Spyware / Malware / Virus Removal

Win32/Small.CA [Solved]

23 min read

Looking for the outcome? Ask AI

bustamaj

Post #31January 22, 2013, 12:09 AM UTC

Here is the new OTL Log:

OTL logfile created on: 1/21/2013 3:49:34 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Jeanette\Desktop\WhatTheTech Virus Removal
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.80 Gb Total Physical Memory | 2.13 Gb Available Physical Memory | 55.90% Memory free
7.60 Gb Paging File | 5.58 Gb Available in Paging File | 73.34% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 281.48 Gb Total Space | 173.65 Gb Free Space | 61.69% Space Free | Partition Type: NTFS
Drive D: | 16.32 Gb Total Space | 2.36 Gb Free Space | 14.44% Space Free | Partition Type: NTFS
Drive G: | 99.34 Mb Total Space | 93.54 Mb Free Space | 94.16% Space Free | Partition Type: FAT32

Computer Name: JEANETTE-HP | User Name: Jeanette | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/01/09 18:57:11 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Jeanette\Desktop\WhatTheTech Virus Removal\OTL.exe
PRC - [2013/01/07 16:06:24 | 001,248,360 | —- | M] (Google Inc.) – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2012/12/14 16:49:28 | 000,682,344 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/12/14 16:49:28 | 000,512,360 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/12/14 16:49:28 | 000,398,184 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/12/13 14:26:20 | 003,290,896 | —- | M] (Skype Technologies S.A.) – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/11/12 05:34:40 | 002,869,824 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
PRC - [2012/11/12 05:34:10 | 000,216,640 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
PRC - [2012/07/26 15:53:18 | 004,792,768 | —- | M] (IBM Corp.) – C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe
PRC - [2012/07/26 15:53:18 | 001,472,448 | —- | M] (IBM Corp.) – C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClientUI.exe
PRC - [2012/07/06 10:16:00 | 000,900,160 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
PRC - [2012/07/06 10:15:54 | 000,232,512 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
PRC - [2012/06/15 03:00:37 | 000,139,840 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
PRC - [2012/05/20 07:50:28 | 000,296,056 | —- | M] (RealNetworks, Inc.) – C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
PRC - [2011/10/26 15:45:40 | 000,787,640 | —- | M] () – C:\Program Files (x86)\FUJIFILM\MyFinePix Studio\dd.exe
PRC - [2010/11/09 15:20:36 | 000,586,296 | —- | M] (Hewlett-Packard Development Company, L.P.) – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
PRC - [2010/11/09 15:20:34 | 000,026,680 | —- | M] (Hewlett-Packard Development Company, L.P.) – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
PRC - [2010/04/09 16:54:38 | 001,441,544 | —- | M] (Motorola, Inc.) – C:\Program Files\Motorola\Bluetooth\btplayerctrl.exe
PRC - [2010/02/18 10:43:20 | 000,490,728 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
PRC - [2009/09/30 20:01:32 | 002,320,920 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
PRC - [2009/09/30 20:01:30 | 000,268,824 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
PRC - [2008/11/09 12:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) – C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

========== Modules (No Company Name) ==========

MOD - [2013/01/07 16:06:22 | 000,460,392 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\ppgooglenaclpluginchrome.dll
MOD - [2013/01/07 16:06:19 | 004,012,648 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\pdf.dll
MOD - [2013/01/07 16:05:29 | 000,598,120 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\libglesv2.dll
MOD - [2013/01/07 16:05:28 | 000,124,520 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\libegl.dll
MOD - [2013/01/07 16:05:25 | 001,553,000 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\ffmpegsumo.dll
MOD - [2012/02/20 20:29:04 | 000,087,912 | —- | M] () – C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/02/20 20:28:42 | 001,242,472 | —- | M] () – C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/10/26 15:45:40 | 000,787,640 | —- | M] () – C:\Program Files (x86)\FUJIFILM\MyFinePix Studio\dd.exe

========== Services (SafeList) ==========

SRV:64bit: - [2012/10/08 16:39:16 | 000,230,416 | —- | M] (Nitro PDF Software) [Auto | Running] – C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe – (NitroReaderDriverReadSpool3)
SRV:64bit: - [2010/11/20 00:37:45 | 001,028,096 | —- | M] (Macrovision Europe Ltd.) [On_Demand | Running] – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe – (FLEXnet Licensing Service 64)
SRV:64bit: - [2010/06/29 11:52:12 | 004,181,256 | —- | M] (Motorola, Inc.) [On_Demand | Running] – C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe – (Bluetooth Device Manager)
SRV:64bit: - [2010/06/24 15:24:12 | 000,315,392 | —- | M] (Realtek Semiconductor Corp.) [Auto | Running] – C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe – (RtVOsdService)
SRV:64bit: - [2010/06/18 15:26:18 | 000,103,992 | —- | M] (Hewlett-Packard Company) [Auto | Running] – C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe – (HP Wireless Assistant Service)
SRV:64bit: - [2010/05/20 13:28:14 | 000,677,128 | —- | M] (Motorola, Inc.) [Auto | Running] – C:\Program Files\Motorola\Bluetooth\obexsrv.exe – (Bluetooth OBEX Service)
SRV:64bit: - [2010/05/20 13:28:12 | 001,096,968 | —- | M] (Motorola, Inc.) [On_Demand | Running] – C:\Program Files\Motorola\Bluetooth\audiosrv.exe – (Bluetooth Media Service)
SRV:64bit: - [2009/11/17 18:14:26 | 000,098,208 | —- | M] (Andrea Electronics Corporation) [Auto | Running] – C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe – (AERTFilters)
SRV:64bit: - [2009/07/13 17:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2013/01/09 18:10:51 | 000,251,400 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/14 16:49:28 | 000,682,344 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe – (MBAMService)
SRV - [2012/12/14 16:49:28 | 000,398,184 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe – (MBAMScheduler)
SRV - [2012/12/13 14:26:20 | 003,290,896 | —- | M] (Skype Technologies S.A.) [Auto | Running] – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe – (Skype C2C Service)
SRV - [2012/11/12 05:34:40 | 002,869,824 | —- | M] (Sophos Limited) [Auto | Running] – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe – (swi_service)
SRV - [2012/11/12 05:34:37 | 001,998,400 | —- | M] (Sophos Limited) [Auto | Stopped] – C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe – (swi_update_64)
SRV - [2012/11/12 05:34:10 | 000,216,640 | —- | M] (Sophos Limited) [Auto | Running] – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe – (SAVAdminService)
SRV - [2012/11/09 11:21:24 | 000,160,944 | R— | M] (Skype Technologies) [Auto | Stopped] – C:\Program Files (x86)\Skype\Updater\Updater.exe – (SkypeUpdate)
SRV - [2012/09/27 11:55:16 | 000,086,528 | —- | M] (Hewlett-Packard Company) [Auto | Running] – C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe – (HP Support Assistant Service)
SRV - [2012/07/26 15:53:18 | 004,792,768 | —- | M] (IBM Corp.) [Auto | Running] – C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe – (BESClient)
SRV - [2012/07/06 10:15:54 | 000,232,512 | —- | M] (Sophos Limited) [Auto | Running] – C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe – (Sophos AutoUpdate Service)
SRV - [2012/06/15 03:00:37 | 000,139,840 | —- | M] (Sophos Limited) [Auto | Running] – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe – (SAVService)
SRV - [2012/04/30 13:19:43 | 000,129,976 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2010/11/20 00:37:44 | 000,647,680 | —- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe – (FLEXnet Licensing Service)
SRV - [2010/11/09 15:20:34 | 000,026,680 | —- | M] (Hewlett-Packard Development Company, L.P.) [Auto | Running] – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe – (HPWMISVC)
SRV - [2010/04/03 15:01:24 | 000,246,520 | —- | M] (WildTangent, Inc.) [On_Demand | Stopped] – C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe – (GameConsoleService)
SRV - [2010/03/18 12:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/09/30 20:01:32 | 002,320,920 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe – (UNS)
SRV - [2009/09/30 20:01:30 | 000,268,824 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe – (LMS)
SRV - [2009/06/10 13:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)
SRV - [2008/11/09 12:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Auto | Running] – C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/12/14 16:49:28 | 000,024,176 | —- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] – C:\Windows\SysNative\drivers\mbam.sys – (MBAMProtector)
DRV:64bit: - [2012/06/15 03:00:32 | 000,144,672 | —- | M] (Sophos Limited) [File_System | System | Running] – C:\Windows\SysNative\drivers\savonaccess.sys – (SAVOnAccess)
DRV:64bit: - [2012/02/29 22:46:16 | 000,023,408 | —- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] – C:\Windows\SysNative\drivers\fs_rec.sys – (Fs_Rec)
DRV:64bit: - [2012/02/15 11:06:39 | 001,390,640 | —- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\SynTP.sys – (SynTP)
DRV:64bit: - [2012/02/15 10:01:50 | 000,052,736 | —- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\usbaapl64.sys – (USBAAPL64)
DRV:64bit: - [2011/11/15 14:44:49 | 000,158,976 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Impcd.sys – (Impcd)
DRV:64bit: - [2011/10/23 07:01:40 | 000,036,640 | —- | M] (Sophos Limited) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\sdcfilter.sys – (sdcfilter)
DRV:64bit: - [2011/10/23 07:01:28 | 000,025,608 | —- | M] (Sophos Plc) [Kernel | Disabled | Stopped] – C:\Windows\SysNative\drivers\SophosBootDriver.sys – (SophosBootDriver)
DRV:64bit: - [2011/10/11 12:00:44 | 000,271,424 | —- | M] (DT Soft Ltd) [Kernel | System | Running] – C:\Windows\SysNative\drivers\dtsoftbus01.sys – (dtsoftbus01)
DRV:64bit: - [2011/03/10 22:41:12 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/03/10 22:41:12 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2010/11/20 05:33:35 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2010/11/20 03:07:05 | 000,059,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2010/11/20 01:37:42 | 000,109,056 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\sdbus.sys – (sdbus)
DRV:64bit: - [2010/11/04 20:57:54 | 001,041,760 | —- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\netr28x.sys – (netr28x)
DRV:64bit: - [2010/06/29 10:12:26 | 003,232,768 | —- | M] (Motorola, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\btmusb.sys – (BTMUSB)
DRV:64bit: - [2010/05/07 11:19:58 | 000,245,792 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\RtsUStor.sys – (RSUSBSTOR)
DRV:64bit: - [2010/04/13 09:44:22 | 000,540,696 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\iaStor.sys – (iaStor)
DRV:64bit: - [2010/04/09 16:53:04 | 000,052,736 | —- | M] (Motorola, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\btmcom.sys – (BTMCOM)
DRV:64bit: - [2010/03/22 17:57:20 | 000,347,680 | —- | M] (Realtek ) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Rt64win7.sys – (RTL8167)
DRV:64bit: - [2010/03/05 11:57:18 | 000,271,872 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\IntcDAud.sys – (IntcDAud)
DRV:64bit: - [2010/03/05 11:57:00 | 010,300,800 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\igdkmd64.sys – (igfx)
DRV:64bit: - [2010/02/08 07:32:00 | 000,014,992 | —- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\CVirtA64.sys – (CVirtA)
DRV:64bit: - [2009/09/17 12:54:54 | 000,056,344 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\HECIx64.sys – (HECIx64)
DRV:64bit: - [2009/07/13 17:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/13 17:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/13 17:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/06/10 13:01:11 | 001,485,312 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\VSTDPV6.SYS – (SrvHsfV92)
DRV:64bit: - [2009/06/10 13:01:11 | 000,740,864 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\VSTCNXT6.SYS – (SrvHsfWinac)
DRV:64bit: - [2009/06/10 13:01:11 | 000,292,864 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\VSTAZL6.SYS – (SrvHsfHDA)
DRV:64bit: - [2009/06/10 12:35:33 | 000,389,120 | —- | M] (Marvell) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\yk62x64.sys – (yukonw7)
DRV:64bit: - [2009/06/10 12:35:28 | 005,434,368 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\netw5v64.sys – (netw5v64)
DRV:64bit: - [2009/06/10 12:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 12:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 12:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 12:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009/05/18 12:17:08 | 000,034,152 | —- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\GEARAspiWDM.sys – (GEARAspiWDM)
DRV:64bit: - [2008/11/16 17:39:44 | 000,157,968 | —- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\SysNative\drivers\dne64x.sys – (DNE)
DRV:64bit: - [2008/04/16 14:49:34 | 000,028,416 | —- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\RimUsb_AMD64.sys – (RimUsb)
DRV - [2009/07/13 17:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{1C0B7A16-1BAD-41E7-BD52-9797E492D841}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl
IE:64bit: - HKLM\..\SearchScopes\{595CE31E-C5D1-41D5-AF76-DA1A315E9AB7}: "URL" = http://en.wikipedia.org/wiki/Special:Searc…h={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{9C981203-0FC1-4340-855A-1F0DEE3E7159}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=HPNTDF
IE:64bit: - HKLM\..\SearchScopes\{D5030B4B-2840-4AAD-BAF3-03A972BB32E2}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{1C0B7A16-1BAD-41E7-BD52-9797E492D841}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl
IE - HKLM\..\SearchScopes\{595CE31E-C5D1-41D5-AF76-DA1A315E9AB7}: "URL" = http://en.wikipedia.org/wiki/Special:Searc…h={searchTerms}
IE - HKLM\..\SearchScopes\{9C981203-0FC1-4340-855A-1F0DEE3E7159}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=HPNTDF
IE - HKLM\..\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKLM\..\SearchScopes\{D5030B4B-2840-4AAD-BAF3-03A972BB32E2}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{24EC05D0-D5B1-44E8-8E5B-1F51795B090D}: "URL" = http://search.yahoo.com/search?p={searchte…11,17118,0,18,0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10516.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: c:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2013/01/09 16:33:32 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2013/01/09 16:33:32 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/11/02 09:27:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2012/04/30 18:45:25 | 000,000,000 | —D | M] (No name found) – C:\Users\Jeanette\AppData\Roaming\Mozilla\Extensions
[2013/01/14 14:16:19 | 000,000,000 | —D | M] (No name found) – C:\Users\Jeanette\AppData\Roaming\Mozilla\Firefox\Profiles\cx2mh8cc.default\extensions
[2012/11/30 09:46:00 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/12/14 21:07:18 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/04/30 13:19:43 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/03/12 20:38:32 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/03/12 20:38:32 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage:
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter},
CHR - homepage:
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\pdf.dll
CHR - plugin: Skype Click to Call (Enabled) = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.5.0.11422_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U20 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: My Web Search Plugin Stub (Enabled) = C:\Program Files (x86)\MyWebSearch\bar\1.bin\NPMyWebS.dll
CHR - plugin: Nitro PDF plugin for Firefox and Chrome (Enabled) = C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll
CHR - plugin: TVU Web Player for FireFox (Enabled) = C:\Windows\system32\TVUAx\npTVUAx.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll
CHR - plugin: RealPlayer Download Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll
CHR - Extension: Google Drive = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Skype Click to Call = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.5.0.11422_0\
CHR - Extension: Gmail = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2013/01/17 09:41:01 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3:64bit: - HKLM\..\Toolbar: (no name) - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - !{ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - !{EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - !{07B18EA9-A523-4961-B6BB-170DE4475CCA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files\Motorola\Bluetooth\btmshell.dll (Motorola, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [HPWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe ()
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe (Sophos Limited)
O4 - HKLM..\Run: [TkBellExe] c:\program files (x86)\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [Device Detection] C:\Program Files (x86)\FUJIFILM\MyFinePix Studio\dd.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9:64bit: - Extra Button: @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()
O9 - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000020 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.5.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B1798265-C47A-43C3-80FD-E2874EFB3A75}: DhcpNameServer = 192.168.5.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D8EC507C-08E5-4F26-891F-323A4C761BDB}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured_x64.dll) - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll (Sophos Limited)
O20 - AppInit_DLLs: (C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured.dll) - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Limited)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/01/21 15:12:27 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Roaming\Malwarebytes
[2013/01/21 15:12:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/01/21 15:12:16 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2013/01/21 15:12:15 | 000,024,176 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2013/01/21 15:12:15 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/01/21 15:11:34 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\Programs
[2013/01/18 08:28:59 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2013/01/17 09:50:21 | 000,000,000 | —D | C] – C:\Windows\temp
[2013/01/17 09:08:28 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{2F04304C-DD6B-4BC4-879C-44F5D1F68EDB}
[2013/01/16 16:07:01 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2013/01/16 16:07:00 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2013/01/16 16:05:51 | 000,000,000 | —D | C] – C:\Qoobox
[2013/01/16 16:05:26 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2013/01/16 16:01:10 | 005,024,203 | R— | C] (Swearware) – C:\Users\Jeanette\Desktop\ComboFix.exe
[2013/01/16 15:26:55 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\WhatTheTech Virus Removal
[2013/01/16 10:51:40 | 000,000,000 | —D | C] – C:\ProgramData\BigFix
[2013/01/16 10:46:15 | 000,000,000 | —D | C] – C:\Windows\ERUNT
[2013/01/16 10:45:07 | 000,000,000 | —D | C] – C:\JRT
[2013/01/16 08:24:08 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{99FBEC18-EC05-4644-8E1A-B7FDE9348A92}
[2013/01/15 16:45:14 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\Latinos in America Data
[2013/01/15 09:38:28 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{075D76D7-48E8-44DA-A26C-E6F99A1BEEA9}
[2013/01/14 20:52:59 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\R Codes, Output
[2013/01/14 20:41:31 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{479B09FF-335F-46F6-8050-B9199F0563D1}
[2013/01/14 17:17:08 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\Devil's Cut - Ogilvy
[2013/01/14 16:49:31 | 000,000,000 | —D | C] – C:\Users\Jeanette\Documents\R
[2013/01/14 16:16:17 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R
[2013/01/14 16:15:31 | 000,000,000 | —D | C] – C:\Program Files\R
[2013/01/14 14:13:56 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{3B6439AD-350A-4D2A-8616-FFD43946D5F2}
[2013/01/14 13:18:02 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{8C479158-7AA7-444D-9746-A6093D5D39E6}
[2013/01/14 00:27:45 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{B590E548-C93D-483A-B45B-D1FA3301108A}
[2013/01/13 12:27:34 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{BFAE6E49-6373-4698-8678-02AD978258E1}
[2013/01/12 19:35:06 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{492395A6-30A4-41BE-A7B3-92CB905FE8D0}
[2013/01/11 10:22:24 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{B36A81D6-CA1D-47B4-B08B-16C5B6F2C26A}
[2013/01/10 09:10:08 | 000,750,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\win32spl.dll
[2013/01/10 09:10:08 | 000,492,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\win32spl.dll
[2013/01/10 09:10:03 | 000,307,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncrypt.dll
[2013/01/10 09:09:27 | 000,800,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\usp10.dll
[2013/01/10 09:09:03 | 000,441,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Wpc.dll
[2013/01/10 09:09:03 | 000,046,592 | —- | C] (Microsoft) – C:\Windows\SysWow64\fpb.rs
[2013/01/10 09:09:03 | 000,046,592 | —- | C] (Microsoft) – C:\Windows\SysNative\fpb.rs
[2013/01/10 09:09:03 | 000,045,568 | —- | C] (Microsoft) – C:\Windows\SysWow64\oflc-nz.rs
[2013/01/10 09:09:03 | 000,045,568 | —- | C] (Microsoft) – C:\Windows\SysNative\oflc-nz.rs
[2013/01/10 09:09:03 | 000,044,544 | —- | C] (Microsoft) – C:\Windows\SysWow64\pegibbfc.rs
[2013/01/10 09:09:03 | 000,044,544 | —- | C] (Microsoft) – C:\Windows\SysNative\pegibbfc.rs
[2013/01/10 09:09:03 | 000,043,520 | —- | C] (Microsoft) – C:\Windows\SysWow64\csrr.rs
[2013/01/10 09:09:03 | 000,043,520 | —- | C] (Microsoft) – C:\Windows\SysNative\csrr.rs
[2013/01/10 09:09:03 | 000,040,960 | —- | C] (Microsoft) – C:\Windows\SysWow64\cob-au.rs
[2013/01/10 09:09:03 | 000,040,960 | —- | C] (Microsoft) – C:\Windows\SysNative\cob-au.rs
[2013/01/10 09:09:03 | 000,030,720 | —- | C] (Microsoft) – C:\Windows\SysWow64\usk.rs
[2013/01/10 09:09:03 | 000,030,720 | —- | C] (Microsoft) – C:\Windows\SysNative\usk.rs
[2013/01/10 09:09:03 | 000,021,504 | —- | C] (Microsoft) – C:\Windows\SysWow64\grb.rs
[2013/01/10 09:09:03 | 000,021,504 | —- | C] (Microsoft) – C:\Windows\SysNative\grb.rs
[2013/01/10 09:09:03 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysWow64\pegi-pt.rs
[2013/01/10 09:09:03 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysNative\pegi-pt.rs
[2013/01/10 09:09:03 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysWow64\pegi.rs
[2013/01/10 09:09:03 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysNative\pegi.rs
[2013/01/10 09:09:03 | 000,015,360 | —- | C] (Microsoft) – C:\Windows\SysWow64\djctq.rs
[2013/01/10 09:09:03 | 000,015,360 | —- | C] (Microsoft) – C:\Windows\SysNative\djctq.rs
[2013/01/10 09:08:58 | 002,746,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\gameux.dll
[2013/01/10 09:08:57 | 002,576,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\gameux.dll
[2013/01/10 09:08:57 | 000,308,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Wpc.dll
[2013/01/10 09:08:53 | 000,055,296 | —- | C] (Microsoft) – C:\Windows\SysWow64\cero.rs
[2013/01/10 09:08:53 | 000,055,296 | —- | C] (Microsoft) – C:\Windows\SysNative\cero.rs
[2013/01/10 09:08:53 | 000,051,712 | —- | C] (Microsoft) – C:\Windows\SysWow64\esrb.rs
[2013/01/10 09:08:53 | 000,051,712 | —- | C] (Microsoft) – C:\Windows\SysNative\esrb.rs
[2013/01/10 09:08:53 | 000,023,552 | —- | C] (Microsoft) – C:\Windows\SysWow64\oflc.rs
[2013/01/10 09:08:53 | 000,023,552 | —- | C] (Microsoft) – C:\Windows\SysNative\oflc.rs
[2013/01/10 09:08:53 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysWow64\pegi-fi.rs
[2013/01/10 09:08:53 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysNative\pegi-fi.rs
[2013/01/10 09:07:32 | 000,424,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KernelBase.dll
[2013/01/10 09:07:30 | 001,161,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[2013/01/10 09:07:29 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64win.dll
[2013/01/10 09:07:29 | 000,338,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\conhost.exe
[2013/01/10 09:07:29 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64.dll
[2013/01/10 09:07:29 | 000,215,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2013/01/10 09:07:29 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntvdm64.dll
[2013/01/10 09:07:29 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2013/01/10 09:07:29 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64cpu.dll
[2013/01/10 09:07:29 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2013/01/10 09:07:29 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2013/01/10 09:07:28 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2013/01/10 09:07:28 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013/01/10 09:07:28 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2013/01/10 09:07:28 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/10 09:07:28 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/10 09:07:28 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/10 09:07:26 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2013/01/10 09:07:26 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2013/01/10 09:07:26 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013/01/10 09:07:26 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/10 09:07:26 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013/01/10 09:07:26 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2013/01/10 09:07:25 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2013/01/10 09:06:37 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskhost.exe
[2013/01/10 08:50:34 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{DB42F9A9-2A0D-489C-9947-16234EDD3BCD}
[2013/01/09 17:13:09 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013/01/09 16:37:57 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{9AAF75D6-C2CA-42BF-A454-68A4A6E14E33}
[2013/01/09 10:32:45 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{FBC5647B-427F-436F-9945-44C38626960C}
[2013/01/08 22:17:52 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{3DDA1B85-7FA9-4EE0-9F5E-ED029371EAFB}
[2013/01/08 10:17:21 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{3179341A-CB79-4B13-9B77-E66D6358AC94}
[2013/01/05 15:27:43 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\Oxford Encyclopedia 2012 Update
[2013/01/05 11:43:07 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{C47484D7-A588-4113-A87F-5A172DAD3CAF}
[2013/01/03 10:37:39 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{189CA010-67B6-4F59-B719-59EE6CFC6A87}
[2013/01/01 16:08:48 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{D6C5086E-71CF-4B73-BAE6-5EAC9BCFE36C}
[2012/12/30 18:51:17 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{957F9E29-9732-46C1-94BA-8D7E222115CF}
[2012/12/29 12:54:19 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{E928F01B-7F59-4FFB-8510-97CC3E2A5985}
[2012/12/27 11:58:18 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\Dissertation
[2012/12/27 11:44:29 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{72A5913D-2C3A-4A97-970F-45A9707B4568}
[2012/12/26 12:45:27 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\chads work stuff
[2012/12/26 10:22:55 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{A283BFC6-17AD-407B-9665-2702D100D76A}
[2012/12/25 21:25:19 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{99A43A28-3E32-4E86-B783-A3E6F5B08435}
[2012/12/25 01:35:12 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{4E4AF951-7AEC-45C7-838B-6071D73295F7}
[2012/12/23 22:17:43 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{7D07E029-2AF7-4EA6-A82B-EC64C1D859BA}
[2011/06/06 00:49:58 | 000,133,632 | —- | C] (Hewlett-Packard) – C:\Users\Jeanette\hpmco115.dll
[2011/06/06 00:49:22 | 003,077,632 | —- | C] (Hewlett-Packard) – C:\Users\Jeanette\Install.dll
[2011/05/24 04:28:20 | 000,551,424 | —- | C] (Hewlett-Packard) – C:\Users\Jeanette\hpmprein.dll
[2009/02/25 18:59:08 | 000,234,496 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hpmews02.dll
[2009/02/25 18:58:58 | 000,031,768 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hppdgenio.sys
[2009/02/25 18:58:58 | 000,031,256 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hpfx64gen.sys
[2009/02/25 18:58:58 | 000,022,040 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hppdbulkio.sys
[2009/02/25 18:58:58 | 000,020,504 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hpfx64bulk.sys
[2009/02/09 15:49:46 | 000,235,008 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hpmldm02.dll

