Spyware / Malware / Virus Removal

Laptop Running Very Slow [Solved]

23 min read

Looking for the outcome? Ask AI

YatesBros Topic Starter

Post #1December 16, 2012, 9:06 PM UTC

My laptop is running very slow. I used CCleaner to go in and turn off various applications that were starting at start-up. It did not help very much. I was wondering if someone could help take a look to see if there is anything else causing issues like Malware or a virus. I have Microsoft Security Essentials running all the time. I run Malware bytes check weekly. Here is the Hyjackthis that I ran. Any help would be much appreciated.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:57:43 PM, on 12/16/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16457)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe
C:\Users\owner\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…d4z1m5t47l2x29n
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://toolbar.inbox.com/search/dispatcher…d&%language
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchnu.com/406
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…d4z1m5t47l2x29n
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…d4z1m5t47l2x29n
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - (no file)
R3 - URLSearchHook: (no name) - {37483b40-c254-4a72-bda4-22ee90182c1e} - (no file)
R3 - URLSearchHook: (no name) - {0696f815-a3a9-490a-bb14-9ec3350b1276} - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64SrcAs.dll
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ooVoo Toolbar - {59c6f12b-f004-43e5-9997-08f2123119b6} - C:\Program Files (x86)\oovootoolbar\oovootoolbarX.dll
O2 - BHO: Search Assistant BHO - {5d79f641-c168-40df-a32f-bacea7509e75} - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64SrcAs.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll (file missing)
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Toolbar BHO - {cb41fc95-f1b3-4797-8bb6-1012ff62abba} - C:\PROGRA~2\TELEVI~2\bar\1.bin\64bar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo Layers Runtime\YontooIEClient.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: ooVoo Toolbar - {59c6f12b-f004-43e5-9997-08f2123119b6} - C:\Program Files (x86)\oovootoolbar\oovootoolbarX.dll
O3 - Toolbar: TelevisionFanatic - {c98d5b61-b0ea-4d48-9839-1079d352d880} - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64bar.dll
O3 - Toolbar: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll (file missing)
O4 - HKLM\..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files (x86)\Acer\Acer Assist\launcher.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: Go to PlaySushi web site - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - (no file)
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs:
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\Acer Games\Acer Game Console\GameConsoleService.exe
O23 - Service: GRegService (Greg_Service) - Acer Incorporated - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: MyWinLocker Service (MWLService) - Egis Technology Inc. - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TelevisionFanaticService - COMPANYVERS_NAME - C:\PROGRA~2\TELEVI~2\bar\1.bin\64barsvc.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Updater Service - Acer - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 12649 bytes

JonTom

Post #2December 16, 2012, 11:41 PM UTC

Hello YatesBros and

My name is JonTom

Malware Logs can sometimes take a lot of time to research and interpret.
Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
PLEASE NOTE: If you do not reply after 3 days your thread will be closed.

HiJackThis is a little outdated now, so lets take a closer look at your machine with the following scans

Download and run OTL by Oldtimer
- Please download OTL by Oldtimer by clicking here and save the file (called OTL.exe) to your desktop.
- Close all open windows on your computer then Right click on the OTL.exe icon and select "Run as Administrator" to run the program.
- Check the boxes beside "LOP Check" and "Purity Check".
- Under Custom Scan paste this in:
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\drivers\*.sys /90
CREATERESTOREPOINT
- Click the "Run Scan" button. Do not change any settings unless specifically told to do so. The scan will not take long.
- When the scan completes, it will open two notepad windows: OTL.Txt and Extras.Txt.
- Note: These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
- Please Copy and Paste the contents of both files in your next reply. You may need two posts to fit them both in.
aswMBR
- Download aswMBR.exe to your desktop.
- Double click the aswMBR.exe to run it.
- When asked if you want to download Avast's virus definitions please select Yes.
- Click the "Scan" button to start scan.
[external image: Posted Image]
- On completion of the scan click save log, save it to your desktop and post in your next reply.
[external image: Posted Image]

Please post both OTL logs and the aswMBR log in your next reply.

YatesBros

Post #3December 18, 2012, 2:17 AM UTC

Thank you so much for your willingness to help.

OTL.Txt
OTL logfile created on: 12/17/2012 8:31:49 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\owner\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 1.76 Gb Available Physical Memory | 64.19% Memory free
5.49 Gb Paging File | 4.19 Gb Available in Paging File | 76.34% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 136.95 Gb Total Space | 74.31 Gb Free Space | 54.26% Space Free | Partition Type: NTFS

Computer Name: OWNER-PC | User Name: owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/12/17 18:56:35 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\owner\Desktop\OTL.exe
PRC - [2012/07/16 10:42:58 | 000,042,504 | —- | M] (COMPANYVERS_NAME) – C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64barsvc.exe
PRC - [2009/08/06 12:18:54 | 000,311,592 | —- | M] (Egis Technology Inc.) – C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
PRC - [2009/08/06 12:18:42 | 000,349,480 | —- | M] (Egis Technology Inc.) – C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
PRC - [2009/07/27 19:50:32 | 001,157,128 | —- | M] (Dritek System Inc.) – C:\Program Files (x86)\Launch Manager\LManager.exe
PRC - [2009/07/03 20:47:12 | 000,240,160 | —- | M] (Acer) – C:\Program Files\Acer\Acer Updater\UpdaterService.exe
PRC - [2009/06/04 08:04:50 | 001,150,496 | —- | M] (Acer Incorporated) – C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

========== Modules (No Company Name) ==========

MOD - [2011/10/05 03:52:30 | 000,756,048 | —- | M] () – C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\MSPTLS.DLL

========== Services (SafeList) ==========

SRV:64bit: - [2012/09/12 20:21:48 | 000,368,896 | —- | M] (Microsoft Corporation) [On_Demand | Running] – c:\Program Files\Microsoft Security Client\NisSrv.exe – (NisSrv)
SRV:64bit: - [2012/09/12 20:21:48 | 000,022,072 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\MsMpEng.exe – (MsMpSvc)
SRV:64bit: - [2009/08/05 23:30:58 | 000,844,320 | —- | M] (Acer Incorporated) [Auto | Running] – C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe – (ePowerSvc)
SRV:64bit: - [2009/07/29 07:03:42 | 000,203,264 | —- | M] (AMD) [Auto | Running] – C:\Windows\SysNative\atiesrxx.exe – (AMD External Events Utility)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV:64bit: - [2009/07/03 20:47:12 | 000,240,160 | —- | M] (Acer) [Auto | Running] – C:\Program Files\Acer\Acer Updater\UpdaterService.exe – (Updater Service)
SRV - [2012/12/12 19:18:30 | 000,115,168 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2012/12/12 15:10:20 | 000,250,808 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/10/19 18:10:42 | 000,147,888 | —- | M] (LogMeIn, Inc.) [Auto | Running] – C:\Program Files (x86)\LogMeIn\x64\ramaint.exe – (LMIMaint)
SRV - [2012/10/19 18:10:34 | 000,375,728 | —- | M] (LogMeIn, Inc.) [Auto | Running] – C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe – (LMIGuardianSvc)
SRV - [2012/08/24 14:41:30 | 000,407,424 | —- | M] (LogMeIn, Inc.) [Auto | Running] – C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe – (LogMeIn)
SRV - [2012/07/16 10:42:58 | 000,042,504 | —- | M] (COMPANYVERS_NAME) [Auto | Running] – C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64barsvc.exe – (TelevisionFanaticService)
SRV - [2012/07/13 12:28:36 | 000,160,944 | R— | M] (Skype Technologies) [Auto | Stopped] – C:\Program Files (x86)\Skype\Updater\Updater.exe – (SkypeUpdate)
SRV - [2010/10/22 13:08:18 | 001,039,360 | —- | M] (Hewlett-Packard Co.) [Auto | Running] – C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL – (HPSLPSVC)
SRV - [2010/03/18 13:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2010/01/04 13:03:42 | 000,238,328 | —- | M] (WildTangent, Inc.) [On_Demand | Stopped] – C:\Program Files (x86)\Acer Games\Acer Game Console\GameConsoleService.exe – (GameConsoleService)
SRV - [2009/08/06 12:18:54 | 000,311,592 | —- | M] () [Auto | Running] – C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe – (MWLService)
SRV - [2009/06/10 16:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)
SRV - [2009/06/04 08:04:50 | 001,150,496 | —- | M] (Acer Incorporated) [Auto | Running] – C:\Program Files (x86)\Acer\Registration\GregHSRW.exe – (Greg_Service)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/11/02 15:38:36 | 000,050,856 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\point64.sys – (Point64)
DRV:64bit: - [2012/11/01 21:52:50 | 000,075,928 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\dc3d.sys – (dc3d)
DRV:64bit: - [2012/10/19 18:11:06 | 000,088,008 | —- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] – C:\Windows\SysNative\LMIRfsClientNP.dll – (LMIRfsClientNP)
DRV:64bit: - [2012/08/30 21:03:48 | 000,128,456 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\Windows\SysNative\drivers\NisDrvWFP.sys – (NisDrv)
DRV:64bit: - [2012/08/24 14:41:30 | 000,072,216 | —- | M] (LogMeIn, Inc.) [File_System | Auto | Running] – C:\Windows\SysNative\drivers\LMIRfsDriver.sys – (LMIRfsDriver)
DRV:64bit: - [2012/08/24 14:41:16 | 000,011,552 | —- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\lmimirr.sys – (lmimirr)
DRV:64bit: - [2012/08/23 09:10:20 | 000,019,456 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\rdpvideominiport.sys – (RdpVideoMiniport)
DRV:64bit: - [2012/08/23 09:07:35 | 000,057,856 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2012/08/21 12:01:20 | 000,033,240 | —- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\GEARAspiWDM.sys – (GEARAspiWDM)
DRV:64bit: - [2012/07/09 12:42:54 | 000,052,736 | —- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\usbaapl64.sys – (USBAAPL64)
DRV:64bit: - [2012/03/01 01:46:16 | 000,023,408 | —- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] – C:\Windows\SysNative\drivers\fs_rec.sys – (Fs_Rec)
DRV:64bit: - [2011/03/11 01:41:12 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/03/11 01:41:12 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2010/11/20 08:33:35 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2009/10/05 16:34:00 | 001,542,656 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\athrx.sys – (athr)
DRV:64bit: - [2009/07/29 17:11:24 | 006,038,016 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmdag.sys – (atikmdag)
DRV:64bit: - [2009/07/27 02:04:36 | 000,058,880 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\L1C62x64.sys – (L1C)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/07/13 19:35:32 | 000,012,288 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\serscan.sys – (StillCam)
DRV:64bit: - [2009/06/18 07:12:32 | 000,272,432 | —- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\SynTP.sys – (SynTP)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009/06/02 06:15:30 | 000,060,464 | —- | M] (Egis Technology Inc.) [Kernel | System | Running] – C:\Windows\SysNative\drivers\mwlPSDVDisk.sys – (mwlPSDVDisk)
DRV:64bit: - [2009/06/02 06:15:30 | 000,022,576 | —- | M] (Egis Technology Inc.) [File_System | System | Running] – C:\Windows\SysNative\drivers\mwlPSDFilter.sys – (mwlPSDFilter)
DRV:64bit: - [2009/06/02 06:15:30 | 000,020,016 | —- | M] (Egis Technology Inc.) [Kernel | System | Running] – C:\Windows\SysNative\drivers\mwlPSDNserv.sys – (mwlPSDNServ)
DRV:64bit: - [2009/05/05 03:46:08 | 000,018,432 | —- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\NTIDrvr.sys – (NTIDrvr)
DRV:64bit: - [2009/05/05 03:46:08 | 000,016,896 | —- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\UBHelper.sys – (UBHelper)
DRV:64bit: - [2009/05/04 08:30:28 | 000,016,440 | —- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\AtiPcie.sys – (AtiPcie)
DRV:64bit: - [2009/04/03 08:39:58 | 000,034,872 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\usbfilter.sys – (usbfilter)
DRV:64bit: - [2008/03/13 02:46:00 | 000,027,136 | —- | M] (ManyCam LLC.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\ManyCam_x64.sys – (ManyCam)
DRV - [2012/08/24 14:41:32 | 000,015,928 | —- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] – C:\Program Files (x86)\LogMeIn\x64\rainfo.sys – (LMIInfo)
DRV - [2009/07/13 20:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…d4z1m5t47l2x29n
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…d4z1m5t47l2x29n
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…d4z1m5t47l2x29n
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…d4z1m5t47l2x29n
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7ACAW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT2801948

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…d4z1m5t47l2x29n
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://toolbar.inbox.com/search/dispatcher…d&%language
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchnu.com/406
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.msn.com
IE - HKCU\..\URLSearchHook: {0696f815-a3a9-490a-bb14-9ec3350b1276} - No CLSID value found
IE - HKCU\..\URLSearchHook: {37483b40-c254-4a72-bda4-22ee90182c1e} - No CLSID value found
IE - HKCU\..\URLSearchHook: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?FORM=GM2TDF&…rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{3DB51E13-7669-4FED-BCB4-0B72D7D7ECDA}: "URL" = http://websearch.ask.com/redirect?client=i…12-ADB9F98F35FA
IE - HKCU\..\SearchScopes\{409DD3B4-D1F8-EC6E-EDBD-2367FDA78762}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&…1I7ACAW_enUS355
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
IE - HKCU\..\SearchScopes\{9E699A06-EE61-4B6B-A91E-70ABBE285723}: "URL" = http://ws.infospace.com/playsushi_tbar/ws/…ceUrl=true& user_id=%userid&tool_id=60231&qkw={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT2801948
IE - HKCU\..\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}: "URL" = http://toolbar.inbox.com/search/dispatcher…0364&lng=en
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "NCH EN Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2801948&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:3.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:2010.9.0.6
FF - prefs.js..extensions.enabledItems: {59c6f12b-f004-43e5-9997-08f2123119b6}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.3.0.7280
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {ED76C299-85BC-4891-9237-74A140C28832}:[removed]
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
FF - prefs.js..extensions.enabledItems: {37483b40-c254-4a72-bda4-22ee90182c1e}:3.8.1.0
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&appid=150&systemid=406&sr=0&q="

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_135.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@TelevisionFanatic.com/Plugin: C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\NP64Stub.dll (MindSpark)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\owner\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\owner\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\TelevisionFanatic\bar\1.bin [2012/07/16 10:43:11 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012/11/25 16:54:34 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/12/12 19:18:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/12/12 19:16:59 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012/11/25 16:54:34 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/12/12 19:18:33 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/12/12 19:16:59 | 000,000,000 | —D | M]

[2012/11/25 16:24:04 | 000,000,000 | —D | M] (No name found) – C:\Users\owner\AppData\Roaming\mozilla\Extensions
[2012/11/30 17:49:09 | 000,000,000 | —D | M] (No name found) – C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\2xmxyhoy.default\extensions
[2010/12/31 14:42:55 | 000,000,000 | —D | M] (ooVoo Toolbar) – C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\{59c6f12b-f004-43e5-9997-08f2123119b6}
[2012/11/30 17:49:09 | 000,000,000 | —D | M] (TelevisionFanatic) – C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\[removed]
[2012/01/10 21:47:38 | 000,000,000 | —D | M] (Yontoo Layers) – C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\[removed]
[2012/10/15 15:25:18 | 000,002,299 | —- | M] () – C:\Users\owner\AppData\Roaming\mozilla\firefox\profiles\2xmxyhoy.default\searchplugins\askcom.xml
[2011/01/31 19:05:30 | 000,001,919 | —- | M] () – C:\Users\owner\AppData\Roaming\mozilla\firefox\profiles\2xmxyhoy.default\searchplugins\bing-zugo.xml
[2010/07/02 11:17:29 | 000,001,842 | —- | M] () – C:\Users\owner\AppData\Roaming\mozilla\firefox\profiles\2xmxyhoy.default\searchplugins\bing.xml
[2011/12/13 15:06:06 | 000,000,915 | —- | M] () – C:\Users\owner\AppData\Roaming\mozilla\firefox\profiles\2xmxyhoy.default\searchplugins\conduit.xml
[2011/10/14 20:26:43 | 000,002,292 | —- | M] () – C:\Users\owner\AppData\Roaming\mozilla\firefox\profiles\2xmxyhoy.default\searchplugins\inbox-search.xml
[2012/07/20 08:37:14 | 000,002,519 | —- | M] () – C:\Users\owner\AppData\Roaming\mozilla\firefox\profiles\2xmxyhoy.default\searchplugins\Search_Results.xml
[2012/12/12 19:16:57 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/12/12 19:16:57 | 000,000,000 | —D | M] (Skype extension) – C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/12/12 19:18:33 | 000,262,112 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2009/11/06 11:37:19 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npCouponPrinter.dll
[2009/11/06 11:37:20 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npMozCouponPrinter.dll
[2012/11/11 17:43:59 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/07/20 08:37:14 | 000,002,519 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml
[2012/11/11 17:43:59 | 000,002,058 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://www.searchnu.com/406
CHR - default_search_provider: Search Results (Enabled)
CHR - default_search_provider: search_url = http://dts.search-results.com/sr?src=crb&a…q={searchTerms}
CHR - default_search_provider: suggest_url =
CHR - homepage: http://www.searchnu.com/406
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\owner\AppData\Local\Google\Chrome\Application\23.0.1271.64\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U26 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\owner\AppData\Local\Google\Chrome\Application\23.0.1271.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\owner\AppData\Local\Google\Chrome\Application\23.0.1271.64\pdf.dll
CHR - plugin: Play Pickle Textlinks Plugin (Enabled) = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\bllefkbpbefdodiiefpkcnigpicmhohe\npptl.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.7280_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\owner\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\owner\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Bing Bar (Enabled) = C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll
CHR - plugin: WildTangent Games App Presence Detector (Enabled) = C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Play Pickle = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\bllefkbpbefdodiiefpkcnigpicmhohe\
CHR - Extension: YouTube = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: YouTube = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Google Search = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Search = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: Free SMS bar = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\foffjhlcnkehaapebnoehjhdbjfmpgjn\10.11.22.2_0\
CHR - Extension: Productivity 3.1 = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\fojnkghiggpfagjciliabphpgnbmehjf\2.3.15.10_0\
CHR - Extension: Skype Extension = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.7280_0\
CHR - Extension: Gmail = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Gmail = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2009/11/26 16:16:34 | 000,358,599 | R— | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 123haustiereundmehr.com
O1 - Hosts: 12307 more lines…
O2 - BHO: (ooVoo Toolbar) - {59c6f12b-f004-43e5-9997-08f2123119b6} - C:\Program Files (x86)\oovootoolbar\oovootoolbarX.dll ()
O2 - BHO: (Search Assistant BHO) - {5d79f641-c168-40df-a32f-bacea7509e75} - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64SrcAs.dll (MindSpark)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll File not found
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Toolbar BHO) - {cb41fc95-f1b3-4797-8bb6-1012ff62abba} - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64bar.dll (MindSpark)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo Layers Runtime\YontooIEClient.dll (Yontoo LLC)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (ooVoo Toolbar) - {59c6f12b-f004-43e5-9997-08f2123119b6} - C:\Program Files (x86)\oovootoolbar\oovootoolbarX.dll ()
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll File not found
O3 - HKLM\..\Toolbar: (TelevisionFanatic) - {c98d5b61-b0ea-4d48-9839-1079d352d880} - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64bar.dll (MindSpark)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {37483B40-C254-4A72-BDA4-22EE90182C1E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [IntelliType Pro] c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files (x86)\Acer\Acer Assist\launcher.exe ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [DW6] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Go to PlaySushi web site - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - Reg Error: Key error. File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.9.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1EAA46E7-6F20-4029-83EE-924C629995B5}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{25B43BE2-156C-41BE-82C5-21FD7D02B0DA}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O27:64bit: - HKLM IFEO\ehshell.exe: Debugger - C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe (LogMeIn, Inc.)
O27 - HKLM IFEO\ehshell.exe: Debugger - C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe (LogMeIn, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{b6445803-455e-11e1-861c-0026224eda88}\Shell - "" = AutoRun
O33 - MountPoints2\{b6445803-455e-11e1-861c-0026224eda88}\Shell\AutoRun\command - "" = E:\IronKey.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/12/17 19:01:41 | 004,732,416 | —- | C] (AVAST Software) – C:\Users\owner\Desktop\aswMBR.exe
[2012/12/17 18:56:28 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\owner\Desktop\OTL.exe
[2012/12/16 15:47:23 | 000,000,000 | —D | C] – C:\Users\owner\AppData\Local\LogMeIn
[2012/12/16 15:47:18 | 000,035,240 | —- | C] (LogMeIn, Inc.) – C:\Windows\SysNative\LMIport.dll
[2012/12/16 15:47:17 | 000,088,008 | —- | C] (LogMeIn, Inc.) – C:\Windows\SysNative\LMIRfsClientNP.dll
[2012/12/16 15:47:17 | 000,072,216 | —- | C] (LogMeIn, Inc.) – C:\Windows\SysNative\drivers\LMIRfsDriver.sys
[2012/12/16 15:47:09 | 000,083,880 | —- | C] (LogMeIn, Inc.) – C:\Windows\SysNative\LMIinit.dll
[2012/12/16 15:47:02 | 000,000,000 | —D | C] – C:\ProgramData\LogMeIn
[2012/12/16 15:46:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\LogMeIn
[2012/12/16 15:15:06 | 000,000,000 | —D | C] – C:\Program Files\HP
[2012/12/16 13:53:53 | 000,000,000 | —D | C] – C:\Windows\Hewlett-Packard
[2012/12/13 15:48:56 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/12/13 15:48:55 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/12/13 15:48:43 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/12/13 15:48:41 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/12/13 15:48:40 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/12/13 15:48:38 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/12/13 15:48:37 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/12/13 15:48:37 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/12/13 15:48:31 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/12/13 15:48:29 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/12/13 15:48:28 | 002,312,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/12/13 15:48:27 | 000,729,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012/12/13 15:48:17 | 000,717,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/12/13 15:48:16 | 000,816,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/12/13 15:48:16 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2012/12/12 19:16:56 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2012/12/12 17:34:28 | 000,424,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KernelBase.dll
[2012/12/12 17:34:27 | 001,161,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[2012/12/12 17:34:27 | 000,338,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\conhost.exe
[2012/12/12 17:34:27 | 000,215,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2012/12/12 17:34:25 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64win.dll
[2012/12/12 17:34:25 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64.dll
[2012/12/12 17:34:25 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2012/12/12 17:34:24 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntvdm64.dll
[2012/12/12 17:34:24 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2012/12/12 17:34:24 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64cpu.dll
[2012/12/12 17:34:24 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2012/12/12 17:34:22 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2012/12/12 17:34:22 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/12/12 17:34:20 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012/12/12 17:34:20 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012/12/12 17:34:20 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012/12/12 17:34:20 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012/12/12 17:34:20 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012/12/12 17:34:20 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012/12/12 17:34:19 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012/12/12 17:34:19 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012/12/12 17:34:19 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/12/12 17:34:19 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012/12/12 17:34:19 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012/12/12 17:34:18 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012/12/12 17:34:18 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012/12/12 17:34:17 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012/12/12 17:34:17 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012/12/12 17:34:17 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012/12/12 17:34:16 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012/12/12 17:34:16 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012/12/12 17:34:16 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012/12/12 17:34:16 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012/12/12 17:34:15 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2012/12/12 17:33:51 | 000,478,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dpnet.dll
[2012/12/12 17:33:50 | 000,376,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dpnet.dll
[2012/12/09 13:36:38 | 000,000,000 | —D | C] – C:\Users\owner\Documents\christmas card
[2012/11/25 17:33:33 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Mouse and Keyboard Center
[2012/11/25 17:32:47 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TsUsbRedirectionGroupPolicyExtension.dll
[2012/11/25 17:32:47 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TsUsbRedirectionGroupPolicyControl.exe
[2012/11/25 17:32:46 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RdpGroupPolicyExtension.dll
[2012/11/25 17:32:41 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\TsUsbFlt.sys
[2012/11/25 17:32:41 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\rdpvideominiport.sys
[2012/11/25 17:32:33 | 000,269,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\aaclient.dll
[2012/11/25 17:32:33 | 000,192,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\rdpendp_winip.dll
[2012/11/25 17:32:33 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MsRdpWebAccess.dll
[2012/11/25 17:32:33 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tsgqec.dll
[2012/11/25 17:32:33 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TsUsbGDCoInstaller.dll
[2012/11/25 17:32:33 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tsgqec.dll
[2012/11/25 17:32:33 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wksprtPS.dll
[2012/11/25 17:32:33 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wksprtPS.dll
[2012/11/25 17:32:32 | 000,322,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\aaclient.dll
[2012/11/25 17:32:32 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MsRdpWebAccess.dll
[2012/11/25 17:32:31 | 001,048,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstsc.exe
[2012/11/25 17:32:31 | 000,384,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wksprt.exe
[2012/11/25 17:32:31 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpudd.dll
[2012/11/25 17:32:31 | 000,228,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpendp_winip.dll
[2012/11/25 17:32:31 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TSWbPrxy.exe
[2012/11/25 17:32:30 | 003,174,912 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpcorets.dll
[2012/11/25 17:32:30 | 001,123,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstsc.exe
[2012/11/25 17:32:29 | 004,916,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstscax.dll
[2012/11/25 17:32:28 | 005,773,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstscax.dll
[2012/11/25 17:31:46 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Mouse and Keyboard Center
[2012/11/25 17:28:36 | 000,514,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\qdvd.dll
[2012/11/25 17:28:36 | 000,366,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\qdvd.dll
[2012/11/25 17:28:33 | 001,448,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lsasrv.dll
[2012/11/25 17:28:33 | 000,307,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncrypt.dll
[2012/11/25 16:55:49 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons
[2012/11/25 16:55:46 | 000,000,000 | —D | C] – C:\Program Files (x86)\Coupons
[2012/11/25 16:53:31 | 000,000,000 | —D | C] – C:\ProgramData\HP Product Assistant
[2012/11/25 16:51:12 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\HP
[2012/11/25 14:48:13 | 000,000,000 | —D | C] – C:\Users\owner\Desktop\RegistryBackups
[2012/11/25 13:40:00 | 000,000,000 | —D | C] – C:\Users\owner\AppData\Roaming\HPAppData
[2012/11/25 13:39:12 | 000,174,056 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2012/11/25 13:39:12 | 000,174,056 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2012/11/25 13:39:12 | 000,095,208 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll

========== Files - Modified Within 30 Days ==========

[2012/12/17 20:38:05 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/12/17 20:24:01 | 000,000,908 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2600581341-1188975230-2990884034-1000UA.job
[2012/12/17 20:24:00 | 000,000,856 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2600581341-1188975230-2990884034-1000Core.job
[2012/12/17 20:06:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/12/17 19:50:45 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/12/17 19:49:25 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/12/17 19:02:26 | 004,732,416 | —- | M] (AVAST Software) – C:\Users\owner\Desktop\aswMBR.exe
[2012/12/17 18:56:35 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\owner\Desktop\OTL.exe
[2012/12/17 15:25:23 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/12/17 15:25:23 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/12/17 15:17:09 | 000,000,292 | —- | M] () – C:\Windows\tasks\iMeshNAG.job
[2012/12/17 15:16:39 | 2211,483,648 | -HS- | M] () – C:\hiberfil.sys
[2012/12/16 15:47:05 | 000,001,024 | —- | M] () – C:\.rnd
[2012/12/16 15:32:11 | 000,173,111 | —- | M] () – C:\Windows\hpoins46.dat
[2012/12/16 15:32:11 | 000,002,331 | —- | M] () – C:\Users\Public\Desktop\Add a Device - Photosmart D110 series.lnk
[2012/12/16 13:43:58 | 000,344,296 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/12/15 10:10:47 | 000,002,491 | —- | M] () – C:\Users\owner\Desktop\Google Chrome.lnk
[2012/12/12 15:10:18 | 000,697,272 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/12/12 15:10:18 | 000,073,656 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/11/29 20:26:47 | 000,726,444 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/11/29 20:26:47 | 000,624,412 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/11/29 20:26:47 | 000,106,756 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/11/25 17:33:32 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_point64_01011.Wdf
[2012/11/25 17:30:02 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01011.Wdf
[2012/11/25 17:28:05 | 000,207,029 | —- | M] () – C:\Windows\hpoins46.dat.temp
[2012/11/25 17:17:21 | 000,058,780 | —- | M] () – C:\Users\owner\Desktop\HP Installation Error - Windows 7.hta
[2012/11/25 16:54:58 | 000,001,165 | —- | M] () – C:\Users\Public\Desktop\Shop for HP Supplies.lnk
[2012/11/25 16:53:19 | 000,001,319 | —- | M] () – C:\Users\Public\Desktop\HP Solution Center.lnk
[2012/11/25 16:52:14 | 000,002,103 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2012/11/25 16:51:54 | 000,001,976 | —- | M] () – C:\Users\Public\Desktop\HP ePrinterCenter.lnk
[2012/11/25 14:14:18 | 000,000,826 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk

========== Files Created - No Company Name ==========

[2012/12/16 15:47:04 | 000,001,024 | —- | C] () – C:\.rnd
[2012/12/16 15:46:50 | 000,000,992 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn.lnk
[2012/12/16 15:32:11 | 000,002,331 | —- | C] () – C:\Users\Public\Desktop\Add a Device - Photosmart D110 series.lnk
[2012/12/16 15:14:35 | 000,207,029 | —- | C] () – C:\Windows\hpoins46.dat.temp
[2012/11/25 17:33:32 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_point64_01011.Wdf
[2012/11/25 17:30:02 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01011.Wdf
[2012/11/25 17:17:18 | 000,058,780 | —- | C] () – C:\Users\owner\Desktop\HP Installation Error - Windows 7.hta
[2012/11/25 16:58:20 | 000,000,574 | —- | C] () – C:\Windows\hpomdl46.dat.temp
[2012/11/25 16:54:58 | 000,001,165 | —- | C] () – C:\Users\Public\Desktop\Shop for HP Supplies.lnk
[2012/11/25 16:53:19 | 000,001,319 | —- | C] () – C:\Users\Public\Desktop\HP Solution Center.lnk
[2012/11/25 16:52:14 | 000,002,103 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2012/11/25 16:51:54 | 000,001,976 | —- | C] () – C:\Users\Public\Desktop\HP ePrinterCenter.lnk
[2012/11/25 16:46:05 | 000,173,111 | —- | C] () – C:\Windows\hpoins46.dat
[2012/03/04 15:02:22 | 000,743,534 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2012/01/03 18:13:22 | 000,057,344 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll
[2011/05/19 19:04:53 | 000,001,940 | —- | C] () – C:\Users\owner\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2011/05/03 17:31:58 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2011/03/17 21:31:13 | 000,000,175 | —- | C] () – C:\Windows\wininit.ini
[2011/02/07 19:09:43 | 000,000,035 | —- | C] () – C:\Windows\popcinfo.dat
[2009/11/26 12:11:09 | 000,000,000 | —- | C] () – C:\Users\owner\AppData\Roaming\wklnhst.dat

========== ZeroAccess Check ==========

[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 00:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 23:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 20:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 07:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 20:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2009/10/30 00:54:35 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Acer
[2012/01/10 20:18:04 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\EasiestSoft
[2009/10/30 00:54:35 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Leadertech
[2011/09/25 13:57:10 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\ManyCam
[2010/12/31 14:47:01 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\ooVoo Details
[2009/12/25 15:50:09 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\PowerCinema
[2009/11/26 13:55:31 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\SoftDMA
[2009/11/26 12:13:01 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Template
[2011/12/28 11:02:49 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Tific
[2012/11/25 16:24:57 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\WildTangent
[2012/09/24 18:29:15 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Windows Live Writer

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2009/07/13 20:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows\SysNative\drivers\AGP440.sys
[2009/07/13 20:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009/07/13 20:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009/07/13 20:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/07/13 20:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows\SysNative\drivers\atapi.sys
[2009/07/13 20:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009/07/13 20:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009/07/13 20:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2009/07/13 20:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 20:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 20:40:20 | 000,018,944 | —- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 – C:\Windows\SysNative\cngaudit.dll
[2009/07/13 20:40:20 | 000,018,944 | —- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 – C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

< MD5 for: IASTORV.SYS >
[2010/11/20 08:33:38 | 000,410,496 | —- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D – C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010/11/20 08:33:38 | 000,410,496 | —- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D – C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011/03/11 01:19:16 | 000,410,496 | —- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C – C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011/03/11 01:41:26 | 000,410,496 | —- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 – C:\Windows\SysNative\drivers\iaStorV.sys
[2011/03/11 01:41:26 | 000,410,496 | —- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 – C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011/03/11 01:41:26 | 000,410,496 | —- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 – C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011/03/11 01:23:00 | 000,410,496 | —- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA – C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011/03/11 01:25:49 | 000,410,496 | —- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 – C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009/07/13 20:48:04 | 000,410,688 | —- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 – C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2009/07/13 20:41:52 | 000,692,736 | —- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 – C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010/11/20 08:27:22 | 000,695,808 | —- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 – C:\Windows\SysNative\netlogon.dll
[2010/11/20 08:27:22 | 000,695,808 | —- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 – C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010/11/20 07:20:28 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B – C:\Windows\SysWOW64\netlogon.dll
[2010/11/20 07:20:28 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B – C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009/07/13 20:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2009/07/13 20:45:45 | 000,167,488 | —- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 – C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011/03/11 01:23:06 | 000,166,272 | —- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 – C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011/03/11 01:25:53 | 000,166,272 | —- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 – C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011/03/11 01:19:21 | 000,166,272 | —- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 – C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011/03/11 01:41:34 | 000,166,272 | —- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A – C:\Windows\SysNative\drivers\nvstor.sys
[2011/03/11 01:41:34 | 000,166,272 | —- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A – C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011/03/11 01:41:34 | 000,166,272 | —- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A – C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010/11/20 08:33:48 | 000,166,272 | —- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 – C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010/11/20 08:33:48 | 000,166,272 | —- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 – C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

< MD5 for: SCECLI.DLL >
[2009/07/13 20:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009/07/13 20:41:53 | 000,232,448 | —- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 – C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010/11/20 07:21:04 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 – C:\Windows\SysWOW64\scecli.dll
[2010/11/20 07:21:04 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 – C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010/11/20 08:27:25 | 000,232,960 | —- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C – C:\Windows\SysNative\scecli.dll
[2010/11/20 08:27:25 | 000,232,960 | —- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C – C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >

< %systemroot%\system32\drivers\*.sys /90 >

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\ProgramData\Temp:5C321E34

< End of report >

Extras.Txt
OTL Extras logfile created on: 12/17/2012 8:31:49 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\owner\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 1.76 Gb Available Physical Memory | 64.19% Memory free
5.49 Gb Paging File | 4.19 Gb Available in Paging File | 76.34% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 136.95 Gb Total Space | 74.31 Gb Free Space | 54.26% Space Free | Partition Type: NTFS

Computer Name: OWNER-PC | User Name: owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{022140FC-75C9-43B2-8651-A859F9AC44B5}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{02FF00E7-6100-4F74-8A7C-6E824CF0510A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{0C39B27F-E7F3-42FB-9DCB-7E45D2F9E999}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{0ECE689B-369A-4C17-ACCE-2565A3CAB460}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{142FC8D3-F632-4A3A-9279-7C0EF8289B02}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{150BF585-46C2-44DA-8ADA-41F5A26430CC}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1D00A99C-0E59-4B9B-9258-4759CDBB1C95}" = rport=445 | protocol=6 | dir=out | app=system |
"{23AD5A12-1E68-4F73-A90A-E72C06D78433}" = lport=10243 | protocol=6 | dir=in | app=system |
"{23CED3A3-CDE2-4BA3-BB60-AC126CE6BE78}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2AA43943-1062-4CE0-8997-4D8B92E65D18}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{2E062AAD-A62B-42B4-8CF2-ACB78F40455B}" = lport=137 | protocol=17 | dir=in | app=system |
"{30048C57-B1F0-4968-9D07-358853461E29}" = lport=2869 | protocol=6 | dir=in | app=system |
"{39BDFDC5-5707-4B68-9036-2266C34AB253}" = rport=10243 | protocol=6 | dir=out | app=system |
"{593817EF-29F6-4028-8618-1215C4D31053}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5F9531B1-930C-4683-8D0A-B02E7AAC35DD}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{6B3A38CC-FAC6-4032-A90E-C6E0D7385B39}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{9723E11B-8E14-4FA2-B84F-660174A9AF48}" = lport=2869 | protocol=6 | dir=in | app=system |
"{A2D19AFC-EE21-4874-B016-FA14DF8DD442}" = lport=138 | protocol=17 | dir=in | app=system |
"{AE862481-240E-4045-9D8B-D4E3C01BB021}" = lport=139 | protocol=6 | dir=in | app=system |
"{B26B6C74-72AE-4AD9-A6E1-5DC12A20D670}" = rport=137 | protocol=17 | dir=out | app=system |
"{B3465871-3AF0-4CA3-9AF4-EA05C4C7DA64}" = rport=139 | protocol=6 | dir=out | app=system |
"{B529B26E-4256-43CE-9AAD-EE2D7190C785}" = lport=445 | protocol=6 | dir=in | app=system |
"{C38560F3-805F-491B-AEDF-DDB41A80C52C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{CD7C900C-BFD8-4A0E-A265-9F964BB0A704}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{ED2130B1-D70E-4B05-B8B6-0569956A15B2}" = rport=138 | protocol=17 | dir=out | app=system |
"{F30AB3C4-F430-48B4-A29D-27A9AD7EEACA}" = rport=427 | protocol=17 | dir=in | svc=hpslpsvc | app=c:\windows\system32\svchost.exe |
"{FB33B654-EC92-4127-B7F9-7C61D5ED5721}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{FED24E6E-AC33-4862-AD5F-9CC4019D42E1}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0310780F-F01B-4E38-A64F-1A17B4097B4B}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgm.exe |
"{06FF36C7-B900-491B-AE63-7FD3B67281F1}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{09809B21-F58B-41B7-BC3A-0A99E4E30B44}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgh.exe |
"{0F0BE943-CA3E-4272-AB38-67F1D32098CF}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{0FDD20F7-89CA-49F4-B16C-5F1CD04442C4}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpoews01.exe |
"{1639A881-7D72-45F1-8091-1482AEA4C5B5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{181226F7-4D1C-4282-8DFA-BAF105AF6092}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{1BA1456B-8DA3-4C62-99A2-C33940E1F54A}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{1EE5519A-7F65-4BAF-95C2-BBE0D3697FF4}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{2976E300-F7C0-48F7-A792-61D6A9CE3A17}" = protocol=6 | dir=in | app=c:\program files (x86)\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{2EBE566A-3E75-4EFF-913D-E988AE7F455E}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{36ECEA67-5665-4A41-B6E4-38D46007E223}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgplgtupl.exe |
"{393F48A2-D596-46C3-9D0A-0AF21AD0CBDC}" = protocol=17 | dir=in | app=c:\program files (x86)\newtech infosystems\nti backup now 5\backupsvc.exe |
"{3B2C7A7E-E800-45FD-8685-CF32037787C0}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{3B446CDF-A1B0-496E-8310-DF3331CD407C}" = protocol=17 | dir=in | app=c:\program files (x86)\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{3FC619F4-39A6-4B73-BB6E-6FB1EA1B9F5B}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{404899C2-E603-4E43-BA9B-7D8C0DEF4A3F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{43F883D8-9F69-4708-B26C-B7420D938D82}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4EFBF05A-2008-40C1-8C21-9E5044414600}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{561911E9-8E65-4BE2-9A5B-A402624716F7}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposid01.exe |
"{5DE0E549-B0F4-4EC4-8419-F35CBF168115}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{5E84E563-E181-4C6E-9AB7-F494AC372EF1}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{600ED4E1-497C-43EA-8E6D-71B65E60A108}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{66D48EBE-AA18-4E19-89A2-0D863B71DF5D}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqtra08.exe |
"{68692565-4CB8-4AF8-AFBD-E9BC9D40A4A0}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{6D33394A-AD34-49A6-ADC1-BEAF4B160223}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{7A2E1893-49F5-48D4-A9D2-3D86E093290C}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqkygrp.exe |
"{7BBAE870-07DD-486B-961F-D6465CE376B2}" = dir=in | app=c:\program files (x86)\acer arcade deluxe\homemedia\homemedia.exe |
"{83A3728A-EC70-43E0-89B3-5008E0452F69}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{86A48481-6E6E-44F9-BCF5-8205A3E7E816}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
"{88C0D8EA-4330-405B-832C-1A79B8869F12}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{8DC200D9-0756-422F-9904-C59EE704B00A}" = dir=in | app=c:\program files (x86)\hp\digital imaging\smart web printing\smartwebprintexe.exe |
"{8E81025B-EEAE-4187-A984-8F7EC4CC5917}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{A170C692-0F9E-49F1-AA3E-9EA35B0F5ACC}" = dir=in | app=c:\program files (x86)\acer arcade deluxe\acer arcade deluxe\acer arcade deluxe.exe |
"{ABD42200-D43A-429D-85D3-0A28BC5762D1}" = dir=in | app=c:\program files (x86)\acer arcade deluxe\playmovie\playmovie.exe |
"{B7652B98-23AE-4A83-AC51-E8B09CE31BE2}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{BF90DD7E-9696-43DF-B42C-1A6FB493E11D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{BFFC8C2C-E3CE-4389-B28B-1C407BAD392A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{C9B1CD99-FC3B-4839-9C88-44FB3F2FD69C}" = dir=in | app=c:\program files (x86)\acer arcade deluxe\playmovie\pmvservice.exe |
"{CEBBB945-8C7F-4CE1-BAD5-C6820D5F8AC5}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgpc01.exe |
"{D63DDE84-977D-458C-B5AD-8E6726E3A633}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D8DE1049-0ACC-48A5-9AB1-829C146B020E}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{DDB05038-DD09-4907-8FF8-728F7CFA644A}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{E61B4D61-FEE7-4076-94A4-2383DF4DF441}" = protocol=6 | dir=in | app=c:\program files (x86)\newtech infosystems\nti backup now 5\backupsvc.exe |
"{F093E4AA-74EB-4D8F-948D-13B84090F0CC}" = dir=in | app=c:\program files (x86)\hp\hp software update\hpwucli.exe |
"{F0C3CC38-6FB8-4F2C-B709-9E10AAA2EA23}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{F17952A1-1CAE-47FB-B0D8-354C577D8F9B}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqste08.exe |
"{F1A1FD74-14FF-44D1-919B-0894F95168E2}" = dir=in | app=d:\setup\hpznui40.exe |
"{F7E48813-509C-41AE-9547-633976DA4BCD}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpfccopy.exe |
"{F9128091-5215-4936-95CA-EF67B2203BF8}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpiscnapp.exe |
"{FB05DF3F-B9B7-4FD8-A8E6-A2048417A37E}" = protocol=6 | dir=out | app=system |
"TCP Query User{201D2404-D6D7-4F0D-8419-510A6F531613}C:\program files (x86)\oovoo\oovoo.exe" = protocol=6 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe |
"TCP Query User{C4ACC39F-08A4-4A37-AFDE-1B5AE85A0161}C:\program files (x86)\oovoo\oovoo.exe" = protocol=6 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe |
"UDP Query User{A4051CED-2760-4010-8795-03A472AA4C0C}C:\program files (x86)\oovoo\oovoo.exe" = protocol=17 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe |
"UDP Query User{D8755921-C54A-41F8-BED4-F5622BFDF181}C:\program files (x86)\oovoo\oovoo.exe" = protocol=17 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}" = iTunes
"{14BC6853-A74E-4874-B50D-679889D1544D}" = HP Photosmart D110 All-In-One Driver 14.0 Rel. 7
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{48C0866E-57EB-444C-8371-8E4321066BC3}" = Network64
"{4BC310C4-B898-46E2-B5FB-B85A30AA7142}" = iCloud
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6BFAB6C1-6D46-46DB-A538-A269907C9F2F}" = Network64
"{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}" = Apple Mobile Device Support
"{7AB6F8D7-7804-4662-BE8C-1AFCCD602D9F}" = Microsoft Mouse and Keyboard Center
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo Layers Runtime 1.10.01
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{ACCA82EB-7088-919E-5E1C-100A24F11CCF}" = ATI Catalyst Install Manager
"{C78D3032-9DFD-41D0-9DE9-58EAE750CBA4}" = Microsoft Security Client
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DBC1DE57-B55A-4D57-9769-1DB9BE506AF7}" = HP Photosmart D110 All-In-One Driver Software 14.0 Rel. 7
"{E2FCA441-6D7B-CD78-3ADF-42EA9FA06065}" = ccc-utility64
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FF21C3E6-97FD-474F-9518-8DCBE94C2854}" = 64 Bit HP CIO Components Installer
"CCleaner" = CCleaner
"HP Imaging Device Functions" = HP Imaging Device Functions 14.0
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0
"HPExtendedCapabilities" = HP Customer Participation Program 14.0
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Mouse and Keyboard Center" = Microsoft Mouse and Keyboard Center
"Microsoft Security Client" = Microsoft Security Essentials
"Shop for HP Supplies" = Shop for HP Supplies
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{1111706F-666A-4037-7777-210328764D10}" = JavaFX 2.1.0
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery
"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant
"{183F0908-AD5E-8B3B-5F06-28B1A8C65C62}" = CCC Help Japanese
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{23E9588B-05ED-BC2F-EB69-101A96511EF1}" = ccc-core-static
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2484D1EA-CBA4-60BB-82B9-F8477D25C47A}" = CCC Help Dutch
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java™ 6 Update 29
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 9
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
"{29802D65-9514-DB20-36CD-E47A94C8AEB9}" = Catalyst Control Center Graphics Full Existing
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{2F61E9D7-CD05-643E-A04E-CC1A8B6610BA}" = CCC Help Finnish
"{2FA3CDD8-1436-497D-6339-789936561E99}" = CCC Help German
"{30AB2FCD-FBF2-4bed-1369-13E6A1468621}_is1" = EasiestSoft Video Converter 1.0.3
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34123E80-BE96-6282-1167-6696730AF6D2}" = CCC Help Korean
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3D20EF26-2E9A-D388-851D-E7675BBACFF5}" = Catalyst Control Center Core Implementation
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{4024F49B-65D4-D6B2-2A1D-6DBF6F09F181}" = CCC Help Greek
"{42BBA4CC-EFB6-4653-A2CC-F305D4B399C3}" = PS_AIO_07_D110_SW_Min
"{49A63237-FD38-AE77-6DF6-FFB41499A4E6}" = CCC Help Hungarian
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4F0FC827-B693-F166-612E-EA89D798540C}" = CCC Help Chinese Traditional
"{4F94119D-1B71-400e-9F04-B4E5CEAE71F8}_is1" = Sothink Movie DVD Maker
"{52FBF90E-D2EF-A2A3-1CCA-6984596B1B02}" = CCC Help English
"{565E7B0E-B76B-4EAD-9753-F1E72A5CF12E}" = HPAppStudio
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5B025634-7D5B-4B8D-BE2A-7943C1CF2D5D}" = Status
"{5C5778DB-3E5A-499D-865D-740E67D1F165}" = LogMeIn
"{628CBFE4-3823-67FB-26D2-566899C3BB5C}" = CCC Help Italian
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{63F26DAE-CB0D-98B6-3019-D4FC3D0DD203}" = Catalyst Control Center InstallProxy
"{652EB559-6865-DEF4-2409-D506963C15FD}" = CCC Help Polish
"{67E03279-F703-408F-B4BF-46B5FC8D70CD}" = Microsoft Works
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68301905-2DEA-41CE-A4D4-E8B443B099BA}" = MyWinLocker
"{68987945-A387-4C25-0C59-21F2AF657E65}" = CCC Help Thai
"{6B45E33B-6BB4-234B-2F5F-65B1A103801D}" = CCC Help Russian
"{6B99737C-9FDC-50F9-C9A4-AB7DA5C9A336}" = Catalyst Control Center Graphics Full New
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7BE74C0E-F300-D0A6-780B-C93BB78DE58C}" = CCC Help Norwegian
"{7E75ACC5-B0EC-7006-183A-374974019911}" = Catalyst Control Center Graphics Light
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{82809116-D1EE-443C-AE31-F19E709DDF7A}" = AMD USB Filter Driver
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91D3AD6F-09CD-4695-9FA3-8FB15429BE97}" = D110
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{97124B44-C17B-C352-44B1-403D0D706173}" = CCC Help Czech
"{9ACA8261-11D1-F8A1-C154-7F8B23515C79}" = CCC Help Swedish
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A1BF9950-8CDB-468E-83FA-EACFB00EA7D5}" = Windows Live Sync
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9574A7E-C024-EED1-7A81-CC4786A1915A}" = CCC Help Portuguese
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA32D2A6-1299-0F05-BF8D-04075A9F69EB}" = CCC Help Turkish
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.5.2 MUI
"{B3DAF54F-DB25-4586-9EF1-96D24BB14088}" = Windows Movie Maker 2.6
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2
"{BC5DD87B-0143-4D14-AAE6-97109614DC6B}" = SolutionCenter
"{BCC05B1F-7397-799A-9EDB-AC10123BB17A}" = CCC Help Chinese Standard
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{BEF4FD8A-29FF-C250-468A-5FC55F0E3451}" = Catalyst Control Center Localization All
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CF7A62B6-F712-412E-9914-D80033A7F8B8}" = Catalyst Control Center - Branding
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch
"{D41301F8-90FD-9CE8-CD2C-ED2B9D5F07E3}" = CCC Help Spanish
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D43AD08C-BE76-8C5B-FD90-4B665EF60E2E}" = CCC Help Danish
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DA4CA661-5ABF-9218-6E42-84BF89F43655}" = CCC Help French
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E517094C-06B6-419F-8FFD-EF4F57972130}" = QuickTransfer
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
"{FA4C2D53-205F-4245-9717-F3761154824D}" = Safari
"{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}" = ooVoo
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Acer Assist" = Acer Assist
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AviSynth" = AviSynth 2.5
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"ffdshow_is1" = ffdshow [rev 2583] [2009-01-05]
"Graboid Video" = Graboid Video 3.26
"GridVista" = Acer GridVista
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Photo Creations" = HP Photo Creations
"Identity Card" = Identity Card
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.65.1.1000
"Mozilla Firefox 17.0.1 (x86 en-US)" = Mozilla Firefox 17.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"oovootoolbar" = ooVoo Toolbar
"TelevisionFanaticbar Uninstall" = TelevisionFanatic Toolbar
"VideoPad" = VideoPad Video Editor
"VLC media player" = VLC media player 1.0.1
"WildTangent acer Master Uninstall" = Acer Games
"WinLiveSuite" = Windows Live Essentials
"WT084204" = Color Cross

