE" [Solve

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi,
I'm a figure-it-out-myself person, but after a full week of spinning my wheels this Browser redirect BEAT me!…
Just so that it is known… I've tried a zillion things unsupervised, and unsuccessful…
Things i've done: combofix (I've used it in the past with great success),bitdefender,ATF-Cleaner,TDSSKiller,MiniToolBox,Sophos,ASWMBR,RootkitBuster,antirootkit,rootkitre
mover,NPE, scanned with spybotSD, Maywarebytes, superantimalware,un- and re-installed both IE9 and lastest FF..
The only thing that seems to have worked was GooREDfix but it came back… so now you've heard everything I probably shouldn't have done…
I got nothing and need REAL help…

It has also affected my links in my emails… they open in "PRIVATE browsing"?

Regards,

Lasa

Here is my HiJackThis:


MSIE: Internet Explorer v9.00 (9.00.8112.16447)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\Program Files\CyberPower PowerPanel Personal Edition\pppeuser.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\ATT-SST\McciTrayApp.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\System32\rundll32.exe
C:\Users\FMA\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\taskhost.exe
C:\Users\FMA\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPCOM/1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
O4 - HKLM\..\Run: [NortonOnlineBackupReminder] "C:\Program Files\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [PowerPanel Personal Edition User Interaction] C:\Program Files\CyberPower PowerPanel Personal Edition\pppeuser.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [ATT-SST_McciTrayApp] "C:\Program Files\ATT-SST\McciTrayApp.exe"
O4 - HKLM\..\Run: [Bonus.SSR.FR11] "C:\Program Files\ABBYY FineReader 11\Bonus.ScreenshotReader.exe" /autorun
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [WonderSoft] RUNDLL32.EXE C:\Users\FMA\AppData\Local\WonderSoft\gsvcibuw.dll,GetImporterInterface
O4 - Startup: Dropbox.lnk = FMA\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Free YouTube Download - C:\Users\FMA\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\FMA\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} (SysInfo Class) - http://content.systemrequirementslab.com.s…tel_4.5.3.0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (file missing)
O23 - Service: ABBYY FineReader 11 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.11.0) - ABBYY - C:\Program Files\ABBYY FineReader 11\NetworkLicenseServer.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Acronis Nonstop Backup Service (afcdpsrv) - Acronis - C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
O23 - Service: FreemakeVideoCapture - Unknown owner - C:\Program Files\Freemake\CaptureLib\CaptureLibService.exe (file missing)
O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
O23 - Service: HP Quick Synchronization Service (HPDrvMntSvc.exe) - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McciServiceHost - Alcatel-Lucent - C:\Program Files\Common Files\Motive\McciServiceHost.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NitroPDFDriverCreatorReadSpool2 (NitroDriverReadSpool2) - Nitro PDF Software - C:\Program Files\Nitro PDF\Professional 7\NitroPDFDriverService2.exe
O23 - Service: pcCMService - Alcatel-Lucent - C:\Program Files\Common Files\Motive\pcCMService.exe
O23 - Service: PowerPanel Personal Edition Service (ppped) - Cyber Power Systems, Inc. - C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Samsung UPD Service - Samsung Electronics CO., LTD. - C:\Windows\System32\SUPDSvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Adobe SwitchBoard (SwitchBoard) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe

–
End of file - 11754 bytes
Post #2
Hi Lasa,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.


Ok…. now that you've ran every tool you've ever heard of… I need to try to figure out how much masking of the problem has been done.

Could you please post the logs from the tools that you ran?
Post #3
Hi Tomk, Hindsight being 20/20 I should have saved the results but… I deleted most everything off my system if it didn't seem to do anything. I've been updating and running the latest Malwarebytes in hope that as it gets updated it would find what I have…on this last update / run it found two things related to: WonderSoft\gsvcibuw.dll so I let it remove them. My pc has been working fine since, no redirects and no "in private" browsing from email links. The HJT I had attached earlier to my topic showed something about the WonderSoft\gsvcibuw.dll as well…. O4 - HKCU\..\Run: [WonderSoft] RUNDLL32.EXE C:\Users\FMA\AppData\Local\WonderSoft\gsvcibuw.dll,GetImporterInterface ————————————————- I found an earlier GooredFix…I had copied onto an email…see below..this was days before the malwarebytes WonderSoft find. GooredFix had found something called ZUGO…removed it as well. C:\Users\FMA\Application Data\Mozilla\Firefox\Profiles\x0z62shu.default\extensions\ [removed] [02:14 11/01/2011] {ACAA314B-EEBA-48e4-AD47-84E31C44796C} [02:18 11/01/2011] {bee6eb20-01e0-ebd1-da83-080329fb9a3a} [19:08 08/08/2012] It's been 3 days and I seem to be running right. Lasa
Post #4
OK… let's see a more detailed log.

  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Check the boxes beside LOP Check and Purity Check.
  • Under Custom Scan paste this in

    netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.
Post #5
OK heres the OTL.txt
———————————————————————

OTL logfile created on: 8/13/2012 4:58:41 PM - Run 1
OTL by OldTimer - Version 3.2.57.0 Folder = C:\Users\FMA\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.97 Gb Total Physical Memory | 1.78 Gb Available Physical Memory | 59.85% Memory free
5.93 Gb Paging File | 4.65 Gb Available in Paging File | 78.42% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 362.24 Gb Total Space | 235.34 Gb Free Space | 64.97% Space Free | Partition Type: NTFS
Drive D: | 3.86 Gb Total Space | 0.40 Gb Free Space | 10.28% Space Free | Partition Type: NTFS
Drive F: | 97.66 Gb Total Space | 97.56 Gb Free Space | 99.91% Space Free | Partition Type: NTFS

Computer Name: FMA-HP | User Name: FMA | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/08/13 16:51:47 | 000,596,992 | —- | M] (OldTimer Tools) – C:\Users\FMA\Desktop\OTL.exe
PRC - [2012/07/16 05:13:56 | 000,184,840 | —- | M] (Nitro PDF Software) – C:\Program Files\Nitro PDF\Professional 7\NitroPDFDriverService2.exe
PRC - [2012/07/06 05:56:56 | 000,361,472 | —- | M] (Alcatel-Lucent) – C:\Program Files\Common Files\Motive\pcCMService.exe
PRC - [2012/05/24 14:39:22 | 027,112,840 | —- | M] (Dropbox, Inc.) – C:\Users\FMA\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012/04/04 06:25:00 | 000,295,584 | —- | M] (Adobe Systems Incorporated) – C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
PRC - [2012/03/26 17:08:12 | 000,931,200 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2012/03/26 17:03:40 | 000,011,552 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2012/01/03 09:10:42 | 000,063,928 | —- | M] (Adobe Systems Incorporated) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/12/22 20:11:20 | 000,818,952 | —- | M] (ABBYY) – C:\Program Files\ABBYY FineReader 11\NetworkLicenseServer.exe
PRC - [2011/09/09 18:10:28 | 000,086,072 | —- | M] (Hewlett-Packard Company) – C:\Program Files\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
PRC - [2011/09/09 10:00:26 | 000,315,392 | —- | M] (Alcatel-Lucent) – C:\Program Files\Common Files\Motive\McciServiceHost.exe
PRC - [2011/06/06 14:23:18 | 005,429,624 | —- | M] (Wacom Technology, Corp.) – C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
PRC - [2011/06/06 14:23:18 | 001,460,088 | —- | M] (Wacom Technology, Corp.) – C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
PRC - [2011/03/28 18:07:50 | 000,094,264 | —- | M] (Hewlett-Packard Company) – C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
PRC - [2011/03/03 08:03:33 | 003,246,040 | —- | M] (Acronis) – C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
PRC - [2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2011/01/28 18:59:56 | 000,358,200 | —- | M] (Acronis) – C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
PRC - [2011/01/28 18:59:50 | 000,763,816 | —- | M] (Acronis) – C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
PRC - [2011/01/28 18:57:58 | 005,111,464 | —- | M] (Acronis) – C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
PRC - [2010/11/20 08:17:47 | 000,049,152 | —- | M] (Microsoft Corporation) – C:\Windows\System32\taskhost.exe
PRC - [2010/07/27 06:15:50 | 001,573,888 | —- | M] (Alcatel-Lucent) – C:\Program Files\ATT-SST\McciTrayApp.exe
PRC - [2010/04/16 17:12:16 | 000,918,976 | —- | M] (Cyber Power Systems, Inc.) – C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe
PRC - [2010/04/09 20:49:46 | 000,316,864 | —- | M] (Cyber Power Systems, Inc.) – C:\Program Files\CyberPower PowerPanel Personal Edition\pppeuser.exe
PRC - [2009/01/26 15:31:10 | 001,153,368 | —- | M] (Safer Networking Ltd.) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2006/10/30 10:00:00 | 001,116,920 | —- | M] (Roxio) – C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
PRC - [2003/10/13 17:24:14 | 001,732,608 | —- | M] (Adobe Sytems) – C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe


========== Modules (No Company Name) ==========

MOD - [2012/06/14 05:14:44 | 014,340,608 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e717a230496832656b05b515eb9f3bc5\PresentationFramework.ni.dll
MOD - [2012/06/14 05:14:30 | 012,436,480 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012/06/14 05:14:24 | 001,591,808 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012/06/14 05:14:12 | 012,237,824 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\14a87218ea49639f38097e278b98a3da\PresentationCore.ni.dll
MOD - [2012/05/12 03:31:50 | 001,051,136 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\9b2f17fb61b7197f2a04108f5d1a1cc6\System.Management.ni.dll
MOD - [2012/05/12 03:29:06 | 000,368,128 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8e56489276063ededde74e597a121df3\PresentationFramework.Aero.ni.dll
MOD - [2012/05/12 03:28:52 | 000,771,584 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012/05/12 03:28:51 | 006,611,456 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\f3814b488d9e083cbbc623e01b389f09\System.Data.ni.dll
MOD - [2012/05/12 03:28:20 | 000,185,344 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\d8af9a65cf0ed85d47360796e2645a06\UIAutomationTypes.ni.dll
MOD - [2012/05/12 03:28:20 | 000,060,928 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\ca2eff60beb3ba00a529a2d42dceca22\UIAutomationProvider.ni.dll
MOD - [2012/05/12 03:28:20 | 000,025,600 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\2ec98ab0193d64e95b7d09d094deed97\Accessibility.ni.dll
MOD - [2012/05/12 03:28:10 | 003,347,968 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012/05/12 03:28:05 | 005,452,800 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012/05/12 03:28:02 | 000,971,264 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012/05/12 03:28:01 | 007,967,232 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012/05/12 03:27:46 | 011,492,864 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2012/02/02 12:10:41 | 000,036,920 | —- | M] () – C:\Windows\assembly\GAC_MSIL\HP.ActiveSupportLibrary\2.0.0.1__01a974bc1760f423\HP.ActiveSupportLibrary.dll
MOD - [2011/11/08 16:46:02 | 000,093,696 | —- | M] () – C:\Program Files\FileZilla FTP Client\fzshellext.dll
MOD - [2011/06/06 14:23:18 | 000,962,936 | —- | M] () – C:\Program Files\Tablet\Wacom\libxml2.dll
MOD - [2011/01/28 19:23:44 | 000,279,904 | —- | M] () – C:\Program Files\Acronis\TrueImageHome\Common\resource.dll
MOD - [2011/01/28 18:04:34 | 000,028,512 | —- | M] () – C:\Program Files\Acronis\TrueImageHome\Common\rpc_client.dll
MOD - [2011/01/28 18:03:34 | 000,019,808 | —- | M] () – C:\Program Files\Acronis\TrueImageHome\Common\thread_pool.dll
MOD - [2010/11/04 21:58:05 | 002,927,616 | —- | M] () – C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2010/03/15 12:28:22 | 000,141,824 | —- | M] () – C:\Program Files\WinRAR\RarExt.dll
MOD - [2009/09/29 19:25:46 | 000,061,440 | —- | M] () – C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll
MOD - [2009/09/29 19:25:44 | 000,131,072 | —- | M] () – C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll
MOD - [2009/09/29 19:25:38 | 000,040,960 | —- | M] () – C:\Program Files\Hewlett-Packard\HP Advisor\MessagingServer.dll
MOD - [2009/09/29 19:25:38 | 000,036,864 | —- | M] () – C:\Program Files\Hewlett-Packard\HP Advisor\MessagingClients.dll
MOD - [2009/09/29 19:25:38 | 000,007,680 | —- | M] () – C:\Program Files\Hewlett-Packard\HP Advisor\RemotingClient.dll
MOD - [2009/09/29 19:25:36 | 000,005,632 | —- | M] () – C:\Program Files\Hewlett-Packard\HP Advisor\MessagingInterface.dll
MOD - [2009/09/29 19:25:28 | 000,018,944 | —- | M] () – C:\Program Files\Hewlett-Packard\HP Advisor\MessagingMessages.dll
MOD - [2009/09/29 19:25:18 | 000,028,672 | —- | M] () – C:\Program Files\Hewlett-Packard\HP Advisor\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll
MOD - [2008/02/22 11:22:32 | 000,055,792 | —- | M] () – C:\Windows\System32\DLAAPI_W.DLL