========== Files - Modified Within 30 Days ==========

[2013/01/21 15:36:06 | 000,023,248 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/21 15:36:06 | 000,023,248 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/21 15:28:07 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/01/21 15:27:23 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/01/21 15:27:17 | 3062,255,616 | -HS- | M] () – C:\hiberfil.sys
[2013/01/21 11:29:20 | 000,000,902 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/21 11:29:20 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/01/20 18:49:44 | 000,546,721 | —- | M] () – C:\Users\Jeanette\Desktop\application to rent.pdf
[2013/01/20 18:39:21 | 000,781,205 | —- | M] () – C:\Users\Jeanette\Desktop\anes2011_egss1dta.zip
[2013/01/20 15:35:43 | 001,284,426 | —- | M] () – C:\Users\Jeanette\Desktop\Latinos_in_America_Final_PreTest.sav
[2013/01/17 09:41:01 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2013/01/17 09:21:24 | 005,024,203 | R— | M] (Swearware) – C:\Users\Jeanette\Desktop\ComboFix.exe
[2013/01/15 11:16:56 | 000,008,740 | —- | M] () – C:\Users\Jeanette\Documents\CeciliaHenleyCraveReturnLabel.png
[2013/01/15 11:11:35 | 000,010,157 | —- | M] () – C:\Users\Jeanette\Documents\KellieWoodsReturnLabel.png
[2013/01/14 16:16:17 | 000,001,033 | —- | M] () – C:\Users\Public\Desktop\R i386 2.15.2.lnk
[2013/01/14 16:16:17 | 000,001,026 | —- | M] () – C:\Users\Public\Desktop\R x64 2.15.2.lnk
[2013/01/11 15:15:52 | 000,740,814 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/01/11 15:15:52 | 000,624,412 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/01/11 15:15:52 | 000,106,756 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/01/11 10:17:45 | 000,322,024 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/01/10 19:07:26 | 000,000,344 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForJeanette.job
[2013/01/09 18:10:47 | 000,697,864 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/01/09 18:10:47 | 000,074,248 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/12/25 05:24:18 | 000,006,144 | —- | M] () – C:\Users\Jeanette\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== Files Created - No Company Name ==========

[2013/01/20 18:49:44 | 000,546,721 | —- | C] () – C:\Users\Jeanette\Desktop\application to rent.pdf
[2013/01/20 18:39:20 | 000,781,205 | —- | C] () – C:\Users\Jeanette\Desktop\anes2011_egss1dta.zip
[2013/01/20 16:33:44 | 001,284,426 | —- | C] () – C:\Users\Jeanette\Desktop\Latinos_in_America_Final_PreTest.sav
[2013/01/17 09:22:31 | 000,060,416 | —- | C] () – C:\Windows\NIRCMD.exe
[2013/01/16 16:07:05 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2013/01/16 16:07:01 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2013/01/16 16:07:01 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2013/01/16 16:07:00 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2013/01/16 16:07:00 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2013/01/15 11:16:55 | 000,008,740 | —- | C] () – C:\Users\Jeanette\Documents\CeciliaHenleyCraveReturnLabel.png
[2013/01/15 11:11:34 | 000,010,157 | —- | C] () – C:\Users\Jeanette\Documents\KellieWoodsReturnLabel.png
[2013/01/14 16:16:17 | 000,001,033 | —- | C] () – C:\Users\Public\Desktop\R i386 2.15.2.lnk
[2013/01/14 16:16:17 | 000,001,026 | —- | C] () – C:\Users\Public\Desktop\R x64 2.15.2.lnk
[2012/12/25 05:24:18 | 000,006,144 | —- | C] () – C:\Users\Jeanette\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/08 20:44:16 | 000,098,304 | —- | C] () – C:\Windows\SysWow64\redmonnt.dll
[2011/10/17 12:41:33 | 000,000,000 | —- | C] () – C:\Windows\HPMProp.INI
[2011/10/11 05:56:56 | 000,731,106 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/06/24 16:46:50 | 000,235,700 | —- | C] () – C:\Users\Jeanette\hpcu115v.cat
[2011/06/24 16:46:50 | 000,180,327 | —- | C] () – C:\Users\Jeanette\hpzius23.cat
[2011/06/24 16:46:50 | 000,179,886 | —- | C] () – C:\Users\Jeanette\hpmldm02.cat
[2011/06/24 16:46:50 | 000,179,886 | —- | C] () – C:\Users\Jeanette\hpmews02.cat
[2011/06/24 16:46:50 | 000,179,878 | —- | C] () – C:\Users\Jeanette\hpzipa23.cat
[2011/06/24 16:46:50 | 000,179,429 | —- | C] () – C:\Users\Jeanette\hpzid4v4.cat
[2011/06/24 16:46:50 | 000,178,982 | —- | C] () – C:\Users\Jeanette\hpzipr23.cat
[2011/06/24 16:46:50 | 000,178,535 | —- | C] () – C:\Users\Jeanette\hpbuio20l.cat
[2011/06/24 16:46:50 | 000,178,533 | —- | C] () – C:\Users\Jeanette\hppfaxnd.cat
[2011/06/24 16:46:50 | 000,178,531 | —- | C] () – C:\Users\Jeanette\hppscnd.cat
[2011/06/24 16:46:50 | 000,178,531 | —- | C] () – C:\Users\Jeanette\hppewnd.cat
[2011/06/06 01:30:38 | 000,039,125 | —- | C] () – C:\Users\Jeanette\psa4ukww.cab
[2011/06/06 01:30:38 | 000,038,469 | —- | C] () – C:\Users\Jeanette\psa4viww.cab
[2011/06/06 01:30:36 | 000,038,461 | —- | C] () – C:\Users\Jeanette\psa4srww.cab
[2011/06/06 01:30:36 | 000,038,457 | —- | C] () – C:\Users\Jeanette\psa4slww.cab
[2011/06/06 01:30:36 | 000,038,291 | —- | C] () – C:\Users\Jeanette\psa4roww.cab
[2011/06/06 01:30:34 | 000,039,299 | —- | C] () – C:\Users\Jeanette\psa4kkww.cab
[2011/06/06 01:30:34 | 000,038,619 | —- | C] () – C:\Users\Jeanette\psa4lvww.cab
[2011/06/06 01:30:34 | 000,038,487 | —- | C] () – C:\Users\Jeanette\psa4ltww.cab
[2011/06/06 01:30:34 | 000,038,087 | —- | C] () – C:\Users\Jeanette\psa4idww.cab
[2011/06/06 01:30:32 | 000,039,011 | —- | C] () – C:\Users\Jeanette\psa4trww.cab
[2011/06/06 01:30:32 | 000,038,991 | —- | C] () – C:\Users\Jeanette\psa4bgww.cab
[2011/06/06 01:30:32 | 000,038,637 | —- | C] () – C:\Users\Jeanette\psa4thww.cab
[2011/06/06 01:30:32 | 000,038,531 | —- | C] () – C:\Users\Jeanette\psa4hrww.cab
[2011/06/06 01:30:32 | 000,038,509 | —- | C] () – C:\Users\Jeanette\psa4etww.cab
[2011/06/06 01:30:30 | 000,037,885 | —- | C] () – C:\Users\Jeanette\psa4svww.cab
[2011/06/06 01:30:28 | 000,039,977 | —- | C] () – C:\Users\Jeanette\psa4plww.cab
[2011/06/06 01:30:28 | 000,039,205 | —- | C] () – C:\Users\Jeanette\psa4ruww.cab
[2011/06/06 01:30:28 | 000,038,947 | —- | C] () – C:\Users\Jeanette\psa4ptww.cab
[2011/06/06 01:30:28 | 000,038,825 | —- | C] () – C:\Users\Jeanette\psa4skww.cab
[2011/06/06 01:30:28 | 000,038,369 | —- | C] () – C:\Users\Jeanette\psa4nlww.cab
[2011/06/06 01:30:28 | 000,038,223 | —- | C] () – C:\Users\Jeanette\psa4noww.cab
[2011/06/06 01:30:26 | 000,039,739 | —- | C] () – C:\Users\Jeanette\psa4huww.cab
[2011/06/06 01:30:26 | 000,039,239 | —- | C] () – C:\Users\Jeanette\psa4frww.cab
[2011/06/06 01:30:26 | 000,038,427 | —- | C] () – C:\Users\Jeanette\psa4heww.cab
[2011/06/06 01:30:26 | 000,038,205 | —- | C] () – C:\Users\Jeanette\psa4itww.cab
[2011/06/06 01:30:26 | 000,038,001 | —- | C] () – C:\Users\Jeanette\psa4jaww.cab
[2011/06/06 01:30:26 | 000,037,559 | —- | C] () – C:\Users\Jeanette\psa4koww.cab
[2011/06/06 01:30:24 | 000,039,431 | —- | C] () – C:\Users\Jeanette\psa4deww.cab
[2011/06/06 01:30:24 | 000,039,189 | —- | C] () – C:\Users\Jeanette\psa4elww.cab
[2011/06/06 01:30:24 | 000,038,343 | —- | C] () – C:\Users\Jeanette\psa4fiww.cab
[2011/06/06 01:30:24 | 000,038,115 | —- | C] () – C:\Users\Jeanette\psa4esww.cab
[2011/06/06 01:30:24 | 000,037,547 | —- | C] () – C:\Users\Jeanette\psa4enww.cab
[2011/06/06 01:30:22 | 000,039,441 | —- | C] () – C:\Users\Jeanette\psa4csww.cab
[2011/06/06 01:30:22 | 000,038,151 | —- | C] () – C:\Users\Jeanette\psa4daww.cab
[2011/06/06 01:30:22 | 000,038,131 | —- | C] () – C:\Users\Jeanette\psa4caww.cab
[2011/06/06 01:30:22 | 000,036,893 | —- | C] () – C:\Users\Jeanette\psa4zhcn.cab
[2011/06/06 01:30:22 | 000,036,057 | —- | C] () – C:\Users\Jeanette\psa4zhtw.cab
[2011/06/06 01:30:20 | 013,958,690 | —- | C] () – C:\Users\Jeanette\hpcu115v.cab
[2011/06/06 01:30:20 | 000,038,709 | —- | C] () – C:\Users\Jeanette\psa4arww.cab
[2011/06/06 00:27:32 | 000,090,898 | —- | C] () – C:\Users\Jeanette\hpcu115v.inf
[2011/06/02 04:05:24 | 000,001,203 | —- | C] () – C:\Users\Jeanette\hpbuio20l.inf
[2011/06/02 04:04:02 | 000,221,391 | —- | C] () – C:\Users\Jeanette\hpcpu115.cfg
[2011/06/01 11:48:58 | 003,314,688 | —- | C] () – C:\Users\Jeanette\hpbcfgre.dll
[2011/05/24 09:47:04 | 000,001,165 | —- | C] () – C:\Users\Jeanette\hpmprein.config
[2011/05/24 09:47:02 | 000,005,740 | —- | C] () – C:\Users\Jeanette\hppldcoi.config
[2011/05/02 13:45:36 | 000,003,888 | —- | C] () – C:\Users\Jeanette\hppscnd.inf
[2011/04/16 16:02:30 | 000,068,062 | —- | C] () – C:\Users\Jeanette\hpzid4vp.inf
[2011/04/16 16:01:58 | 000,189,098 | —- | C] () – C:\Users\Jeanette\hpzius23.inf
[2011/04/16 16:01:46 | 000,051,648 | —- | C] () – C:\Users\Jeanette\hpzipr23.inf
[2011/04/16 16:01:36 | 000,101,018 | —- | C] () – C:\Users\Jeanette\hpzipa23.inf
[2010/10/29 13:44:04 | 000,002,583 | —- | C] () – C:\Users\Jeanette\hppfaxnd.inf
[2010/10/29 13:43:50 | 000,001,542 | —- | C] () – C:\Users\Jeanette\hppewnd.inf
[2010/09/10 12:38:02 | 000,003,633 | —- | C] () – C:\Users\Jeanette\hpmldm02.inf
[2009/09/10 10:13:10 | 000,007,950 | —- | C] () – C:\Users\Jeanette\hpmews02.inf
[2009/02/25 18:59:08 | 000,000,665 | —- | C] () – C:\Users\Jeanette\hpmldm02.dat
[2009/02/25 18:59:08 | 000,000,648 | —- | C] () – C:\Users\Jeanette\hpmews02.dat

========== ZeroAccess Check ==========

[2009/07/13 20:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/08 21:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 20:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 17:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 04:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 17:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >

Satchfan

Post #32January 22, 2013, 12:13 AM UTC

Thanks - I'll check as soon as I can. It's gone midnight here and I have an early start so won't reply again tonight.

bustamaj

Post #33January 22, 2013, 12:23 AM UTC

Satchfan,

I hope you have a good night. I will be more prompt in my responses from now on. I really apologize about not being quicker.

Here is the SecurityCheck log:

esults of screen317's Security Check version 0.99.57
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Sophos Anti-Virus
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.70.0.1100
Java™ 6 Update 20
Java version out of Date!
Adobe Flash Player 11.5.502.146
Adobe Reader 9 Adobe Reader out of Date!
Mozilla Firefox 12.0 Firefox out of Date!
Google Chrome 23.0.1271.97
Google Chrome 24.0.1312.52
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Sophos Sophos Anti-Virus SavService.exe
Sophos Sophos Anti-Virus SAVAdminService.exe
Sophos Sophos Anti-Virus Web Intelligence swi_service.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 18% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````

bustamaj

Post #34January 22, 2013, 1:06 AM UTC

Satchfan,

Here is the OTL log after the SecurityCheck scan.