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 11/14/2012 5:02:12 PM | Computer Name = owner-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files (x86)\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value
"MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" of attribute
"version" in element "assemblyIdentity" is invalid.

Error - 11/14/2012 5:06:35 PM | Computer Name = owner-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksCal.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 11/14/2012 5:06:35 PM | Computer Name = owner-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksdb.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 11/14/2012 5:06:35 PM | Computer Name = owner-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksss.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 11/14/2012 5:06:35 PM | Computer Name = owner-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 11/14/2012 5:18:57 PM | Computer Name = owner-PC | Source = Bonjour Service | ID = 100
Description =

Error - 11/14/2012 5:18:57 PM | Computer Name = owner-PC | Source = Bonjour Service | ID = 100
Description =

Error - 11/14/2012 5:18:57 PM | Computer Name = owner-PC | Source = Bonjour Service | ID = 100
Description =

Error - 11/15/2012 3:37:40 PM | Computer Name = owner-PC | Source = Windows Search Service | ID = 3007
Description =

Error - 11/16/2012 6:33:06 PM | Computer Name = owner-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files (x86)\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value
"MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" of attribute
"version" in element "assemblyIdentity" is invalid.

[ System Events ]
Error - 12/16/2012 5:35:06 PM | Computer Name = owner-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 12/17/2012 4:16:52 PM | Computer Name = owner-PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter

Error - 12/17/2012 4:16:52 PM | Computer Name = owner-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 12/17/2012 4:58:26 PM | Computer Name = owner-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 12/17/2012 7:50:45 PM | Computer Name = owner-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 12/17/2012 8:49:22 PM | Computer Name = owner-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the Wlansvc service.

Error - 12/17/2012 8:49:24 PM | Computer Name = owner-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 12/17/2012 10:10:10 PM | Computer Name = owner-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the Wlansvc service.

Error - 12/17/2012 10:10:10 PM | Computer Name = owner-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the NlaSvc service.

Error - 12/17/2012 10:10:12 PM | Computer Name = owner-PC | Source = atikmdag | ID = 43029
Description = Display is not active

< End of report >

YatesBros

Post #4December 18, 2012, 2:53 AM UTC

Here is the aswMBR.txt file aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software Run date: 2012-12-17 21:18:34 —————————– 21:18:34.118 OS Version: Windows x64 6.1.7601 Service Pack 1 21:18:34.119 Number of processors: 1 586 0x7C02 21:18:34.120 ComputerName: OWNER-PC UserName: owner 21:18:35.463 Initialize success 21:20:37.476 AVAST engine defs: 12121702 21:20:41.584 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 21:20:41.601 Disk 0 Vendor: TOSHIBA_MK1655GSX FG011J Size: 152627MB BusType: 11 21:20:41.667 Disk 0 MBR read successfully 21:20:41.674 Disk 0 MBR scan 21:20:41.697 Disk 0 Windows 7 default MBR code 21:20:41.734 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 12291 MB offset 63 21:20:41.812 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 101 MB offset 25173855 21:20:41.855 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 140232 MB offset 25382700 21:20:41.927 Disk 0 scanning C:\Windows\system32\drivers 21:21:08.366 Service scanning 21:22:16.312 Modules scanning 21:22:16.360 Disk 0 trace - called modules: 21:22:16.409 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys 21:22:17.030 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800306b220] 21:22:17.051 3 CLASSPNP.SYS[fffff8800165143f] -> nt!IofCallDriver -> [0xfffffa80030949b0] 21:22:17.073 5 ACPI.sys[fffff88000faf7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8003055060] 21:22:17.827 AVAST engine scan C:\Windows 21:22:22.671 AVAST engine scan C:\Windows\system32 21:30:22.236 AVAST engine scan C:\Windows\system32\drivers 21:30:54.471 AVAST engine scan C:\Users\owner 21:46:08.821 AVAST engine scan C:\ProgramData 21:50:52.945 Scan finished successfully 21:51:31.366 Disk 0 MBR has been saved successfully to "C:\Users\owner\Desktop\MBR.dat" 21:51:31.519 The log file has been saved successfully to "C:\Users\owner\Desktop\aswMBR.txt"

JonTom

Post #5December 18, 2012, 1:57 PM UTC

Hello Yatesbros

Thank you for the logs.

Please do the following:

Please un-install Yontoo Layers Runtime 1.10.01
- Click on "Start" then on "Control Panel" and then on the "Programs and Features" tab.
- Find the "Yontoo Layers Runtime 1.10.01" program, click on it once and then click on the "uninstall" button.
- If you are prompted to re-boot your computer to complete the uninstall please do so.
- Repeat for Java™ 6 Update 29.

Please open OTL

Copy and paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.

:OTL
PRC - [2012/07/16 10:42:58 | 000,042,504 | —- | M] (COMPANYVERS_NAME) – C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64barsvc.exe
SRV - [2012/07/16 10:42:58 | 000,042,504 | —- | M] (COMPANYVERS_NAME) [Auto | Running] – C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64barsvc.exe – (TelevisionFanaticService)
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://toolbar.inbox.com/search/dispatcher…d&%language
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchnu.com/406
IE - HKCU\..\URLSearchHook: {0696f815-a3a9-490a-bb14-9ec3350b1276} - No CLSID value found
IE - HKCU\..\URLSearchHook: {37483b40-c254-4a72-bda4-22ee90182c1e} - No CLSID value found
IE - HKCU\..\URLSearchHook: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - No CLSID value found
IE - HKCU\..\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}: "URL" = http://toolbar.inbox.com/search/dispatcher…0364&lng=en
FF - HKLM\Software\MozillaPlugins\@TelevisionFanatic.com/Plugin: C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\NP64Stub.dll (MindSpark)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\TelevisionFanatic\bar\1.bin [2012/07/16 10:43:11 | 000,000,000 | —D | M]
[2012/11/30 17:49:09 | 000,000,000 | —D | M] (TelevisionFanatic) – C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\[removed]
[2012/01/10 21:47:38 | 000,000,000 | —D | M] (Yontoo Layers) – C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\[removed]
CHR - homepage: http://www.searchnu.com/406
CHR - homepage: http://www.searchnu.com/406
O2 - BHO: (Search Assistant BHO) - {5d79f641-c168-40df-a32f-bacea7509e75} - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64SrcAs.dll (MindSpark)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll File not found
O2 - BHO: (Toolbar BHO) - {cb41fc95-f1b3-4797-8bb6-1012ff62abba} - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64bar.dll (MindSpark)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo Layers Runtime\YontooIEClient.dll (Yontoo LLC)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll File not found
O3 - HKLM\..\Toolbar: (TelevisionFanatic) - {c98d5b61-b0ea-4d48-9839-1079d352d880} - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64bar.dll (MindSpark)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {37483B40-C254-4A72-BDA4-22EE90182C1E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKCU..\Run: [DW6] File not found
O9 - Extra Button: Go to PlaySushi web site - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O33 - MountPoints2\{b6445803-455e-11e1-861c-0026224eda88}\Shell - "" = AutoRun
O33 - MountPoints2\{b6445803-455e-11e1-861c-0026224eda88}\Shell\AutoRun\command - "" = E:\IronKey.exe
@Alternate Data Stream - 95 bytes -> C:\ProgramData\Temp:5C321E34

:Files
C:\Program Files (x86)\TelevisionFanatic
C:\PROGRA~2\SEARCH~1\Datamngr
C:\Program Files (x86)\Yontoo Layers Runtime

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]

Once you have pasted the information into the Custom Scans/Fixes box, click the "Run Fix" button at the top.
Allow the program to run unhindered.
Your machine will re-start itself. This is normal.
A log will be created after your machine reboots. Please post the contents of the log in your next reply.

Junkware Removal Tool

Please download Junkware Removal Tool to your desktop.
- Shutdown your antivirus to avoid any conflicts.
- Right-mouse click JRT.exe and select Run as administrator
- The tool will open and start scanning your system.
- Please be patient as this can take a while to complete.
- On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
- Post the contents of JRT.txt into your next message.
Please post the OTL fix log and the Junkware Rermoval Tool log in your next reply along with a new OTL scan log.

YatesBros

Post #6December 19, 2012, 1:18 AM UTC

Hello,

Attached are the three logs you requested.

OTL Fix
All processes killed
========== OTL ==========
Process 64barsvc.exe killed successfully!
Service TelevisionFanaticService stopped successfully!
Service TelevisionFanaticService deleted successfully!
C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64barsvc.exe moved successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Bar| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{0696f815-a3a9-490a-bb14-9ec3350b1276} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0696f815-a3a9-490a-bb14-9ec3350b1276}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{0696f815-a3a9-490a-bb14-9ec3350b1276}\ deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{37483b40-c254-4a72-bda4-22ee90182c1e} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{37483b40-c254-4a72-bda4-22ee90182c1e}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{D3D233D5-9F6D-436C-B6C7-E63F77503B30} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@TelevisionFanatic.com/Plugin\ deleted successfully.
C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\NP64Stub.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed] deleted successfully.
C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\ThirdPartyInstallers folder moved successfully.
C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\chrome folder moved successfully.
C:\Program Files (x86)\TelevisionFanatic\bar\1.bin folder moved successfully.
C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\[removed]\META-INF folder moved successfully.
C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\[removed]\chrome folder moved successfully.
C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\[removed] folder moved successfully.
Folder C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\[removed]\ not found.
Use Chrome's Settings page to change the HomePage.
Use Chrome's Settings page to change the HomePage.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5d79f641-c168-40df-a32f-bacea7509e75}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5d79f641-c168-40df-a32f-bacea7509e75}\ deleted successfully.
File C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64SrcAs.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cb41fc95-f1b3-4797-8bb6-1012ff62abba}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cb41fc95-f1b3-4797-8bb6-1012ff62abba}\ deleted successfully.
File C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64bar.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\ not found.
File C:\Program Files (x86)\Yontoo Layers Runtime\YontooIEClient.dll not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{99079a25-328f-4bd4-be04-00955acaa0a7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{c98d5b61-b0ea-4d48-9839-1079d352d880} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c98d5b61-b0ea-4d48-9839-1079d352d880}\ deleted successfully.
File C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64bar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{37483B40-C254-4A72-BDA4-22EE90182C1E} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{37483B40-C254-4A72-BDA4-22EE90182C1E}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D7E97865-918F-41E4-9CD0-25AB1C574CE8} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\DW6 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EBD24BD3-E272-4FA3-A8BA-C5D709757CAB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EBD24BD3-E272-4FA3-A8BA-C5D709757CAB}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\livecall\ deleted successfully.
File Protocol\Handler\livecall - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ deleted successfully.
File Protocol\Handler\ms-help - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-itss\ deleted successfully.
File Protocol\Handler\ms-itss - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msnim\ deleted successfully.
File Protocol\Handler\msnim - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype4com\ deleted successfully.
File Protocol\Handler\skype4com - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype-ie-addon-data\ deleted successfully.
File Protocol\Handler\skype-ie-addon-data - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlmailhtml\ deleted successfully.
File Protocol\Handler\wlmailhtml - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlpg\ deleted successfully.
File Protocol\Handler\wlpg - No CLSID value found not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b6445803-455e-11e1-861c-0026224eda88}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b6445803-455e-11e1-861c-0026224eda88}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b6445803-455e-11e1-861c-0026224eda88}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b6445803-455e-11e1-861c-0026224eda88}\ not found.
File E:\IronKey.exe not found.
ADS C:\ProgramData\Temp:5C321E34 deleted successfully.
========== FILES ==========
C:\Program Files (x86)\TelevisionFanatic\bar\Settings folder moved successfully.
C:\Program Files (x86)\TelevisionFanatic\bar\Message folder moved successfully.
C:\Program Files (x86)\TelevisionFanatic\bar\IE9Mesg folder moved successfully.
C:\Program Files (x86)\TelevisionFanatic\bar\gen1 folder moved successfully.
C:\Program Files (x86)\TelevisionFanatic\bar folder moved successfully.
C:\Program Files (x86)\TelevisionFanatic folder moved successfully.
File\Folder C:\PROGRA~2\SEARCH~1\Datamngr not found.
File\Folder C:\Program Files (x86)\Yontoo Layers Runtime not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Andrew

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Guest
->Temp folder emptied: 5490951 bytes
->Temporary Internet Files folder emptied: 1703083 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 63162551 bytes
->Apple Safari cache emptied: 81142784 bytes
->Flash cache emptied: 1598 bytes

User: owner
->Temp folder emptied: 399388971 bytes
->Temporary Internet Files folder emptied: 155480762 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 75928061 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 143715328 bytes
->Flash cache emptied: 9830428 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1434964 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67496 bytes
RecycleBin emptied: 8678887 bytes

Total Files Cleaned = 902.00 mb

[EMPTYFLASH]

User: All Users

User: Andrew

User: Default

User: Default User

User: Guest
->Flash cache emptied: 0 bytes

User: owner
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 12182012_190842

Files\Folders moved on Reboot…
C:\Users\owner\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files…

Registry entries deleted on Reboot…

Junkware Removal Tool Results
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.1.8 (12.17.2012:1)
OS: Windows 7 Home Premium x64
Ran by [removed] on Tue 12/18/2012 at 19:22:46.53
Blog: http://thisisudax.blogspot.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully deleted: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\toolbar\\{59c6f12b-f004-43e5-9997-08f2123119b6}
Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_users\.default\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_users\s-1-5-18\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_users\s-1-5-19\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_users\s-1-5-20\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_users\S-1-5-21-2600581341-1188975230-2990884034-1000\software\microsoft\internet explorer\searchscopes\\DefaultScope

~~~ Registry Keys

Successfully deleted: [Registry Key] hkey_current_user\software\conduit
Successfully deleted: [Registry Key] hkey_local_machine\software\conduit
Successfully deleted: [Registry Key] hkey_current_user\software\datamngr
Successfully deleted: [Registry Key] hkey_current_user\software\softonic
Successfully deleted: [Registry Key] hkey_current_user\software\zugo
Successfully deleted: [Registry Key] hkey_current_user\software\appdatalow\software\conduit
Successfully deleted: [Registry Key] hkey_current_user\software\appdatalow\software\conduitsearchscopes
Successfully deleted: [Registry Key] hkey_current_user\software\appdatalow\software\freecause
Successfully deleted: [Registry Key] hkey_current_user\software\appdatalow\software\searchqutoolbar
Successfully deleted: [Registry Key] hkey_current_user\software\appdatalow\software\smartbar
Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\pstext.dll
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\tracing\searchqumediabar_rasapi32
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\tracing\searchqumediabar_rasmancs
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\tracing\setupdatamngr_searchqu_rasapi32
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\tracing\setupdatamngr_searchqu_rasmancs
Successfully deleted: [Registry Key] hkey_classes_root\clsid\{3c471948-f874-49f5-b338-4f214a2ee0b1}
Successfully deleted: [Registry Key] hkey_classes_root\clsid\{59c6f12b-f004-43e5-9997-08f2123119b6}
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{59c6f12b-f004-43e5-9997-08f2123119b6}
Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\internet explorer\searchscopes\{9bb47c17-9c68-4bb3-b188-dd9af0fd2406}
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{9bb47c17-9c68-4bb3-b188-dd9af0fd2406}
Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\internet explorer\searchscopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}

~~~ Files

Successfully deleted: [File] "C:\Program Files (x86)\mozilla firefox\plugins\npcouponprinter.dll"
Successfully deleted: [File] "C:\Program Files (x86)\mozilla firefox\plugins\npmozcouponprinter.dll"
Successfully deleted: [File] "C:\Windows\couponprinter.ocx"