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Running] – C:\Program Files\Spybot – (SBSDWSCService)
SRV - File not found [Auto | Stopped] – C:\Program Files\Freemake\CaptureLib\CaptureLibService.exe – (FreemakeVideoCapture)
SRV - [2012/08/03 09:27:33 | 000,250,056 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/16 05:13:56 | 000,184,840 | —- | M] (Nitro PDF Software) [Auto | Running] – C:\Program Files\Nitro PDF\Professional 7\NitroPDFDriverService2.exe – (NitroDriverReadSpool2)
SRV - [2012/07/13 20:17:12 | 000,113,120 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2012/07/06 05:56:56 | 000,361,472 | —- | M] (Alcatel-Lucent) [Auto | Running] – C:\Program Files\Common Files\Motive\pcCMService.exe – (pcCMService)
SRV - [2012/03/26 17:03:40 | 000,214,952 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – c:\Program Files\Microsoft Security Client\NisSrv.exe – (NisSrv)
SRV - [2012/03/26 17:03:40 | 000,011,552 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\MsMpEng.exe – (MsMpSvc)
SRV - [2012/01/03 09:10:42 | 000,063,928 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe – (AdobeARMservice)
SRV - [2011/12/22 20:11:20 | 000,818,952 | —- | M] (ABBYY) [Auto | Running] – C:\Program Files\ABBYY FineReader 11\NetworkLicenseServer.exe – (ABBYY.Licensing.FineReader.Professional.11.0)
SRV - [2011/09/09 18:10:28 | 000,086,072 | —- | M] (Hewlett-Packard Company) [Auto | Running] – C:\Program Files\Hewlett-Packard\HP Support Framework\HPSA_Service.exe – (HP Support Assistant Service)
SRV - [2011/09/09 10:00:26 | 000,315,392 | —- | M] (Alcatel-Lucent) [Auto | Running] – C:\Program Files\Common Files\Motive\McciServiceHost.exe – (McciServiceHost)
SRV - [2011/06/06 14:23:18 | 005,429,624 | —- | M] (Wacom Technology, Corp.) [Auto | Running] – C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe – (TabletServiceWacom)
SRV - [2011/03/28 18:07:50 | 000,094,264 | —- | M] (Hewlett-Packard Company) [Auto | Running] – C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe – (HPDrvMntSvc.exe)
SRV - [2011/03/03 08:03:33 | 003,246,040 | —- | M] (Acronis) [Auto | Running] – C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe – (afcdpsrv)
SRV - [2011/01/28 18:59:50 | 000,763,816 | —- | M] (Acronis) [Auto | Running] – C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe – (AcrSch2Svc)
SRV - [2010/11/29 21:18:56 | 001,343,400 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\Wat\WatAdminSvc.exe – (WatAdminSvc)
SRV - [2010/08/08 22:04:02 | 000,131,888 | —- | M] (Samsung Electronics CO., LTD.) [On_Demand | Stopped] – C:\Windows\System32\SUPDSvc.exe – (Samsung UPD Service)
SRV - [2010/04/16 17:12:16 | 000,918,976 | —- | M] (Cyber Power Systems, Inc.) [Auto | Running] – C:\Program Files\CyberPower PowerPanel Personal Edition\ppped.exe – (ppped)
SRV - [2010/02/19 13:37:14 | 000,517,096 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe – (SwitchBoard)
SRV - [2009/07/13 21:16:15 | 000,016,384 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\StorSvc.dll – (StorSvc)
SRV - [2009/07/13 21:16:13 | 000,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sensrsvc.dll – (SensrSvc)
SRV - [2009/07/13 21:16:12 | 001,004,544 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\PeerDistSvc.dll – (PeerDistSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2004/10/22 04:24:18 | 000,073,728 | —- | M] (Macrovision Corporation) [On_Demand | Stopped] – C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe – (IDriverT)
SRV - [2003/10/13 17:24:14 | 000,061,440 | —- | M] (Adobe Sytems) [On_Demand | Stopped] – C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe – (AdobeVersionCue)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS – (MRENDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS – (MREMPR5)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\FMA\AppData\Local\Temp\mfe_rr.sys – (MFE_RR)
DRV - File not found [Adapter | On_Demand | Unknown] – – (Himpsrymm)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\FMA\AppData\Local\Temp\catchme.sys – (catchme)
DRV - [2012/03/20 20:44:12 | 000,074,112 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\NisDrvWFP.sys – (NisDrv)
DRV - [2011/09/09 10:00:28 | 000,021,248 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\Program Files\Common Files\Motive\MREMP50.sys – (MREMP50)
DRV - [2011/09/09 10:00:28 | 000,020,096 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Motive\MRESP50.sys – (MRESP50)
DRV - [2011/03/03 08:03:35 | 000,167,968 | —- | M] (Acronis) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\afcdp.sys – (afcdp)
DRV - [2011/03/03 08:03:31 | 000,752,128 | —- | M] (Acronis) [Kernel | Boot | Running] – C:\Windows\System32\drivers\tdrpm273.sys – (tdrpman273)
DRV - [2011/03/03 08:03:28 | 000,581,984 | —- | M] (Acronis) [Kernel | Boot | Running] – C:\Windows\System32\drivers\timntr.sys – (timounter)
DRV - [2011/03/03 08:03:20 | 000,170,464 | —- | M] (Acronis) [Kernel | Boot | Running] – C:\Windows\System32\drivers\snapman.sys – (snapman)
DRV - [2011/02/11 17:23:34 | 000,035,088 | —- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\npf.sys – (npf)
DRV - [2010/11/20 08:30:15 | 000,175,360 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\vmbus.sys – (vmbus)
DRV - [2010/11/20 08:30:15 | 000,040,704 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\vmstorfl.sys – (storflt)
DRV - [2010/11/20 08:30:15 | 000,028,032 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\storvsc.sys – (storvsc)
DRV - [2010/11/20 06:24:41 | 000,052,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV - [2010/11/20 05:14:45 | 000,017,920 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\VMBusHID.sys – (VMBusHID)
DRV - [2010/11/20 05:14:41 | 000,005,632 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\vms3cap.sys – (s3cap)
DRV - [2010/02/25 18:51:02 | 000,025,216 | —- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\tap0901.sys – (tap0901)
DRV - [2009/09/21 16:29:22 | 000,014,120 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacomvhid.sys – (wacomvhid)
DRV - [2009/07/13 19:45:33 | 000,083,456 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\serial.sys – (Serial)
DRV - [2009/07/13 18:09:17 | 004,194,816 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (atikmdag)
DRV - [2009/03/02 15:12:10 | 000,038,400 | —- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] – C:\Windows\System32\drivers\DGIVECP.SYS – (DgiVecp)
DRV - [2009/03/02 15:12:10 | 000,005,120 | —- | M] (Samsung Electronics) [Kernel | Auto | Running] – C:\Windows\System32\drivers\SSPORT.SYS – (SSPORT)
DRV - [2008/05/06 16:06:00 | 000,011,520 | —- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\wdcsam.sys – (WDC_SAM)
DRV - [2008/02/22 11:22:54 | 000,009,136 | —- | M] (Roxio) [File_System | Auto | Running] – C:\Windows\System32\DLA\DLADResM.SYS – (DLADResM)
DRV - [2008/02/22 11:22:38 | 000,094,384 | —- | M] (Roxio) [File_System | Auto | Running] – C:\Windows\System32\DLA\DLAUDFAM.SYS – (DLAUDFAM)
DRV - [2008/02/22 11:22:38 | 000,034,832 | —- | M] (Roxio) [File_System | Auto | Running] – C:\Windows\System32\DLA\DLABMFSM.SYS – (DLABMFSM)
DRV - [2008/02/22 11:22:36 | 000,097,584 | —- | M] (Roxio) [File_System | Auto | Running] – C:\Windows\System32\DLA\DLAUDF_M.SYS – (DLAUDF_M)
DRV - [2008/02/22 11:22:36 | 000,026,032 | —- | M] (Roxio) [File_System | Auto | Running] – C:\Windows\System32\DLA\DLAOPIOM.SYS – (DLAOPIOM)
DRV - [2008/02/22 11:22:34 | 000,032,208 | —- | M] (Roxio) [File_System | Auto | Running] – C:\Windows\System32\DLA\DLABOIOM.SYS – (DLABOIOM)
DRV - [2008/02/22 11:22:34 | 000,014,256 | —- | M] (Roxio) [File_System | Auto | Running] – C:\Windows\System32\DLA\DLAPoolM.SYS – (DLAPoolM)
DRV - [2008/02/22 11:22:32 | 000,104,240 | —- | M] (Roxio) [File_System | Auto | Running] – C:\Windows\System32\DLA\DLAIFS_M.SYS – (DLAIFS_M)
DRV - [2007/02/16 11:12:36 | 000,011,312 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacommousefilter.sys – (wacommousefilter)
DRV - [2007/02/08 21:05:30 | 000,028,120 | —- | M] (Roxio) [File_System | System | Running] – C:\Windows\System32\drivers\DLARTL_M.SYS – (DLARTL_M)
DRV - [2007/02/08 21:05:30 | 000,012,856 | —- | M] (Roxio) [File_System | System | Running] – C:\Windows\System32\drivers\DLACDBHM.SYS – (DLACDBHM)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPCOM/1
IE - HKLM\..\SearchScopes,DefaultScope = {112E0D50-CCFA-41F3-83DE-309FCC0A9C68}
IE - HKLM\..\SearchScopes\{112E0D50-CCFA-41F3-83DE-309FCC0A9C68}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\SearchScopes,DefaultScope = {1CFB4729-0EC5-4D41-A008-1CCEB61EEB12}
IE - HKCU\..\SearchScopes\{112E0D50-CCFA-41F3-83DE-309FCC0A9C68}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{1CFB4729-0EC5-4D41-A008-1CCEB61EEB12}: "URL" = http://www.google.com/search?q={searchTerm…age={startPage}
IE - HKCU\..\SearchScopes\{40419C19-01BD-D42C-3B25-A639D6F21B1C}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files\Nitro PDF\Professional 7\npnitromozilla.dll ( )
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.10: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\FMA\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\FMA\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/08/10 08:54:19 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2012/08/10 08:54:40 | 000,000,000 | —D | M] (No name found) – C:\Users\FMA\AppData\Roaming\Mozilla\Extensions
[2012/08/09 20:33:32 | 000,000,000 | —D | M] (No name found) – C:\Users\FMA\AppData\Roaming\Mozilla\SeaMonkey\Profiles\illv719f.default\extensions
[2012/08/10 08:54:19 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/10/09 19:52:06 | 000,014,597 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,008,359 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,007,116 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,005,640 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,009,360 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,427,314 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,427,977 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,410,115 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,400,488 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,424,557 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,427,447 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,433,790 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,392,706 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,455,298 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,408,616 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,424,256 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,433,028 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,458,383 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,459,356 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,439,257 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,446,888 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,017,628 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,006,203 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,678,864 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,007,380 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2011/10/09 19:52:06 | 000,017,429 | —- | M] () (No name found) – C:\USERS\FMA\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\KSDRIRK2.DEFAULT\EXTENSIONS\[removed]
[2012/07/13 20:17:47 | 000,136,672 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/07/13 20:16:36 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/07/13 20:16:36 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl;={language}&q;={searchTerms},
CHR - homepage: http://www.google.com/
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\FMA\AppData\Local\Google\Chrome\Application\20.0.1132.57\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\FMA\AppData\Local\Google\Chrome\Application\20.0.1132.57\gears.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\FMA\AppData\Local\Google\Chrome\Application\20.0.1132.57\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: NPCIG.dll (Enabled) = C:\Program Files\Canon\MyCamera Download Plugin\NPCIG.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Google Update (Enabled) = C:\Users\FMA\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Users\FMA\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\FMA\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Wajam = C:\Users\FMA\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.21_0\
CHR - Extension: Gmail = C:\Users\FMA\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/08/07 10:44:33 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {3E1201F4-1707-409F-BB45-A5F192381DA0} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe (Adobe Sytems)
O4 - HKLM..\Run: [ATT-SST_McciTrayApp] C:\Program Files\ATT-SST\McciTrayApp.exe (Alcatel-Lucent)
O4 - HKLM..\Run: [Bonus.SSR.FR11] C:\Program Files\ABBYY FineReader 11\Bonus.ScreenshotReader.exe (ABBYY.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files\Symantec\Norton Online Backup\Activation\NobuActivation.exe (Symantec Corporation)
O4 - HKLM..\Run: [PowerPanel Personal Edition User Interaction] C:\Program Files\CyberPower PowerPanel Personal Edition\pppeuser.exe (Cyber Power Systems, Inc.)
O4 - HKLM..\Run: [RoxioDragToDisc] C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe (Roxio)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - Startup: C:\Users\FMA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\FMA\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &ieSpell; Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html File not found
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html File not found
O8 - Extra context menu item: Check &Spelling; - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html File not found
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\FMA\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\FMA\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra Button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll ()
O9 - Extra 'Tools' menuitem : Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll ()
O9 - Extra Button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm ()
O9 - Extra 'Tools' menuitem : Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm ()
O15 - HKCU\..Trusted Domains: $talisma_url$ ([]https in Trusted sites)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} http://content.systemrequirementslab.com.s…tel_4.5.3.0.cab (SysInfo Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5CB05E7A-7E74-43EB-BEF3-0A362EF12521}: DhcpNameServer = 192.168.1.254 192.168.1.254
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - File not found
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/08/13 16:51:47 | 000,596,992 | —- | C] (OldTimer Tools) – C:\Users\FMA\Desktop\OTL.exe
[2012/08/13 06:59:22 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{7248F327-8329-439C-B2A2-197EE6E0BFE8}
[2012/08/13 06:59:01 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{8D7D087D-5889-48E7-B8C4-DEA8D0ADBF4D}
[2012/08/12 18:36:58 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{579DE13B-1E8B-4521-9B51-078BE7229682}
[2012/08/12 18:36:36 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{227E8887-0AE9-4519-BB01-00CA21FEC52C}
[2012/08/12 06:36:11 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{272CD36F-8461-4201-AB95-58A1844ECA7C}
[2012/08/12 06:35:49 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{7AACE3C5-BA92-48F4-9380-31F4569AC687}
[2012/08/11 18:35:20 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{274AEC7B-CE67-400A-BB1B-D49F032BE63C}
[2012/08/11 18:34:58 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{057516BB-7FBE-4201-9027-604B4183662B}
[2012/08/11 06:34:33 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{14370330-0818-4E24-B06E-9027D0B4E9C6}
[2012/08/11 06:34:11 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{F25B9F43-90FB-4446-BEB2-0095B07C0F87}
[2012/08/10 18:33:47 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{AB95C19C-10A4-423A-A0CD-6935A46911DA}
[2012/08/10 18:33:25 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{EE2175AD-C0F4-43E4-A32C-BB0CE13E3036}
[2012/08/10 15:10:22 | 000,000,000 | —D | C] – C:\ProgramData\Sophos
[2012/08/10 15:09:37 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sophos
[2012/08/10 15:09:31 | 000,000,000 | —D | C] – C:\Program Files\Sophos
[2012/08/10 09:41:37 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\FMA\Desktop\HijackThis.exe
[2012/08/10 08:54:21 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service
[2012/08/10 08:54:18 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2012/08/10 06:32:59 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{7C0AB839-1A23-4A57-AC18-32D95A2C5525}
[2012/08/10 06:32:49 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{235DA8BF-8ED7-48C7-B433-7E8BB68AAB30}
[2012/08/09 20:33:25 | 000,000,000 | —D | C] – C:\Program Files\SeaMonkey
[2012/08/09 19:16:57 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\WebPage
[2012/08/09 19:16:57 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Roaming\Trellian
[2012/08/09 19:16:41 | 000,000,000 | —D | C] – C:\Users\FMA\Documents\SEO Toolkit
[2012/08/09 19:16:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trellian WebPage
[2012/08/09 19:16:35 | 000,512,000 | —- | C] (WebSupergoo) – C:\Windows\System32\Achroma2.dll
[2012/08/09 19:16:33 | 000,000,000 | —D | C] – C:\Program Files\Trellian
[2012/08/09 17:54:27 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\Adobe
[2012/08/09 14:23:04 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{B7E8D3FF-0488-471A-9F1F-6BDDD62B8F43}
[2012/08/09 14:22:43 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{32B80D55-6000-45D8-8358-9DDA903658E7}
[2012/08/09 08:17:30 | 000,000,000 | —D | C] – C:\Users\FMA\Desktop\GooredFix Backups
[2012/08/08 21:09:56 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{87C507AB-6C54-4356-A9F6-F568F471392F}
[2012/08/08 21:09:34 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{85EE95F0-A16E-4247-947A-0C5C65FB68E1}
[2012/08/08 16:00:16 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Roaming\ieSpell