OTL logfile created on: 1/21/2013 4:29:30 PM - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Jeanette\Desktop\WhatTheTech Virus Removal
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.80 Gb Total Physical Memory | 1.55 Gb Available Physical Memory | 40.66% Memory free
7.60 Gb Paging File | 4.90 Gb Available in Paging File | 64.50% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 281.48 Gb Total Space | 173.67 Gb Free Space | 61.70% Space Free | Partition Type: NTFS
Drive D: | 16.32 Gb Total Space | 2.36 Gb Free Space | 14.44% Space Free | Partition Type: NTFS
Drive G: | 99.34 Mb Total Space | 93.54 Mb Free Space | 94.16% Space Free | Partition Type: FAT32

Computer Name: JEANETTE-HP | User Name: Jeanette | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/01/09 18:57:11 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Jeanette\Desktop\WhatTheTech Virus Removal\OTL.exe
PRC - [2013/01/07 16:06:24 | 001,248,360 | —- | M] (Google Inc.) – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2012/12/14 16:49:28 | 000,682,344 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/12/14 16:49:28 | 000,512,360 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/12/14 16:49:28 | 000,398,184 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/12/13 14:26:20 | 003,290,896 | —- | M] (Skype Technologies S.A.) – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/11/12 05:34:40 | 002,869,824 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
PRC - [2012/11/12 05:34:10 | 000,216,640 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
PRC - [2012/07/26 15:53:18 | 004,792,768 | —- | M] (IBM Corp.) – C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe
PRC - [2012/07/26 15:53:18 | 001,472,448 | —- | M] (IBM Corp.) – C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClientUI.exe
PRC - [2012/07/06 10:16:00 | 000,900,160 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
PRC - [2012/07/06 10:15:54 | 000,232,512 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
PRC - [2012/06/15 03:00:37 | 000,139,840 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
PRC - [2012/05/20 07:50:28 | 000,296,056 | —- | M] (RealNetworks, Inc.) – C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
PRC - [2011/10/26 15:45:40 | 000,787,640 | —- | M] () – C:\Program Files (x86)\FUJIFILM\MyFinePix Studio\dd.exe
PRC - [2010/11/09 15:20:36 | 000,586,296 | —- | M] (Hewlett-Packard Development Company, L.P.) – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
PRC - [2010/11/09 15:20:34 | 000,026,680 | —- | M] (Hewlett-Packard Development Company, L.P.) – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
PRC - [2010/04/09 16:54:38 | 001,441,544 | —- | M] (Motorola, Inc.) – C:\Program Files\Motorola\Bluetooth\btplayerctrl.exe
PRC - [2010/02/18 10:43:20 | 000,490,728 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
PRC - [2009/09/30 20:01:32 | 002,320,920 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
PRC - [2009/09/30 20:01:30 | 000,268,824 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
PRC - [2008/11/09 12:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) – C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

========== Modules (No Company Name) ==========

MOD - [2013/01/07 16:06:22 | 000,460,392 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\ppgooglenaclpluginchrome.dll
MOD - [2013/01/07 16:06:21 | 012,459,624 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\PepperFlash\pepflashplayer.dll
MOD - [2013/01/07 16:06:19 | 004,012,648 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\pdf.dll
MOD - [2013/01/07 16:05:29 | 000,598,120 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\libglesv2.dll
MOD - [2013/01/07 16:05:28 | 000,124,520 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\libegl.dll
MOD - [2013/01/07 16:05:25 | 001,553,000 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\ffmpegsumo.dll
MOD - [2012/02/20 20:29:04 | 000,087,912 | —- | M] () – C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/02/20 20:28:42 | 001,242,472 | —- | M] () – C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/10/26 15:45:40 | 000,787,640 | —- | M] () – C:\Program Files (x86)\FUJIFILM\MyFinePix Studio\dd.exe
MOD - [2011/10/05 03:52:30 | 000,756,048 | —- | M] () – C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\MSPTLS.DLL

========== Services (SafeList) ==========

SRV:64bit: - [2012/10/08 16:39:16 | 000,230,416 | —- | M] (Nitro PDF Software) [Auto | Running] – C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe – (NitroReaderDriverReadSpool3)
SRV:64bit: - [2010/11/20 00:37:45 | 001,028,096 | —- | M] (Macrovision Europe Ltd.) [On_Demand | Running] – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe – (FLEXnet Licensing Service 64)
SRV:64bit: - [2010/06/29 11:52:12 | 004,181,256 | —- | M] (Motorola, Inc.) [On_Demand | Running] – C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe – (Bluetooth Device Manager)
SRV:64bit: - [2010/06/24 15:24:12 | 000,315,392 | —- | M] (Realtek Semiconductor Corp.) [Auto | Running] – C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe – (RtVOsdService)
SRV:64bit: - [2010/06/18 15:26:18 | 000,103,992 | —- | M] (Hewlett-Packard Company) [Auto | Running] – C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe – (HP Wireless Assistant Service)
SRV:64bit: - [2010/05/20 13:28:14 | 000,677,128 | —- | M] (Motorola, Inc.) [Auto | Running] – C:\Program Files\Motorola\Bluetooth\obexsrv.exe – (Bluetooth OBEX Service)
SRV:64bit: - [2010/05/20 13:28:12 | 001,096,968 | —- | M] (Motorola, Inc.) [On_Demand | Running] – C:\Program Files\Motorola\Bluetooth\audiosrv.exe – (Bluetooth Media Service)
SRV:64bit: - [2009/11/17 18:14:26 | 000,098,208 | —- | M] (Andrea Electronics Corporation) [Auto | Running] – C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe – (AERTFilters)
SRV:64bit: - [2009/07/13 17:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2013/01/09 18:10:51 | 000,251,400 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/14 16:49:28 | 000,682,344 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe – (MBAMService)
SRV - [2012/12/14 16:49:28 | 000,398,184 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe – (MBAMScheduler)
SRV - [2012/12/13 14:26:20 | 003,290,896 | —- | M] (Skype Technologies S.A.) [Auto | Running] – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe – (Skype C2C Service)
SRV - [2012/11/12 05:34:40 | 002,869,824 | —- | M] (Sophos Limited) [Auto | Running] – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe – (swi_service)
SRV - [2012/11/12 05:34:37 | 001,998,400 | —- | M] (Sophos Limited) [Auto | Stopped] – C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe – (swi_update_64)
SRV - [2012/11/12 05:34:10 | 000,216,640 | —- | M] (Sophos Limited) [Auto | Running] – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe – (SAVAdminService)
SRV - [2012/11/09 11:21:24 | 000,160,944 | R— | M] (Skype Technologies) [Auto | Stopped] – C:\Program Files (x86)\Skype\Updater\Updater.exe – (SkypeUpdate)
SRV - [2012/09/27 11:55:16 | 000,086,528 | —- | M] (Hewlett-Packard Company) [Auto | Running] – C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe – (HP Support Assistant Service)
SRV - [2012/07/26 15:53:18 | 004,792,768 | —- | M] (IBM Corp.) [Auto | Running] – C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe – (BESClient)
SRV - [2012/07/06 10:15:54 | 000,232,512 | —- | M] (Sophos Limited) [Auto | Running] – C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe – (Sophos AutoUpdate Service)
SRV - [2012/06/15 03:00:37 | 000,139,840 | —- | M] (Sophos Limited) [Auto | Running] – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe – (SAVService)
SRV - [2012/04/30 13:19:43 | 000,129,976 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2010/11/20 00:37:44 | 000,647,680 | —- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe – (FLEXnet Licensing Service)
SRV - [2010/11/09 15:20:34 | 000,026,680 | —- | M] (Hewlett-Packard Development Company, L.P.) [Auto | Running] – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe – (HPWMISVC)
SRV - [2010/04/03 15:01:24 | 000,246,520 | —- | M] (WildTangent, Inc.) [On_Demand | Stopped] – C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe – (GameConsoleService)
SRV - [2010/03/18 12:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/09/30 20:01:32 | 002,320,920 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe – (UNS)
SRV - [2009/09/30 20:01:30 | 000,268,824 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe – (LMS)
SRV - [2009/06/10 13:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)
SRV - [2008/11/09 12:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Auto | Running] – C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/12/14 16:49:28 | 000,024,176 | —- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] – C:\Windows\SysNative\drivers\mbam.sys – (MBAMProtector)
DRV:64bit: - [2012/06/15 03:00:32 | 000,144,672 | —- | M] (Sophos Limited) [File_System | System | Running] – C:\Windows\SysNative\drivers\savonaccess.sys – (SAVOnAccess)
DRV:64bit: - [2012/02/29 22:46:16 | 000,023,408 | —- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] – C:\Windows\SysNative\drivers\fs_rec.sys – (Fs_Rec)
DRV:64bit: - [2012/02/15 11:06:39 | 001,390,640 | —- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\SynTP.sys – (SynTP)
DRV:64bit: - [2012/02/15 10:01:50 | 000,052,736 | —- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\usbaapl64.sys – (USBAAPL64)
DRV:64bit: - [2011/11/15 14:44:49 | 000,158,976 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Impcd.sys – (Impcd)
DRV:64bit: - [2011/10/23 07:01:40 | 000,036,640 | —- | M] (Sophos Limited) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\sdcfilter.sys – (sdcfilter)
DRV:64bit: - [2011/10/23 07:01:28 | 000,025,608 | —- | M] (Sophos Plc) [Kernel | Disabled | Stopped] – C:\Windows\SysNative\drivers\SophosBootDriver.sys – (SophosBootDriver)
DRV:64bit: - [2011/10/11 12:00:44 | 000,271,424 | —- | M] (DT Soft Ltd) [Kernel | System | Running] – C:\Windows\SysNative\drivers\dtsoftbus01.sys – (dtsoftbus01)
DRV:64bit: - [2011/03/10 22:41:12 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/03/10 22:41:12 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2010/11/20 05:33:35 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2010/11/20 03:07:05 | 000,059,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2010/11/20 01:37:42 | 000,109,056 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\sdbus.sys – (sdbus)
DRV:64bit: - [2010/11/04 20:57:54 | 001,041,760 | —- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\netr28x.sys – (netr28x)
DRV:64bit: - [2010/06/29 10:12:26 | 003,232,768 | —- | M] (Motorola, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\btmusb.sys – (BTMUSB)
DRV:64bit: - [2010/05/07 11:19:58 | 000,245,792 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\RtsUStor.sys – (RSUSBSTOR)
DRV:64bit: - [2010/04/13 09:44:22 | 000,540,696 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\iaStor.sys – (iaStor)
DRV:64bit: - [2010/04/09 16:53:04 | 000,052,736 | —- | M] (Motorola, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\btmcom.sys – (BTMCOM)
DRV:64bit: - [2010/03/22 17:57:20 | 000,347,680 | —- | M] (Realtek ) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Rt64win7.sys – (RTL8167)
DRV:64bit: - [2010/03/05 11:57:18 | 000,271,872 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\IntcDAud.sys – (IntcDAud)
DRV:64bit: - [2010/03/05 11:57:00 | 010,300,800 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\igdkmd64.sys – (igfx)
DRV:64bit: - [2010/02/08 07:32:00 | 000,014,992 | —- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\CVirtA64.sys – (CVirtA)
DRV:64bit: - [2009/09/17 12:54:54 | 000,056,344 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\HECIx64.sys – (HECIx64)
DRV:64bit: - [2009/07/13 17:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/13 17:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/13 17:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/06/10 13:01:11 | 001,485,312 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\VSTDPV6.SYS – (SrvHsfV92)
DRV:64bit: - [2009/06/10 13:01:11 | 000,740,864 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\VSTCNXT6.SYS – (SrvHsfWinac)
DRV:64bit: - [2009/06/10 13:01:11 | 000,292,864 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\VSTAZL6.SYS – (SrvHsfHDA)
DRV:64bit: - [2009/06/10 12:35:33 | 000,389,120 | —- | M] (Marvell) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\yk62x64.sys – (yukonw7)
DRV:64bit: - [2009/06/10 12:35:28 | 005,434,368 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\netw5v64.sys – (netw5v64)
DRV:64bit: - [2009/06/10 12:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 12:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 12:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 12:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009/05/18 12:17:08 | 000,034,152 | —- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\GEARAspiWDM.sys – (GEARAspiWDM)
DRV:64bit: - [2008/11/16 17:39:44 | 000,157,968 | —- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\SysNative\drivers\dne64x.sys – (DNE)
DRV:64bit: - [2008/04/16 14:49:34 | 000,028,416 | —- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\RimUsb_AMD64.sys – (RimUsb)
DRV - [2009/07/13 17:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{1C0B7A16-1BAD-41E7-BD52-9797E492D841}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl
IE:64bit: - HKLM\..\SearchScopes\{595CE31E-C5D1-41D5-AF76-DA1A315E9AB7}: "URL" = http://en.wikipedia.org/wiki/Special:Searc…h={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{9C981203-0FC1-4340-855A-1F0DEE3E7159}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=HPNTDF
IE:64bit: - HKLM\..\SearchScopes\{D5030B4B-2840-4AAD-BAF3-03A972BB32E2}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{1C0B7A16-1BAD-41E7-BD52-9797E492D841}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl
IE - HKLM\..\SearchScopes\{595CE31E-C5D1-41D5-AF76-DA1A315E9AB7}: "URL" = http://en.wikipedia.org/wiki/Special:Searc…h={searchTerms}
IE - HKLM\..\SearchScopes\{9C981203-0FC1-4340-855A-1F0DEE3E7159}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=HPNTDF
IE - HKLM\..\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKLM\..\SearchScopes\{D5030B4B-2840-4AAD-BAF3-03A972BB32E2}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
IE - HKCU\..\SearchScopes,DefaultScope = {24EC05D0-D5B1-44E8-8E5B-1F51795B090D}
IE - HKCU\..\SearchScopes\{24EC05D0-D5B1-44E8-8E5B-1F51795B090D}: "URL" = http://search.yahoo.com/search?p={searchte…11,17118,0,18,0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10516.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: c:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2013/01/09 16:33:32 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2013/01/09 16:33:32 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/11/02 09:27:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2012/04/30 18:45:25 | 000,000,000 | —D | M] (No name found) – C:\Users\Jeanette\AppData\Roaming\Mozilla\Extensions
[2013/01/14 14:16:19 | 000,000,000 | —D | M] (No name found) – C:\Users\Jeanette\AppData\Roaming\Mozilla\Firefox\Profiles\cx2mh8cc.default\extensions
[2012/11/30 09:46:00 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/12/14 21:07:18 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/04/30 13:19:43 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/03/12 20:38:32 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/03/12 20:38:32 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage:
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter},
CHR - homepage:
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\pdf.dll
CHR - plugin: Skype Click to Call (Enabled) = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.5.0.11422_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U20 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: My Web Search Plugin Stub (Enabled) = C:\Program Files (x86)\MyWebSearch\bar\1.bin\NPMyWebS.dll
CHR - plugin: Nitro PDF plugin for Firefox and Chrome (Enabled) = C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll
CHR - plugin: TVU Web Player for FireFox (Enabled) = C:\Windows\system32\TVUAx\npTVUAx.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll
CHR - plugin: RealPlayer Download Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll
CHR - Extension: Google Drive = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Skype Click to Call = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.5.0.11422_0\
CHR - Extension: Gmail = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2013/01/17 09:41:01 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3:64bit: - HKLM\..\Toolbar: (no name) - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - !{ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - !{EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - !{07B18EA9-A523-4961-B6BB-170DE4475CCA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files\Motorola\Bluetooth\btmshell.dll (Motorola, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [HPWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe ()
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe (Sophos Limited)
O4 - HKLM..\Run: [TkBellExe] c:\program files (x86)\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [Device Detection] C:\Program Files (x86)\FUJIFILM\MyFinePix Studio\dd.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9:64bit: - Extra Button: @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()
O9 - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000020 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.5.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B1798265-C47A-43C3-80FD-E2874EFB3A75}: DhcpNameServer = 192.168.5.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D8EC507C-08E5-4F26-891F-323A4C761BDB}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured_x64.dll) - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll (Sophos Limited)
O20 - AppInit_DLLs: (C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured.dll) - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Limited)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/01/21 15:12:27 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Roaming\Malwarebytes
[2013/01/21 15:12:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/01/21 15:12:16 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2013/01/21 15:12:15 | 000,024,176 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2013/01/21 15:12:15 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/01/21 15:11:34 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\Programs
[2013/01/18 08:28:59 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2013/01/17 09:50:21 | 000,000,000 | —D | C] – C:\Windows\temp
[2013/01/17 09:08:28 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{2F04304C-DD6B-4BC4-879C-44F5D1F68EDB}
[2013/01/16 16:07:01 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2013/01/16 16:07:00 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2013/01/16 16:05:51 | 000,000,000 | —D | C] – C:\Qoobox
[2013/01/16 16:05:26 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2013/01/16 16:01:10 | 005,024,203 | R— | C] (Swearware) – C:\Users\Jeanette\Desktop\ComboFix.exe
[2013/01/16 15:26:55 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\WhatTheTech Virus Removal
[2013/01/16 10:51:40 | 000,000,000 | —D | C] – C:\ProgramData\BigFix
[2013/01/16 10:46:15 | 000,000,000 | —D | C] – C:\Windows\ERUNT
[2013/01/16 10:45:07 | 000,000,000 | —D | C] – C:\JRT
[2013/01/16 08:24:08 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{99FBEC18-EC05-4644-8E1A-B7FDE9348A92}
[2013/01/15 16:45:14 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\Latinos in America Data
[2013/01/15 09:38:28 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{075D76D7-48E8-44DA-A26C-E6F99A1BEEA9}
[2013/01/14 20:52:59 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\R Codes, Output
[2013/01/14 20:41:31 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{479B09FF-335F-46F6-8050-B9199F0563D1}
[2013/01/14 17:17:08 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\Devil's Cut - Ogilvy
[2013/01/14 16:49:31 | 000,000,000 | —D | C] – C:\Users\Jeanette\Documents\R
[2013/01/14 16:16:17 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R
[2013/01/14 16:15:31 | 000,000,000 | —D | C] – C:\Program Files\R
[2013/01/14 14:13:56 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{3B6439AD-350A-4D2A-8616-FFD43946D5F2}
[2013/01/14 13:18:02 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{8C479158-7AA7-444D-9746-A6093D5D39E6}
[2013/01/14 00:27:45 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{B590E548-C93D-483A-B45B-D1FA3301108A}
[2013/01/13 12:27:34 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{BFAE6E49-6373-4698-8678-02AD978258E1}
[2013/01/12 19:35:06 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{492395A6-30A4-41BE-A7B3-92CB905FE8D0}
[2013/01/11 10:22:24 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{B36A81D6-CA1D-47B4-B08B-16C5B6F2C26A}
[2013/01/10 09:10:08 | 000,750,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\win32spl.dll
[2013/01/10 09:10:08 | 000,492,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\win32spl.dll
[2013/01/10 09:10:03 | 000,307,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncrypt.dll
[2013/01/10 09:09:27 | 000,800,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\usp10.dll
[2013/01/10 09:09:03 | 000,441,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Wpc.dll
[2013/01/10 09:09:03 | 000,046,592 | —- | C] (Microsoft) – C:\Windows\SysWow64\fpb.rs
[2013/01/10 09:09:03 | 000,046,592 | —- | C] (Microsoft) – C:\Windows\SysNative\fpb.rs
[2013/01/10 09:09:03 | 000,045,568 | —- | C] (Microsoft) – C:\Windows\SysWow64\oflc-nz.rs
[2013/01/10 09:09:03 | 000,045,568 | —- | C] (Microsoft) – C:\Windows\SysNative\oflc-nz.rs
[2013/01/10 09:09:03 | 000,044,544 | —- | C] (Microsoft) – C:\Windows\SysWow64\pegibbfc.rs
[2013/01/10 09:09:03 | 000,044,544 | —- | C] (Microsoft) – C:\Windows\SysNative\pegibbfc.rs
[2013/01/10 09:09:03 | 000,043,520 | —- | C] (Microsoft) – C:\Windows\SysWow64\csrr.rs
[2013/01/10 09:09:03 | 000,043,520 | —- | C] (Microsoft) – C:\Windows\SysNative\csrr.rs
[2013/01/10 09:09:03 | 000,040,960 | —- | C] (Microsoft) – C:\Windows\SysWow64\cob-au.rs
[2013/01/10 09:09:03 | 000,040,960 | —- | C] (Microsoft) – C:\Windows\SysNative\cob-au.rs
[2013/01/10 09:09:03 | 000,030,720 | —- | C] (Microsoft) – C:\Windows\SysWow64\usk.rs
[2013/01/10 09:09:03 | 000,030,720 | —- | C] (Microsoft) – C:\Windows\SysNative\usk.rs
[2013/01/10 09:09:03 | 000,021,504 | —- | C] (Microsoft) – C:\Windows\SysWow64\grb.rs
[2013/01/10 09:09:03 | 000,021,504 | —- | C] (Microsoft) – C:\Windows\SysNative\grb.rs
[2013/01/10 09:09:03 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysWow64\pegi-pt.rs
[2013/01/10 09:09:03 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysNative\pegi-pt.rs
[2013/01/10 09:09:03 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysWow64\pegi.rs
[2013/01/10 09:09:03 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysNative\pegi.rs
[2013/01/10 09:09:03 | 000,015,360 | —- | C] (Microsoft) – C:\Windows\SysWow64\djctq.rs
[2013/01/10 09:09:03 | 000,015,360 | —- | C] (Microsoft) – C:\Windows\SysNative\djctq.rs
[2013/01/10 09:08:58 | 002,746,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\gameux.dll
[2013/01/10 09:08:57 | 002,576,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\gameux.dll
[2013/01/10 09:08:57 | 000,308,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Wpc.dll
[2013/01/10 09:08:53 | 000,055,296 | —- | C] (Microsoft) – C:\Windows\SysWow64\cero.rs
[2013/01/10 09:08:53 | 000,055,296 | —- | C] (Microsoft) – C:\Windows\SysNative\cero.rs
[2013/01/10 09:08:53 | 000,051,712 | —- | C] (Microsoft) – C:\Windows\SysWow64\esrb.rs
[2013/01/10 09:08:53 | 000,051,712 | —- | C] (Microsoft) – C:\Windows\SysNative\esrb.rs
[2013/01/10 09:08:53 | 000,023,552 | —- | C] (Microsoft) – C:\Windows\SysWow64\oflc.rs
[2013/01/10 09:08:53 | 000,023,552 | —- | C] (Microsoft) – C:\Windows\SysNative\oflc.rs
[2013/01/10 09:08:53 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysWow64\pegi-fi.rs
[2013/01/10 09:08:53 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysNative\pegi-fi.rs
[2013/01/10 09:07:32 | 000,424,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KernelBase.dll
[2013/01/10 09:07:30 | 001,161,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[2013/01/10 09:07:29 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64win.dll
[2013/01/10 09:07:29 | 000,338,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\conhost.exe
[2013/01/10 09:07:29 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64.dll
[2013/01/10 09:07:29 | 000,215,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2013/01/10 09:07:29 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntvdm64.dll
[2013/01/10 09:07:29 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2013/01/10 09:07:29 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64cpu.dll
[2013/01/10 09:07:29 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2013/01/10 09:07:29 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2013/01/10 09:07:28 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2013/01/10 09:07:28 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013/01/10 09:07:28 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2013/01/10 09:07:28 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/10 09:07:28 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/10 09:07:28 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/10 09:07:26 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2013/01/10 09:07:26 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2013/01/10 09:07:26 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013/01/10 09:07:26 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/10 09:07:26 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013/01/10 09:07:26 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2013/01/10 09:07:25 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2013/01/10 09:06:37 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskhost.exe
[2013/01/10 08:50:34 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{DB42F9A9-2A0D-489C-9947-16234EDD3BCD}
[2013/01/09 17:13:09 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013/01/09 16:37:57 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{9AAF75D6-C2CA-42BF-A454-68A4A6E14E33}
[2013/01/09 10:32:45 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{FBC5647B-427F-436F-9945-44C38626960C}
[2013/01/08 22:17:52 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{3DDA1B85-7FA9-4EE0-9F5E-ED029371EAFB}
[2013/01/08 10:17:21 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{3179341A-CB79-4B13-9B77-E66D6358AC94}
[2013/01/05 15:27:43 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\Oxford Encyclopedia 2012 Update
[2013/01/05 11:43:07 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{C47484D7-A588-4113-A87F-5A172DAD3CAF}
[2013/01/03 10:37:39 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{189CA010-67B6-4F59-B719-59EE6CFC6A87}
[2013/01/01 16:08:48 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{D6C5086E-71CF-4B73-BAE6-5EAC9BCFE36C}
[2012/12/30 18:51:17 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{957F9E29-9732-46C1-94BA-8D7E222115CF}
[2012/12/29 12:54:19 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{E928F01B-7F59-4FFB-8510-97CC3E2A5985}
[2012/12/27 11:58:18 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\Dissertation
[2012/12/27 11:44:29 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{72A5913D-2C3A-4A97-970F-45A9707B4568}
[2012/12/26 12:45:27 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\chads work stuff
[2012/12/26 10:22:55 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{A283BFC6-17AD-407B-9665-2702D100D76A}
[2012/12/25 21:25:19 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{99A43A28-3E32-4E86-B783-A3E6F5B08435}
[2012/12/25 01:35:12 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{4E4AF951-7AEC-45C7-838B-6071D73295F7}
[2012/12/23 22:17:43 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{7D07E029-2AF7-4EA6-A82B-EC64C1D859BA}
[2011/06/06 00:49:58 | 000,133,632 | —- | C] (Hewlett-Packard) – C:\Users\Jeanette\hpmco115.dll
[2011/06/06 00:49:22 | 003,077,632 | —- | C] (Hewlett-Packard) – C:\Users\Jeanette\Install.dll
[2011/05/24 04:28:20 | 000,551,424 | —- | C] (Hewlett-Packard) – C:\Users\Jeanette\hpmprein.dll
[2009/02/25 18:59:08 | 000,234,496 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hpmews02.dll
[2009/02/25 18:58:58 | 000,031,768 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hppdgenio.sys
[2009/02/25 18:58:58 | 000,031,256 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hpfx64gen.sys
[2009/02/25 18:58:58 | 000,022,040 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hppdbulkio.sys
[2009/02/25 18:58:58 | 000,020,504 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hpfx64bulk.sys
[2009/02/09 15:49:46 | 000,235,008 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hpmldm02.dll