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"
Successfully deleted: [Folder] "C:\ProgramData\partner"
Successfully deleted: [Folder] "C:\ProgramData\tarma installer"
Successfully deleted: [Folder] "C:\Users\owner\appdata\local\conduit"
Successfully deleted: [Folder] "C:\Users\owner\appdata\local\ilivid player"
Failed to delete: [Folder] "C:\Users\owner\appdata\locallow\conduit"
Successfully deleted: [Folder] "C:\Users\owner\appdata\locallow\datamngr"
Successfully deleted: [Folder] "C:\Users\owner\appdata\locallow\searchquband"
Successfully deleted: [Folder] "C:\Users\owner\appdata\locallow\televisionfanatic"
Successfully deleted: [Folder] "C:\Program Files (x86)\conduit"
Successfully deleted: [Folder] "C:\Program Files (x86)\coupons"
Successfully deleted: [Folder] "C:\Program Files (x86)\fantastigames"
Successfully deleted: [Folder] "C:\Program Files (x86)\ilivid"
Successfully deleted: [Folder] "C:\ProgramData\ask"

~~~ FireFox

Successfully deleted: [File] "C:\Program Files (x86)\Mozilla Firefox\searchplugins\search_results.xml"
Successfully deleted: [File] C:\Users\owner\AppData\Roaming\mozilla\firefox\profiles\2xmxyhoy.default\user.js
Successfully deleted: [File] C:\Users\owner\AppData\Roaming\mozilla\firefox\profiles\2xmxyhoy.default\searchplugins\askcom.xml
Successfully deleted: [File] C:\Users\owner\AppData\Roaming\mozilla\firefox\profiles\2xmxyhoy.default\searchplugins\bing-zugo.xml
Successfully deleted: [File] C:\Users\owner\AppData\Roaming\mozilla\firefox\profiles\2xmxyhoy.default\searchplugins\conduit.xml
Successfully deleted: [File] C:\Users\owner\AppData\Roaming\mozilla\firefox\profiles\2xmxyhoy.default\searchplugins\search_results.xml
Successfully deleted: [Folder] C:\Users\owner\AppData\Roaming\mozilla\firefox\profiles\2xmxyhoy.default\conduitcommon
Successfully deleted the following from C:\Users\owner\AppData\Roaming\mozilla\firefox\profiles\2xmxyhoy.default\prefs.js

user_pref("CT2801948..clientLogIsEnabled", true);
user_pref("CT2801948..clientLogServiceUrl", "http://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");
user_pref("CT2801948..uninstallLogServiceUrl", "http://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");
user_pref("CT2801948.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
user_pref("CT2801948.AboutPrivacyUrl", "http://www.conduit.com/privacy/Default.aspx");
user_pref("CT2801948.AppTrackingLastCheckTime", "Sun Dec 25 2011 15:57:19 GMT-0500 (Eastern Standard Time)");
user_pref("CT2801948.CTID", "CT2801948");
user_pref("CT2801948.CurrentServerDate", "25-12-2011");
user_pref("CT2801948.DSInstall", true);
user_pref("CT2801948.DialogsAlignMode", "LTR");
user_pref("CT2801948.DialogsGetterLastCheckTime", "Sun Dec 25 2011 15:57:11 GMT-0500 (Eastern Standard Time)");
user_pref("CT2801948.DownloadReferralCookieData", "");
user_pref("CT2801948.EMailNotifierPollDate", "Sun Dec 25 2011 15:57:08 GMT-0500 (Eastern Standard Time)");
user_pref("CT2801948.FirstServerDate", "21-12-2011");
user_pref("CT2801948.FirstTime", true);
user_pref("CT2801948.FirstTimeFF3", true);
user_pref("CT2801948.FixPageNotFoundErrors", true);
user_pref("CT2801948.GroupingServerCheckInterval", 1440);
user_pref("CT2801948.GroupingServiceUrl", "http://grouping.services.conduit.com/");
user_pref("CT2801948.HPInstall", true);
user_pref("CT2801948.HasUserGlobalKeys", true);
user_pref("CT2801948.HomePageProtectorEnabled", true);
user_pref("CT2801948.HomepageBeforeUnload", "http://search.conduit.com/?ctid=CT2801948&SearchSource=13");
user_pref("CT2801948.Initialize", true);
user_pref("CT2801948.InitializeCommonPrefs", true);
user_pref("CT2801948.InstallationAndCookieDataSentCount", 2);
user_pref("CT2801948.InstallationId", "ConduitNSISIntegration");
user_pref("CT2801948.InstallationType", "ConduitXPEIntegration");
user_pref("CT2801948.InstalledDate", "Tue Dec 20 2011 21:30:10 GMT-0500 (Eastern Standard Time)");
user_pref("CT2801948.InvalidateCache", false);
user_pref("CT2801948.IsAlertDBUpdated", true);
user_pref("CT2801948.IsGrouping", false);
user_pref("CT2801948.IsInitSetupIni", true);
user_pref("CT2801948.IsMulticommunity", false);
user_pref("CT2801948.IsOpenThankYouPage", false);
user_pref("CT2801948.IsOpenUninstallPage", true);
user_pref("CT2801948.IsProtectorsInit", true);
user_pref("CT2801948.LanguagePackLastCheckTime", "Sun Dec 25 2011 15:57:09 GMT-0500 (Eastern Standard Time)");
user_pref("CT2801948.LanguagePackReloadIntervalMM", 1440);
user_pref("CT2801948.LanguagePackServiceUrl", "http://translation.users.conduit.com/Translation.ashx");
user_pref("CT2801948.LastLogin_3.8.1.0", "Sun Dec 25 2011 15:57:09 GMT-0500 (Eastern Standard Time)");
user_pref("CT2801948.LatestVersion", "3.7.0.6");
user_pref("CT2801948.Locale", "en-us");
user_pref("CT2801948.MCDetectTooltipHeight", "83");
user_pref("CT2801948.MCDetectTooltipUrl", "http://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
user_pref("CT2801948.MCDetectTooltipWidth", "295");
user_pref("CT2801948.MyStuffEnabledAtInstallation", true);
user_pref("CT2801948.OriginalFirstVersion", "3.8.1.0");
user_pref("CT2801948.RadioIsPodcast", false);
user_pref("CT2801948.RadioLastCheckTime", "Sun Dec 25 2011 15:57:12 GMT-0500 (Eastern Standard Time)");
user_pref("CT2801948.RadioLastUpdateIPServer", "3");
user_pref("CT2801948.RadioLastUpdateServer", "129307496595170000");
user_pref("CT2801948.RadioMediaID", "21435220");
user_pref("CT2801948.RadioMediaType", "Media Player");
user_pref("CT2801948.RadioMenuSelectedID", "EBRadioMenu_CT280194821435220");
user_pref("CT2801948.RadioShrinkedFromSetup", false);
user_pref("CT2801948.RadioStationName", "Virgin%20Radio%20Classic%20Rock");
user_pref("CT2801948.RadioStationURL", "http://www.smgradio.com/core/audio/wmp/live.asx?service=vcbb");
user_pref("CT2801948.SHRINK_TOOLBAR", 1);
user_pref("CT2801948.SavedHomepage", "http://www.inbox.com/homepage.aspx?tbid=80364&lng=en");
user_pref("CT2801948.SearchCaption", "NCH EN Customized Web Search");
user_pref("CT2801948.SearchEngineBeforeUnload", "NCH EN Customized Web Search");
user_pref("CT2801948.SearchFromAddressBarIsInit", true);
user_pref("CT2801948.SearchFromAddressBarUrl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT2801948&q=");
user_pref("CT2801948.SearchInNewTabEnabled", true);
user_pref("CT2801948.SearchInNewTabIntervalMM", 1440);
user_pref("CT2801948.SearchInNewTabLastCheckTime", "Sun Dec 25 2011 15:57:07 GMT-0500 (Eastern Standard Time)");
user_pref("CT2801948.SearchInNewTabServiceUrl", "http://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID");
user_pref("CT2801948.SearchInNewTabUsageUrl", "http://usage.hosting.toolbar.conduit-services.com/usage.ashx?ctid=EB_TOOLBAR_ID");
user_pref("CT2801948.SearchProtectorEnabled", true);
user_pref("CT2801948.SearchProtectorToolbarDisabled", false);
user_pref("CT2801948.SendProtectorDataViaLogin", true);
user_pref("CT2801948.ServiceMapLastCheckTime", "Sun Dec 25 2011 15:57:07 GMT-0500 (Eastern Standard Time)");
user_pref("CT2801948.SettingsLastCheckTime", "Sun Dec 25 2011 15:57:05 GMT-0500 (Eastern Standard Time)");
user_pref("CT2801948.SettingsLastUpdate", "1321973106");
user_pref("CT2801948.TBHomePageUrl", "http://search.conduit.com/?ctid=CT2801948&SearchSource=13");
user_pref("CT2801948.ThirdPartyComponentsInterval", 504);
user_pref("CT2801948.ThirdPartyComponentsLastCheck", "Tue Dec 20 2011 21:30:04 GMT-0500 (Eastern Standard Time)");
user_pref("CT2801948.ThirdPartyComponentsLastUpdate", "1312887586");
user_pref("CT2801948.ToolbarShrinkedFromSetup", false);
user_pref("CT2801948.TrusteLinkUrl", "http://trust.conduit.com/CT2801948");
user_pref("CT2801948.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,client.conduit-storage.com,OurToolbar.com,CommunityToolbars.com,ForumToolbar.com
user_pref("CT2801948.UserID", "UN23280837716242775");
user_pref("CT2801948.ValidationData_Toolbar", 0);
user_pref("CT2801948.alertChannelId", "1194029");
user_pref("CT2801948.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.conduit.com;apps.conduit.com;services.apps.conduit.com\",\"AppsDetectionUrlP
user_pref("CT2801948.globalFirstTimeInfoLastCheckTime", "Sun Dec 25 2011 15:57:09 GMT-0500 (Eastern Standard Time)");
user_pref("CT2801948.homepageProtectorEnableByLogin", true);
user_pref("CT2801948.initDone", true);
user_pref("CT2801948.isAppTrackingManagerOn", true);
user_pref("CT2801948.isFirstRadioInstallation", false);
user_pref("CT2801948.myStuffEnabled", true);
user_pref("CT2801948.myStuffPublihserMinWidth", 400);
user_pref("CT2801948.myStuffSearchUrl", "http://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");
user_pref("CT2801948.myStuffServiceIntervalMM", 1440);
user_pref("CT2801948.myStuffServiceUrl", "http://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");
user_pref("CT2801948.oldAppsList", "129306881620344305,129306881621438061,111,129306881624250628,12930688162456
3129,129343840936544328,129311959839444431,129306881632844577,10
user_pref("CT2801948.revertSettingsEnabled", false);
user_pref("CT2801948.searchProtectorDialogDelayInSec", 10);
user_pref("CT2801948.searchProtectorEnableByLogin", true);
user_pref("CT2801948.testingCtid", "");
user_pref("CT2801948.toolbarAppMetaDataLastCheckTime", "Sun Dec 25 2011 15:57:09 GMT-0500 (Eastern Standard Time)");
user_pref("CT2801948.toolbarContextMenuLastCheckTime", "Tue Dec 20 2011 21:30:51 GMT-0500 (Eastern Standard Time)");
user_pref("CT2801948.usagesFlag", 2);
user_pref("CommunityToolbar.ConduitHomepagesList", "http://search.conduit.com/?ctid=CT2801948&SearchSource=13");
user_pref("CommunityToolbar.ConduitSearchList", "NCH EN Customized Web Search");
user_pref("CommunityToolbar.ETag.http://Settings.toolbar.search.conduit.com/root/CT2801948/CT2801948", "\"1321973107\"");
user_pref("CommunityToolbar.ETag.http://alerts.conduit-services.com/root/1194029/1189706/US", "\"0\"");
user_pref("CommunityToolbar.ETag.http://appsmetadata.toolbar.conduit-services.com/?ctid=CT2801948", "\"0\"");
user_pref("CommunityToolbar.ETag.http://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=en-us", "wVmmvqqOMqrv5xct1cJIHg==");
user_pref("CommunityToolbar.ETag.http://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=en-us", "0uSPYx+Kl2jpu8sJZMeHjw==");
user_pref("CommunityToolbar.ETag.http://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=en-us", "Dclc8oo4TTv7+mAkSlUSWg==");
user_pref("CommunityToolbar.ETag.http://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=en-us", "K4Vqu91uAzWURlxJRdXJOg==");
user_pref("CommunityToolbar.ETag.http://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\"07879643d3acc1:0\"");
user_pref("CommunityToolbar.ETag.http://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.1.0", "\"6a637346d78ccc1:127c\"");
user_pref("CommunityToolbar.ETag.http://servicemap.conduit-services.com/Toolbar/?ownerId=CT2801948", "\"3e5a4f275840b518b14c5ff3d7391b70\"");
user_pref("CommunityToolbar.ETag.http://storage.conduit.com/BankImages/RadioSkins/Tapuz/idel.gif", "\"802b1fef4e19c81:0\"");
user_pref("CommunityToolbar.ETag.http://storage.conduit.com/BankImages/RadioSkins/Tapuz/minimize.gif", "\"802b1fef4e19c81:0\"");
user_pref("CommunityToolbar.ETag.http://storage.conduit.com/BankImages/RadioSkins/Tapuz/play.gif", "\"802b1fef4e19c81:0\"");
user_pref("CommunityToolbar.ETag.http://storage.conduit.com/BankImages/RadioSkins/Tapuz/stop.gif", "\"802b1fef4e19c81:0\"");
user_pref("CommunityToolbar.ETag.http://storage.conduit.com/BankImages/RadioSkins/Tapuz/vol.gif", "\"802b1fef4e19c81:0\"");
user_pref("CommunityToolbar.ETag.http://translation.toolbar.conduit-services.com/?locale=en-us", "\"dfcd977b3de16cbbb14789dbe1cbbc9f\"");
user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\owner\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\2xmxyhoy.default\\conduitCommon\\modules\\3.8.1.0");
user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.8.1.0");
user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "http://toolbar.inbox.com/search/dispatcher.aspx?tp=sf&tbid=80364&language=en&qkw=");
user_pref("CommunityToolbar.ToolbarsList", "CT2801948");
user_pref("CommunityToolbar.ToolbarsList2", "CT2801948");
user_pref("CommunityToolbar.ToolbarsList4", "CT2801948");
user_pref("CommunityToolbar.globalUserId", "92768d95-ca82-4c81-bdb8-782208536a14");
user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2801948");
user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Tue Dec 20 2011 21:30:12 GMT-0500 (Eastern Standard Time)");
user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);
user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Sun Dec 25 2011 15:57:17 GMT-0500 (Eastern Standard Time)");
user_pref("CommunityToolbar.notifications.clientsServerUrl", "http://alert.client.conduit.com");
user_pref("CommunityToolbar.notifications.locale", "en");
user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sun Dec 25 2011 15:57:09 GMT-0500 (Eastern Standard Time)");
user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");
user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
user_pref("CommunityToolbar.notifications.servicesServerUrl", "http://alert.services.conduit.com");
user_pref("CommunityToolbar.notifications.showTrayIcon", false);
user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
user_pref("CommunityToolbar.notifications.userId", "45ea4933-9dca-4d38-b372-d7382b6d115a");
user_pref("CommunityToolbar.originalHomepage", "http://www.inbox.com/homepage.aspx?tbid=80364&lng=en");
user_pref("CommunityToolbar.originalSearchEngine", "Inbox Search");
user_pref("browser.search.defaultengine", "Ask.com");
user_pref("browser.search.defaultenginename", "Ask.com");
user_pref("browser.search.defaultthis.engineName", "NCH EN Customized Web Search");
user_pref("browser.search.defaulturl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT2801948&SearchSource=3&q={searchTerms}");
user_pref("browser.search.order.1", "Ask.com");
user_pref("browser.search.selectedEngine", "Ask.com");
user_pref("keyword.URL", "http://dts.search-results.com/sr?src=ffb&appid=150&systemid=406&sr=0&q=");

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 12/18/2012 at 19:43:40.34
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

OTL Scan Re-Run
OTL logfile created on: 12/18/2012 7:47:15 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\owner\Desktop\Uncle Jim Files
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 1.64 Gb Available Physical Memory | 59.58% Memory free
5.49 Gb Paging File | 4.11 Gb Available in Paging File | 74.92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 136.95 Gb Total Space | 75.03 Gb Free Space | 54.78% Space Free | Partition Type: NTFS

Computer Name: OWNER-PC | User Name: owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/12/17 18:56:35 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\owner\Desktop\Uncle Jim Files\OTL.exe
PRC - [2012/12/12 19:18:32 | 000,916,960 | —- | M] (Mozilla Corporation) – C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2009/08/06 12:18:54 | 000,311,592 | —- | M] (Egis Technology Inc.) – C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
PRC - [2009/08/06 12:18:42 | 000,349,480 | —- | M] (Egis Technology Inc.) – C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
PRC - [2009/07/27 19:50:32 | 001,157,128 | —- | M] (Dritek System Inc.) – C:\Program Files (x86)\Launch Manager\LManager.exe
PRC - [2009/07/03 20:47:12 | 000,240,160 | —- | M] (Acer) – C:\Program Files\Acer\Acer Updater\UpdaterService.exe
PRC - [2009/06/04 08:04:50 | 001,150,496 | —- | M] (Acer Incorporated) – C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

========== Modules (No Company Name) ==========

MOD - [2012/12/12 19:17:16 | 002,397,152 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

========== Services (SafeList) ==========

SRV:64bit: - [2012/09/12 20:21:48 | 000,368,896 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – c:\Program Files\Microsoft Security Client\NisSrv.exe – (NisSrv)
SRV:64bit: - [2012/09/12 20:21:48 | 000,022,072 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\MsMpEng.exe – (MsMpSvc)
SRV:64bit: - [2009/08/05 23:30:58 | 000,844,320 | —- | M] (Acer Incorporated) [Auto | Running] – C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe – (ePowerSvc)
SRV:64bit: - [2009/07/29 07:03:42 | 000,203,264 | —- | M] (AMD) [Auto | Running] – C:\Windows\SysNative\atiesrxx.exe – (AMD External Events Utility)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV:64bit: - [2009/07/03 20:47:12 | 000,240,160 | —- | M] (Acer) [Auto | Running] – C:\Program Files\Acer\Acer Updater\UpdaterService.exe – (Updater Service)
SRV - [2012/12/12 19:18:30 | 000,115,168 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2012/12/12 15:10:20 | 000,250,808 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/10/19 18:10:42 | 000,147,888 | —- | M] (LogMeIn, Inc.) [Auto | Running] – C:\Program Files (x86)\LogMeIn\x64\ramaint.exe – (LMIMaint)
SRV - [2012/10/19 18:10:34 | 000,375,728 | —- | M] (LogMeIn, Inc.) [Auto | Running] – C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe – (LMIGuardianSvc)
SRV - [2012/08/24 14:41:30 | 000,407,424 | —- | M] (LogMeIn, Inc.) [Auto | Running] – C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe – (LogMeIn)
SRV - [2012/07/13 12:28:36 | 000,160,944 | R— | M] (Skype Technologies) [Auto | Stopped] – C:\Program Files (x86)\Skype\Updater\Updater.exe – (SkypeUpdate)
SRV - [2010/10/22 13:08:18 | 001,039,360 | —- | M] (Hewlett-Packard Co.) [Auto | Running] – C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL – (HPSLPSVC)
SRV - [2010/03/18 13:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2010/01/04 13:03:42 | 000,238,328 | —- | M] (WildTangent, Inc.) [On_Demand | Stopped] – C:\Program Files (x86)\Acer Games\Acer Game Console\GameConsoleService.exe – (GameConsoleService)
SRV - [2009/08/06 12:18:54 | 000,311,592 | —- | M] () [Auto | Running] – C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe – (MWLService)
SRV - [2009/06/10 16:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)
SRV - [2009/06/04 08:04:50 | 001,150,496 | —- | M] (Acer Incorporated) [Auto | Running] – C:\Program Files (x86)\Acer\Registration\GregHSRW.exe – (Greg_Service)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/11/02 15:38:36 | 000,050,856 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\point64.sys – (Point64)
DRV:64bit: - [2012/11/01 21:52:50 | 000,075,928 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\dc3d.sys – (dc3d)
DRV:64bit: - [2012/10/19 18:11:06 | 000,088,008 | —- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] – C:\Windows\SysNative\LMIRfsClientNP.dll – (LMIRfsClientNP)
DRV:64bit: - [2012/08/30 21:03:48 | 000,128,456 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\NisDrvWFP.sys – (NisDrv)
DRV:64bit: - [2012/08/24 14:41:30 | 000,072,216 | —- | M] (LogMeIn, Inc.) [File_System | Auto | Running] – C:\Windows\SysNative\drivers\LMIRfsDriver.sys – (LMIRfsDriver)
DRV:64bit: - [2012/08/24 14:41:16 | 000,011,552 | —- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\lmimirr.sys – (lmimirr)
DRV:64bit: - [2012/08/23 09:10:20 | 000,019,456 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\rdpvideominiport.sys – (RdpVideoMiniport)
DRV:64bit: - [2012/08/23 09:07:35 | 000,057,856 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2012/08/21 12:01:20 | 000,033,240 | —- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\GEARAspiWDM.sys – (GEARAspiWDM)
DRV:64bit: - [2012/07/09 12:42:54 | 000,052,736 | —- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\usbaapl64.sys – (USBAAPL64)
DRV:64bit: - [2012/03/01 01:46:16 | 000,023,408 | —- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] – C:\Windows\SysNative\drivers\fs_rec.sys – (Fs_Rec)
DRV:64bit: - [2011/03/11 01:41:12 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/03/11 01:41:12 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2010/11/20 08:33:35 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2009/10/05 16:34:00 | 001,542,656 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\athrx.sys – (athr)
DRV:64bit: - [2009/07/29 17:11:24 | 006,038,016 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmdag.sys – (atikmdag)
DRV:64bit: - [2009/07/27 02:04:36 | 000,058,880 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\L1C62x64.sys – (L1C)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/07/13 19:35:32 | 000,012,288 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\serscan.sys – (StillCam)
DRV:64bit: - [2009/06/18 07:12:32 | 000,272,432 | —- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\SynTP.sys – (SynTP)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009/06/02 06:15:30 | 000,060,464 | —- | M] (Egis Technology Inc.) [Kernel | System | Running] – C:\Windows\SysNative\drivers\mwlPSDVDisk.sys – (mwlPSDVDisk)
DRV:64bit: - [2009/06/02 06:15:30 | 000,022,576 | —- | M] (Egis Technology Inc.) [File_System | System | Running] – C:\Windows\SysNative\drivers\mwlPSDFilter.sys – (mwlPSDFilter)
DRV:64bit: - [2009/06/02 06:15:30 | 000,020,016 | —- | M] (Egis Technology Inc.) [Kernel | System | Running] – C:\Windows\SysNative\drivers\mwlPSDNserv.sys – (mwlPSDNServ)
DRV:64bit: - [2009/05/05 03:46:08 | 000,018,432 | —- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\NTIDrvr.sys – (NTIDrvr)
DRV:64bit: - [2009/05/05 03:46:08 | 000,016,896 | —- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\UBHelper.sys – (UBHelper)
DRV:64bit: - [2009/05/04 08:30:28 | 000,016,440 | —- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\AtiPcie.sys – (AtiPcie)
DRV:64bit: - [2009/04/03 08:39:58 | 000,034,872 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\usbfilter.sys – (usbfilter)
DRV:64bit: - [2008/03/13 02:46:00 | 000,027,136 | —- | M] (ManyCam LLC.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\ManyCam_x64.sys – (ManyCam)
DRV - [2012/08/24 14:41:32 | 000,015,928 | —- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] – C:\Program Files (x86)\LogMeIn\x64\rainfo.sys – (LMIInfo)
DRV - [2009/07/13 20:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…d4z1m5t47l2x29n
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…d4z1m5t47l2x29n
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…d4z1m5t47l2x29n
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…d4z1m5t47l2x29n
IE - HKLM\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7ACAW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…d4z1m5t47l2x29n
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.msn.com
IE - HKCU\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?FORM=GM2TDF&…rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{3DB51E13-7669-4FED-BCB4-0B72D7D7ECDA}: "URL" = http://websearch.ask.com/redirect?client=i…12-ADB9F98F35FA
IE - HKCU\..\SearchScopes\{409DD3B4-D1F8-EC6E-EDBD-2367FDA78762}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&…1I7ACAW_enUS355
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKCU\..\SearchScopes\{9E699A06-EE61-4B6B-A91E-70ABBE285723}: "URL" = http://ws.infospace.com/playsushi_tbar/ws/…ceUrl=true& user_id=%userid&tool_id=60231&qkw={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:3.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:2010.9.0.6
FF - prefs.js..extensions.enabledItems: {59c6f12b-f004-43e5-9997-08f2123119b6}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.3.0.7280
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {ED76C299-85BC-4891-9237-74A140C28832}:[removed]
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
FF - prefs.js..extensions.enabledItems: {37483b40-c254-4a72-bda4-22ee90182c1e}:3.8.1.0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_135.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\owner\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\owner\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012/11/25 16:54:34 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/12/12 19:18:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/12/18 19:31:46 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012/11/25 16:54:34 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/12/12 19:18:33 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/12/18 19:31:46 | 000,000,000 | —D | M]

[2012/11/25 16:24:04 | 000,000,000 | —D | M] (No name found) – C:\Users\owner\AppData\Roaming\mozilla\Extensions
[2012/12/18 19:08:44 | 000,000,000 | —D | M] (No name found) – C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\2xmxyhoy.default\extensions
