view.atdmt.com and other spyware babylon toolbar and zugo [Solved]

Did that and here is the OTL.txt

OTL logfile created on: 11/30/2012 10:33:06 AM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Cynthia\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16438)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 1.99 Gb Available Physical Memory | 49.83% Memory free
8.00 Gb Paging File | 5.72 Gb Available in Paging File | 71.54% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 320.68 Gb Total Space | 178.70 Gb Free Space | 55.73% Space Free | Partition Type: NTFS
Drive D: | 149.49 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive E: | 189.91 Gb Total Space | 189.27 Gb Free Space | 99.66% Space Free | Partition Type: NTFS
Drive F: | 925.70 Gb Total Space | 415.94 Gb Free Space | 44.93% Space Free | Partition Type: NTFS
Drive G: | 465.76 Gb Total Space | 348.56 Gb Free Space | 74.84% Space Free | Partition Type: NTFS
Drive I: | 6.67 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive K: | 1.90 Gb Total Space | 1.68 Gb Free Space | 88.41% Space Free | Partition Type: FAT
Drive M: | 150.88 Gb Total Space | 149.06 Gb Free Space | 98.79% Space Free | Partition Type: NTFS

Computer Name: OFFICE | User Name: Cynthia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Cynthia\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe (Siber Systems)
PRC - C:\Program Files (x86)\PCPitstop\PCPitstopScheduleService.exe (PC Pitstop LLC)
PRC - C:\Program Files (x86)\PCPitstop\Info Center\InfoCenter.exe (PC Pitstop LLC)
PRC - C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe (Logitech Inc.)
PRC - C:\Users\Cynthia\AppData\Local\DIRECTV Player\PCShowServerPMWrapper.exe (NDS Technologies)
PRC - C:\Users\Cynthia\AppData\Local\DIRECTV Player\NDSPCShowServer.exe ()
PRC - C:\Program Files (x86)\Free Download Manager\fdm.exe (FreeDownloadManager.ORG)
PRC - C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis)
PRC - C:\Program Files (x86)\CyberPower PowerPanel Personal Edition\ppped.exe (Cyber Power Systems, Inc.)
PRC - C:\Program Files (x86)\CyberPower PowerPanel Personal Edition\pppeuser.exe (Cyber Power Systems, Inc.)
PRC - C:\Program Files (x86)\Bidnapper\Bidnapper Homelink\BidnapperHomelink.exe ()
PRC - C:\Program Files (x86)\TechSmith\Snagit 9\TscHelp.exe (TechSmith Corporation)
PRC - C:\Program Files (x86)\TechSmith\Snagit 9\SnagPriv.exe (TechSmith Corporation)
PRC - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitEditor.exe (TechSmith Corporation)
PRC - C:\Program Files (x86)\TechSmith\Snagit 9\Snagit32.exe (TechSmith Corporation)
PRC - C:\Program Files (x86)\Stickies\stickies.exe (Zhorn Software)


========== Modules (No Company Name) ==========

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d040079bc7148afeca03c5abb6fc3c61\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\4e80768a2d88c7a333e43cbb7a6c0705\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dd758ac0bf7358ac6e4720610fcc63c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\187d7c66735c533de851c76384f86912\mscorlib.ni.dll ()
MOD - C:\Users\Cynthia\AppData\Local\DIRECTV Player\z.dll ()
MOD - C:\Users\Cynthia\AppData\Local\DIRECTV Player\libxml2-2.dll ()
MOD - C:\Users\Cynthia\AppData\Local\DIRECTV Player\libgstreamer-0.10.dll ()
MOD - C:\Users\Cynthia\AppData\Local\DIRECTV Player\gsttspplugin.dll ()
MOD - C:\Users\Cynthia\AppData\Local\DIRECTV Player\ndsLogStore.dll ()
MOD - C:\Users\Cynthia\AppData\Local\DIRECTV Player\boost_thread-vc90-mt-1_39.dll ()
MOD - C:\Users\Cynthia\AppData\Local\DIRECTV Player\XferManagerDll.dll ()
MOD - C:\Users\Cynthia\AppData\Local\DIRECTV Player\TSB.dll ()
MOD - C:\Users\Cynthia\AppData\Local\DIRECTV Player\PCShowServerDll.dll ()
MOD - C:\Users\Cynthia\AppData\Local\DIRECTV Player\NDSPCShowServer.exe ()
MOD - C:\Users\Cynthia\AppData\Local\DIRECTV Player\DrmSingleton.dll ()
MOD - C:\Users\Cynthia\AppData\Local\DIRECTV Player\CatalogDll.dll ()
MOD - C:\Program Files (x86)\Free Download Manager\fdmbtsupp.dll ()
MOD - C:\Program Files (x86)\Free Download Manager\fdmumsp.dll ()
MOD - C:\Program Files (x86)\Free Download Manager\iefdm2.dll ()
MOD - C:\Program Files (x86)\Bidnapper\Bidnapper Homelink\BidnapperHomelink.exe ()
MOD - C:\Program Files (x86)\TechSmith\Snagit 9\PDFNetC.dll ()
MOD - C:\Program Files (x86)\Bidnapper\Bidnapper Homelink\QxtCrypto.dll ()
MOD - C:\Program Files (x86)\Bidnapper\Bidnapper Homelink\imageformats\qgif4.dll ()
MOD - C:\Program Files (x86)\Bidnapper\Bidnapper Homelink\imageformats\qjpeg4.dll ()
MOD - C:\Program Files (x86)\Bidnapper\Bidnapper Homelink\QtWebKit4.dll ()
MOD - C:\Program Files (x86)\Bidnapper\Bidnapper Homelink\phonon4.dll ()
MOD - C:\Program Files (x86)\Bidnapper\Bidnapper Homelink\QtGui4.dll ()
MOD - C:\Program Files (x86)\Bidnapper\Bidnapper Homelink\QtNetwork4.dll ()
MOD - C:\Program Files (x86)\Bidnapper\Bidnapper Homelink\QtXml4.dll ()
MOD - C:\Program Files (x86)\Bidnapper\Bidnapper Homelink\QtCore4.dll ()
MOD - C:\Program Files (x86)\Stickies\shook45.dll ()


========== Services (SafeList) ==========

SRV:64bit: - (PDEngine) – C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe File not found
SRV:64bit: - (PDAgent) – C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe File not found
SRV:64bit: - (NitroReaderDriverReadSpool2) – C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe (Nitro PDF Software)
SRV:64bit: - (NisSrv) – C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCore64.exe (SUPERAntiSpyware.com)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (PCPitstop Scheduling) – C:\Program Files (x86)\PCPitstop\PCPitstopScheduleService.exe (PC Pitstop LLC)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe (McAfee, Inc.)
SRV - (nvUpdatusService) – C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Media Center 17 Service) – C:\Program Files (x86)\J River\Media Center 17\JRService.exe (JRiver, Inc.)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (afcdpsrv) – C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis)
SRV - (ppped) – C:\Program Files (x86)\CyberPower PowerPanel Personal Edition\ppped.exe (Cyber Power Systems, Inc.)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (CinemaNow Service) – C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe (CinemaNow, Inc.)
SRV - (ATTRcAppSvc) – C:\Program Files (x86)\AT&T;\Communication Manager\RcAppSvc.exe (SmithMicro Inc.)
SRV - (CAATT) – C:\Program Files (x86)\AT&T;\Communication Manager\ConAppsSvc.exe (SmithMicro Inc.)
SRV - (AcrSch2Svc) – C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (YahooAUService) – C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (EPSON_EB_RPCV4_01) – C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE (SEIKO EPSON CORPORATION)
SRV - (WcesComm) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (EPSON_PM_RPCV4_01) – C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE (SEIKO EPSON CORPORATION)


========== Driver Services (SafeList) ==========

DRV:64bit: - (SANDRA) – C:\Program Files\SiSoftware\SiSoftware Sandra Professional Home 2011.SP1\WNt500x64\Sandra.sys File not found
DRV:64bit: - (Point64) – C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:64bit: - (NuidFltr) – C:\Windows\SysNative\drivers\nuidfltr.sys (Microsoft Corporation)
DRV:64bit: - (dc3d) – C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation)
DRV:64bit: - (avgtp) – C:\Windows\SysNative\drivers\avgtpx64.sys (AVG Technologies)
DRV:64bit: - (NisDrv) – C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) – C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (HssDRV6) – C:\Windows\SysNative\drivers\hssdrv6.sys (AnchorFree Inc.)
DRV:64bit: - (taphss) – C:\Windows\SysNative\drivers\taphss.sys (AnchorFree Inc)
DRV:64bit: - (NVHDA) – C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (LMouFilt) – C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LHidFilt) – C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (afcdp) – C:\Windows\SysNative\drivers\afcdp.sys (Acronis)
DRV:64bit: - (tdrpman251) – C:\Windows\SysNative\drivers\tdrpm251.sys (Acronis)
DRV:64bit: - (timounter) – C:\Windows\SysNative\drivers\timntr.sys (Acronis)
DRV:64bit: - (snapman) – C:\Windows\SysNative\drivers\snapman.sys (Acronis)
DRV:64bit: - (LADF_RenderOnly) – C:\Windows\SysNative\drivers\ladfGSRamd64.sys (Logitech)
DRV:64bit: - (LADF_CaptureOnly) – C:\Windows\SysNative\drivers\ladfGSCamd64.sys (Logitech)
DRV:64bit: - (AtiHDAudioService) – C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (LADF_BakerCOnly) – C:\Windows\SysNative\drivers\ladfBakerCamd64.sys (Logitech)
DRV:64bit: - (LADF_BakerROnly) – C:\Windows\SysNative\drivers\ladfBakerRamd64.sys (Logitech)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (MRESP50a64) – C:\Program Files\Common Files\Motive\MRESP50a64.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV:64bit: - (MREMP50a64) – C:\Program Files\Common Files\Motive\MREMP50a64.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (acedrv11) – C:\Windows\SysNative\drivers\acedrv11.sys (Protect Software GmbH)
DRV:64bit: - (AtiHdmiService) – C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (Revoflt) – C:\Windows\SysNative\drivers\revoflt.sys (VS Revo Group)
DRV:64bit: - (pwdrvio) – C:\Windows\SysNative\pwdrvio.sys ()
DRV:64bit: - (pwdspio) – C:\Windows\SysNative\pwdspio.sys ()
DRV:64bit: - (PCTINDIS5X64) – C:\Windows\SysNative\PCTINDIS5X64.sys (Smith Micro Inc.)
DRV:64bit: - (LGVirHid) – C:\Windows\SysNative\drivers\LGVirHid.sys (Logitech Inc.)
DRV:64bit: - (LGBusEnum) – C:\Windows\SysNative\drivers\LGBusEnum.sys (Logitech Inc.)
DRV:64bit: - (SCDEmu) – C:\Windows\SysNative\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV:64bit: - (DefragFS) – C:\Windows\SysNative\drivers\DefragFs.sys (Raxco Software, Inc.)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (usb_rndisx) – C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (pavboot) – C:\Windows\SysNative\drivers\pavboot64.sys (Panda Security, S.L.)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (MRESP50) – C:\Program Files (x86)\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MREMP50) – C:\Program Files (x86)\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\..\SearchScopes\{BE28C22E-F666-424d-B5FD-125C4AFEE34E}: "URL" = http://search.myheritage.com?orig=ds&q;={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\SearchScopes,DefaultScope = {96F75758-1F08-4886-AFF3-C504EA57657A}
IE - HKCU\..\SearchScopes\{37BE2764-F126-49CB-AEA5-2857156837A3}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE10SR
IE - HKCU\..\SearchScopes\{44816E91-C68A-2FF3-3D8F-8970062E5600}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…;rlz=1I7GPCK_en
IE - HKCU\..\SearchScopes\{93BC2328-3000-4A4E-A208-171252A9F3B4}: "URL" = http://www.amazon.com/s?ie=UTF8&tag;=am…s={searchTerms}
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={FE5B7B5…mp;d=2012-09-10 16:56:56&v;=12.2.5.33&sap;=dsp&q;={searchTerms}
IE - HKCU\..\SearchScopes\{96F75758-1F08-4886-AFF3-C504EA57657A}: "URL" = http://www.google.com/search?q={searchTerm…;rlz=1I7GPCK_en
IE - HKCU\..\SearchScopes\{BE28C22E-F666-424d-B5FD-125C4AFEE34E}: "URL" = http://search.myheritage.com?orig=ds&q;={searchTerms}
IE - HKCU\..\SearchScopes\{E6C82431-BE31-4325-92B5-2B9F9F419DD9}: "URL" = http://www.nextag.com/goto.jsp?search={sea…rms}&p;=2828
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_110.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files (x86)\Virtual Earth 3D\ File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@ei.WeatherBlink.com/Plugin: C:\Program Files (x86)\WeatherBlinkEI\Installr\2.bin\NPgcEISB.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro PDF\Reader\npnitromozilla.dll ( )
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandasecurity.com/activescan: C:\Program Files (x86)\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security, S.L.)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@nds.com/PCShowPlugin: C:\Users\Cynthia\AppData\Local\DIRECTV Player\npPCShowPlugin.dll (NDS)
FF - HKCU\Software\MozillaPlugins\@nds.com/PlayerPlugin: C:\Users\Cynthia\AppData\Local\DIRECTV Player\npPlayerPlugin.dll (NDS)
FF - HKCU\Software\MozillaPlugins\NDS.com/PlayerPlugin: C:\Users\Cynthia\AppData\Local\DIRECTV Player\npPlayerPlugin.dll (NDS)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: File not found