[2012/08/08 12:57:30 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Roaming\Ad-Aware Antivirus
[2012/08/08 09:09:08 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{296FE2D8-0D70-4857-8865-D20435616396}
[2012/08/08 09:08:45 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{9E2C76D1-A3C2-4595-BF9B-92CBE1B91B64}
[2012/08/08 07:49:46 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Roaming\BitDefender
[2012/08/08 07:49:32 | 000,000,000 | —D | C] – C:\ProgramData\BitDefender
[2012/08/08 07:49:32 | 000,000,000 | —D | C] – C:\Program Files\BitDefender
[2012/08/08 07:48:16 | 000,000,000 | —D | C] – C:\Program Files\Common Files\BitDefender
[2012/08/07 21:08:19 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{1E9D3776-DE06-4AD9-B5E6-75B1A2EFC952}
[2012/08/07 21:08:09 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{4E568AEC-CBBB-4DE4-A25E-0F0C8EDDD9C3}
[2012/08/07 19:11:53 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/08/07 19:11:28 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/08/07 11:21:59 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2012/08/07 10:46:51 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\temp
[2012/08/07 10:24:25 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/08/07 10:24:25 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/08/07 10:24:25 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/08/07 09:07:38 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{885A5F06-AF5F-467E-B1EC-F3AD9BA3327A}
[2012/08/07 09:07:14 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{9CB41EAD-050B-4C9C-8C8B-BD75D0337AFF}
[2012/08/07 08:15:39 | 000,000,000 | —D | C] – C:\Users\FMA\Pavark
[2012/08/06 18:14:54 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{5E4FFFB8-CE7E-4B41-AA30-ADD4AE3DD226}
[2012/08/06 18:14:32 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{AFEB78D2-EF97-446A-8B67-1AB3914D37C7}
[2012/08/06 13:19:43 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2012/08/06 13:19:43 | 000,162,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msrating.dll
[2012/08/06 13:19:43 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msls31.dll
[2012/08/06 13:19:43 | 000,130,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieakeng.dll
[2012/08/06 13:19:43 | 000,110,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\IEAdvpack.dll
[2012/08/06 13:19:43 | 000,086,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2012/08/06 13:19:43 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SetIEInstalledDate.exe
[2012/08/06 13:19:43 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RegisterIEPKEYs.exe
[2012/08/06 13:19:43 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2012/08/06 13:19:43 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtmler.dll
[2012/08/06 13:19:43 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2012/08/06 13:19:43 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2012/08/06 13:19:42 | 003,695,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dat
[2012/08/06 13:19:42 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2012/08/06 13:19:42 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2012/08/06 13:19:42 | 000,580,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2012/08/06 13:19:42 | 000,434,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dll
[2012/08/06 13:19:42 | 000,367,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2012/08/06 13:19:42 | 000,353,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxtmsft.dll
[2012/08/06 13:19:42 | 000,353,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2012/08/06 13:19:42 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2012/08/06 13:19:42 | 000,223,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxtrans.dll
[2012/08/06 13:19:42 | 000,152,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wextract.exe
[2012/08/06 13:19:42 | 000,150,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iexpress.exe
[2012/08/06 13:19:42 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2012/08/06 13:19:42 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inseng.dll
[2012/08/06 13:19:42 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2012/08/06 13:19:42 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2012/08/06 13:19:42 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2012/08/06 13:19:42 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2012/08/06 13:19:41 | 001,800,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2012/08/06 13:19:41 | 000,227,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieaksie.dll
[2012/08/06 13:19:41 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieakui.dll
[2012/08/06 13:19:41 | 000,118,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2012/08/06 13:19:41 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\admparse.dll
[2012/08/06 13:19:41 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pngfilt.dll
[2012/08/06 13:19:41 | 000,035,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\imgutil.dll
[2012/08/06 11:54:23 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Client
[2012/08/06 06:46:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012/08/06 06:46:06 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2012/08/06 06:46:06 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2012/08/06 06:13:55 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{2313E7F9-31C0-48B3-B643-16349D55DE97}
[2012/08/06 06:13:44 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{DB484BBD-78B4-4662-A884-4DFF61F55074}
[2012/08/05 06:19:32 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{60A48754-BDF2-4A20-9415-03B731A7826E}
[2012/08/05 06:19:10 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{A78A8C23-0207-43A1-83FA-8ADFD83E9A73}
[2012/08/04 09:08:12 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{B5208DAE-EB90-4994-9C89-E8483DC4F3BB}
[2012/08/04 09:08:02 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{B25C7D7E-CFAD-4AEB-8868-33B479546C65}
[2012/08/04 06:55:45 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2012/08/04 06:55:15 | 000,000,000 | —D | C] – C:\Program Files\Oracle
[2012/08/04 06:54:49 | 000,772,544 | —- | C] (Oracle Corporation) – C:\Windows\System32\npDeployJava1.dll
[2012/08/04 06:54:49 | 000,227,760 | —- | C] (Oracle Corporation) – C:\Windows\System32\javaws.exe
[2012/08/04 06:54:40 | 000,174,064 | —- | C] (Oracle Corporation) – C:\Windows\System32\javaw.exe
[2012/08/04 06:54:40 | 000,174,064 | —- | C] (Oracle Corporation) – C:\Windows\System32\java.exe
[2012/08/03 20:07:50 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{D1FDD9D9-9D54-4DE0-81F6-1ED53984A9BF}
[2012/08/03 20:07:28 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{43F345CE-A431-45B8-8064-C45829D4D496}
[2012/08/03 19:20:10 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\WonderSoft
[2012/08/03 08:07:03 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{816432A2-5D3A-4F6D-93CA-595C67B33462}
[2012/08/03 08:06:41 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{D5CC4D00-F106-41BE-846C-31F514323D7A}
[2012/08/02 18:51:58 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{5B87C639-6595-4A4D-98F2-CC799748AE63}
[2012/08/02 18:51:36 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{F0C391F8-22EC-45AF-A290-54141F20B5D5}
[2012/08/02 06:51:11 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{109E0588-FEA1-4615-BC5F-2FBE10DE1B8C}
[2012/08/02 06:51:00 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{4EACEEAB-DDC3-48DF-A699-17DC96E9195D}
[2012/08/01 19:52:31 | 000,000,000 | –SD | C] – C:\Users\FMA\Documents\My Data Sources
[2012/08/01 12:41:21 | 000,000,000 | —D | C] – C:\Users\FMA\Desktop\SampleData
[2012/08/01 11:26:39 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{1F6DFD6F-9943-441C-BC24-E906CA925EDE}
[2012/08/01 11:26:29 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{6326281C-C859-4B01-A3E5-3494816E4E34}
[2012/08/01 07:00:29 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\FileMaker
[2012/08/01 06:54:25 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Roaming\Leadertech
[2012/08/01 06:54:10 | 000,000,000 | —D | C] – C:\ProgramData\FileMaker
[2012/08/01 06:53:29 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Roaming\FileMaker
[2012/08/01 06:53:29 | 000,000,000 | —D | C] – C:\Program Files\FileMaker
[2012/08/01 06:20:24 | 000,000,000 | —D | C] – C:\ProgramData\DBOData
[2012/08/01 06:20:19 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\MKF_Solutions
[2012/08/01 06:20:13 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Database Oasis
[2012/08/01 06:20:08 | 000,000,000 | —D | C] – C:\Program Files\Database Oasis
[2012/07/31 23:26:04 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{ACB4294E-A206-452F-A9E3-6B7918AAE6E9}
[2012/07/31 23:25:42 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{5EFD4910-EF8E-4677-83D9-0F08E667942B}
[2012/07/31 11:25:18 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{93F9FCFA-539F-4086-9BF7-CFB14730979E}
[2012/07/31 11:24:56 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{303E0E40-43D1-48BB-B7C7-BE3B5DB90BE3}
[2012/07/30 20:26:20 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{50064236-A4E0-473C-9098-8AACF1889A65}
[2012/07/30 14:26:31 | 000,000,000 | —D | C] – C:\Users\FMA\Desktop\acsshow-test
[2012/07/30 08:25:06 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{84965A07-98BA-4115-B7CE-A1B723C2675D}
[2012/07/30 08:24:43 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{93551238-6FF1-481C-9AAE-789D7E15460C}
[2012/07/29 19:45:21 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{A2C3D65C-DAB4-4777-B09D-F578D6C1C11E}
[2012/07/29 19:44:58 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{A1F380B3-B7B9-4BCE-A854-77EFAC2B4A77}
[2012/07/29 15:04:29 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\3D PageFlip for PowerPoint
[2012/07/29 15:04:19 | 000,000,000 | —D | C] – C:\Program Files\3D PageFlip for PowerPoint
[2012/07/29 14:11:07 | 000,000,000 | —D | C] – C:\Program Files\Kvisoft
[2012/07/29 09:20:01 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kvisoft
[2012/07/29 08:46:06 | 000,000,000 | —D | C] – C:\Users\FMA\Documents\Kvisoft
[2012/07/29 07:04:45 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{112A35A9-AB66-429B-A9F0-9BB87FC6E054}
[2012/07/29 07:04:22 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{594D8B49-CE0B-4766-91DC-690654B54A23}
[2012/07/28 19:03:56 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{A2B14645-BF24-4A82-83BA-DB6F1538F151}
[2012/07/28 19:03:33 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{9F80E477-7A14-46AA-931D-FBEA7F8E20DC}
[2012/07/28 15:28:58 | 000,000,000 | —D | C] – C:\Users\FMA\Desktop\finethreshold
[2012/07/28 07:03:07 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{B70EFB43-9EC1-4FA1-B6C1-7465084A4A42}
[2012/07/28 07:02:44 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{1ED81DDB-E0E6-4800-88FA-93E98CED032C}
[2012/07/27 19:02:18 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{7CAE83AB-E9D2-4931-86A7-0451739515BF}
[2012/07/27 19:01:56 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{BC4A059F-EFD7-4BD5-95E7-D79B79DD8C20}
[2012/07/27 09:24:25 | 000,000,000 | R–D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wacom Tablet
[2012/07/27 09:02:01 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\WOWSlider.com
[2012/07/27 07:01:30 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{9E1EEFF0-787F-4137-B98F-143110F17B57}
[2012/07/27 07:01:06 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{82514F2C-FEE2-423D-8E87-6B2035E19F48}
[2012/07/26 19:00:40 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{430111FD-4107-462A-AC5C-A6B8627130B9}
[2012/07/26 19:00:17 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{1CEBFCF9-64B5-4DDE-8FA7-053B170FB0AE}
[2012/07/26 07:00:04 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{D90000CF-42A8-44CD-9348-C68BFC818FE4}
[2012/07/26 06:59:41 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{B4A6BA8F-C544-4B14-93AA-1C13F495B2D1}
[2012/07/25 18:59:15 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{551EFA1B-5728-4049-A5BA-4CD38E8F7ABC}
[2012/07/25 18:58:53 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{8BAD9BA5-64A5-4BB4-9AD6-C049110DB8AD}
[2012/07/25 13:04:44 | 000,000,000 | —D | C] – C:\ProgramData\fptffb
[2012/07/25 12:54:26 | 000,000,000 | —D | C] – C:\ProgramData\flippagemaker
[2012/07/25 12:54:26 | 000,000,000 | —D | C] – C:\ProgramData\A-PDF
[2012/07/25 12:54:01 | 000,000,000 | —D | C] – C:\ProgramData\flipBook
[2012/07/25 06:58:27 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{875D4AC2-EB67-45E7-AE43-C28E0F7B0E0D}
[2012/07/25 06:58:04 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{99BDE0A9-F928-43EB-88CA-6CED84458DCE}
[2012/07/24 13:34:15 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{7402CF96-6E7E-4D77-B2C2-6F4D4B076905}
[2012/07/24 13:33:52 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{2483A079-850E-46EC-A0D6-9ABD8F124A64}
[2012/07/23 19:49:52 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{04224CB0-F9C5-405C-A60D-61C1AFB014C4}
[2012/07/23 19:49:29 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{32F0DA1D-650D-4348-82A1-DE22E6D04A1A}
[2012/07/23 07:49:16 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{53DAE278-292F-4791-96C5-124870C702D9}
[2012/07/23 07:48:53 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{9F8361BB-1C26-438D-A09D-C08C84868128}
[2012/07/22 19:48:27 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{33D0A000-98F1-4C76-AF38-EF0E9C3FB132}
[2012/07/22 19:48:04 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{FD965C68-0975-468E-97FB-7FA515A04341}
[2012/07/22 07:47:51 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{8DBC968F-9C9E-4849-A605-125097477933}
[2012/07/22 07:47:28 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{402C62EC-20DA-43C3-AEC2-E226B53EB8A3}
[2012/07/21 19:47:02 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{C3BF8980-0646-4300-ADF9-D4BC3ACD7F36}
[2012/07/21 19:46:40 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{6980A2E9-C451-4A09-99EC-551AE7CA6938}
[2012/07/21 07:46:14 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{F6F04298-6342-4078-B77F-2A304087C47D}
[2012/07/21 07:45:51 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{146676E9-7711-47F2-ACFC-BE9B0AC6BEDC}
[2012/07/20 19:45:25 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{647AEF39-A8FB-41A9-86C9-329397F7FA88}
[2012/07/20 19:45:02 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{23ABB1A7-BD60-4C3E-9E1D-250F4C8BB298}
[2012/07/20 07:56:33 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Roaming\Nitro PDF
[2012/07/20 07:53:01 | 000,027,144 | —- | C] (Nitro PDF Software) – C:\Windows\System32\nitrolocalmon2.dll
[2012/07/20 07:53:01 | 000,018,440 | —- | C] (Nitro PDF Software) – C:\Windows\System32\nitrolocalui2.dll
[2012/07/20 07:52:41 | 000,000,000 | —D | C] – C:\ProgramData\Nitro PDF
[2012/07/20 07:52:41 | 000,000,000 | —D | C] – C:\Program Files\Nitro PDF
[2012/07/20 07:52:41 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Nitro PDF
[2012/07/20 07:51:50 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Roaming\Downloaded Installations
[2012/07/20 07:51:23 | 000,000,000 | —D | C] – C:\Users\FMA\Desktop\nbnghyt_x86
[2012/07/20 07:44:49 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{0F0A0324-AB1F-4AE9-9DBC-A669C9A22AEE}
[2012/07/20 07:44:26 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{9DFBD157-615B-4CAD-84E0-889A4EFA2FF3}
[2012/07/20 07:42:06 | 000,000,000 | —D | C] – C:\Users\FMA\Desktop\amtlib
[2012/07/19 19:44:01 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{975ED040-E707-43F7-AC95-1895EB6325B7}
[2012/07/19 19:43:39 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{F3C6C843-FEC2-4F0A-84ED-F65C65BAF082}
[2012/07/19 15:38:04 | 000,000,000 | —D | C] – C:\Users\FMA\Desktop\Frankie model
[2012/07/19 11:10:58 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Roaming\IrfanView
[2012/07/19 11:10:57 | 000,000,000 | —D | C] – C:\Program Files\IrfanView
[2012/07/19 10:39:06 | 000,000,000 | —D | C] – C:\Users\FMA\Desktop\BG-stuff
[2012/07/19 07:43:25 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{CE54AC92-CE55-4784-B42E-C747BC653786}
[2012/07/19 07:43:02 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{23122C80-2112-4C4D-A681-E14999A5A5F9}
[2012/07/18 19:42:35 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{81E48203-2351-473C-907A-7DEB2E0B0A49}
[2012/07/18 19:42:12 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{F7AF1386-5400-4595-BDBB-C0A7A7D8DB25}
[2012/07/18 07:41:59 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{5BEA63A4-882A-4C2A-A883-17AAC0D20644}
[2012/07/18 07:41:36 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{AB31AE7D-E141-4ABB-A560-DCF831BB70FF}
[2012/07/17 19:41:10 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{71CBF6AC-E2A1-4960-A834-B4F22C2AB957}
[2012/07/17 19:40:47 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{DE07B435-91C9-4732-B8A4-6EA8762E286A}
[2012/07/17 07:40:21 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{A48AEE2A-77C5-48D7-93D3-214F2D3F9E0C}
[2012/07/17 07:39:58 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{04E8F6C0-9FFE-4E05-822B-22948BC9D4A8}
[2012/07/16 19:39:32 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{316BE6A3-D32A-4983-92DE-3FCBE5AB7065}
[2012/07/16 19:39:10 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{27E2985D-B1BB-4A15-B63D-BA21FE98D9E2}
[2012/07/16 07:38:56 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{0BAC505C-6C8F-451A-90D2-CE6AF7643978}
[2012/07/16 07:38:34 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{701381AC-6369-4AA0-A3CA-F58BFF89BA57}
[2012/07/15 21:12:46 | 000,000,000 | —D | C] – C:\Program Files\MSECache
[2012/07/15 19:38:08 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{3B57D9FE-4062-4099-A4D7-BAE129F2998E}
[2012/07/15 19:37:45 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{A5888738-67B9-4C7F-B222-1C52BBDDEAFA}
[2012/07/15 07:37:19 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{0FE226A0-235B-401A-9A06-0AE1D42EB3A8}
[2012/07/15 07:36:57 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{C64DC56B-530D-4CED-9744-BD820CB32BD0}