========== Files - Modified Within 30 Days ==========

[2013/01/21 16:13:03 | 000,000,902 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/21 16:08:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/01/21 16:00:23 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/01/21 15:36:06 | 000,023,248 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/21 15:36:06 | 000,023,248 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/21 15:28:07 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/01/21 15:27:17 | 3062,255,616 | -HS- | M] () – C:\hiberfil.sys
[2013/01/20 18:49:44 | 000,546,721 | —- | M] () – C:\Users\Jeanette\Desktop\application to rent.pdf
[2013/01/20 18:39:21 | 000,781,205 | —- | M] () – C:\Users\Jeanette\Desktop\anes2011_egss1dta.zip
[2013/01/20 15:35:43 | 001,284,426 | —- | M] () – C:\Users\Jeanette\Desktop\Latinos_in_America_Final_PreTest.sav
[2013/01/17 09:41:01 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2013/01/17 09:21:24 | 005,024,203 | R— | M] (Swearware) – C:\Users\Jeanette\Desktop\ComboFix.exe
[2013/01/15 11:16:56 | 000,008,740 | —- | M] () – C:\Users\Jeanette\Documents\CeciliaHenleyCraveReturnLabel.png
[2013/01/15 11:11:35 | 000,010,157 | —- | M] () – C:\Users\Jeanette\Documents\KellieWoodsReturnLabel.png
[2013/01/14 16:16:17 | 000,001,033 | —- | M] () – C:\Users\Public\Desktop\R i386 2.15.2.lnk
[2013/01/14 16:16:17 | 000,001,026 | —- | M] () – C:\Users\Public\Desktop\R x64 2.15.2.lnk
[2013/01/11 15:15:52 | 000,740,814 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/01/11 15:15:52 | 000,624,412 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/01/11 15:15:52 | 000,106,756 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/01/11 10:17:45 | 000,322,024 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/01/10 19:07:26 | 000,000,344 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForJeanette.job
[2013/01/09 18:10:47 | 000,697,864 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/01/09 18:10:47 | 000,074,248 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/12/25 05:24:18 | 000,006,144 | —- | M] () – C:\Users\Jeanette\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== Files Created - No Company Name ==========

[2013/01/20 18:49:44 | 000,546,721 | —- | C] () – C:\Users\Jeanette\Desktop\application to rent.pdf
[2013/01/20 18:39:20 | 000,781,205 | —- | C] () – C:\Users\Jeanette\Desktop\anes2011_egss1dta.zip
[2013/01/20 16:33:44 | 001,284,426 | —- | C] () – C:\Users\Jeanette\Desktop\Latinos_in_America_Final_PreTest.sav
[2013/01/17 09:22:31 | 000,060,416 | —- | C] () – C:\Windows\NIRCMD.exe
[2013/01/16 16:07:05 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2013/01/16 16:07:01 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2013/01/16 16:07:01 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2013/01/16 16:07:00 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2013/01/16 16:07:00 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2013/01/15 11:16:55 | 000,008,740 | —- | C] () – C:\Users\Jeanette\Documents\CeciliaHenleyCraveReturnLabel.png
[2013/01/15 11:11:34 | 000,010,157 | —- | C] () – C:\Users\Jeanette\Documents\KellieWoodsReturnLabel.png
[2013/01/14 16:16:17 | 000,001,033 | —- | C] () – C:\Users\Public\Desktop\R i386 2.15.2.lnk
[2013/01/14 16:16:17 | 000,001,026 | —- | C] () – C:\Users\Public\Desktop\R x64 2.15.2.lnk
[2012/12/25 05:24:18 | 000,006,144 | —- | C] () – C:\Users\Jeanette\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/08 20:44:16 | 000,098,304 | —- | C] () – C:\Windows\SysWow64\redmonnt.dll
[2011/10/17 12:41:33 | 000,000,000 | —- | C] () – C:\Windows\HPMProp.INI
[2011/10/11 05:56:56 | 000,731,106 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/06/24 16:46:50 | 000,235,700 | —- | C] () – C:\Users\Jeanette\hpcu115v.cat
[2011/06/24 16:46:50 | 000,180,327 | —- | C] () – C:\Users\Jeanette\hpzius23.cat
[2011/06/24 16:46:50 | 000,179,886 | —- | C] () – C:\Users\Jeanette\hpmldm02.cat
[2011/06/24 16:46:50 | 000,179,886 | —- | C] () – C:\Users\Jeanette\hpmews02.cat
[2011/06/24 16:46:50 | 000,179,878 | —- | C] () – C:\Users\Jeanette\hpzipa23.cat
[2011/06/24 16:46:50 | 000,179,429 | —- | C] () – C:\Users\Jeanette\hpzid4v4.cat
[2011/06/24 16:46:50 | 000,178,982 | —- | C] () – C:\Users\Jeanette\hpzipr23.cat
[2011/06/24 16:46:50 | 000,178,535 | —- | C] () – C:\Users\Jeanette\hpbuio20l.cat
[2011/06/24 16:46:50 | 000,178,533 | —- | C] () – C:\Users\Jeanette\hppfaxnd.cat
[2011/06/24 16:46:50 | 000,178,531 | —- | C] () – C:\Users\Jeanette\hppscnd.cat
[2011/06/24 16:46:50 | 000,178,531 | —- | C] () – C:\Users\Jeanette\hppewnd.cat
[2011/06/06 01:30:38 | 000,039,125 | —- | C] () – C:\Users\Jeanette\psa4ukww.cab
[2011/06/06 01:30:38 | 000,038,469 | —- | C] () – C:\Users\Jeanette\psa4viww.cab
[2011/06/06 01:30:36 | 000,038,461 | —- | C] () – C:\Users\Jeanette\psa4srww.cab
[2011/06/06 01:30:36 | 000,038,457 | —- | C] () – C:\Users\Jeanette\psa4slww.cab
[2011/06/06 01:30:36 | 000,038,291 | —- | C] () – C:\Users\Jeanette\psa4roww.cab
[2011/06/06 01:30:34 | 000,039,299 | —- | C] () – C:\Users\Jeanette\psa4kkww.cab
[2011/06/06 01:30:34 | 000,038,619 | —- | C] () – C:\Users\Jeanette\psa4lvww.cab
[2011/06/06 01:30:34 | 000,038,487 | —- | C] () – C:\Users\Jeanette\psa4ltww.cab
[2011/06/06 01:30:34 | 000,038,087 | —- | C] () – C:\Users\Jeanette\psa4idww.cab
[2011/06/06 01:30:32 | 000,039,011 | —- | C] () – C:\Users\Jeanette\psa4trww.cab
[2011/06/06 01:30:32 | 000,038,991 | —- | C] () – C:\Users\Jeanette\psa4bgww.cab
[2011/06/06 01:30:32 | 000,038,637 | —- | C] () – C:\Users\Jeanette\psa4thww.cab
[2011/06/06 01:30:32 | 000,038,531 | —- | C] () – C:\Users\Jeanette\psa4hrww.cab
[2011/06/06 01:30:32 | 000,038,509 | —- | C] () – C:\Users\Jeanette\psa4etww.cab
[2011/06/06 01:30:30 | 000,037,885 | —- | C] () – C:\Users\Jeanette\psa4svww.cab
[2011/06/06 01:30:28 | 000,039,977 | —- | C] () – C:\Users\Jeanette\psa4plww.cab
[2011/06/06 01:30:28 | 000,039,205 | —- | C] () – C:\Users\Jeanette\psa4ruww.cab
[2011/06/06 01:30:28 | 000,038,947 | —- | C] () – C:\Users\Jeanette\psa4ptww.cab
[2011/06/06 01:30:28 | 000,038,825 | —- | C] () – C:\Users\Jeanette\psa4skww.cab
[2011/06/06 01:30:28 | 000,038,369 | —- | C] () – C:\Users\Jeanette\psa4nlww.cab
[2011/06/06 01:30:28 | 000,038,223 | —- | C] () – C:\Users\Jeanette\psa4noww.cab
[2011/06/06 01:30:26 | 000,039,739 | —- | C] () – C:\Users\Jeanette\psa4huww.cab
[2011/06/06 01:30:26 | 000,039,239 | —- | C] () – C:\Users\Jeanette\psa4frww.cab
[2011/06/06 01:30:26 | 000,038,427 | —- | C] () – C:\Users\Jeanette\psa4heww.cab
[2011/06/06 01:30:26 | 000,038,205 | —- | C] () – C:\Users\Jeanette\psa4itww.cab
[2011/06/06 01:30:26 | 000,038,001 | —- | C] () – C:\Users\Jeanette\psa4jaww.cab
[2011/06/06 01:30:26 | 000,037,559 | —- | C] () – C:\Users\Jeanette\psa4koww.cab
[2011/06/06 01:30:24 | 000,039,431 | —- | C] () – C:\Users\Jeanette\psa4deww.cab
[2011/06/06 01:30:24 | 000,039,189 | —- | C] () – C:\Users\Jeanette\psa4elww.cab
[2011/06/06 01:30:24 | 000,038,343 | —- | C] () – C:\Users\Jeanette\psa4fiww.cab
[2011/06/06 01:30:24 | 000,038,115 | —- | C] () – C:\Users\Jeanette\psa4esww.cab
[2011/06/06 01:30:24 | 000,037,547 | —- | C] () – C:\Users\Jeanette\psa4enww.cab
[2011/06/06 01:30:22 | 000,039,441 | —- | C] () – C:\Users\Jeanette\psa4csww.cab
[2011/06/06 01:30:22 | 000,038,151 | —- | C] () – C:\Users\Jeanette\psa4daww.cab
[2011/06/06 01:30:22 | 000,038,131 | —- | C] () – C:\Users\Jeanette\psa4caww.cab
[2011/06/06 01:30:22 | 000,036,893 | —- | C] () – C:\Users\Jeanette\psa4zhcn.cab
[2011/06/06 01:30:22 | 000,036,057 | —- | C] () – C:\Users\Jeanette\psa4zhtw.cab
[2011/06/06 01:30:20 | 013,958,690 | —- | C] () – C:\Users\Jeanette\hpcu115v.cab
[2011/06/06 01:30:20 | 000,038,709 | —- | C] () – C:\Users\Jeanette\psa4arww.cab
[2011/06/06 00:27:32 | 000,090,898 | —- | C] () – C:\Users\Jeanette\hpcu115v.inf
[2011/06/02 04:05:24 | 000,001,203 | —- | C] () – C:\Users\Jeanette\hpbuio20l.inf
[2011/06/02 04:04:02 | 000,221,391 | —- | C] () – C:\Users\Jeanette\hpcpu115.cfg
[2011/06/01 11:48:58 | 003,314,688 | —- | C] () – C:\Users\Jeanette\hpbcfgre.dll
[2011/05/24 09:47:04 | 000,001,165 | —- | C] () – C:\Users\Jeanette\hpmprein.config
[2011/05/24 09:47:02 | 000,005,740 | —- | C] () – C:\Users\Jeanette\hppldcoi.config
[2011/05/02 13:45:36 | 000,003,888 | —- | C] () – C:\Users\Jeanette\hppscnd.inf
[2011/04/16 16:02:30 | 000,068,062 | —- | C] () – C:\Users\Jeanette\hpzid4vp.inf
[2011/04/16 16:01:58 | 000,189,098 | —- | C] () – C:\Users\Jeanette\hpzius23.inf
[2011/04/16 16:01:46 | 000,051,648 | —- | C] () – C:\Users\Jeanette\hpzipr23.inf
[2011/04/16 16:01:36 | 000,101,018 | —- | C] () – C:\Users\Jeanette\hpzipa23.inf
[2010/10/29 13:44:04 | 000,002,583 | —- | C] () – C:\Users\Jeanette\hppfaxnd.inf
[2010/10/29 13:43:50 | 000,001,542 | —- | C] () – C:\Users\Jeanette\hppewnd.inf
[2010/09/10 12:38:02 | 000,003,633 | —- | C] () – C:\Users\Jeanette\hpmldm02.inf
[2009/09/10 10:13:10 | 000,007,950 | —- | C] () – C:\Users\Jeanette\hpmews02.inf
[2009/02/25 18:59:08 | 000,000,665 | —- | C] () – C:\Users\Jeanette\hpmldm02.dat
[2009/02/25 18:59:08 | 000,000,648 | —- | C] () – C:\Users\Jeanette\hpmews02.dat

========== ZeroAccess Check ==========

[2009/07/13 20:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/08 21:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 20:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 17:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 04:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 17:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >

Satchfan

Post #35January 22, 2013, 9:06 AM UTC last edited January 22, 2013, 10:55 AM UTC

There are still some annoying entries that should have been dealt with, one of which is a Chrome entry.

Please do this in the order instructed.

Let’s try uninstalling Chrome and if asked about user data or settings, remove those also.

Restart the computer and re-install Chrome.

===================================================

Note: Please temporarily disable MalwareBytes Anti-Malware for the duration of this fix as it may interfere with the successfully execution of the script below.