[2010/12/31 14:42:55 | 000,000,000 | —D | M] (ooVoo Toolbar) – C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\{59c6f12b-f004-43e5-9997-08f2123119b6}
[2010/07/02 11:17:29 | 000,001,842 | —- | M] () – C:\Users\owner\AppData\Roaming\mozilla\firefox\profiles\2xmxyhoy.default\searchplugins\bing.xml
[2011/10/14 20:26:43 | 000,002,292 | —- | M] () – C:\Users\owner\AppData\Roaming\mozilla\firefox\profiles\2xmxyhoy.default\searchplugins\inbox-search.xml
[2012/12/12 19:16:57 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/12/12 19:16:57 | 000,000,000 | —D | M] (Skype extension) – C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/12/12 19:18:33 | 000,262,112 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/11/11 17:43:59 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/11/11 17:43:59 | 000,002,058 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://www.searchnu.com/406
CHR - default_search_provider: Search Results (Enabled)
CHR - default_search_provider: search_url = http://dts.search-results.com/sr?src=crb&a…q={searchTerms}
CHR - default_search_provider: suggest_url =
CHR - homepage: http://www.searchnu.com/406
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\owner\AppData\Local\Google\Chrome\Application\23.0.1271.64\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U26 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\owner\AppData\Local\Google\Chrome\Application\23.0.1271.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\owner\AppData\Local\Google\Chrome\Application\23.0.1271.64\pdf.dll
CHR - plugin: Play Pickle Textlinks Plugin (Enabled) = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\bllefkbpbefdodiiefpkcnigpicmhohe\npptl.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.7280_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\owner\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\owner\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Bing Bar (Enabled) = C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll
CHR - plugin: WildTangent Games App Presence Detector (Enabled) = C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Play Pickle = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\bllefkbpbefdodiiefpkcnigpicmhohe\
CHR - Extension: YouTube = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: YouTube = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Google Search = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Search = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: Free SMS bar = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\foffjhlcnkehaapebnoehjhdbjfmpgjn\10.11.22.2_0\
CHR - Extension: Productivity 3.1 = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\fojnkghiggpfagjciliabphpgnbmehjf\2.3.15.10_0\
CHR - Extension: Skype Extension = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.7280_0\
CHR - Extension: Gmail = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Gmail = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2009/11/26 16:16:34 | 000,358,599 | R— | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 123haustiereundmehr.com
O1 - Hosts: 12307 more lines…
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [IntelliType Pro] c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files (x86)\Acer\Acer Assist\launcher.exe ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_09)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_09)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1EAA46E7-6F20-4029-83EE-924C629995B5}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{25B43BE2-156C-41BE-82C5-21FD7D02B0DA}: DhcpNameServer = 192.168.2.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O27:64bit: - HKLM IFEO\ehshell.exe: Debugger - C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe (LogMeIn, Inc.)
O27 - HKLM IFEO\ehshell.exe: Debugger - C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe (LogMeIn, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/12/18 19:22:40 | 000,000,000 | —D | C] – C:\Windows\ERUNT
[2012/12/18 19:22:22 | 000,000,000 | —D | C] – C:\JRT
[2012/12/18 19:08:42 | 000,000,000 | —D | C] – C:\_OTL
[2012/12/18 19:04:38 | 000,246,760 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2012/12/17 21:59:22 | 000,000,000 | —D | C] – C:\Users\owner\Desktop\Uncle Jim Files
[2012/12/16 15:47:23 | 000,000,000 | —D | C] – C:\Users\owner\AppData\Local\LogMeIn
[2012/12/16 15:47:18 | 000,035,240 | —- | C] (LogMeIn, Inc.) – C:\Windows\SysNative\LMIport.dll
[2012/12/16 15:47:17 | 000,088,008 | —- | C] (LogMeIn, Inc.) – C:\Windows\SysNative\LMIRfsClientNP.dll
[2012/12/16 15:47:17 | 000,072,216 | —- | C] (LogMeIn, Inc.) – C:\Windows\SysNative\drivers\LMIRfsDriver.sys
[2012/12/16 15:47:09 | 000,083,880 | —- | C] (LogMeIn, Inc.) – C:\Windows\SysNative\LMIinit.dll
[2012/12/16 15:47:02 | 000,000,000 | —D | C] – C:\ProgramData\LogMeIn
[2012/12/16 15:46:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\LogMeIn
[2012/12/16 15:15:06 | 000,000,000 | —D | C] – C:\Program Files\HP
[2012/12/16 13:53:53 | 000,000,000 | —D | C] – C:\Windows\Hewlett-Packard
[2012/12/13 15:48:56 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/12/13 15:48:55 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/12/13 15:48:43 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/12/13 15:48:41 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/12/13 15:48:40 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/12/13 15:48:38 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/12/13 15:48:37 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/12/13 15:48:37 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/12/13 15:48:31 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/12/13 15:48:29 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/12/13 15:48:28 | 002,312,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/12/13 15:48:27 | 000,729,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012/12/13 15:48:17 | 000,717,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/12/13 15:48:16 | 000,816,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/12/13 15:48:16 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2012/12/12 19:16:56 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2012/12/12 17:34:28 | 000,424,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KernelBase.dll
[2012/12/12 17:34:27 | 001,161,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[2012/12/12 17:34:27 | 000,338,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\conhost.exe
[2012/12/12 17:34:27 | 000,215,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2012/12/12 17:34:25 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64win.dll
[2012/12/12 17:34:25 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64.dll
[2012/12/12 17:34:25 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2012/12/12 17:34:24 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntvdm64.dll
[2012/12/12 17:34:24 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2012/12/12 17:34:24 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64cpu.dll
[2012/12/12 17:34:24 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2012/12/12 17:34:22 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2012/12/12 17:34:22 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/12/12 17:34:20 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012/12/12 17:34:20 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012/12/12 17:34:20 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012/12/12 17:34:20 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012/12/12 17:34:20 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012/12/12 17:34:20 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012/12/12 17:34:19 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012/12/12 17:34:19 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012/12/12 17:34:19 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/12/12 17:34:19 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012/12/12 17:34:19 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012/12/12 17:34:18 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012/12/12 17:34:18 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012/12/12 17:34:17 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012/12/12 17:34:17 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012/12/12 17:34:17 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012/12/12 17:34:16 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012/12/12 17:34:16 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012/12/12 17:34:16 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012/12/12 17:34:16 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012/12/12 17:34:15 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2012/12/12 17:33:51 | 000,478,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dpnet.dll
[2012/12/12 17:33:50 | 000,376,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dpnet.dll
[2012/12/09 13:36:38 | 000,000,000 | —D | C] – C:\Users\owner\Documents\christmas card
[2012/11/25 17:33:33 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Mouse and Keyboard Center
[2012/11/25 17:32:47 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TsUsbRedirectionGroupPolicyExtension.dll
[2012/11/25 17:32:47 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TsUsbRedirectionGroupPolicyControl.exe
[2012/11/25 17:32:46 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RdpGroupPolicyExtension.dll
[2012/11/25 17:32:41 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\TsUsbFlt.sys
[2012/11/25 17:32:41 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\rdpvideominiport.sys
[2012/11/25 17:32:33 | 000,269,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\aaclient.dll
[2012/11/25 17:32:33 | 000,192,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\rdpendp_winip.dll
[2012/11/25 17:32:33 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MsRdpWebAccess.dll
[2012/11/25 17:32:33 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tsgqec.dll
[2012/11/25 17:32:33 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TsUsbGDCoInstaller.dll
[2012/11/25 17:32:33 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tsgqec.dll
[2012/11/25 17:32:33 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wksprtPS.dll
[2012/11/25 17:32:33 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wksprtPS.dll
[2012/11/25 17:32:32 | 000,322,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\aaclient.dll
[2012/11/25 17:32:32 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MsRdpWebAccess.dll
[2012/11/25 17:32:31 | 001,048,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstsc.exe
[2012/11/25 17:32:31 | 000,384,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wksprt.exe
[2012/11/25 17:32:31 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpudd.dll
[2012/11/25 17:32:31 | 000,228,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpendp_winip.dll
[2012/11/25 17:32:31 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TSWbPrxy.exe
[2012/11/25 17:32:30 | 003,174,912 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpcorets.dll
[2012/11/25 17:32:30 | 001,123,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstsc.exe
[2012/11/25 17:32:29 | 004,916,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstscax.dll
[2012/11/25 17:32:28 | 005,773,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstscax.dll
[2012/11/25 17:31:46 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Mouse and Keyboard Center
[2012/11/25 17:28:36 | 000,514,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\qdvd.dll
[2012/11/25 17:28:36 | 000,366,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\qdvd.dll
[2012/11/25 17:28:33 | 001,448,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lsasrv.dll
[2012/11/25 17:28:33 | 000,307,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncrypt.dll
[2012/11/25 16:55:49 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons
[2012/11/25 16:53:31 | 000,000,000 | —D | C] – C:\ProgramData\HP Product Assistant
[2012/11/25 16:51:12 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\HP
[2012/11/25 14:48:13 | 000,000,000 | —D | C] – C:\Users\owner\Desktop\RegistryBackups
[2012/11/25 13:40:00 | 000,000,000 | —D | C] – C:\Users\owner\AppData\Roaming\HPAppData
[2012/11/25 13:39:12 | 000,174,056 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2012/11/25 13:39:12 | 000,174,056 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2012/11/25 13:39:12 | 000,095,208 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll

========== Files - Modified Within 30 Days ==========

[2012/12/18 19:38:34 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/12/18 19:38:34 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/12/18 19:28:52 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/12/18 19:24:04 | 000,000,908 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2600581341-1188975230-2990884034-1000UA.job
[2012/12/18 19:19:15 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/12/18 19:19:15 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/12/18 19:11:05 | 000,000,292 | —- | M] () – C:\Windows\tasks\iMeshNAG.job
[2012/12/18 19:10:45 | 2211,483,648 | -HS- | M] () – C:\hiberfil.sys
[2012/12/18 19:06:05 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/12/17 20:24:00 | 000,000,856 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2600581341-1188975230-2990884034-1000Core.job
[2012/12/16 15:47:05 | 000,001,024 | —- | M] () – C:\.rnd
[2012/12/16 15:32:11 | 000,173,111 | —- | M] () – C:\Windows\hpoins46.dat
[2012/12/16 15:32:11 | 000,002,331 | —- | M] () – C:\Users\Public\Desktop\Add a Device - Photosmart D110 series.lnk
[2012/12/16 13:43:58 | 000,344,296 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/12/15 10:10:47 | 000,002,491 | —- | M] () – C:\Users\owner\Desktop\Google Chrome.lnk
[2012/12/12 15:10:18 | 000,697,272 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/12/12 15:10:18 | 000,073,656 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/11/29 20:26:47 | 000,726,444 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/11/29 20:26:47 | 000,624,412 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/11/29 20:26:47 | 000,106,756 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/11/25 17:33:32 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_point64_01011.Wdf
[2012/11/25 17:30:02 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01011.Wdf
[2012/11/25 17:28:05 | 000,207,029 | —- | M] () – C:\Windows\hpoins46.dat.temp
[2012/11/25 17:17:21 | 000,058,780 | —- | M] () – C:\Users\owner\Desktop\HP Installation Error - Windows 7.hta
[2012/11/25 16:54:58 | 000,001,165 | —- | M] () – C:\Users\Public\Desktop\Shop for HP Supplies.lnk
[2012/11/25 16:53:19 | 000,001,319 | —- | M] () – C:\Users\Public\Desktop\HP Solution Center.lnk
[2012/11/25 16:52:14 | 000,002,103 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2012/11/25 16:51:54 | 000,001,976 | —- | M] () – C:\Users\Public\Desktop\HP ePrinterCenter.lnk
[2012/11/25 14:14:18 | 000,000,826 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk

========== Files Created - No Company Name ==========

[2012/12/16 15:47:04 | 000,001,024 | —- | C] () – C:\.rnd
[2012/12/16 15:46:50 | 000,000,992 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn.lnk
[2012/12/16 15:32:11 | 000,002,331 | —- | C] () – C:\Users\Public\Desktop\Add a Device - Photosmart D110 series.lnk
[2012/12/16 15:14:35 | 000,207,029 | —- | C] () – C:\Windows\hpoins46.dat.temp
[2012/11/25 17:33:32 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_point64_01011.Wdf
[2012/11/25 17:30:02 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01011.Wdf
[2012/11/25 17:17:18 | 000,058,780 | —- | C] () – C:\Users\owner\Desktop\HP Installation Error - Windows 7.hta
[2012/11/25 16:58:20 | 000,000,574 | —- | C] () – C:\Windows\hpomdl46.dat.temp
[2012/11/25 16:54:58 | 000,001,165 | —- | C] () – C:\Users\Public\Desktop\Shop for HP Supplies.lnk
[2012/11/25 16:53:19 | 000,001,319 | —- | C] () – C:\Users\Public\Desktop\HP Solution Center.lnk
[2012/11/25 16:52:14 | 000,002,103 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2012/11/25 16:51:54 | 000,001,976 | —- | C] () – C:\Users\Public\Desktop\HP ePrinterCenter.lnk
[2012/11/25 16:46:05 | 000,173,111 | —- | C] () – C:\Windows\hpoins46.dat
[2012/03/04 15:02:22 | 000,743,534 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2012/01/03 18:13:22 | 000,057,344 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll
[2011/05/19 19:04:53 | 000,001,940 | —- | C] () – C:\Users\owner\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2011/05/03 17:31:58 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2011/03/17 21:31:13 | 000,000,175 | —- | C] () – C:\Windows\wininit.ini
[2011/02/07 19:09:43 | 000,000,035 | —- | C] () – C:\Windows\popcinfo.dat
[2009/11/26 12:11:09 | 000,000,000 | —- | C] () – C:\Users\owner\AppData\Roaming\wklnhst.dat

========== ZeroAccess Check ==========

[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 00:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 23:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 20:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 07:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 20:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2009/10/30 00:54:35 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Acer
[2012/01/10 20:18:04 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\EasiestSoft
[2009/10/30 00:54:35 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Leadertech
[2011/09/25 13:57:10 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\ManyCam
[2010/12/31 14:47:01 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\ooVoo Details
[2009/12/25 15:50:09 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\PowerCinema
[2009/11/26 13:55:31 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\SoftDMA
[2009/11/26 12:13:01 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Template
[2011/12/28 11:02:49 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Tific
[2012/11/25 16:24:57 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\WildTangent
[2012/09/24 18:29:15 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Windows Live Writer

========== Purity Check ==========

< End of report >

JonTom

Post #7December 19, 2012, 4:01 PM UTC

Hello YatesBros

Thank you for the logs.

We need to change your Chrome Homepage:

Change Your Google Chrome Home Page
- Click the wrench icon in the top-right corner of the browser.
- Select Options.
- In the 'On startup' section, select Open the home page.
- In the 'Home page' section, choose Open this page and type in the address of the website you would like as your start page (for example http://www.google.com )
- Save your preferences.
MalwareBytes AntiMalware:
- I can see that you have MBAM installed.
- Double click on your MalwareBytes AntiMalware icon to launch the program.
- Click on the "Update" tab and then on "Check for Updates".
- The program will now install the latest Malware definition files.
- Once complete, click on the "Scanner" tab, select "Perform Quick Scan"and then click on "Scan".
- Once the program has scanned your computer, a log file will be created in Notepad.
- Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
- If the scan detects any Malware-related objects, make sure that everything is checked, and click "Remove Selected" <– Very Important.
- When disinfection is completed, a log will open in Notepad and you may be prompted to restart your computer.
- The log is automatically saved by MBAM and can be viewed by clicking the "Logs" tab.
- Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart your computer, please do so immediately.
- Come back here to this thread and Paste the log in your next reply.
How is the machine running at the moment?

YatesBros

Post #8December 20, 2012, 1:51 AM UTC

Hi JonTom

I don't see the wrench under Google Chrome in the top right hand corner. The laptop with issues is actually my niece's and I am not that familiar with Google Chrome. When I started Chrome on her laptop it said it installed an SMS Toolbar. When Chrome is opened, there are two tabs, one has http://www.searchnu.com/406 entered in the search area and the other tab has http://search.conduit.com/?ctid=CT2801948&…SearchSource=48. There is also a Bing bar one of the tabs. It seems like the Google Chrome has more turned on automatically inside of it than my niece needs running.

Is there another way to the area that the wrench takes you to? Maybe I need to uninstall and reinstall Chrome?

Here are the results of Malwarebytes. I need to get her to run this more often.

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Database version: v2012.12.19.13

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
owner :: OWNER-PC [administrator]

12/19/2012 6:35:47 PM
mbam-log-2012-12-19 (18-35-47).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 246640
Time elapsed: 3 minute(s), 32 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 78
