OTL.TXT
OTL logfile created on: 11/28/2012 8:29:33 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Cynthia\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16438)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
4.00 Gb Total Physical Memory | 1.87 Gb Available Physical Memory | 46.87% Memory free
8.00 Gb Paging File | 5.90 Gb Available in Paging File | 73.77% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 320.68 Gb Total Space | 179.83 Gb Free Space | 56.08% Space Free | Partition Type: NTFS
Drive E: | 189.91 Gb Total Space | 189.27 Gb Free Space | 99.66% Space Free | Partition Type: NTFS
Drive F: | 925.70 Gb Total Space | 415.94 Gb Free Space | 44.93% Space Free | Partition Type: NTFS
Drive G: | 465.76 Gb Total Space | 348.56 Gb Free Space | 74.84% Space Free | Partition Type: NTFS
Drive M: | 150.88 Gb Total Space | 149.05 Gb Free Space | 98.79% Space Free | Partition Type: NTFS
Computer Name: OFFICE | User Name: Cynthia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\Cynthia\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe (Siber Systems)
PRC - C:\Program Files (x86)\PCPitstop\PCPitstopScheduleService.exe (PC Pitstop LLC)
PRC - C:\Program Files (x86)\PCPitstop\Info Center\InfoCenter.exe (PC Pitstop LLC)
PRC - C:\Program Files (x86)\Free Download Manager\fdm.exe (FreeDownloadManager.ORG)
PRC - C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis)
PRC - C:\Program Files (x86)\CyberPower PowerPanel Personal Edition\ppped.exe (Cyber Power Systems, Inc.)
PRC - C:\Program Files (x86)\CyberPower PowerPanel Personal Edition\pppeuser.exe (Cyber Power Systems, Inc.)
PRC - C:\Program Files (x86)\TechSmith\Snagit 9\TscHelp.exe (TechSmith Corporation)
PRC - C:\Program Files (x86)\TechSmith\Snagit 9\SnagPriv.exe (TechSmith Corporation)
PRC - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitEditor.exe (TechSmith Corporation)
PRC - C:\Program Files (x86)\TechSmith\Snagit 9\Snagit32.exe (TechSmith Corporation)
PRC - C:\Program Files (x86)\Stickies\stickies.exe (Zhorn Software)
========== Modules (No Company Name) ==========
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d040079bc7148afeca03c5abb6fc3c61\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\4e80768a2d88c7a333e43cbb7a6c0705\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\25e672ea505e50ab058258ac72a54f02\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\c64ca3678261c8ffcd9e7efd1af6ed54\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dd758ac0bf7358ac6e4720610fcc63c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\187d7c66735c533de851c76384f86912\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Free Download Manager\fdmbtsupp.dll ()
MOD - C:\Program Files (x86)\Free Download Manager\fdmumsp.dll ()
MOD - C:\Program Files (x86)\Free Download Manager\iefdm2.dll ()
MOD - C:\Program Files (x86)\TechSmith\Snagit 9\PDFNetC.dll ()
MOD - C:\Program Files (x86)\Stickies\shook45.dll ()
========== Services (SafeList) ==========
SRV:
64bit: - (PDEngine) – C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe File not found
SRV:
64bit: - (PDAgent) – C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe File not found
SRV:
64bit: - (NitroReaderDriverReadSpool2) – C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe (Nitro PDF Software)
SRV:
64bit: - (NisSrv) – C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV:
64bit: - (MsMpSvc) – C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV:
64bit: - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCore64.exe (SUPERAntiSpyware.com)
SRV:
64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (PCPitstop Scheduling) – C:\Program Files (x86)\PCPitstop\PCPitstopScheduleService.exe (PC Pitstop LLC)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe (McAfee, Inc.)
SRV - (nvUpdatusService) – C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Media Center 17 Service) – C:\Program Files (x86)\J River\Media Center 17\JRService.exe (JRiver, Inc.)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (afcdpsrv) – C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis)
SRV - (ppped) – C:\Program Files (x86)\CyberPower PowerPanel Personal Edition\ppped.exe (Cyber Power Systems, Inc.)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (CinemaNow Service) – C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe (CinemaNow, Inc.)
SRV - (ATTRcAppSvc) – C:\Program Files (x86)\AT&T;\Communication Manager\RcAppSvc.exe (SmithMicro Inc.)
SRV - (CAATT) – C:\Program Files (x86)\AT&T;\Communication Manager\ConAppsSvc.exe (SmithMicro Inc.)
SRV - (AcrSch2Svc) – C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (YahooAUService) – C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (EPSON_EB_RPCV4_01) – C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE (SEIKO EPSON CORPORATION)
SRV - (WcesComm) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (EPSON_PM_RPCV4_01) – C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE (SEIKO EPSON CORPORATION)
========== Driver Services (SafeList) ==========
DRV:
64bit: - (SANDRA) – C:\Program Files\SiSoftware\SiSoftware Sandra Professional Home 2011.SP1\WNt500x64\Sandra.sys File not found
DRV:
64bit: - (Point64) – C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:
64bit: - (NuidFltr) – C:\Windows\SysNative\drivers\nuidfltr.sys (Microsoft Corporation)
DRV:
64bit: - (dc3d) – C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation)
DRV:
64bit: - (avgtp) – C:\Windows\SysNative\drivers\avgtpx64.sys (AVG Technologies)
DRV:
64bit: - (NisDrv) – C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:
64bit: - (RdpVideoMiniport) – C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:
64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:
64bit: - (HssDRV6) – C:\Windows\SysNative\drivers\hssdrv6.sys (AnchorFree Inc.)
DRV:
64bit: - (taphss) – C:\Windows\SysNative\drivers\taphss.sys (AnchorFree Inc)
DRV:
64bit: - (NVHDA) – C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:
64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:
64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:
64bit: - (LMouFilt) – C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:
64bit: - (LHidFilt) – C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:
64bit: - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:
64bit: - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:
64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:
64bit: - (afcdp) – C:\Windows\SysNative\drivers\afcdp.sys (Acronis)
DRV:
64bit: - (tdrpman251) – C:\Windows\SysNative\drivers\tdrpm251.sys (Acronis)
DRV:
64bit: - (timounter) – C:\Windows\SysNative\drivers\timntr.sys (Acronis)
DRV:
64bit: - (snapman) – C:\Windows\SysNative\drivers\snapman.sys (Acronis)
DRV:
64bit: - (LADF_RenderOnly) – C:\Windows\SysNative\drivers\ladfGSRamd64.sys (Logitech)
DRV:
64bit: - (LADF_CaptureOnly) – C:\Windows\SysNative\drivers\ladfGSCamd64.sys (Logitech)
DRV:
64bit: - (AtiHDAudioService) – C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:
64bit: - (LADF_BakerCOnly) – C:\Windows\SysNative\drivers\ladfBakerCamd64.sys (Logitech)
DRV:
64bit: - (LADF_BakerROnly) – C:\Windows\SysNative\drivers\ladfBakerRamd64.sys (Logitech)
DRV:
64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:
64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:
64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:
64bit: - (fssfltr) – C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:
64bit: - (MRESP50a64) – C:\Program Files\Common Files\Motive\MRESP50a64.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV:
64bit: - (MREMP50a64) – C:\Program Files\Common Files\Motive\MREMP50a64.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV:
64bit: - (PxHlpa64) – C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:
64bit: - (acedrv11) – C:\Windows\SysNative\drivers\acedrv11.sys (Protect Software GmbH)
DRV:
64bit: - (AtiHdmiService) – C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:
64bit: - (Revoflt) – C:\Windows\SysNative\drivers\revoflt.sys (VS Revo Group)
DRV:
64bit: - (pwdrvio) – C:\Windows\SysNative\pwdrvio.sys ()
DRV:
64bit: - (pwdspio) – C:\Windows\SysNative\pwdspio.sys ()
DRV:
64bit: - (PCTINDIS5X64) – C:\Windows\SysNative\PCTINDIS5X64.sys (Smith Micro Inc.)