Run OTL

double click on the icon to run it.

copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL IE:64bit: - HKLM\..\SearchScopes\{1C0B7A16-1BAD-41E7-BD52-9797E492D841}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl IE:64bit: - HKLM\..\SearchScopes\{595CE31E-C5D1-41D5-AF76-DA1A315E9AB7}: "URL" = http://en.wikipedia.org/wiki/Special:Searc…h={searchTerms} IE:64bit: - HKLM\..\SearchScopes\{9C981203-0FC1-4340-855A-1F0DEE3E7159}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=HPNTDF IE:64bit: - HKLM\..\SearchScopes\{D5030B4B-2840-4AAD-BAF3-03A972BB32E2}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox IE - HKLM\..\SearchScopes\{1C0B7A16-1BAD-41E7-BD52-9797E492D841}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl IE - HKLM\..\SearchScopes\{595CE31E-C5D1-41D5-AF76-DA1A315E9AB7}: "URL" = http://en.wikipedia.org/wiki/Special:Searc…h={searchTerms} IE - HKLM\..\SearchScopes\{9C981203-0FC1-4340-855A-1F0DEE3E7159}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=HPNTDF IE - HKLM\..\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms} IE - HKLM\..\SearchScopes\{D5030B4B-2840-4AAD-BAF3-03A972BB32E2}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox IE - HKCU\..\SearchScopes\{24EC05D0-D5B1-44E8-8E5B-1F51795B090D}: "URL" = http://search.yahoo.com/search?p={searchte…11,17118,0,18,0 O3:64bit: - HKLM\..\Toolbar: (no name) - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - !{ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - !{EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - !{07B18EA9-A523-4961-B6BB-170DE4475CCA} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - !{ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - !{EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found. [2013/01/17 09:08:28 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{2F04304C-DD6B-4BC4-879C-44F5D1F68EDB} C:\Users\Jeanette\AppData\Local\{99FBEC18-EC05-4644-8E1A-B7FDE9348A92} [2013/01/14 20:41:31 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{479B09FF-335F-46F6-8050-B9199F0563D1} [2013/01/14 14:13:56 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{3B6439AD-350A-4D2A-8616-FFD43946D5F2} [2013/01/14 13:18:02 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{8C479158-7AA7-444D-9746-A6093D5D39E6} [2013/01/14 00:27:45 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{B590E548-C93D-483A-B45B-D1FA3301108A} [2013/01/13 12:27:34 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{BFAE6E49-6373-4698-8678-02AD978258E1} [2013/01/12 19:35:06 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{492395A6-30A4-41BE-A7B3-92CB905FE8D0} [2013/01/11 10:22:24 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{B36A81D6-CA1D-47B4-B08B-16C5B6F2C26A} [2013/01/10 08:50:34 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{DB42F9A9-2A0D-489C-9947-16234EDD3BCD} [2013/01/09 16:37:57 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{9AAF75D6-C2CA-42BF-A454-68A4A6E14E33} [2013/01/09 10:32:45 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{FBC5647B-427F-436F-9945-44C38626960C} [2013/01/08 22:17:52 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{3DDA1B85-7FA9-4EE0-9F5E-ED029371EAFB} [2013/01/08 10:17:21 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{3179341A-CB79-4B13-9B77-E66D6358AC94} [2013/01/05 11:43:07 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{C47484D7-A588-4113-A87F-5A172DAD3CAF} [2013/01/03 10:37:39 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{189CA010-67B6-4F59-B719-59EE6CFC6A87} [2013/01/01 16:08:48 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{D6C5086E-71CF-4B73-BAE6-5EAC9BCFE36C} [2012/12/30 18:51:17 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{957F9E29-9732-46C1-94BA-8D7E222115CF} [2012/12/29 12:54:19 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{E928F01B-7F59-4FFB-8510-97CC3E2A5985} [2012/12/27 11:44:29 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{72A5913D-2C3A-4A97-970F-45A9707B4568} [2012/12/26 10:22:55 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{A283BFC6-17AD-407B-9665-2702D100D76A} [2012/12/25 21:25:19 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{99A43A28-3E32-4E86-B783-A3E6F5B08435} [2012/12/25 01:35:12 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{4E4AF951-7AEC-45C7-838B-6071D73295F7} [2012/12/23 22:17:43 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{7D07E029-2AF7-4EA6-A82B-EC64C1D859BA} :Commands [purity] [emptytemp] [Reboot]

click the Run Fix button at the top
let the program run unhindered, reboot when it is done
please post the OTL fix log and a new OTL log

Logs to include in the next post:

OTL fix log
New OTL log

Thanks

Satchfan

bustamaj

Post #36January 22, 2013, 8:38 PM UTC

Hello Satchfan, I followed the above directions and here is the OTL fix log: All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1C0B7A16-1BAD-41E7-BD52-9797E492D841}\ deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1C0B7A16-1BAD-41E7-BD52-9797E492D841}\ not found. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{595CE31E-C5D1-41D5-AF76-DA1A315E9AB7}\ deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{595CE31E-C5D1-41D5-AF76-DA1A315E9AB7}\ not found. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9C981203-0FC1-4340-855A-1F0DEE3E7159}\ deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C981203-0FC1-4340-855A-1F0DEE3E7159}\ not found. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D5030B4B-2840-4AAD-BAF3-03A972BB32E2}\ deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D5030B4B-2840-4AAD-BAF3-03A972BB32E2}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1C0B7A16-1BAD-41E7-BD52-9797E492D841}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1C0B7A16-1BAD-41E7-BD52-9797E492D841}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{595CE31E-C5D1-41D5-AF76-DA1A315E9AB7}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{595CE31E-C5D1-41D5-AF76-DA1A315E9AB7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9C981203-0FC1-4340-855A-1F0DEE3E7159}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C981203-0FC1-4340-855A-1F0DEE3E7159}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D5030B4B-2840-4AAD-BAF3-03A972BB32E2}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D5030B4B-2840-4AAD-BAF3-03A972BB32E2}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{24EC05D0-D5B1-44E8-8E5B-1F51795B090D}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24EC05D0-D5B1-44E8-8E5B-1F51795B090D}\ not found. 64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\!{2318C2B1-4965-11d4-9B18-009027A5CD4F} deleted successfully. 64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\!{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully. 64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\!{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully. 64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\!{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\!{07B18EA9-A523-4961-B6BB-170DE4475CCA} deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\!{2318C2B1-4965-11d4-9B18-009027A5CD4F} deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\!{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\!{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\!{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully. C:\Users\Jeanette\AppData\Local\{2F04304C-DD6B-4BC4-879C-44F5D1F68EDB} folder moved successfully. C:\Users\Jeanette\AppData\Local\{479B09FF-335F-46F6-8050-B9199F0563D1} folder moved successfully. C:\Users\Jeanette\AppData\Local\{3B6439AD-350A-4D2A-8616-FFD43946D5F2} folder moved successfully. C:\Users\Jeanette\AppData\Local\{8C479158-7AA7-444D-9746-A6093D5D39E6} folder moved successfully. C:\Users\Jeanette\AppData\Local\{B590E548-C93D-483A-B45B-D1FA3301108A} folder moved successfully. C:\Users\Jeanette\AppData\Local\{BFAE6E49-6373-4698-8678-02AD978258E1} folder moved successfully. C:\Users\Jeanette\AppData\Local\{492395A6-30A4-41BE-A7B3-92CB905FE8D0} folder moved successfully. C:\Users\Jeanette\AppData\Local\{B36A81D6-CA1D-47B4-B08B-16C5B6F2C26A} folder moved successfully. C:\Users\Jeanette\AppData\Local\{DB42F9A9-2A0D-489C-9947-16234EDD3BCD} folder moved successfully. C:\Users\Jeanette\AppData\Local\{9AAF75D6-C2CA-42BF-A454-68A4A6E14E33} folder moved successfully. C:\Users\Jeanette\AppData\Local\{FBC5647B-427F-436F-9945-44C38626960C} folder moved successfully. C:\Users\Jeanette\AppData\Local\{3DDA1B85-7FA9-4EE0-9F5E-ED029371EAFB} folder moved successfully. C:\Users\Jeanette\AppData\Local\{3179341A-CB79-4B13-9B77-E66D6358AC94} folder moved successfully. C:\Users\Jeanette\AppData\Local\{C47484D7-A588-4113-A87F-5A172DAD3CAF} folder moved successfully. C:\Users\Jeanette\AppData\Local\{189CA010-67B6-4F59-B719-59EE6CFC6A87} folder moved successfully. C:\Users\Jeanette\AppData\Local\{D6C5086E-71CF-4B73-BAE6-5EAC9BCFE36C} folder moved successfully. C:\Users\Jeanette\AppData\Local\{957F9E29-9732-46C1-94BA-8D7E222115CF} folder moved successfully. C:\Users\Jeanette\AppData\Local\{E928F01B-7F59-4FFB-8510-97CC3E2A5985} folder moved successfully. C:\Users\Jeanette\AppData\Local\{72A5913D-2C3A-4A97-970F-45A9707B4568} folder moved successfully. C:\Users\Jeanette\AppData\Local\{A283BFC6-17AD-407B-9665-2702D100D76A} folder moved successfully. C:\Users\Jeanette\AppData\Local\{99A43A28-3E32-4E86-B783-A3E6F5B08435} folder moved successfully. C:\Users\Jeanette\AppData\Local\{4E4AF951-7AEC-45C7-838B-6071D73295F7} folder moved successfully. C:\Users\Jeanette\AppData\Local\{7D07E029-2AF7-4EA6-A82B-EC64C1D859BA} folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 56504 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Jeanette ->Temp folder emptied: 9864129 bytes ->Temporary Internet Files folder emptied: 237403463 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 150437181 bytes ->Google Chrome cache emptied: 7877991 bytes ->Flash cache emptied: 57258 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 73634 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36028370 bytes %systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 749 bytes RecycleBin emptied: 6804491 bytes Total Files Cleaned = 428.00 mb OTL by OldTimer - Version 3.2.69.0 log created on 01222013_122947 Files\Folders moved on Reboot… C:\Users\Jeanette\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. PendingFileRenameOperations files… Registry entries deleted on Reboot…

bustamaj

Post #37January 22, 2013, 9:07 PM UTC

Here is the new OTL Log:

OTL logfile created on: 1/22/2013 12:39:00 PM - Run 5
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Jeanette\Desktop\WhatTheTech Virus Removal
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.80 Gb Total Physical Memory | 1.87 Gb Available Physical Memory | 49.25% Memory free
7.60 Gb Paging File | 5.40 Gb Available in Paging File | 70.99% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 281.48 Gb Total Space | 175.21 Gb Free Space | 62.25% Space Free | Partition Type: NTFS
Drive D: | 16.32 Gb Total Space | 2.36 Gb Free Space | 14.44% Space Free | Partition Type: NTFS
Drive G: | 99.34 Mb Total Space | 93.54 Mb Free Space | 94.16% Space Free | Partition Type: FAT32

Computer Name: JEANETTE-HP | User Name: Jeanette | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/01/18 00:07:04 | 001,248,208 | —- | M] (Google Inc.) – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2013/01/09 18:57:11 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Jeanette\Desktop\WhatTheTech Virus Removal\OTL.exe
PRC - [2012/12/14 16:49:28 | 000,682,344 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/12/14 16:49:28 | 000,512,360 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/12/14 16:49:28 | 000,398,184 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/12/13 14:26:20 | 003,290,896 | —- | M] (Skype Technologies S.A.) – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/11/12 05:34:40 | 002,869,824 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
PRC - [2012/11/12 05:34:10 | 000,216,640 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
PRC - [2012/07/26 15:53:18 | 004,792,768 | —- | M] (IBM Corp.) – C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe
PRC - [2012/07/26 15:53:18 | 001,472,448 | —- | M] (IBM Corp.) – C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClientUI.exe
PRC - [2012/07/06 10:16:00 | 000,900,160 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
PRC - [2012/07/06 10:15:54 | 000,232,512 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
PRC - [2012/06/15 03:00:37 | 000,139,840 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
PRC - [2012/05/20 07:50:28 | 000,296,056 | —- | M] (RealNetworks, Inc.) – C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
PRC - [2011/10/26 15:45:40 | 000,787,640 | —- | M] () – C:\Program Files (x86)\FUJIFILM\MyFinePix Studio\dd.exe
PRC - [2010/11/09 15:20:36 | 000,586,296 | —- | M] (Hewlett-Packard Development Company, L.P.) – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
PRC - [2010/11/09 15:20:34 | 000,026,680 | —- | M] (Hewlett-Packard Development Company, L.P.) – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
PRC - [2010/04/09 16:54:38 | 001,441,544 | —- | M] (Motorola, Inc.) – C:\Program Files\Motorola\Bluetooth\btplayerctrl.exe
PRC - [2009/09/30 20:01:32 | 002,320,920 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
PRC - [2009/09/30 20:01:30 | 000,268,824 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
PRC - [2008/11/09 12:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) – C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

========== Modules (No Company Name) ==========

MOD - [2013/01/18 00:07:02 | 000,460,240 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\ppgooglenaclpluginchrome.dll
MOD - [2013/01/18 00:07:01 | 004,012,496 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\pdf.dll
MOD - [2013/01/18 00:06:15 | 000,597,968 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\libglesv2.dll
MOD - [2013/01/18 00:06:15 | 000,124,368 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\libegl.dll
MOD - [2013/01/18 00:06:13 | 001,552,848 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\ffmpegsumo.dll
MOD - [2012/02/20 20:29:04 | 000,087,912 | —- | M] () – C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/02/20 20:28:42 | 001,242,472 | —- | M] () – C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/10/26 15:45:40 | 000,787,640 | —- | M] () – C:\Program Files (x86)\FUJIFILM\MyFinePix Studio\dd.exe