HKCR\CLSID\{02515cef-2063-4d64-b87a-d504c99d40dd} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TypeLib\{aed3b1e0-fabb-4c27-a2da-ec8352ee7e30} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\Interface\{9989BC14-9B5B-4B3B-8040-478FD1685E34} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CLSID\{04d2b915-19ff-41e9-994d-95dc898bea43} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TypeLib\{0597d3be-9a4d-4426-a8a7-572ad299852e} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\Interface\{4E7F49ED-8C94-4AAA-A407-3010D099B11A} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.SettingsPlugin.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.SettingsPlugin (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{04D2B915-19FF-41E9-994D-95DC898BEA43} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{04D2B915-19FF-41E9-994D-95DC898BEA43} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CLSID\{07494721-dfcf-41c1-8a03-b3fffb0f8409} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TypeLib\{952c6f00-cba7-47be-baf3-cfc5808e6c7b} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\Interface\{1E34EA93-600B-4CBC-9858-59BE04C1A581} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CLSID\{0e8a6cb6-3b14-491d-8bba-86a95a62ff72} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.PseudoTransparentPlugin.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.PseudoTransparentPlugin (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{0E8A6CB6-3B14-491D-8BBA-86A95A62FF72} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CLSID\{1D7E63AF-274B-426B-B51D-ADF161DF7F24} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.HTMLMenu.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.HTMLMenu (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1D7E63AF-274B-426B-B51D-ADF161DF7F24} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CLSID\{387dface-9e46-415f-8c86-18083b7d6ead} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TypeLib\{73cadbbd-4dc5-419d-84f1-e7bf4c3b20c4} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\Interface\{32CC4D2E-999C-4853-9D3E-5DE4C02D57C6} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CLSID\{38deffd9-9379-4ac4-baa9-1a883dba9cd2} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.MultipleButton.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.MultipleButton (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CLSID\{52d3c28f-c9ac-40b5-848f-1fb63d2badef} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.ScriptButton.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.ScriptButton (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CLSID\{67d33c35-62e9-4f77-a284-9e9d256f7846} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.DynamicBarButton.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.DynamicBarButton (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CLSID\{6ffb45e3-cffc-4b3a-95eb-334cb53c85b0} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TypeLib\{a378fd9d-b406-44bb-96d2-8cdaa668713f} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\Interface\{93A55DA3-83ED-4090-91B6-904C44647639} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.FeedManager.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.FeedManager (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CLSID\{7895609d-c8b4-4cf5-a2c7-28223d0c3d92} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TypeLib\{34979cb5-728d-4727-81bf-01850a3bb89b} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\Interface\{934063FB-A81D-4849-B02C-478446DF3219} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.ThirdPartyInstaller.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.ThirdPartyInstaller (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7895609D-C8B4-4CF5-A2C7-28223D0C3D92} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CLSID\{7952f465-ac46-4a82-b383-870f3784d1cd} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.UrlAlertButton.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.UrlAlertButton (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CLSID\{7ad9c324-3672-4d33-8477-d9c8e627f4bf} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.Radio.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.Radio (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CLSID\{8be781d8-5e70-423d-82de-9e4756fce53c} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TypeLib\{026fd9ba-112b-4d9f-86ea-589e28016e8c} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\Interface\{0328B630-EA94-4FA3-9F27-8250B6324DDB} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.XMLSessionPlugin.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.XMLSessionPlugin (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8BE781D8-5E70-423D-82DE-9E4756FCE53C} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CLSID\{91a8da6b-8013-44aa-b63f-00195312999a} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TypeLib\{03f59b4b-09d9-40f0-a01a-6e895023f2f0} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\Interface\{42CB7963-EFE0-4737-A927-CE076FAA3BA0} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.RadioSettings.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.RadioSettings (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CLSID\{d09094b3-b426-4f16-a6d9-e211fe222127} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D09094B3-B426-4F16-A6D9-E211FE222127} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CLSID\{f02c0832-c85c-4b93-8c6f-9df20121a10d} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TypeLib\{6784d08d-cdc3-419d-9b97-744a351ed908} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\Interface\{844C2331-94DF-431E-9A67-426ED861D27F} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.HTMLPanel.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.HTMLPanel (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F02C0832-C85C-4B93-8C6F-9DF20121A10D} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CLSID\{fba7cbb1-fc93-4149-8862-d94451a7d167} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TypeLib\{608f7340-e221-4afb-a848-c4dad297cd58} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\Interface\{966430CC-2097-45CA-8626-2C3F454C3297} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4e7f49ed-8c94-4aaa-a407-3010d099b11a} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.SkinLauncher (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.SkinLauncher.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.SkinLauncherSettings (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\TelevisionFanatic.SkinLauncherSettings.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TelevisionFanaticbar Uninstall (PUP.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

YatesBros

Post #9December 20, 2012, 2:32 PM UTC

Sorry, meant to include that the laptop seems to be better.

JonTom

Post #10December 20, 2012, 9:46 PM UTC

Hello YatesBros

Thank you for the logs.

the laptop seems to be better

Thats good to hear, but we still have work to do.

I don't see the wrench under Google Chrome in the top right hand corner.
Is there another way to the area that the wrench takes you to? Maybe I need to uninstall and reinstall Chrome?

Uninstalling then reinstalling is an option we have at our disposal, but lets try this first:

Are you able to locate the chrome menu button on the browser?

Click the Chrome menu button on the browser toolbar.
Select Settings.
Add the home button to the browser toolbar.
The Home page button is off by default. Select the "Show Home button" checkbox in the "Appearance" section to show it on the browser toolbar.
Set your home page.
When the "Show Home button" checkbox is selected, a web address appears below it.
Make sure that all instances of searchnu are removed.
If you want the Home page button to open up a different webpage, click Change to enter a link.

Once you have tried the above please re-scan with OTL and post the new log for me to review.

YatesBros

Post #11December 20, 2012, 11:55 PM UTC

I was able to make the changes in Google Chrome you suggested.

A couple of questions:
Running Microsoft Security Essentials actively on this laptop. Would you recommend another instead?
When you had me run Malwarebytes, you had me run Quick scan. Is that enough to do regularly? Or, should I run the full scan?
I use CCleaner regularly, do you recommend I continue?
Is Outpost a good firewall to run?
Would you make any other recommendations to keeping the laptop clean?

Here is the OTL log:
OTL logfile created on: 12/20/2012 6:31:35 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\owner\Desktop\Uncle Jim Files
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 1.78 Gb Available Physical Memory | 64.80% Memory free
5.49 Gb Paging File | 4.17 Gb Available in Paging File | 75.89% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 136.95 Gb Total Space | 74.20 Gb Free Space | 54.18% Space Free | Partition Type: NTFS

Computer Name: OWNER-PC | User Name: owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/12/17 18:56:35 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\owner\Desktop\Uncle Jim Files\OTL.exe
PRC - [2009/08/06 12:18:54 | 000,311,592 | —- | M] (Egis Technology Inc.) – C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
PRC - [2009/08/06 12:18:42 | 000,349,480 | —- | M] (Egis Technology Inc.) – C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
PRC - [2009/07/27 19:50:32 | 001,157,128 | —- | M] (Dritek System Inc.) – C:\Program Files (x86)\Launch Manager\LManager.exe
PRC - [2009/07/03 20:47:12 | 000,240,160 | —- | M] (Acer) – C:\Program Files\Acer\Acer Updater\UpdaterService.exe
PRC - [2009/06/04 08:04:50 | 001,150,496 | —- | M] (Acer Incorporated) – C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

========== Modules (No Company Name) ==========

========== Services (SafeList) ==========

SRV:64bit: - [2012/09/12 20:21:48 | 000,368,896 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – c:\Program Files\Microsoft Security Client\NisSrv.exe – (NisSrv)
SRV:64bit: - [2012/09/12 20:21:48 | 000,022,072 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\MsMpEng.exe – (MsMpSvc)
SRV:64bit: - [2009/08/05 23:30:58 | 000,844,320 | —- | M] (Acer Incorporated) [Auto | Running] – C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe – (ePowerSvc)
SRV:64bit: - [2009/07/29 07:03:42 | 000,203,264 | —- | M] (AMD) [Auto | Running] – C:\Windows\SysNative\atiesrxx.exe – (AMD External Events Utility)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV:64bit: - [2009/07/03 20:47:12 | 000,240,160 | —- | M] (Acer) [Auto | Running] – C:\Program Files\Acer\Acer Updater\UpdaterService.exe – (Updater Service)
SRV - [2012/12/12 19:18:30 | 000,115,168 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2012/12/12 15:10:20 | 000,250,808 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/10/19 18:10:42 | 000,147,888 | —- | M] (LogMeIn, Inc.) [Auto | Running] – C:\Program Files (x86)\LogMeIn\x64\ramaint.exe – (LMIMaint)
SRV - [2012/10/19 18:10:34 | 000,375,728 | —- | M] (LogMeIn, Inc.) [Auto | Running] – C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe – (LMIGuardianSvc)
SRV - [2012/08/24 14:41:30 | 000,407,424 | —- | M] (LogMeIn, Inc.) [Auto | Running] – C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe – (LogMeIn)
SRV - [2012/07/13 12:28:36 | 000,160,944 | R— | M] (Skype Technologies) [Auto | Stopped] – C:\Program Files (x86)\Skype\Updater\Updater.exe – (SkypeUpdate)
SRV - [2010/10/22 13:08:18 | 001,039,360 | —- | M] (Hewlett-Packard Co.) [Auto | Running] – C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL – (HPSLPSVC)
SRV - [2010/03/18 13:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2010/01/04 13:03:42 | 000,238,328 | —- | M] (WildTangent, Inc.) [On_Demand | Stopped] – C:\Program Files (x86)\Acer Games\Acer Game Console\GameConsoleService.exe – (GameConsoleService)
SRV - [2009/08/06 12:18:54 | 000,311,592 | —- | M] () [Auto | Running] – C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe – (MWLService)
SRV - [2009/06/10 16:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)
SRV - [2009/06/04 08:04:50 | 001,150,496 | —- | M] (Acer Incorporated) [Auto | Running] – C:\Program Files (x86)\Acer\Registration\GregHSRW.exe – (Greg_Service)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/11/02 15:38:36 | 000,050,856 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\point64.sys – (Point64)
DRV:64bit: - [2012/11/01 21:52:50 | 000,075,928 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\dc3d.sys – (dc3d)
DRV:64bit: - [2012/10/19 18:11:06 | 000,088,008 | —- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] – C:\Windows\SysNative\LMIRfsClientNP.dll – (LMIRfsClientNP)
DRV:64bit: - [2012/08/30 21:03:48 | 000,128,456 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\NisDrvWFP.sys – (NisDrv)
DRV:64bit: - [2012/08/24 14:41:30 | 000,072,216 | —- | M] (LogMeIn, Inc.) [File_System | Auto | Running] – C:\Windows\SysNative\drivers\LMIRfsDriver.sys – (LMIRfsDriver)
DRV:64bit: - [2012/08/24 14:41:16 | 000,011,552 | —- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\lmimirr.sys – (lmimirr)
DRV:64bit: - [2012/08/23 09:10:20 | 000,019,456 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\rdpvideominiport.sys – (RdpVideoMiniport)
DRV:64bit: - [2012/08/23 09:07:35 | 000,057,856 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2012/08/21 12:01:20 | 000,033,240 | —- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\GEARAspiWDM.sys – (GEARAspiWDM)
DRV:64bit: - [2012/07/09 12:42:54 | 000,052,736 | —- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\usbaapl64.sys – (USBAAPL64)
DRV:64bit: - [2012/03/01 01:46:16 | 000,023,408 | —- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] – C:\Windows\SysNative\drivers\fs_rec.sys – (Fs_Rec)
DRV:64bit: - [2011/03/11 01:41:12 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/03/11 01:41:12 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2010/11/20 08:33:35 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2009/10/05 16:34:00 | 001,542,656 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\athrx.sys – (athr)
DRV:64bit: - [2009/07/29 17:11:24 | 006,038,016 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmdag.sys – (atikmdag)
DRV:64bit: - [2009/07/27 02:04:36 | 000,058,880 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\L1C62x64.sys – (L1C)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/07/13 19:35:32 | 000,012,288 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\serscan.sys – (StillCam)
DRV:64bit: - [2009/06/18 07:12:32 | 000,272,432 | —- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\SynTP.sys – (SynTP)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009/06/02 06:15:30 | 000,060,464 | —- | M] (Egis Technology Inc.) [Kernel | System | Running] – C:\Windows\SysNative\drivers\mwlPSDVDisk.sys – (mwlPSDVDisk)
DRV:64bit: - [2009/06/02 06:15:30 | 000,022,576 | —- | M] (Egis Technology Inc.) [File_System | System | Running] – C:\Windows\SysNative\drivers\mwlPSDFilter.sys – (mwlPSDFilter)
DRV:64bit: - [2009/06/02 06:15:30 | 000,020,016 | —- | M] (Egis Technology Inc.) [Kernel | System | Running] – C:\Windows\SysNative\drivers\mwlPSDNserv.sys – (mwlPSDNServ)
DRV:64bit: - [2009/05/05 03:46:08 | 000,018,432 | —- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\NTIDrvr.sys – (NTIDrvr)
DRV:64bit: - [2009/05/05 03:46:08 | 000,016,896 | —- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\UBHelper.sys – (UBHelper)
DRV:64bit: - [2009/05/04 08:30:28 | 000,016,440 | —- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\AtiPcie.sys – (AtiPcie)
DRV:64bit: - [2009/04/03 08:39:58 | 000,034,872 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\usbfilter.sys – (usbfilter)
DRV:64bit: - [2008/03/13 02:46:00 | 000,027,136 | —- | M] (ManyCam LLC.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\ManyCam_x64.sys – (ManyCam)
DRV - [2012/08/24 14:41:32 | 000,015,928 | —- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] – C:\Program Files (x86)\LogMeIn\x64\rainfo.sys – (LMIInfo)
DRV - [2009/07/13 20:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…d4z1m5t47l2x29n
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…d4z1m5t47l2x29n
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a;…q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…d4z1m5t47l2x29n
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…d4z1m5t47l2x29n
IE - HKLM\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7ACAW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…d4z1m5t47l2x29n
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.msn.com
IE - HKCU\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?FORM=GM2TDF&…rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{3DB51E13-7669-4FED-BCB4-0B72D7D7ECDA}: "URL" = http://websearch.ask.com/redirect?client=i…12-ADB9F98F35FA
IE - HKCU\..\SearchScopes\{409DD3B4-D1F8-EC6E-EDBD-2367FDA78762}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&…1I7ACAW_enUS355
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKCU\..\SearchScopes\{9E699A06-EE61-4B6B-A91E-70ABBE285723}: "URL" = http://ws.infospace.com/playsushi_tbar/ws/…ceUrl=true& user_id=%userid&tool;_id=60231&qkw;={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:3.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:2010.9.0.6
FF - prefs.js..extensions.enabledItems: {59c6f12b-f004-43e5-9997-08f2123119b6}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.3.0.7280
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {ED76C299-85BC-4891-9237-74A140C28832}:[removed]
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
FF - prefs.js..extensions.enabledItems: {37483b40-c254-4a72-bda4-22ee90182c1e}:3.8.1.0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_135.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\owner\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\owner\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012/11/25 16:54:34 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/12/12 19:18:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/12/18 19:31:46 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012/11/25 16:54:34 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/12/12 19:18:33 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/12/18 19:31:46 | 000,000,000 | —D | M]

[2012/11/25 16:24:04 | 000,000,000 | —D | M] (No name found) – C:\Users\owner\AppData\Roaming\mozilla\Extensions
[2012/12/18 19:08:44 | 000,000,000 | —D | M] (No name found) – C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\2xmxyhoy.default\extensions
[2010/12/31 14:42:55 | 000,000,000 | —D | M] (ooVoo Toolbar) – C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\{59c6f12b-f004-43e5-9997-08f2123119b6}
[2010/07/02 11:17:29 | 000,001,842 | —- | M] () – C:\Users\owner\AppData\Roaming\mozilla\firefox\profiles\2xmxyhoy.default\searchplugins\bing.xml
[2011/10/14 20:26:43 | 000,002,292 | —- | M] () – C:\Users\owner\AppData\Roaming\mozilla\firefox\profiles\2xmxyhoy.default\searchplugins\inbox-search.xml
[2012/12/12 19:16:57 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/12/12 19:16:57 | 000,000,000 | —D | M] (Skype extension) – C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/12/12 19:18:33 | 000,262,112 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/11/11 17:43:59 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/11/11 17:43:59 | 000,002,058 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://www.google.com/webhp?rls=ig
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl;={language}&q;={searchTerms}&sugkey;={google:suggestAPIKeyParameter}
CHR - homepage: http://www.google.com/webhp?rls=ig
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\owner\AppData\Local\Google\Chrome\Application\23.0.1271.97\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U26 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\owner\AppData\Local\Google\Chrome\Application\23.0.1271.97\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\owner\AppData\Local\Google\Chrome\Application\23.0.1271.97\pdf.dll
CHR - plugin: Play Pickle Textlinks Plugin (Enabled) = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\bllefkbpbefdodiiefpkcnigpicmhohe\npptl.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.7280_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\owner\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\owner\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Bing Bar (Enabled) = C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll
CHR - plugin: WildTangent Games App Presence Detector (Enabled) = C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Play Pickle = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\bllefkbpbefdodiiefpkcnigpicmhohe\
CHR - Extension: YouTube = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Google Search = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: Skype Extension = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.7280_0\
CHR - Extension: Gmail = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2009/11/26 16:16:34 | 000,358,599 | R— | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 123haustiereundmehr.com
O1 - Hosts: 12307 more lines…
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [IntelliType Pro] c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files (x86)\Acer\Acer Assist\launcher.exe ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_09)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_09)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1EAA46E7-6F20-4029-83EE-924C629995B5}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{25B43BE2-156C-41BE-82C5-21FD7D02B0DA}: DhcpNameServer = 192.168.2.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O27:64bit: - HKLM IFEO\ehshell.exe: Debugger - C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe (LogMeIn, Inc.)
O27 - HKLM IFEO\ehshell.exe: Debugger - C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe (LogMeIn, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/12/18 19:22:40 | 000,000,000 | —D | C] – C:\Windows\ERUNT
[2012/12/18 19:22:22 | 000,000,000 | —D | C] – C:\JRT
[2012/12/18 19:08:42 | 000,000,000 | —D | C] – C:\_OTL
[2012/12/18 19:04:38 | 000,246,760 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2012/12/17 21:59:22 | 000,000,000 | —D | C] – C:\Users\owner\Desktop\Uncle Jim Files
[2012/12/16 15:47:23 | 000,000,000 | —D | C] – C:\Users\owner\AppData\Local\LogMeIn
[2012/12/16 15:47:18 | 000,035,240 | —- | C] (LogMeIn, Inc.) – C:\Windows\SysNative\LMIport.dll
[2012/12/16 15:47:17 | 000,088,008 | —- | C] (LogMeIn, Inc.) – C:\Windows\SysNative\LMIRfsClientNP.dll
[2012/12/16 15:47:17 | 000,072,216 | —- | C] (LogMeIn, Inc.) – C:\Windows\SysNative\drivers\LMIRfsDriver.sys
[2012/12/16 15:47:09 | 000,083,880 | —- | C] (LogMeIn, Inc.) – C:\Windows\SysNative\LMIinit.dll
[2012/12/16 15:47:02 | 000,000,000 | —D | C] – C:\ProgramData\LogMeIn
[2012/12/16 15:46:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\LogMeIn
[2012/12/16 15:15:06 | 000,000,000 | —D | C] – C:\Program Files\HP
[2012/12/16 13:53:53 | 000,000,000 | —D | C] – C:\Windows\Hewlett-Packard
[2012/12/13 15:48:56 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/12/13 15:48:55 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/12/13 15:48:43 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/12/13 15:48:41 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/12/13 15:48:40 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/12/13 15:48:38 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/12/13 15:48:37 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/12/13 15:48:37 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/12/13 15:48:31 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/12/13 15:48:29 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/12/13 15:48:28 | 002,312,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/12/13 15:48:27 | 000,729,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012/12/13 15:48:17 | 000,717,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/12/13 15:48:16 | 000,816,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/12/13 15:48:16 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2012/12/12 19:16:56 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2012/12/12 17:34:28 | 000,424,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KernelBase.dll
[2012/12/12 17:34:27 | 001,161,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[2012/12/12 17:34:27 | 000,338,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\conhost.exe
[2012/12/12 17:34:27 | 000,215,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2012/12/12 17:34:25 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64win.dll
[2012/12/12 17:34:25 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64.dll
[2012/12/12 17:34:25 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2012/12/12 17:34:24 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntvdm64.dll
[2012/12/12 17:34:24 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2012/12/12 17:34:24 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64cpu.dll
[2012/12/12 17:34:24 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2012/12/12 17:34:22 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2012/12/12 17:34:22 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/12/12 17:34:20 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012/12/12 17:34:20 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012/12/12 17:34:20 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012/12/12 17:34:20 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012/12/12 17:34:20 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012/12/12 17:34:20 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012/12/12 17:34:19 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012/12/12 17:34:19 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012/12/12 17:34:19 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/12/12 17:34:19 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012/12/12 17:34:19 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012/12/12 17:34:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012/12/12 17:34:18 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012/12/12 17:34:18 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012/12/12 17:34:18 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012/12/12 17:34:17 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012/12/12 17:34:17 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012/12/12 17:34:17 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012/12/12 17:34:17 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012/12/12 17:34:16 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012/12/12 17:34:16 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012/12/12 17:34:16 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012/12/12 17:34:16 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012/12/12 17:34:15 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2012/12/12 17:33:51 | 000,478,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dpnet.dll
[2012/12/12 17:33:50 | 000,376,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dpnet.dll
[2012/12/09 13:36:38 | 000,000,000 | —D | C] – C:\Users\owner\Documents\christmas card
[2012/11/25 17:33:33 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Mouse and Keyboard Center
[2012/11/25 17:32:47 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TsUsbRedirectionGroupPolicyExtension.dll
[2012/11/25 17:32:47 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TsUsbRedirectionGroupPolicyControl.exe
[2012/11/25 17:32:46 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RdpGroupPolicyExtension.dll
[2012/11/25 17:32:41 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\TsUsbFlt.sys
[2012/11/25 17:32:41 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\rdpvideominiport.sys
[2012/11/25 17:32:33 | 000,269,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\aaclient.dll
[2012/11/25 17:32:33 | 000,192,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\rdpendp_winip.dll
[2012/11/25 17:32:33 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MsRdpWebAccess.dll
[2012/11/25 17:32:33 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tsgqec.dll
[2012/11/25 17:32:33 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TsUsbGDCoInstaller.dll
[2012/11/25 17:32:33 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tsgqec.dll
[2012/11/25 17:32:33 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wksprtPS.dll
[2012/11/25 17:32:33 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wksprtPS.dll
[2012/11/25 17:32:32 | 000,322,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\aaclient.dll
[2012/11/25 17:32:32 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MsRdpWebAccess.dll
[2012/11/25 17:32:31 | 001,048,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstsc.exe
[2012/11/25 17:32:31 | 000,384,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wksprt.exe
[2012/11/25 17:32:31 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpudd.dll
[2012/11/25 17:32:31 | 000,228,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpendp_winip.dll
[2012/11/25 17:32:31 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TSWbPrxy.exe
[2012/11/25 17:32:30 | 003,174,912 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpcorets.dll
[2012/11/25 17:32:30 | 001,123,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstsc.exe
[2012/11/25 17:32:29 | 004,916,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstscax.dll
[2012/11/25 17:32:28 | 005,773,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstscax.dll
[2012/11/25 17:31:46 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Mouse and Keyboard Center
[2012/11/25 17:28:36 | 000,514,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\qdvd.dll
[2012/11/25 17:28:36 | 000,366,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\qdvd.dll
[2012/11/25 17:28:33 | 001,448,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lsasrv.dll
[2012/11/25 17:28:33 | 000,307,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncrypt.dll
[2012/11/25 16:55:49 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons
[2012/11/25 16:53:31 | 000,000,000 | —D | C] – C:\ProgramData\HP Product Assistant
[2012/11/25 16:51:12 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\HP
[2012/11/25 14:48:13 | 000,000,000 | —D | C] – C:\Users\owner\Desktop\RegistryBackups
[2012/11/25 13:40:00 | 000,000,000 | —D | C] – C:\Users\owner\AppData\Roaming\HPAppData
[2012/11/25 13:39:12 | 000,174,056 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2012/11/25 13:39:12 | 000,174,056 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2012/11/25 13:39:12 | 000,095,208 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll

========== Files - Modified Within 30 Days ==========

[2012/12/20 18:24:00 | 000,000,908 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2600581341-1188975230-2990884034-1000UA.job
[2012/12/20 18:06:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/12/20 17:57:49 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/12/20 17:57:24 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/12/20 17:07:41 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/12/20 15:05:17 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/12/20 15:05:17 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/12/20 14:56:43 | 000,000,292 | —- | M] () – C:\Windows\tasks\iMeshNAG.job
[2012/12/20 14:56:18 | 2211,483,648 | -HS- | M] () – C:\hiberfil.sys
[2012/12/19 20:29:57 | 000,000,856 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2600581341-1188975230-2990884034-1000Core.job
[2012/12/16 15:47:05 | 000,001,024 | —- | M] () – C:\.rnd
[2012/12/16 15:32:11 | 000,173,111 | —- | M] () – C:\Windows\hpoins46.dat
[2012/12/16 15:32:11 | 000,002,331 | —- | M] () – C:\Users\Public\Desktop\Add a Device - Photosmart D110 series.lnk
[2012/12/16 13:43:58 | 000,344,296 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/12/15 10:10:47 | 000,002,491 | —- | M] () – C:\Users\owner\Desktop\Google Chrome.lnk
[2012/12/12 15:10:18 | 000,697,272 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/12/12 15:10:18 | 000,073,656 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/11/29 20:26:47 | 000,726,444 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/11/29 20:26:47 | 000,624,412 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/11/29 20:26:47 | 000,106,756 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/11/25 17:33:32 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_point64_01011.Wdf
[2012/11/25 17:30:02 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01011.Wdf
[2012/11/25 17:28:05 | 000,207,029 | —- | M] () – C:\Windows\hpoins46.dat.temp
[2012/11/25 17:17:21 | 000,058,780 | —- | M] () – C:\Users\owner\Desktop\HP Installation Error - Windows 7.hta
[2012/11/25 16:54:58 | 000,001,165 | —- | M] () – C:\Users\Public\Desktop\Shop for HP Supplies.lnk
[2012/11/25 16:53:19 | 000,001,319 | —- | M] () – C:\Users\Public\Desktop\HP Solution Center.lnk
[2012/11/25 16:52:14 | 000,002,103 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2012/11/25 16:51:54 | 000,001,976 | —- | M] () – C:\Users\Public\Desktop\HP ePrinterCenter.lnk
[2012/11/25 14:14:18 | 000,000,826 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk

========== Files Created - No Company Name ==========

[2012/12/16 15:47:04 | 000,001,024 | —- | C] () – C:\.rnd
[2012/12/16 15:46:50 | 000,000,992 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn.lnk
[2012/12/16 15:32:11 | 000,002,331 | —- | C] () – C:\Users\Public\Desktop\Add a Device - Photosmart D110 series.lnk
[2012/12/16 15:14:35 | 000,207,029 | —- | C] () – C:\Windows\hpoins46.dat.temp
[2012/11/25 17:33:32 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_point64_01011.Wdf
[2012/11/25 17:30:02 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01011.Wdf
[2012/11/25 17:17:18 | 000,058,780 | —- | C] () – C:\Users\owner\Desktop\HP Installation Error - Windows 7.hta
[2012/11/25 16:58:20 | 000,000,574 | —- | C] () – C:\Windows\hpomdl46.dat.temp
[2012/11/25 16:54:58 | 000,001,165 | —- | C] () – C:\Users\Public\Desktop\Shop for HP Supplies.lnk
[2012/11/25 16:53:19 | 000,001,319 | —- | C] () – C:\Users\Public\Desktop\HP Solution Center.lnk
[2012/11/25 16:52:14 | 000,002,103 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2012/11/25 16:51:54 | 000,001,976 | —- | C] () – C:\Users\Public\Desktop\HP ePrinterCenter.lnk
[2012/11/25 16:46:05 | 000,173,111 | —- | C] () – C:\Windows\hpoins46.dat
[2012/03/04 15:02:22 | 000,743,534 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2012/01/03 18:13:22 | 000,057,344 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll
[2011/05/19 19:04:53 | 000,001,940 | —- | C] () – C:\Users\owner\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2011/05/03 17:31:58 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2011/03/17 21:31:13 | 000,000,175 | —- | C] () – C:\Windows\wininit.ini
[2011/02/07 19:09:43 | 000,000,035 | —- | C] () – C:\Windows\popcinfo.dat
[2009/11/26 12:11:09 | 000,000,000 | —- | C] () – C:\Users\owner\AppData\Roaming\wklnhst.dat

========== ZeroAccess Check ==========

[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 00:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 23:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 20:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 07:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 20:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >

JonTom

Post #12December 21, 2012, 12:22 AM UTC

Hello YatesBros

Glad you were able to change your homepage. Your latest OTL reflects that the changes you made were sucessful.

To address your questions:

Running Microsoft Security Essentials actively on this laptop. Would you recommend another instead?

There is nothing wrong with MSE. Provided you excercise common sense and are careful about what you do when on the net it ought to keep you well protected.

When you had me run Malwarebytes, you had me run Quick scan. Is that enough to do regularly? Or, should I run the full scan?

There are some differences between quick and full scan modes, but not too many. The quick scan scans all of the critical system areas and is ideal for regular (weekly) use. You can of course run a full scan every month or so if you desire.

I use CCleaner regularly, do you recommend I continue?

I recommend that you use TFC or ATF cleaner for removing your temporary files (we will use TFC shortly). You can use CCleaner to remove temporary files, but CCleaner also comes with a registry cleaner facility. We do not recommend the use of registry cleaners as they can sometimes cause more harm than good. Sticking with a dedicated temp file cleaner that does not touch the registry is the safest option to use in my opinion.

Is Outpost a good firewall to run?

To be honest, I have never tried it so I am unable to comment with regards to its effectiveness.

If you have any specific questions about OutPost, I'm sure the staff at the OutPost forum will be happy to address them: http://www.outpostfirewall.com/forum/forum.php

Would you make any other recommendations to keeping the laptop clean?

I will in due course, but lets continue with the following and takes things from there:

Temporary File Cleaner
- Download TFC to your desktop.
- Close any open windows.
- Right click the TFC icon and select "Run as Administrator" to run the program.
- TFC will close all open programs itself in order to run.
- Click the Start button to begin the process.
- Allow TFC to run uninterrupted.
- The program should not take long to finish.
- Once complete it should automatically reboot your machine.
- If your machine does not reboot automatically, manually reboot to ensure a complete clean.
- Note: After running TFC your machine may take slightly longer to boot the first time. This is normal.
Please run the following scan
- Note: You will need to use Internet Explorer for this scan.
- Note for Vista/Windows 7 Users: ESET is compatible but Internet Explorer must be run as Administrator. To do this, right-click on your Internet Explorer icon and select "Run as Administrator".
- Please disable your real time security programs before performing the scan.
- Scan your system with Eset Online Scanner
- Place a check mark in the box YES, I accept the Terms Of Use.
- Click the [external image: Posted Image] button.
- For alternate browsers only: (Microsoft Internet Explorer users can skip these steps).
- Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
- Double click on the [external image: Posted Image] icon on your desktop.
- Check [external image: Posted Image]
- Click the [external image: Posted Image] button.
- Accept any security warnings from your browser.
- Check [external image: Posted Image]
- Make sure that the option to "Remove Found Threats" is UN checked.
- Push the "Start" button.
- ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
- When the scan completes, push [external image: Posted Image]
- Push [external image: Posted Image], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
- Push the [external image: Posted Image] button.
- Push [external image: Posted Image]
Post the ESET log in your next reply.

YatesBros

Post #13December 22, 2012, 3:02 AM UTC

Hi JonTom, I was able to run TFC and it restarted my laptop as you said it would. I am having trouble with Eset. I used explorer like you suggested. I get to the point where I checked Scan Archives and I un-checked Remove Found threats. The problem is I can't see the start button. It looks like part of the screen is cutoff. Also, it says that I am running AVG Business. The only Virus scan I am running is Microsoft Security Essentials. Any suggestions?

JonTom

Post #14December 22, 2012, 11:30 AM UTC

Hello YatesBros

The only Virus scan I am running is Microsoft Security Essentials. Any suggestions?

As I mentioned there is nothing wrong with MSE. You should only ever run ONE real time AV on your machine as multiple applications will clash and leave your machine open to infection.

It looks like part of the screen is cutoff

Thats odd. Do you use a script blocker at all? If so please make sure it is disabled.

As for AVG, it may be possible that there are leftovers from a previous installation.

Run the following tool and if you are still having no luck with ESET, try BitDefender instead:

Please download and run the AVG Removal Tool
- The AVG removal tool will locate and remove all traces of AVG products from your computer.
- To download the tool, click here and save the file to your desktop.
- Double click on the avgremover.exe icon to run the program.
- Follow any prompts you receive.
- Once you have run the removal tool you may delete it from your machine.
BitDefender
- Lets perform an online scan with BitDefender QuickScan.
- Please be patient as scanning can take some time.
- We recommend that you disable any real time protection that you have before starting the scan.
- Click here here to access the BitDefender QuickScan page
- For Firefox users:
- Click on the Free Scan Now button.
- You will be prompted to install a plug-in. Please Allow the installation.
- If the process stalls you may need to refresh the page.
- A Software Installation window will appear.
- Click on Install Now and the plugin will be installed as an Add-on.
- Restart Firefox when done. Go back to the BitDefender QuickScan page again and click on Free Scan Now and proceed accordingly.
- For Internet Explorer users:
- Click on the Free Scan Now button.
- You will be prompted to install an ActiveX control. Please allow the control to install.
- The page will refresh. Click on the Free Scan Now button again and proceed accordingly.
- When scan has completed, click on View report and a Notepad log will open.
- If ant malware has been detected, you will receive a warning and the link to the report will be displayed as the number of infections. Click on it.
- Post the contents of this report in your next reply.
- The reports can also be found by navigating to C:\Documents and Settings\\Application Data\QuickScan, (where "" is the Windows log-in name).
Let me know how you get on with the scans in your next reply.

YatesBros

Post #15December 23, 2012, 6:43 PM UTC

I was not able to grab the ESET report, but it did say no threats found. I can re-run if needed. Here is the Bit Defender log. QuickScan 32-bit v0.9.9.119 ————————— Scan date: Sun Dec 23 13:36:04 2012 Machine ID: E47E3894 No infection found. ——————- Processes ——— 2007 Microsoft Office system 3364 C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE Firefox 700 C:\Program Files (x86)\Mozilla Firefox\firefox.exe Firefox 196 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe Flash Player Helper 3712 C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10b.exe GPCore COM object 3180 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe HP Digital Imaging 3980 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe HP Digital Imaging 3832 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe HP Digital Imaging 3108 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe MyWinLocker 816 C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe Windows® Internet Explorer 948 C:\Program Files (x86)\Internet Explorer\iexplore.exe Windows® Internet Explorer 4128 C:\Program Files (x86)\Internet Explorer\iexplore.exe Windows® Internet Explorer 5088 C:\Program Files (x86)\Internet Explorer\iexplore.exe Network activity —————- Process firefox.exe (700) connected on port 80 (HTTP) –> 173.194.43.26 Process firefox.exe (700) connected on port 80 (HTTP) –> [removed] Process firefox.exe (700) connected on port 443 (HTTP over SSL) –> [removed] Process firefox.exe (700) connected on port 443 (HTTP over SSL) –> [removed] Process firefox.exe (700) connected on port 443 (HTTP over SSL) –> [removed] Process firefox.exe (700) connected on port 443 (HTTP over SSL) –> [removed] Process firefox.exe (700) connected on port 443 (HTTP over SSL) –> [removed] Process firefox.exe (700) connected on port 80 (HTTP) –> [removed] Process firefox.exe (700) connected on port 443 (HTTP over SSL) –> [removed] Process firefox.exe (700) connected on port 80 (HTTP) –> [removed] Process firefox.exe (700) connected on port 443 (HTTP over SSL) –> [removed] Process firefox.exe (700) connected on port 80 (HTTP) –> [removed] Process firefox.exe (700) connected on port 80 (HTTP) –> [removed] Process firefox.exe (700) connected on port 80 (HTTP) –> [removed] Process firefox.exe (700) connected on port 80 (HTTP) –> [removed] Process firefox.exe (700) connected on port 80 (HTTP) –> [removed] Process firefox.exe (700) connected on port 80 (HTTP) –> [removed] Process firefox.exe (700) connected on port 80 (HTTP) –> [removed] Process firefox.exe (700) connected on port 80 (HTTP) –> [removed] Process firefox.exe (700) connected on port 80 (HTTP) –> [removed] Process firefox.exe (700) connected on port 80 (HTTP) –> [removed] Process firefox.exe (700) connected on port 80 (HTTP) –> 66.235.142.3 Autoruns and critical files ————————— Apple Push C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe Catalyst® Control Center C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe HP Digital Imaging C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe Launch Manager C:\Program Files (x86)\Launch Manager\LManager.exe launcher.exe C:\Program Files (x86)\Acer\Acer Assist\launcher.exe Microsoft® Windows® Operating System C:\Windows\system32\userinit.exe (verified) Google Update C:\Users\owner\AppData\Local\Google\Update\GoogleUpdate.exe Browser plugins ————— 2007 Microsoft Office system C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL AcroIEHelperShim Library c:\program files (x86)\common files\adobe\acrobat\activex\acroiehelpershim.dll Adobe Acrobat C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll Adobe Acrobat C:\Program Files (x86)\Internet Explorer\plugins\nppdf32.dll Adobe Acrobat C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll Bitdefender QuickScan C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll DTX Toolbar C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\{59c6f12b-f004-43e5-9997-08f2123119b6}\components\dtTransparency.dll DTX Toolbar C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\{59c6f12b-f004-43e5-9997-08f2123119b6}\components\dtTransparency3.5.dll DTX Toolbar C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\{59c6f12b-f004-43e5-9997-08f2123119b6}\components\dtTransparency3.6.dll Google Update C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll Google Update C:\Users\owner\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll HP Smart Web Printing c:\program files (x86)\hp\digital imaging\smart web printing\hpswp_bho.dll HP Smart Web Printing c:\program files (x86)\hp\digital imaging\smart web printing\hpswp_printenhancer.dll Java Deployment Toolkit 7.0.70.11 C:\Windows\SysWOW64\npDeployJava1.dll Java™ Platform SE 7 U9 c:\program files (x86)\java\jre7\bin\jp2ssv.dll Java™ Platform SE 7 U9 C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll Microsoft® CoReXT c:\program files (x86)\common files\microsoft shared\windows live\windowslivelogin.dll Microsoft® CoReXT C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL Microsoft® CoReXT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL Microsoft® Windows® Operating System C:\Windows\system32\mswsock.dll Microsoft® Windows® Operating System C:\Windows\system32\NLAapi.dll npitunes.dll C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll NPSWF32_11_5_502_135.dll C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll QuickTime Plug-in 7.7.2 C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin.dll QuickTime Plug-in 7.7.2 C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin2.dll QuickTime Plug-in 7.7.2 C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin3.dll QuickTime Plug-in 7.7.2 C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin4.dll QuickTime Plug-in 7.7.2 C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin5.dll QuickTime Plug-in 7.7.2 C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin6.dll QuickTime Plug-in 7.7.2 C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin7.dll QuickTime Plug-in 7.7.2 C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll QuickTime Plug-in 7.7.2 C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll QuickTime Plug-in 7.7.2 C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll QuickTime Plug-in 7.7.2 C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll QuickTime Plug-in 7.7.2 C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll QuickTime Plug-in 7.7.2 C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll QuickTime Plug-in 7.7.2 C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll Silverlight Plug-In c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll Skype Toolbars c:\program files (x86)\skype\toolbars\internet explorer\skypeieplugin.dll Skype Toolbars C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.7280_0\npSkypeChromePlugin.dll Windows Live™ Photo Gallery C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll Windows® Internet Explorer c:\windows\syswow64\ieframe.dll (verified) Microsoft® Windows® Operating System C:\Windows\system32\napinsp.dll (verified) Microsoft® Windows® Operating System C:\Windows\system32\pnrpnsp.dll (verified) Microsoft® Windows® Operating System C:\Windows\System32\winrnr.dll Scan —- MD5: e53ee18a21c025deabcfe0f72fc481bb C:\Program Files (x86)\Acer Games\Acer Game Console\GameConsoleService.exe MD5: 19b2731afb82729f8ff10b082cd609b3 C:\Program Files (x86)\Acer\Acer Assist\launcher.exe MD5: 4cd43010502a7e1337d72e2ad296b239 C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll MD5: ef5c94e3efc691d1ee862044505f6345 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe MD5: 0171a39ae9f529e4e49f02bcf8d22ebd c:\program files (x86)\common files\adobe\acrobat\activex\acroiehelpershim.dll MD5: 82cc8f77e9ec61c6b4d48dd4d5ca78e7 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe MD5: a5299d04ed225d64cf07a568a3e1bf8c C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe MD5: 8fecd12803558fa84f63b7ddd16d89f1 C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE11\msxml5.dll MD5: 4c5d603a632023bfdb8edd4436882abf C:\Program Files (x86)\Common Files\Microsoft Shared\office12\1033\MSOINTL.DLL MD5: 7043d485aeae435312659ff1461f1491 C:\Program Files (x86)\Common Files\Microsoft Shared\office12\mso.dll MD5: c7d010bd8bcef2eb3fca8f7cd3c08d9f C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSORES.DLL MD5: 2424231bbd703a677d115c29983b4293 C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL MD5: 8fa9a16022a664f536b616130b2ea866 C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL MD5: 785f487a64950f3cb8e9f16253ba3b7b C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE MD5: 4a1b8af97e3b0aef8be1b8684277200b C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\OGL.DLL MD5: 1a8b4857f2caaed89e16b1ed1f24930d C:\Program Files (x86)\Common Files\Microsoft Shared\office12\riched20.dll MD5: c2b290ce6b81520b96377e890f4c021c C:\Program Files (x86)\Common Files\Microsoft Shared\PROOF\1033\MSGR3EN.DLL MD5: cf39a105cd553eed31e2255aff4c6742 c:\program files (x86)\common files\microsoft shared\windows live\windowslivelogin.dll MD5: 12b79422a23814429cda9e734c58f78f C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL MD5: 0f5faac852db4c340b7a2f187e3358b8 C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe MD5: 27d2e3584786d384ea64f7fff9e77c6f C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\ADMIN_CLASS_LIB.dll MD5: 955cce0330ab406de9b8999c35975187 C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\CryptoAPI.dll MD5: 17fe38ccbaadf58228a0a2f941205d70 C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\GDIExtendCtrl.dll MD5: eaeb34d06ac35097031b0f11595012d7 C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe MD5: e49df2dd8763ad6c53b5e5bd1736115e C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlOP.dll MD5: ce8f2697774d893fd15a01a599d52133 C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlRecordUI.dll MD5: e86b836d969cb42ca30a6dcce37d167e C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlUI.DLL MD5: 87eb83715180eb3ff083b93e2630a53b C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\PSDUtil.dll MD5: 466dca4840f805c541a8652d9d05af68 C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\ShowErrMsg.dll MD5: f22495b45864f8aabb63105e76a075f9 C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\sysenv.dll MD5: 8433a6ee8b0c85cf0f3cbb5f00e2c9ec C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\SYSTrayUI.dll MD5: 58b6aa7f41851d526938f0fafc740966 C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScanner.ocx MD5: 586fdc4e02623ee228ec35b9604ae5f2 C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll MD5: 8ae4c5b18734b51baf0628e58cc60d84 C:\Program Files (x86)\HP\Digital Imaging\bin\hpodio08.dll MD5: 06d0b327661137f9aef8e13cb16417fe C:\Program Files (x86)\HP\Digital Imaging\bin\hpotra08.dll MD5: 46c713094f05da8955c85dcb24790ba8 C:\Program Files (x86)\HP\Digital Imaging\bin\hpotra08.rsc MD5: 5a64999dbcf4e58a64b5a8107d922e1f C:\Program Files (x86)\HP\Digital Imaging\bin\hpotradd.dll MD5: b29a08a0cb56cd5a4b9c53a011819657 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe MD5: 8d8d646fb98aa0cef1057cc81ca18d1a C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcob08.dll MD5: 0f8fa115dcfc76014ea083721bef49b8 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqsem08.rsc MD5: de0a2e33a98f68228359afef58f89bbb C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSplh08.dll MD5: 370ad2815d627588fc06a8fdb8a71b5a C:\Program Files (x86)\HP\Digital Imaging\bin\hpqssm08.dll MD5: c180e890ffe0fded8306427d3c836af2 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe MD5: 23165ff4528e15fe5fa7bfff4f59a882 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqsti08.dll MD5: 95e84f068995977bbbf39ae75bd88346 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqstp08.dll MD5: e93bec0495a7033c9a2cf9d059b75897 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqstp08.rsc MD5: 11aaec8bb512262f07c191accee205d8 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtao08.dll MD5: eaa666e9dd8dcda6e075087091cb85ee C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe MD5: c66376234c25d1fb4f5f376ce2923dbf C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.rsc MD5: c3fa7e499982129bf8223d335b701617 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqwso08.dll MD5: f37882f128efacefe353e0bae2766909 C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL MD5: 62cbf36e3e10baa74224bc7a6dd998b5 C:\Program Files (x86)\Internet Explorer\ieproxy.dll MD5: 1d4127fe151165c5fb9c0eed8701a3d1 C:\Program Files (x86)\Internet Explorer\IEShims.dll MD5: 0d286c0fe561d1a7eb30e83a0ff305b2 C:\Program Files (x86)\Internet Explorer\iexplore.exe MD5: 4cd43010502a7e1337d72e2ad296b239 C:\Program Files (x86)\Internet Explorer\plugins\nppdf32.dll MD5: 2f7480a40151eb2e483cf6524edba3f7 C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin.dll MD5: 2f7480a40151eb2e483cf6524edba3f7 C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin2.dll MD5: 2f7480a40151eb2e483cf6524edba3f7 C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin3.dll MD5: 2f7480a40151eb2e483cf6524edba3f7 C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin4.dll MD5: 2f7480a40151eb2e483cf6524edba3f7 C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin5.dll MD5: 2f7480a40151eb2e483cf6524edba3f7 C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin6.dll MD5: 2f7480a40151eb2e483cf6524edba3f7 C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin7.dll MD5: c1680c34de8a405c8829ab93236576fd C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll MD5: eb47e405a9222ca595e5e763b4156529 c:\program files (x86)\java\jre7\bin\jp2ssv.dll MD5: c04fcb7eebeb5097b30468828f20fb9e C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll MD5: 34bc222864cef86dabb5032da36485da C:\Program Files (x86)\Launch Manager\LManager.exe MD5: 7109163d8027076d2680cfc4e80e2a28 C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe MD5: d3760bc17e1755091b7120cf32dbf56b C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe MD5: 0317335b15ff3bda8e10197e3434cfc0 C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys MD5: 8054ce1fc8b417691960d00f931516a7 C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe MD5: bef1ead605cf791fdbb48add71075509 C:\Program Files (x86)\Microsoft Office\Office12\1033\wwintl.dll MD5: da79517783552b80229705d9720b8e8d C:\Program Files (x86)\Microsoft Office\Office12\msproof6.dll MD5: 2c6e01c2269cd4306ad2bc070a2a68f8 C:\Program Files (x86)\Microsoft Office\Office12\oart.dll MD5: 6c8c001ef62cefa7e333af8d0aaed564 C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE MD5: 18a67cd5082f436d28dd8007cc4a46b6 C:\Program Files (x86)\Microsoft Office\Office12\wwlib.dll MD5: 711a2e6a55ec7bfd59b5f649d58b704b c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll MD5: 520b9ef148145fde39e4fb77e0c7fc48 C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll MD5: 5744fff8e72d105c138dae9e17bb29fe C:\Program Files (x86)\Mozilla Firefox\firefox.exe MD5: d9fa57cba32aba63d5c30b854f660f07 C:\Program Files (x86)\Mozilla Firefox\freebl3.dll MD5: a38b82a306cdda0bb141225f92fc9f85 C:\Program Files (x86)\Mozilla Firefox\gkmedias.dll MD5: 52652560bce03f232ce6af381d82ce5f C:\Program Files (x86)\Mozilla Firefox\mozalloc.dll MD5: c2efe31691b0220ba2d366f6ecd9eebc C:\Program Files (x86)\Mozilla Firefox\mozglue.dll MD5: 2d64a5315260aad1d6beee65d2681db3 C:\Program Files (x86)\Mozilla Firefox\mozjs.dll MD5: 3d2706e87d3e4433db929b86207ca928 C:\Program Files (x86)\Mozilla Firefox\mozsqlite3.dll MD5: 03e9314004f504a14a61c3d364b62f66 C:\Program Files (x86)\Mozilla Firefox\MSVCP100.dll MD5: 67ec459e42d3081dd8fd34356f7cafc1 C:\Program Files (x86)\Mozilla Firefox\MSVCR100.dll MD5: 4d8cae21d3617dbc539f0a7aceb66fad C:\Program Files (x86)\Mozilla Firefox\nspr4.dll MD5: 0206166f245be09dc9c1550afb2c0b8d C:\Program Files (x86)\Mozilla Firefox\nss3.dll MD5: 2944201bcd2bcc92897551a95757ddbe C:\Program Files (x86)\Mozilla Firefox\nssckbi.dll MD5: cf7c83513ad0f22070b6795590f6ba68 C:\Program Files (x86)\Mozilla Firefox\nssdbm3.dll MD5: 15a9691c1f00631bc5475ceef9a6ea62 C:\Program Files (x86)\Mozilla Firefox\nssutil3.dll MD5: 6f255f96534fcf5ff4b611b52c1ab813 C:\Program Files (x86)\Mozilla Firefox\plc4.dll MD5: 6b85d6adef244f9077bd7874610574a9 C:\Program Files (x86)\Mozilla Firefox\plds4.dll MD5: c142445b59c1daba31f6397a34c42c74 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe MD5: 9a6101f29e2e9d41b99cbcc8f106e8fe C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL MD5: 4cd43010502a7e1337d72e2ad296b239 C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll MD5: 2f7480a40151eb2e483cf6524edba3f7 C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll MD5: 2f7480a40151eb2e483cf6524edba3f7 C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll MD5: 2f7480a40151eb2e483cf6524edba3f7 C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll MD5: 2f7480a40151eb2e483cf6524edba3f7 C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll MD5: 2f7480a40151eb2e483cf6524edba3f7 C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll MD5: 2f7480a40151eb2e483cf6524edba3f7 C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll MD5: 2f7480a40151eb2e483cf6524edba3f7 C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll MD5: 9f135327116e63d522bfef39f37cb2e6 C:\Program Files (x86)\Mozilla Firefox\smime3.dll MD5: 9662e514a77389eb6f7e846db8b44c4d C:\Program Files (x86)\Mozilla Firefox\softokn3.dll MD5: f5720ed4eea3d62a3c9af0950f2b7d23 C:\Program Files (x86)\Mozilla Firefox\ssl3.dll MD5: 4d774b94671141d491cfcb4ca3650ebf C:\Program Files (x86)\Mozilla Firefox\xpcom.dll MD5: 4c44a99bb7584d6b70507987be786259 C:\Program Files (x86)\Mozilla Firefox\xul.dll MD5: 8c7336950f1e69cdfd811cbbd9cf00a2 C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe MD5: fd324cce1d4d5bb5af65f8e55b462c7e C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe MD5: 3f6268a2ec33cd38cf75c880af8ded42 C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe MD5: 0ae3ee2a15685bcde716e1ef410d4436 c:\program files (x86)\skype\toolbars\internet explorer\skypeieplugin.dll MD5: f07af60b152221472fbdb2fecec4896d C:\Program Files (x86)\Skype\Updater\Updater.exe MD5: 0a1ff0b674e2f268799442a434a63bb3 C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll MD5: 7c35c6865957289d9efe6cc73f4ab2e1 C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe MD5: afb5b500ad69e24ed1bc15d1161641ef C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL MD5: 2bacd71123f42cea603f4e205e1ae337 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE MD5: 6e50cfa46527b39015b750aad161c5cc C:\Program Files\iPod\bin\iPodService.exe MD5: cc8e4f72f21340a4d3a3d4db50313ef5 c:\Program Files\Microsoft Security Client\MsMpEng.exe MD5: 79e80b10fe8f6662e0c9162a68c43444 c:\Program Files\Microsoft Security Client\NisSrv.exe MD5: a9f3bfc9345f49614d5859ec95b9e994 C:\Program Files\Windows Media Player\wmpnetwk.exe MD5: ec5f1b4482b01afb20c111973f9a920d C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.7280_0\npSkypeChromePlugin.dll MD5: 586fdc4e02623ee228ec35b9604ae5f2 C:\Users\owner\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll MD5: 9232d0e2a87b415869b128b2e7dc7953 C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\{59c6f12b-f004-43e5-9997-08f2123119b6}\components\dtTransparency.dll MD5: 761c53e00e6c1b64ec628be0f63fc86d C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\{59c6f12b-f004-43e5-9997-08f2123119b6}\components\dtTransparency3.5.dll MD5: e9fcb8fcf9fe1c27f7eece9afe944fb8 C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\{59c6f12b-f004-43e5-9997-08f2123119b6}\components\dtTransparency3.6.dll MD5: c9e3864fb9cbfa93d9010bcfe18a5697 C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll MD5: c4002b6b41975f057d98c439030cea07 C:\Windows\ehome\ehRecvr.exe MD5: 332feab1435662fc6c672e25beb37be3 C:\Windows\Explorer.exe MD5: 5988fc40f8db5b0739cd1e3a5d0d78bd C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe MD5: a8b7f3818ab65695e3a0bb3279f6dce6 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe MD5: f5df6846f30e9f54ea60ccaeb3fb2055 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll MD5: 773212b2aaa24c1e31f10246b15b276c C:\Windows\servicing\TrustedInstaller.exe MD5: 3c3685c29eef909266f124a184f849e6 C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll MD5: 139590e1c420a439f23f261979a59bc4 C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll MD5: a2c23b02dc32aa8d3801b84fb54137a6 C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll MD5: 1697959965bc58308d046048a69e6c1e C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll MD5: 50a078c76d94014b61238f1118b6e02c C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll MD5: caf11064a276247fe9f30ab06c4f2f2c C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll MD5: d433e08b64837534afb786e454bab61e C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll MD5: 72d37545bc03b38537c3acc7fa8fca3a C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll MD5: 7978b487e3fbbc666a494ebecbfb26a9 C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll MD5: d7573a8d927b68f962bd0b5da6603eef C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll MD5: 1818ccee5cfc3fcc876f42643109f2c0 C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll MD5: b4fcce5ba0990ae78809379cb0c3873c C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll MD5: cbe6c675d3b10e48ef7b25a5ff07b46d C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll MD5: 4a01572d2030d49ceb0a319de0bff53c C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll MD5: c1fa7d1a6548037873c90d4eee34df2b C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll MD5: ec0a0e7b3537bb2912221d4933216727 C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll MD5: 73af314c216f08a1c97bc03ecad3a423 C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll MD5: 3b319cc2334ac0d15be25a5994065f13 C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll MD5: 0e3ceb4fce14af72fbaaae754a7c136a C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll MD5: 6b28d57a511929227ff1c8f412c1a3f9 C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll MD5: 2a1a2c962bb789ef8ee8cf8cb8f100c0 C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll MD5: bc24199038f4be63a1825cf168408120 C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll MD5: 63416d211d4b15fd841a21e508081f4c C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll MD5: 6f08cabf92af8fab3509dd9f313b83f9 C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll MD5: 1a208f0ceb6de90a7ee3d4469b3a88ba C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll MD5: 97188f405255248ac8316001411d9cc5 C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll MD5: 2b9b097c293696dbc473cef9f623c980 C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll MD5: 2330b3912a579f8a3feea001b79f6a11 C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll MD5: 863f793d15b4026b1a5fdeca873d4d84 C:\Windows\system32\apphelp.dll MD5: fe0f0c1069232105645910bca2b85822 C:\Windows\system32\atidxx32.dll MD5: c940f2f5c60b3727c5f18840735b229c C:\Windows\system32\AUDIOSES.DLL MD5: ad7b9c14083b52bc532fba5948342b98 C:\Windows\system32\cmd.exe MD5: 4e5fe39c1076d115ec8bfcfe14d75b80 C:\Windows\system32\credssp.dll MD5: ca79539d3d4c0ba66f0f051a5ee5e923 C:\Windows\system32\cryptnet.dll MD5: 96c0e38905cfd788313be8e11dae3f2f C:\Windows\system32\cryptsvc.dll MD5: 465bea35f7ed4a4a57686dea7ea10f47 C:\Windows\system32\cscapi.dll MD5: 35cede6439ff0d8903223a0817ffe46c C:\Windows\system32\d2d1.dll MD5: 2de90400a63818fa38c4c5c9adb166bf C:\Windows\system32\d3d10_1.dll MD5: 9c36a3ca80f9b204c670336d344f5df8 C:\Windows\system32\d3d10_1core.dll MD5: 284b59d7b56fc76c80e622ab856b1fab C:\Windows\system32\DavClnt.DLL MD5: 53223b673a3fa2f9a4d1c31c8d3f6cd8 C:\Windows\system32\dbghelp.dll MD5: e9e01eb683c132f7fa27cd607b8a2b63 C:\Windows\system32\dhcpcore.dll MD5: 81f6c1ae23b1c493d9e996c3103915d7 C:\Windows\system32\dhcpcsvc6.DLL MD5: b40420876b9288e0a1c8cca8a84e5dc9 C:\Windows\system32\DNSAPI.dll MD5: a29d734f650f958424743be3baa052c8 C:\Windows\system32\dwrite.dll MD5: 0411b7958c524bb2e91ee1b3035fe321 C:\Windows\system32\dxgi.dll MD5: 8b88ebbb05a0e56b7dcc708498c02b3e C:\Windows\system32\explorer.exe MD5: e2a17bcc08d92f42e08af6ba2f93aba7 C:\Windows\system32\explorerframe.dll MD5: 03a03a453f1aaae0c73aaaf895321c7a C:\Windows\System32\fwpuclnt.dll MD5: 1cd5c2dfd2a5bf6da720386679f3c449 C:\Windows\system32\hpzipr12.dll MD5: 5466dcaef5a648e04d1b6580f2c901b5 C:\Windows\system32\IEFRAME.dll MD5: f9d038a8c2bdc3ae2548150a7aed0f8a C:\Windows\system32\IEUI.dll MD5: 68563ac389f92ee79f1c714288ba1dce C:\Windows\system32\ImgUtil.dll MD5: a6f09e5669d9a19035f6d942caa15882 C:\Windows\system32\IMM32.DLL MD5: a90dc9abd65db1a8902f361103029952 C:\Windows\system32\IPHLPAPI.DLL MD5: 243974ec02f7ae49e4179c54624143ab C:\Windows\System32\MMDevApi.dll MD5: 7f8678c59f188528d60104e697c2361e C:\Windows\system32\mscms.dll MD5: d83947a58613e9091b4c9cc0f1546a8d C:\Windows\system32\mscoree.dll MD5: 07f649cd36f266bbe33b814fa678aa43 C:\Windows\system32\MSHTML.dll MD5: a6c29db53eca94fa8591c5388d604b82 C:\Windows\system32\msi.dll MD5: eee470f2a771fc0b543bdeef74fceca0 C:\Windows\system32\msiexec.exe MD5: 35aae2e841aa1a949775168e119482c9 C:\Windows\system32\msls31.dll MD5: 8999b8631c7fd9f7f9ec3cafd953ba24 C:\Windows\system32\mswsock.dll MD5: 1cdea9188899e76d4ffd54c9d512ccdb C:\Windows\System32\msxml3.dll MD5: d9a9702e43a5859896f34898d5fd3fec C:\Windows\System32\msxml6.dll MD5: 8b57a1ad493653bb57f281fe75dd175b C:\Windows\System32\NaturalLanguage6.dll MD5: 859cfce4a0f72916911bd9f6c6e84581 C:\Windows\system32\ncrypt.dll MD5: 2fca0d2c59a855c54bafa22aa329df0f C:\Windows\system32\NETAPI32.dll MD5: 20b3934db73eaba2b49b7177873cb81f C:\Windows\system32\netutils.dll MD5: 0ba65122ffa7e37564ee86422dbf7ae8 C:\Windows\system32\NLAapi.dll MD5: 03f3b770dfbed6131653ceda8ca780f0 C:\Windows\system32\ntshrui.dll MD5: 8e01332cc4b68bc6b5b7effe374442aa C:\Windows\system32\OLEACC.dll MD5: 414bba67a3ded1d28437eb66aeb8a720 C:\Windows\system32\pla.dll MD5: 12c45e3cb6d65f73209549e2d02eca7a C:\Windows\System32\PROPSYS.dll MD5: dbc02d918fff1cad628acbe0c0eaa8e8 C:\Windows\system32\provsvc.dll MD5: 5997d769cdb108390dcfaebf442bf816 C:\Windows\system32\RpcRtRemote.dll MD5: 0915c4db6dbc3bb9e11b7ecbbe4b7159 C:\Windows\system32\rtutils.dll MD5: 68ecca523ed760aafc03c5d587569859 C:\Windows\system32\SAMCLI.DLL MD5: 236f286e103fd44bd85fdd93097fd5dd C:\Windows\system32\SearchIndexer.exe MD5: a113afeed3159a1ed52d78cb0226006d C:\Windows\system32\Secur32.dll MD5: 4ae380f39a0032eab7dd953030b26d28 C:\Windows\system32\sessenv.dll MD5: be247ae996a9fde007a27b51413a6c79 C:\Windows\system32\shdocvw.dll MD5: 414da952a35bf5d50192e28263b40577 C:\Windows\System32\shsvcs.dll MD5: 5ccdcd40e732d54e0f7451ac66ac1c87 C:\Windows\system32\srvcli.dll MD5: 6a1e8deb746912df47cf651e138401d7 C:\Windows\System32\StructuredQuery.dll MD5: 919001d2bb17df06ca3f8ac16ad039f6 C:\Windows\system32\SXS.DLL MD5: 6b140b1382f1fe04ba57b196aeb19725 C:\Windows\system32\t2embed.dll MD5: 613bf4820361543956909043a265c6ac C:\Windows\System32\tapisrv.dll MD5: d15618a0ff8dbc2c5bf3726bacc75a0b C:\Windows\system32\USERENV.dll MD5: 61ac3efdfacfdd3f0f11dd4fd4044223 C:\Windows\system32\userinit.exe MD5: cfc7d8289d2b5f3cf8d16e2db7f93d4a C:\Windows\system32\wbem\fastprox.dll MD5: 704314fd398c81d5f342caa5df7b7f21 C:\Windows\system32\wbemcomn.dll MD5: 34eee0dfaadb4f691d6d5308a51315dc C:\Windows\System32\wcncsvc.dll MD5: d205c24a9d069049fe2df2a1b38726a7 C:\Windows\system32\wdmaud.drv MD5: a9d880f97530d5b8fee278923349929d C:\Windows\System32\webclnt.dll MD5: fb19fc5951a88f3c523e35c2c98d23c0 C:\Windows\system32\webio.dll MD5: 1db71a41daee6b3f8cd0dda8209fa2d5 C:\Windows\system32\windowscodecs.dll MD5: ca9f7888b524d8100b977c81f44c3234 C:\Windows\system32\WINHTTP.dll MD5: d5aefad57c08349a4393d987df7c715d C:\Windows\system32\WINMM.dll MD5: 9e4b0e7472b4ceba9e17f440b8cb0ab8 C:\Windows\system32\WINSPOOL.DRV MD5: 418e881201583a3039d81f43e39e6c78 C:\Windows\system32\WINSTA.dll MD5: e5a4a1326a02f8e7b59e6c3270ce7202 C:\Windows\system32\wkscli.dll MD5: 1b91cd34ea3a90ab6a4ef0550174f4cc C:\Windows\system32\WsmSvc.dll MD5: 6a6b2ee4565a178035be2a4ff6f2c968 C:\Windows\system32\WTSAPI32.dll MD5: edf2a5e96bec469da3f64e9bdd386111 C:\Windows\system32\xmllite.dll MD5: 95e2376b3323f062eb562b8586d0f14a C:\Windows\syswow64\ADVAPI32.dll MD5: f436e847fa799ecd75ad8c313673f450 C:\Windows\syswow64\CFGMGR32.dll MD5: d1de1eafde97be41cf6585027ff3e732 C:\Windows\syswow64\comdlg32.dll MD5: 60d21799a4af4edce65fb98830e4b0c8 C:\Windows\syswow64\CRYPT32.dll MD5: 2eeff4502f5e13b1bed4a04ccad64c08 C:\Windows\syswow64\DEVOBJ.dll MD5: 4312debdacbe338f0b90e7f08e7672be C:\Windows\SysWOW64\Dxtmsft.dll MD5: ca493a92da9880b6f1a89c3dbd54ba5b C:\Windows\SysWOW64\Dxtrans.dll MD5: d6d3ad7bf1d6f6ce9547613ed5e170a2 C:\Windows\syswow64\GDI32.dll MD5: 5466dcaef5a648e04d1b6580f2c901b5 c:\windows\syswow64\ieframe.dll MD5: 780e80e5502015edaec91dc0a0c96a79 C:\Windows\syswow64\iertutil.dll MD5: a6f09e5669d9a19035f6d942caa15882 C:\Windows\syswow64\IMM32.dll MD5: a3fa99a16f10d44edb7a8c340fa2ee1b C:\Windows\SysWOW64\jscript9.dll MD5: d4f3176082566cefa633b4945802d4c4 C:\Windows\syswow64\kernel32.dll MD5: 0978c2b33bdd0a7e6c563aa337dc8ba0 C:\Windows\syswow64\KERNELBASE.dll MD5: 95ce557d16a75606ccc2d7f3b0b0bccb C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe MD5: 5f7fc2c4d371ac8fde09d57f7c904ba9 C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10b.exe MD5: 54fc590185d7d00d65e53b9a5990dc14 C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll MD5: 938f39b50bafe13d6f58c7790682c010 C:\Windows\syswow64\MSASN1.dll MD5: 9dc80a8aaaaac397bdab3c67165a824e C:\Windows\syswow64\msvcrt.dll MD5: ab87c54ca19675880b0cae65b8af140c C:\Windows\SysWOW64\npDeployJava1.dll MD5: e73b0f1819602cb6ef176fb78d76a47b C:\Windows\SysWOW64\ntdll.dll MD5: 928cf7268086631f54c3d8e17238c6dd C:\Windows\syswow64\ole32.dll MD5: 6c765e82b57f2e66ce9c54ac238471d9 C:\Windows\syswow64\OLEAUT32.dll MD5: c5ad8083cf94201f1f8084ecc696a8b7 C:\Windows\syswow64\RPCRT4.dll MD5: af78f66116814fdd6677cebd73035cdd C:\Windows\SysWOW64\schannel.dll MD5: 10fb16b50affda6d44588f3c445dc273 C:\Windows\syswow64\SETUPAPI.dll MD5: 29e9794708df51db5dc89fb2e903a0f6 C:\Windows\syswow64\SHELL32.dll MD5: 8cc3c111d653e96f3ea1590891491d71 C:\Windows\syswow64\SHLWAPI.dll MD5: bfb26890612fb8ae8b0463ebebe84b7e C:\Windows\syswow64\SspiCli.dll MD5: 4266a3230981dd4434c55957f6dd497d C:\Windows\syswow64\urlmon.dll MD5: 5e0db2d8b2750543cd2ebb9ea8e6cdd3 C:\Windows\syswow64\USER32.dll MD5: 804aaafebb3ad5f49334dd906bcb1de5 C:\Windows\syswow64\USP10.dll MD5: 7fa3a810f383588d46220967de8b64ff C:\Windows\syswow64\WININET.dll MD5: 17448af0bba9e7ab5ec955af93f271bd C:\Windows\syswow64\WINTRUST.dll MD5: a8bb45f9ecad993461e0fef8e2a99152 C:\Windows\syswow64\WLDAP32.dll MD5: 7ff15a4f092cd4a96055ba69f903e3e9 C:\Windows\syswow64\WS2_32.dll MD5: 0b3595a4ff0b36d68e5fc67fd7d70fdc C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9 a\MSVCP80.dll MD5: c9564cf4976e7e96b4052737aa2492b4 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9 a\MSVCR80.dll MD5: 686b224b4987c22b153fbb545fee9657 C:\Windows\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.4053_none_cbf21254470d875 2\MFC80U.DLL MD5: 58a14c45a5cd2528f10a889e7b0c3fc2 C:\Windows\WinSxS\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_51cd0a7abbe4e19 b\ATL90.DLL MD5: 4c39358ebdd2ffcd9132a30e1ec31e16 C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb5 7\MSVCP90.dll MD5: cdbe9690cf2b8409facad94fac9479c9 C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb5 7\MSVCR90.dll MD5: ca6ade4f7761bb15b3325356dc3b82bb C:\Windows\WinSxS\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_4bf7e3e2bf9ada4 c\mfc90u.dll MD5: fbfca1a574d47ee575448b719cbbf2e4 C:\Windows\WinSxS\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_49768ef57548 175e\MFC90ENU.DLL MD5: bdac1aa64495d0f7e1ff810ebbf1f018 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.dll MD5: 352b3dc62a0d259a82a052238425c872 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll MD5: 7717f84f483002815490033bf069dabd C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d27359 8668a06b\gdiplus.dll The following file(s) must be uploaded for server-side scanning: C:\Program Files (x86)\HP\Digital Imaging\bin\hpqsem08.rsc C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\{59c6f12b-f004-43e5-9997-08f2123119b6}\components\dtTransparency3.6.dll C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\{59c6f12b-f004-43e5-9997-08f2123119b6}\components\dtTransparency.dll C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin3.dll C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin2.dll C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin.dll C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.rsc C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin7.dll C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin5.dll C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll C:\Windows\system32\hpzipr12.dll C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin4.dll C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\2xmxyhoy.default\extensions\{59c6f12b-f004-43e5-9997-08f2123119b6}\components\dtTransparency3.5.dll C:\Program Files (x86)\Internet Explorer\plugins\npqtplugin6.dll C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll C:\Program Files (x86)\HP\Digital Imaging\bin\hpqstp08.rsc Upload started - 23 file(s) CLIStart.exe (98304) hpqstp08.rsc (12288) hpzipr12.dll (34816) hpqtra08.rsc (48128) dtTransparency3.6.dll (73216) dtTransparency.dll (73216) dtTransparency3.5.dll (73216) npqtplugin2.dll (159744) hpqsem08.rsc (927232) HPSLPSVC64.DLL (1039360) Upload speed - 106 KB/s Upload finished - 23 uploaded, 0 failed The uploaded file(s) were found clean. Scan finished - communication took 24 sec Total traffic - 2.51 MB sent, 16.13 KB recvd Scanned 404 files and modules - 124 seconds ==============================================================================

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Laptop Running Very Slow [Solved]

✨ Ask AI

Ask AI