========== Files - Modified Within 30 Days ==========

[2012/08/13 16:51:47 | 000,596,992 | —- | M] (OldTimer Tools) – C:\Users\FMA\Desktop\OTL.exe
[2012/08/13 16:27:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/13 16:16:00 | 000,000,900 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2824507079-1246889368-3507066619-1000UA.job
[2012/08/13 07:16:00 | 000,000,848 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2824507079-1246889368-3507066619-1000Core.job
[2012/08/13 06:02:34 | 000,009,920 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/13 06:02:34 | 000,009,920 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/13 05:55:13 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/08/13 05:55:09 | 2388,582,400 | -HS- | M] () – C:\hiberfil.sys
[2012/08/12 14:58:49 | 000,006,129 | —- | M] () – C:\Users\FMA\Desktop\wow.png
[2012/08/11 18:00:00 | 000,001,456 | —- | M] () – C:\Users\FMA\AppData\Local\Adobe Save for Web 13.0 Prefs
[2012/08/11 08:18:58 | 001,663,074 | —- | M] () – C:\Users\FMA\Desktop\site-under-construction.zip
[2012/08/10 09:41:37 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\FMA\Desktop\HijackThis.exe
[2012/08/10 08:54:24 | 000,001,094 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/08/09 08:29:30 | 003,928,808 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/08/09 06:46:58 | 000,000,312 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForFMA.job
[2012/08/08 16:41:59 | 000,000,008 | RHS- | M] () – C:\ProgramData\ntuser.pol
[2012/08/08 15:42:31 | 000,000,973 | —- | M] () – C:\Users\Public\Desktop\Antenna.lnk
[2012/08/08 15:17:58 | 000,002,445 | —- | M] () – C:\Users\FMA\Desktop\Google Chrome.lnk
[2012/08/08 12:59:56 | 000,081,984 | —- | M] () – C:\Windows\System32\bdod.bin
[2012/08/07 10:44:33 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2012/08/06 13:19:43 | 000,176,640 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2012/08/06 13:19:43 | 000,162,304 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msrating.dll
[2012/08/06 13:19:43 | 000,161,792 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msls31.dll
[2012/08/06 13:19:43 | 000,130,560 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieakeng.dll
[2012/08/06 13:19:43 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\Windows\System32\IEAdvpack.dll
[2012/08/06 13:19:43 | 000,086,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2012/08/06 13:19:43 | 000,076,800 | —- | M] (Microsoft Corporation) – C:\Windows\System32\SetIEInstalledDate.exe
[2012/08/06 13:19:43 | 000,074,752 | —- | M] (Microsoft Corporation) – C:\Windows\System32\RegisterIEPKEYs.exe
[2012/08/06 13:19:43 | 000,065,024 | —- | M] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2012/08/06 13:19:43 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mshtmler.dll
[2012/08/06 13:19:43 | 000,041,472 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2012/08/06 13:19:43 | 000,010,752 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2012/08/06 13:19:42 | 003,695,416 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dat
[2012/08/06 13:19:42 | 002,382,848 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2012/08/06 13:19:42 | 001,427,968 | —- | M] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2012/08/06 13:19:42 | 000,580,608 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2012/08/06 13:19:42 | 000,434,176 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dll
[2012/08/06 13:19:42 | 000,367,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2012/08/06 13:19:42 | 000,353,792 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dxtmsft.dll
[2012/08/06 13:19:42 | 000,353,584 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2012/08/06 13:19:42 | 000,231,936 | —- | M] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2012/08/06 13:19:42 | 000,223,232 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dxtrans.dll
[2012/08/06 13:19:42 | 000,152,064 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wextract.exe
[2012/08/06 13:19:42 | 000,150,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iexpress.exe
[2012/08/06 13:19:42 | 000,142,848 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2012/08/06 13:19:42 | 000,078,848 | —- | M] (Microsoft Corporation) – C:\Windows\System32\inseng.dll
[2012/08/06 13:19:42 | 000,074,752 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2012/08/06 13:19:42 | 000,074,240 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2012/08/06 13:19:42 | 000,072,822 | —- | M] () – C:\Windows\System32\ieuinit.inf
[2012/08/06 13:19:42 | 000,031,744 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2012/08/06 13:19:42 | 000,023,552 | —- | M] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2012/08/06 13:19:41 | 001,800,192 | —- | M] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2012/08/06 13:19:41 | 000,227,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieaksie.dll
[2012/08/06 13:19:41 | 000,163,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieakui.dll
[2012/08/06 13:19:41 | 000,118,784 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2012/08/06 13:19:41 | 000,101,888 | —- | M] (Microsoft Corporation) – C:\Windows\System32\admparse.dll
[2012/08/06 13:19:41 | 000,054,272 | —- | M] (Microsoft Corporation) – C:\Windows\System32\pngfilt.dll
[2012/08/06 13:19:41 | 000,035,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\imgutil.dll
[2012/08/06 13:06:30 | 000,000,134 | —- | M] () – C:\Users\FMA\Desktop\Internet Explorer Troubleshooting.url
[2012/08/06 11:54:46 | 000,001,945 | —- | M] () – C:\Windows\epplauncher.mif
[2012/08/06 11:54:27 | 000,626,290 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/08/06 11:54:27 | 000,107,566 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/08/06 06:46:22 | 000,001,222 | —- | M] () – C:\Users\FMA\Desktop\Spybot - Search & Destroy.lnk
[2012/08/04 06:54:30 | 000,174,064 | —- | M] (Oracle Corporation) – C:\Windows\System32\javaw.exe
[2012/08/04 06:54:30 | 000,174,064 | —- | M] (Oracle Corporation) – C:\Windows\System32\java.exe
[2012/08/03 09:27:33 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2012/08/03 09:27:33 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/08/01 12:40:51 | 000,009,811 | —- | M] () – C:\Users\FMA\Desktop\SampleData.zip
[2012/08/01 06:54:07 | 000,001,404 | —- | M] () – C:\Users\Public\Desktop\FileMaker Pro Advanced.lnk
[2012/08/01 06:20:13 | 000,003,015 | —- | M] () – C:\Users\FMA\Desktop\Database Oasis.lnk
[2012/07/27 15:19:36 | 000,000,080 | —- | M] () – C:\Users\FMA\AppData\Roaming\MultiFill Prefs
[2012/07/22 13:23:59 | 000,000,539 | —- | M] () – C:\Users\FMA\Desktop\The Open Championship - TheOpen LIVE.website
[2012/07/19 11:01:37 | 000,690,966 | —- | M] () – C:\Users\FMA\Desktop\BG-stuff.zip
[2012/07/18 13:40:05 | 000,108,202 | —- | M] () – C:\Users\FMA\Desktop\checkbox2textarea.zip
[2012/07/17 19:54:31 | 000,007,201 | —- | M] () – C:\Users\FMA\Desktop\form.zip
[2012/07/17 16:25:52 | 000,000,132 | —- | M] () – C:\Users\FMA\AppData\Roaming\Adobe PNG Format CS6 Prefs
[2012/07/17 16:16:06 | 000,000,132 | —- | M] () – C:\Users\FMA\AppData\Roaming\Adobe IllExport Filter CS6 Prefs
[2012/07/17 07:18:40 | 000,007,086 | —- | M] () – C:\Users\FMA\Desktop\F5.jpg
[2012/07/16 12:43:53 | 000,838,656 | —- | M] () – C:\Users\FMA\AppData\Roaming\SharedSettings.ccs
[2012/07/16 05:13:16 | 000,027,144 | —- | M] (Nitro PDF Software) – C:\Windows\System32\nitrolocalmon2.dll
[2012/07/16 05:13:16 | 000,018,440 | —- | M] (Nitro PDF Software) – C:\Windows\System32\nitrolocalui2.dll
[2012/07/15 10:37:56 | 000,001,329 | —- | M] () – C:\Users\FMA\Desktop\Antenna - Shortcut (2).lnk
[2012/07/15 10:36:40 | 000,001,265 | —- | M] () – C:\Users\FMA\Desktop\Angulo Websites - Shortcut.lnk
[2012/07/14 17:42:46 | 000,000,072 | —- | M] () – C:\ProgramData\-R2LlJOB4wyik9wr
[2012/07/14 17:42:46 | 000,000,072 | —- | M] () – C:\ProgramData\-R2LlJOB4wyik9w

========== Files Created - No Company Name ==========

[2012/08/12 14:58:49 | 000,006,129 | —- | C] () – C:\Users\FMA\Desktop\wow.png
[2012/08/11 08:18:57 | 001,663,074 | —- | C] () – C:\Users\FMA\Desktop\site-under-construction.zip
[2012/08/10 20:03:46 | 000,001,456 | —- | C] () – C:\Users\FMA\AppData\Local\Adobe Save for Web 13.0 Prefs
[2012/08/10 08:54:24 | 000,001,106 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/08/10 08:54:24 | 000,001,094 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/08/08 15:42:31 | 000,000,973 | —- | C] () – C:\Users\Public\Desktop\Antenna.lnk
[2012/08/08 11:22:04 | 000,081,984 | —- | C] () – C:\Windows\System32\bdod.bin
[2012/08/07 10:24:25 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/08/07 10:24:25 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/08/07 10:24:25 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/08/07 10:24:25 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/08/07 10:24:25 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/08/06 13:19:42 | 000,072,822 | —- | C] () – C:\Windows\System32\ieuinit.inf
[2012/08/06 13:00:38 | 000,000,134 | —- | C] () – C:\Users\FMA\Desktop\Internet Explorer Troubleshooting.url
[2012/08/06 11:54:31 | 000,001,917 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2012/08/06 06:46:21 | 000,001,222 | —- | C] () – C:\Users\FMA\Desktop\Spybot - Search & Destroy.lnk
[2012/08/01 12:41:17 | 000,009,811 | —- | C] () – C:\Users\FMA\Desktop\SampleData.zip
[2012/08/01 06:54:07 | 000,001,404 | —- | C] () – C:\Users\Public\Desktop\FileMaker Pro Advanced.lnk
[2012/08/01 06:53:59 | 000,002,717 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileMaker Pro Advanced.lnk
[2012/08/01 06:20:13 | 000,003,015 | —- | C] () – C:\Users\FMA\Desktop\Database Oasis.lnk
[2012/07/27 12:28:08 | 000,000,080 | —- | C] () – C:\Users\FMA\AppData\Roaming\MultiFill Prefs
[2012/07/25 12:59:52 | 000,364,955 | —- | C] () – C:\Users\FMA\Documents\book.swf
[2012/07/21 08:36:59 | 000,000,539 | —- | C] () – C:\Users\FMA\Desktop\The Open Championship - TheOpen LIVE.website
[2012/07/20 07:52:56 | 000,002,545 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nitro Pro 7.lnk
[2012/07/19 11:01:37 | 000,690,966 | —- | C] () – C:\Users\FMA\Desktop\BG-stuff.zip
[2012/07/18 13:40:04 | 000,108,202 | —- | C] () – C:\Users\FMA\Desktop\checkbox2textarea.zip
[2012/07/17 19:54:31 | 000,007,201 | —- | C] () – C:\Users\FMA\Desktop\form.zip
[2012/07/17 16:16:06 | 000,000,132 | —- | C] () – C:\Users\FMA\AppData\Roaming\Adobe IllExport Filter CS6 Prefs
[2012/07/17 07:18:39 | 000,007,086 | —- | C] () – C:\Users\FMA\Desktop\F5.jpg
[2012/07/16 08:16:59 | 000,002,543 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft PowerPoint Viewer .lnk
[2012/07/15 10:37:56 | 000,001,329 | —- | C] () – C:\Users\FMA\Desktop\Antenna - Shortcut (2).lnk
[2012/07/15 10:36:40 | 000,001,265 | —- | C] () – C:\Users\FMA\Desktop\Angulo Websites - Shortcut.lnk
[2012/07/14 17:42:46 | 000,000,072 | —- | C] () – C:\ProgramData\-R2LlJOB4wyik9wr
[2012/07/14 17:42:46 | 000,000,072 | —- | C] () – C:\ProgramData\-R2LlJOB4wyik9w
[2012/07/13 12:55:11 | 000,000,132 | —- | C] () – C:\Users\FMA\AppData\Roaming\Adobe GIF Format CS6 Prefs
[2012/07/12 07:26:33 | 000,000,036 | —- | C] () – C:\Users\FMA\AppData\Local\housecall.guid.cache
[2012/06/22 07:31:20 | 000,000,132 | —- | C] () – C:\Users\FMA\AppData\Roaming\Adobe PNG Format CS6 Prefs
[2012/03/25 14:37:01 | 000,012,466 | —- | C] () – C:\Users\FMA\index.htm
[2012/03/09 16:16:11 | 000,017,465 | —- | C] () – C:\Users\FMA\index.html
[2012/02/28 20:07:11 | 000,000,091 | —- | C] () – C:\Users\FMA\AppData\Local\fusioncache.dat
[2012/02/15 12:27:01 | 000,098,304 | —- | C] () – C:\Windows\System32\redmonnt.dll
[2012/01/19 21:31:34 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2012/01/19 21:31:34 | 000,000,000 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2011/12/31 11:39:39 | 000,001,744 | —- | C] () – C:\Users\FMA\nav-bkgd.png
[2011/12/31 11:39:29 | 000,041,436 | —- | C] () – C:\Users\FMA\untitled-1.jpg
[2011/12/31 11:39:20 | 000,004,658 | —- | C] () – C:\Users\FMA\divider02.png
[2011/12/31 11:25:03 | 000,011,800 | —- | C] () – C:\Users\FMA\safetyclip.atr
[2011/11/25 16:11:00 | 000,026,624 | —- | C] () – C:\Windows\System32\spd__l.dll
[2011/11/25 16:10:59 | 000,283,136 | —- | C] () – C:\Windows\System32\DscPnt.dll
[2011/11/25 16:10:59 | 000,259,888 | —- | C] () – C:\Windows\SUPDRun.exe
[2011/11/25 16:10:59 | 000,151,552 | —- | C] () – C:\Windows\System32\spd__ci.exe
[2011/11/05 17:28:56 | 000,001,027 | —- | C] () – C:\Users\FMA\button_reviews.gif
[2011/11/04 12:33:21 | 000,022,422 | —- | C] () – C:\Users\FMA\stylesheet.css
[2011/11/03 08:14:26 | 000,000,008 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2011/10/02 14:04:57 | 001,174,083 | —- | C] () – C:\Windows\unins000.exe
[2011/10/02 14:04:57 | 000,018,001 | —- | C] () – C:\Windows\unins000.dat
[2011/04/11 09:03:27 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2011/02/11 17:23:34 | 000,053,299 | —- | C] () – C:\Windows\System32\pthreadVC.dll
[2011/01/02 17:09:36 | 000,000,106 | -HS- | C] () – C:\Windows\WSYS049.SYS
[2010/12/11 13:17:15 | 000,838,656 | —- | C] () – C:\Users\FMA\AppData\Roaming\SharedSettings.ccs
[2010/12/11 13:16:57 | 000,000,208 | —- | C] () – C:\Windows\System32\xpysys.dll
[2010/11/30 16:37:51 | 000,007,598 | —- | C] () – C:\Users\FMA\AppData\Local\Resmon.ResmonCfg
[2010/11/30 06:49:35 | 000,016,384 | —- | C] () – C:\Windows\System32\FileOps.exe
[2010/11/29 19:11:47 | 000,073,728 | —- | C] () – C:\Windows\System32\RtNicProp32.dll
[2010/11/29 19:11:45 | 000,134,592 | —- | C] () – C:\Windows\System32\igfcg500.bin
[2010/11/29 19:04:21 | 000,055,792 | —- | C] () – C:\Windows\System32\DLAAPI_W.DLL
[2010/11/29 19:04:21 | 000,000,120 | —- | C] () – C:\Windows\wininit.ini
[2010/10/16 05:23:26 | 000,982,240 | —- | C] () – C:\Windows\System32\igkrng500.bin
[2010/10/16 05:23:26 | 000,439,308 | —- | C] () – C:\Windows\System32\igcompkrng500.bin
[2010/10/16 05:23:26 | 000,092,356 | —- | C] () – C:\Windows\System32\igfcg500m.bin
[2010/10/16 04:56:28 | 000,004,096 | —- | C] ( ) – C:\Windows\System32\IGFXDEVLib.dll
[2010/10/16 04:54:52 | 000,000,151 | —- | C] () – C:\Windows\System32\GfxUI.exe.config
[2010/10/16 04:51:56 | 000,208,896 | —- | C] () – C:\Windows\System32\iglhsip32.dll
[2010/10/16 04:51:56 | 000,143,360 | —- | C] () – C:\Windows\System32\iglhcp32.dll