DRV:
64bit: - (LGVirHid) – C:\Windows\SysNative\drivers\LGVirHid.sys (Logitech Inc.)
DRV:
64bit: - (LGBusEnum) – C:\Windows\SysNative\drivers\LGBusEnum.sys (Logitech Inc.)
DRV:
64bit: - (SCDEmu) – C:\Windows\SysNative\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV:
64bit: - (DefragFS) – C:\Windows\SysNative\drivers\DefragFs.sys (Raxco Software, Inc.)
DRV:
64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:
64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:
64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:
64bit: - (usb_rndisx) – C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:
64bit: - (pavboot) – C:\Windows\SysNative\drivers\pavboot64.sys (Panda Security, S.L.)
DRV:
64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:
64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:
64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:
64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (MRESP50) – C:\Program Files (x86)\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MREMP50) – C:\Program Files (x86)\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:
64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:
64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE:
64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" =
http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKLM\..\SearchScopes\{597b1823-7ff0-4cd3-8095-9d8cba514992}: "URL" =
http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" =
http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\..\SearchScopes\{BE28C22E-F666-424d-B5FD-125C4AFEE34E}: "URL" = http://search.myheritage.com?orig=ds&q;={searchTerms}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.com/
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 9B 6C B7 DE 96 8E CA 01 [binary data]
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\..\SearchScopes,DefaultScope = {96F75758-1F08-4886-AFF3-C504EA57657A}
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE10SR
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\..\SearchScopes\{1BE304B9-EB46-457F-B213-AE41BDDDB706}: "URL" =
http://search.conduit.com/ResultsExt.aspx?…;ctid=CT3247201
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\..\SearchScopes\{37BE2764-F126-49CB-AEA5-2857156837A3}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE10SR
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\..\SearchScopes\{44816E91-C68A-2FF3-3D8F-8970062E5600}: "URL" =
http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" =
http://www.google.com/search?q={searchTerm…;rlz=1I7GPCK_en
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\..\SearchScopes\{93BC2328-3000-4A4E-A208-171252A9F3B4}: "URL" =
http://www.amazon.com/s?ie=UTF8&tag;=am…s={searchTerms}
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" =
https://isearch.avg.com/search?cid={FE5B7B5…mp;d=2012-09-10 16:56:56&v;=12.2.5.33&sap;=dsp&q;={searchTerms}
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\..\SearchScopes\{96F75758-1F08-4886-AFF3-C504EA57657A}: "URL" =
http://www.google.com/search?q={searchTerm…;rlz=1I7GPCK_en
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\..\SearchScopes\{BE28C22E-F666-424d-B5FD-125C4AFEE34E}: "URL" = http://search.myheritage.com?orig=ds&q;={searchTerms}
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\..\SearchScopes\{E6C82431-BE31-4325-92B5-2B9F9F419DD9}: "URL" =
http://www.nextag.com/goto.jsp?search={sea…rms}&p;=2828
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\..\SearchScopes\{F85506F1-B179-4AD2-AAF5-91DDE1CD5B27}: "URL" =
http://websearch.ask.com/redirect?client=i…51C84C2752&
IE - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF:
64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_110.dll File not found
FF:
64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:
64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:
64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files (x86)\Virtual Earth 3D\ File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@ei.WeatherBlink.com/Plugin: C:\Program Files (x86)\WeatherBlinkEI\Installr\2.bin\NPgcEISB.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro PDF\Reader\npnitromozilla.dll ( )
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandasecurity.com/activescan: C:\Program Files (x86)\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security, S.L.)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@nds.com/PCShowPlugin: C:\Users\Cynthia\AppData\Local\DIRECTV Player\npPCShowPlugin.dll (NDS)
FF - HKCU\Software\MozillaPlugins\@nds.com/PlayerPlugin: C:\Users\Cynthia\AppData\Local\DIRECTV Player\npPlayerPlugin.dll (NDS)
FF - HKCU\Software\MozillaPlugins\NDS.com/PlayerPlugin: C:\Users\Cynthia\AppData\Local\DIRECTV Player\npPlayerPlugin.dll (NDS)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: File not found
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION\ [2011/03/16 14:05:02 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}: C:\Program Files (x86)\SpeedBit Video Downloader\SPFireFox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor [2012/11/09 23:12:15 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\WeatherBlink\bar\1.bin
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files (x86)\Siber Systems\AI RoboForm\Firefox [2012/08/03 10:07:29 | 000,000,000 | —D | M]
[2012/08/20 11:32:03 | 000,000,000 | —D | M] (No name found) – C:\Users\Cynthia\AppData\Roaming\Mozilla\Extensions
[2010/03/02 16:49:21 | 000,000,000 | —D | M] (No name found) – C:\Users\Cynthia\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012/11/11 17:59:17 | 000,000,000 | —D | M] (No name found) – C:\Users\Cynthia\AppData\Roaming\Mozilla\Firefox\Profiles\0\extensions
[2012/11/11 17:59:16 | 000,213,316 | —- | M] () (No name found) – C:\Users\Cynthia\AppData\Roaming\Mozilla\Firefox\Profiles\0\extensions\[removed]
========== Chrome ==========
CHR - homepage:
http://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl;={language}&q;={searchTerms}&sugkey;={google:suggestAPIKeyParameter}
CHR - homepage:
http://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.64\pdf.dll
CHR - plugin: nphelper scriptable example plugin (Enabled) = C:\Users\Cynthia\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnfaglepmjgohnkcoieaijlheabmcdeo\1.2_0\nphelper.dll
CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Users\Cynthia\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.60.123.1_0\McChPlg.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin8.dll
CHR - plugin: AVG SiteSafety plugin (Enabled) = C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\12.2.6\\npsitesafety.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U9 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Nitro PDF Plug-In (Enabled) = C:\Program Files (x86)\Nitro PDF\Reader\npnitromozilla.dll
CHR - plugin: Panda ActiveScan 2.0 (Enabled) = C:\Program Files (x86)\Panda Security\ActiveScan 2.0\npwrapper.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: WeatherBlink Installer Plugin Stub (Enabled) = C:\Program Files (x86)\WeatherBlinkEI\Installr\2.bin\NPgcEISB.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: NDS PCShow Plugin (Enabled) = C:\Users\Cynthia\AppData\Local\DIRECTV Player\npPCShowPlugin.dll
CHR - plugin: PCShow Player Plugin (Enabled) = C:\Users\Cynthia\AppData\Local\DIRECTV Player\npPlayerPlugin.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll
CHR - plugin: Java Deployment Toolkit 7.0.90.5 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - Extension: Google Drive = C:\Users\Cynthia\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\
CHR - Extension: YouTube = C:\Users\Cynthia\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Cynthia\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: SiteAdvisor = C:\Users\Cynthia\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.60.123.1_0\
CHR - Extension: AVG Secure Search = C:\Users\Cynthia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\12.2.5.33_0\
CHR - Extension: Gmail = C:\Users\Cynthia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2012/11/27 21:18:48 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:
64bit: - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 9\DLLx64\SnagitBHO64.dll (TechSmith Corporation)
O2:
64bit: - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O2:
64bit: - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.
O2:
64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O2:
64bit: - BHO: (no name) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - No CLSID value found.
O2 - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitBHO.dll (TechSmith Corporation)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Qwiklinx) - {3E7C8B5A-96AB-438F-BF9B-782400655440} - C:\Users\Cynthia\AppData\Roaming\Qwiklinx\Qwiklinx.dll File not found
O2 - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\12.2.5.33\AVG Secure Search_toolbar.dll File not found
O2 - BHO: (no name) - {9b9dcae3-be34-424c-8d73-75e305a9e091} - No CLSID value found.
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Free Download Manager) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {dc9051c2-8f55-479a-97a4-747980d9047f} - No CLSID value found.
O2 - BHO: (Shop to Win) - {F9E44926-2497-46F3-8A25-928136AC079E} - C:\Program Files (x86)\Shop to Win 20\Shop to Win 20.dll File not found
O2 - BHO: (no name) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - No CLSID value found.
O3:
64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O3:
64bit: - HKLM\..\Toolbar: (&RoboForm; Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O3:
64bit: - HKLM\..\Toolbar: (Snagit) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 9\DLLx64\SnagitIEAddin64.dll (TechSmith Corporation)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (&RoboForm; Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (Snagit) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitIEAddin.dll (TechSmith Corporation)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\12.2.5.33\AVG Secure Search_toolbar.dll File not found
O3 - HKLM\..\Toolbar: (no name) - {f20de5e0-2a6e-4c54-985f-1cf59551ce39} - No CLSID value found.
O3:
64bit: - HKU\.DEFAULT\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3:
64bit: - HKU\S-1-5-18\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3:
64bit: - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O3 - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4:
64bit: - HKLM..\Run: [boincmgr] C:\Program Files\BOINC\boincmgr.exe (Space Sciences Laboratory)
O4:
64bit: - HKLM..\Run: [boinctray] C:\Program Files\BOINC\boinctray.exe (Space Sciences Laboratory)
O4:
64bit: - HKLM..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe (The Eraser Project)
O4:
64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (Microsoft Corporation)
O4:
64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4:
64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:
64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:
64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [Info Center] C:\Program Files (x86)\PCPitstop\Info Center\InfoCenter.exe (PC Pitstop LLC)
O4 - HKLM..\Run: [PowerPanel Personal Edition User Interaction] C:\Program Files (x86)\CyberPower PowerPanel Personal Edition\pppeuser.exe (Cyber Power Systems, Inc.)
O4 - HKU\.DEFAULT..\Run: [RoboForm] C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKU\S-1-5-18..\Run: [RoboForm] C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKU\S-1-5-21-3416148573-2493547136-111628057-1001..\Run: [Bidnapper Homelink] C:\Program Files (x86)\Bidnapper\Bidnapper Homelink\BidnapperHomelink.exe ()
O4 - HKU\S-1-5-21-3416148573-2493547136-111628057-1001..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe (The Eraser Project)
O4 - HKU\S-1-5-21-3416148573-2493547136-111628057-1001..\Run: [Free Download Manager] C:\Program Files (x86)\Free Download Manager\fdm.exe (FreeDownloadManager.ORG)
O4 - HKU\S-1-5-21-3416148573-2493547136-111628057-1001..\Run: [PCShowServer] C:\Users\Cynthia\AppData\Local\DIRECTV Player\PCShowServerPMWrapper.exe (NDS Technologies)
O4 - HKU\S-1-5-21-3416148573-2493547136-111628057-1001..\Run: [RoboForm] C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKU\S-1-5-21-3416148573-2493547136-111628057-1001..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Users\Cynthia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk = C:\Program Files\Rainmeter\Rainmeter.exe ()
O4 - Startup: C:\Users\Cynthia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stickies.lnk = C:\Program Files (x86)\Stickies\stickies.exe (Zhorn Software)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0
O7 - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecycleFiles = 1
O8:
64bit: - Extra context menu item: &ieSpell; Options - C:\Program Files (x86)\ieSpell\iespell.dll (Red Egg Software)
O8:
64bit: - Extra context menu item: Add to Google Photos Screensa&ver; - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:
64bit: - Extra context menu item: Check &Spelling; - C:\Program Files (x86)\ieSpell\iespell.dll (Red Egg Software)
O8:
64bit: - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8:
64bit: - Extra context menu item: Download all with Free Download Manager - C:\Program Files (x86)\Free Download Manager\dlall.htm ()
O8:
64bit: - Extra context menu item: Download selected with Free Download Manager - C:\Program Files (x86)\Free Download Manager\dlselected.htm ()
O8:
64bit: - Extra context menu item: Download video with Free Download Manager - C:\Program Files (x86)\Free Download Manager\dlfvideo.htm ()
O8:
64bit: - Extra context menu item: Download with Free Download Manager - C:\Program Files (x86)\Free Download Manager\dllink.htm ()
O8:
64bit: - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8:
64bit: - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found
O8:
64bit: - Extra context menu item: Lookup on Merriam Webster - C:\Program Files (x86)\ieSpell\Merriam Webster.HTM ()
O8:
64bit: - Extra context menu item: Lookup on Wikipedia - C:\Program Files (x86)\ieSpell\wikipedia.HTM ()
O8:
64bit: - Extra context menu item: RoboForm Editor - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComEditIdent.html ()
O8:
64bit: - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8:
64bit: - Extra context menu item: Set Fields - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSetFields.html ()
O8:
64bit: - Extra context menu item: Show RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8:
64bit: - Extra context menu item: Sync RoboForm Data - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSync.html ()
O8 - Extra context menu item: &ieSpell; Options - C:\Program Files (x86)\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Check &Spelling; - C:\Program Files (x86)\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Download all with Free Download Manager - C:\Program Files (x86)\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Download selected with Free Download Manager - C:\Program Files (x86)\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Download video with Free Download Manager - C:\Program Files (x86)\Free Download Manager\dlfvideo.htm ()
O8 - Extra context menu item: Download with Free Download Manager - C:\Program Files (x86)\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files (x86)\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files (x86)\ieSpell\wikipedia.HTM ()
O8 - Extra context menu item: RoboForm Editor - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComEditIdent.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: Set Fields - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSetFields.html ()
O8 - Extra context menu item: Show RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Sync RoboForm Data - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSync.html ()
O9:
64bit: - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:
64bit: - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:
64bit: - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:
64bit: - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:
64bit: - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:
64bit: - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files (x86)\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files (x86)\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files (x86)\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\..Trusted Domains: ask.com ([www] http in Local intranet)
O15 - HKU\S-1-5-21-3416148573-2493547136-111628057-1001\..Trusted Domains: google.com ([]http in Local intranet)
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} http://www.logitech.com/devicedetector/plu…Detection32.cab (Reg Error: Key error.)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94}
http://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab (PCPitstop Utility)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} http://cdn.scan.onecare.live.com/resource/…s/wlscctrl2.cab (Windows Live OneCare safety scanner control)
O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400}
http://www.myheritage.com/Genoogle/Compone…EngineQuery.dll (CSEQueryObject Object)
O16 - DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD}
http://utilities.pcpitstop.com/Exterminate…opAntiVirus.dll (Reg Error: Key error.)
O16 - DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7}
http://www.worldwinner.com/games/v41/freecell/freecell.cab (FreeCell Control)
O16 - DPF: {72376E32-8AF2-473F-BE32-E5D0F39C865D}
http://www.cyberlink.com/prog/win7/js/UpdateAdvisor.cab (CUpdateAdvisorCtrl Object)
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} http://www.worldwinner.com/games/shared/wwlaunch.cab (Wwlaunch Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {8F6E7FB2-E56B-4F66-A4E1-9765D2565280}
http://www.worldwinner.com/games/launcher/….0/iewwload.cab (WorldWinner ActiveX Launcher Control)
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913}
http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {BA35B9B8-DE9E-47C9-AFA7-3C77E3DDFD39}
http://www.worldwinner.com/games/v46/monopoly/monopoly.cab (Monopoly Control)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA}
http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044}
http://beach.sandestinwebcam.com/activex/AMC.cab (AxisMediaControlEmb Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D}
http://content.systemrequirementslab.com.s…ri_4.4.26.0.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{340BF911-9E4D-4D17-80AC-A1D58BC869F1}: DhcpNameServer = 192.168.1.254
O18:
64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O18:
64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O18:
64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O20:
64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:
64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:
64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 0
O34 - HKLM BootExecute: (autocheck autochk *)
O35:
64bit: - HKLM\..comfile [open] – "%1" %*
O35:
64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:
64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:
64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2012/11/28 20:27:25 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Cynthia\Desktop\OTL.exe
[2012/11/28 19:11:07 | 000,000,000 | —D | C] – C:\ProgramData\APN
[2012/11/28 09:33:22 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{880C2B9F-941A-42DB-8339-D1B88D68095A}
[2012/11/28 03:12:51 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/11/28 02:20:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
[2012/11/28 02:20:37 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Roaming\Uniblue
[2012/11/28 02:20:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Uniblue
[2012/11/27 21:21:21 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/11/27 20:24:54 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/11/27 20:24:54 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/11/27 20:24:54 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/11/27 20:24:37 | 000,000,000 | —D | C] – C:\Qoobox
[2012/11/27 20:23:59 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2012/11/27 08:26:28 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{AEC50FF9-9838-4B9E-905A-FEC3D8B6D9A8}
[2012/11/26 14:26:20 | 000,000,000 | —D | C] – C:\Config.Msi
[2012/11/26 14:06:38 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Roaming\SUPERAntiSpyware.com
[2012/11/26 14:06:31 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2012/11/26 14:06:29 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2012/11/26 14:06:29 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2012/11/26 08:46:55 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{1492B728-BDBF-4DF0-8F1A-3F5EE461B3F4}
[2012/11/25 20:46:43 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{85F6F42D-142C-4AF1-B3FB-4C3B507BCE70}
[2012/11/25 07:17:35 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{30A7079C-6238-4F00-ADF0-A10F0A744051}
[2012/11/23 21:46:06 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{25201E87-BF68-4B04-BE16-2F5C21EF7E24}
[2012/11/23 09:45:03 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{4231C187-68B1-4112-93BB-00CBE5EB1FE8}
[2012/11/22 21:44:13 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{C79D0F9D-6DA7-4553-9DAE-19730865178B}
[2012/11/22 09:44:01 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{F67004C7-7625-46A3-9FB8-361BF07C0600}
[2012/11/21 15:24:13 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{A084099C-4324-4408-94FB-14DB57B4AEAE}
[2012/11/21 15:09:46 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\Logitech
[2012/11/21 15:08:57 | 000,000,000 | —D | C] – C:\Program Files\Logitech Gaming Software
[2012/11/21 03:23:36 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{F8A6E68F-997F-406F-9888-2B317E5B3C72}
[2012/11/20 15:23:11 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{0E546C3F-DA19-413F-B813-DCEA11D43D23}
[2012/11/18 23:06:32 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{EFEEB4C2-598C-4C75-A8D4-20BF3672A636}
[2012/11/18 11:05:56 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{690ACE75-30F6-43C8-85EB-0FD3C3464939}
[2012/11/17 22:38:07 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012/11/17 21:36:24 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{1691A1F2-CE3E-47ED-94FD-81FBDA031B56}
[2012/11/17 09:36:01 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{2091CA9F-9241-4854-B66E-CC7A5693C2EC}
[2012/11/16 22:27:33 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\The Weather Channel
[2012/11/16 21:35:36 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{94381402-2262-4C09-A0DA-D5B252DED490}
[2012/11/16 09:35:24 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{B42B9C96-334D-4A10-9065-914B7B3AFDAE}
[2012/11/15 03:22:46 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{20EA800D-0DF1-4DD4-B60A-43EB3644A207}
[2012/11/14 04:50:33 | 000,726,160 | —- | C] (Realtek ) – C:\Windows\SysNative\drivers\Rt64win7.sys
[2012/11/14 03:48:36 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{95E60291-1310-4C47-A5E4-5241A8033AA1}
[2012/11/13 15:48:12 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{5305C3BC-D8ED-4525-A96D-5A5B7FCEAC52}
[2012/11/12 15:28:40 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{36488028-000C-437B-9BAB-B6F9D33B4C82}
[2012/11/11 19:50:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Ultimate Troubleshooter
[2012/11/11 19:50:20 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\eSellerate
[2012/11/11 18:10:59 | 000,000,000 | —D | C] – C:\Program Files (x86)\uTorrent
[2012/11/11 17:21:50 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012/11/11 17:13:47 | 000,000,000 | —D | C] – C:\Program Files (x86)\Java
[2012/11/11 16:42:52 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Mouse and Keyboard Center
[2012/11/11 16:41:09 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Mouse and Keyboard Center
[2012/11/11 11:10:28 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{E9E41445-6285-4B86-95AA-322E99D8C6A9}
[2012/11/10 23:09:44 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{EAA2CB8C-0A85-4C94-88CC-DE9ABB34C1EA}
[2012/11/10 17:12:48 | 000,000,000 | —D | C] – C:\Users\Cynthia\Desktop\Program Shortcuts
[2012/11/10 17:11:42 | 000,000,000 | —D | C] – C:\Users\Cynthia\Desktop\Trailer
[2012/11/10 16:52:26 | 000,000,000 | —D | C] – C:\Users\Cynthia\Desktop\Internet shortcuts
[2012/11/10 11:08:56 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{0203FBBD-0D82-4D64-90F4-8BB2074DD0BF}
[2012/11/09 23:08:30 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{EA11026F-1163-4CE7-8133-5A646F356DB8}
[2012/11/08 12:12:20 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{AEE4C028-EFF2-45CA-B8C1-07FBB86D25D8}
[2012/11/08 00:10:31 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{FB19F89C-DC64-463E-AF58-4F0F10AC0ACC}
[2012/11/07 12:10:07 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{F8EE9D44-C542-440E-81D2-C91CA8283921}
[2012/11/07 00:09:42 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{97D30092-A8F5-4A42-90FB-CFD63A85F2D5}
[2012/11/06 01:40:48 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{5B8FF134-C66F-47F2-B33E-E45A028B0D6E}
[2012/11/05 13:05:38 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{9FEB3107-4F28-4C60-B13C-66EAF73B8A5D}
[2012/11/05 01:05:15 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{D9074A04-B986-4169-9C79-F2E14600C321}
[2012/11/04 13:04:51 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{EBCB8FB6-B4EF-444B-AAC5-8D61601CD457}
[2012/11/04 01:04:11 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{3C1B8A87-290C-4ED0-88BC-D7B19DADB3AF}
[2012/11/03 13:03:46 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{BFE8AB7C-23A0-443B-95A3-93FF32BC87AE}
[2012/11/02 23:05:13 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{3C971BAC-0F34-411B-A8C9-9807BCDF938F}
[2012/11/02 10:43:06 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{9326F420-E7E5-4897-9EB4-8E221B24C992}
[2012/11/01 22:42:43 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{F7B9924A-9DA6-4C2A-A4BF-083A603E763E}
[2012/11/01 10:42:20 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{AD74C2CA-854E-466C-B22C-93AFDB4FE746}
[2012/10/31 22:42:08 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{2C1EE078-715D-4D53-ACE9-A352108EC612}
[2012/10/31 14:03:47 | 002,792,728 | —- | C] (Siber Systems) – C:\PortableRoboForm.exe
[2012/10/31 14:03:47 | 000,000,000 | —D | C] – C:\RoboForm
[2012/10/31 14:03:47 | 000,000,000 | —D | C] – C:\My RoboForm Data
[2012/10/31 10:41:44 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{408E8680-16DE-4065-928D-865F1C3588E5}
[2010/05/12 20:22:00 | 000,082,816 | —- | C] (VSO Software) – C:\Users\Cynthia\AppData\Roaming\pcouffin.sys
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Cynthia\AppData\Local\*.tmp files -> C:\Users\Cynthia\AppData\Local\*.tmp -> ]
[1 C:\Users\Cynthia\*.tmp files -> C:\Users\Cynthia\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012/11/28 20:27:10 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Cynthia\Desktop\OTL.exe
[2012/11/28 02:20:40 | 000,000,214 | —- | M] () – C:\Windows\tasks\SpeedUpMyPC.job
[2012/11/28 02:20:38 | 000,001,192 | —- | M] () – C:\Users\Cynthia\Application Data\Microsoft\Internet Explorer\Quick Launch\SpeedUpMyPC.lnk
[2012/11/28 02:20:38 | 000,001,144 | —- | M] () – C:\Users\Public\Desktop\SpeedUpMyPC.lnk
[2012/11/27 21:18:48 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2012/11/27 20:27:46 | 000,028,352 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/11/27 20:27:46 | 000,028,352 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/11/27 20:20:11 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/11/27 20:20:06 | 3220,037,632 | -HS- | M] () – C:\hiberfil.sys
[2012/11/27 06:30:12 | 000,001,953 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012/11/26 18:37:14 | 000,001,431 | —- | M] () – C:\Users\Cynthia\Desktop\Lydia.mp4 - Shortcut.lnk
[2012/11/25 14:32:38 | 000,002,351 | —- | M] () – C:\Users\Cynthia\Documents\RODEO LYRICS.rtf
[2012/11/25 14:26:28 | 000,444,885 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts_PTbackup2.bak
[2012/11/25 07:33:49 | 000,000,224 | —- | M] () – C:\Users\Cynthia\Desktop\A3 - Too Sick To Pray Lyrics.url
[2012/11/24 06:48:53 | 000,000,180 | —- | M] () – C:\Users\Cynthia\Desktop\Service Center Detail.url
[2012/11/22 10:52:12 | 000,941,189 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts_PTBackup.bak
[2012/11/22 01:16:08 | 000,007,355 | —- | M] () – C:\Users\Cynthia\Documents\Re_ Hi.eml
[2012/11/19 02:57:21 | 000,001,186 | —- | M] () – C:\Users\Cynthia\Documents\Jimmy.rtf
[2012/11/18 02:17:16 | 000,025,185 | —- | M] () – C:\Windows\SysWow64\ieuinit.inf
[2012/11/18 02:17:13 | 000,025,185 | —- | M] () – C:\Windows\SysNative\ieuinit.inf
[2012/11/17 22:39:46 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore1cdc546bca0a8f1.job
[2012/11/17 22:38:07 | 000,002,291 | —- | M] () – C:\Users\Cynthia\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/11/16 22:41:32 | 000,000,278 | —- | M] () – C:\Users\Cynthia\Desktop\WATCH Waterspout churn up waves (2).url
[2012/11/16 22:38:44 | 000,000,278 | —- | M] () – C:\Users\Cynthia\Desktop\WATCH Waterspout churn up waves.url
[2012/11/15 03:03:20 | 000,792,550 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/11/15 03:03:20 | 000,669,048 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/11/15 03:03:20 | 000,125,234 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/11/14 13:39:21 | 000,334,328 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/11/13 10:11:26 | 000,001,706 | —- | M] () – C:\Users\Cynthia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
[2012/11/13 03:14:48 | 000,000,221 | —- | M] () – C:\Users\Cynthia\Desktop\Clickomania Next Generation! (2).url
[2012/11/12 01:38:14 | 000,444,833 | R— | M] () – C:\Windows\SysNative\drivers\etc\hosts.20121121-100646.backup
[2012/11/11 19:50:23 | 000,001,233 | —- | M] () – C:\Users\Cynthia\Desktop\The Ultimate Troubleshooter.lnk
[2012/11/11 16:42:52 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_point64_01011.Wdf
[2012/11/11 16:41:58 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01011.Wdf
[2012/11/11 16:41:55 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Coinstaller_Critical.Wdf
[2012/11/11 05:33:14 | 000,000,240 | —- | M] () – C:\Users\Cynthia\Desktop\Apricot-Pecan Sweet Potatoes Recipe - Allrecipes.com.url
[2012/11/11 00:24:55 | 000,007,612 | —- | M] () – C:\Users\Cynthia\AppData\Local\Resmon.ResmonCfg
[2012/11/10 23:28:25 | 000,000,228 | —- | M] () – C:\Users\Cynthia\Desktop\Chat Window.url
[2012/11/10 14:41:52 | 000,000,182 | —- | M] () – C:\Users\Cynthia\Desktop\Womens Designer Leathers and Suedes Final Clearance Designer Clothing Clearance Lafayette 148 New York.url
[2012/11/09 00:23:20 | 000,000,196 | —- | M] () – C:\Users\Cynthia\Desktop\Novartis Keri Original Skin Lotion - 15 oz Pump Bottle.url
[2012/11/08 07:06:58 | 000,048,636 | —- | M] () – C:\Users\Cynthia\Documents\Life Sucks When You’re a Frog.eml
[2012/11/03 19:44:37 | 000,000,787 | —- | M] () – C:\Users\Cynthia\Documents\obama's vieiw of America..rtf
[2012/11/01 13:53:40 | 000,002,587 | —- | M] () – C:\Users\Cynthia\Documents\New Text Document.odt
[2012/11/01 13:52:30 | 000,000,517 | —- | M] () – C:\Users\Cynthia\Documents\New Text Document.rtf
[2012/10/31 15:18:13 | 000,000,236 | —- | M] () – C:\Users\Cynthia\Desktop\Clickomania Next Generation!.url
[2012/10/31 14:03:48 | 002,792,728 | —- | M] (Siber Systems) – C:\PortableRoboForm.exe
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Cynthia\AppData\Local\*.tmp files -> C:\Users\Cynthia\AppData\Local\*.tmp -> ]
[1 C:\Users\Cynthia\*.tmp files -> C:\Users\Cynthia\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012/11/28 02:20:40 | 000,000,214 | —- | C] () – C:\Windows\tasks\SpeedUpMyPC.job
[2012/11/28 02:20:38 | 000,001,192 | —- | C] () – C:\Users\Cynthia\Application Data\Microsoft\Internet Explorer\Quick Launch\SpeedUpMyPC.lnk
[2012/11/28 02:20:38 | 000,001,144 | —- | C] () – C:\Users\Public\Desktop\SpeedUpMyPC.lnk
[2012/11/27 20:24:54 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/11/27 20:24:54 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/11/27 20:24:54 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/11/27 20:24:54 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/11/27 20:24:54 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/11/26 18:37:14 | 000,001,431 | —- | C] () – C:\Users\Cynthia\Desktop\Lydia.mp4 - Shortcut.lnk
[2012/11/26 14:06:31 | 000,001,953 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012/11/25 14:32:38 | 000,002,351 | —- | C] () – C:\Users\Cynthia\Documents\RODEO LYRICS.rtf
[2012/11/25 07:33:49 | 000,000,224 | —- | C] () – C:\Users\Cynthia\Desktop\A3 - Too Sick To Pray Lyrics.url
[2012/11/24 06:48:53 | 000,000,180 | —- | C] () – C:\Users\Cynthia\Desktop\Service Center Detail.url
[2012/11/22 01:16:08 | 000,007,355 | —- | C] () – C:\Users\Cynthia\Documents\Re_ Hi.eml
[2012/11/19 02:57:21 | 000,001,186 | —- | C] () – C:\Users\Cynthia\Documents\Jimmy.rtf
[2012/11/18 02:17:16 | 000,025,185 | —- | C] () – C:\Windows\SysWow64\ieuinit.inf
[2012/11/18 02:17:13 | 000,025,185 | —- | C] () – C:\Windows\SysNative\ieuinit.inf
[2012/11/17 22:39:46 | 000,000,894 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore1cdc546bca0a8f1.job
[2012/11/17 22:38:07 | 000,002,291 | —- | C] () – C:\Users\Cynthia\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/11/16 22:41:32 | 000,000,278 | —- | C] () – C:\Users\Cynthia\Desktop\WATCH Waterspout churn up waves (2).url
[2012/11/16 22:38:44 | 000,000,278 | —- | C] () – C:\Users\Cynthia\Desktop\WATCH Waterspout churn up waves.url
[2012/11/14 11:17:30 | 000,000,003 | —- | C] () – C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012/11/13 03:14:48 | 000,000,221 | —- | C] () – C:\Users\Cynthia\Desktop\Clickomania Next Generation! (2).url
[2012/11/11 19:50:23 | 000,001,233 | —- | C] () – C:\Users\Cynthia\Desktop\The Ultimate Troubleshooter.lnk
[2012/11/11 16:42:52 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_point64_01011.Wdf
[2012/11/11 16:41:58 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01011.Wdf
[2012/11/11 16:41:55 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Coinstaller_Critical.Wdf
[2012/11/11 16:41:33 | 000,000,003 | —- | C] () – C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012/11/11 05:33:14 | 000,000,240 | —- | C] () – C:\Users\Cynthia\Desktop\Apricot-Pecan Sweet Potatoes Recipe - Allrecipes.com.url
[2012/11/10 23:28:24 | 000,000,228 | —- | C] () – C:\Users\Cynthia\Desktop\Chat Window.url
[2012/11/10 14:41:52 | 000,000,182 | —- | C] () – C:\Users\Cynthia\Desktop\Womens Designer Leathers and Suedes Final Clearance Designer Clothing Clearance Lafayette 148 New York.url
[2012/11/09 00:23:20 | 000,000,196 | —- | C] () – C:\Users\Cynthia\Desktop\Novartis Keri Original Skin Lotion - 15 oz Pump Bottle.url
[2012/11/08 07:06:57 | 000,048,636 | —- | C] () – C:\Users\Cynthia\Documents\Life Sucks When You’re a Frog.eml
[2012/11/03 19:44:36 | 000,000,787 | —- | C] () – C:\Users\Cynthia\Documents\obama's vieiw of America..rtf
[2012/11/01 13:53:40 | 000,002,587 | —- | C] () – C:\Users\Cynthia\Documents\New Text Document.odt
[2012/10/31 15:18:13 | 000,000,236 | —- | C] () – C:\Users\Cynthia\Desktop\Clickomania Next Generation!.url
[2012/10/21 08:06:58 | 000,229,028 | —- | C] () – C:\Users\Cynthia\Hell_Awaits_backwards.ogg
[2012/07/18 01:02:15 | 635,836,575 | —- | C] () – C:\Users\Cynthia\1Ya02628
[2012/06/01 13:51:50 | 000,000,022 | -HS- | C] () – C:\Users\Cynthia\AppData\Roaming\Windows1569_SettingsRepository.bin
[2012/06/01 13:51:50 | 000,000,022 | -HS- | C] () – C:\Windows\90C7D912BE2316.sys
[2012/05/24 20:44:34 | 000,000,076 | —- | C] () – C:\Windows\SysWow64\w3url.dll
[2012/05/22 01:07:49 | 588,814,860 | —- | C] () – C:\Users\Cynthia\Downloads.zip
[2012/05/08 07:58:06 | 000,000,030 | —- | C] () – C:\Windows\SysWow64\conquests.ini
[2012/02/05 06:50:22 | 234,021,979 | —- | C] () – C:\Users\Cynthia\Documents.7z
[2012/02/05 06:47:05 | 342,735,128 | —- | C] () – C:\Users\Cynthia\Downloads.7z
[2011/12/27 10:44:32 | 000,001,449 | —- | C] () – C:\Windows\wininit.ini
[2011/10/02 08:44:56 | 000,000,128 | —- | C] () – C:\ProgramData\sandra.ldb
[2011/09/28 16:44:14 | 000,179,271 | —- | C] () – C:\Windows\SysWow64\xlive.dll.cat
[2011/08/09 17:26:04 | 000,022,092 | —- | C] () – C:\Windows\SysWow64\aaxsiu.dll
[2011/06/24 13:17:18 | 000,058,702 | —- | C] () – C:\Users\Cynthia\Total Points.mht
[2011/06/14 06:30:21 | 000,007,612 | —- | C] () – C:\Users\Cynthia\AppData\Local\Resmon.ResmonCfg
[2011/06/11 18:14:16 | 000,003,929 | —- | C] () – C:\Windows\SysWow64\atipblag.dat
[2011/05/25 07:43:01 | 000,005,632 | —- | C] () – C:\Users\Cynthia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/05 00:28:10 | 000,059,904 | —- | C] () – C:\Windows\SysWow64\OVDecode.dll
[2011/04/07 11:38:24 | 000,000,193 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc
[2011/03/16 13:57:58 | 000,789,710 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/03/16 13:54:23 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2011/02/18 23:32:14 | 000,000,022 | -HS- | C] () – C:\Users\Cynthia\AppData\Roaming\Sys2662.Config.Repository.bin
[2010/09/20 04:27:14 | 000,011,124 | —- | C] () – C:\Users\Cynthia\mural.jpg
[2010/08/30 06:14:27 | 000,055,203 | —- | C] () – C:\Users\Cynthia\s-cape-handwand_page1_image1.jpg
[2010/08/30 06:07:57 | 000,107,519 | —- | C] () – C:\Users\Cynthia\s-cape-handwand.pdf
[2010/05/12 20:22:00 | 000,007,859 | —- | C] () – C:\Users\Cynthia\AppData\Roaming\pcouffin.cat
[2010/05/12 20:22:00 | 000,001,167 | —- | C] () – C:\Users\Cynthia\AppData\Roaming\pcouffin.inf
[2010/04/20 20:33:13 | 000,001,016 | —- | C] () – C:\Users\Cynthia\bludisk.gif
[2010/01/11 10:06:18 | 000,018,565 | —- | C] () – C:\Users\Cynthia\AppData\Roaming\UserTile.png
========== ZeroAccess Check ==========
[2009/07/13 22:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/08 23:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 22:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 19:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 03:19:04 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 19:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2011/03/16 14:09:16 | 000,000,000 | —D | M] – C:\Users\Administrator\AppData\Roaming\Spearit
[2010/03/02 16:47:49 | 000,000,000 | —D | M] – C:\Users\Administrator\AppData\Roaming\uTorrent
[2011/03/16 14:10:29 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Acoustica
[2011/03/16 14:10:30 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Acronis
[2011/06/28 00:09:18 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Activision
[2011/04/20 19:38:53 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\AnvSoft
[2012/03/26 21:57:11 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Artifex Mundi
[2011/03/16 14:10:30 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Atari
[2012/02/24 16:04:25 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Audacity
[2011/03/16 14:10:30 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Auslogics
[2012/01/22 13:09:39 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\BigHugeEngine
[2011/03/16 14:10:30 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Bridge Baron 19
[2012/05/05 16:52:03 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Bridge Baron 20
[2012/05/07 20:49:25 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Bridge Baron 22
[2011/05/06 16:54:54 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\BVS Solitaire Collection
[2011/04/20 20:51:30 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\CA614908-B35E-4FF8-B745-C40CE682AE14
[2011/10/24 12:21:11 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\casualArts
[2011/03/16 14:10:31 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Catalina Marketing Corp
[2011/07/25 10:10:21 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\CBS Interactive
[2012/08/19 11:08:14 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\com.bwsf.DragonAgeLegends
[2011/04/13 20:09:09 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\com.desktube.desktube-tv-lite
[2011/10/08 12:28:28 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\CursedOnboard
[2011/03/16 14:10:31 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\DassaultSystemes
[2012/09/27 18:44:42 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Downloaded Installations
[2011/03/16 14:10:31 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\DriverFinder
[2012/06/21 12:24:53 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\EasyDuplicateFinder
[2011/04/20 19:51:52 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\EE1C4149-A74C-4EA3-A8B6-6C4CA4F25AB6
[2011/03/16 14:10:31 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\EPSON
[2012/11/28 20:34:55 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Free Download Manager
[2011/11/13 13:30:58 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\GetRightToGo
[2011/03/16 14:10:31 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\GlarySoft
[2012/09/19 12:37:04 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\GOG.com
[2011/03/16 14:10:31 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\GoodSync
[2011/03/16 14:10:31 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Graboid Inc
[2012/09/01 09:58:14 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\HandBrake
[2011/03/16 14:10:31 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Highresolution Enterprises
[2012/04/22 13:13:32 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\ieSpell
[2012/01/16 10:16:37 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\ImgBurn
[2011/03/16 14:10:31 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\IObit
[2012/09/17 00:20:47 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\IrfanView
[2011/07/05 20:41:21 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\iShell
[2012/06/29 21:35:38 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\J River
[2011/03/16 14:10:31 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Jeyo
[2011/03/16 14:10:32 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Leadertech
[2011/05/20 23:20:20 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Lionhead Studios
[2011/03/16 14:10:32 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Marine Aquarium 3
[2011/12/05 11:25:14 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\MAXON
[2011/11/07 16:17:21 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Might & Magic Heroes VI
[2012/11/28 02:21:04 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Nitro PDF
[2011/03/16 14:10:38 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\OpenOffice.org
[2011/06/19 21:52:50 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\ProtectDISC
[2012/11/03 12:42:51 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Rainmeter
[2011/10/22 15:30:03 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\RoboForm
[2011/03/16 14:10:40 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\ScripterRon
[2010/07/08 00:33:12 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\SEGA Corporation
[2011/03/16 14:10:40 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Sierra Wireless
[2011/07/26 20:26:39 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Soluto
[2011/03/16 14:10:40 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Spearit
[2011/04/25 21:06:28 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Stardock
[2012/11/27 06:24:48 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\stickies
[2011/06/18 22:26:39 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\STV Software
[2012/01/09 11:12:34 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\System
[2011/12/09 06:19:15 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\TFS2
[2011/03/16 14:10:40 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Thunderbird
[2012/09/13 05:47:04 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\TuneUp Software
[2012/11/28 02:20:37 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Uniblue
[2012/08/12 10:46:47 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Vso
[2011/06/28 08:15:24 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Windows Live Writer
[2012/01/09 13:13:54 | 000,000,000 | -HSD | M] – C:\Users\Cynthia\AppData\Roaming\wyUpdate AU
[2011/03/16 14:10:45 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\YoudaGames
[2011/11/04 18:46:57 | 000,000,000 | —D | M] – C:\Users\Cynthia\AppData\Roaming\Zoner
========== Purity Check ==========
========== Custom Scans ==========
< MD5 for: EXPLORER.EXE >
[2011/02/26 00:23:14 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/25 23:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 19:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/25 23:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2011/02/25 23:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 00:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\erdnt\cache86\explorer.exe
[2011/02/25 00:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011/02/25 00:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 00:14:34 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 04:17:10 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\dacbe03deb0caa9247dad9\95c338d19a537e59104178584019\78ca6e9211b88b968b\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2010/11/20 03:17:10 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/02/24 23:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011/02/24 23:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/20 05:24:46 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\dacbe03deb0caa9247dad9\95c338d19a537e59104178584019\78ca6e9211b88b968b\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2010/11/20 04:24:46 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009/07/13 19:39:10 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2011/02/26 00:26:45 | 002,870,784 | —- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
< MD5 for: SVCHOST.EXE >
[2009/07/13 19:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\erdnt\cache86\svchost.exe
[2009/07/13 19:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\SysWOW64\svchost.exe
[2009/07/13 19:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2012/09/29 19:54:26 | 000,218,184 | —- | M] () MD5=8846E87210AD131CF71E3E2E49F647B0 – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2009/07/13 19:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\erdnt\cache64\svchost.exe
[2009/07/13 19:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\SysNative\svchost.exe
[2009/07/13 19:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe
< MD5 for: USERINIT.EXE >
[2010/11/20 04:17:50 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\dacbe03deb0caa9247dad9\95c338d19a537e59104178584019\78ca6e9211b88b968b\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010/11/20 03:17:50 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\erdnt\cache86\userinit.exe
[2010/11/20 03:17:50 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\SysWOW64\userinit.exe
[2010/11/20 03:17:50 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 19:14:43 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/13 19:39:48 | 000,030,208 | —- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 05:25:26 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\dacbe03deb0caa9247dad9\95c338d19a537e59104178584019\78ca6e9211b88b968b\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
[2010/11/20 04:25:26 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\erdnt\cache64\userinit.exe
[2010/11/20 04:25:26 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\SysNative\userinit.exe
[2010/11/20 04:25:26 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
< MD5 for: WINLOGON.EXE >
[2010/11/20 05:25:32 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\dacbe03deb0caa9247dad9\95c338d19a537e59104178584019\78ca6e9211b88b968b\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2010/11/20 04:25:32 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\erdnt\cache64\winlogon.exe
[2010/11/20 04:25:32 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SysNative\winlogon.exe
[2010/11/20 04:25:32 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/13 19:39:52 | 000,389,120 | —- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012/09/29 19:54:26 | 000,218,184 | —- | M] () MD5=8846E87210AD131CF71E3E2E49F647B0 – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
========== Alternate Data Streams ==========
@Alternate Data Stream - 985 bytes -> C:\Users\Cynthia\Documents\if you were an Elvis fan——YOU'LL LOVE THIS!!!!!!!!!!.eml:OECustomProperty
@Alternate Data Stream - 885 bytes -> C:\Users\Cynthia\Documents\Life Sucks When You’re a Frog.eml:OECustomProperty
@Alternate Data Stream - 849 bytes -> C:\Users\Cynthia\Documents\Fw_ NASHVILLE FLOOD PICTURES.eml:OECustomProperty
@Alternate Data Stream - 809 bytes -> C:\Users\Cynthia\Documents\Fw_ Forgotten photos.eml:OECustomProperty
@Alternate Data Stream - 801 bytes -> C:\Users\Cynthia\Documents\Fw_ EVER SEEN CAVIAR_.eml:OECustomProperty
@Alternate Data Stream - 747 bytes -> C:\Users\Cynthia\Documents\National Association of Federal Credit Union.eml:OECustomProperty
@Alternate Data Stream - 676 bytes -> C:\Users\Cynthia\Documents\Re_ Hi.eml:OECustomProperty
@Alternate Data Stream - 648 bytes -> C:\Users\Cynthia\Documents\longest email to molllie.eml:OECustomProperty
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:D2F2F703
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:9812B773
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:0988A428
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:C946EBB2
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:BBC9C1EB
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:774C075A
@Alternate Data Stream - 1096 bytes -> C:\Users\Cynthia\Documents\moterized bike.eml:OECustomProperty
@Alternate Data Stream - 1089 bytes -> C:\Users\Cynthia\Documents\Fw_ Fwd_ Fw_ Fwd_ Fw_ Biden may be interim president by the end of 2012.eml:OECustomProperty
< End of report >
My name is![[external image: Posted Image]](http://i1224.photobucket.com/albums/ee380/jeffce74/aswmbrscan.jpg){kind=link}