========== Services (SafeList) ==========

SRV:64bit: - [2012/10/08 16:39:16 | 000,230,416 | —- | M] (Nitro PDF Software) [Auto | Running] – C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe – (NitroReaderDriverReadSpool3)
SRV:64bit: - [2010/11/20 00:37:45 | 001,028,096 | —- | M] (Macrovision Europe Ltd.) [On_Demand | Running] – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe – (FLEXnet Licensing Service 64)
SRV:64bit: - [2010/06/29 11:52:12 | 004,181,256 | —- | M] (Motorola, Inc.) [On_Demand | Running] – C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe – (Bluetooth Device Manager)
SRV:64bit: - [2010/06/24 15:24:12 | 000,315,392 | —- | M] (Realtek Semiconductor Corp.) [Auto | Running] – C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe – (RtVOsdService)
SRV:64bit: - [2010/06/18 15:26:18 | 000,103,992 | —- | M] (Hewlett-Packard Company) [Auto | Running] – C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe – (HP Wireless Assistant Service)
SRV:64bit: - [2010/05/20 13:28:14 | 000,677,128 | —- | M] (Motorola, Inc.) [Auto | Running] – C:\Program Files\Motorola\Bluetooth\obexsrv.exe – (Bluetooth OBEX Service)
SRV:64bit: - [2010/05/20 13:28:12 | 001,096,968 | —- | M] (Motorola, Inc.) [On_Demand | Running] – C:\Program Files\Motorola\Bluetooth\audiosrv.exe – (Bluetooth Media Service)
SRV:64bit: - [2009/11/17 18:14:26 | 000,098,208 | —- | M] (Andrea Electronics Corporation) [Auto | Running] – C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe – (AERTFilters)
SRV:64bit: - [2009/07/13 17:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2013/01/09 18:10:51 | 000,251,400 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/14 16:49:28 | 000,682,344 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe – (MBAMService)
SRV - [2012/12/14 16:49:28 | 000,398,184 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe – (MBAMScheduler)
SRV - [2012/12/13 14:26:20 | 003,290,896 | —- | M] (Skype Technologies S.A.) [Auto | Running] – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe – (Skype C2C Service)
SRV - [2012/11/12 05:34:40 | 002,869,824 | —- | M] (Sophos Limited) [Auto | Running] – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe – (swi_service)
SRV - [2012/11/12 05:34:37 | 001,998,400 | —- | M] (Sophos Limited) [Auto | Stopped] – C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe – (swi_update_64)
SRV - [2012/11/12 05:34:10 | 000,216,640 | —- | M] (Sophos Limited) [Auto | Running] – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe – (SAVAdminService)
SRV - [2012/11/09 11:21:24 | 000,160,944 | R— | M] (Skype Technologies) [Auto | Stopped] – C:\Program Files (x86)\Skype\Updater\Updater.exe – (SkypeUpdate)
SRV - [2012/09/27 11:55:16 | 000,086,528 | —- | M] (Hewlett-Packard Company) [Auto | Running] – C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe – (HP Support Assistant Service)
SRV - [2012/07/26 15:53:18 | 004,792,768 | —- | M] (IBM Corp.) [Auto | Running] – C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe – (BESClient)
SRV - [2012/07/06 10:15:54 | 000,232,512 | —- | M] (Sophos Limited) [Auto | Running] – C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe – (Sophos AutoUpdate Service)
SRV - [2012/06/15 03:00:37 | 000,139,840 | —- | M] (Sophos Limited) [Auto | Running] – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe – (SAVService)
SRV - [2012/04/30 13:19:43 | 000,129,976 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2010/11/20 00:37:44 | 000,647,680 | —- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe – (FLEXnet Licensing Service)
SRV - [2010/11/09 15:20:34 | 000,026,680 | —- | M] (Hewlett-Packard Development Company, L.P.) [Auto | Running] – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe – (HPWMISVC)
SRV - [2010/04/03 15:01:24 | 000,246,520 | —- | M] (WildTangent, Inc.) [On_Demand | Stopped] – C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe – (GameConsoleService)
SRV - [2010/03/18 12:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/09/30 20:01:32 | 002,320,920 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe – (UNS)
SRV - [2009/09/30 20:01:30 | 000,268,824 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe – (LMS)
SRV - [2009/06/10 13:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)
SRV - [2008/11/09 12:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Auto | Running] – C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/12/14 16:49:28 | 000,024,176 | —- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] – C:\Windows\SysNative\drivers\mbam.sys – (MBAMProtector)
DRV:64bit: - [2012/06/15 03:00:32 | 000,144,672 | —- | M] (Sophos Limited) [File_System | System | Running] – C:\Windows\SysNative\drivers\savonaccess.sys – (SAVOnAccess)
DRV:64bit: - [2012/02/29 22:46:16 | 000,023,408 | —- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] – C:\Windows\SysNative\drivers\fs_rec.sys – (Fs_Rec)
DRV:64bit: - [2012/02/15 11:06:39 | 001,390,640 | —- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\SynTP.sys – (SynTP)
DRV:64bit: - [2012/02/15 10:01:50 | 000,052,736 | —- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\usbaapl64.sys – (USBAAPL64)
DRV:64bit: - [2011/11/15 14:44:49 | 000,158,976 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Impcd.sys – (Impcd)
DRV:64bit: - [2011/10/23 07:01:40 | 000,036,640 | —- | M] (Sophos Limited) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\sdcfilter.sys – (sdcfilter)
DRV:64bit: - [2011/10/23 07:01:28 | 000,025,608 | —- | M] (Sophos Plc) [Kernel | Disabled | Stopped] – C:\Windows\SysNative\drivers\SophosBootDriver.sys – (SophosBootDriver)
DRV:64bit: - [2011/10/11 12:00:44 | 000,271,424 | —- | M] (DT Soft Ltd) [Kernel | System | Running] – C:\Windows\SysNative\drivers\dtsoftbus01.sys – (dtsoftbus01)
DRV:64bit: - [2011/03/10 22:41:12 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/03/10 22:41:12 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2010/11/20 05:33:35 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2010/11/20 03:07:05 | 000,059,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2010/11/20 01:37:42 | 000,109,056 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\sdbus.sys – (sdbus)
DRV:64bit: - [2010/11/04 20:57:54 | 001,041,760 | —- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\netr28x.sys – (netr28x)
DRV:64bit: - [2010/06/29 10:12:26 | 003,232,768 | —- | M] (Motorola, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\btmusb.sys – (BTMUSB)
DRV:64bit: - [2010/05/07 11:19:58 | 000,245,792 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\RtsUStor.sys – (RSUSBSTOR)
DRV:64bit: - [2010/04/13 09:44:22 | 000,540,696 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\iaStor.sys – (iaStor)
DRV:64bit: - [2010/04/09 16:53:04 | 000,052,736 | —- | M] (Motorola, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\btmcom.sys – (BTMCOM)
DRV:64bit: - [2010/03/22 17:57:20 | 000,347,680 | —- | M] (Realtek ) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Rt64win7.sys – (RTL8167)
DRV:64bit: - [2010/03/05 11:57:18 | 000,271,872 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\IntcDAud.sys – (IntcDAud)
DRV:64bit: - [2010/03/05 11:57:00 | 010,300,800 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\igdkmd64.sys – (igfx)
DRV:64bit: - [2010/02/08 07:32:00 | 000,014,992 | —- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\CVirtA64.sys – (CVirtA)
DRV:64bit: - [2009/09/17 12:54:54 | 000,056,344 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\HECIx64.sys – (HECIx64)
DRV:64bit: - [2009/07/13 17:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/13 17:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/13 17:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/06/10 13:01:11 | 001,485,312 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\VSTDPV6.SYS – (SrvHsfV92)
DRV:64bit: - [2009/06/10 13:01:11 | 000,740,864 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\VSTCNXT6.SYS – (SrvHsfWinac)
DRV:64bit: - [2009/06/10 13:01:11 | 000,292,864 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\VSTAZL6.SYS – (SrvHsfHDA)
DRV:64bit: - [2009/06/10 12:35:33 | 000,389,120 | —- | M] (Marvell) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\yk62x64.sys – (yukonw7)
DRV:64bit: - [2009/06/10 12:35:28 | 005,434,368 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\netw5v64.sys – (netw5v64)
DRV:64bit: - [2009/06/10 12:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 12:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 12:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 12:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009/05/18 12:17:08 | 000,034,152 | —- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\GEARAspiWDM.sys – (GEARAspiWDM)
DRV:64bit: - [2008/11/16 17:39:44 | 000,157,968 | —- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\SysNative\drivers\dne64x.sys – (DNE)
DRV:64bit: - [2008/04/16 14:49:34 | 000,028,416 | —- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\RimUsb_AMD64.sys – (RimUsb)
DRV - [2009/07/13 17:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
IE - HKCU\..\SearchScopes,DefaultScope = {24EC05D0-D5B1-44E8-8E5B-1F51795B090D}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10516.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: c:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2013/01/09 16:33:32 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2013/01/09 16:33:32 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/11/02 09:27:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2012/04/30 18:45:25 | 000,000,000 | —D | M] (No name found) – C:\Users\Jeanette\AppData\Roaming\Mozilla\Extensions
[2013/01/14 14:16:19 | 000,000,000 | —D | M] (No name found) – C:\Users\Jeanette\AppData\Roaming\Mozilla\Firefox\Profiles\cx2mh8cc.default\extensions
[2012/11/30 09:46:00 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/12/14 21:07:18 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/04/30 13:19:43 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/03/12 20:38:32 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/03/12 20:38:32 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl;={language}&q;={searchTerms}&sugkey;={google:suggestAPIKeyParameter},
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\pdf.dll
CHR - plugin: Skype Click to Call (Enabled) = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.5.0.11422_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U20 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll
CHR - plugin: Nitro PDF plugin for Firefox and Chrome (Enabled) = C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll
CHR - plugin: TVU Web Player for FireFox (Enabled) = C:\Windows\system32\TVUAx\npTVUAx.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.10516.0\npctrl.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll
CHR - plugin: RealPlayer Download Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll
CHR - Extension: Google Docs = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.4_0\
CHR - Extension: Google Drive = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Skype Click to Call = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.5.0.11422_0\
CHR - Extension: Gmail = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2013/01/17 09:41:01 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files\Motorola\Bluetooth\btmshell.dll (Motorola, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [HPWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe ()
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe (Sophos Limited)
O4 - HKLM..\Run: [TkBellExe] c:\program files (x86)\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [Device Detection] C:\Program Files (x86)\FUJIFILM\MyFinePix Studio\dd.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9:64bit: - Extra Button: @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()
O9 - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000020 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B1798265-C47A-43C3-80FD-E2874EFB3A75}: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D8EC507C-08E5-4F26-891F-323A4C761BDB}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured_x64.dll) - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll (Sophos Limited)
O20 - AppInit_DLLs: (C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured.dll) - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Limited)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/01/22 12:29:47 | 000,000,000 | —D | C] – C:\_OTL
[2013/01/22 12:20:14 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013/01/21 15:12:27 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Roaming\Malwarebytes
[2013/01/21 15:12:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/01/21 15:12:16 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2013/01/21 15:12:15 | 000,024,176 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2013/01/21 15:12:15 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/01/21 15:11:34 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\Programs
[2013/01/18 08:28:59 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2013/01/17 09:50:21 | 000,000,000 | —D | C] – C:\Windows\temp
[2013/01/16 16:07:01 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2013/01/16 16:07:00 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2013/01/16 16:05:51 | 000,000,000 | —D | C] – C:\Qoobox
[2013/01/16 16:05:26 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2013/01/16 16:01:10 | 005,024,203 | R— | C] (Swearware) – C:\Users\Jeanette\Desktop\ComboFix.exe
[2013/01/16 15:26:55 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\WhatTheTech Virus Removal
[2013/01/16 10:51:40 | 000,000,000 | —D | C] – C:\ProgramData\BigFix
[2013/01/16 10:46:15 | 000,000,000 | —D | C] – C:\Windows\ERUNT
[2013/01/16 10:45:07 | 000,000,000 | —D | C] – C:\JRT
[2013/01/16 08:24:08 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{99FBEC18-EC05-4644-8E1A-B7FDE9348A92}
[2013/01/15 16:45:14 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\Latinos in America Data
[2013/01/15 09:38:28 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{075D76D7-48E8-44DA-A26C-E6F99A1BEEA9}
[2013/01/14 20:52:59 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\R Codes, Output
[2013/01/14 17:17:08 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\Devil's Cut - Ogilvy
[2013/01/14 16:49:31 | 000,000,000 | —D | C] – C:\Users\Jeanette\Documents\R
[2013/01/14 16:16:17 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R
[2013/01/14 16:15:31 | 000,000,000 | —D | C] – C:\Program Files\R
[2013/01/10 09:10:08 | 000,750,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\win32spl.dll
[2013/01/10 09:10:08 | 000,492,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\win32spl.dll
[2013/01/10 09:10:03 | 000,307,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncrypt.dll
[2013/01/10 09:09:27 | 000,800,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\usp10.dll
[2013/01/10 09:09:03 | 000,441,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Wpc.dll
[2013/01/10 09:09:03 | 000,046,592 | —- | C] (Microsoft) – C:\Windows\SysWow64\fpb.rs
[2013/01/10 09:09:03 | 000,046,592 | —- | C] (Microsoft) – C:\Windows\SysNative\fpb.rs
[2013/01/10 09:09:03 | 000,045,568 | —- | C] (Microsoft) – C:\Windows\SysWow64\oflc-nz.rs
[2013/01/10 09:09:03 | 000,045,568 | —- | C] (Microsoft) – C:\Windows\SysNative\oflc-nz.rs
[2013/01/10 09:09:03 | 000,044,544 | —- | C] (Microsoft) – C:\Windows\SysWow64\pegibbfc.rs
[2013/01/10 09:09:03 | 000,044,544 | —- | C] (Microsoft) – C:\Windows\SysNative\pegibbfc.rs
[2013/01/10 09:09:03 | 000,043,520 | —- | C] (Microsoft) – C:\Windows\SysWow64\csrr.rs
[2013/01/10 09:09:03 | 000,043,520 | —- | C] (Microsoft) – C:\Windows\SysNative\csrr.rs
[2013/01/10 09:09:03 | 000,040,960 | —- | C] (Microsoft) – C:\Windows\SysWow64\cob-au.rs
[2013/01/10 09:09:03 | 000,040,960 | —- | C] (Microsoft) – C:\Windows\SysNative\cob-au.rs
[2013/01/10 09:09:03 | 000,030,720 | —- | C] (Microsoft) – C:\Windows\SysWow64\usk.rs
[2013/01/10 09:09:03 | 000,030,720 | —- | C] (Microsoft) – C:\Windows\SysNative\usk.rs
[2013/01/10 09:09:03 | 000,021,504 | —- | C] (Microsoft) – C:\Windows\SysWow64\grb.rs
[2013/01/10 09:09:03 | 000,021,504 | —- | C] (Microsoft) – C:\Windows\SysNative\grb.rs
[2013/01/10 09:09:03 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysWow64\pegi-pt.rs
[2013/01/10 09:09:03 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysNative\pegi-pt.rs
[2013/01/10 09:09:03 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysWow64\pegi.rs
[2013/01/10 09:09:03 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysNative\pegi.rs
[2013/01/10 09:09:03 | 000,015,360 | —- | C] (Microsoft) – C:\Windows\SysWow64\djctq.rs
[2013/01/10 09:09:03 | 000,015,360 | —- | C] (Microsoft) – C:\Windows\SysNative\djctq.rs
[2013/01/10 09:08:58 | 002,746,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\gameux.dll
[2013/01/10 09:08:57 | 002,576,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\gameux.dll
[2013/01/10 09:08:57 | 000,308,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Wpc.dll
[2013/01/10 09:08:53 | 000,055,296 | —- | C] (Microsoft) – C:\Windows\SysWow64\cero.rs
[2013/01/10 09:08:53 | 000,055,296 | —- | C] (Microsoft) – C:\Windows\SysNative\cero.rs
[2013/01/10 09:08:53 | 000,051,712 | —- | C] (Microsoft) – C:\Windows\SysWow64\esrb.rs
[2013/01/10 09:08:53 | 000,051,712 | —- | C] (Microsoft) – C:\Windows\SysNative\esrb.rs
[2013/01/10 09:08:53 | 000,023,552 | —- | C] (Microsoft) – C:\Windows\SysWow64\oflc.rs
[2013/01/10 09:08:53 | 000,023,552 | —- | C] (Microsoft) – C:\Windows\SysNative\oflc.rs
[2013/01/10 09:08:53 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysWow64\pegi-fi.rs
[2013/01/10 09:08:53 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysNative\pegi-fi.rs
[2013/01/10 09:07:32 | 000,424,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KernelBase.dll
[2013/01/10 09:07:30 | 001,161,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[2013/01/10 09:07:29 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64win.dll
[2013/01/10 09:07:29 | 000,338,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\conhost.exe
[2013/01/10 09:07:29 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64.dll
[2013/01/10 09:07:29 | 000,215,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2013/01/10 09:07:29 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntvdm64.dll
[2013/01/10 09:07:29 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2013/01/10 09:07:29 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64cpu.dll
[2013/01/10 09:07:29 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2013/01/10 09:07:29 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2013/01/10 09:07:28 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2013/01/10 09:07:28 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013/01/10 09:07:28 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2013/01/10 09:07:28 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/10 09:07:28 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/10 09:07:28 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/10 09:07:26 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2013/01/10 09:07:26 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2013/01/10 09:07:26 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013/01/10 09:07:26 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/10 09:07:26 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013/01/10 09:07:26 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2013/01/10 09:07:25 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2013/01/10 09:06:37 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskhost.exe
[2013/01/05 15:27:43 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\Oxford Encyclopedia 2012 Update
[2012/12/27 11:58:18 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\Dissertation
[2012/12/26 12:45:27 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\chads work stuff
[2011/06/06 00:49:58 | 000,133,632 | —- | C] (Hewlett-Packard) – C:\Users\Jeanette\hpmco115.dll
[2011/06/06 00:49:22 | 003,077,632 | —- | C] (Hewlett-Packard) – C:\Users\Jeanette\Install.dll
[2011/05/24 04:28:20 | 000,551,424 | —- | C] (Hewlett-Packard) – C:\Users\Jeanette\hpmprein.dll
[2009/02/25 18:59:08 | 000,234,496 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hpmews02.dll
[2009/02/25 18:58:58 | 000,031,768 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hppdgenio.sys
[2009/02/25 18:58:58 | 000,031,256 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hpfx64gen.sys
[2009/02/25 18:58:58 | 000,022,040 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hppdbulkio.sys
[2009/02/25 18:58:58 | 000,020,504 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hpfx64bulk.sys
[2009/02/09 15:49:46 | 000,235,008 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hpmldm02.dll

========== Files - Modified Within 30 Days ==========

[2013/01/22 12:45:22 | 001,307,444 | —- | M] () – C:\Users\Jeanette\Documents\Diamond_Girl_W9.PDF
[2013/01/22 12:42:06 | 000,023,248 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/22 12:42:06 | 000,023,248 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/22 12:35:04 | 000,002,279 | —- | M] () – C:\Users\Jeanette\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/01/22 12:34:28 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/01/22 12:34:02 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/01/22 12:33:57 | 3062,255,616 | -HS- | M] () – C:\hiberfil.sys
[2013/01/22 12:20:14 | 000,002,255 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2013/01/22 12:13:09 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/01/22 12:13:06 | 000,000,902 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/22 11:45:31 | 000,001,254 | —- | M] () – C:\Users\Jeanette\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/01/20 18:49:44 | 000,546,721 | —- | M] () – C:\Users\Jeanette\Desktop\application to rent.pdf
[2013/01/20 18:39:21 | 000,781,205 | —- | M] () – C:\Users\Jeanette\Desktop\anes2011_egss1dta.zip
[2013/01/20 15:35:43 | 001,284,426 | —- | M] () – C:\Users\Jeanette\Desktop\Latinos_in_America_Final_PreTest.sav
[2013/01/17 09:41:01 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2013/01/17 09:21:24 | 005,024,203 | R— | M] (Swearware) – C:\Users\Jeanette\Desktop\ComboFix.exe
[2013/01/15 11:16:56 | 000,008,740 | —- | M] () – C:\Users\Jeanette\Documents\CeciliaHenleyCraveReturnLabel.png
[2013/01/15 11:11:35 | 000,010,157 | —- | M] () – C:\Users\Jeanette\Documents\KellieWoodsReturnLabel.png
[2013/01/14 16:16:17 | 000,001,026 | —- | M] () – C:\Users\Public\Desktop\R x64 2.15.2.lnk
[2013/01/11 15:15:52 | 000,740,814 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/01/11 15:15:52 | 000,624,412 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/01/11 15:15:52 | 000,106,756 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/01/11 10:17:45 | 000,322,024 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/01/10 19:07:26 | 000,000,344 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForJeanette.job
[2013/01/09 18:10:47 | 000,697,864 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/01/09 18:10:47 | 000,074,248 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/12/25 05:24:18 | 000,006,144 | —- | M] () – C:\Users\Jeanette\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== Files Created - No Company Name ==========

[2013/01/22 12:45:20 | 001,307,444 | —- | C] () – C:\Users\Jeanette\Documents\Diamond_Girl_W9.PDF
[2013/01/22 12:20:14 | 000,002,279 | —- | C] () – C:\Users\Jeanette\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/01/22 12:20:14 | 000,002,255 | —- | C] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2013/01/20 18:49:44 | 000,546,721 | —- | C] () – C:\Users\Jeanette\Desktop\application to rent.pdf
[2013/01/20 18:39:20 | 000,781,205 | —- | C] () – C:\Users\Jeanette\Desktop\anes2011_egss1dta.zip
[2013/01/20 16:33:44 | 001,284,426 | —- | C] () – C:\Users\Jeanette\Desktop\Latinos_in_America_Final_PreTest.sav
[2013/01/17 09:22:31 | 000,060,416 | —- | C] () – C:\Windows\NIRCMD.exe
[2013/01/16 16:07:05 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2013/01/16 16:07:01 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2013/01/16 16:07:01 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2013/01/16 16:07:00 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2013/01/16 16:07:00 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2013/01/15 11:16:55 | 000,008,740 | —- | C] () – C:\Users\Jeanette\Documents\CeciliaHenleyCraveReturnLabel.png
[2013/01/15 11:11:34 | 000,010,157 | —- | C] () – C:\Users\Jeanette\Documents\KellieWoodsReturnLabel.png
[2013/01/14 16:16:17 | 000,001,026 | —- | C] () – C:\Users\Public\Desktop\R x64 2.15.2.lnk
[2012/12/25 05:24:18 | 000,006,144 | —- | C] () – C:\Users\Jeanette\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/08 20:44:16 | 000,098,304 | —- | C] () – C:\Windows\SysWow64\redmonnt.dll
[2011/10/17 12:41:33 | 000,000,000 | —- | C] () – C:\Windows\HPMProp.INI
[2011/10/11 05:56:56 | 000,731,106 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/06/24 16:46:50 | 000,235,700 | —- | C] () – C:\Users\Jeanette\hpcu115v.cat
[2011/06/24 16:46:50 | 000,180,327 | —- | C] () – C:\Users\Jeanette\hpzius23.cat
[2011/06/24 16:46:50 | 000,179,886 | —- | C] () – C:\Users\Jeanette\hpmldm02.cat
[2011/06/24 16:46:50 | 000,179,886 | —- | C] () – C:\Users\Jeanette\hpmews02.cat
[2011/06/24 16:46:50 | 000,179,878 | —- | C] () – C:\Users\Jeanette\hpzipa23.cat
[2011/06/24 16:46:50 | 000,179,429 | —- | C] () – C:\Users\Jeanette\hpzid4v4.cat
[2011/06/24 16:46:50 | 000,178,982 | —- | C] () – C:\Users\Jeanette\hpzipr23.cat
[2011/06/24 16:46:50 | 000,178,535 | —- | C] () – C:\Users\Jeanette\hpbuio20l.cat
[2011/06/24 16:46:50 | 000,178,533 | —- | C] () – C:\Users\Jeanette\hppfaxnd.cat
[2011/06/24 16:46:50 | 000,178,531 | —- | C] () – C:\Users\Jeanette\hppscnd.cat
[2011/06/24 16:46:50 | 000,178,531 | —- | C] () – C:\Users\Jeanette\hppewnd.cat
[2011/06/06 01:30:38 | 000,039,125 | —- | C] () – C:\Users\Jeanette\psa4ukww.cab
[2011/06/06 01:30:38 | 000,038,469 | —- | C] () – C:\Users\Jeanette\psa4viww.cab
[2011/06/06 01:30:36 | 000,038,461 | —- | C] () – C:\Users\Jeanette\psa4srww.cab
[2011/06/06 01:30:36 | 000,038,457 | —- | C] () – C:\Users\Jeanette\psa4slww.cab
[2011/06/06 01:30:36 | 000,038,291 | —- | C] () – C:\Users\Jeanette\psa4roww.cab
[2011/06/06 01:30:34 | 000,039,299 | —- | C] () – C:\Users\Jeanette\psa4kkww.cab
[2011/06/06 01:30:34 | 000,038,619 | —- | C] () – C:\Users\Jeanette\psa4lvww.cab
[2011/06/06 01:30:34 | 000,038,487 | —- | C] () – C:\Users\Jeanette\psa4ltww.cab
[2011/06/06 01:30:34 | 000,038,087 | —- | C] () – C:\Users\Jeanette\psa4idww.cab
[2011/06/06 01:30:32 | 000,039,011 | —- | C] () – C:\Users\Jeanette\psa4trww.cab
[2011/06/06 01:30:32 | 000,038,991 | —- | C] () – C:\Users\Jeanette\psa4bgww.cab
[2011/06/06 01:30:32 | 000,038,637 | —- | C] () – C:\Users\Jeanette\psa4thww.cab
[2011/06/06 01:30:32 | 000,038,531 | —- | C] () – C:\Users\Jeanette\psa4hrww.cab
[2011/06/06 01:30:32 | 000,038,509 | —- | C] () – C:\Users\Jeanette\psa4etww.cab
[2011/06/06 01:30:30 | 000,037,885 | —- | C] () – C:\Users\Jeanette\psa4svww.cab
[2011/06/06 01:30:28 | 000,039,977 | —- | C] () – C:\Users\Jeanette\psa4plww.cab
[2011/06/06 01:30:28 | 000,039,205 | —- | C] () – C:\Users\Jeanette\psa4ruww.cab
[2011/06/06 01:30:28 | 000,038,947 | —- | C] () – C:\Users\Jeanette\psa4ptww.cab
[2011/06/06 01:30:28 | 000,038,825 | —- | C] () – C:\Users\Jeanette\psa4skww.cab
[2011/06/06 01:30:28 | 000,038,369 | —- | C] () – C:\Users\Jeanette\psa4nlww.cab
[2011/06/06 01:30:28 | 000,038,223 | —- | C] () – C:\Users\Jeanette\psa4noww.cab
[2011/06/06 01:30:26 | 000,039,739 | —- | C] () – C:\Users\Jeanette\psa4huww.cab
[2011/06/06 01:30:26 | 000,039,239 | —- | C] () – C:\Users\Jeanette\psa4frww.cab
[2011/06/06 01:30:26 | 000,038,427 | —- | C] () – C:\Users\Jeanette\psa4heww.cab
[2011/06/06 01:30:26 | 000,038,205 | —- | C] () – C:\Users\Jeanette\psa4itww.cab
[2011/06/06 01:30:26 | 000,038,001 | —- | C] () – C:\Users\Jeanette\psa4jaww.cab
[2011/06/06 01:30:26 | 000,037,559 | —- | C] () – C:\Users\Jeanette\psa4koww.cab
[2011/06/06 01:30:24 | 000,039,431 | —- | C] () – C:\Users\Jeanette\psa4deww.cab
[2011/06/06 01:30:24 | 000,039,189 | —- | C] () – C:\Users\Jeanette\psa4elww.cab
[2011/06/06 01:30:24 | 000,038,343 | —- | C] () – C:\Users\Jeanette\psa4fiww.cab
[2011/06/06 01:30:24 | 000,038,115 | —- | C] () – C:\Users\Jeanette\psa4esww.cab
[2011/06/06 01:30:24 | 000,037,547 | —- | C] () – C:\Users\Jeanette\psa4enww.cab
[2011/06/06 01:30:22 | 000,039,441 | —- | C] () – C:\Users\Jeanette\psa4csww.cab
[2011/06/06 01:30:22 | 000,038,151 | —- | C] () – C:\Users\Jeanette\psa4daww.cab
[2011/06/06 01:30:22 | 000,038,131 | —- | C] () – C:\Users\Jeanette\psa4caww.cab
[2011/06/06 01:30:22 | 000,036,893 | —- | C] () – C:\Users\Jeanette\psa4zhcn.cab
[2011/06/06 01:30:22 | 000,036,057 | —- | C] () – C:\Users\Jeanette\psa4zhtw.cab
[2011/06/06 01:30:20 | 013,958,690 | —- | C] () – C:\Users\Jeanette\hpcu115v.cab
[2011/06/06 01:30:20 | 000,038,709 | —- | C] () – C:\Users\Jeanette\psa4arww.cab
[2011/06/06 00:27:32 | 000,090,898 | —- | C] () – C:\Users\Jeanette\hpcu115v.inf
[2011/06/02 04:05:24 | 000,001,203 | —- | C] () – C:\Users\Jeanette\hpbuio20l.inf
[2011/06/02 04:04:02 | 000,221,391 | —- | C] () – C:\Users\Jeanette\hpcpu115.cfg
[2011/06/01 11:48:58 | 003,314,688 | —- | C] () – C:\Users\Jeanette\hpbcfgre.dll
[2011/05/24 09:47:04 | 000,001,165 | —- | C] () – C:\Users\Jeanette\hpmprein.config
[2011/05/24 09:47:02 | 000,005,740 | —- | C] () – C:\Users\Jeanette\hppldcoi.config
[2011/05/02 13:45:36 | 000,003,888 | —- | C] () – C:\Users\Jeanette\hppscnd.inf
[2011/04/16 16:02:30 | 000,068,062 | —- | C] () – C:\Users\Jeanette\hpzid4vp.inf
[2011/04/16 16:01:58 | 000,189,098 | —- | C] () – C:\Users\Jeanette\hpzius23.inf
[2011/04/16 16:01:46 | 000,051,648 | —- | C] () – C:\Users\Jeanette\hpzipr23.inf
[2011/04/16 16:01:36 | 000,101,018 | —- | C] () – C:\Users\Jeanette\hpzipa23.inf
[2010/10/29 13:44:04 | 000,002,583 | —- | C] () – C:\Users\Jeanette\hppfaxnd.inf
[2010/10/29 13:43:50 | 000,001,542 | —- | C] () – C:\Users\Jeanette\hppewnd.inf
[2010/09/10 12:38:02 | 000,003,633 | —- | C] () – C:\Users\Jeanette\hpmldm02.inf
[2009/09/10 10:13:10 | 000,007,950 | —- | C] () – C:\Users\Jeanette\hpmews02.inf
[2009/02/25 18:59:08 | 000,000,665 | —- | C] () – C:\Users\Jeanette\hpmldm02.dat
[2009/02/25 18:59:08 | 000,000,648 | —- | C] () – C:\Users\Jeanette\hpmews02.dat

========== ZeroAccess Check ==========

[2009/07/13 20:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/08 21:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 20:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 17:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 04:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 17:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >

Satchfan

Post #38January 22, 2013, 11:38 PM UTC

Only one entry that needs dealt with.

Note: If you have MalwareBytes Anti-Malware 1.6 or higher installed and are using the Pro version or trial version, please temporarily disable it for the duration of this fix as it may interfere with the successfully execution of the script below.

Run OTL

double click on the icon to run it.

copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :Reg [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{24EC05D0-D5B1-44E8-8E5B-1F51795B090D}] :Commands [purity] [emptytemp] [Reboot]

click the Run Fix button at the top
let the program run unhindered, reboot when it is done
please post the OTL fix log and a new OTL log

Logs to include in the next post:

OTL fix log
New OTL log

Can you tell me how your computer is now and if there are any remaining problems.

Satchfan

bustamaj

Post #39January 23, 2013, 11:18 PM UTC

Satchfan, Here is the OTL fix log: All processes killed ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{24EC05D0-D5B1-44E8-8E5B-1F51795B090D}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24EC05D0-D5B1-44E8-8E5B-1F51795B090D}\ not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Jeanette ->Temp folder emptied: 2632365 bytes ->Temporary Internet Files folder emptied: 167125 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Google Chrome cache emptied: 24181099 bytes ->Flash cache emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 33172 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes %systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 26.00 mb OTL by OldTimer - Version 3.2.69.0 log created on 01232013_151421 Files\Folders moved on Reboot… C:\Users\Jeanette\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. PendingFileRenameOperations files… Registry entries deleted on Reboot…

bustamaj

Post #40January 23, 2013, 11:34 PM UTC

Here is the new OTL log:

My windows messenger has archived the notice concerning the Win32/SMall.CA virus I am not sure if this means that it is now removed. As for the computer it seems to be responding quicker. If you say that it is clean then I everything you help me with removed the virus! Thank you.

OTL logfile created on: 1/23/2013 3:18:44 PM - Run 6
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Jeanette\Desktop\WhatTheTech Virus Removal
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.80 Gb Total Physical Memory | 2.18 Gb Available Physical Memory | 57.30% Memory free
7.60 Gb Paging File | 5.70 Gb Available in Paging File | 74.94% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 281.48 Gb Total Space | 175.45 Gb Free Space | 62.33% Space Free | Partition Type: NTFS
Drive D: | 16.32 Gb Total Space | 2.36 Gb Free Space | 14.44% Space Free | Partition Type: NTFS
Drive G: | 99.34 Mb Total Space | 93.54 Mb Free Space | 94.16% Space Free | Partition Type: FAT32

Computer Name: JEANETTE-HP | User Name: Jeanette | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/01/18 00:07:04 | 001,248,208 | —- | M] (Google Inc.) – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2013/01/09 18:57:11 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Jeanette\Desktop\WhatTheTech Virus Removal\OTL.exe
PRC - [2012/12/14 16:49:28 | 000,682,344 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/12/14 16:49:28 | 000,512,360 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/12/14 16:49:28 | 000,398,184 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/12/13 14:26:20 | 003,290,896 | —- | M] (Skype Technologies S.A.) – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/11/12 05:34:40 | 002,869,824 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
PRC - [2012/11/12 05:34:10 | 000,216,640 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
PRC - [2012/07/26 15:53:18 | 004,792,768 | —- | M] (IBM Corp.) – C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe
PRC - [2012/07/26 15:53:18 | 001,472,448 | —- | M] (IBM Corp.) – C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClientUI.exe
PRC - [2012/07/06 10:16:00 | 000,900,160 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
PRC - [2012/07/06 10:15:54 | 000,232,512 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
PRC - [2012/06/15 03:00:37 | 000,139,840 | —- | M] (Sophos Limited) – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
PRC - [2012/05/20 07:50:28 | 000,296,056 | —- | M] (RealNetworks, Inc.) – C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
PRC - [2012/02/28 21:19:42 | 001,781,984 | —- | M] (Trusted Software ApS) – C:\Program Files (x86)\File Type Assistant\tsassist.exe
PRC - [2011/10/26 15:45:40 | 000,787,640 | —- | M] () – C:\Program Files (x86)\FUJIFILM\MyFinePix Studio\dd.exe
PRC - [2010/11/09 15:20:36 | 000,586,296 | —- | M] (Hewlett-Packard Development Company, L.P.) – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
PRC - [2010/11/09 15:20:34 | 000,026,680 | —- | M] (Hewlett-Packard Development Company, L.P.) – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
PRC - [2010/04/09 16:54:38 | 001,441,544 | —- | M] (Motorola, Inc.) – C:\Program Files\Motorola\Bluetooth\btplayerctrl.exe
PRC - [2009/09/30 20:01:32 | 002,320,920 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
PRC - [2009/09/30 20:01:30 | 000,268,824 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
PRC - [2008/11/09 12:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) – C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

========== Modules (No Company Name) ==========

MOD - [2013/01/18 00:07:02 | 000,460,240 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\ppgooglenaclpluginchrome.dll
MOD - [2013/01/18 00:07:01 | 004,012,496 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\pdf.dll
MOD - [2013/01/18 00:06:15 | 000,597,968 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\libglesv2.dll
MOD - [2013/01/18 00:06:15 | 000,124,368 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\libegl.dll
MOD - [2013/01/18 00:06:13 | 001,552,848 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\ffmpegsumo.dll
MOD - [2012/02/20 20:29:04 | 000,087,912 | —- | M] () – C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/02/20 20:28:42 | 001,242,472 | —- | M] () – C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/10/26 15:45:40 | 000,787,640 | —- | M] () – C:\Program Files (x86)\FUJIFILM\MyFinePix Studio\dd.exe

========== Services (SafeList) ==========

SRV:64bit: - [2012/10/08 16:39:16 | 000,230,416 | —- | M] (Nitro PDF Software) [Auto | Running] – C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe – (NitroReaderDriverReadSpool3)
SRV:64bit: - [2010/11/20 00:37:45 | 001,028,096 | —- | M] (Macrovision Europe Ltd.) [On_Demand | Running] – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe – (FLEXnet Licensing Service 64)
SRV:64bit: - [2010/06/29 11:52:12 | 004,181,256 | —- | M] (Motorola, Inc.) [On_Demand | Running] – C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe – (Bluetooth Device Manager)
SRV:64bit: - [2010/06/24 15:24:12 | 000,315,392 | —- | M] (Realtek Semiconductor Corp.) [Auto | Running] – C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe – (RtVOsdService)
SRV:64bit: - [2010/06/18 15:26:18 | 000,103,992 | —- | M] (Hewlett-Packard Company) [Auto | Running] – C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe – (HP Wireless Assistant Service)
SRV:64bit: - [2010/05/20 13:28:14 | 000,677,128 | —- | M] (Motorola, Inc.) [Auto | Running] – C:\Program Files\Motorola\Bluetooth\obexsrv.exe – (Bluetooth OBEX Service)
SRV:64bit: - [2010/05/20 13:28:12 | 001,096,968 | —- | M] (Motorola, Inc.) [On_Demand | Running] – C:\Program Files\Motorola\Bluetooth\audiosrv.exe – (Bluetooth Media Service)
SRV:64bit: - [2009/11/17 18:14:26 | 000,098,208 | —- | M] (Andrea Electronics Corporation) [Auto | Running] – C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe – (AERTFilters)
SRV:64bit: - [2009/07/13 17:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2013/01/09 18:10:51 | 000,251,400 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/14 16:49:28 | 000,682,344 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe – (MBAMService)
SRV - [2012/12/14 16:49:28 | 000,398,184 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe – (MBAMScheduler)
SRV - [2012/12/13 14:26:20 | 003,290,896 | —- | M] (Skype Technologies S.A.) [Auto | Running] – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe – (Skype C2C Service)
SRV - [2012/11/12 05:34:40 | 002,869,824 | —- | M] (Sophos Limited) [Auto | Running] – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe – (swi_service)
SRV - [2012/11/12 05:34:37 | 001,998,400 | —- | M] (Sophos Limited) [Auto | Stopped] – C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe – (swi_update_64)
SRV - [2012/11/12 05:34:10 | 000,216,640 | —- | M] (Sophos Limited) [Auto | Running] – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe – (SAVAdminService)
SRV - [2012/09/27 11:55:16 | 000,086,528 | —- | M] (Hewlett-Packard Company) [Auto | Running] – C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe – (HP Support Assistant Service)
SRV - [2012/07/26 15:53:18 | 004,792,768 | —- | M] (IBM Corp.) [Auto | Running] – C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe – (BESClient)
SRV - [2012/07/06 10:15:54 | 000,232,512 | —- | M] (Sophos Limited) [Auto | Running] – C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe – (Sophos AutoUpdate Service)
SRV - [2012/06/15 03:00:37 | 000,139,840 | —- | M] (Sophos Limited) [Auto | Running] – C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe – (SAVService)
SRV - [2012/04/30 13:19:43 | 000,129,976 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2010/11/20 00:37:44 | 000,647,680 | —- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe – (FLEXnet Licensing Service)
SRV - [2010/11/09 15:20:34 | 000,026,680 | —- | M] (Hewlett-Packard Development Company, L.P.) [Auto | Running] – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe – (HPWMISVC)
SRV - [2010/04/03 15:01:24 | 000,246,520 | —- | M] (WildTangent, Inc.) [On_Demand | Stopped] – C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe – (GameConsoleService)
SRV - [2010/03/18 12:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/09/30 20:01:32 | 002,320,920 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe – (UNS)
SRV - [2009/09/30 20:01:30 | 000,268,824 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe – (LMS)
SRV - [2009/06/10 13:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)
SRV - [2008/11/09 12:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Auto | Running] – C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/12/14 16:49:28 | 000,024,176 | —- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] – C:\Windows\SysNative\drivers\mbam.sys – (MBAMProtector)
DRV:64bit: - [2012/06/15 03:00:32 | 000,144,672 | —- | M] (Sophos Limited) [File_System | System | Running] – C:\Windows\SysNative\drivers\savonaccess.sys – (SAVOnAccess)
DRV:64bit: - [2012/02/29 22:46:16 | 000,023,408 | —- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] – C:\Windows\SysNative\drivers\fs_rec.sys – (Fs_Rec)
DRV:64bit: - [2012/02/15 11:06:39 | 001,390,640 | —- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\SynTP.sys – (SynTP)
DRV:64bit: - [2012/02/15 10:01:50 | 000,052,736 | —- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\usbaapl64.sys – (USBAAPL64)
DRV:64bit: - [2011/11/15 14:44:49 | 000,158,976 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Impcd.sys – (Impcd)
DRV:64bit: - [2011/10/23 07:01:40 | 000,036,640 | —- | M] (Sophos Limited) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\sdcfilter.sys – (sdcfilter)
DRV:64bit: - [2011/10/23 07:01:28 | 000,025,608 | —- | M] (Sophos Plc) [Kernel | Disabled | Stopped] – C:\Windows\SysNative\drivers\SophosBootDriver.sys – (SophosBootDriver)
DRV:64bit: - [2011/10/11 12:00:44 | 000,271,424 | —- | M] (DT Soft Ltd) [Kernel | System | Running] – C:\Windows\SysNative\drivers\dtsoftbus01.sys – (dtsoftbus01)
DRV:64bit: - [2011/03/10 22:41:12 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/03/10 22:41:12 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2010/11/20 05:33:35 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2010/11/20 03:07:05 | 000,059,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2010/11/20 01:37:42 | 000,109,056 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\sdbus.sys – (sdbus)
DRV:64bit: - [2010/11/04 20:57:54 | 001,041,760 | —- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\netr28x.sys – (netr28x)
DRV:64bit: - [2010/06/29 10:12:26 | 003,232,768 | —- | M] (Motorola, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\btmusb.sys – (BTMUSB)
DRV:64bit: - [2010/05/07 11:19:58 | 000,245,792 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\RtsUStor.sys – (RSUSBSTOR)
DRV:64bit: - [2010/04/13 09:44:22 | 000,540,696 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\iaStor.sys – (iaStor)
DRV:64bit: - [2010/04/09 16:53:04 | 000,052,736 | —- | M] (Motorola, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\btmcom.sys – (BTMCOM)
DRV:64bit: - [2010/03/22 17:57:20 | 000,347,680 | —- | M] (Realtek ) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Rt64win7.sys – (RTL8167)
DRV:64bit: - [2010/03/05 11:57:18 | 000,271,872 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\IntcDAud.sys – (IntcDAud)
DRV:64bit: - [2010/03/05 11:57:00 | 010,300,800 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\igdkmd64.sys – (igfx)
DRV:64bit: - [2010/02/08 07:32:00 | 000,014,992 | —- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\CVirtA64.sys – (CVirtA)
DRV:64bit: - [2009/09/17 12:54:54 | 000,056,344 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\HECIx64.sys – (HECIx64)
DRV:64bit: - [2009/07/13 17:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/13 17:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/13 17:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/06/10 13:01:11 | 001,485,312 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\VSTDPV6.SYS – (SrvHsfV92)
DRV:64bit: - [2009/06/10 13:01:11 | 000,740,864 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\VSTCNXT6.SYS – (SrvHsfWinac)
DRV:64bit: - [2009/06/10 13:01:11 | 000,292,864 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\VSTAZL6.SYS – (SrvHsfHDA)
DRV:64bit: - [2009/06/10 12:35:33 | 000,389,120 | —- | M] (Marvell) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\yk62x64.sys – (yukonw7)
DRV:64bit: - [2009/06/10 12:35:28 | 005,434,368 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\netw5v64.sys – (netw5v64)
DRV:64bit: - [2009/06/10 12:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 12:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 12:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 12:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009/05/18 12:17:08 | 000,034,152 | —- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\GEARAspiWDM.sys – (GEARAspiWDM)
DRV:64bit: - [2008/11/16 17:39:44 | 000,157,968 | —- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\SysNative\drivers\dne64x.sys – (DNE)
DRV:64bit: - [2008/04/16 14:49:34 | 000,028,416 | —- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\RimUsb_AMD64.sys – (RimUsb)
DRV - [2009/07/13 17:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
IE - HKCU\..\SearchScopes,DefaultScope = {24EC05D0-D5B1-44E8-8E5B-1F51795B090D}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10516.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: c:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2013/01/09 16:33:32 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2013/01/09 16:33:32 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/11/02 09:27:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2012/04/30 18:45:25 | 000,000,000 | —D | M] (No name found) – C:\Users\Jeanette\AppData\Roaming\Mozilla\Extensions
[2013/01/14 14:16:19 | 000,000,000 | —D | M] (No name found) – C:\Users\Jeanette\AppData\Roaming\Mozilla\Firefox\Profiles\cx2mh8cc.default\extensions
[2012/11/30 09:46:00 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/12/14 21:07:18 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/04/30 13:19:43 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/03/12 20:38:32 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/03/12 20:38:32 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter},
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\pdf.dll
CHR - plugin: Skype Click to Call (Enabled) = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.5.0.11422_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U20 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll
CHR - plugin: Nitro PDF plugin for Firefox and Chrome (Enabled) = C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll
CHR - plugin: TVU Web Player for FireFox (Enabled) = C:\Windows\system32\TVUAx\npTVUAx.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.10516.0\npctrl.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll
CHR - plugin: RealPlayer Download Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll
CHR - Extension: Google Docs = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.4_0\
CHR - Extension: Google Drive = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Gmail = C:\Users\Jeanette\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2013/01/17 09:41:01 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files\Motorola\Bluetooth\btmshell.dll (Motorola, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [HPWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe ()
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe (Sophos Limited)
O4 - HKLM..\Run: [TkBellExe] c:\program files (x86)\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [Device Detection] C:\Program Files (x86)\FUJIFILM\MyFinePix Studio\dd.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9:64bit: - Extra Button: @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()
O9 - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000020 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll (Sophos Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.5.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B1798265-C47A-43C3-80FD-E2874EFB3A75}: DhcpNameServer = 192.168.5.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D8EC507C-08E5-4F26-891F-323A4C761BDB}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured_x64.dll) - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll (Sophos Limited)
O20 - AppInit_DLLs: (C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured.dll) - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Limited)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/01/22 12:29:47 | 000,000,000 | —D | C] – C:\_OTL
[2013/01/22 12:20:14 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013/01/21 15:12:27 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Roaming\Malwarebytes
[2013/01/21 15:12:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/01/21 15:12:16 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2013/01/21 15:12:15 | 000,024,176 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2013/01/21 15:12:15 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/01/21 15:11:34 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\Programs
[2013/01/18 08:28:59 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2013/01/17 09:50:21 | 000,000,000 | —D | C] – C:\Windows\temp
[2013/01/16 16:07:01 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2013/01/16 16:07:00 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2013/01/16 16:05:51 | 000,000,000 | —D | C] – C:\Qoobox
[2013/01/16 16:05:26 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2013/01/16 16:01:10 | 005,024,203 | R— | C] (Swearware) – C:\Users\Jeanette\Desktop\ComboFix.exe
[2013/01/16 15:26:55 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\WhatTheTech Virus Removal
[2013/01/16 10:51:40 | 000,000,000 | —D | C] – C:\ProgramData\BigFix
[2013/01/16 10:46:15 | 000,000,000 | —D | C] – C:\Windows\ERUNT
[2013/01/16 10:45:07 | 000,000,000 | —D | C] – C:\JRT
[2013/01/16 08:24:08 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{99FBEC18-EC05-4644-8E1A-B7FDE9348A92}
[2013/01/15 16:45:14 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\Latinos in America Data
[2013/01/15 09:38:28 | 000,000,000 | —D | C] – C:\Users\Jeanette\AppData\Local\{075D76D7-48E8-44DA-A26C-E6F99A1BEEA9}
[2013/01/14 20:52:59 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\R Codes, Output
[2013/01/14 17:17:08 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\Devil's Cut - Ogilvy
[2013/01/14 16:49:31 | 000,000,000 | —D | C] – C:\Users\Jeanette\Documents\R
[2013/01/14 16:16:17 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R
[2013/01/14 16:15:31 | 000,000,000 | —D | C] – C:\Program Files\R
[2013/01/10 09:10:08 | 000,750,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\win32spl.dll
[2013/01/10 09:10:08 | 000,492,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\win32spl.dll
[2013/01/10 09:10:03 | 000,307,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncrypt.dll
[2013/01/10 09:09:27 | 000,800,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\usp10.dll
[2013/01/10 09:09:03 | 000,441,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Wpc.dll
[2013/01/10 09:09:03 | 000,046,592 | —- | C] (Microsoft) – C:\Windows\SysWow64\fpb.rs
[2013/01/10 09:09:03 | 000,046,592 | —- | C] (Microsoft) – C:\Windows\SysNative\fpb.rs
[2013/01/10 09:09:03 | 000,045,568 | —- | C] (Microsoft) – C:\Windows\SysWow64\oflc-nz.rs
[2013/01/10 09:09:03 | 000,045,568 | —- | C] (Microsoft) – C:\Windows\SysNative\oflc-nz.rs
[2013/01/10 09:09:03 | 000,044,544 | —- | C] (Microsoft) – C:\Windows\SysWow64\pegibbfc.rs
[2013/01/10 09:09:03 | 000,044,544 | —- | C] (Microsoft) – C:\Windows\SysNative\pegibbfc.rs
[2013/01/10 09:09:03 | 000,043,520 | —- | C] (Microsoft) – C:\Windows\SysWow64\csrr.rs
[2013/01/10 09:09:03 | 000,043,520 | —- | C] (Microsoft) – C:\Windows\SysNative\csrr.rs
[2013/01/10 09:09:03 | 000,040,960 | —- | C] (Microsoft) – C:\Windows\SysWow64\cob-au.rs
[2013/01/10 09:09:03 | 000,040,960 | —- | C] (Microsoft) – C:\Windows\SysNative\cob-au.rs
[2013/01/10 09:09:03 | 000,030,720 | —- | C] (Microsoft) – C:\Windows\SysWow64\usk.rs
[2013/01/10 09:09:03 | 000,030,720 | —- | C] (Microsoft) – C:\Windows\SysNative\usk.rs
[2013/01/10 09:09:03 | 000,021,504 | —- | C] (Microsoft) – C:\Windows\SysWow64\grb.rs
[2013/01/10 09:09:03 | 000,021,504 | —- | C] (Microsoft) – C:\Windows\SysNative\grb.rs
[2013/01/10 09:09:03 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysWow64\pegi-pt.rs
[2013/01/10 09:09:03 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysNative\pegi-pt.rs
[2013/01/10 09:09:03 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysWow64\pegi.rs
[2013/01/10 09:09:03 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysNative\pegi.rs
[2013/01/10 09:09:03 | 000,015,360 | —- | C] (Microsoft) – C:\Windows\SysWow64\djctq.rs
[2013/01/10 09:09:03 | 000,015,360 | —- | C] (Microsoft) – C:\Windows\SysNative\djctq.rs
[2013/01/10 09:08:58 | 002,746,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\gameux.dll
[2013/01/10 09:08:57 | 002,576,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\gameux.dll
[2013/01/10 09:08:57 | 000,308,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Wpc.dll
[2013/01/10 09:08:53 | 000,055,296 | —- | C] (Microsoft) – C:\Windows\SysWow64\cero.rs
[2013/01/10 09:08:53 | 000,055,296 | —- | C] (Microsoft) – C:\Windows\SysNative\cero.rs
[2013/01/10 09:08:53 | 000,051,712 | —- | C] (Microsoft) – C:\Windows\SysWow64\esrb.rs
[2013/01/10 09:08:53 | 000,051,712 | —- | C] (Microsoft) – C:\Windows\SysNative\esrb.rs
[2013/01/10 09:08:53 | 000,023,552 | —- | C] (Microsoft) – C:\Windows\SysWow64\oflc.rs
[2013/01/10 09:08:53 | 000,023,552 | —- | C] (Microsoft) – C:\Windows\SysNative\oflc.rs
[2013/01/10 09:08:53 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysWow64\pegi-fi.rs
[2013/01/10 09:08:53 | 000,020,480 | —- | C] (Microsoft) – C:\Windows\SysNative\pegi-fi.rs
[2013/01/10 09:07:32 | 000,424,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KernelBase.dll
[2013/01/10 09:07:30 | 001,161,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[2013/01/10 09:07:29 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64win.dll
[2013/01/10 09:07:29 | 000,338,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\conhost.exe
[2013/01/10 09:07:29 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64.dll
[2013/01/10 09:07:29 | 000,215,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2013/01/10 09:07:29 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntvdm64.dll
[2013/01/10 09:07:29 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2013/01/10 09:07:29 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64cpu.dll
[2013/01/10 09:07:29 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2013/01/10 09:07:29 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2013/01/10 09:07:28 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2013/01/10 09:07:28 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013/01/10 09:07:28 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2013/01/10 09:07:28 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/10 09:07:28 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/10 09:07:28 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/10 09:07:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/10 09:07:27 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2013/01/10 09:07:27 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/10 09:07:26 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2013/01/10 09:07:26 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2013/01/10 09:07:26 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013/01/10 09:07:26 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/10 09:07:26 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013/01/10 09:07:26 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013/01/10 09:07:26 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2013/01/10 09:07:25 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2013/01/10 09:06:37 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskhost.exe
[2013/01/05 15:27:43 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\Oxford Encyclopedia 2012 Update
[2012/12/27 11:58:18 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\Dissertation
[2012/12/26 12:45:27 | 000,000,000 | —D | C] – C:\Users\Jeanette\Desktop\chads work stuff
[2011/06/06 00:49:58 | 000,133,632 | —- | C] (Hewlett-Packard) – C:\Users\Jeanette\hpmco115.dll
[2011/06/06 00:49:22 | 003,077,632 | —- | C] (Hewlett-Packard) – C:\Users\Jeanette\Install.dll
[2011/05/24 04:28:20 | 000,551,424 | —- | C] (Hewlett-Packard) – C:\Users\Jeanette\hpmprein.dll
[2009/02/25 18:59:08 | 000,234,496 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hpmews02.dll
[2009/02/25 18:58:58 | 000,031,768 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hppdgenio.sys
[2009/02/25 18:58:58 | 000,031,256 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hpfx64gen.sys
[2009/02/25 18:58:58 | 000,022,040 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hppdbulkio.sys
[2009/02/25 18:58:58 | 000,020,504 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hpfx64bulk.sys
[2009/02/09 15:49:46 | 000,235,008 | —- | C] (Hewlett Packard) – C:\Users\Jeanette\hpmldm02.dll

========== Files - Modified Within 30 Days ==========

[2013/01/23 15:29:26 | 000,023,248 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/23 15:29:26 | 000,023,248 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/23 15:15:52 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/01/23 15:15:19 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/01/23 15:15:15 | 3062,255,616 | -HS- | M] () – C:\hiberfil.sys
[2013/01/23 15:13:03 | 000,000,902 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/23 15:08:15 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/01/22 14:36:24 | 000,094,734 | —- | M] () – C:\Users\Jeanette\Desktop\doc_diss_rdg_ctte.pdf
[2013/01/22 12:45:22 | 001,307,444 | —- | M] () – C:\Users\Jeanette\Documents\Diamond_Girl_W9.PDF
[2013/01/22 12:35:04 | 000,002,279 | —- | M] () – C:\Users\Jeanette\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/01/22 12:20:14 | 000,002,255 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2013/01/22 11:45:31 | 000,001,254 | —- | M] () – C:\Users\Jeanette\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/01/20 18:49:44 | 000,546,721 | —- | M] () – C:\Users\Jeanette\Desktop\application to rent.pdf
[2013/01/20 18:39:21 | 000,781,205 | —- | M] () – C:\Users\Jeanette\Desktop\anes2011_egss1dta.zip
[2013/01/17 09:41:01 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2013/01/17 09:21:24 | 005,024,203 | R— | M] (Swearware) – C:\Users\Jeanette\Desktop\ComboFix.exe
[2013/01/15 11:16:56 | 000,008,740 | —- | M] () – C:\Users\Jeanette\Documents\CeciliaHenleyCraveReturnLabel.png
[2013/01/15 11:11:35 | 000,010,157 | —- | M] () – C:\Users\Jeanette\Documents\KellieWoodsReturnLabel.png
[2013/01/14 16:16:17 | 000,001,026 | —- | M] () – C:\Users\Public\Desktop\R x64 2.15.2.lnk
[2013/01/11 15:15:52 | 000,740,814 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/01/11 15:15:52 | 000,624,412 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/01/11 15:15:52 | 000,106,756 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/01/11 10:17:45 | 000,322,024 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/01/10 19:07:26 | 000,000,344 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForJeanette.job
[2013/01/09 18:10:47 | 000,697,864 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/01/09 18:10:47 | 000,074,248 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/12/25 05:24:18 | 000,006,144 | —- | M] () – C:\Users\Jeanette\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== Files Created - No Company Name ==========

[2013/01/22 14:36:23 | 000,094,734 | —- | C] () – C:\Users\Jeanette\Desktop\doc_diss_rdg_ctte.pdf
[2013/01/22 12:45:20 | 001,307,444 | —- | C] () – C:\Users\Jeanette\Documents\Diamond_Girl_W9.PDF
[2013/01/22 12:20:14 | 000,002,279 | —- | C] () – C:\Users\Jeanette\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/01/22 12:20:14 | 000,002,255 | —- | C] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2013/01/20 18:49:44 | 000,546,721 | —- | C] () – C:\Users\Jeanette\Desktop\application to rent.pdf
[2013/01/20 18:39:20 | 000,781,205 | —- | C] () – C:\Users\Jeanette\Desktop\anes2011_egss1dta.zip
[2013/01/17 09:22:31 | 000,060,416 | —- | C] () – C:\Windows\NIRCMD.exe
[2013/01/16 16:07:05 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2013/01/16 16:07:01 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2013/01/16 16:07:01 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2013/01/16 16:07:00 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2013/01/16 16:07:00 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2013/01/15 11:16:55 | 000,008,740 | —- | C] () – C:\Users\Jeanette\Documents\CeciliaHenleyCraveReturnLabel.png
[2013/01/15 11:11:34 | 000,010,157 | —- | C] () – C:\Users\Jeanette\Documents\KellieWoodsReturnLabel.png
[2013/01/14 16:16:17 | 000,001,026 | —- | C] () – C:\Users\Public\Desktop\R x64 2.15.2.lnk
[2012/12/25 05:24:18 | 000,006,144 | —- | C] () – C:\Users\Jeanette\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/08 20:44:16 | 000,098,304 | —- | C] () – C:\Windows\SysWow64\redmonnt.dll
[2011/10/17 12:41:33 | 000,000,000 | —- | C] () – C:\Windows\HPMProp.INI
[2011/10/11 05:56:56 | 000,731,106 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/06/24 16:46:50 | 000,235,700 | —- | C] () – C:\Users\Jeanette\hpcu115v.cat
[2011/06/24 16:46:50 | 000,180,327 | —- | C] () – C:\Users\Jeanette\hpzius23.cat
[2011/06/24 16:46:50 | 000,179,886 | —- | C] () – C:\Users\Jeanette\hpmldm02.cat
[2011/06/24 16:46:50 | 000,179,886 | —- | C] () – C:\Users\Jeanette\hpmews02.cat
[2011/06/24 16:46:50 | 000,179,878 | —- | C] () – C:\Users\Jeanette\hpzipa23.cat
[2011/06/24 16:46:50 | 000,179,429 | —- | C] () – C:\Users\Jeanette\hpzid4v4.cat
[2011/06/24 16:46:50 | 000,178,982 | —- | C] () – C:\Users\Jeanette\hpzipr23.cat
[2011/06/24 16:46:50 | 000,178,535 | —- | C] () – C:\Users\Jeanette\hpbuio20l.cat
[2011/06/24 16:46:50 | 000,178,533 | —- | C] () – C:\Users\Jeanette\hppfaxnd.cat
[2011/06/24 16:46:50 | 000,178,531 | —- | C] () – C:\Users\Jeanette\hppscnd.cat
[2011/06/24 16:46:50 | 000,178,531 | —- | C] () – C:\Users\Jeanette\hppewnd.cat
[2011/06/06 01:30:38 | 000,039,125 | —- | C] () – C:\Users\Jeanette\psa4ukww.cab
[2011/06/06 01:30:38 | 000,038,469 | —- | C] () – C:\Users\Jeanette\psa4viww.cab
[2011/06/06 01:30:36 | 000,038,461 | —- | C] () – C:\Users\Jeanette\psa4srww.cab
[2011/06/06 01:30:36 | 000,038,457 | —- | C] () – C:\Users\Jeanette\psa4slww.cab
[2011/06/06 01:30:36 | 000,038,291 | —- | C] () – C:\Users\Jeanette\psa4roww.cab
[2011/06/06 01:30:34 | 000,039,299 | —- | C] () – C:\Users\Jeanette\psa4kkww.cab
[2011/06/06 01:30:34 | 000,038,619 | —- | C] () – C:\Users\Jeanette\psa4lvww.cab
[2011/06/06 01:30:34 | 000,038,487 | —- | C] () – C:\Users\Jeanette\psa4ltww.cab
[2011/06/06 01:30:34 | 000,038,087 | —- | C] () – C:\Users\Jeanette\psa4idww.cab
[2011/06/06 01:30:32 | 000,039,011 | —- | C] () – C:\Users\Jeanette\psa4trww.cab
[2011/06/06 01:30:32 | 000,038,991 | —- | C] () – C:\Users\Jeanette\psa4bgww.cab
[2011/06/06 01:30:32 | 000,038,637 | —- | C] () – C:\Users\Jeanette\psa4thww.cab
[2011/06/06 01:30:32 | 000,038,531 | —- | C] () – C:\Users\Jeanette\psa4hrww.cab
[2011/06/06 01:30:32 | 000,038,509 | —- | C] () – C:\Users\Jeanette\psa4etww.cab
[2011/06/06 01:30:30 | 000,037,885 | —- | C] () – C:\Users\Jeanette\psa4svww.cab
[2011/06/06 01:30:28 | 000,039,977 | —- | C] () – C:\Users\Jeanette\psa4plww.cab
[2011/06/06 01:30:28 | 000,039,205 | —- | C] () – C:\Users\Jeanette\psa4ruww.cab
[2011/06/06 01:30:28 | 000,038,947 | —- | C] () – C:\Users\Jeanette\psa4ptww.cab
[2011/06/06 01:30:28 | 000,038,825 | —- | C] () – C:\Users\Jeanette\psa4skww.cab
[2011/06/06 01:30:28 | 000,038,369 | —- | C] () – C:\Users\Jeanette\psa4nlww.cab
[2011/06/06 01:30:28 | 000,038,223 | —- | C] () – C:\Users\Jeanette\psa4noww.cab
[2011/06/06 01:30:26 | 000,039,739 | —- | C] () – C:\Users\Jeanette\psa4huww.cab
[2011/06/06 01:30:26 | 000,039,239 | —- | C] () – C:\Users\Jeanette\psa4frww.cab
[2011/06/06 01:30:26 | 000,038,427 | —- | C] () – C:\Users\Jeanette\psa4heww.cab
[2011/06/06 01:30:26 | 000,038,205 | —- | C] () – C:\Users\Jeanette\psa4itww.cab
[2011/06/06 01:30:26 | 000,038,001 | —- | C] () – C:\Users\Jeanette\psa4jaww.cab
[2011/06/06 01:30:26 | 000,037,559 | —- | C] () – C:\Users\Jeanette\psa4koww.cab
[2011/06/06 01:30:24 | 000,039,431 | —- | C] () – C:\Users\Jeanette\psa4deww.cab
[2011/06/06 01:30:24 | 000,039,189 | —- | C] () – C:\Users\Jeanette\psa4elww.cab
[2011/06/06 01:30:24 | 000,038,343 | —- | C] () – C:\Users\Jeanette\psa4fiww.cab
[2011/06/06 01:30:24 | 000,038,115 | —- | C] () – C:\Users\Jeanette\psa4esww.cab
[2011/06/06 01:30:24 | 000,037,547 | —- | C] () – C:\Users\Jeanette\psa4enww.cab
[2011/06/06 01:30:22 | 000,039,441 | —- | C] () – C:\Users\Jeanette\psa4csww.cab
[2011/06/06 01:30:22 | 000,038,151 | —- | C] () – C:\Users\Jeanette\psa4daww.cab
[2011/06/06 01:30:22 | 000,038,131 | —- | C] () – C:\Users\Jeanette\psa4caww.cab
[2011/06/06 01:30:22 | 000,036,893 | —- | C] () – C:\Users\Jeanette\psa4zhcn.cab
[2011/06/06 01:30:22 | 000,036,057 | —- | C] () – C:\Users\Jeanette\psa4zhtw.cab
[2011/06/06 01:30:20 | 013,958,690 | —- | C] () – C:\Users\Jeanette\hpcu115v.cab
[2011/06/06 01:30:20 | 000,038,709 | —- | C] () – C:\Users\Jeanette\psa4arww.cab
[2011/06/06 00:27:32 | 000,090,898 | —- | C] () – C:\Users\Jeanette\hpcu115v.inf
[2011/06/02 04:05:24 | 000,001,203 | —- | C] () – C:\Users\Jeanette\hpbuio20l.inf
[2011/06/02 04:04:02 | 000,221,391 | —- | C] () – C:\Users\Jeanette\hpcpu115.cfg
[2011/06/01 11:48:58 | 003,314,688 | —- | C] () – C:\Users\Jeanette\hpbcfgre.dll
[2011/05/24 09:47:04 | 000,001,165 | —- | C] () – C:\Users\Jeanette\hpmprein.config
[2011/05/24 09:47:02 | 000,005,740 | —- | C] () – C:\Users\Jeanette\hppldcoi.config
[2011/05/02 13:45:36 | 000,003,888 | —- | C] () – C:\Users\Jeanette\hppscnd.inf
[2011/04/16 16:02:30 | 000,068,062 | —- | C] () – C:\Users\Jeanette\hpzid4vp.inf
[2011/04/16 16:01:58 | 000,189,098 | —- | C] () – C:\Users\Jeanette\hpzius23.inf
[2011/04/16 16:01:46 | 000,051,648 | —- | C] () – C:\Users\Jeanette\hpzipr23.inf
[2011/04/16 16:01:36 | 000,101,018 | —- | C] () – C:\Users\Jeanette\hpzipa23.inf
[2010/10/29 13:44:04 | 000,002,583 | —- | C] () – C:\Users\Jeanette\hppfaxnd.inf
[2010/10/29 13:43:50 | 000,001,542 | —- | C] () – C:\Users\Jeanette\hppewnd.inf
[2010/09/10 12:38:02 | 000,003,633 | —- | C] () – C:\Users\Jeanette\hpmldm02.inf
[2009/09/10 10:13:10 | 000,007,950 | —- | C] () – C:\Users\Jeanette\hpmews02.inf
[2009/02/25 18:59:08 | 000,000,665 | —- | C] () – C:\Users\Jeanette\hpmldm02.dat
[2009/02/25 18:59:08 | 000,000,648 | —- | C] () – C:\Users\Jeanette\hpmews02.dat

========== ZeroAccess Check ==========

[2009/07/13 20:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/08 21:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 20:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 17:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 04:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 17:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >

Satchfan

Post #41January 23, 2013, 11:58 PM UTC

Hello bustamaj

I can’t see any sign of anything bad on here now and a final online scan should help to confirm it.

Run ESET Online Scan

IMPORTANT Please make sure you uncheck the box next to Remove found threats. Eset will detect anything that looks even slightly suspicious, which could include legitimate program files. If you do not uncheck the box, Eset will automatically remove all suspicious files which could leave some of your software inoperable.

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.

3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - if ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.

As before, it’s late here now and I need my beauty sleep so won’t reply tonight.

Satchfan

bustamaj

Post #42January 24, 2013, 12:02 AM UTC

Satchfan, My Sophos Anti Virus has a "Shop to Win" adware program in its quarantine folder that will not let me delete it. Do you know how I can get rid of this adware program? Thank you, Jeanette

Satchfan

Post #43January 24, 2013, 7:57 AM UTC

This article may help.

There is a link to "configure what actions you can perform" referring to Configuring user rights for Quarantine manager.

I'll wait for the result of the Eset scan.

bustamaj

Post #44January 25, 2013, 12:29 AM UTC

Hello Satchfan, I am currently running the online scan it has just been going for an hour and a half and only 28% complete. I wanted to keep you updated that I am running it and willmpostnlogs once it finishes. I know you are probably sleeping. Best, Jeanette

Satchfan

Post #45January 25, 2013, 8:46 AM UTC last edited January 25, 2013, 8:46 AM UTC

Hi Jeanette Thanks for letting me know. It can take a few hours, depending on the size of your hard drive. Let me know if you have a problem and I'll advise a different scan.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Win32/Small.CA [Solved]

✨ Ask AI

Ask AI