========== LOP Check ==========

[2010/12/02 08:36:57 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Acronis
[2012/08/08 12:57:38 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Ad-Aware Antivirus
[2012/06/13 13:00:41 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Aimersoft Video Converter Pro
[2012/06/28 21:42:58 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Alien Skin
[2011/01/20 18:00:43 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Artisteer
[2012/08/08 07:49:46 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\BitDefender
[2012/07/15 07:10:28 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Canneverbe Limited
[2011/02/19 12:12:29 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/07/15 07:15:39 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\CoffeeCup Software
[2012/05/07 19:25:41 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2012/07/15 07:10:30 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Disruptive Innovations SARL
[2012/07/20 07:51:50 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Downloaded Installations
[2012/08/13 05:55:53 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Dropbox
[2012/05/19 19:03:41 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\DVDVideoSoft
[2012/05/17 10:49:38 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\DVDVideoSoftIEHelpers
[2012/07/15 07:15:39 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Easy Thumbnails
[2012/05/19 17:48:24 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\EasyHtml5Video.com
[2010/12/07 18:42:36 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\EPSON
[2012/08/01 06:53:29 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\FileMaker
[2012/07/16 15:11:08 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\FileZilla
[2011/01/10 22:17:11 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\HamsterSoft
[2012/07/15 07:15:39 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\IBP
[2012/08/08 16:00:16 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\ieSpell
[2012/06/21 21:02:14 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Imagenomic
[2012/04/03 20:21:47 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\imgmap.desktop.F68B91BC91DC8DBB721862DF996B29D3E5B3678D.1
[2012/07/19 11:10:58 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\IrfanView
[2012/07/15 07:15:39 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\KompoZer
[2012/08/01 06:54:25 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Leadertech
[2012/06/22 13:39:23 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Lucis
[2012/07/15 07:10:32 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\MAGIX
[2012/07/20 07:56:33 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Nitro PDF
[2012/07/15 07:10:46 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Opera
[2012/05/08 07:15:13 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\PDAppFlex
[2011/02/08 18:49:35 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\PGP
[2012/07/15 07:10:47 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\scriptocean
[2012/07/15 07:10:47 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\SimfaticForms
[2012/07/15 07:10:47 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Softland
[2012/05/08 07:17:59 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012/07/15 07:15:41 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Stormdance
[2011/03/21 10:20:57 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\SWiSH Max4
[2012/08/09 19:23:14 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Trellian
[2012/07/15 07:15:42 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\UBitMenu
[2011/09/26 14:52:16 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\WinBatch
[2010/11/30 16:46:35 | 000,000,000 | —D | M] – C:\Users\FMA\AppData\Roaming\Windows Live Writer
[2012/07/02 05:17:22 | 000,032,566 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/06/10 17:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/07/25 09:42:28 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2012/08/07 19:11:51 | 000,018,764 | —- | M] () – C:\ComboFix.txt
[2009/06/10 17:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.1028.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.1031.txt
[2007/11/07 09:00:40 | 000,010,134 | —- | M] () – C:\eula.1033.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.1036.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.1040.txt
[2007/11/07 09:00:40 | 000,000,118 | —- | M] () – C:\eula.1041.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.1042.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.2052.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.3082.txt
[2007/11/07 09:00:40 | 000,001,110 | —- | M] () – C:\globdata.ini
[2012/08/13 05:55:09 | 2388,582,400 | -HS- | M] () – C:\hiberfil.sys
[2007/11/07 09:00:40 | 000,000,843 | —- | M] () – C:\install.ini
[2007/11/07 09:03:18 | 000,076,304 | —- | M] (Microsoft Corporation) – C:\install.res.1028.dll
[2007/11/07 09:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.1031.dll
[2007/11/07 09:03:18 | 000,091,152 | —- | M] (Microsoft Corporation) – C:\install.res.1033.dll
[2007/11/07 09:03:18 | 000,097,296 | —- | M] (Microsoft Corporation) – C:\install.res.1036.dll
[2007/11/07 09:03:18 | 000,095,248 | —- | M] (Microsoft Corporation) – C:\install.res.1040.dll
[2007/11/07 09:03:18 | 000,081,424 | —- | M] (Microsoft Corporation) – C:\install.res.1041.dll
[2007/11/07 09:03:18 | 000,079,888 | —- | M] (Microsoft Corporation) – C:\install.res.1042.dll
[2007/11/07 09:03:18 | 000,075,792 | —- | M] (Microsoft Corporation) – C:\install.res.2052.dll
[2007/11/07 09:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.3082.dll
[2011/04/25 21:24:44 | 000,000,287 | —- | M] () – C:\InstallHelper.log
[2010/12/13 16:13:08 | 000,000,155 | —- | M] () – C:\myinstall.log
[2010/11/29 18:50:32 | 000,000,000 | RHS- | M] () – C:\OS
[2012/08/13 05:55:12 | 3184,779,264 | -HS- | M] () – C:\pagefile.sys
[2012/07/14 21:34:25 | 000,000,420 | —- | M] () – C:\rkill.log
[2012/06/08 06:30:33 | 000,000,000 | —- | M] () – C:\sniffer.log
[2012/08/05 08:14:09 | 000,135,182 | —- | M] () – C:\TDSSKiller.2.7.48.0_05.08.2012_08.12.21_log.txt
[2012/08/05 13:30:14 | 000,135,182 | —- | M] () – C:\TDSSKiller.2.7.48.0_05.08.2012_13.29.30_log.txt
[2012/08/05 19:34:58 | 000,135,182 | —- | M] () – C:\TDSSKiller.2.7.48.0_05.08.2012_19.34.26_log.txt
[2012/08/06 12:50:31 | 000,143,420 | —- | M] () – C:\TDSSKiller.2.7.48.0_06.08.2012_12.48.07_log.txt
[2012/08/09 17:46:09 | 000,135,238 | —- | M] () – C:\TDSSKiller.2.7.48.0_09.08.2012_17.45.07_log.txt
[2010/12/13 16:13:08 | 000,001,487 | —- | M] () – C:\temp.log
[2010/11/30 06:55:29 | 002,586,746 | —- | M] () – C:\test.log
[2007/11/07 09:00:40 | 000,005,686 | —- | M] () – C:\vcredist.bmp
[2007/11/07 09:09:22 | 001,442,522 | —- | M] () – C:\VC_RED.cab
[2007/11/07 09:12:28 | 000,232,960 | —- | M] () – C:\VC_RED.MSI

< %systemroot%\Fonts\*.com >
[2009/07/14 00:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 00:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 00:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 00:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 17:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll
[2007/06/26 20:56:34 | 000,019,968 | —- | M] (Windows ® 2000 DDK provider) – C:\Windows\system32\spool\prtprocs\w32x86\spd__pc.dll
[2006/09/18 02:57:22 | 000,019,456 | —- | M] (Windows ® 2000 DDK provider) – C:\Windows\system32\spool\prtprocs\w32x86\SSGB6pc.dll
[2010/11/20 08:21:36 | 000,030,208 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2012/03/08 18:37:20 | 000,302,448 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 00:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/08/14 09:11:24 | 000,000,221 | -HS- | M] () – C:\Users\FMA\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2012/08/10 09:41:37 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\FMA\Desktop\HijackThis.exe
[2012/08/13 16:51:47 | 000,596,992 | —- | M] (OldTimer Tools) – C:\Users\FMA\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >
[2011/12/19 03:04:46 | 000,000,698 | —- | M] () – C:\Windows\AppPatch\Custom\{a9264802-8a7a-40fe-a135-5c6d204aed7a}.sdb

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-07-18 07:01:23

========== Alternate Data Streams ==========

@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:9ABD7EE6
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:E4A69413
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:0CFF5F08

< End of report >
Post #6
Heres the extra.txt… wow..what a ton of stuff!, Thanks
_________________________________________
OTL Extras logfile created on: 8/13/2012 4:58:41 PM - Run 1
OTL by OldTimer - Version 3.2.57.0 Folder = C:\Users\FMA\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.97 Gb Total Physical Memory | 1.78 Gb Available Physical Memory | 59.85% Memory free
5.93 Gb Paging File | 4.65 Gb Available in Paging File | 78.42% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 362.24 Gb Total Space | 235.34 Gb Free Space | 64.97% Space Free | Partition Type: NTFS
Drive D: | 3.86 Gb Total Space | 0.40 Gb Free Space | 10.28% Space Free | Partition Type: NTFS
Drive F: | 97.66 Gb Total Space | 97.56 Gb Free Space | 99.91% Space Free | Partition Type: NTFS