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION\ [2011/03/16 14:05:02 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}: C:\Program Files (x86)\SpeedBit Video Downloader\SPFireFox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor [2012/11/09 23:12:15 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\WeatherBlink\bar\1.bin
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files (x86)\Siber Systems\AI RoboForm\Firefox [2012/08/03 10:07:29 | 000,000,000 | —D | M]

[2012/08/20 11:32:03 | 000,000,000 | —D | M] (No name found) – C:\Users\Cynthia\AppData\Roaming\Mozilla\Extensions
[2010/03/02 16:49:21 | 000,000,000 | —D | M] (No name found) – C:\Users\Cynthia\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012/11/11 17:59:17 | 000,000,000 | —D | M] (No name found) – C:\Users\Cynthia\AppData\Roaming\Mozilla\Firefox\Profiles\0\extensions
[2012/11/11 17:59:16 | 000,213,316 | —- | M] () (No name found) – C:\Users\Cynthia\AppData\Roaming\Mozilla\Firefox\Profiles\0\extensions\[removed]

========== Chrome ==========

CHR - homepage: http://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl;={language}&q;={searchTerms}&sugkey;={google:suggestAPIKeyParameter}
CHR - homepage: http://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.64\pdf.dll
CHR - plugin: nphelper scriptable example plugin (Enabled) = C:\Users\Cynthia\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnfaglepmjgohnkcoieaijlheabmcdeo\1.2_0\nphelper.dll
CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Users\Cynthia\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.60.123.1_0\McChPlg.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin8.dll
CHR - plugin: AVG SiteSafety plugin (Enabled) = C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\12.2.6\\npsitesafety.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U9 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Nitro PDF Plug-In (Enabled) = C:\Program Files (x86)\Nitro PDF\Reader\npnitromozilla.dll
CHR - plugin: Panda ActiveScan 2.0 (Enabled) = C:\Program Files (x86)\Panda Security\ActiveScan 2.0\npwrapper.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: WeatherBlink Installer Plugin Stub (Enabled) = C:\Program Files (x86)\WeatherBlinkEI\Installr\2.bin\NPgcEISB.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: NDS PCShow Plugin (Enabled) = C:\Users\Cynthia\AppData\Local\DIRECTV Player\npPCShowPlugin.dll
CHR - plugin: PCShow Player Plugin (Enabled) = C:\Users\Cynthia\AppData\Local\DIRECTV Player\npPlayerPlugin.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll
CHR - plugin: Java Deployment Toolkit 7.0.90.5 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - Extension: Google Drive = C:\Users\Cynthia\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\
CHR - Extension: YouTube = C:\Users\Cynthia\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Cynthia\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: SiteAdvisor = C:\Users\Cynthia\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.60.123.1_0\
CHR - Extension: Gmail = C:\Users\Cynthia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/11/30 10:27:15 | 000,000,098 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 9\DLLx64\SnagitBHO64.dll (TechSmith Corporation)
O2:64bit: - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O2:64bit: - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.
O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitBHO.dll (TechSmith Corporation)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\12.2.5.33\AVG Secure Search_toolbar.dll File not found
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Free Download Manager) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O3:64bit: - HKLM\..\Toolbar: (&RoboForm; Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O3:64bit: - HKLM\..\Toolbar: (Snagit) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 9\DLLx64\SnagitIEAddin64.dll (TechSmith Corporation)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (&RoboForm; Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (Snagit) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitIEAddin.dll (TechSmith Corporation)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\12.2.5.33\AVG Secure Search_toolbar.dll File not found
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4:64bit: - HKLM..\Run: [boincmgr] C:\Program Files\BOINC\boincmgr.exe (Space Sciences Laboratory)
O4:64bit: - HKLM..\Run: [boinctray] C:\Program Files\BOINC\boinctray.exe (Space Sciences Laboratory)
O4:64bit: - HKLM..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe (The Eraser Project)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [Info Center] C:\Program Files (x86)\PCPitstop\Info Center\InfoCenter.exe (PC Pitstop LLC)
O4 - HKLM..\Run: [PowerPanel Personal Edition User Interaction] C:\Program Files (x86)\CyberPower PowerPanel Personal Edition\pppeuser.exe (Cyber Power Systems, Inc.)
O4 - HKCU..\Run: [Bidnapper Homelink] C:\Program Files (x86)\Bidnapper\Bidnapper Homelink\BidnapperHomelink.exe ()
O4 - HKCU..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe (The Eraser Project)
O4 - HKCU..\Run: [Free Download Manager] C:\Program Files (x86)\Free Download Manager\fdm.exe (FreeDownloadManager.ORG)
O4 - HKCU..\Run: [PCShowServer] C:\Users\Cynthia\AppData\Local\DIRECTV Player\PCShowServerPMWrapper.exe (NDS Technologies)
O4 - HKCU..\Run: [RoboForm] C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Users\Cynthia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files (x86)\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Users\Cynthia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk = C:\Program Files\Rainmeter\Rainmeter.exe ()
O4 - Startup: C:\Users\Cynthia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stickies.lnk = C:\Program Files (x86)\Stickies\stickies.exe (Zhorn Software)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecycleFiles = 1
O8:64bit: - Extra context menu item: &ieSpell; Options - C:\Program Files (x86)\ieSpell\iespell.dll (Red Egg Software)
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver; - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: Check &Spelling; - C:\Program Files (x86)\ieSpell\iespell.dll (Red Egg Software)
O8:64bit: - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8:64bit: - Extra context menu item: Download all with Free Download Manager - C:\Program Files (x86)\Free Download Manager\dlall.htm ()
O8:64bit: - Extra context menu item: Download selected with Free Download Manager - C:\Program Files (x86)\Free Download Manager\dlselected.htm ()
O8:64bit: - Extra context menu item: Download video with Free Download Manager - C:\Program Files (x86)\Free Download Manager\dlfvideo.htm ()
O8:64bit: - Extra context menu item: Download with Free Download Manager - C:\Program Files (x86)\Free Download Manager\dllink.htm ()
O8:64bit: - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8:64bit: - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found
O8:64bit: - Extra context menu item: Lookup on Merriam Webster - C:\Program Files (x86)\ieSpell\Merriam Webster.HTM ()
O8:64bit: - Extra context menu item: Lookup on Wikipedia - C:\Program Files (x86)\ieSpell\wikipedia.HTM ()
O8:64bit: - Extra context menu item: RoboForm Editor - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComEditIdent.html ()
O8:64bit: - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8:64bit: - Extra context menu item: Set Fields - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSetFields.html ()
O8:64bit: - Extra context menu item: Show RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8:64bit: - Extra context menu item: Sync RoboForm Data - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSync.html ()
O8 - Extra context menu item: &ieSpell; Options - C:\Program Files (x86)\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Check &Spelling; - C:\Program Files (x86)\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Download all with Free Download Manager - C:\Program Files (x86)\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Download selected with Free Download Manager - C:\Program Files (x86)\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Download video with Free Download Manager - C:\Program Files (x86)\Free Download Manager\dlfvideo.htm ()
O8 - Extra context menu item: Download with Free Download Manager - C:\Program Files (x86)\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files (x86)\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files (x86)\ieSpell\wikipedia.HTM ()
O8 - Extra context menu item: RoboForm Editor - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComEditIdent.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: Set Fields - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSetFields.html ()
O8 - Extra context menu item: Show RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Sync RoboForm Data - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSync.html ()
O9:64bit: - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files (x86)\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files (x86)\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files (x86)\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: google.com ([]http in Local intranet)
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} http://www.logitech.com/devicedetector/plu…Detection32.cab (Reg Error: Key error.)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab (PCPitstop Utility)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} http://cdn.scan.onecare.live.com/resource/…s/wlscctrl2.cab (Windows Live OneCare safety scanner control)
O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} http://www.myheritage.com/Genoogle/Compone…EngineQuery.dll (CSEQueryObject Object)
O16 - DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} http://utilities.pcpitstop.com/Exterminate…opAntiVirus.dll (Reg Error: Key error.)
O16 - DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7} http://www.worldwinner.com/games/v41/freecell/freecell.cab (FreeCell Control)
O16 - DPF: {72376E32-8AF2-473F-BE32-E5D0F39C865D} http://www.cyberlink.com/prog/win7/js/UpdateAdvisor.cab (CUpdateAdvisorCtrl Object)
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} http://www.worldwinner.com/games/shared/wwlaunch.cab (Wwlaunch Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {8F6E7FB2-E56B-4F66-A4E1-9765D2565280} http://www.worldwinner.com/games/launcher/….0/iewwload.cab (WorldWinner ActiveX Launcher Control)
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {BA35B9B8-DE9E-47C9-AFA7-3C77E3DDFD39} http://www.worldwinner.com/games/v46/monopoly/monopoly.cab (Monopoly Control)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} http://beach.sandestinwebcam.com/activex/AMC.cab (AxisMediaControlEmb Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} http://content.systemrequirementslab.com.s…ri_4.4.26.0.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{340BF911-9E4D-4D17-80AC-A1D58BC869F1}: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2008/04/21 14:26:34 | 000,000,062 | R— | M] () - D:\Autorun.inf – [ CDFS ]
O32 - AutoRun File - [2008/05/06 06:26:23 | 000,000,309 | R— | M] () - I:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/11/30 10:27:01 | 000,000,000 | —D | C] – C:\_OTL
[2012/11/30 10:25:51 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Cynthia\Desktop\OTL.exe
[2012/11/30 10:23:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2012/11/30 10:23:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\ERUNT
[2012/11/29 17:10:41 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{3D0354F6-B758-49BD-9DDF-2BC50B9C964D}
[2012/11/29 12:14:37 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Jeyo Mobile Companion
[2012/11/29 12:14:35 | 000,000,000 | —D | C] – C:\Program Files (x86)\Jeyo
[2012/11/29 05:10:16 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{2D30E32B-844B-46FC-857E-AB2CF3F8A099}
[2012/11/28 19:11:07 | 000,000,000 | —D | C] – C:\ProgramData\APN
[2012/11/28 09:33:22 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{880C2B9F-941A-42DB-8339-D1B88D68095A}
[2012/11/28 03:12:51 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/11/28 02:20:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
[2012/11/28 02:20:37 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Roaming\Uniblue
[2012/11/28 02:20:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Uniblue
[2012/11/27 21:21:21 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/11/27 20:24:54 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/11/27 20:24:54 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/11/27 20:24:54 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/11/27 20:24:37 | 000,000,000 | —D | C] – C:\Qoobox
[2012/11/27 20:23:59 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2012/11/27 08:26:28 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{AEC50FF9-9838-4B9E-905A-FEC3D8B6D9A8}
[2012/11/26 14:26:20 | 000,000,000 | —D | C] – C:\Config.Msi
[2012/11/26 14:06:38 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Roaming\SUPERAntiSpyware.com
[2012/11/26 14:06:31 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2012/11/26 14:06:29 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2012/11/26 14:06:29 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2012/11/26 08:46:55 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{1492B728-BDBF-4DF0-8F1A-3F5EE461B3F4}
[2012/11/25 20:46:43 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{85F6F42D-142C-4AF1-B3FB-4C3B507BCE70}
[2012/11/25 07:17:35 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{30A7079C-6238-4F00-ADF0-A10F0A744051}
[2012/11/23 21:46:06 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{25201E87-BF68-4B04-BE16-2F5C21EF7E24}
[2012/11/23 09:45:03 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{4231C187-68B1-4112-93BB-00CBE5EB1FE8}
[2012/11/22 21:44:13 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{C79D0F9D-6DA7-4553-9DAE-19730865178B}
[2012/11/22 09:44:01 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{F67004C7-7625-46A3-9FB8-361BF07C0600}
[2012/11/21 15:24:13 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{A084099C-4324-4408-94FB-14DB57B4AEAE}
[2012/11/21 15:09:46 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\Logitech
[2012/11/21 15:08:57 | 000,000,000 | —D | C] – C:\Program Files\Logitech Gaming Software
[2012/11/21 03:23:36 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{F8A6E68F-997F-406F-9888-2B317E5B3C72}
[2012/11/20 15:23:11 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{0E546C3F-DA19-413F-B813-DCEA11D43D23}
[2012/11/18 23:06:32 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{EFEEB4C2-598C-4C75-A8D4-20BF3672A636}
[2012/11/18 11:05:56 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{690ACE75-30F6-43C8-85EB-0FD3C3464939}
[2012/11/18 02:21:29 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\IEUDINIT.EXE
[2012/11/18 02:17:20 | 001,054,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2012/11/18 02:17:18 | 000,718,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmlmedia.dll
[2012/11/18 02:17:18 | 000,226,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\elshyph.dll
[2012/11/18 02:17:18 | 000,185,344 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\elshyph.dll
[2012/11/18 02:17:18 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msrating.dll
[2012/11/18 02:17:18 | 000,150,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iexpress.exe
[2012/11/18 02:17:18 | 000,135,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wextract.exe
[2012/11/18 02:17:18 | 000,082,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inseng.dll
[2012/11/18 02:17:18 | 000,079,872 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/11/18 02:17:18 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2012/11/18 02:17:17 | 000,690,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/11/18 02:17:17 | 000,391,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/11/18 02:17:17 | 000,137,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/11/18 02:17:17 | 000,125,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2012/11/18 02:17:17 | 000,117,248 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2012/11/18 02:17:17 | 000,111,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\IEAdvpack.dll
[2012/11/18 02:17:17 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2012/11/18 02:17:17 | 000,073,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\SetIEInstalledDate.exe
[2012/11/18 02:17:17 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\pngfilt.dll
[2012/11/18 02:17:17 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmler.dll
[2012/11/18 02:17:17 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2012/11/18 02:17:16 | 001,441,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/11/18 02:17:16 | 001,400,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dat
[2012/11/18 02:17:16 | 000,629,248 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2012/11/18 02:17:16 | 000,361,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2012/11/18 02:17:16 | 000,232,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/11/18 02:17:16 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\icardie.dll
[2012/11/18 02:17:16 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tdc.ocx
[2012/11/18 02:17:16 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2012/11/18 02:17:16 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2012/11/18 02:17:16 | 000,023,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2012/11/18 02:17:13 | 001,400,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dat
[2012/11/18 02:17:13 | 000,762,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2012/11/18 02:17:13 | 000,453,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtmsft.dll
[2012/11/18 02:17:13 | 000,441,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2012/11/18 02:17:13 | 000,281,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtrans.dll
[2012/11/18 02:17:13 | 000,235,008 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/11/18 02:17:13 | 000,216,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msls31.dll
[2012/11/18 02:17:13 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msrating.dll
[2012/11/18 02:17:13 | 000,089,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2012/11/18 02:17:13 | 000,081,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\icardie.dll
[2012/11/18 02:17:13 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2012/11/18 02:17:13 | 000,050,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2012/11/18 02:17:13 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2012/11/18 02:17:12 | 001,509,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/11/18 02:17:12 | 000,905,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmlmedia.dll
[2012/11/18 02:17:12 | 000,854,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/11/18 02:17:12 | 000,603,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012/11/18 02:17:12 | 000,593,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2012/11/18 02:17:12 | 000,173,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/11/18 02:17:12 | 000,167,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iexpress.exe
[2012/11/18 02:17:12 | 000,149,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\occache.dll
[2012/11/18 02:17:12 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wextract.exe
[2012/11/18 02:17:12 | 000,136,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2012/11/18 02:17:12 | 000,136,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\IEAdvpack.dll
[2012/11/18 02:17:12 | 000,102,912 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inseng.dll
[2012/11/18 02:17:12 | 000,097,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/11/18 02:17:12 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\pngfilt.dll
[2012/11/18 02:17:12 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\imgutil.dll
[2012/11/18 02:17:12 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2012/11/18 02:17:12 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshta.exe
[2012/11/18 02:17:12 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2012/11/18 02:17:11 | 003,966,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/11/18 02:17:11 | 000,531,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/11/18 02:17:11 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2012/11/18 02:17:11 | 000,092,160 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SetIEInstalledDate.exe
[2012/11/18 02:17:11 | 000,077,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tdc.ocx
[2012/11/18 02:17:11 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmler.dll
[2012/11/18 02:14:13 | 001,682,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XpsPrint.dll
[2012/11/18 02:14:13 | 001,158,144 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XpsPrint.dll
[2012/11/18 02:14:13 | 000,522,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XpsGdiConverter.dll
[2012/11/18 02:14:13 | 000,465,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WMPhoto.dll
[2012/11/18 02:14:13 | 000,364,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XpsGdiConverter.dll
[2012/11/18 02:14:13 | 000,010,752 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2012/11/18 02:14:13 | 000,010,752 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2012/11/18 02:14:13 | 000,009,728 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2012/11/18 02:14:13 | 000,009,728 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2012/11/18 02:14:13 | 000,005,632 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2012/11/18 02:14:13 | 000,005,632 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2012/11/18 02:14:13 | 000,005,632 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
[2012/11/18 02:14:13 | 000,005,632 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll
[2012/11/18 02:14:13 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
[2012/11/18 02:14:13 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll
[2012/11/18 02:14:13 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2012/11/18 02:14:13 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2012/11/18 02:14:13 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
[2012/11/18 02:14:13 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll
[2012/11/18 02:14:13 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
[2012/11/18 02:14:13 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll
[2012/11/18 02:14:13 | 000,002,560 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2012/11/18 02:14:13 | 000,002,560 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2012/11/18 02:14:12 | 003,928,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d2d1.dll
[2012/11/18 02:14:12 | 002,776,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msmpeg2vdec.dll
[2012/11/18 02:14:12 | 002,434,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10warp.dll
[2012/11/18 02:14:12 | 002,284,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msmpeg2vdec.dll
[2012/11/18 02:14:12 | 001,887,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d11.dll
[2012/11/18 02:14:12 | 001,643,008 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\DWrite.dll
[2012/11/18 02:14:12 | 001,504,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3d11.dll
[2012/11/18 02:14:12 | 001,424,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WindowsCodecs.dll
[2012/11/18 02:14:12 | 001,238,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10.dll
[2012/11/18 02:14:12 | 000,648,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10level9.dll
[2012/11/18 02:14:12 | 000,417,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WMPhoto.dll
[2012/11/18 02:14:12 | 000,363,008 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxgi.dll
[2012/11/18 02:14:12 | 000,333,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10_1core.dll
[2012/11/18 02:14:12 | 000,296,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10core.dll
[2012/11/18 02:14:12 | 000,245,248 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WindowsCodecsExt.dll
[2012/11/18 02:14:12 | 000,221,184 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\UIAnimation.dll
[2012/11/18 02:14:12 | 000,194,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10_1.dll
[2012/11/18 02:14:12 | 000,187,392 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\UIAnimation.dll
[2012/11/17 22:38:07 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012/11/17 21:36:24 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{1691A1F2-CE3E-47ED-94FD-81FBDA031B56}
[2012/11/17 09:36:01 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{2091CA9F-9241-4854-B66E-CC7A5693C2EC}
[2012/11/16 22:27:33 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\The Weather Channel
[2012/11/16 21:35:36 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{94381402-2262-4C09-A0DA-D5B252DED490}
[2012/11/16 09:35:24 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{B42B9C96-334D-4A10-9065-914B7B3AFDAE}
[2012/11/15 03:22:46 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{20EA800D-0DF1-4DD4-B60A-43EB3644A207}
[2012/11/14 11:17:31 | 000,194,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WUDFPlatform.dll
[2012/11/14 11:17:30 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WUDFx.dll
[2012/11/14 11:17:30 | 000,229,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WUDFHost.exe
[2012/11/14 11:17:30 | 000,045,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WUDFCoinstaller.dll
[2012/11/14 06:32:30 | 000,226,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dhcpcore6.dll
[2012/11/14 06:32:30 | 000,193,536 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dhcpcore6.dll
[2012/11/14 06:32:30 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dhcpcsvc6.dll
[2012/11/14 06:31:36 | 000,246,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\netcorehc.dll
[2012/11/14 06:31:36 | 000,216,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncsi.dll
[2012/11/14 06:31:36 | 000,175,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\netcorehc.dll
[2012/11/14 06:31:36 | 000,156,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ncsi.dll
[2012/11/14 06:31:35 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\netevent.dll
[2012/11/14 06:31:35 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\netevent.dll
[2012/11/14 06:30:21 | 000,095,744 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\synceng.dll
[2012/11/14 06:30:21 | 000,078,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\synceng.dll
[2012/11/14 04:50:33 | 000,726,160 | —- | C] (Realtek ) – C:\Windows\SysNative\drivers\Rt64win7.sys
[2012/11/14 04:50:33 | 000,074,344 | —- | C] (Realtek Semiconductor Corporation) – C:\Windows\SysNative\RtNicProp64.dll
[2012/11/14 03:48:36 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{95E60291-1310-4C47-A5E4-5241A8033AA1}
[2012/11/13 15:48:12 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{5305C3BC-D8ED-4525-A96D-5A5B7FCEAC52}
[2012/11/12 15:28:40 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{36488028-000C-437B-9BAB-B6F9D33B4C82}
[2012/11/12 01:15:20 | 002,557,800 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvsvcr.dll
[2012/11/12 01:13:24 | 025,256,296 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcompiler.dll
[2012/11/12 01:13:24 | 018,252,136 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvd3dumx.dll
[2012/11/12 01:13:24 | 015,309,160 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvd3dum.dll
[2012/11/12 01:13:24 | 006,127,464 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvopencl.dll
[2012/11/12 01:13:24 | 000,189,288 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\drivers\nvhda64v.sys
[2012/11/12 01:13:24 | 000,031,080 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvhdap64.dll
[2012/11/12 01:13:22 | 026,331,496 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvoglv64.dll
[2012/11/12 01:13:22 | 019,906,920 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvoglv32.dll
[2012/11/12 01:13:22 | 017,559,912 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcompiler.dll
[2012/11/12 01:13:22 | 012,501,352 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvwgf2um.dll
[2012/11/12 01:13:22 | 007,697,768 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuda.dll
[2012/11/12 01:13:22 | 007,414,632 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvopencl.dll
[2012/11/12 01:13:22 | 002,747,240 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvid.dll
[2012/11/12 01:13:22 | 002,574,696 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvid.dll
[2012/11/12 01:13:22 | 002,428,776 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvapi.dll
[2012/11/12 01:13:22 | 002,218,344 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvenc.dll
[2012/11/12 01:13:22 | 001,867,112 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvenc.dll
[2012/11/12 01:13:22 | 001,482,600 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvdispgenco64.dll
[2012/11/12 01:13:22 | 000,973,672 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvumdshimx.dll
[2012/11/12 01:13:22 | 000,831,848 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvumdshim.dll
[2012/11/12 01:13:22 | 000,247,144 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvinitx.dll
[2012/11/12 01:13:22 | 000,202,600 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvinit.dll
[2012/11/11 19:50:21 | 000,212,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RichTx32.ocx
[2012/11/11 19:50:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Ultimate Troubleshooter
[2012/11/11 19:50:20 | 000,326,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\temp.017
[2012/11/11 19:50:20 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\eSellerate
[2012/11/11 19:50:18 | 001,388,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\temp.016
[2012/11/11 19:50:18 | 000,598,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\temp.012
[2012/11/11 19:50:18 | 000,164,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\temp.013
[2012/11/11 19:50:18 | 000,147,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\temp.014
[2012/11/11 19:50:18 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\temp.015
[2012/11/11 19:46:07 | 000,326,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\temp.011
[2012/11/11 19:46:06 | 001,388,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\temp.010
[2012/11/11 19:46:06 | 000,164,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\temp.00D
[2012/11/11 19:46:06 | 000,147,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\temp.00E
[2012/11/11 19:46:06 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\temp.00F
[2012/11/11 19:46:05 | 000,598,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\temp.00C
[2012/11/11 18:10:59 | 000,000,000 | —D | C] – C:\Program Files (x86)\uTorrent
[2012/11/11 17:21:50 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012/11/11 17:14:31 | 000,246,760 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2012/11/11 17:14:01 | 000,174,056 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2012/11/11 17:14:01 | 000,174,056 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2012/11/11 17:14:01 | 000,095,208 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012/11/11 17:13:47 | 000,000,000 | —D | C] – C:\Program Files (x86)\Java
[2012/11/11 16:42:52 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Mouse and Keyboard Center
[2012/11/11 16:41:30 | 000,054,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\WdfLdr.sys
[2012/11/11 16:41:30 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Wdfres.dll
[2012/11/11 16:41:09 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Mouse and Keyboard Center
[2012/11/11 16:20:56 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TsUsbRedirectionGroupPolicyExtension.dll
[2012/11/11 16:20:56 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TsUsbRedirectionGroupPolicyControl.exe
[2012/11/11 16:20:55 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RdpGroupPolicyExtension.dll
[2012/11/11 16:20:54 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\TsUsbFlt.sys
[2012/11/11 16:20:54 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\rdpvideominiport.sys
[2012/11/11 16:20:53 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TsUsbGDCoInstaller.dll
[2012/11/11 16:20:53 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wksprtPS.dll
[2012/11/11 16:20:52 | 001,048,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstsc.exe
[2012/11/11 16:20:52 | 000,384,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wksprt.exe
[2012/11/11 16:20:52 | 000,322,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\aaclient.dll
[2012/11/11 16:20:52 | 000,269,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\aaclient.dll
[2012/11/11 16:20:52 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpudd.dll
[2012/11/11 16:20:52 | 000,228,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpendp_winip.dll
[2012/11/11 16:20:52 | 000,192,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\rdpendp_winip.dll
[2012/11/11 16:20:52 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TSWbPrxy.exe
[2012/11/11 16:20:52 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MsRdpWebAccess.dll
[2012/11/11 16:20:52 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MsRdpWebAccess.dll
[2012/11/11 16:20:52 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tsgqec.dll
[2012/11/11 16:20:52 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tsgqec.dll
[2012/11/11 16:20:52 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wksprtPS.dll
[2012/11/11 16:20:51 | 005,773,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstscax.dll
[2012/11/11 16:20:51 | 004,916,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstscax.dll
[2012/11/11 16:20:51 | 003,174,912 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpcorets.dll
[2012/11/11 16:20:51 | 001,123,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstsc.exe
[2012/11/11 16:19:17 | 000,307,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncrypt.dll
[2012/11/11 16:19:16 | 001,448,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lsasrv.dll
[2012/11/11 11:10:28 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{E9E41445-6285-4B86-95AA-322E99D8C6A9}
[2012/11/10 23:09:44 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{EAA2CB8C-0A85-4C94-88CC-DE9ABB34C1EA}
[2012/11/10 17:12:48 | 000,000,000 | —D | C] – C:\Users\Cynthia\Desktop\Program Shortcuts
[2012/11/10 17:11:42 | 000,000,000 | —D | C] – C:\Users\Cynthia\Desktop\Trailer
[2012/11/10 16:52:26 | 000,000,000 | —D | C] – C:\Users\Cynthia\Desktop\Internet shortcuts
[2012/11/10 11:08:56 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{0203FBBD-0D82-4D64-90F4-8BB2074DD0BF}
[2012/11/09 23:08:30 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{EA11026F-1163-4CE7-8133-5A646F356DB8}
[2012/11/08 12:12:20 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{AEE4C028-EFF2-45CA-B8C1-07FBB86D25D8}
[2012/11/08 00:10:31 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{FB19F89C-DC64-463E-AF58-4F0F10AC0ACC}
[2012/11/07 12:10:07 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{F8EE9D44-C542-440E-81D2-C91CA8283921}
[2012/11/07 00:09:42 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{97D30092-A8F5-4A42-90FB-CFD63A85F2D5}
[2012/11/06 01:40:48 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{5B8FF134-C66F-47F2-B33E-E45A028B0D6E}
[2012/11/05 13:05:38 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{9FEB3107-4F28-4C60-B13C-66EAF73B8A5D}
[2012/11/05 01:05:15 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{D9074A04-B986-4169-9C79-F2E14600C321}
[2012/11/04 13:04:51 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{EBCB8FB6-B4EF-444B-AAC5-8D61601CD457}
[2012/11/04 01:04:11 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{3C1B8A87-290C-4ED0-88BC-D7B19DADB3AF}
[2012/11/03 13:03:46 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{BFE8AB7C-23A0-443B-95A3-93FF32BC87AE}
[2012/11/02 23:05:13 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{3C971BAC-0F34-411B-A8C9-9807BCDF938F}
[2012/11/02 15:38:36 | 000,862,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msvcr110.dll
[2012/11/02 15:38:36 | 000,828,872 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msvcr110.dll
[2012/11/02 15:38:36 | 000,661,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msvcp110.dll
[2012/11/02 15:38:36 | 000,534,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msvcp110.dll
[2012/11/02 15:38:36 | 000,354,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vccorlib110.dll
[2012/11/02 15:38:36 | 000,251,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\vccorlib110.dll
[2012/11/02 15:38:36 | 000,050,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\point64.sys
[2012/11/02 15:38:36 | 000,023,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\nuidfltr.sys
[2012/11/02 10:43:06 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{9326F420-E7E5-4897-9EB4-8E221B24C992}
[2012/11/01 22:42:43 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{F7B9924A-9DA6-4C2A-A4BF-083A603E763E}
[2012/11/01 10:42:20 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{AD74C2CA-854E-466C-B22C-93AFDB4FE746}
[2012/10/31 22:42:08 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{2C1EE078-715D-4D53-ACE9-A352108EC612}
[2012/10/31 14:03:47 | 002,792,728 | —- | C] (Siber Systems) – C:\PortableRoboForm.exe
[2012/10/31 14:03:47 | 000,000,000 | —D | C] – C:\RoboForm
[2012/10/31 14:03:47 | 000,000,000 | —D | C] – C:\My RoboForm Data
[2012/10/31 10:41:44 | 000,000,000 | —D | C] – C:\Users\Cynthia\AppData\Local\{408E8680-16DE-4065-928D-865F1C3588E5}
[2010/05/12 20:22:00 | 000,082,816 | —- | C] (VSO Software) – C:\Users\Cynthia\AppData\Roaming\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2012/11/30 10:36:26 | 000,028,352 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/11/30 10:36:26 | 000,028,352 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/11/30 10:28:46 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/11/30 10:28:41 | 3220,037,632 | -HS- | M] () – C:\hiberfil.sys
[2012/11/30 10:27:15 | 000,000,098 | —- | M] () – C:\Windows\SysNative\drivers\etc\Hosts
[2012/11/30 10:23:54 | 000,001,120 | —- | M] () – C:\Users\Cynthia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/11/30 01:52:08 | 000,000,172 | —- | M] () – C:\Users\Cynthia\Desktop\Motley Fool Options - Options Whiz.url
[2012/11/29 23:46:02 | 000,792,550 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/11/29 23:46:02 | 000,669,048 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/11/29 23:46:02 | 000,125,234 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/11/29 13:39:44 | 000,000,124 | —- | M] () – C:\Users\Cynthia\Desktop\The Official EasyList Website.url
[2012/11/29 12:14:37 | 000,001,181 | —- | M] () – C:\Users\Cynthia\Desktop\Jeyo Mobile Companion 2.1.lnk
[2012/11/28 20:27:10 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Cynthia\Desktop\OTL.exe
[2012/11/28 02:20:40 | 000,000,214 | —- | M] () – C:\Windows\tasks\SpeedUpMyPC.job
[2012/11/28 02:20:38 | 000,001,192 | —- | M] () – C:\Users\Cynthia\Application Data\Microsoft\Internet Explorer\Quick Launch\SpeedUpMyPC.lnk
[2012/11/28 02:20:38 | 000,001,144 | —- | M] () – C:\Users\Public\Desktop\SpeedUpMyPC.lnk
[2012/11/27 06:30:12 | 000,001,953 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012/11/26 18:37:14 | 000,001,431 | —- | M] () – C:\Users\Cynthia\Desktop\Lydia.mp4 - Shortcut.lnk
[2012/11/26 18:35:19 | 000,697,272 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/11/26 18:35:19 | 000,073,656 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/11/25 14:32:38 | 000,002,351 | —- | M] () – C:\Users\Cynthia\Documents\RODEO LYRICS.rtf
[2012/11/25 14:26:28 | 000,444,885 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts_PTbackup2.bak
[2012/11/25 07:33:49 | 000,000,224 | —- | M] () – C:\Users\Cynthia\Desktop\A3 - Too Sick To Pray Lyrics.url
[2012/11/24 06:48:53 | 000,000,180 | —- | M] () – C:\Users\Cynthia\Desktop\Service Center Detail.url
[2012/11/22 10:52:12 | 000,941,189 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts_PTBackup.bak
[2012/11/22 01:16:08 | 000,007,355 | —- | M] () – C:\Users\Cynthia\Documents\Re_ Hi.eml
[2012/11/21 15:05:15 | 000,018,960 | —- | M] (Logitech, Inc.) – C:\Windows\SysNative\drivers\LNonPnP.sys
[2012/11/19 02:57:21 | 000,001,186 | —- | M] () – C:\Users\Cynthia\Documents\Jimmy.rtf
[2012/11/18 02:17:20 | 001,054,720 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2012/11/18 02:17:18 | 000,718,336 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmlmedia.dll
[2012/11/18 02:17:18 | 000,226,304 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\elshyph.dll
[2012/11/18 02:17:18 | 000,185,344 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\elshyph.dll
[2012/11/18 02:17:18 | 000,163,840 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msrating.dll
[2012/11/18 02:17:18 | 000,150,528 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iexpress.exe
[2012/11/18 02:17:18 | 000,135,680 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\wextract.exe
[2012/11/18 02:17:18 | 000,082,432 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\inseng.dll
[2012/11/18 02:17:18 | 000,079,872 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/11/18 02:17:18 | 000,071,680 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2012/11/18 02:17:17 | 000,690,688 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/11/18 02:17:17 | 000,391,168 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/11/18 02:17:17 | 000,137,216 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/11/18 02:17:17 | 000,125,440 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2012/11/18 02:17:17 | 000,117,248 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2012/11/18 02:17:17 | 000,111,104 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\IEAdvpack.dll
[2012/11/18 02:17:17 | 000,109,056 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2012/11/18 02:17:17 | 000,073,728 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\SetIEInstalledDate.exe
[2012/11/18 02:17:17 | 000,057,344 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\pngfilt.dll
[2012/11/18 02:17:17 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmler.dll
[2012/11/18 02:17:17 | 000,011,776 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2012/11/18 02:17:16 | 001,441,280 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/11/18 02:17:16 | 001,400,416 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dat
[2012/11/18 02:17:16 | 000,629,248 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2012/11/18 02:17:16 | 000,361,984 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2012/11/18 02:17:16 | 000,232,960 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/11/18 02:17:16 | 000,069,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\icardie.dll
[2012/11/18 02:17:16 | 000,061,952 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\tdc.ocx
[2012/11/18 02:17:16 | 000,061,440 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2012/11/18 02:17:16 | 000,033,280 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2012/11/18 02:17:16 | 000,025,185 | —- | M] () – C:\Windows\SysWow64\ieuinit.inf
[2012/11/18 02:17:16 | 000,023,040 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2012/11/18 02:17:13 | 001,400,416 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dat
[2012/11/18 02:17:13 | 000,905,216 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshtmlmedia.dll
[2012/11/18 02:17:13 | 000,762,368 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2012/11/18 02:17:13 | 000,453,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxtmsft.dll
[2012/11/18 02:17:13 | 000,441,856 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2012/11/18 02:17:13 | 000,281,600 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxtrans.dll
[2012/11/18 02:17:13 | 000,235,008 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/11/18 02:17:13 | 000,216,576 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msls31.dll
[2012/11/18 02:17:13 | 000,197,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msrating.dll
[2012/11/18 02:17:13 | 000,089,600 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2012/11/18 02:17:13 | 000,081,408 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\icardie.dll
[2012/11/18 02:17:13 | 000,067,072 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2012/11/18 02:17:13 | 000,050,688 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2012/11/18 02:17:13 | 000,039,936 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2012/11/18 02:17:13 | 000,025,185 | —- | M] () – C:\Windows\SysNative\ieuinit.inf
[2012/11/18 02:17:12 | 001,509,376 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/11/18 02:17:12 | 000,854,528 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/11/18 02:17:12 | 000,603,136 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012/11/18 02:17:12 | 000,593,408 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2012/11/18 02:17:12 | 000,173,568 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/11/18 02:17:12 | 000,167,424 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iexpress.exe
[2012/11/18 02:17:12 | 000,149,504 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\occache.dll
[2012/11/18 02:17:12 | 000,142,848 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wextract.exe
[2012/11/18 02:17:12 | 000,136,192 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2012/11/18 02:17:12 | 000,136,192 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\IEAdvpack.dll
[2012/11/18 02:17:12 | 000,102,912 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\inseng.dll
[2012/11/18 02:17:12 | 000,097,280 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/11/18 02:17:12 | 000,062,976 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\pngfilt.dll
[2012/11/18 02:17:12 | 000,051,200 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\imgutil.dll
[2012/11/18 02:17:12 | 000,027,648 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2012/11/18 02:17:12 | 000,013,824 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshta.exe
[2012/11/18 02:17:12 | 000,012,800 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2012/11/18 02:17:11 | 003,966,976 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/11/18 02:17:11 | 000,531,456 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/11/18 02:17:11 | 000,136,704 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2012/11/18 02:17:11 | 000,092,160 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\SetIEInstalledDate.exe
[2012/11/18 02:17:11 | 000,077,312 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\tdc.ocx
[2012/11/18 02:17:11 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshtmler.dll
[2012/11/18 02:14:13 | 002,284,544 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msmpeg2vdec.dll
[2012/11/18 02:14:13 | 001,682,432 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\XpsPrint.dll
[2012/11/18 02:14:13 | 001,158,144 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\XpsPrint.dll
[2012/11/18 02:14:13 | 000,522,752 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\XpsGdiConverter.dll
[2012/11/18 02:14:13 | 000,465,920 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\WMPhoto.dll
[2012/11/18 02:14:13 | 000,364,544 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\XpsGdiConverter.dll
[2012/11/18 02:14:13 | 000,010,752 | -H– | M] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2012/11/18 02:14:13 | 000,010,752 | -H– | M] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2012/11/18 02:14:13 | 000,009,728 | -H– | M] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2012/11/18 02:14:13 | 000,009,728 | -H– | M] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2012/11/18 02:14:13 | 000,005,632 | -H– | M] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2012/11/18 02:14:13 | 000,005,632 | -H– | M] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2012/11/18 02:14:13 | 000,005,632 | -H– | M] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
[2012/11/18 02:14:13 | 000,005,632 | -H– | M] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll
[2012/11/18 02:14:13 | 000,004,096 | -H– | M] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
[2012/11/18 02:14:13 | 000,004,096 | -H– | M] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll
[2012/11/18 02:14:13 | 000,003,584 | -H– | M] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2012/11/18 02:14:13 | 000,003,584 | -H– | M] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2012/11/18 02:14:13 | 000,003,072 | -H– | M] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
[2012/11/18 02:14:13 | 000,003,072 | -H– | M] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll
[2012/11/18 02:14:13 | 000,003,072 | -H– | M] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
[2012/11/18 02:14:13 | 000,003,072 | -H– | M] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll
[2012/11/18 02:14:13 | 000,002,560 | -H– | M] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2012/11/18 02:14:13 | 000,002,560 | -H– | M] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2012/11/18 02:14:12 | 003,928,064 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\d2d1.dll
[2012/11/18 02:14:12 | 002,776,576 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msmpeg2vdec.dll
[2012/11/18 02:14:12 | 002,434,560 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\d3d10warp.dll
[2012/11/18 02:14:12 | 001,887,232 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\d3d11.dll
[2012/11/18 02:14:12 | 001,643,008 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\DWrite.dll
[2012/11/18 02:14:12 | 001,504,768 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\d3d11.dll
[2012/11/18 02:14:12 | 001,424,384 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\WindowsCodecs.dll
[2012/11/18 02:14:12 | 001,238,528 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\d3d10.dll
[2012/11/18 02:14:12 | 000,648,192 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\d3d10level9.dll
[2012/11/18 02:14:12 | 000,417,792 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\WMPhoto.dll
[2012/11/18 02:14:12 | 000,363,008 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxgi.dll
[2012/11/18 02:14:12 | 000,333,312 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\d3d10_1core.dll
[2012/11/18 02:14:12 | 000,296,960 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\d3d10core.dll
[2012/11/18 02:14:12 | 000,245,248 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\WindowsCodecsExt.dll
[2012/11/18 02:14:12 | 000,221,184 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\UIAnimation.dll
[2012/11/18 02:14:12 | 000,194,560 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\d3d10_1.dll
[2012/11/18 02:14:12 | 000,187,392 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\UIAnimation.dll
[2012/11/17 22:39:46 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore1cdc546bca0a8f1.job
[2012/11/17 22:38:07 | 000,002,291 | —- | M] () – C:\Users\Cynthia\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/11/16 22:41:32 | 000,000,278 | —- | M] () – C:\Users\Cynthia\Desktop\WATCH Waterspout churn up waves (2).url
[2012/11/16 22:38:44 | 000,000,278 | —- | M] () – C:\Users\Cynthia\Desktop\WATCH Waterspout churn up waves.url
[2012/11/14 13:39:21 | 000,334,328 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/11/13 10:11:26 | 000,001,706 | —- | M] () – C:\Users\Cynthia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
[2012/11/13 03:14:48 | 000,000,221 | —- | M] () – C:\Users\Cynthia\Desktop\Clickomania Next Generation! (2).url
[2012/11/12 01:38:14 | 000,444,833 | R— | M] () – C:\Windows\SysNative\drivers\etc\hosts.20121121-100646.backup
[2012/11/11 19:50:23 | 000,001,233 | —- | M] () – C:\Users\Cynthia\Desktop\The Ultimate Troubleshooter.lnk
[2012/11/11 17:13:50 | 000,095,208 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012/11/11 17:13:49 | 000,246,760 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2012/11/11 17:13:49 | 000,174,056 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2012/11/11 17:13:49 | 000,174,056 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2012/11/11 17:13:48 | 000,821,736 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\npDeployJava1.dll
[2012/11/11 17:13:48 | 000,746,984 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\deployJava1.dll
[2012/11/11 16:42:52 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_point64_01011.Wdf
[2012/11/11 16:41:58 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01011.Wdf
[2012/11/11 16:41:55 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Coinstaller_Critical.Wdf
[2012/11/11 05:33:14 | 000,000,240 | —- | M] () – C:\Users\Cynthia\Desktop\Apricot-Pecan Sweet Potatoes Recipe - Allrecipes.com.url
[2012/11/11 00:24:55 | 000,007,612 | —- | M] () – C:\Users\Cynthia\AppData\Local\Resmon.ResmonCfg
[2012/11/10 23:28:25 | 000,000,228 | —- | M] () – C:\Users\Cynthia\Desktop\Chat Window.url
[2012/11/10 14:41:52 | 000,000,182 | —- | M] () – C:\Users\Cynthia\Desktop\Womens Designer Leathers and Suedes Final Clearance Designer Clothing Clearance Lafayette 148 New York.url
[2012/11/09 00:46:10 | 000,028,672 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\IEUDINIT.EXE
[2012/11/09 00:23:20 | 000,000,196 | —- | M] () – C:\Users\Cynthia\Desktop\Novartis Keri Original Skin Lotion - 15 oz Pump Bottle.url
[2012/11/08 07:06:58 | 000,048,636 | —- | M] () – C:\Users\Cynthia\Documents\Life Sucks When You’re a Frog.eml
[2012/11/03 19:44:37 | 000,000,787 | —- | M] () – C:\Users\Cynthia\Documents\obama's vieiw of America..rtf
[2012/11/02 15:38:36 | 000,862,664 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msvcr110.dll
[2012/11/02 15:38:36 | 000,828,872 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msvcr110.dll
[2012/11/02 15:38:36 | 000,661,448 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msvcp110.dll
[2012/11/02 15:38:36 | 000,534,480 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msvcp110.dll
[2012/11/02 15:38:36 | 000,354,264 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\vccorlib110.dll
[2012/11/02 15:38:36 | 000,251,864 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\vccorlib110.dll
[2012/11/02 15:38:36 | 000,050,856 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\drivers\point64.sys
[2012/11/02 15:38:36 | 000,023,960 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\drivers\nuidfltr.sys
[2012/11/01 13:53:40 | 000,002,587 | —- | M] () – C:\Users\Cynthia\Documents\New Text Document.odt
[2012/11/01 13:52:30 | 000,000,517 | —- | M] () – C:\Users\Cynthia\Documents\New Text Document.rtf
[2012/10/31 15:18:13 | 000,000,236 | —- | M] () – C:\Users\Cynthia\Desktop\Clickomania Next Generation!.url
[2012/10/31 14:03:48 | 002,792,728 | —- | M] (Siber Systems) – C:\PortableRoboForm.exe

========== Files Created - No Company Name ==========

[2012/11/30 10:23:54 | 000,001,120 | —- | C] () – C:\Users\Cynthia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/11/30 01:52:08 | 000,000,172 | —- | C] () – C:\Users\Cynthia\Desktop\Motley Fool Options - Options Whiz.url
[2012/11/30 00:36:55 | 010,616,875 | —- | C] () – C:\Users\Cynthia\06 - Carly Simon - Your'e So Vain.mp3
[2012/11/29 13:39:44 | 000,000,124 | —- | C] () – C:\Users\Cynthia\Desktop\The Official EasyList Website.url
[2012/11/29 12:14:37 | 000,001,181 | —- | C] () – C:\Users\Cynthia\Desktop\Jeyo Mobile Companion 2.1.lnk
[2012/11/28 02:20:40 | 000,000,214 | —- | C] () – C:\Windows\tasks\SpeedUpMyPC.job
[2012/11/28 02:20:38 | 000,001,192 | —- | C] () – C:\Users\Cynthia\Application Data\Microsoft\Internet Explorer\Quick Launch\SpeedUpMyPC.lnk
[2012/11/28 02:20:38 | 000,001,144 | —- | C] () – C:\Users\Public\Desktop\SpeedUpMyPC.lnk
[2012/11/27 20:24:54 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/11/27 20:24:54 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/11/27 20:24:54 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/11/27 20:24:54 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/11/27 20:24:54 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/11/26 18:37:14 | 000,001,431 | —- | C] () – C:\Users\Cynthia\Desktop\Lydia.mp4 - Shortcut.lnk
[2012/11/26 14:06:31 | 000,001,953 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012/11/25 14:32:38 | 000,002,351 | —- | C] () – C:\Users\Cynthia\Documents\RODEO LYRICS.rtf
[2012/11/25 07:33:49 | 000,000,224 | —- | C] () – C:\Users\Cynthia\Desktop\A3 - Too Sick To Pray Lyrics.url
[2012/11/24 06:48:53 | 000,000,180 | —- | C] () – C:\Users\Cynthia\Desktop\Service Center Detail.url
[2012/11/22 01:16:08 | 000,007,355 | —- | C] () – C:\Users\Cynthia\Documents\Re_ Hi.eml
[2012/11/19 02:57:21 | 000,001,186 | —- | C] () – C:\Users\Cynthia\Documents\Jimmy.rtf
[2012/11/18 02:17:16 | 000,025,185 | —- | C] () – C:\Windows\SysWow64\ieuinit.inf
[2012/11/18 02:17:13 | 000,025,185 | —- | C] () – C:\Windows\SysNative\ieuinit.inf
[2012/11/17 22:39:46 | 000,000,894 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore1cdc546bca0a8f1.job
[2012/11/17 22:38:07 | 000,002,291 | —- | C] () – C:\Users\Cynthia\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/11/16 22:41:32 | 000,000,278 | —- | C] () – C:\Users\Cynthia\Desktop\WATCH Waterspout churn up waves (2).url
[2012/11/16 22:38:44 | 000,000,278 | —- | C] () – C:\Users\Cynthia\Desktop\WATCH Waterspout churn up waves.url
[2012/11/14 11:17:30 | 000,000,003 | —- | C] () – C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012/11/13 03:14:48 | 000,000,221 | —- | C] () – C:\Users\Cynthia\Desktop\Clickomania Next Generation! (2).url
[2012/11/11 19:50:23 | 000,001,233 | —- | C] () – C:\Users\Cynthia\Desktop\The Ultimate Troubleshooter.lnk
[2012/11/11 16:42:52 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_point64_01011.Wdf
[2012/11/11 16:41:58 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01011.Wdf
[2012/11/11 16:41:55 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Coinstaller_Critical.Wdf
[2012/11/11 16:41:33 | 000,000,003 | —- | C] () – C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012/11/11 05:33:14 | 000,000,240 | —- | C] () – C:\Users\Cynthia\Desktop\Apricot-Pecan Sweet Potatoes Recipe - Allrecipes.com.url
[2012/11/10 23:28:24 | 000,000,228 | —- | C] () – C:\Users\Cynthia\Desktop\Chat Window.url
[2012/11/10 14:41:52 | 000,000,182 | —- | C] () – C:\Users\Cynthia\Desktop\Womens Designer Leathers and Suedes Final Clearance Designer Clothing Clearance Lafayette 148 New York.url
[2012/11/09 00:23:20 | 000,000,196 | —- | C] () – C:\Users\Cynthia\Desktop\Novartis Keri Original Skin Lotion - 15 oz Pump Bottle.url
[2012/11/08 07:06:57 | 000,048,636 | —- | C] () – C:\Users\Cynthia\Documents\Life Sucks When You’re a Frog.eml
[2012/11/03 19:44:36 | 000,000,787 | —- | C] () – C:\Users\Cynthia\Documents\obama's vieiw of America..rtf
[2012/11/01 13:53:40 | 000,002,587 | —- | C] () – C:\Users\Cynthia\Documents\New Text Document.odt
[2012/10/31 15:18:13 | 000,000,236 | —- | C] () – C:\Users\Cynthia\Desktop\Clickomania Next Generation!.url
[2012/10/21 08:06:58 | 000,229,028 | —- | C] () – C:\Users\Cynthia\Hell_Awaits_backwards.ogg
[2012/06/01 13:51:50 | 000,000,022 | -HS- | C] () – C:\Users\Cynthia\AppData\Roaming\Windows1569_SettingsRepository.bin
[2012/06/01 13:51:50 | 000,000,022 | -HS- | C] () – C:\Windows\90C7D912BE2316.sys
[2012/05/24 20:44:34 | 000,000,076 | —- | C] () – C:\Windows\SysWow64\w3url.dll
[2012/05/22 01:07:49 | 588,814,860 | —- | C] () – C:\Users\Cynthia\Downloads.zip
[2012/05/08 07:58:06 | 000,000,030 | —- | C] () – C:\Windows\SysWow64\conquests.ini
[2012/02/05 06:50:22 | 234,021,979 | —- | C] () – C:\Users\Cynthia\Documents.7z
[2012/02/05 06:47:05 | 342,735,128 | —- | C] () – C:\Users\Cynthia\Downloads.7z
[2011/12/27 10:44:32 | 000,001,449 | —- | C] () – C:\Windows\wininit.ini
[2011/10/02 08:44:56 | 000,000,128 | —- | C] () – C:\ProgramData\sandra.ldb
[2011/09/28 16:44:14 | 000,179,271 | —- | C] () – C:\Windows\SysWow64\xlive.dll.cat
[2011/08/09 17:26:04 | 000,022,092 | —- | C] () – C:\Windows\SysWow64\aaxsiu.dll
[2011/06/24 13:17:18 | 000,058,702 | —- | C] () – C:\Users\Cynthia\Total Points.mht
[2011/06/14 06:30:21 | 000,007,612 | —- | C] () – C:\Users\Cynthia\AppData\Local\Resmon.ResmonCfg
[2011/06/11 18:14:16 | 000,003,929 | —- | C] () – C:\Windows\SysWow64\atipblag.dat
[2011/05/05 00:28:10 | 000,059,904 | —- | C] () – C:\Windows\SysWow64\OVDecode.dll
[2011/04/07 11:38:24 | 000,000,193 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc
[2011/03/16 13:57:58 | 000,789,710 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/03/16 13:54:23 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2011/02/18 23:32:14 | 000,000,022 | -HS- | C] () – C:\Users\Cynthia\AppData\Roaming\Sys2662.Config.Repository.bin
[2010/09/20 04:27:14 | 000,011,124 | —- | C] () – C:\Users\Cynthia\mural.jpg
[2010/08/30 06:14:27 | 000,055,203 | —- | C] () – C:\Users\Cynthia\s-cape-handwand_page1_image1.jpg
[2010/08/30 06:07:57 | 000,107,519 | —- | C] () – C:\Users\Cynthia\s-cape-handwand.pdf
[2010/05/12 20:22:00 | 000,007,859 | —- | C] () – C:\Users\Cynthia\AppData\Roaming\pcouffin.cat
[2010/05/12 20:22:00 | 000,001,167 | —- | C] () – C:\Users\Cynthia\AppData\Roaming\pcouffin.inf
[2010/04/20 20:33:13 | 000,001,016 | —- | C] () – C:\Users\Cynthia\bludisk.gif
[2010/01/11 10:06:18 | 000,018,565 | —- | C] () – C:\Users\Cynthia\AppData\Roaming\UserTile.png

========== ZeroAccess Check ==========

[2009/07/13 22:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/08 23:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 22:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 19:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 03:19:04 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 19:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== Alternate Data Streams ==========

@Alternate Data Stream - 985 bytes -> C:\Users\Cynthia\Documents\if you were an Elvis fan——YOU'LL LOVE THIS!!!!!!!!!!.eml:OECustomProperty
@Alternate Data Stream - 885 bytes -> C:\Users\Cynthia\Documents\Life Sucks When You’re a Frog.eml:OECustomProperty
@Alternate Data Stream - 849 bytes -> C:\Users\Cynthia\Documents\Fw_ NASHVILLE FLOOD PICTURES.eml:OECustomProperty
@Alternate Data Stream - 809 bytes -> C:\Users\Cynthia\Documents\Fw_ Forgotten photos.eml:OECustomProperty
@Alternate Data Stream - 801 bytes -> C:\Users\Cynthia\Documents\Fw_ EVER SEEN CAVIAR_.eml:OECustomProperty
@Alternate Data Stream - 747 bytes -> C:\Users\Cynthia\Documents\National Association of Federal Credit Union.eml:OECustomProperty
@Alternate Data Stream - 676 bytes -> C:\Users\Cynthia\Documents\Re_ Hi.eml:OECustomProperty
@Alternate Data Stream - 648 bytes -> C:\Users\Cynthia\Documents\longest email to molllie.eml:OECustomProperty
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:D2F2F703
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:9812B773
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:0988A428
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:C946EBB2
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:BBC9C1EB
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:774C075A
@Alternate Data Stream - 1096 bytes -> C:\Users\Cynthia\Documents\moterized bike.eml:OECustomProperty
@Alternate Data Stream - 1089 bytes -> C:\Users\Cynthia\Documents\Fw_ Fwd_ Fw_ Fwd_ Fw_ Biden may be interim president by the end of 2012.eml:OECustomProperty

< End of report >



Thank you for sticking with me on this.

here they are. Combofix ComboFix 12-12-02.01 - Cynthia 12/03/2012 10:40:12.3.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4094.2240 [GMT -6:00] Running from: C:\Users\[removed]\Desktop\ComboFix.exe Command switches used :: C:\Users\Cynthia\Desktop\CFScript.txt AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C} SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FILE :: "C:\ProgramData\Spybot - Search & Destroy\Recovery\WiIQfraud16.zip" "C:\Users\All Users\Spybot - Search & Destroy\Recovery\WiIQfraud16.zip" "C:\Users\Cynthia\AppData\Local\Downloaded Installations\{9BE938C8-4585-4C5D-A6BB-9AD19F6622F2}\PCmover Professional.msi" "C:\Users\Cynthia\Desktop\Cissy's\gimp.exe" "C:\Users\Cynthia\Downloads.7z" "C:\Users\Cynthia\Downloads.zip" "C:\Users\Cynthia\Downloads\adlsoft_uncompressor_3_3_last.exe" "C:\Users\Cynthia\Downloads\Jeyo.Mobile.Companion.v2.1.Build.403.Incl.Keygen-SCOTCH.zip" "C:\Users\Cynthia\Downloads\Jeyo.Mobile.Companion.v2.1.Build.403.Incl.Keygen-SCOTCH\Jeyo.Mobile.Companion.v2.1.Build.403.Incl.Keygen-SCOTCH\Jeyo.Mobile.Companion.v2.0.Keygen.exe" "G:\$Recycle.Bin\S-1-5-21-3416148573-2493547136-111628057-1001\$RQENUCF\Application Data\Spybot - Search & Destroy\Recovery\WiIQfraud16.zip" "G:\Documents and Settings\All Users\Spybot - Search & Destroy\Recovery\WiIQfraud16.zip" "G:\Documents and Settings\Cynthia\AppData\Local\Downloaded Installations\{9BE938C8-4585-4C5D-A6BB-9AD19F6622F2}\PCmover Professional.msi" "G:\Documents and Settings\Cynthia\Desktop\Cissy's\gimp.exe" "G:\Documents and Settings\Cynthia\Downloads.7z" "G:\Documents and Settings\Cynthia\Downloads.zip" "G:\Documents and Settings\Cynthia\Downloads\adlsoft_uncompressor_3_3_last.exe" "G:\Documents and Settings\Cynthia\Downloads\Jeyo.Mobile.Companion.v2.1.Build.403.Incl.Keygen-SCOTCH.zip" "G:\Documents and Settings\Cynthia\Downloads\Jeyo.Mobile.Companion.v2.1.Build.403.Incl.Keygen-SCOTCH\Jeyo.Mobile.Companion.v2.1.Build.403.Incl.Keygen-SCOTCH\Jeyo.Mobile.Companion.v2.0.Keygen.exe" ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\ProgramData\Spybot - Search & Destroy\Recovery\WiIQfraud16.zip C:\Users\All Users\Spybot - Search & Destroy\Recovery\WiIQfraud16.zip C:\Users\Cynthia\AppData\Local\Downloaded Installations\{9BE938C8-4585-4C5D-A6BB-9AD19F6622F2}\PCmover Professional.msi C:\Users\Cynthia\Desktop\Cissy's\gimp.exe C:\Users\Cynthia\Downloads.7z C:\Users\Cynthia\Downloads.zip C:\Users\Cynthia\Downloads\adlsoft_uncompressor_3_3_last.exe C:\Users\Cynthia\Downloads\Jeyo.Mobile.Companion.v2.1.Build.403.Incl.Keygen-SCOTCH.zip C:\Users\Cynthia\Downloads\Jeyo.Mobile.Companion.v2.1.Build.403.Incl.Keygen-SCOTCH\Jeyo.Mobile.Companion.v2.1.Build.403.Incl.Keygen-SCOTCH\Jeyo.Mobile.Companion.v2.0.Keygen.exe G:\$Recycle.Bin\S-1-5-21-3416148573-2493547136-111628057-1001\$RQENUCF\Application Data\Spybot - Search & Destroy\Recovery\WiIQfraud16.zip G:\Documents and Settings\All Users\Spybot - Search & Destroy\Recovery\WiIQfraud16.zip G:\Documents and Settings\Cynthia\AppData\Local\Downloaded Installations\{9BE938C8-4585-4C5D-A6BB-9AD19F6622F2}\PCmover Professional.msi G:\Documents and Settings\Cynthia\Desktop\Cissy's\gimp.exe G:\Documents and Settings\Cynthia\Downloads.7z G:\Documents and Settings\Cynthia\Downloads.zip G:\Documents and Settings\Cynthia\Downloads\adlsoft_uncompressor_3_3_last.exe G:\Documents and Settings\Cynthia\Downloads\Jeyo.Mobile.Companion.v2.1.Build.403.Incl.Keygen-SCOTCH.zip G:\Documents and Settings\Cynthia\Downloads\Jeyo.Mobile.Companion.v2.1.Build.403.Incl.Keygen-SCOTCH\Jeyo.Mobile.Companion.v2.1.Build.403.Incl.Keygen-SCOTCH\Jeyo.Mobile.Companion.v2.0.Keygen.exe ((((((((((((((((((((((((( Files Created from 2012-11-03 to 2012-12-03 ))))))))))))))))))))))))))))))) 2012-12-03 16:48:38 . 2012-12-03 16:48:38 ——– d—–w- C:\Users\UpdatusUser\AppData\Local\temp 2012-12-03 16:48:38 . 2012-12-03 16:48:38 ——– d—–w- C:\Users\Default\AppData\Local\temp 2012-12-03 16:48:38 . 2012-12-03 16:48:38 ——– d—–w- C:\Users\Administrator\AppData\Local\temp 2012-12-03 01:15:16 . 2012-12-03 01:15:16 ——– d—–w- C:\Program Files (x86)\ESET 2012-12-02 16:40:34 . 2012-11-08 17:24:30 9125352 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{89FE5B1E-6F31-43BF-97F3-196DA891BCD4}\mpengine.dll 2012-12-02 15:28:17 . 2012-12-02 15:28:17 0 —-a-w- C:\Users\Cynthia\AppData\Local\jv16PT_temp.tmp 2012-12-02 07:40:09 . 2012-11-08 17:24:30 9125352 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-11-30 22:27:05 . 2012-11-30 22:27:20 ——– d—–w- C:\ProgramData\UAB 2012-11-30 22:27:03 . 2012-11-30 22:27:03 ——– d—–w- C:\Users\Cynthia\AppData\Local\PC_Drivers_Headquarters 2012-11-30 21:34:32 . 2012-11-30 21:34:32 ——– d—–w- C:\Users\Cynthia\AppData\Roaming\CompuClever 2012-11-30 21:34:32 . 2012-11-30 21:34:32 ——– d—–w- C:\ProgramData\CompuClever 2012-11-30 21:34:31 . 2012-11-30 21:34:31 ——– d—–w- C:\Program Files (x86)\CompuClever 2012-11-30 16:27:01 . 2012-11-30 16:27:01 ——– d—–w- C:\_OTL 2012-11-30 16:23:37 . 2012-11-30 16:23:54 ——– d—–w- C:\Program Files (x86)\ERUNT 2012-11-29 18:14:35 . 2012-11-29 18:14:35 ——– d—–w- C:\Program Files (x86)\Jeyo 2012-11-29 02:37:02 . 2012-11-29 02:35:58 972264 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3C7566AC-6716-4EBE-8BC3-3EF061364F9C}\gapaengine.dll 2012-11-29 01:11:07 . 2012-11-29 01:11:07 ——– d—–w- C:\ProgramData\APN 2012-11-28 08:20:37 . 2012-11-28 08:20:37 ——– d—–w- C:\Users\Cynthia\AppData\Roaming\Uniblue 2012-11-28 08:20:37 . 2012-11-28 08:20:37 ——– d—–w- C:\Program Files (x86)\Uniblue 2012-11-26 20:06:38 . 2012-11-26 20:06:38 ——– d—–w- C:\Users\Cynthia\AppData\Roaming\SUPERAntiSpyware.com 2012-11-26 20:06:29 . 2012-11-26 20:06:38 ——– d—–w- C:\Program Files\SUPERAntiSpyware 2012-11-26 20:06:29 . 2012-11-26 20:06:29 ——– d—–w- C:\ProgramData\SUPERAntiSpyware.com 2012-11-21 21:09:46 . 2012-11-21 21:09:46 ——– d—–w- C:\Users\Cynthia\AppData\Local\Logitech 2012-11-21 21:08:57 . 2012-11-21 21:09:34 ——– d—–w- C:\Program Files\Logitech Gaming Software 2012-11-18 08:21:29 . 2012-11-09 06:46:10 28672 —-a-w- C:\Windows\system32\IEUDINIT.EXE 2012-11-18 08:14:13 . 2012-11-18 08:14:13 9728 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2012-11-17 04:27:33 . 2012-11-17 04:27:33 ——– d—–w- C:\Users\Cynthia\AppData\Local\The Weather Channel 2012-11-14 17:17:31 . 2012-07-26 03:08:14 84992 —-a-w- C:\Windows\system32\WUDFSvc.dll 2012-11-14 17:17:31 . 2012-07-26 03:08:14 194048 —-a-w- C:\Windows\system32\WUDFPlatform.dll 2012-11-14 17:17:31 . 2012-07-26 02:26:45 87040 —-a-w- C:\Windows\system32\drivers\WUDFPf.sys 2012-11-14 17:17:31 . 2012-07-26 02:26:06 198656 —-a-w- C:\Windows\system32\drivers\WUDFRd.sys 2012-11-14 17:17:30 . 2012-07-26 03:08:53 229888 —-a-w- C:\Windows\system32\WUDFHost.exe 2012-11-14 17:17:30 . 2012-07-26 03:08:14 744448 —-a-w- C:\Windows\system32\WUDFx.dll 2012-11-14 17:17:30 . 2012-07-26 03:08:14 45056 —-a-w- C:\Windows\system32\WUDFCoinstaller.dll 2012-11-14 12:32:30 . 2012-10-09 18:17:13 55296 —-a-w- C:\Windows\system32\dhcpcsvc6.dll 2012-11-14 12:32:30 . 2012-10-09 18:17:13 226816 —-a-w- C:\Windows\system32\dhcpcore6.dll 2012-11-14 12:32:30 . 2012-10-09 17:40:31 44032 —-a-w- C:\Windows\SysWow64\dhcpcsvc6.dll 2012-11-14 12:32:30 . 2012-10-09 17:40:31 193536 —-a-w- C:\Windows\SysWow64\dhcpcore6.dll 2012-11-14 12:30:21 . 2012-09-25 22:47:43 78336 —-a-w- C:\Windows\SysWow64\synceng.dll 2012-11-14 12:30:21 . 2012-09-25 22:46:17 95744 —-a-w- C:\Windows\system32\synceng.dll 2012-11-14 10:50:33 . 2012-06-13 09:00:48 74344 —-a-w- C:\Windows\system32\RtNicProp64.dll 2012-11-14 10:50:33 . 2012-06-13 09:00:48 726160 —-a-w- C:\Windows\system32\drivers\Rt64win7.sys 2012-11-12 07:15:20 . 2012-10-02 19:50:57 2557800 —-a-w- C:\Windows\system32\nvsvcr.dll 2012-11-12 01:50:21 . 2005-06-18 16:44:40 212240 —-a-w- C:\Windows\SysWow64\RichTx32.ocx 2012-11-12 01:50:20 . 2012-11-12 01:50:20 ——– d—–w- C:\Program Files (x86)\Common Files\eSellerate 2012-11-12 01:50:20 . 2001-03-13 19:53:42 326656 —-a-w- C:\Windows\SysWow64\temp.017 2012-11-12 01:50:18 . 2001-03-13 19:47:26 17920 —-a-w- C:\Windows\SysWow64\temp.015 2012-11-12 01:50:18 . 2001-03-13 19:47:24 164112 —-a-w- C:\Windows\SysWow64\temp.013 2012-11-12 01:50:18 . 2001-03-13 19:47:14 598288 —-a-w- C:\Windows\SysWow64\temp.012 2012-11-12 01:50:18 . 2001-03-13 19:45:54 147728 —-a-w- C:\Windows\SysWow64\temp.014 2012-11-12 01:50:18 . 2000-08-21 02:00:00 1388544 —-a-w- C:\Windows\SysWow64\temp.016 2012-11-12 01:46:07 . 2001-03-13 19:53:42 326656 —-a-w- C:\Windows\SysWow64\temp.011 2012-11-12 01:46:06 . 2001-03-13 19:47:26 17920 —-a-w- C:\Windows\SysWow64\temp.00F 2012-11-12 01:46:06 . 2001-03-13 19:47:24 164112 —-a-w- C:\Windows\SysWow64\temp.00D 2012-11-12 01:46:06 . 2001-03-13 19:45:54 147728 —-a-w- C:\Windows\SysWow64\temp.00E 2012-11-12 01:46:06 . 2000-08-21 02:00:00 1388544 —-a-w- C:\Windows\SysWow64\temp.010 2012-11-12 01:46:05 . 2001-03-13 19:47:14 598288 —-a-w- C:\Windows\SysWow64\temp.00C 2012-11-12 00:10:59 . 2012-11-12 01:30:03 ——– d—–w- C:\Program Files (x86)\uTorrent 2012-11-11 23:22:32 . 2012-11-11 23:22:32 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin8.dll 2012-11-11 23:22:32 . 2012-11-11 23:22:32 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin7.dll 2012-11-11 23:22:32 . 2012-11-11 23:22:31 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin6.dll 2012-11-11 23:22:32 . 2012-11-11 23:22:31 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin5.dll 2012-11-11 23:22:32 . 2012-11-11 23:22:31 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin4.dll 2012-11-11 23:22:32 . 2012-11-11 23:22:31 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin3.dll 2012-11-11 23:22:32 . 2012-11-11 23:22:31 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin2.dll 2012-11-11 23:22:32 . 2012-11-11 23:22:31 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin.dll 2012-11-11 23:14:01 . 2012-11-11 23:13:50 95208 —-a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll 2012-11-11 23:13:47 . 2012-11-11 23:13:47 ——– d—–w- C:\Program Files (x86)\Java 2012-11-11 22:41:30 . 2012-07-26 04:55:47 785512 —-a-w- C:\Windows\system32\drivers\Wdf01000.sys 2012-11-11 22:41:30 . 2012-07-26 04:55:47 54376 —-a-w- C:\Windows\system32\drivers\WdfLdr.sys 2012-11-11 22:41:30 . 2012-07-26 04:47:34 2560 —-a-w- C:\Windows\system32\drivers\en-US\wdf01000.sys.mui 2012-11-11 22:41:30 . 2012-07-26 02:36:08 9728 —-a-w- C:\Windows\system32\Wdfres.dll 2012-11-11 22:41:09 . 2012-11-11 22:41:15 ——– d—–w- C:\Program Files\Microsoft Mouse and Keyboard Center 2012-11-11 22:19:17 . 2012-08-24 18:13:17 154480 —-a-w- C:\Windows\system32\drivers\ksecpkg.sys 2012-11-11 22:19:17 . 2012-08-24 18:09:34 458712 —-a-w- C:\Windows\system32\drivers\cng.sys 2012-11-11 22:19:17 . 2012-08-24 18:05:03 340992 —-a-w- C:\Windows\system32\schannel.dll 2012-11-11 22:19:17 . 2012-08-24 18:04:18 307200 —-a-w- C:\Windows\system32\ncrypt.dll 2012-11-11 22:19:17 . 2012-08-24 16:57:40 247808 —-a-w- C:\Windows\SysWow64\schannel.dll 2012-11-11 22:19:16 . 2012-08-24 18:03:09 1448448 —-a-w- C:\Windows\system32\lsasrv.dll 2012-11-11 22:19:16 . 2012-08-24 16:57:40 22016 —-a-w- C:\Windows\SysWow64\secur32.dll 2012-11-11 22:19:16 . 2012-08-24 16:57:37 220160 —-a-w- C:\Windows\SysWow64\ncrypt.dll 2012-11-11 22:19:16 . 2012-08-24 16:53:35 96768 —-a-w- C:\Windows\SysWow64\sspicli.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2012-11-27 00:35:19 . 2012-04-02 21:42:49 697272 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-11-27 00:35:19 . 2011-06-26 16:59:39 73656 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-11-21 21:05:15 . 2011-03-16 19:56:34 18960 —-a-w- C:\Windows\system32\drivers\LNonPnP.sys 2012-11-14 17:18:10 . 2011-04-13 20:55:42 66395536 —-a-w- C:\Windows\system32\MRT.exe 2012-11-11 23:13:48 . 2012-07-25 19:42:58 821736 —-a-w- C:\Windows\SysWow64\npDeployJava1.dll 2012-11-11 23:13:48 . 2012-01-01 21:34:08 746984 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2012-11-02 21:38:36 . 2012-11-02 21:38:36 862664 —-a-w- C:\Windows\SysWow64\msvcr110.dll 2012-11-02 21:38:36 . 2012-11-02 21:38:36 828872 —-a-w- C:\Windows\system32\msvcr110.dll 2012-11-02 21:38:36 . 2012-11-02 21:38:36 661448 —-a-w- C:\Windows\system32\msvcp110.dll 2012-11-02 21:38:36 . 2012-11-02 21:38:36 534480 —-a-w- C:\Windows\SysWow64\msvcp110.dll 2012-11-02 21:38:36 . 2012-11-02 21:38:36 50856 —-a-w- C:\Windows\system32\drivers\point64.sys 2012-11-02 21:38:36 . 2012-11-02 21:38:36 354264 —-a-w- C:\Windows\system32\vccorlib110.dll 2012-11-02 21:38:36 . 2012-11-02 21:38:36 251864 —-a-w- C:\Windows\SysWow64\vccorlib110.dll 2012-11-02 21:38:36 . 2012-11-02 21:38:36 23960 —-a-w- C:\Windows\system32\drivers\nuidfltr.sys 2012-10-31 20:03:48 . 2012-10-31 20:03:47 2792728 —-a-w- C:\PortableRoboForm.exe 2012-10-25 09:12:26 . 2012-10-25 09:12:26 94208 —-a-w- C:\Windows\SysWow64\QuickTimeVR.qtx 2012-10-25 09:12:26 . 2012-10-25 09:12:26 69632 —-a-w- C:\Windows\SysWow64\QuickTime.qts 2012-10-19 23:18:22 . 2012-10-14 04:46:30 652160 —-a-w- C:\Windows\couponprinter_x64.ocx 2012-10-16 08:38:37 . 2012-11-28 20:37:05 135168 —-a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll 2012-10-16 08:38:34 . 2012-11-28 20:37:05 350208 —-a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll 2012-10-16 07:39:52 . 2012-11-28 20:37:05 561664 —-a-w- C:\Windows\apppatch\AcLayers.dll 2012-10-02 22:21:00 . 2012-07-31 20:38:54 9146728 —-a-w- C:\Windows\system32\nvcuda.dll 2012-10-02 22:21:00 . 2012-07-31 20:38:54 2731880 —-a-w- C:\Windows\system32\nvapi64.dll 2012-10-02 22:21:00 . 2011-11-05 18:12:50 1760104 —-a-w- C:\Windows\system32\nvdispco64.dll 2012-10-02 22:21:00 . 2011-11-05 18:12:50 14922600 —-a-w- C:\Windows\system32\nvwgf2umx.dll 2012-10-02 19:51:15 . 2012-04-16 06:26:35 3536817 —-a-w- C:\Windows\system32\nvcoproc.bin 2012-10-02 19:51:11 . 2011-11-05 18:13:49 3293544 —-a-w- C:\Windows\system32\nvsvc64.dll 2012-10-02 19:51:04 . 2011-11-05 18:13:49 6200680 —-a-w- C:\Windows\system32\nvcpl.dll 2012-10-02 19:50:57 . 2011-11-05 18:13:49 891240 —-a-w- C:\Windows\system32\nvvsvc.exe 2012-10-02 19:50:57 . 2011-11-05 18:13:49 63336 —-a-w- C:\Windows\system32\nvshext.dll 2012-10-02 19:50:57 . 2011-11-05 18:13:49 118120 —-a-w- C:\Windows\system32\nvmctray.dll 2012-10-02 19:15:52 . 2012-10-02 19:15:52 430952 —-a-w- C:\Windows\SysWow64\nvStreaming.exe 2012-09-30 07:15:30 . 2011-03-26 05:30:27 972192 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll 2012-09-30 01:54:26 . 2011-04-07 17:35:55 25928 —-a-w- C:\Windows\system32\drivers\mbam.sys 2012-09-29 03:52:10 . 2012-09-29 03:52:10 75928 —-a-w- C:\Windows\system32\drivers\dc3d.sys 2012-09-29 03:52:10 . 2012-09-29 03:52:10 2177704 —-a-w- C:\Windows\system32\coin92.dll 2012-09-29 03:52:10 . 2012-09-29 03:52:10 1795952 —-a-w- C:\Windows\system32\WdfCoInstaller01011.dll 2012-09-14 19:19:29 . 2012-10-10 23:44:10 2048 —-a-w- C:\Windows\system32\tzres.dll 2012-09-14 18:28:53 . 2012-10-10 23:44:10 2048 —-a-w- C:\Windows\SysWow64\tzres.dll 2012-09-13 06:44:32 . 2012-09-28 00:47:31 17936 —-a-w- C:\Windows\system32\nitrolocalui2.dll 2012-09-13 06:44:30 . 2012-09-28 00:47:31 29712 —-a-w- C:\Windows\system32\nitrolocalmon2.dll 2012-09-10 21:56:53 . 2012-09-10 21:56:53 31080 —-a-w- C:\Windows\system32\drivers\avgtpx64.sys ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] C:\Program Files (x86)\AVG Secure Search\12.2.5.33\AVG Secure Search_toolbar.dll [BU] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "C:\Program Files (x86)\AVG Secure Search\12.2.5.33\AVG Secure Search_toolbar.dll" [BU] [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Bidnapper Homelink"="C:\Program Files (x86)\Bidnapper\Bidnapper Homelink\BidnapperHomelink.exe" [2010-04-21 23:07:56 236544] "Eraser"="C:\Program Files\Eraser\Eraser.exe" [2010-11-05 03:08:04 980368] "PCShowServer"="C:\Users\Cynthia\AppData\Local\DIRECTV Player\PCShowServerPMWrapper.exe" [2012-04-02 21:50:14 351888] "Free Download Manager"="C:\Program Files (x86)\Free Download Manager\fdm.exe" [2011-12-28 18:40:48 6148096] "RoboForm"="C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2012-11-16 15:43:05 109336] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-11-01 19:41:30 5629312] "Driver Detective"="C:\Program Files (x86)\PC Drivers HeadQuarters\Driver Detective\DriversHQ.DriverDetective.Client.exe" [2012-11-12 21:22:26 3539936] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "PowerPanel Personal Edition User Interaction"="C:\Program Files (x86)\CyberPower PowerPanel Personal Edition\pppeuser.exe" [2010-08-03 15:02:08 349632] "amd_dc_opt"="C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 19:53:10 77824] "Info Center"="C:\Program Files (x86)\PCPitstop\Info Center\InfoCenter.exe" [2012-09-01 02:38:26 27328] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "RoboForm"="C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2012-11-16 15:43:05 109336] C:\Users\Cynthia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ERUNT AutoBackup.lnk - C:\Program Files (x86)\ERUNT\AUTOBACK.EXE [2005-10-20 38912] Rainmeter.lnk - C:\Program Files\Rainmeter\Rainmeter.exe [2012-11-4 41160] Stickies.lnk - C:\Program Files (x86)\Stickies\stickies.exe [2008-8-28 765952] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Snagit 9.lnk - C:\Program Files (x86)\TechSmith\Snagit 9\Snagit32.exe [2009-10-15 6287176] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) "EnableLinkedConnections"= 1 (0x1) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\setup\disabledrunkeys] "Windows Mobile Device Center"=%windir%\WindowsMobile\wmdc.exe R1 ArcSec;ArcSec;C:\Windows\system32\drivers\ArcSec.sys [x] R1 sensorsview;sensorsview;C:\Program Files (x86)\SensorsViewPro41\drv\sensorsview32_64.sys [x] R2 {329F96B6-DF1E-4328-BFDA-39EA953C1312};Power Control [2011/09/03 18:07:47];C:\Program Files (x86)\CyberLink\PowerDVD11\Common\NavFilter\000.fcl [x] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 19:27:14 138576] R2 ntk_PowerDVD;ntk_PowerDVD;C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\ntk_PowerDVD_64.sys [x] R3 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [x] R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys [2011-03-30 18:46:44 114704] R3 ATTRcAppSvc;AT&T RcAppSvc;C:\Program Files (x86)\AT&T\Communication Manager\RcAppSvc.exe [2009-12-04 23:41:50 121416] R3 CAATT;AT&T Con App Svc;C:\Program Files (x86)\AT&T\Communication Manager\ConAppsSvc.exe [2009-12-04 23:39:56 125512] R3 CinemaNow Service;CinemaNow Service;C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe [2010-01-14 22:58:40 129520] R3 CLHNServiceForPowerDVD;CLHNServiceForPowerDVD;C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe [x] R3 CyberLink PowerDVD 11.0 Monitor Service;CyberLink PowerDVD 11.0 Monitor Service;C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe [x] R3 CyberLink PowerDVD 11.0 Service;CyberLink PowerDVD 11.0 Service;C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSServerForPDVD11.exe [x] R3 LADF_BakerCOnly;BakerC Filter Driver;C:\Windows\system32\DRIVERS\ladfBakerCamd64.sys [2011-03-18 22:20:22 410184] R3 LADF_BakerROnly;BakerR Filter Driver;C:\Windows\system32\DRIVERS\ladfBakerRamd64.sys [2011-03-18 19:33:48 335688] R3 McciCMService64;McciCMService64;C:\Program Files\Common Files\Motive\McciCMService.exe [2010-10-17 01:11:30 517632] R3 Media Center 17 Service;Media Center 17 Service;C:\Program Files (x86)\J River\Media Center 17\JRService.exe [2012-06-10 20:02:39 394408] R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 03:03:48 128456] R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-09-13 02:21:48 368896] R3 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2012-09-13 06:44:42 229392] R3 PCTINDIS5X64;PCTINDIS5X64 NDIS Protocol Driver;C:\Windows\system32\PCTINDIS5X64.SYS [2009-12-04 23:31:18 43032] R3 pwdrvio;pwdrvio;C:\Windows\system32\pwdrvio.sys [2009-12-22 02:39:26 19912] R3 pwdspio;pwdspio;C:\Windows\system32\pwdspio.sys [2009-12-22 02:39:24 13264] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14:10:20 19456] R3 Revoflt;Revoflt;C:\Windows\system32\DRIVERS\revoflt.sys [2009-12-30 16:21:26 31800] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys [x] R3 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x] R3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys [2012-08-23 14:07:35 57856] R3 vToolbarUpdater12.2.6;vToolbarUpdater12.2.6;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe [x] R3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe [2011-03-17 00:03:33 1255736] R3 WinRing0_1_2_0;WinRing0_1_2_0;C:\Users\Cynthia\Desktop\Dan's\paperback swap\RealTemp_360\WinRing0x64.sys [x] S0 pavboot;pavboot;C:\Windows\system32\drivers\pavboot64.sys [2009-06-30 16:37:16 33800] S0 PxHlpa64;PxHlpa64;C:\Windows\System32\Drivers\PxHlpa64.sys [2010-03-11 02:50:55 52856] S0 tdrpman251;Acronis Try&Decide and Restore Points filter (build 251);C:\Windows\system32\DRIVERS\tdrpm251.sys [2011-04-24 04:58:25 1455648] S1 avgtp;avgtp;C:\Windows\system32\drivers\avgtpx64.sys [2012-09-10 21:56:53 31080] S1 HssDRV6;Hotspot Shield Routing Driver 6;C:\Windows\system32\DRIVERS\hssdrv6.sys [2012-08-01 18:13:42 41704] S1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 16:26:56 14928] S1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 21:55:18 12368] S2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2012-07-11 18:54:58 140672] S2 acedrv11;acedrv11;C:\Windows\system32\drivers\acedrv11.sys [2010-02-24 10:20:40 191616] S2 afcdpsrv;Acronis Nonstop Backup service;C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2011-04-24 04:58:27 2326920] S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [2012-10-23 21:35:40 103472] S2 PCPitstop Scheduling;PCPitstop Scheduling;C:\Program Files (x86)\PCPitstop\PCPitstopScheduleService.exe [2012-11-15 19:57:20 86216] S3 afcdp;afcdp;C:\Windows\system32\DRIVERS\afcdp.sys [2011-04-24 04:58:28 250400] S3 dc3d;MS Hardware Device Detection Driver;C:\Windows\system32\DRIVERS\dc3d.sys [2012-09-29 03:52:10 75928] S3 LADF_CaptureOnly;LADF Capture Filter Driver;C:\Windows\system32\DRIVERS\ladfGSCamd64.sys [2011-04-11 19:00:18 410184] S3 LADF_RenderOnly;LADF Render Filter Driver;C:\Windows\system32\DRIVERS\ladfGSRamd64.sys [2011-04-11 19:01:00 341832] S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;C:\Windows\system32\drivers\LGBusEnum.sys [2009-11-24 00:37:50 22408] S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;C:\Windows\system32\drivers\LGVirHid.sys [2009-11-24 00:38:00 16008] S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;C:\Windows\system32\DRIVERS\point64.sys [2012-11-02 21:38:36 50856] S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys [2012-06-13 09:00:48 726160] [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2011-06-20 21:05:00 451872 —-a-w- C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe Contents of the 'Scheduled Tasks' folder 2012-11-18 C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cdc546bca0a8f1.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-05-15 10:21:30 . 2010-05-15 10:21:27] 2012-11-28 C:\Windows\Tasks\SpeedUpMyPC.job - C:\Program Files (x86)\Uniblue\SpeedUpMyPC\sump.exe [2012-11-28 08:20:38 . 2012-11-23 01:44:00] ——— X64 Entries ———– [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Eraser"="C:\PROGRA~1\Eraser\Eraser.exe" [2010-11-05 03:08:04 980368] "Windows Mobile Device Center"="C:\Windows\WindowsMobile\wmdc.exe" [2007-05-31 16:11:56 660360] "MSC"="C:\Program Files\Microsoft Security Client\msseces.exe" [2012-09-13 02:16:10 1289704] "boincmgr"="C:\Program Files\BOINC\boincmgr.exe" [2012-05-15 21:02:02 5860016] "boinctray"="C:\Program Files\BOINC\boinctray.exe" [2012-05-15 21:02:00 70832] "RtHDVCpl"="C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-06-11 16:28:02 12503184] "IntelliPoint"="C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe" [2012-11-02 21:38:34 2076272] "Launch LCore"="C:\Program Files\Logitech Gaming Software\LCore.exe" [2012-07-24 00:33:00 6900024] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService FontCache ——- Supplementary Scan ——- uLocal Page = C:\Windows\system32\blank.htm uDefault_Search_URL = hxxp://www.google.com/ie uStart Page = hxxp://www.google.com/ mLocal Page = C:\Windows\SysWOW64\blank.htm uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &ieSpell Options - C:\Program Files (x86)\ieSpell\iespell.dll/SPELLOPTION.HTM IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200 IE: Check &Spelling - C:\Program Files (x86)\ieSpell\iespell.dll/SPELLCHECK.HTM IE: Customize Menu - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html IE: Download all with Free Download Manager - file://C:\Program Files (x86)\Free Download Manager\dlall.htm IE: Download selected with Free Download Manager - file://C:\Program Files (x86)\Free Download Manager\dlselected.htm IE: Download video with Free Download Manager - file://C:\Program Files (x86)\Free Download Manager\dlfvideo.htm IE: Download with Free Download Manager - file://C:\Program Files (x86)\Free Download Manager\dllink.htm IE: Fill Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html IE: Google Sidewiki… - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html IE: Lookup on Merriam Webster - file://C:\Program Files (x86)\ieSpell\Merriam Webster.HTM IE: Lookup on Wikipedia - file://C:\Program Files (x86)\ieSpell\wikipedia.HTM IE: RoboForm Editor - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComEditIdent.html IE: Save Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html IE: Set Fields - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSetFields.html IE: Show RoboForm Toolbar - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html IE: Sync RoboForm Data - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSync.html TCP: DhcpNameServer = 192.168.1.254 DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} - hxxp://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll DPF: {72376E32-8AF2-473F-BE32-E5D0F39C865D} - hxxp://www.cyberlink.com/prog/win7/js/UpdateAdvisor.cab DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://beach.sandestinwebcam.com/activex/AMC.cab - - - - ORPHANS REMOVED - - - - BHO-{FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - (no file) WebBrowser-{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - (no file) WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) AddRemove-SLABCOMM&10C4&EA60 - C:\Windows\system32\Silabs\DriverUninstaller.exe VCP CP210x Cardinal\SLABCOMM&10C4&EA60 MBAM Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Database version: v2012.12.02.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.10.9200.16438 Cynthia :: OFFICE [administrator] 12/3/2012 10:29:11 AM mbam-log-2012-12-03 (10-29-11).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 256314 Time elapsed: 2 minute(s), 57 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoRecycleFiles (PUM.Disable.Recycle) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully. Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)