Computer Name: FMA-HP | User Name: FMA | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.cmd [@ = cmdfile] – Reg Error: Key error. File not found
.js [@ = jsfile] – Reg Error: Key error. File not found
.pif [@ = piffile] – Reg Error: Key error. File not found
.txt [@ = txtfile] – Reg Error: Key error. File not found
.vbs [@ = VBSFile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] – C:\Program Files\Adobe\Adobe Bridge CS6\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{32947F1D-0C4D-4015-8F2F-DF7181F966F7}" = lport=2869 | protocol=6 | dir=in | app=system |
"{4A129A85-812F-43E8-8B78-227CF1F0EB90}" = lport=137 | protocol=17 | dir=in | app=system |
"{5266F408-EC58-4B76-B31C-97DB2E6BBB4F}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{577D103E-EFC4-4240-816A-9DFC7CBA1B2A}" = lport=138 | protocol=17 | dir=in | app=system |
"{5EA8E708-6D2A-4B01-B967-488DB2539747}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=c:\windows\system32\spoolsv.exe |
"{67F9F5C3-8C7B-4D1A-A4FF-84D356E27DC4}" = rport=139 | protocol=6 | dir=out | app=system |
"{694ABF4D-C34C-4781-89C6-F49E1A6EBE13}" = lport=10243 | protocol=6 | dir=in | app=system |
"{734AB8E0-2ED9-4963-A0BC-54D9B1E582CD}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7AC79B6D-06A3-4C46-BE72-EBF0966B95D8}" = rport=137 | protocol=17 | dir=out | app=system |
"{91916700-E9B3-49EF-8196-3CDBC2674313}" = lport=445 | protocol=6 | dir=in | app=system |
"{A3CF9466-6E05-420F-BA19-EEAE8BFB3792}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=file and printer sharing (spooler service - rpc-epmap) |
"{AAA87A79-F209-4F12-AA11-4932A101BF39}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C085D939-EF3D-4ECA-8EFC-1BEEB232A5DA}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=c:\windows\system32\svchost.exe |
"{C37606C2-5685-4D29-85F0-48CDB72F7406}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C77AB563-9EC9-40B6-B0C5-5FE4262BFB2D}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C898FD91-DBB3-4753-B7EA-E9649AD140FA}" = rport=138 | protocol=17 | dir=out | app=system |
"{C9F931CF-E34E-40A7-9DFB-742EA43B97AB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{DF66932B-C5A0-40C7-8A70-839472942F6A}" = rport=445 | protocol=6 | dir=out | app=system |
"{E142E703-5AF4-4EB7-A5EE-C4EF64BDA7E5}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{EA0443D9-B4DC-4FBA-A236-9B7344283075}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F579BB29-BBCE-4F76-8B0A-CED092B31153}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=c:\windows\system32\svchost.exe |
"{FC3C6578-6699-4F73-8203-5846C726B547}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FF4EA0FD-8F9C-4601-B49C-E30363EC127C}" = lport=139 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{192E2B98-C48D-4101-B0D2-15812D634560}" = protocol=6 | dir=in | app=c:\users\fma\appdata\roaming\dropbox\bin\dropbox.exe |
"{2783FC58-AFA0-4ABC-ADC0-13F3E4A6A11D}" = protocol=17 | dir=in | app=c:\windows\system32\supdsvc.exe |
"{27ACF908-EBA9-4EF9-8EBD-B1532975274C}" = protocol=1 | dir=in | name=file and printer sharing (echo request - icmpv4-in) |
"{35DDEC82-C039-4BD9-B184-566A10FB775D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{39344340-2A04-4DD6-BC55-356EDC58DB9C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{42F29CD4-5317-48F8-9F54-BEAAF2B46563}" = protocol=6 | dir=in | app=c:\program files\common files\motive\mcciservicehost.exe |
"{4574D7C2-D9A8-4B2D-8609-E02D6ED3B559}" = dir=out | app=%programfiles%\artisteer 3\bin\artisteer.exe |
"{4A93FC10-56D5-4BD6-82AB-45E1E6F1B07E}" = protocol=6 | dir=out | app=system |
"{4EFAEB04-465F-44DA-B8C1-84565B9F7EDB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{54B08FFB-B6D0-4F98-86E9-25B32DB60CAA}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{60DD00FC-969D-4079-A77D-40FF0187BC1A}" = protocol=6 | dir=in | app=c:\windows\system32\supdsvc.exe |
"{6A0641EA-C8FA-46DF-A886-CD29019CB52E}" = protocol=17 | dir=in | app=c:\users\fma\appdata\roaming\dropbox\bin\dropbox.exe |
"{76831A81-2E81-4095-8906-6F9A6716068B}" = protocol=6 | dir=in | app=c:\program files\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{7E8AF757-E4F3-499D-A695-6C28E133EA76}" = protocol=58 | dir=out | name=file and printer sharing (echo request - icmpv6-out) |
"{8A22185C-DD3E-41C6-9C56-9A4CD1BABC3F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{91087BB0-EDF6-46EC-B139-5820ED2B5C9C}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"{954A87FB-A28D-46E4-A522-D53246CC03DC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A62C00A9-8A52-4A18-A1B9-A7946F6E73D0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A8AF4774-6ADA-4CFB-A1B8-03E8AA2C8823}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{AA314D80-BAB9-4E4E-B996-DDF42479393F}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"{AB51D213-5429-40BB-B927-E37AFC0F4A32}" = protocol=1 | dir=out | name=file and printer sharing (echo request - icmpv4-out) |
"{AF3554E0-9FE5-442B-AB79-BC8F9F0D81D8}" = protocol=6 | dir=in | app=c:\program files\common files\motive\mcciservicehost.exe |
"{B08DA19F-AA29-4BEE-88EF-B3444583A54A}" = protocol=17 | dir=in | app=c:\program files\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{BB68D936-85DA-43A7-9F40-9B4C2CF300E2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{C75AB679-F6B6-43FE-AEEF-9498C6208DEF}" = protocol=17 | dir=in | app=c:\program files\common files\motive\mcciservicehost.exe |
"{C7F8DCD3-BABE-4A50-AD9F-2AB6F897B45D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{CBCF067A-76A4-4B93-9160-68286041B925}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{CF4DC140-37B3-446C-8795-7970349372C9}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{D5B10A2C-9D20-4F04-8F86-910E03898CE8}" = dir=out | app=%programfiles%\adobe\acrobat 10.0\acrobat\acrobat.exe |
"{DCB21D80-2915-4C5B-AD10-3C67BB110BF2}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E7E2F375-7898-4292-AC11-7709DD04B214}" = protocol=58 | dir=in | name=file and printer sharing (echo request - icmpv6-in) |
"{F80149C3-CC11-49B0-B429-964D7615A697}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{FDCB018C-9367-485F-A9EF-6236F1B02F2C}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{FEFDC4C2-E5FE-434A-84B2-EF1CFE70F1C4}" = protocol=17 | dir=in | app=c:\program files\common files\motive\mcciservicehost.exe |
"TCP Query User{3EA2BEAD-71DE-4FAD-961F-EEBBB87C01BB}C:\users\fma\appdata\local\aptana studio 2.0\aptanastudio.exe" = protocol=6 | dir=in | app=c:\users\fma\appdata\local\aptana studio 2.0\aptanastudio.exe |
"TCP Query User{AA359D16-4533-453B-9833-4E9B45A4C998}C:\program files\antenna 4.0\antenna.exe" = protocol=6 | dir=in | app=c:\program files\antenna 4.0\antenna.exe |
"TCP Query User{DCE85C2E-B032-475D-B025-5821EFC7C37A}C:\program files\antenna\antenna.exe" = protocol=6 | dir=in | app=c:\program files\antenna\antenna.exe |
"UDP Query User{7A37FDED-7EC4-4829-A852-C67E28DFCD9C}C:\program files\antenna 4.0\antenna.exe" = protocol=17 | dir=in | app=c:\program files\antenna 4.0\antenna.exe |
"UDP Query User{8BC61E91-F23C-425A-8EAD-C98D49AA42AA}C:\users\fma\appdata\local\aptana studio 2.0\aptanastudio.exe" = protocol=17 | dir=in | app=c:\users\fma\appdata\local\aptana studio 2.0\aptanastudio.exe |
"UDP Query User{920F8CAA-7BE2-4915-A603-8F9AA94EE4AE}C:\program files\antenna\antenna.exe" = protocol=17 | dir=in | app=c:\program files\antenna\antenna.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{0F842B77-56EA-4AAF-8295-81A022350B5E}" = Microsoft Security Client
"{10CCF16B-F1C9-4B24-9570-B4CCEE42392D}" = LightScribe System Software
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{16C315AA-1027-4530-92E1-C47CA832E330}" = Xara Designer Pro 6 Content Pack
"{17504ED4-DB08-40A8-81C2-27D8C01581DA}" = Windows Live Remote Service Resources
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{254BEB3E-1085-4D66-9CDC-0152C0DC2E93}" = EPSON TWAIN 5
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java™ 7 Update 5
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Roxio Drag-to-Disc
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{402F6F2E-5683-491C-977D-0CA599A07CAF}" = Adobe CS6 Design and Web Premium
"{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}" = HP Advisor
"{41982F90-951A-4B7F-A8FC-4154C3ACE05F}" = Database Oasis
"{464B3406-A4D0-4914-910F-7CA4380DCC13}" = Windows Live Remote Client Resources
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6604C31C-A3F5-4B19-A75F-BF7B87369C89}" = CyberPower PowerPanel Personal Edition 1.2.7
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{67C7BC46-9430-45F7-88EB-BD4FECE9F53B}" = Nitro Pro 7
"{67ED38A3-4882-448B-B44D-3428AB00D7D5}" = Acronis True Image Home
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6B9B0C6F-E5FA-4633-A640-AB98A272ECCA}" = Safari
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.1.2.0
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}" = Adobe Photoshop CS6
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7FA8B156-D139-4de4-9E75-870BC5865CC9}_is1" = LightBox Video Web Gallery Creator 2.1.7
"{7FC84AD6-D939-41A0-A3DF-FB9B511FF275}_is1" = Sothink SWF Catcher for Internet Explorer
"{7FCBED5C-8C0F-43FA-9880-E3BBCE81FEF0}" = CoffeeCup Web Form Builder
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00B0-0409-0000-0000000FF1CE}" = Microsoft Save as PDF Add-in for 2007 Microsoft Office programs
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{938B1CD7-7C60-491E-AA90-1F1888168240}" = Roxio MyDVD Basic v9
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-00AF-0409-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{9866E5F0-121F-E018-E2D1-2E1770847ABF}" = Adobe Download Assistant
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A4ED5E53-7AA0-11E1-BF04-B2D4D4A5360E}" = Adobe Dreamweaver CS6
"{a9264802-8a7a-40fe-a135-5c6d204aed7a}.sdb" = Internet Explorer (Enable DEP)
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.3)
"{AD1C7ACE-30DC-4107-B6A7-9495D12DC846}" = TinEye Internet Explorer plugin 1.2
"{AF37176A-78CA-545B-34EF-8B6A21514DD1}" = Adobe Help Manager
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B829E117-D072-41EA-9606-9826A38D34C1}" = Sophos Virus Removal Tool
"{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}" = PDF Settings CS6
"{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}" = Norton Online Backup
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C7163400-6A4A-467E-A31B-3841C33F6F5D}" = Xara Designer Pro 6
"{C79312BD-3E76-4474-A10C-1435D1856A4B}" = Adobe Dreamweaver CS5
"{C8748FFB-1713-4e95-B3DF-4F1622D96F93}_is1" = UBitMenu UK
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9
"{CA51940F-053A-A5BE-A6D3-F36241CD84F2}" = Adobe® Content Viewer
"{CB30938E-2BCE-4837-9FEB-EB5DAB000235}" = LucisArt 3.0.2 ED/SE
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D52ECEBC-9B20-41A5-81C4-A62DE2367419}" = Adobe Creative Suite
"{D7BF3B76-EEF9-4868-9B2B-42ABF60B279A}" = Microsoft_VC80_CRT_x86
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{EC21B3F4-6A5B-4D77-A796-BB4F1A646C8B}" = FileMaker Pro 12 Advanced
"{EC21B3F4-6A5B-4D77-A796-BB4F1A646C8B}_FileMaker" = FileMaker Pro 12 Advanced
"{EC90EAE9-0E03-44A1-BF36-0B670B8B8E19}" = CoffeeCup Direct FTP
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EFBE6DD5-B224-96E5-72B9-68D328CB12A6}" = Adobe Widget Browser
"{EFE3D683-903C-4B58-AB8F-C68C69F33758}" = System Requirements Lab for Intel
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F1100000-0011-0000-0001-074957833700}" = ABBYY FineReader 11
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"3D PageFlip for PowerPoint_is1" = 3D PageFlip for PowerPoint
"7-Zip" = 7-Zip 9.20
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"Aimersoft Video Converter Pro_is1" = Aimersoft Video Converter Pro(Build [removed])
"Alien Skin Blow Up 3" = Alien Skin Blow Up 3
"Amara - Flash Intro and Banner Builder" = Amara - Flash Intro and Banner Builder
"Amara - Flash News Ticker" = Amara - Flash News Ticker
"Amara - Flash Photo Animation Software" = Amara - Flash Photo Animation Software
"Amara - Flash Slide Show Builder" = Amara - Flash Slide Show Builder
"Amaya" = Amaya
"Antenna" = Antenna
"Artisteer 3" = Artisteer 3
"ATT-SST" = AT&T Troubleshoot & Resolve Tool
"Blow Up" = Alien Skin Blow Up
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"Canon MOV Decoder" = Canon MOV Decoder
"Canon MOV Encoder" = Canon MOV Encoder
"CCleaner" = CCleaner
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Help Manager
"CoffeeCup Direct FTP 6.6.0" = CoffeeCup Direct FTP
"CoffeeCup Flash FireStarter" = CoffeeCup Flash FireStarter
"CoffeeCup Shopping Cart Creator Pro 3.8.3863" = CoffeeCup Shopping Cart Creator Pro
"CoffeeCup Web Form Builder - Registered" = CoffeeCup Web Form Builder - Registered
"CoffeeCup Website Color Schemer" = CoffeeCup Website Color Schemer
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.dmp.contentviewer" = Adobe® Content Viewer
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"com.adobe.WidgetBrowser" = Adobe Widget Browser
"CSS3 Menu" = CSS3 Menu
"Easy GIF Animator_is1" = Easy GIF Animator 5.4
"EyeCandy5Impact" = Alien Skin Eye Candy 5 Impact
"EyeCandy5Nature" = Alien Skin Eye Candy 5 Nature
"EyeCandy5Textures" = Alien Skin Eye Candy 5 Textures
"FileZilla Client" = FileZilla Client 3.5.2
"Free Studio_is1" = Free Studio version 5.5.0
"GML GrowCut_is1" = GML GrowCut 1.1
"GML Matting_is1" = GML Matting 0.3
"Hamster Free Video Converter_is1" = HamsterFreeVideoConverter
"HDMI" = Intel® Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ieSpell" = ieSpell
"ImagenomicPortraiturePlugin" = Imagenomic Portraiture 2.3 Plug-in (build 2308)
"IrfanView" = IrfanView (remove only)
"iWisoft Free Video Downloader_is1" = iWisoft Free Video Downloader 2.1
"Kvisoft FlipBook Maker Pro_is1" = Kvisoft FlipBook Maker Pro 3.5.3
"LameACM" = LameACM
"MAGIX_MSI_XtremePro6" = Xara Designer Pro 6
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox 14.0.1 (x86 en-US)" = Mozilla Firefox 14.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MyCamera Download Plugin" = CANON iMAGE GATEWAY MyCamera Download Plugin
"News Scroller Wizard" = News Scroller Wizard 2.3
"Opera 12.00.1467" = Opera 12.00
"PhotoRazor" = PhotoRazor
"PicPick" = PicPick
"PSPad editor_is1" = PSPad editor
"QuickInvoice 2.63" = QuickInvoice Pro 2.63
"Revo Uninstaller" = Revo Uninstaller 1.91
"Samsung ML-1740 Series" = Samsung ML-1740 Series
"Samsung Universal Print Driver" = Samsung Universal Print Driver
"SEOToolkit30_is1" = Trellian SEO Toolkit v3.0
"SWiSH Max4" = SWiSH Max4
"Topaz Star Effects" = Topaz Star Effects
"Trellian WebPage_is1" = Trellian WebPage
"Typograf" = Typograf4.8f
"Uninstall_is1" = Uninstall 1.0.0.1
"VideoLightBox" = VideoLightBox
"Visual Slideshow" = Visual Slideshow
"Wacom Tablet Driver" = Wacom Tablet
"Wacom WebTabletPlugin for IE" = WebTablet IE Plugin
"Wacom WebTabletPlugin for Netscape" = WebTablet Netscape Plugin
"Web Calendar" = Web Calendar
"WinHTTrack Website Copier_is1" = WinHTTrack Website Copier 3.43-9D
"WinLiveSuite" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.1.2
"WinRAR archiver" = WinRAR archiver
"WOW Slider" = WOW Slider
"Zoom Search Engine 6.0_is1" = Zoom Search Engine 6.0
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"CoffeeCup HTML Editor" = CoffeeCup HTML Editor
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 8/8/2012 7:31:13 AM | Computer Name = FMA-HP | Source = Microsoft-Windows-CAPI2 | ID = 513
Description = Cryptographic Services failed while processing the OnIdentity() call
in the System Writer Object. Details: AddLegacyDriverFiles: Unable to back up image
of binary 13299348. System Error: The system cannot find the file specified. .

Error - 8/8/2012 7:49:10 AM | Computer Name = FMA-HP | Source = Microsoft-Windows-CAPI2 | ID = 513
Description = Cryptographic Services failed while processing the OnIdentity() call
in the System Writer Object. Details: AddLegacyDriverFiles: Unable to back up image
of binary 4167298drv. System Error: The system cannot find the file specified. .

Error - 8/8/2012 7:49:10 AM | Computer Name = FMA-HP | Source = Microsoft-Windows-CAPI2 | ID = 513
Description = Cryptographic Services failed while processing the OnIdentity() call
in the System Writer Object. Details: AddLegacyDriverFiles: Unable to back up image
of binary 13299348. System Error: The system cannot find the file specified. .

Error - 8/8/2012 10:52:42 AM | Computer Name = FMA-HP | Source = MsiInstaller | ID = 10005
Description =

Error - 8/8/2012 10:54:13 AM | Computer Name = FMA-HP | Source = MsiInstaller | ID = 10005
Description =

Error - 8/8/2012 12:59:21 PM | Computer Name = FMA-HP | Source = Microsoft-Windows-RestartManager | ID = 10006
Description = Application or service 'BitDefender Virus Shield' could not be shut
down.

Error - 8/8/2012 12:59:52 PM | Computer Name = FMA-HP | Source = Microsoft-Windows-RestartManager | ID = 10006
Description = Application or service 'BitDefender Security Center' could not be
shut down.

Error - 8/8/2012 1:02:44 PM | Computer Name = FMA-HP | Source = Microsoft-Windows-RestartManager | ID = 10007
Description = Application or service 'BitDefender Virus Shield' could not be restarted.

Error - 8/8/2012 2:11:31 PM | Computer Name = FMA-HP | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 9.0.8112.16447 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: b20 Start
Time: 01cd758877acc56c Termination Time: 0 Application Path: C:\Program Files\Internet
Explorer\iexplore.exe Report Id:

Error - 8/8/2012 2:55:01 PM | Computer Name = FMA-HP | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 9.0.8112.16447 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: f00 Start
Time: 01cd759145274593 Termination Time: 0 Application Path: C:\Program Files\Internet
Explorer\iexplore.exe Report Id:

Error - 8/8/2012 3:44:24 PM | Computer Name = FMA-HP | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 9.0.8112.16447 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: ac0 Start
Time: 01cd759a7df9317a Termination Time: 0 Application Path: C:\Program Files\Internet
Explorer\iexplore.exe Report Id:

[ Hewlett-Packard Events ]
Error - 7/12/2012 6:40:51 AM | Computer Name = FMA-HP | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088 at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Message: One HP Active Check Local Mode job already running. StackTrace:
at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Source: HP.ActiveCheckLocalMode.SessionManager Name: hpsa_service.exe
Version:
06.00.01.01 Path: C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
en-US RAM: 3037 Ram Utilization: 30 TargetSite: Void UpdateAndDetect()

Error - 7/12/2012 7:17:11 AM | Computer Name = FMA-HP | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088 at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Message: One HP Active Check Local Mode job already running. StackTrace:
at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Source: HP.ActiveCheckLocalMode.SessionManager Name: hpsa_service.exe
Version:
06.00.01.01 Path: C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
en-US RAM: 3037 Ram Utilization: 40 TargetSite: Void UpdateAndDetect()

Error - 7/18/2012 9:33:11 PM | Computer Name = FMA-HP | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088 at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Message: One HP Active Check Local Mode job already running. StackTrace:
at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Source: HP.ActiveCheckLocalMode.SessionManager Name: hpsa_service.exe
Version:
06.00.01.01 Path: C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
en-US RAM: 3037 Ram Utilization: 60 TargetSite: Void UpdateAndDetect()

Error - 7/18/2012 10:32:32 PM | Computer Name = FMA-HP | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088hpsa_service.exe at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Message: One HP Active Check Local Mode job already running. StackTrace:
at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Source: HP.ActiveCheckLocalMode.SessionManager Name: hpsa_service.exe
Version:
06.00.01.01 Path: C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
en-US RAM: 3037 Ram Utilization: 60 TargetSite: Void UpdateAndDetect()

Error - 7/25/2012 9:07:14 PM | Computer Name = FMA-HP | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088 at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Message: One HP Active Check Local Mode job already running. StackTrace:
at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Source: HP.ActiveCheckLocalMode.SessionManager Name: hpsa_service.exe
Version:
06.00.01.01 Path: C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
en-US RAM: 3037 Ram Utilization: 50 TargetSite: Void UpdateAndDetect()

Error - 8/1/2012 9:21:16 PM | Computer Name = FMA-HP | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088 at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Message: One HP Active Check Local Mode job already running. StackTrace:
at HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

at HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Source: HP.ActiveCheckLocalMode.SessionManager Name: hpsa_service.exe
Version:
06.00.01.01 Path: C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
en-US RAM: 3037 Ram Utilization: 50 TargetSite: Void UpdateAndDetect()

Error - 8/5/2012 1:53:07 PM | Computer Name = FMA-HP | Source = HPSFMsgr.exe | ID = 4000
Description = HP Error ID: -2147221164 at System.RuntimeTypeHandle.CreateInstance(RuntimeType
type, Boolean publicOnly, Boolean noCheck, Boolean& canBeCached, RuntimeMethodHandle&
ctor, Boolean& bNeedSecurityCheck) at System.RuntimeType.CreateInstanceSlow(Boolean
publicOnly, Boolean fillCache) at System.RuntimeType.CreateInstanceImpl(Boolean
publicOnly, Boolean skipVisibilityChecks, Boolean fillCache) at System.Activator.CreateInstance(Type
type, Boolean nonPublic) at HPSA_Messenger.MessengerCom.TrayDeskBand.isTaskbarDisplayed()
StackTrace:
at System.RuntimeTypeHandle.CreateInstance(RuntimeType type, Boolean publicOnly,
Boolean noCheck, Boolean& canBeCached, RuntimeMethodHandle& ctor, Boolean& bNeedSecurityCheck)

at System.RuntimeType.CreateInstanceSlow(Boolean publicOnly, Boolean fillCache)

at System.RuntimeType.CreateInstanceImpl(Boolean publicOnly, Boolean skipVisibilityChecks,
Boolean fillCache) at System.Activator.CreateInstance(Type type, Boolean nonPublic)

at HPSA_Messenger.MessengerCom.TrayDeskBand.isTaskbarDisplayed() Source: mscorlib

Name:
HPSFMsgr.exe Version: 01.00.00.00 Path: C:\Program Files\Hewlett-Packard\HP Support
Framework\Resources\HPSFMessenger\HPSFMsgr.exe Format: en-US RAM: 3037 Ram Utilization:
20 TargetSite: System.Object CreateInstance(System.RuntimeType, Boolean, Boolean,
Boolean ByRef, System.RuntimeMethodHandle ByRef, Boolean ByRef)

Error - 8/5/2012 1:53:18 PM | Computer Name = FMA-HP | Source = HPSFMsgr.exe | ID = 4000
Description = HP Error ID: -2147221164HPSFMsgr.exe at System.RuntimeTypeHandle.CreateInstance(RuntimeType
type, Boolean publicOnly, Boolean noCheck, Boolean& canBeCached, RuntimeMethodHandle&
ctor, Boolean& bNeedSecurityCheck) at System.RuntimeType.CreateInstanceSlow(Boolean
publicOnly, Boolean fillCache) at System.RuntimeType.CreateInstanceImpl(Boolean
publicOnly, Boolean skipVisibilityChecks, Boolean fillCache) at System.Activator.CreateInstance(Type
type, Boolean nonPublic) at HPSA_Messenger.MessengerCom.TrayDeskBand.ShowTaskBar()
StackTrace:
at System.RuntimeTypeHandle.CreateInstance(RuntimeType type, Boolean publicOnly,
Boolean noCheck, Boolean& canBeCached, RuntimeMethodHandle& ctor, Boolean& bNeedSecurityCheck)

at System.RuntimeType.CreateInstanceSlow(Boolean publicOnly, Boolean fillCache)

at System.RuntimeType.CreateInstanceImpl(Boolean publicOnly, Boolean skipVisibilityChecks,
Boolean fillCache) at System.Activator.CreateInstance(Type type, Boolean nonPublic)

at HPSA_Messenger.MessengerCom.TrayDeskBand.ShowTaskBar() Source: mscorlib Name:
HPSFMsgr.exe Version: 01.00.00.00 Path: C:\Program Files\Hewlett-Packard\HP Support
Framework\Resources\HPSFMessenger\HPSFMsgr.exe Format: en-US RAM: 3037 Ram Utilization:
30 TargetSite: System.Object CreateInstance(System.RuntimeType, Boolean, Boolean,
Boolean ByRef, System.RuntimeMethodHandle ByRef, Boolean ByRef)

Error - 8/6/2012 7:46:44 AM | Computer Name = FMA-HP | Source = HPSFMsgr.exe | ID = 4000
Description = HP Error ID: -2147221164 at System.RuntimeTypeHandle.CreateInstance(RuntimeType
type, Boolean publicOnly, Boolean noCheck, Boolean& canBeCached, RuntimeMethodHandle&
ctor, Boolean& bNeedSecurityCheck) at System.RuntimeType.CreateInstanceSlow(Boolean
publicOnly, Boolean fillCache) at System.RuntimeType.CreateInstanceImpl(Boolean
publicOnly, Boolean skipVisibilityChecks, Boolean fillCache) at System.Activator.CreateInstance(Type
type, Boolean nonPublic) at HPSA_Messenger.MessengerCom.TrayDeskBand.isTaskbarDisplayed()
StackTrace:
at System.RuntimeTypeHandle.CreateInstance(RuntimeType type, Boolean publicOnly,
Boolean noCheck, Boolean& canBeCached, RuntimeMethodHandle& ctor, Boolean& bNeedSecurityCheck)

at System.RuntimeType.CreateInstanceSlow(Boolean publicOnly, Boolean fillCache)

at System.RuntimeType.CreateInstanceImpl(Boolean publicOnly, Boolean skipVisibilityChecks,
Boolean fillCache) at System.Activator.CreateInstance(Type type, Boolean nonPublic)

at HPSA_Messenger.MessengerCom.TrayDeskBand.isTaskbarDisplayed() Source: mscorlib

Name:
HPSFMsgr.exe Version: 01.00.00.00 Path: C:\Program Files\Hewlett-Packard\HP Support
Framework\Resources\HPSFMessenger\HPSFMsgr.exe Format: en-US RAM: 3037 Ram Utilization:
30 TargetSite: System.Object CreateInstance(System.RuntimeType, Boolean, Boolean,
Boolean ByRef, System.RuntimeMethodHandle ByRef, Boolean ByRef)

Error - 8/6/2012 7:46:49 AM | Computer Name = FMA-HP | Source = HPSFMsgr.exe | ID = 4000
Description = HP Error ID: -2147221164HPSFMsgr.exe at System.RuntimeTypeHandle.CreateInstance(RuntimeType
type, Boolean publicOnly, Boolean noCheck, Boolean& canBeCached, RuntimeMethodHandle&
ctor, Boolean& bNeedSecurityCheck) at System.RuntimeType.CreateInstanceSlow(Boolean
publicOnly, Boolean fillCache) at System.RuntimeType.CreateInstanceImpl(Boolean
publicOnly, Boolean skipVisibilityChecks, Boolean fillCache) at System.Activator.CreateInstance(Type
type, Boolean nonPublic) at HPSA_Messenger.MessengerCom.TrayDeskBand.ShowTaskBar()
StackTrace:
at System.RuntimeTypeHandle.CreateInstance(RuntimeType type, Boolean publicOnly,
Boolean noCheck, Boolean& canBeCached, RuntimeMethodHandle& ctor, Boolean& bNeedSecurityCheck)

at System.RuntimeType.CreateInstanceSlow(Boolean publicOnly, Boolean fillCache)

at System.RuntimeType.CreateInstanceImpl(Boolean publicOnly, Boolean skipVisibilityChecks,
Boolean fillCache) at System.Activator.CreateInstance(Type type, Boolean nonPublic)

at HPSA_Messenger.MessengerCom.TrayDeskBand.ShowTaskBar() Source: mscorlib Name:
HPSFMsgr.exe Version: 01.00.00.00 Path: C:\Program Files\Hewlett-Packard\HP Support
Framework\Resources\HPSFMessenger\HPSFMsgr.exe Format: en-US RAM: 3037 Ram Utilization:
30 TargetSite: System.Object CreateInstance(System.RuntimeType, Boolean, Boolean,
Boolean ByRef, System.RuntimeMethodHandle ByRef, Boolean ByRef)

[ OSession Events ]
Error - 2/16/2012 4:36:39 PM | Computer Name = FMA-HP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 709
seconds with 600 seconds of active time. This session ended with a crash.

Error - 2/16/2012 5:30:24 PM | Computer Name = FMA-HP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 920
seconds with 900 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 8/10/2012 11:16:08 AM | Computer Name = FMA-HP | Source = Service Control Manager | ID = 7000
Description = The FreemakeVideoCapture service failed to start due to the following
error: %%2

Error - 8/11/2012 6:51:24 AM | Computer Name = FMA-HP | Source = Service Control Manager | ID = 7000
Description = The DgiVecp service failed to start due to the following error: %%20

Error - 8/11/2012 6:51:24 AM | Computer Name = FMA-HP | Source = Service Control Manager | ID = 7000
Description = The FreemakeVideoCapture service failed to start due to the following
error: %%2

Error - 8/12/2012 5:53:14 AM | Computer Name = FMA-HP | Source = Service Control Manager | ID = 7000
Description = The DgiVecp service failed to start due to the following error: %%20

Error - 8/12/2012 5:53:14 AM | Computer Name = FMA-HP | Source = Service Control Manager | ID = 7000
Description = The FreemakeVideoCapture service failed to start due to the following
error: %%2

Error - 8/12/2012 7:56:19 AM | Computer Name = FMA-HP | Source = BugCheck | ID = 1001
Description =

Error - 8/12/2012 7:56:26 AM | Computer Name = FMA-HP | Source = Service Control Manager | ID = 7000
Description = The DgiVecp service failed to start due to the following error: %%20

Error - 8/12/2012 7:56:26 AM | Computer Name = FMA-HP | Source = Service Control Manager | ID = 7000
Description = The FreemakeVideoCapture service failed to start due to the following
error: %%2

Error - 8/13/2012 5:55:20 AM | Computer Name = FMA-HP | Source = Service Control Manager | ID = 7000
Description = The DgiVecp service failed to start due to the following error: %%20

Error - 8/13/2012 5:55:20 AM | Computer Name = FMA-HP | Source = Service Control Manager | ID = 7000
Description = The FreemakeVideoCapture service failed to start due to the following
error: %%2


< End of report >
Post #7
gsvcibuw.dll seems to be gone. I'm assuming you removed it with Mbam?

Double click on OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Processes

:OTL
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {3E1201F4-1707-409F-BB45-A5F192381DA0} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html File not found
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html File not found
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html File not found
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html File not found
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - File not found
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL File not found
[2012/08/03 20:07:50 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{D1FDD9D9-9D54-4DE0-81F6-1ED53984A9BF}
[2012/08/03 20:07:28 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{43F345CE-A431-45B8-8064-C45829D4D496}
[2012/08/03 08:07:03 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{816432A2-5D3A-4F6D-93CA-595C67B33462}
[2012/08/03 08:06:41 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{D5CC4D00-F106-41BE-846C-31F514323D7A}
[2012/08/02 18:51:58 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{5B87C639-6595-4A4D-98F2-CC799748AE63}
[2012/08/02 18:51:36 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{F0C391F8-22EC-45AF-A290-54141F20B5D5}
[2012/08/02 06:51:11 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{109E0588-FEA1-4615-BC5F-2FBE10DE1B8C}
[2012/08/02 06:51:00 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{4EACEEAB-DDC3-48DF-A699-17DC96E9195D}
[2012/08/01 11:26:39 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{1F6DFD6F-9943-441C-BC24-E906CA925EDE}
[2012/08/01 11:26:29 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{6326281C-C859-4B01-A3E5-3494816E4E34}
[2012/07/31 23:26:04 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{ACB4294E-A206-452F-A9E3-6B7918AAE6E9}
[2012/07/31 23:25:42 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{5EFD4910-EF8E-4677-83D9-0F08E667942B}
[2012/07/31 11:25:18 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{93F9FCFA-539F-4086-9BF7-CFB14730979E}
[2012/07/31 11:24:56 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{303E0E40-43D1-48BB-B7C7-BE3B5DB90BE3}
[2012/07/30 20:26:20 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{50064236-A4E0-473C-9098-8AACF1889A65}
[2012/07/30 08:25:06 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{84965A07-98BA-4115-B7CE-A1B723C2675D}
[2012/07/30 08:24:43 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{93551238-6FF1-481C-9AAE-789D7E15460C}
[2012/07/29 19:45:21 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{A2C3D65C-DAB4-4777-B09D-F578D6C1C11E}
[2012/07/29 19:44:58 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{A1F380B3-B7B9-4BCE-A854-77EFAC2B4A77}
[2012/07/29 07:04:45 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{112A35A9-AB66-429B-A9F0-9BB87FC6E054}
[2012/07/29 07:04:22 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{594D8B49-CE0B-4766-91DC-690654B54A23}
[2012/07/28 19:03:56 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{A2B14645-BF24-4A82-83BA-DB6F1538F151}
[2012/07/28 19:03:33 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{9F80E477-7A14-46AA-931D-FBEA7F8E20DC}
[2012/07/28 07:03:07 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{B70EFB43-9EC1-4FA1-B6C1-7465084A4A42}
[2012/07/28 07:02:44 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{1ED81DDB-E0E6-4800-88FA-93E98CED032C}
[2012/07/27 19:02:18 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{7CAE83AB-E9D2-4931-86A7-0451739515BF}
[2012/07/27 19:01:56 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{BC4A059F-EFD7-4BD5-95E7-D79B79DD8C20}
[2012/07/27 07:01:30 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{9E1EEFF0-787F-4137-B98F-143110F17B57}
[2012/07/27 07:01:06 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{82514F2C-FEE2-423D-8E87-6B2035E19F48}
[2012/07/26 19:00:40 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{430111FD-4107-462A-AC5C-A6B8627130B9}
[2012/07/26 19:00:17 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{1CEBFCF9-64B5-4DDE-8FA7-053B170FB0AE}
[2012/07/26 07:00:04 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{D90000CF-42A8-44CD-9348-C68BFC818FE4}
[2012/07/26 06:59:41 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{B4A6BA8F-C544-4B14-93AA-1C13F495B2D1}
[2012/07/25 18:59:15 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{551EFA1B-5728-4049-A5BA-4CD38E8F7ABC}
[2012/07/25 18:58:53 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{8BAD9BA5-64A5-4BB4-9AD6-C049110DB8AD}
[2012/07/25 06:58:27 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{875D4AC2-EB67-45E7-AE43-C28E0F7B0E0D}
[2012/07/25 06:58:04 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{99BDE0A9-F928-43EB-88CA-6CED84458DCE}
[2012/07/24 13:34:15 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{7402CF96-6E7E-4D77-B2C2-6F4D4B076905}
[2012/07/24 13:33:52 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{2483A079-850E-46EC-A0D6-9ABD8F124A64}
[2012/07/23 19:49:52 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{04224CB0-F9C5-405C-A60D-61C1AFB014C4}
[2012/07/23 19:49:29 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{32F0DA1D-650D-4348-82A1-DE22E6D04A1A}
[2012/07/23 07:49:16 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{53DAE278-292F-4791-96C5-124870C702D9}
[2012/07/23 07:48:53 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{9F8361BB-1C26-438D-A09D-C08C84868128}
[2012/07/22 19:48:27 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{33D0A000-98F1-4C76-AF38-EF0E9C3FB132}
[2012/07/22 19:48:04 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{FD965C68-0975-468E-97FB-7FA515A04341}
[2012/07/22 07:47:51 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{8DBC968F-9C9E-4849-A605-125097477933}
[2012/07/22 07:47:28 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{402C62EC-20DA-43C3-AEC2-E226B53EB8A3}
[2012/07/21 19:47:02 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{C3BF8980-0646-4300-ADF9-D4BC3ACD7F36}
[2012/07/21 19:46:40 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{6980A2E9-C451-4A09-99EC-551AE7CA6938}
[2012/07/21 07:46:14 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{F6F04298-6342-4078-B77F-2A304087C47D}
[2012/07/21 07:45:51 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{146676E9-7711-47F2-ACFC-BE9B0AC6BEDC}
[2012/07/20 19:45:25 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{647AEF39-A8FB-41A9-86C9-329397F7FA88}
[2012/07/20 19:45:02 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{23ABB1A7-BD60-4C3E-9E1D-250F4C8BB298}
[2012/07/20 07:44:49 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{0F0A0324-AB1F-4AE9-9DBC-A669C9A22AEE}
[2012/07/20 07:44:26 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{9DFBD157-615B-4CAD-84E0-889A4EFA2FF3}
[2012/07/19 19:44:01 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{975ED040-E707-43F7-AC95-1895EB6325B7}
[2012/07/19 19:43:39 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{F3C6C843-FEC2-4F0A-84ED-F65C65BAF082}
[2012/07/19 07:43:25 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{CE54AC92-CE55-4784-B42E-C747BC653786}
[2012/07/19 07:43:02 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{23122C80-2112-4C4D-A681-E14999A5A5F9}
[2012/07/18 19:42:35 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{81E48203-2351-473C-907A-7DEB2E0B0A49}
[2012/07/18 19:42:12 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{F7AF1386-5400-4595-BDBB-C0A7A7D8DB25}
[2012/07/18 07:41:59 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{5BEA63A4-882A-4C2A-A883-17AAC0D20644}
[2012/07/18 07:41:36 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{AB31AE7D-E141-4ABB-A560-DCF831BB70FF}
[2012/07/17 19:41:10 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{71CBF6AC-E2A1-4960-A834-B4F22C2AB957}
[2012/07/17 19:40:47 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{DE07B435-91C9-4732-B8A4-6EA8762E286A}
[2012/07/17 07:40:21 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{A48AEE2A-77C5-48D7-93D3-214F2D3F9E0C}
[2012/07/17 07:39:58 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{04E8F6C0-9FFE-4E05-822B-22948BC9D4A8}
[2012/07/16 19:39:32 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{316BE6A3-D32A-4983-92DE-3FCBE5AB7065}
[2012/07/16 19:39:10 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{27E2985D-B1BB-4A15-B63D-BA21FE98D9E2}
[2012/07/16 07:38:56 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{0BAC505C-6C8F-451A-90D2-CE6AF7643978}
[2012/07/16 07:38:34 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{701381AC-6369-4AA0-A3CA-F58BFF89BA57}
[2012/07/15 19:38:08 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{3B57D9FE-4062-4099-A4D7-BAE129F2998E}
[2012/07/15 19:37:45 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{A5888738-67B9-4C7F-B222-1C52BBDDEAFA}
[2012/07/15 07:37:19 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{0FE226A0-235B-401A-9A06-0AE1D42EB3A8}
[2012/07/15 07:36:57 | 000,000,000 | —D | C] – C:\Users\FMA\AppData\Local\{C64DC56B-530D-4CED-9744-BD820CB32BD0}
DRV - File not found [Adapter | On_Demand | Unknown] – – (Himpsrymm)
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:9ABD7EE6
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:E4A69413
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:0CFF5F08


:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.
  • Reboot your computer
Please post the OTL log.
Post #8
Good morning Tomk, Heres the OTL … Just tested the pc everything seems to be running faster as well :D Lasa All processes killed ========== PROCESSES ========== ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{3E1201F4-1707-409F-BB45-A5F192381DA0} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3E1201F4-1707-409F-BB45-A5F192381DA0}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ not found. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Append Link Target to Existing PDF\ deleted successfully. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Append to Existing PDF\ deleted successfully. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Convert Link Target to Adobe PDF\ deleted successfully. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Convert to Adobe PDF\ deleted successfully. Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7} C:\Windows\Downloaded Program Files\gp.inf not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}\ deleted successfully. C:\Users\FMA\AppData\Local\{D1FDD9D9-9D54-4DE0-81F6-1ED53984A9BF} folder moved successfully. C:\Users\FMA\AppData\Local\{43F345CE-A431-45B8-8064-C45829D4D496} folder moved successfully. C:\Users\FMA\AppData\Local\{816432A2-5D3A-4F6D-93CA-595C67B33462} folder moved successfully. C:\Users\FMA\AppData\Local\{D5CC4D00-F106-41BE-846C-31F514323D7A} folder moved successfully. C:\Users\FMA\AppData\Local\{5B87C639-6595-4A4D-98F2-CC799748AE63} folder moved successfully. C:\Users\FMA\AppData\Local\{F0C391F8-22EC-45AF-A290-54141F20B5D5} folder moved successfully. C:\Users\FMA\AppData\Local\{109E0588-FEA1-4615-BC5F-2FBE10DE1B8C} folder moved successfully. C:\Users\FMA\AppData\Local\{4EACEEAB-DDC3-48DF-A699-17DC96E9195D} folder moved successfully. C:\Users\FMA\AppData\Local\{1F6DFD6F-9943-441C-BC24-E906CA925EDE} folder moved successfully. C:\Users\FMA\AppData\Local\{6326281C-C859-4B01-A3E5-3494816E4E34} folder moved successfully. C:\Users\FMA\AppData\Local\{ACB4294E-A206-452F-A9E3-6B7918AAE6E9} folder moved successfully. C:\Users\FMA\AppData\Local\{5EFD4910-EF8E-4677-83D9-0F08E667942B} folder moved successfully. C:\Users\FMA\AppData\Local\{93F9FCFA-539F-4086-9BF7-CFB14730979E} folder moved successfully. C:\Users\FMA\AppData\Local\{303E0E40-43D1-48BB-B7C7-BE3B5DB90BE3} folder moved successfully. C:\Users\FMA\AppData\Local\{50064236-A4E0-473C-9098-8AACF1889A65} folder moved successfully. C:\Users\FMA\AppData\Local\{84965A07-98BA-4115-B7CE-A1B723C2675D} folder moved successfully. C:\Users\FMA\AppData\Local\{93551238-6FF1-481C-9AAE-789D7E15460C} folder moved successfully. C:\Users\FMA\AppData\Local\{A2C3D65C-DAB4-4777-B09D-F578D6C1C11E} folder moved successfully. C:\Users\FMA\AppData\Local\{A1F380B3-B7B9-4BCE-A854-77EFAC2B4A77} folder moved successfully. C:\Users\FMA\AppData\Local\{112A35A9-AB66-429B-A9F0-9BB87FC6E054} folder moved successfully. C:\Users\FMA\AppData\Local\{594D8B49-CE0B-4766-91DC-690654B54A23} folder moved successfully. C:\Users\FMA\AppData\Local\{A2B14645-BF24-4A82-83BA-DB6F1538F151} folder moved successfully. C:\Users\FMA\AppData\Local\{9F80E477-7A14-46AA-931D-FBEA7F8E20DC} folder moved successfully. C:\Users\FMA\AppData\Local\{B70EFB43-9EC1-4FA1-B6C1-7465084A4A42} folder moved successfully. C:\Users\FMA\AppData\Local\{1ED81DDB-E0E6-4800-88FA-93E98CED032C} folder moved successfully. C:\Users\FMA\AppData\Local\{7CAE83AB-E9D2-4931-86A7-0451739515BF} folder moved successfully. C:\Users\FMA\AppData\Local\{BC4A059F-EFD7-4BD5-95E7-D79B79DD8C20} folder moved successfully. C:\Users\FMA\AppData\Local\{9E1EEFF0-787F-4137-B98F-143110F17B57} folder moved successfully. C:\Users\FMA\AppData\Local\{82514F2C-FEE2-423D-8E87-6B2035E19F48} folder moved successfully. C:\Users\FMA\AppData\Local\{430111FD-4107-462A-AC5C-A6B8627130B9} folder moved successfully. C:\Users\FMA\AppData\Local\{1CEBFCF9-64B5-4DDE-8FA7-053B170FB0AE} folder moved successfully. C:\Users\FMA\AppData\Local\{D90000CF-42A8-44CD-9348-C68BFC818FE4} folder moved successfully. C:\Users\FMA\AppData\Local\{B4A6BA8F-C544-4B14-93AA-1C13F495B2D1} folder moved successfully. C:\Users\FMA\AppData\Local\{551EFA1B-5728-4049-A5BA-4CD38E8F7ABC} folder moved successfully. C:\Users\FMA\AppData\Local\{8BAD9BA5-64A5-4BB4-9AD6-C049110DB8AD} folder moved successfully. C:\Users\FMA\AppData\Local\{875D4AC2-EB67-45E7-AE43-C28E0F7B0E0D} folder moved successfully. C:\Users\FMA\AppData\Local\{99BDE0A9-F928-43EB-88CA-6CED84458DCE} folder moved successfully. C:\Users\FMA\AppData\Local\{7402CF96-6E7E-4D77-B2C2-6F4D4B076905} folder moved successfully. C:\Users\FMA\AppData\Local\{2483A079-850E-46EC-A0D6-9ABD8F124A64} folder moved successfully. C:\Users\FMA\AppData\Local\{04224CB0-F9C5-405C-A60D-61C1AFB014C4} folder moved successfully. C:\Users\FMA\AppData\Local\{32F0DA1D-650D-4348-82A1-DE22E6D04A1A} folder moved successfully. C:\Users\FMA\AppData\Local\{53DAE278-292F-4791-96C5-124870C702D9} folder moved successfully. C:\Users\FMA\AppData\Local\{9F8361BB-1C26-438D-A09D-C08C84868128} folder moved successfully. C:\Users\FMA\AppData\Local\{33D0A000-98F1-4C76-AF38-EF0E9C3FB132} folder moved successfully. C:\Users\FMA\AppData\Local\{FD965C68-0975-468E-97FB-7FA515A04341} folder moved successfully. C:\Users\FMA\AppData\Local\{8DBC968F-9C9E-4849-A605-125097477933} folder moved successfully. C:\Users\FMA\AppData\Local\{402C62EC-20DA-43C3-AEC2-E226B53EB8A3} folder moved successfully. C:\Users\FMA\AppData\Local\{C3BF8980-0646-4300-ADF9-D4BC3ACD7F36} folder moved successfully. C:\Users\FMA\AppData\Local\{6980A2E9-C451-4A09-99EC-551AE7CA6938} folder moved successfully. C:\Users\FMA\AppData\Local\{F6F04298-6342-4078-B77F-2A304087C47D} folder moved successfully. C:\Users\FMA\AppData\Local\{146676E9-7711-47F2-ACFC-BE9B0AC6BEDC} folder moved successfully. C:\Users\FMA\AppData\Local\{647AEF39-A8FB-41A9-86C9-329397F7FA88} folder moved successfully. C:\Users\FMA\AppData\Local\{23ABB1A7-BD60-4C3E-9E1D-250F4C8BB298} folder moved successfully. C:\Users\FMA\AppData\Local\{0F0A0324-AB1F-4AE9-9DBC-A669C9A22AEE} folder moved successfully. C:\Users\FMA\AppData\Local\{9DFBD157-615B-4CAD-84E0-889A4EFA2FF3} folder moved successfully. C:\Users\FMA\AppData\Local\{975ED040-E707-43F7-AC95-1895EB6325B7} folder moved successfully. C:\Users\FMA\AppData\Local\{F3C6C843-FEC2-4F0A-84ED-F65C65BAF082} folder moved successfully. C:\Users\FMA\AppData\Local\{CE54AC92-CE55-4784-B42E-C747BC653786} folder moved successfully. C:\Users\FMA\AppData\Local\{23122C80-2112-4C4D-A681-E14999A5A5F9} folder moved successfully. C:\Users\FMA\AppData\Local\{81E48203-2351-473C-907A-7DEB2E0B0A49} folder moved successfully. C:\Users\FMA\AppData\Local\{F7AF1386-5400-4595-BDBB-C0A7A7D8DB25} folder moved successfully. C:\Users\FMA\AppData\Local\{5BEA63A4-882A-4C2A-A883-17AAC0D20644} folder moved successfully. C:\Users\FMA\AppData\Local\{AB31AE7D-E141-4ABB-A560-DCF831BB70FF} folder moved successfully. C:\Users\FMA\AppData\Local\{71CBF6AC-E2A1-4960-A834-B4F22C2AB957} folder moved successfully. C:\Users\FMA\AppData\Local\{DE07B435-91C9-4732-B8A4-6EA8762E286A} folder moved successfully. C:\Users\FMA\AppData\Local\{A48AEE2A-77C5-48D7-93D3-214F2D3F9E0C} folder moved successfully. C:\Users\FMA\AppData\Local\{04E8F6C0-9FFE-4E05-822B-22948BC9D4A8} folder moved successfully. C:\Users\FMA\AppData\Local\{316BE6A3-D32A-4983-92DE-3FCBE5AB7065} folder moved successfully. C:\Users\FMA\AppData\Local\{27E2985D-B1BB-4A15-B63D-BA21FE98D9E2} folder moved successfully. C:\Users\FMA\AppData\Local\{0BAC505C-6C8F-451A-90D2-CE6AF7643978} folder moved successfully. C:\Users\FMA\AppData\Local\{701381AC-6369-4AA0-A3CA-F58BFF89BA57} folder moved successfully. C:\Users\FMA\AppData\Local\{3B57D9FE-4062-4099-A4D7-BAE129F2998E} folder moved successfully. C:\Users\FMA\AppData\Local\{A5888738-67B9-4C7F-B222-1C52BBDDEAFA} folder moved successfully. C:\Users\FMA\AppData\Local\{0FE226A0-235B-401A-9A06-0AE1D42EB3A8} folder moved successfully. C:\Users\FMA\AppData\Local\{C64DC56B-530D-4CED-9744-BD820CB32BD0} folder moved successfully. Error: No service named Himpsrymm was found to stop! Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Himpsrymm deleted successfully. ADS C:\ProgramData\TEMP:9ABD7EE6 deleted successfully. ADS C:\ProgramData\TEMP:E4A69413 deleted successfully. ADS C:\ProgramData\TEMP:0CFF5F08 deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 56466 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: FMA ->Temp folder emptied: 85114361 bytes ->Temporary Internet Files folder emptied: 131348287 bytes ->Java cache emptied: 1 bytes ->FireFox cache emptied: 23297082 bytes ->Google Chrome cache emptied: 0 bytes ->Opera cache emptied: 0 bytes ->Flash cache emptied: 61881 bytes User: FMA2 User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 599684 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 49152 bytes Total Files Cleaned = 229.00 mb OTL by OldTimer - Version 3.2.57.0 log created on 08142012_065406 Files\Folders moved on Reboot… PendingFileRenameOperations files… Registry entries deleted on Reboot…
Post #10
That's all I'm seeing. Let's get an online scan as a double check.

Go here to run an online scanner from ESET.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan completes, press the LIST OF THREATS FOUND button
  • Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  • Include the contents of this report in your next reply.
  • Press the BACK button.
  • Press Finish
Post #11
Hi Tomk, It seems ZUGO originally cought by GooredFix is back! result of the ESETSCAN: C:\Qoobox\Quarantine\C\Program Files\Search Toolbar\SearchToolbar.dll.vir Win32/Toolbar.Zugo application C:\Qoobox\Quarantine\C\Program Files\Search Toolbar\SearchToolbarUpdater.exe.vir Win32/Toolbar.Zugo application Lasa
Post #12
Nope. Those are in the quarantine and already dealt with. How's things running now? Are you ready to clean up and get on with your regularly scheduled life?
Post #13
Quarintined sounds good to me. PC running great! Regularly schedualed life sounds good about now! lol Clean up sounds good as well. Lasa
Post #14
Time for some housekeeping
  • Click START then RUN
  • Now type ComboFix /Uninstall in the runbox and click OK.
  • Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]
The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.

  • Double click on OTL to run it.
  • Click on CleanUp!
  • When done, you will be prompted to restart your computer. Please restart your computer.

Please re-enable any security that was disabled.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:
Post #15
Thank you very much Tomk, Your patience with us less then computer savy people is very appreciated! My pc is running great! I thank you and "whatthetech" for that. You guys are awesome! Lasa ps: I won't hold you to it but what would you consider to be the "best" anitvirus/malware. I understand that each has its strengths and weaknesses but does any stand above the rest? I currently us MSE (always on) and malwarebytes once a week, and the combo has done well against everything but the fake security and this browser hijack.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI