please help slow comp [Closed]

please help, my comp has slowed down and unresponsive. The Norton security says my system is using a lot of memory or something like that to.


================================================================================
============

OTL logfile created on: 11/01/2013 7:48:00 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Won\Downloads
64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16453)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

1.88 Gb Total Physical Memory | 0.74 Gb Available Physical Memory | 39.49% Memory free
4.59 Gb Paging File | 3.10 Gb Available in Paging File | 67.51% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 275.30 Gb Total Space | 232.45 Gb Free Space | 84.44% Space Free | Partition Type: NTFS
Drive D: | 22.02 Gb Total Space | 2.69 Gb Free Space | 12.20% Space Free | Partition Type: NTFS
Drive E: | 317.12 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: COMPUTER | User Name: Won | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Won\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Norton Internet Security\Engine\20.2.0.19\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (CyberLink)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe (CyberLink)
PRC - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll ()
MOD - C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll ()
MOD - C:\Program Files (x86)\Norton Internet Security\Engine\20.2.0.19\wincfi39.dll ()


========== Services (SafeList) ==========

SRV:64bit: - (PrintNotify) – C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll (Microsoft Corporation)
SRV:64bit: - (AudioEndpointBuilder) – C:\Windows\SysNative\AudioEndpointBuilder.dll (Microsoft Corporation)
SRV:64bit: - (WSService) – C:\Windows\SysNative\WSService.dll (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (wlidsvc) – C:\Windows\SysNative\wlidsvc.dll (Microsoft Corporation)
SRV:64bit: - (WiaRpc) – C:\Windows\SysNative\wiarpc.dll (Microsoft Corporation)
SRV:64bit: - (Wcmsvc) – C:\Windows\SysNative\wcmsvc.dll (Microsoft Corporation)
SRV:64bit: - (VaultSvc) – C:\Windows\SysNative\vaultsvc.dll (Microsoft Corporation)
SRV:64bit: - (TimeBroker) – C:\Windows\SysNative\TimeBrokerServer.dll (Microsoft Corporation)
SRV:64bit: - (SystemEventsBroker) – C:\Windows\SysNative\SystemEventsBrokerServer.dll (Microsoft Corporation)
SRV:64bit: - (svsvc) – C:\Windows\SysNative\svsvc.dll (Microsoft Corporation)
SRV:64bit: - (netprofm) – C:\Windows\SysNative\netprofmsvc.dll (Microsoft Corporation)
SRV:64bit: - (Netlogon) – C:\Windows\SysNative\netlogon.dll (Microsoft Corporation)
SRV:64bit: - (NcaSvc) – C:\Windows\SysNative\NcaSvc.dll (Microsoft Corporation)
SRV:64bit: - (NcdAutoSetup) – C:\Windows\SysNative\NcdAutoSetup.dll (Microsoft Corporation)
SRV:64bit: - (LSM) – C:\Windows\SysNative\lsm.dll (Microsoft Corporation)
SRV:64bit: - (KeyIso) – C:\Windows\SysNative\keyiso.dll (Microsoft Corporation)
SRV:64bit: - (fhsvc) – C:\Windows\SysNative\fhsvc.dll (Microsoft Corporation)
SRV:64bit: - (EFS) – C:\Windows\SysNative\efssvc.dll (Microsoft Corporation)
SRV:64bit: - (DsmSvc) – C:\Windows\SysNative\DeviceSetupManager.dll (Microsoft Corporation)
SRV:64bit: - (DeviceAssociationService) – C:\Windows\SysNative\das.dll (Microsoft Corporation)
SRV:64bit: - (BrokerInfrastructure) – C:\Windows\SysNative\bisrv.dll (Microsoft Corporation)
SRV:64bit: - (AllUserInstallAgent) – C:\Windows\SysNative\AUInstallAgent.dll (Microsoft Corporation)
SRV:64bit: - (vmicvss) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmictimesync) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicshutdown) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicrdv) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmickvpexchange) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicheartbeat) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (Intel® – C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel® Corporation)
SRV:64bit: - (AERTFilters) – C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Andrea Electronics Corporation)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (PrintNotify) – C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll (Microsoft Corporation)
SRV - (NIS) – C:\Program Files (x86)\Norton Internet Security\Engine\20.2.0.19\ccSvcHst.exe (Symantec Corporation)
SRV - (McComponentHostService) – C:\Program Files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe (McAfee, Inc.)
SRV - (HP Support Assistant Service) – C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company)
SRV - (cphs) – C:\Windows\SysWOW64\IntelCpHeciSvc.exe (Intel Corporation)
SRV - (StorSvc) – C:\Windows\SysWOW64\StorSvc.dll (Microsoft Corporation)
SRV - (WAS) – C:\Windows\SysWOW64\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (AppHostSvc) – C:\Windows\SysWOW64\inetsrv\apphostsvc.dll (Microsoft Corporation)
SRV - (UNS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (jhi_service) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe (Intel Corporation)
SRV - (HPWMISVC) – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
SRV - (GamesAppService) – C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.)


========== Driver Services (SafeList) ==========

DRV:64bit: - (hidi2c) – C:\Windows\SysNative\Drivers\hidi2c.sys (Microsoft Corporation)
DRV:64bit: - (USBHUB3) – C:\Windows\SysNative\Drivers\USBHUB3.SYS (Microsoft Corporation)
DRV:64bit: - (pdc) – C:\Windows\SysNative\Drivers\pdc.sys (Microsoft Corporation)
DRV:64bit: - (WFPLWFS) – C:\Windows\SysNative\Drivers\wfplwfs.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) – C:\Windows\SysNative\Drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (FxPPM) – C:\Windows\SysNative\Drivers\fxppm.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) – C:\Windows\SysNative\Drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (sdstor) – C:\Windows\SysNative\Drivers\sdstor.sys (Microsoft Corporation)
DRV:64bit: - (dam) – C:\Windows\SysNative\Drivers\dam.sys (Microsoft Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\Drivers\NISx64\1402000.013\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\Drivers\NISx64\1402000.013\symefa64.sys (Symantec Corporation)
DRV:64bit: - (SymDS) – C:\Windows\SysNative\Drivers\NISx64\1402000.013\symds64.sys (Symantec Corporation)
DRV:64bit: - (ccSet_NIS) – C:\Windows\SysNative\Drivers\NISx64\1402000.013\ccsetx64.sys (Symantec Corporation)
DRV:64bit: - (SymEvent) – C:\Windows\SysNative\Drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (SymNetS) – C:\Windows\SysNative\Drivers\NISx64\1402000.013\symnets.sys (Symantec Corporation)
DRV:64bit: - (SymIRON) – C:\Windows\SysNative\Drivers\NISx64\1402000.013\ironx64.sys (Symantec Corporation)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\Drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (SmbDrvI) – C:\Windows\SysNative\Drivers\Smb_driver_Intel.sys (Synaptics Incorporated)
DRV:64bit: - (SmbDrv) – C:\Windows\SysNative\Drivers\Smb_driver_AMDASF.sys (Synaptics Incorporated)
DRV:64bit: - (netr28x) – C:\Windows\SysNative\Drivers\netr28x.sys (Ralink Technology, Corp.)
DRV:64bit: - (igfx) – C:\Windows\SysNative\Drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (WirelessButtonDriver) – C:\Windows\SysNative\Drivers\WirelessButtonDriver64.sys (Hewlett-Packard Development Company, L.P.)
DRV:64bit: - (iaStorA) – C:\Windows\SysNative\Drivers\iaStorA.sys (Intel Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (condrv) – C:\Windows\SysNative\Drivers\condrv.sys (Microsoft Corporation)
DRV:64bit: - (USBXHCI) – C:\Windows\SysNative\Drivers\USBXHCI.SYS (Microsoft Corporation)
DRV:64bit: - (VSTXRAID) – C:\Windows\SysNative\Drivers\VSTXRAID.SYS (VIA Corporation)
DRV:64bit: - (UCX01000) – C:\Windows\SysNative\Drivers\UCX01000.SYS (Microsoft Corporation)
DRV:64bit: - (VerifierExt) – C:\Windows\SysNative\Drivers\VerifierExt.sys (Microsoft Corporation)
DRV:64bit: - (UASPStor) – C:\Windows\SysNative\Drivers\uaspstor.sys (Microsoft Corporation)
DRV:64bit: - (acpiex) – C:\Windows\SysNative\Drivers\acpiex.sys (Microsoft Corporation)
DRV:64bit: - (spaceport) – C:\Windows\SysNative\Drivers\spaceport.sys (Microsoft Corporation)
DRV:64bit: - (GPIOClx0101) – C:\Windows\SysNative\Drivers\msgpioclx.sys (Microsoft Corporation)
DRV:64bit: - (storahci) – C:\Windows\SysNative\Drivers\storahci.sys (Microsoft Corporation)
DRV:64bit: - (mvumis) – C:\Windows\SysNative\Drivers\mvumis.sys (Marvell Semiconductor, Inc.)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\Drivers\stexstor.sys (Promise Technology, Inc.)
DRV:64bit: - (msgpiowin32) – C:\Windows\SysNative\Drivers\msgpiowin32.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\Drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\Drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (LSI_SSS) – C:\Windows\SysNative\Drivers\lsi_sss.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\Drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (EhStorTcgDrv) – C:\Windows\SysNative\Drivers\EhStorTcgDrv.sys (Microsoft Corporation)
DRV:64bit: - (EhStorClass) – C:\Windows\SysNative\Drivers\EhStorClass.sys (Microsoft Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\Drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\Drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (3ware) – C:\Windows\SysNative\Drivers\3ware.sys (LSI)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\Drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\Drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (TPM) – C:\Windows\SysNative\Drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (CLFS) – C:\Windows\SysNative\Drivers\clfs.sys (Microsoft Corporation)
DRV:64bit: - (vpci) – C:\Windows\SysNative\Drivers\vpci.sys (Microsoft Corporation)
DRV:64bit: - (WdFilter) – C:\Windows\SysNative\Drivers\WdFilter.sys (Microsoft Corporation)
DRV:64bit: - (WdBoot) – C:\Windows\SysNative\Drivers\WdBoot.sys (Microsoft Corporation)
DRV:64bit: - (terminpt) – C:\Windows\SysNative\Drivers\terminpt.sys (Microsoft Corporation)
DRV:64bit: - (mshidumdf) – C:\Windows\SysNative\Drivers\mshidumdf.sys (Microsoft Corporation)
DRV:64bit: - (BasicDisplay) – C:\Windows\SysNative\Drivers\BasicDisplay.sys (Microsoft Corporation)
DRV:64bit: - (HyperVideo) – C:\Windows\SysNative\Drivers\HyperVideo.sys (Microsoft Corporation)
DRV:64bit: - (BasicRender) – C:\Windows\SysNative\Drivers\BasicRender.sys (Microsoft Corporation)
DRV:64bit: - (BthAvrcpTg) – C:\Windows\SysNative\Drivers\BthAvrcpTg.sys (Microsoft Corporation)
DRV:64bit: - (gencounter) – C:\Windows\SysNative\Drivers\vmgencounter.sys (Microsoft Corporation)
DRV:64bit: - (kdnic) – C:\Windows\SysNative\Drivers\kdnic.sys (Microsoft Corporation)
DRV:64bit: - (acpitime) – C:\Windows\SysNative\Drivers\acpitime.sys (Microsoft Corporation)
DRV:64bit: - (npsvctrig) – C:\Windows\SysNative\Drivers\npsvctrig.sys (Microsoft Corporation)
DRV:64bit: - (bthhfhid) – C:\Windows\SysNative\Drivers\BthhfHid.sys (Microsoft Corporation)
DRV:64bit: - (WpdUpFltr) – C:\Windows\SysNative\Drivers\WpdUpFltr.sys (Microsoft Corporation)
DRV:64bit: - (acpipagr) – C:\Windows\SysNative\Drivers\acpipagr.sys (Microsoft Corporation)
DRV:64bit: - (hyperkbd) – C:\Windows\SysNative\Drivers\hyperkbd.sys (Microsoft Corporation)
DRV:64bit: - (SerCx) – C:\Windows\SysNative\Drivers\SerCx.sys (Microsoft Corporation)
DRV:64bit: - (SpbCx) – C:\Windows\SysNative\Drivers\SpbCx.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\Drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (BthHFEnum) – C:\Windows\SysNative\Drivers\bthhfenum.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) – C:\Windows\SysNative\Drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\Drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (wpcfltr) – C:\Windows\SysNative\Drivers\wpcfltr.sys (Microsoft Corporation)
DRV:64bit: - (NdisImPlatform) – C:\Windows\SysNative\Drivers\NdisImPlatform.sys (Microsoft Corporation)
DRV:64bit: - (MsLldp) – C:\Windows\SysNative\Drivers\mslldp.sys (Microsoft Corporation)
DRV:64bit: - (Ndu) – C:\Windows\SysNative\Drivers\Ndu.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) – C:\Windows\SysNative\Drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (CLVirtualDrive) – C:\Windows\SysNative\Drivers\CLVirtualDrive.sys (CyberLink)
DRV:64bit: - (SymELAM) – C:\Windows\SysNative\Drivers\NISx64\1402000.013\symelam.sys (Symantec Corporation)
DRV:64bit: - (IntcDAud) – C:\Windows\SysNative\Drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (RSP2STOR) – C:\Windows\SysNative\Drivers\RtsP2Stor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (RTL8168) – C:\Windows\SysNative\Drivers\Rt630x64.sys (Realtek )
DRV:64bit: - (SRTSPX) – C:\Windows\SysNative\Drivers\NISx64\1402000.013\srtspx64.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\VirusDefs\20130109.040\ex64.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\VirusDefs\20130109.040\eng64.sys (Symantec Corporation)
DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\IPSDefs\20130109.001\IDSviA64.sys (Symantec Corporation)
DRV - (BHDrvx64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\BASHDefs\20130107.001\BHDrvx64.sys (Symantec Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.jp.msn.com/CQALL13/13
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.jp.msn.com/CQALL13/13
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;pc=CPNTDFJS
IE:64bit: - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
IE:64bit: - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://au.search.yahoo.com/search?p={searc…amp;type=CPNTDF
IE:64bit: - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.jp.msn.com/CQALL13/13
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.jp.msn.com/CQALL13/13
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;pc=CPNTDFJS
IE - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
IE - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://au.search.yahoo.com/search?p={searc…amp;type=CPNTDF
IE - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.jp.msn.com/CQALL13/13
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.jp.msn.com/CQALL13/13
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;pc=CPNTDFJS
IE - HKCU\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
IE - HKCU\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://au.search.yahoo.com/search?p={searc…amp;type=CPNTDF
IE - HKCU\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.12
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_135.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\coFFPlgn\ [2013/01/09 18:23:31 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\IPSFFPlgn\ [2012/12/16 12:33:20 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/12/29 22:39:57 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2012/12/29 22:40:28 | 000,000,000 | —D | M] (No name found) – C:\Users\Won\AppData\Roaming\Mozilla\Extensions
[2012/12/29 22:42:09 | 000,000,000 | —D | M] (No name found) – C:\Users\Won\AppData\Roaming\Mozilla\Firefox\Profiles\7yg7jjse.default\extensions
[2012/12/29 22:42:09 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Won\AppData\Roaming\Mozilla\Firefox\Profiles\7yg7jjse.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/12/29 22:39:57 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/11/29 19:27:51 | 000,262,112 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/11/29 19:27:12 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/11/29 19:27:12 | 000,002,058 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/07/26 16:26:49 | 000,000,824 | —- | M]) - C:\Windows\SysNative\Drivers\etc\hosts
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.2.0.19\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.2.0.19\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.2.0.19\coieplg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [CLVirtualDrive] C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe (CyberLink Corp.)
O4 - HKLM..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{042E8B2D-1CE4-4C61-A9E5-5D680BA98BFE}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O30 - LSA: Security Packages - (livessp) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/10/28 16:28:27 | 000,000,175 | R— | M] () - E:\autorun.inf – [ CDFS ]
O33 - MountPoints2\{f324f4a5-ffde-11e1-be71-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{f324f4a5-ffde-11e1-be71-806e6f6e6963}\Shell\AutoRun\command - "" = E:\SETUP.EXE – [2006/10/28 16:28:27 | 000,463,152 | R— | M] (Microsoft Corporation)
O33 - MountPoints2\{f324f4a5-ffde-11e1-be71-806e6f6e6963}\Shell\configure\command - "" = E:\setup.exe – [2006/10/28 16:28:27 | 000,463,152 | R— | M] (Microsoft Corporation)
O33 - MountPoints2\{f324f4a5-ffde-11e1-be71-806e6f6e6963}\Shell\install\command - "" = E:\setup.exe – [2006/10/28 16:28:27 | 000,463,152 | R— | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs:64bit: wlidsvc - C:\Windows\SysNative\wlidsvc.dll (Microsoft Corporation)
NetSvcs:64bit: DsmSvc - C:\Windows\SysNative\DeviceSetupManager.dll (Microsoft Corporation)
NetSvcs:64bit: NcaSvc - C:\Windows\SysNative\NcaSvc.dll (Microsoft Corporation)
NetSvcs:64bit: SystemEventsBroker - C:\Windows\SysNative\SystemEventsBrokerServer.dll (Microsoft Corporation)

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/01/10 22:41:29 | 000,000,000 | —D | C] – C:\Users\Won\Desktop\Inheritance_files
[2013/01/05 15:50:48 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\{D27305E9-1BAB-4BDD-A3C2-9C5169718297}
[2013/01/04 18:40:03 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\{5722BF4C-096C-48BC-AF40-3E13843B4A40}
[2013/01/03 21:47:54 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\Diagnostics
[2013/01/02 10:39:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2012/12/31 18:45:23 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\{73E36C9E-B682-40CB-9629-256403489E1B}
[2012/12/30 10:26:54 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\{F880CE05-7FC5-4B1C-82B6-196D40F9368E}
[2012/12/29 22:47:42 | 000,000,000 | —D | C] – C:\Users\Won\dwhelper
[2012/12/29 22:47:19 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\Macromedia
[2012/12/29 22:45:39 | 000,000,000 | —D | C] – C:\ProgramData\McAfee Security Scan
[2012/12/29 22:45:37 | 000,000,000 | —D | C] – C:\ProgramData\McAfee
[2012/12/29 22:45:36 | 000,000,000 | —D | C] – C:\Program Files (x86)\McAfee Security Scan
[2012/12/29 22:45:03 | 000,000,000 | —D | C] – C:\ProgramData\Adobe
[2012/12/29 22:40:21 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Roaming\Mozilla
[2012/12/29 22:40:21 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\Mozilla
[2012/12/29 22:40:02 | 000,000,000 | —D | C] – C:\ProgramData\Mozilla
[2012/12/29 22:40:01 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Maintenance Service
[2012/12/29 22:39:56 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2012/12/29 22:26:34 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\{13FD6B07-2940-4465-A707-092DABA7B1DB}
[2012/12/29 22:26:33 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\{AC16EB70-B1E9-4801-ABE7-80F6460AFAFE}
[2012/12/26 14:30:17 | 000,000,000 | —D | C] – C:\Users\Won\Desktop\Law job
[2012/12/26 14:29:57 | 000,000,000 | —D | C] – C:\Users\Won\Desktop\Restaurant Other job
[2012/12/21 07:54:13 | 000,362,496 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2012/12/21 07:54:12 | 000,300,032 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2012/12/21 07:54:12 | 000,046,080 | —- | C] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2012/12/21 07:54:12 | 000,035,328 | —- | C] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2012/12/21 07:54:11 | 000,096,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fontsub.dll
[2012/12/21 07:54:11 | 000,075,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\fontsub.dll
[2012/12/21 07:54:11 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dciman32.dll
[2012/12/21 07:54:11 | 000,003,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lpk.dll
[2012/12/19 19:26:55 | 001,131,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\AppXDeploymentServer.dll
[2012/12/19 19:26:55 | 001,120,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msctf.dll
[2012/12/19 19:26:54 | 000,707,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\AppXDeploymentExtensions.dll
[2012/12/19 19:26:39 | 006,971,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2012/12/19 19:26:38 | 001,184,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Display.dll
[2012/12/19 19:26:38 | 001,164,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Display.dll
[2012/12/19 19:26:38 | 000,488,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\usbport.sys
[2012/12/19 19:26:38 | 000,083,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\hidclass.sys
[2012/12/19 19:26:38 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\DevDispItemProvider.dll
[2012/12/19 19:26:38 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\hidi2c.sys
[2012/12/19 19:26:38 | 000,036,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\DevDispItemProvider.dll
[2012/12/19 19:26:38 | 000,021,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\usbd.sys
[2012/12/19 19:26:38 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KBDKURD.DLL
[2012/12/19 19:26:37 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\KBDKURD.DLL
[2012/12/19 19:26:31 | 000,641,536 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WSShared.dll
[2012/12/19 19:26:30 | 000,523,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WSShared.dll
[2012/12/19 19:26:30 | 000,198,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Windows.ApplicationModel.Store.dll
[2012/12/19 19:26:30 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Windows.ApplicationModel.Store.TestingFramework.dll
[2012/12/19 19:26:30 | 000,143,872 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Windows.ApplicationModel.Store.dll
[2012/12/19 19:26:30 | 000,124,928 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Windows.ApplicationModel.Store.TestingFramework.dll
[2012/12/19 19:26:27 | 003,244,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpcorets.dll
[2012/12/19 19:26:26 | 000,109,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dskquota.dll
[2012/12/19 19:26:26 | 000,027,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\rdpvideominiport.sys
[2012/12/19 19:26:25 | 000,082,944 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dskquota.dll
[2012/12/19 19:26:25 | 000,036,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rfxvmt.dll
[2012/12/19 19:26:24 | 000,235,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpudd.dll
[2012/12/19 19:26:10 | 000,396,008 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\hal.dll
[2012/12/19 19:26:03 | 001,172,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfnetsrc.dll
[2012/12/19 19:26:02 | 000,929,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfnetsrc.dll
[2012/12/19 19:26:02 | 000,677,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfnetcore.dll
[2012/12/19 19:26:02 | 000,673,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfmpeg2srcsnk.dll
[2012/12/19 19:26:02 | 000,568,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfnetcore.dll
[2012/12/19 19:26:02 | 000,513,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfmpeg2srcsnk.dll
[2012/12/19 19:26:01 | 001,048,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfasfsrcsnk.dll
[2012/12/19 19:26:01 | 000,850,944 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfasfsrcsnk.dll
[2012/12/19 19:25:31 | 003,554,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tquery.dll
[2012/12/19 19:25:28 | 002,116,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mssrch.dll
[2012/12/19 19:25:27 | 002,206,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dwmcore.dll
[2012/12/19 19:25:26 | 002,380,944 | —- | C] (Microsoft Corporation) – C:\Windows\explorer.exe
[2012/12/19 19:25:25 | 002,764,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tquery.dll
[2012/12/19 19:25:25 | 002,115,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\explorer.exe
[2012/12/19 19:25:24 | 001,610,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mssrch.dll
[2012/12/19 19:25:24 | 001,395,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Windows.UI.Immersive.dll
[2012/12/19 19:25:23 | 001,841,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dwmcore.dll
[2012/12/19 19:25:23 | 001,265,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lsasrv.dll
[2012/12/19 19:25:22 | 001,226,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Windows.UI.Immersive.dll
[2012/12/19 19:25:22 | 000,793,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfplat.dll
[2012/12/19 19:25:22 | 000,590,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SHCore.dll
[2012/12/19 19:25:22 | 000,579,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\StructuredQuery.dll
[2012/12/19 19:25:21 | 000,594,944 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Windows.Networking.dll
[2012/12/19 19:25:20 | 001,403,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winload.efi
[2012/12/19 19:25:20 | 001,267,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winload.exe
[2012/12/19 19:25:19 | 001,217,328 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winresume.efi
[2012/12/19 19:25:19 | 001,093,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winresume.exe
[2012/12/19 19:25:19 | 000,561,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfmp4srcsnk.dll
[2012/12/19 19:25:19 | 000,435,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mssph.dll
[2012/12/19 19:25:19 | 000,373,760 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SearchProtocolHost.exe
[2012/12/19 19:25:18 | 000,612,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfplat.dll
[2012/12/19 19:25:18 | 000,460,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\SHCore.dll
[2012/12/19 19:25:17 | 000,517,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winlogon.exe
[2012/12/19 19:25:17 | 000,441,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\netio.sys
[2012/12/19 19:25:16 | 000,410,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Windows.Networking.dll
[2012/12/19 19:25:15 | 001,045,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\usercpl.dll
[2012/12/19 19:25:15 | 000,503,080 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ci.dll
[2012/12/19 19:25:15 | 000,411,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfmp4srcsnk.dll
[2012/12/19 19:25:15 | 000,286,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\portcls.sys
[2012/12/19 19:25:15 | 000,154,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Windows.Storage.Compression.dll
[2012/12/19 19:25:14 | 000,336,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\Classpnp.sys
[2012/12/19 19:25:14 | 000,058,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\dam.sys
[2012/12/19 19:25:13 | 000,962,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\usercpl.dll
[2012/12/19 19:25:13 | 000,244,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dhcpcore6.dll
[2012/12/19 19:25:12 | 000,505,344 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SpaceControl.dll
[2012/12/19 19:25:12 | 000,204,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dhcpcore6.dll
[2012/12/19 19:25:11 | 000,408,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mssph.dll
[2012/12/19 19:25:11 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SearchFilterHost.exe
[2012/12/19 19:25:11 | 000,116,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Windows.Storage.Compression.dll
[2012/12/19 19:25:11 | 000,056,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\sdstor.sys
[2012/12/19 19:25:11 | 000,033,512 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\battc.sys
[2012/12/19 19:25:10 | 000,259,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\input.dll
[2012/12/19 19:25:10 | 000,219,648 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\input.dll
[2012/12/19 19:25:09 | 000,658,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mssvp.dll
[2012/12/19 19:25:09 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dhcpcsvc6.dll
[2012/12/19 19:25:08 | 000,745,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mssvp.dll
[2012/12/19 19:25:08 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msscntrs.dll
[2012/12/19 19:25:08 | 000,047,616 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\PCPKsp.dll
[2012/12/19 19:25:08 | 000,034,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\microsoft-windows-pdc.dll
[2012/12/19 19:25:07 | 001,294,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\gdi32.dll
[2012/12/19 19:25:07 | 000,757,760 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\FirewallAPI.dll
[2012/12/19 19:25:06 | 000,370,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SysFxUI.dll
[2012/12/19 19:25:06 | 000,118,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\AppxSip.dll
[2012/12/19 19:25:06 | 000,099,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\AppxSip.dll
[2012/12/19 19:25:05 | 001,836,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\DWrite.dll
[2012/12/19 19:25:05 | 000,246,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mssphtb.dll
[2012/12/19 19:25:05 | 000,105,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\icfupgd.dll
[2012/12/19 19:25:05 | 000,049,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\BdeUISrv.exe
[2012/12/19 19:25:04 | 000,102,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mssitlb.dll
[2012/12/19 19:25:04 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\PCPKsp.dll
[2012/12/19 19:25:03 | 000,096,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mssprxy.dll
[2012/12/19 19:25:03 | 000,094,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mssitlb.dll
[2012/12/19 19:25:02 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msscntrs.dll
[2012/12/19 19:25:02 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wfapigp.dll
[2012/12/19 19:25:02 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wfapigp.dll
[2012/12/19 19:25:01 | 000,111,616 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\drmk.sys
[2012/12/19 19:25:01 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msshooks.dll
[2012/12/19 19:25:01 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msshooks.dll
[2012/12/19 19:25:00 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kbdhebl3.dll
[2012/12/19 19:25:00 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\kbdhebl3.dll
[2012/12/19 19:23:59 | 011,459,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\glcndFilter.dll
[2012/12/19 19:23:55 | 010,096,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\twinui.dll
[2012/12/19 19:23:54 | 008,856,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\twinui.dll
[2012/12/19 19:23:49 | 008,552,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\glcndFilter.dll
[2012/12/19 19:23:48 | 001,526,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfcore.dll
[2012/12/19 19:23:47 | 001,451,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfcore.dll
[2012/12/19 19:23:47 | 000,976,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KernelBase.dll
[2012/12/19 19:23:46 | 005,973,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstscax.dll
[2012/12/19 19:23:46 | 001,566,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ole32.dll
[2012/12/19 19:23:45 | 005,087,744 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstscax.dll
[2012/12/19 19:23:45 | 001,037,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\localspl.dll
[2012/12/19 19:23:44 | 002,302,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\authui.dll
[2012/12/19 19:23:44 | 000,490,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\AudioEng.dll
[2012/12/19 19:23:44 | 000,447,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\AudioSes.dll
[2012/12/19 19:23:43 | 000,883,712 | —- | C] (Microsoft Corporation) – C:\Windows\HelpPane.exe
[2012/12/19 19:23:43 | 000,767,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapi.dll
[2012/12/19 19:23:43 | 000,318,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ubpm.dll
[2012/12/19 19:23:43 | 000,253,512 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\audiodg.exe
[2012/12/19 19:23:42 | 001,619,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wucltux.dll
[2012/12/19 19:23:42 | 000,703,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drvstore.dll
[2012/12/19 19:23:42 | 000,246,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ubpm.dll
[2012/12/19 19:23:41 | 002,033,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\authui.dll
[2012/12/19 19:23:41 | 000,251,904 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WUSettingsProvider.dll
[2012/12/19 19:23:40 | 000,621,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wuapi.dll
[2012/12/19 19:23:40 | 000,194,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\sdbus.sys
[2012/12/19 19:23:39 | 000,549,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\drvstore.dll
[2012/12/19 19:23:39 | 000,522,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\AUDIOKSE.dll
[2012/12/19 19:23:39 | 000,501,760 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\DevicePairing.dll
[2012/12/19 19:23:39 | 000,445,160 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\USBHUB3.SYS
[2012/12/19 19:23:39 | 000,291,328 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Windows.Networking.Connectivity.dll
[2012/12/19 19:23:39 | 000,124,648 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\dumpsd.sys
[2012/12/19 19:23:39 | 000,069,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\pdc.sys
[2012/12/19 19:23:38 | 000,470,016 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wlanmsm.dll
[2012/12/19 19:23:38 | 000,463,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\AUDIOKSE.dll
[2012/12/19 19:23:38 | 000,273,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wlanapi.dll
[2012/12/19 19:23:38 | 000,110,080 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dafWCN.dll
[2012/12/19 19:23:38 | 000,058,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuauclt.exe
[2012/12/19 19:23:37 | 000,449,536 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\DevicePairing.dll
[2012/12/19 19:23:37 | 000,446,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wlansec.dll
[2012/12/19 19:23:37 | 000,386,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wlanmsm.dll
[2012/12/19 19:23:37 | 000,212,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\bthprops.cpl
[2012/12/19 19:23:37 | 000,195,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Windows.Networking.Connectivity.dll
[2012/12/19 19:23:37 | 000,189,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\bthprops.cpl
[2012/12/19 19:23:37 | 000,172,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MFCaptureEngine.dll
[2012/12/19 19:23:37 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskhost.exe
[2012/12/19 19:23:37 | 000,072,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskhostex.exe
[2012/12/19 19:23:37 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups2.dll
[2012/12/19 19:23:37 | 000,043,008 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups.dll
[2012/12/19 19:23:37 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuaext.dll
[2012/12/19 19:23:36 | 002,146,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\actxprxy.dll
[2012/12/19 19:23:36 | 000,375,296 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wlansec.dll
[2012/12/19 19:23:36 | 000,314,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpclip.exe
[2012/12/19 19:23:36 | 000,281,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfreadwrite.dll
[2012/12/19 19:23:36 | 000,173,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\storewuauth.dll
[2012/12/19 19:23:36 | 000,141,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuwebv.dll
[2012/12/19 19:23:36 | 000,125,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wuwebv.dll
[2012/12/19 19:23:36 | 000,096,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\wfplwfs.sys
[2012/12/19 19:23:35 | 000,888,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\nshwfp.dll
[2012/12/19 19:23:35 | 000,702,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\nshwfp.dll
[2012/12/19 19:23:35 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wudriver.dll
[2012/12/19 19:23:35 | 000,083,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wudriver.dll
[2012/12/19 19:23:34 | 000,214,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfreadwrite.dll
[2012/12/19 19:23:34 | 000,202,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wlanapi.dll
[2012/12/19 19:23:34 | 000,126,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFCaptureEngine.dll
[2012/12/19 19:23:34 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapp.exe
[2012/12/19 19:23:34 | 000,034,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wuapp.exe
[2012/12/19 19:23:33 | 000,378,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\FWPUCLNT.DLL
[2012/12/19 19:23:33 | 000,322,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\aaclient.dll
[2012/12/19 19:23:33 | 000,269,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\aaclient.dll
[2012/12/19 19:23:33 | 000,245,248 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\FWPUCLNT.DLL
[2012/12/19 19:23:33 | 000,169,472 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\AudioEndpointBuilder.dll
[2012/12/19 19:23:33 | 000,126,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WcnApi.dll
[2012/12/19 19:23:33 | 000,093,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WcnApi.dll
[2012/12/19 19:23:33 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tsgqec.dll
[2012/12/19 19:23:32 | 000,102,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fdWCN.dll
[2012/12/19 19:23:32 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tsgqec.dll
[2012/12/19 19:23:32 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wfdprov.dll
[2012/12/19 19:23:32 | 000,027,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WcnEapPeerProxy.dll
[2012/12/19 19:23:32 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WcnEapAuthProxy.dll
[2012/12/19 19:23:32 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wups.dll
[2012/12/19 19:23:31 | 000,267,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\EncDump.dll
[2012/12/19 19:23:31 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wfdprov.dll
[2012/12/19 19:23:30 | 000,099,328 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wushareduxresources.dll
[2012/12/19 19:23:30 | 000,022,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\fxppm.sys
[2012/12/19 19:23:30 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iscsilog.dll
[2012/12/19 19:23:30 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wlanhlp.dll
[2012/12/19 19:23:30 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wlanhlp.dll
[2012/12/17 15:17:08 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Roaming\Identities
[2012/12/17 13:30:54 | 000,017,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msvcr100_clr0400.dll
[2012/12/17 13:30:51 | 000,017,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msvcr100_clr0400.dll
[2012/12/17 13:12:50 | 000,144,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tssdisai.dll
[2012/12/17 13:12:49 | 000,135,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\appserverai.dll
[2012/12/17 13:12:49 | 000,126,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RDWebAI.dll
[2012/12/17 13:12:49 | 000,122,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\VmHostAI.dll
[2012/12/17 13:12:46 | 000,148,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\poqexec.exe
[2012/12/17 13:12:46 | 000,132,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\poqexec.exe
[2012/12/17 13:12:45 | 000,094,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\synceng.dll
[2012/12/17 13:12:44 | 000,072,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\synceng.dll
[2012/12/17 13:12:04 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\pcadm.dll
[2012/12/17 13:12:04 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\pcalua.exe
[2012/12/17 13:12:04 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\pcaevts.dll
[2012/12/17 13:12:02 | 000,463,872 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dpnet.dll
[2012/12/17 13:12:02 | 000,375,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dpnet.dll
[2012/12/17 13:12:02 | 000,058,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dpnathlp.dll
[2012/12/17 13:12:02 | 000,034,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dpnsvr.exe
[2012/12/17 13:12:02 | 000,032,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dpnsvr.exe
[2012/12/17 13:12:01 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dpnathlp.dll
[2012/12/17 13:12:01 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dpnhupnp.dll
[2012/12/17 13:12:01 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dpnhpast.dll
[2012/12/17 13:12:01 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dpnhupnp.dll
[2012/12/17 13:12:01 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dpnhpast.dll
[2012/12/17 13:12:01 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dpnlobby.dll
[2012/12/17 13:12:01 | 000,003,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dpnaddr.dll
[2012/12/17 13:12:01 | 000,003,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dpnlobby.dll
[2012/12/17 13:12:01 | 000,002,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dpnaddr.dll
[2012/12/17 13:11:12 | 001,009,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\reseteng.dll
[2012/12/17 13:11:12 | 000,945,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\resetengmig.dll
[2012/12/17 13:11:12 | 000,443,392 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ReAgent.dll
[2012/12/17 13:11:12 | 000,375,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ReAgent.dll
[2012/12/17 13:11:11 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\sysreset.exe
[2012/12/17 13:11:10 | 002,893,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msmpeg2vdec.dll
[2012/12/17 13:11:10 | 002,400,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msmpeg2vdec.dll
[2012/12/17 13:10:47 | 003,966,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/12/17 13:10:45 | 000,907,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\uxtheme.dll
[2012/12/17 13:10:44 | 000,690,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/12/17 13:10:44 | 000,603,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012/12/17 13:10:44 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2012/12/17 13:10:44 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2012/12/17 13:10:44 | 000,050,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2012/12/17 13:10:43 | 000,854,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/12/17 13:10:43 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2012/12/17 13:10:43 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2012/12/17 13:10:43 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\UXInit.dll
[2012/12/17 13:10:43 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\UXInit.dll
[2012/12/17 13:10:43 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2012/12/17 13:10:43 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2012/12/17 13:10:42 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ReAgentc.exe
[2012/12/17 13:10:42 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ReAgentc.exe
[2012/12/17 07:13:25 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Roaming\hpqlog
[2012/12/17 07:13:23 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\Hewlett-Packard
[2012/12/16 13:42:09 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Symantec Shared
[2012/12/16 13:11:22 | 000,000,000 | —D | C] – C:\Users\Won\Documents\Youcam
[2012/12/16 12:59:09 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Roaming\Hewlett-Packard
[2012/12/16 12:58:43 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2012/12/16 12:57:46 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Roaming\WebApp
[2012/12/16 12:57:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Works
[2012/12/16 12:57:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\DESIGNER
[2012/12/16 12:55:06 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\Cyberlink
[2012/12/16 12:54:58 | 000,000,000 | —D | C] – C:\Users\Won\Documents\CyberLink
[2012/12/16 12:54:57 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Roaming\CyberLink
[2012/12/16 12:54:02 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2012/12/16 12:53:19 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\Microsoft Help
[2012/12/16 12:53:10 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft Help
[2012/12/16 12:52:28 | 000,000,000 | RH-D | C] – C:\MSOCache
[2012/12/16 12:47:37 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Roaming\WildTangent
[2012/12/16 12:38:54 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Roaming\Macromedia
[2012/12/16 12:36:37 | 000,000,000 | R–D | C] – C:\Users\Won\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012/12/16 12:36:37 | 000,000,000 | R–D | C] – C:\Users\Won\Searches
[2012/12/16 12:36:37 | 000,000,000 | R–D | C] – C:\Users\Won\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012/12/16 12:36:36 | 000,000,000 | R–D | C] – C:\Users\Won\Contacts
[2012/12/16 12:36:36 | 000,000,000 | -H-D | C] – C:\Users\Won\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2012/12/16 12:36:32 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Roaming\Adobe
[2012/12/16 12:36:16 | 000,000,000 | R–D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shopping and Services
[2012/12/16 12:35:21 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Roaming\Synaptics
[2012/12/16 12:35:21 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\Power2Go8
[2012/12/16 12:34:11 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\VirtualStore
[2012/12/16 12:34:04 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\Packages
[2012/12/16 12:33:46 | 000,000,000 | -H-D | C] – C:\Program Files (x86)\Uninstall Information
[2012/12/16 12:33:28 | 000,000,000 | -HSD | C] – C:\Users\Won\AppData\Local\Temporary Internet Files
[2012/12/16 12:33:28 | 000,000,000 | -HSD | C] – C:\Users\Won\Templates
[2012/12/16 12:33:28 | 000,000,000 | -HSD | C] – C:\Users\Won\Start Menu
[2012/12/16 12:33:28 | 000,000,000 | -HSD | C] – C:\Users\Won\SendTo
[2012/12/16 12:33:28 | 000,000,000 | -HSD | C] – C:\Users\Won\Recent
[2012/12/16 12:33:28 | 000,000,000 | -HSD | C] – C:\Users\Won\PrintHood
[2012/12/16 12:33:28 | 000,000,000 | -HSD | C] – C:\Users\Won\NetHood
[2012/12/16 12:33:28 | 000,000,000 | -HSD | C] – C:\Users\Won\Documents\My Videos
[2012/12/16 12:33:28 | 000,000,000 | -HSD | C] – C:\Users\Won\Documents\My Pictures
[2012/12/16 12:33:28 | 000,000,000 | -HSD | C] – C:\Users\Won\Documents\My Music
[2012/12/16 12:33:28 | 000,000,000 | -HSD | C] – C:\Users\Won\Local Settings
[2012/12/16 12:33:28 | 000,000,000 | -HSD | C] – C:\Users\Won\AppData\Local\History
[2012/12/16 12:33:28 | 000,000,000 | -HSD | C] – C:\Users\Won\Cookies
[2012/12/16 12:33:28 | 000,000,000 | -HSD | C] – C:\Users\Won\Application Data
[2012/12/16 12:33:28 | 000,000,000 | -HSD | C] – C:\Users\Won\AppData\Local\Application Data
[2012/12/16 12:33:27 | 000,000,000 | -HSD | C] – C:\Users\Won\My Documents
[2012/12/16 12:32:27 | 000,000,000 | –SD | C] – C:\Users\Won\AppData\Roaming\Microsoft
[2012/12/16 12:32:27 | 000,000,000 | R–D | C] – C:\Users\Won\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
[2012/12/16 12:32:27 | 000,000,000 | R–D | C] – C:\Users\Won\Desktop
[2012/12/16 12:32:27 | 000,000,000 | R–D | C] – C:\Users\Won\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012/12/16 12:32:27 | 000,000,000 | R–D | C] – C:\Users\Won\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
[2012/12/16 12:32:27 | 000,000,000 | -H-D | C] – C:\Users\Won\AppData
[2012/12/16 12:32:27 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\Temp
[2012/12/16 12:32:27 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\Microsoft
[2012/12/16 12:32:27 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012/12/16 12:32:26 | 000,000,000 | R–D | C] – C:\Users\Won\Videos
[2012/12/16 12:32:26 | 000,000,000 | R–D | C] – C:\Users\Won\Saved Games
[2012/12/16 12:32:26 | 000,000,000 | R–D | C] – C:\Users\Won\Pictures
[2012/12/16 12:32:26 | 000,000,000 | R–D | C] – C:\Users\Won\Music
[2012/12/16 12:32:26 | 000,000,000 | R–D | C] – C:\Users\Won\Links
[2012/12/16 12:32:26 | 000,000,000 | R–D | C] – C:\Users\Won\Favorites
[2012/12/16 12:32:26 | 000,000,000 | R–D | C] – C:\Users\Won\Downloads
[2012/12/16 12:32:26 | 000,000,000 | R–D | C] – C:\Users\Won\Documents
[2012/12/16 12:32:26 | 000,000,000 | -H-D | C] – C:\Users\Won\Documents\hp.system.package.metadata
[2012/12/16 12:32:26 | 000,000,000 | -H-D | C] – C:\Users\Won\Documents\hp.applications.package.appdata
[2012/12/16 12:32:14 | 000,000,000 | —D | C] – C:\Windows\SoftwareDistribution

========== Files - Modified Within 30 Days ==========

[2013/01/11 07:39:34 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/01/10 22:42:41 | 000,138,824 | —- | M] () – C:\Users\Won\Desktop\Inheritance.htm
[2013/01/09 09:58:54 | 000,396,300 | —- | M] () – C:\Users\Won\Desktop\notional estate.pdf
[2013/01/09 09:32:04 | 000,024,622 | —- | M] () – C:\Users\Won\Desktop\Thai Heirs.pdf
[2013/01/09 09:14:54 | 000,302,627 | —- | M] () – C:\Users\Won\Desktop\Overseas assets.pdf
[2013/01/05 11:07:29 | 001,830,521 | —- | M] () – C:\Windows\SysNative\drivers\NISx64\1402000.013\Cat.DB
[2013/01/02 10:39:14 | 000,002,046 | —- | M] () – C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2013/01/02 10:39:14 | 000,002,046 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/12/29 22:40:05 | 000,001,147 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/12/25 15:44:13 | 000,941,050 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/12/25 15:44:13 | 000,788,176 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/12/25 15:44:13 | 000,162,458 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/12/25 15:39:21 | 000,321,856 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/12/25 15:39:09 | 268,435,456 | -HS- | M] () – C:\swapfile.sys
[2012/12/25 15:39:07 | 1615,872,000 | -HS- | M] () – C:\hiberfil.sys
[2012/12/18 22:23:15 | 000,013,946 | —- | M] () – C:\Windows\SysNative\drivers\NISx64\1402000.013\VT20121114.016
[2012/12/18 22:23:08 | 000,002,501 | —- | M] () – C:\Users\Public\Desktop\Norton Internet Security.lnk
[2012/12/16 19:28:20 | 000,046,080 | —- | M] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2012/12/16 19:20:01 | 000,035,328 | —- | M] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2012/12/16 19:08:33 | 000,362,496 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2012/12/16 18:57:09 | 000,300,032 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2012/12/16 12:37:21 | 000,001,424 | —- | M] () – C:\Users\Won\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

========== Files Created - No Company Name ==========

[2013/01/10 22:42:40 | 000,138,824 | —- | C] () – C:\Users\Won\Desktop\Inheritance.htm
[2013/01/09 09:58:54 | 000,396,300 | —- | C] () – C:\Users\Won\Desktop\notional estate.pdf
[2013/01/09 09:32:04 | 000,024,622 | —- | C] () – C:\Users\Won\Desktop\Thai Heirs.pdf
[2013/01/09 09:14:54 | 000,302,627 | —- | C] () – C:\Users\Won\Desktop\Overseas assets.pdf
[2012/12/29 22:45:37 | 000,002,046 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/12/29 22:45:36 | 000,002,046 | —- | C] () – C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2012/12/29 22:40:04 | 000,001,147 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/12/29 22:40:03 | 000,001,159 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/12/25 15:39:08 | 000,321,856 | —- | C] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/12/19 19:23:40 | 000,385,604 | —- | C] () – C:\Windows\SysNative\ApnDatabase.xml
[2012/12/16 12:37:21 | 000,001,424 | —- | C] () – C:\Users\Won\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/12/16 12:36:32 | 000,001,430 | —- | C] () – C:\Users\Won\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012/12/16 12:36:16 | 000,002,202 | —- | C] () – C:\Users\Public\Desktop\eBay.lnk
[2012/12/16 12:36:15 | 000,002,100 | —- | C] () – C:\Users\Public\Desktop\HP Games.lnk
[2012/12/16 12:36:12 | 000,002,212 | —- | C] () – C:\Users\Public\Desktop\Snapfish Photos.lnk
[2012/12/16 12:33:26 | 000,000,352 | —- | C] () – C:\Users\Won\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2012/12/16 12:33:26 | 000,000,334 | —- | C] () – C:\Users\Won\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2012/08/09 07:18:04 | 000,272,928 | —- | C] () – C:\Windows\SysWow64\igvpkrng600.bin
[2012/08/09 07:17:54 | 000,064,512 | —- | C] () – C:\Windows\SysWow64\igdde32.dll
[2012/08/09 07:17:52 | 000,963,388 | —- | C] () – C:\Windows\SysWow64\igcodeckrng600.bin
[2012/08/04 09:40:09 | 000,916,510 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2012/07/26 19:13:10 | 000,215,943 | —- | C] () – C:\Windows\SysWow64\dssec.dat
[2012/07/26 19:13:09 | 000,000,741 | —- | C] () – C:\Windows\SysWow64\NOISE.DAT
[2012/07/26 18:21:26 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2012/07/26 12:17:42 | 000,043,520 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2012/07/26 11:48:53 | 000,083,968 | —- | C] () – C:\Windows\SysWow64\OEMLicense.dll
[2012/07/26 07:37:29 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2012/07/26 07:28:31 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2012/07/26 07:22:56 | 000,733,840 | —- | C] () – C:\Windows\SysWow64\igcodeckrng700.bin
[2012/07/26 07:22:56 | 000,492,340 | —- | C] () – C:\Windows\SysWow64\igvpkrng700.bin
[2012/07/26 07:22:54 | 000,982,240 | —- | C] () – C:\Windows\SysWow64\igkrng500.bin
[2012/07/26 07:22:54 | 000,439,308 | —- | C] () – C:\Windows\SysWow64\igcompkrng500.bin
[2012/07/26 07:22:54 | 000,092,356 | —- | C] () – C:\Windows\SysWow64\igfcg500m.bin
[2012/06/03 01:31:19 | 000,673,088 | —- | C] () – C:\Windows\SysWow64\mlang.dat
[2012/04/21 07:59:44 | 000,001,536 | —- | C] () – C:\Windows\SysWow64\IusEventLog.dll

========== ZeroAccess Check ==========

[2012/08/18 04:43:16 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/11/06 15:19:27 | 019,789,824 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/11/06 15:20:00 | 017,560,576 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2012/07/26 14:05:38 | 001,004,544 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2012/07/26 14:18:27 | 000,784,896 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2012/07/26 14:07:41 | 000,455,680 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/12/16 12:35:21 | 000,000,000 | —D | M] – C:\Users\Won\AppData\Roaming\Synaptics
[2012/12/16 12:57:46 | 000,000,000 | —D | M] – C:\Users\Won\AppData\Roaming\WebApp
[2012/12/16 12:47:52 | 000,000,000 | —D | M] – C:\Users\Won\AppData\Roaming\WildTangent

========== Purity Check ==========



========== Custom Scans ==========

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.ADML >
[2012/07/26 18:50:44 | 000,003,671 | —- | M] () MD5=007B16AEF3E958080573CDB80648167D – C:\Windows\WinSxS\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.2.9200.16384_en-us_7bca26f6f419a854\Explorer.adml
[2012/07/26 18:50:44 | 000,003,671 | —- | M] () MD5=007B16AEF3E958080573CDB80648167D – C:\Windows\WinSxS\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.2.9200.16433_en-us_7bff382ef3f2006f\Explorer.adml
[2012/07/26 18:50:44 | 000,003,671 | —- | M] () MD5=007B16AEF3E958080573CDB80648167D – C:\Windows\WinSxS\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.2.9200.20534_en-us_7c89d5440d0eb990\Explorer.adml

< MD5 for: EXPLORER.ADMX >
[2012/06/03 01:32:35 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.16384_none_6e8451187a9a1607\Explorer.admx
[2012/06/03 01:32:35 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.16420_none_6ec1315e7a6d062c\Explorer.admx
[2012/06/03 01:32:35 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.16433_none_6eb962507a726e22\Explorer.admx
[2012/06/03 01:32:35 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.20521_none_6f4bce739389bf4d\Explorer.admx
[2012/06/03 01:32:35 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.20534_none_6f43ff65938f2743\Explorer.admx

< MD5 for: EXPLORER.EXE >
[2012/10/11 16:53:24 | 002,115,952 | —- | M] (Microsoft Corporation) MD5=0AD19A3CA61271BA872AD90771BA47DC – C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.20534_none_b592a71650d677ed\explorer.exe
[2012/10/11 19:09:58 | 002,380,944 | —- | M] (Microsoft Corporation) MD5=0DDFEAA2AA18D4295EF220EB666B2312 – C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.20534_none_ab3dfcc41c75b5f2\explorer.exe
[2012/07/26 14:50:01 | 002,114,936 | —- | M] (Microsoft Corporation) MD5=5B6ED1B57DBFF18D405A0260559B571E – C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16384_none_b4d2f8c937e166b1\explorer.exe
[2012/07/26 15:49:13 | 002,380,440 | —- | M] (Microsoft Corporation) MD5=928791755FDDEA721B053535EF84FA17 – C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16384_none_aa7e4e770380a4b6\explorer.exe
[2012/10/11 16:56:41 | 002,115,952 | —- | M] (Microsoft Corporation) MD5=953ADECFF08202A01EFC6110214FDE02 – C:\Windows\SysWOW64\explorer.exe
[2012/10/11 16:56:41 | 002,115,952 | —- | M] (Microsoft Corporation) MD5=953ADECFF08202A01EFC6110214FDE02 – C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16433_none_b5080a0137b9becc\explorer.exe
[2012/10/11 18:35:16 | 002,380,944 | —- | M] (Microsoft Corporation) MD5=E13A31D5254C25406A7946BDD9B06364 – C:\Windows\explorer.exe
[2012/10/11 18:35:16 | 002,380,944 | —- | M] (Microsoft Corporation) MD5=E13A31D5254C25406A7946BDD9B06364 – C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16433_none_aab35faf0358fcd1\explorer.exe

< MD5 for: EXPLORER.EXE.MUI >
[2012/07/26 18:50:36 | 000,020,480 | —- | M] (Microsoft Corporation) MD5=C25D32FEDB5AA6FF87B5A29D56D35FFA – C:\Windows\en-US\explorer.exe.mui
[2012/07/26 18:50:36 | 000,020,480 | —- | M] (Microsoft Corporation) MD5=C25D32FEDB5AA6FF87B5A29D56D35FFA – C:\Windows\SysWOW64\en-US\explorer.exe.mui
[2012/07/26 18:50:36 | 000,020,480 | —- | M] (Microsoft Corporation) MD5=C25D32FEDB5AA6FF87B5A29D56D35FFA – C:\Windows\WinSxS\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.2.9200.16384_en-us_5ebc2e81fd6600eb\explorer.exe.mui
[2012/07/26 18:50:36 | 000,020,480 | —- | M] (Microsoft Corporation) MD5=C25D32FEDB5AA6FF87B5A29D56D35FFA – C:\Windows\WinSxS\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.2.9200.16384_en-us_6910d8d431c6c2e6\explorer.exe.mui

< MD5 for: EXPLORER.EXE-03C49D11.PF >
[2013/01/11 07:39:56 | 000,234,078 | —- | M] () MD5=72B0839A5607EFB40EB99B1917EC543B – C:\Windows\Prefetch\EXPLORER.EXE-03C49D11.pf

< MD5 for: IEXPLORE.EXE >
[2012/10/11 17:34:54 | 000,770,544 | —- | M] (Microsoft Corporation) MD5=06E77B5F6BB60E11A377B68BA4AA1DA7 – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20534_none_2b74d7cd3a353a33\iexplore.exe
[2012/10/11 18:33:47 | 000,775,168 | —- | M] (Microsoft Corporation) MD5=0A5074651C95792D32BCF536D64D0463 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20534_none_21202d7b05d47838\iexplore.exe
[2012/07/26 14:36:56 | 000,770,504 | —- | M] (Microsoft Corporation) MD5=1249974F2A658D07E2647DD9C3592B9E – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16384_none_425d1fb32079214f\iexplore.exe
[2012/10/11 18:24:22 | 000,775,168 | —- | M] (Microsoft Corporation) MD5=13F97D5006C3E37D0A4AABC767C0E553 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16433_none_37f8bacaec24e2f1\iexplore.exe
[2012/07/26 15:58:31 | 000,775,112 | —- | M] (Microsoft Corporation) MD5=29CD24D8CA72FDB986B39277E70A48B6 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16384_none_38087560ec185f54\iexplore.exe
[2012/11/08 17:58:26 | 000,775,152 | —- | M] (Microsoft Corporation) MD5=2F92EE7EE7E189EBDDADD5BEEB7E9DE0 – C:\Program Files\Internet Explorer\iexplore.exe
[2012/11/08 17:58:26 | 000,775,152 | —- | M] (Microsoft Corporation) MD5=2F92EE7EE7E189EBDDADD5BEEB7E9DE0 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16453_none_37fabb5eec23159f\iexplore.exe
[2012/10/24 14:14:41 | 000,770,528 | —- | M] (Microsoft Corporation) MD5=39F90724C1A98648CCCDDF13631F2D4A – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16442_none_424e7c2f2084a4a2\iexplore.exe
[2012/11/08 17:48:39 | 000,775,152 | —- | M] (Microsoft Corporation) MD5=4B33704E4B071EC44806846CBE50EB2A – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20557_none_2121e9b705d2f7c9\iexplore.exe
[2012/10/24 14:20:45 | 000,770,528 | —- | M] (Microsoft Corporation) MD5=79FF6755B94FF918441D8F8162E5AC9C – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20544_none_2b75d8173a34538a\iexplore.exe
[2012/11/08 15:52:27 | 000,770,544 | —- | M] (Microsoft Corporation) MD5=7EBFC838C815C3DACA135837D8F7906E – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20557_none_2b7694093a33b9c4\iexplore.exe
[2012/10/24 15:43:41 | 000,775,136 | —- | M] (Microsoft Corporation) MD5=8E1B68702CDB0DDC6597357766E941D9 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16442_none_37f9d1dcec23e2a7\iexplore.exe
[2012/10/11 16:41:41 | 000,770,560 | —- | M] (Microsoft Corporation) MD5=BCF25D644DF1288CD9A6524FF7AB23C8 – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16433_none_424d651d2085a4ec\iexplore.exe
[2012/11/08 15:45:20 | 000,770,520 | —- | M] (Microsoft Corporation) MD5=D05965C02FD5781503968225B22189F4 – C:\Program Files (x86)\Internet Explorer\iexplore.exe
[2012/11/08 15:45:20 | 000,770,520 | —- | M] (Microsoft Corporation) MD5=D05965C02FD5781503968225B22189F4 – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16453_none_424f65b12083d79a\iexplore.exe
[2012/10/24 17:08:39 | 000,775,152 | —- | M] (Microsoft Corporation) MD5=F78F14096EB41341C4D880CEA6D681A2 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20544_none_21212dc505d3918f\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2012/07/26 18:50:45 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C724BBF739D40D8AA3023943F3450A7 – C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui
[2012/07/26 18:50:45 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C724BBF739D40D8AA3023943F3450A7 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2012/07/26 18:50:45 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C724BBF739D40D8AA3023943F3450A7 – C:\Users\Won\AppData\Local\Temp\iexplore.exe.mui
[2012/07/26 18:50:45 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C724BBF739D40D8AA3023943F3450A7 – C:\Windows\WinSxS\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_10.0.9200.16384_en-us_31b50ad823c5a03b\iexplore.exe.mui
[2012/07/26 18:50:45 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C724BBF739D40D8AA3023943F3450A7 – C:\Windows\WinSxS\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_10.0.9200.16384_en-us_3c09b52a58266236\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-6C28DB75.PF >
[2012/12/29 22:32:50 | 000,212,164 | —- | M] () MD5=26AE83B13228CAD5DB803164C5C42C0B – C:\Windows\Prefetch\IEXPLORE.EXE-6C28DB75.pf

< MD5 for: IEXPLORE.EXE-6C28DB76.PF >
[2012/12/28 17:15:40 | 000,303,462 | —- | M] () MD5=C1943CE0BE87AB3AF8D782E86667A367 – C:\Windows\Prefetch\IEXPLORE.EXE-6C28DB76.pf

< MD5 for: IEXPLORE.EXE-7A9337F2.PF >
[2013/01/10 22:44:18 | 000,079,014 | —- | M] () MD5=B512A472C18B9D56B7B6325468268052 – C:\Windows\Prefetch\IEXPLORE.EXE-7A9337F2.pf

< MD5 for: IEXPLORE.EXE-F4FB5D2F.PF >
[2013/01/09 19:00:53 | 000,434,680 | —- | M] () MD5=F9FB5E0FB5F5BC9C4D7B3E9842C34953 – C:\Windows\Prefetch\IEXPLORE.EXE-F4FB5D2F.pf

< MD5 for: SERVICES >
[2012/07/26 16:26:47 | 000,017,463 | —- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 – C:\Windows\WinSxS\amd64_microsoft-windows-w..ucture-other-minwin_31bf3856ad364e35_6.2.9200.16384_none_8e0944daeed62829\services

< MD5 for: SERVICES.EXE >
[2012/09/20 17:33:11 | 000,410,624 | —- | M] (Microsoft Corporation) MD5=581190907DA1CF8CB7B87B35FFE64A07 – C:\Windows\SoftwareDistribution\Download\f7f3f78cb5a30b7a9964504cdf37e9a9\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.2.9200.20521_none_98a9ea2e9f571eb2\services.exe
[2012/07/26 16:26:45 | 000,410,624 | —- | M] (Microsoft Corporation) MD5=754A2CC1F32107EA87CBD305ABE3E618 – C:\Windows\SysNative\services.exe
[2012/07/26 16:26:45 | 000,410,624 | —- | M] (Microsoft Corporation) MD5=754A2CC1F32107EA87CBD305ABE3E618 – C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.2.9200.16384_none_97e26cd38667756c\services.exe
[2012/09/20 17:33:46 | 000,410,624 | —- | M] (Microsoft Corporation) MD5=8F226143046435C75C033B0C52E90FFE – C:\Windows\SoftwareDistribution\Download\f7f3f78cb5a30b7a9964504cdf37e9a9\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.2.9200.16420_none_981f4d19863a6591\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2012/07/26 18:50:12 | 000,018,944 | —- | M] (Microsoft Corporation) MD5=8BCB19134E995FA62587DCE26E13B36C – C:\Windows\SysNative\en-US\services.exe.mui
[2012/07/26 18:50:12 | 000,018,944 | —- | M] (Microsoft Corporation) MD5=8BCB19134E995FA62587DCE26E13B36C – C:\Windows\WinSxS\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.2.9200.16384_en-us_c2c6ee7bafb963b8\services.exe.mui

< MD5 for: SERVICES.JS >
[2012/07/26 18:53:58 | 000,056,775 | —- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 – C:\Program Files\WindowsApps\Microsoft.BingFinance_1.2.0.135_x64__8wekyb3d8bbwe\platform\js\services.js
[2012/07/26 18:53:49 | 000,056,775 | —- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 – C:\Program Files\WindowsApps\Microsoft.BingNews_1.2.0.135_x64__8wekyb3d8bbwe\platform\js\services.js
[2012/07/26 18:53:45 | 000,056,775 | —- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 – C:\Program Files\WindowsApps\Microsoft.BingSports_1.2.0.135_x64__8wekyb3d8bbwe\platform\js\services.js
[2012/07/26 18:54:27 | 000,056,775 | —- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 – C:\Program Files\WindowsApps\Microsoft.BingTravel_1.2.0.145_x64__8wekyb3d8bbwe\platform\js\services.js
[2012/07/26 18:53:53 | 000,056,775 | —- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 – C:\Program Files\WindowsApps\Microsoft.BingWeather_1.2.0.135_x64__8wekyb3d8bbwe\platform\js\services.js
[2012/12/17 13:45:50 | 000,069,359 | —- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 – C:\Program Files\WindowsApps\Microsoft.BingFinance_1.7.0.26_x64__8wekyb3d8bbwe\common\js\services.js
[2012/12/17 13:45:50 | 000,069,359 | —- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 – C:\Program Files\WindowsApps\Microsoft.BingFinance_1.7.0.29_x64__8wekyb3d8bbwe\common\js\services.js
[2012/12/17 13:48:00 | 000,069,359 | —- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 – C:\Program Files\WindowsApps\Microsoft.BingNews_1.7.0.26_x64__8wekyb3d8bbwe\common\js\services.js
[2012/12/17 13:48:00 | 000,069,359 | —- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 – C:\Program Files\WindowsApps\Microsoft.BingNews_1.7.0.27_x64__8wekyb3d8bbwe\common\js\services.js
[2012/12/17 13:48:00 | 000,069,359 | —- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 – C:\Program Files\WindowsApps\Microsoft.BingNews_1.7.0.31_x64__8wekyb3d8bbwe\common\js\services.js
[2012/12/17 13:49:38 | 000,069,359 | —- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 – C:\Program Files\WindowsApps\Microsoft.BingSports_1.7.0.26_x64__8wekyb3d8bbwe\common\js\services.js
[2012/12/17 13:49:54 | 000,069,359 | —- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 – C:\Program Files\WindowsApps\Microsoft.BingTravel_1.7.0.26_x64__8wekyb3d8bbwe\Common\js\services.js
[2012/12/17 13:48:12 | 000,069,359 | —- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 – C:\Program Files\WindowsApps\Microsoft.BingWeather_1.7.0.26_x64__8wekyb3d8bbwe\common\js\services.js

< MD5 for: SERVICES.LNK >
[2012/07/26 07:19:37 | 000,001,158 | —- | M] () MD5=5C11B0E362D426FD6E99B07705BA4A48 – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2012/07/26 07:19:37 | 000,001,158 | —- | M] () MD5=5C11B0E362D426FD6E99B07705BA4A48 – C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2012/07/26 07:19:37 | 000,001,158 | —- | M] () MD5=5C11B0E362D426FD6E99B07705BA4A48 – C:\Windows\WinSxS\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.2.9200.16384_none_282d8a08cf7f1ada\services.lnk

< MD5 for: SERVICES.MOF >
[2012/06/03 01:35:05 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\SysNative\wbem\services.mof
[2012/06/03 01:35:05 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\WinSxS\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.2.9200.16384_none_282967cc570d3701\services.mof

< MD5 for: SERVICES.MSC >
[2012/07/26 18:50:36 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\SysNative\en-US\services.msc
[2012/06/03 01:31:20 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\SysNative\services.msc
[2012/07/26 18:50:36 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\SysWOW64\en-US\services.msc
[2012/06/03 01:31:13 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\SysWOW64\services.msc
[2012/07/26 18:50:36 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\WinSxS\amd64_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.2.9200.16384_en-us_fd08be678622fdab\services.msc
[2012/06/03 01:31:20 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\WinSxS\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.2.9200.16384_none_282d8a08cf7f1ada\services.msc
[2012/06/03 01:31:13 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\WinSxS\wow64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.2.9200.16384_none_3282345b03dfdcd5\services.msc
[2012/07/26 18:50:36 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\WinSxS\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.2.9200.16384_en-us_a0ea22e3cdc58c75\services.msc

< MD5 for: SERVICES.PTXML >
[2012/07/26 07:30:54 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\SysNative\wdi\perftrack\Services.ptxml
[2012/07/26 07:30:54 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\WinSxS\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.2.9200.16384_none_282967cc570d3701\Services.ptxml

< MD5 for: WINLOGON.ADML >
[2012/07/26 18:50:44 | 000,008,017 | —- | M] () MD5=C270056255498A723E7331EFF1AA162F – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_6.2.9200.16384_en-us_edcdb8ec66a62fc0\WinLogon.adml

< MD5 for: WINLOGON.ADMX >
[2012/06/03 01:34:22 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-adm_31bf3856ad364e35_6.2.9200.16384_none_d3d704270306719d\WinLogon.admx

< MD5 for: WINLOGON.EXE >
[2012/09/20 17:33:55 | 000,516,608 | —- | M] (Microsoft Corporation) MD5=1F84B5F8DBDFFD36DF143C61CE25F12A – C:\Windows\SoftwareDistribution\Download\f7f3f78cb5a30b7a9964504cdf37e9a9\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.16420_none_c8c988c15e88a211\winlogon.exe
[2012/09/20 17:33:17 | 000,516,608 | —- | M] (Microsoft Corporation) MD5=6522E98C94A2A81AE11EB66D2AF5743A – C:\Windows\SoftwareDistribution\Download\f7f3f78cb5a30b7a9964504cdf37e9a9\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.20521_none_c95425d677a55b32\winlogon.exe
[2012/07/26 14:08:50 | 000,516,608 | —- | M] (Microsoft Corporation) MD5=93AB226C07A9789B2EC7B41F73602F76 – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.16384_none_c88ca87b5eb5b1ec\winlogon.exe
[2012/10/11 16:46:58 | 000,517,120 | —- | M] (Microsoft Corporation) MD5=BCF2036A0DD579E47C008C133550283E – C:\Windows\SysNative\winlogon.exe
[2012/10/11 16:46:58 | 000,517,120 | —- | M] (Microsoft Corporation) MD5=BCF2036A0DD579E47C008C133550283E – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.16433_none_c8c1b9b35e8e0a07\winlogon.exe
[2012/10/11 16:45:27 | 000,517,120 | —- | M] (Microsoft Corporation) MD5=CBFD56B4EC07CB056A6ABD55DD33671F – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.20534_none_c94c56c877aac328\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2012/07/26 18:50:31 | 000,024,064 | —- | M] (Microsoft Corporation) MD5=B9094B7088CD579E5AED57A693F9BFBD – C:\Windows\SysNative\en-US\winlogon.exe.mui
[2012/07/26 18:50:31 | 000,024,064 | —- | M] (Microsoft Corporation) MD5=B9094B7088CD579E5AED57A693F9BFBD – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.2.9200.16384_en-us_23c238ef8ddaa831\winlogon.exe.mui

< MD5 for: WINLOGON.EXE-0D9AB72B.PF >
[2013/01/10 22:46:01 | 000,032,666 | —- | M] () MD5=34EB8C316947083ACF78DA86AA6C59F9 – C:\Windows\Prefetch\WINLOGON.EXE-0D9AB72B.pf

< MD5 for: WINLOGON.MFL >
[2012/07/26 18:50:31 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\SysNative\wbem\en-US\winlogon.mfl
[2012/07/26 18:50:31 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.2.9200.16384_en-us_81848abaa91301c6\winlogon.mfl

< MD5 for: WINLOGON.MOF >
[2012/07/26 07:30:16 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\SysNative\wbem\winlogon.mof
[2012/07/26 07:30:16 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.2.9200.16384_none_d9027134ffac135f\winlogon.mof

< %SYSTEMDRIVE%\*.* >
[2012/07/26 14:44:30 | 000,398,156 | RHS- | M] () – C:\bootmgr
[2012/06/03 01:30:55 | 000,000,001 | -HS- | M] () – C:\BOOTNXT
[2012/08/04 10:21:37 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2012/12/25 15:39:07 | 1615,872,000 | -HS- | M] () – C:\hiberfil.sys
[2013/01/05 21:42:13 | 2906,546,176 | -HS- | M] () – C:\pagefile.sys
[2012/12/25 15:39:09 | 268,435,456 | -HS- | M] () – C:\swapfile.sys

< %systemroot%\Fonts\*.com >
[2012/08/04 09:37:24 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2012/08/04 09:37:24 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2012/08/04 09:37:24 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2012/08/04 09:37:24 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2012/07/26 19:11:41 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2012/03/09 12:37:20 | 000,302,448 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2012/07/26 19:11:35 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2012/12/16 12:37:21 | 000,000,223 | -HS- | M] () – C:\Users\Won\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >


================================================================================
======================


OTL Extras logfile created on: 11/01/2013 7:48:00 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Won\Downloads
64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16453)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

1.88 Gb Total Physical Memory | 0.74 Gb Available Physical Memory | 39.49% Memory free
4.59 Gb Paging File | 3.10 Gb Available in Paging File | 67.51% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 275.30 Gb Total Space | 232.45 Gb Free Space | 84.44% Space Free | Partition Type: NTFS
Drive D: | 22.02 Gb Total Space | 2.69 Gb Free Space | 12.20% Space Free | Partition Type: NTFS
Drive E: | 317.12 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: COMPUTER | User Name: Won | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – Reg Error: Value error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = CE 37 E6 AF FF 6A CD 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{A6697BD0-73CB-41C5-AAF6-BF2123CA2F6C}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{F5F13175-CED5-4018-A5FB-4EB9A1D4C11E}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C40CEFE-EF9D-4967-A742-C89AF1E44B64}" = dir=out | name=@{microsoft.bing_1.2.0.137_x64__8wekyb3d8bbwe?ms-resource://microsoft.bing/resources/app_name} |
"{0ECAFD14-427B-4948-A9CA-E058D9E5C831}" = dir=in | name=@{microsoft.bing_1.2.0.137_x64__8wekyb3d8bbwe?ms-resource://microsoft.bing/resources/app_name} |
"{0F0FE2CF-80AF-4BED-AF7F-87B159A4669E}" = dir=out | name=norton studio |
"{106D59D0-75E3-4C53-A1E2-6973F646C120}" = dir=in | name=kindle |
"{117554D0-252F-4D60-96F8-3E5899995329}" = dir=out | name=@{microsoft.bingfinance_1.2.0.135_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingfinance/resources/apptitle} |
"{191487FE-D290-4C6D-BE29-896BB8402A76}" = dir=out | name=windows_ie_ac_001 |
"{219C5BB9-E08E-4E95-9558-D246FF3F8D74}" = dir=out | name=microsoft mahjong |
"{21DF4717-5F7D-4803-AC7C-CE3712350836}" = dir=out | name=@{microsoft.bingsports_1.2.0.135_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingsports/resources/bingsports} |
"{28D8A2E7-A9D0-4BAB-B79D-2F17040199E2}" = dir=out | name=@{microsoft.xboxlivegames_1.0.927.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxlivegames/resources/34150} |
"{32D62EE5-CF2D-4AA9-9147-7045DB9FA14E}" = dir=out | name=getting started with windows 8 |
"{36BBCE47-F1D9-4460-8676-0E0003EDCF7D}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{411D6A95-81FA-4A88-B68B-E03610E9345E}" = dir=out | name=@{microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
"{45A5B9A7-FE9A-41AE-83B8-53DE7A43BB9D}" = dir=out | name=microsoft solitaire collection |
"{48B9E224-DB54-4BF1-B147-3FF004D9329C}" = dir=out | name=ebay |
"{492B4C31-CA4A-4690-924E-1E300E1B63D3}" = dir=out | name=hp registration |
"{54CD78F1-5DCE-4014-8A16-1D74762A09BB}" = dir=out | name=@{microsoft.bingweather_1.2.0.135_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/apptitle} |
"{597F6BA4-35B9-47B3-820A-A34C649F7BE8}" = dir=out | name=skype |
"{5BC9C65B-EDB3-4066-8847-AA24B9F41486}" = dir=out | name=@{microsoft.bingnews_1.2.0.135_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingnews/resources/news} |
"{64111219-FB4B-4C1F-9237-F316613C43C0}" = dir=in | name=skype |
"{7737B168-395E-497B-8949-49C0BC1574C1}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{808F1451-4108-46FD-ADBB-F17324B5F0BD}" = dir=out | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
"{96591E5D-3FC2-48D2-A0A1-86D0D41C29E0}" = dir=out | name=@{microsoft.zunevideo_1.0.927.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/33270} |
"{A4CD9391-1EED-413F-BC1E-782459501151}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{A617D05C-217E-4421-80F9-DAA66630D837}" = dir=out | name=@{microsoft.zunemusic_1.0.927.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/resources/33273} |
"{A9E9A5D5-AD0E-459A-9AC8-CB04C312AD12}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd10\powerdvd10.exe |
"{AA1D0A11-9226-466E-B913-C8AF7E3A1447}" = dir=in | name=@{microsoft.windowsphotos_16.4.4204.712_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
"{AF0935A4-20DC-43ED-AAB0-0583AA3D81D3}" = dir=out | name=kindle |
"{B5E5D9B3-007E-46EC-9BB7-724298B1FFF5}" = dir=in | name=@{microsoft.reader_6.2.8516.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |
"{C50CEC81-CBAB-41B2-A222-8EA586AAF5C4}" = dir=out | name=@{microsoft.microsoftskydrive_16.4.4204.712_x64__8wekyb3d8bbwe?ms-resource://microsoft.microsoftskydrive/resources/shortproductname} |
"{CACF765D-B9D2-406C-AB82-EEBF91D78A22}" = dir=out | name=hp connected photo powered by snapfish |
"{CCAE8CCB-E5B4-422E-8D05-23504CA18F22}" = dir=out | name=@{microsoft.bingtravel_1.2.0.145_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingtravel/resources/apptitle} |
"{D302BCE5-9739-4F72-A434-8ED4D00E7084}" = dir=out | name=hp+ |
"{D6BC7E17-84F9-4FD5-A98D-AADB5AEBA96D}" = dir=out | name=@{microsoft.bingmaps_1.2.0.136_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingmaps/resources/appdisplayname} |
"{DD475A87-759D-48EF-9059-563636C180A0}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{E3CE77E6-2DAB-47E7-9E26-9C9180DDD1C1}" = dir=out | name=@{microsoft.windowsphotos_16.4.4204.712_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
"{E7985E1D-C36F-4787-80A8-6350D07E9266}" = dir=in | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
"{E7FFF7AC-614B-4F26-A769-1636865494C6}" = dir=in | name=ebay |
"{EBD658B4-4E3A-4377-BB2E-7342912A24E8}" = dir=in | name=@{microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
"{F44BDC51-8DD1-43D6-950C-C14F480BBFCB}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{F89ADC41-B930-48AA-BC73-86418053D58E}" = dir=out | name=@{microsoft.reader_6.2.8516.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |
"{F8B22DBB-70FB-482F-A691-9C6E61E34376}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{FF22F390-15FB-432C-9F94-030B6FD60DF3}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{0FA995CC-C849-4755-B14B-5404CC75DC24}" = Energy Star
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6E14E6D6-3175-4E1A-B934-CAB5A86367CD}" = HP Postscript Converter
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{E4D6CCF2-0AAF-4B9C-9DE5-893EDC9B4BAA}" = HP Registration Service
"{F4404AFD-2EF3-40C1-8C09-29E5F3B6972B}" = Intel® Trusted Connect Service Client
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0C57987A-A03A-4B95-A309-D23F78F406CA}" = HP Utility Center
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}" = CyberLink Media Suite 10
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}" = CyberLink Power2Go 8
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{4ED7050C-9332-4FB2-AB07-E94F25A53D39}" = HP Quick Launch
"{528AB81B-D65A-4AB0-A2B6-82B51A087D01}" = HP Recovery Manager
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.2.0.0
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp" = WildTangent Games App
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{835B275B-F29B-464B-BD4B-097FD55FAB0A}" = HP Software Framework
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}" = Ralink RT5390R 802.11bgn Wi-Fi Adapter
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{941DE69D-6CEE-4171-8F1F-3D7E352AA498}" = HP Wireless Button Driver
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AE986BF5-B6E3-4F8D-B412-A3DD90DF5146}" = HP Documentation
"{B8019B54-F9BE-490A-9619-6D06F18F129F}" = HP Support Assistant
"{C1594429-8296-4652-BF54-9DBE4932A44C}" = Realtek PCIE Card Reader
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Processor Graphics
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FCB3772C-B7D0-4933-B1A9-3707EBACC573}" = Intel® SDK for OpenCL - CPU Only Runtime Package
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}" = CyberLink Media Suite 10
"InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}" = CyberLink Power2Go 8
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD
"McAfee Security Scan" = McAfee Security Scan Plus
"Mozilla Firefox 17.0.1 (x86 en-US)" = Mozilla Firefox 17.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NIS" = Norton Internet Security
"WildTangent hp Master Uninstall" = HP Games
"WildTangent wildgames Master Uninstall" = WildTangent Games
"WinLiveSuite" = Windows Live Essentials
"WTA-0456dfd2-0ec2-4213-afa2-1d021a5b0fae" = Governor of Poker 2 Premium Edition
"WTA-07c0d2d7-2512-4429-b05c-fc1034b5f4b7" = Bejeweled 3
"WTA-0b17f3fa-0ec1-40cf-aeab-698122631154" = Final Drive Fury
"WTA-0ddee14b-67f9-45b4-83f2-6232e8039cd0" = Cradle of Rome 2
"WTA-1149fabe-18de-426b-82ca-ed3d4eb8bc9d" = Chuzzle Deluxe
"WTA-19453370-88f5-4526-8655-a6bc3d74be3f" = 4 Elements II
"WTA-26047ec2-c1bd-4122-95d7-f000f1a8cdb0" = Hoyle Card Games
"WTA-28e1b6cb-4993-41f7-9e7e-5d13318c0ee6" = Jewel Match 3
"WTA-2dfde976-45c6-4b80-830c-7cabc0de36cb" = Polar Golfer
"WTA-53d9b393-afda-4a8f-ba21-2d4dfc31137a" = Zuma's Revenge
"WTA-545f78a4-9e40-427e-8cab-554b7411c859" = Trinklit Supreme
"WTA-645a22f8-1150-41e5-8145-f0fd933892b8" = Farm Frenzy
"WTA-6ffdca54-7068-4fb8-b958-9f7e75b2be88" = Peggle Nights
"WTA-7fe8770d-e9e1-4da9-9f63-edba4a195277" = 7 Wonders II
"WTA-89c3d389-b1a0-4628-a787-b2162682d2af" = FlatOut 2
"WTA-8eed03a4-32e4-4998-ba4e-5f4c7bec8a29" = Penguins!
"WTA-999558f7-6ca8-4432-b6a6-5bf61ca27a51" = Polar Bowler
"WTA-a19305c6-813e-4154-a587-894c103ca48c" = Roads of Rome 3
"WTA-b49ed285-2311-4bea-b370-11381e6a87ca" = Luxor Evolved
"WTA-bee297fb-b5a6-4858-b2aa-0d70aba5a912" = The Treasures of Mystery Island: The Ghost Ship
"WTA-c18ecbac-f32a-40c0-a6da-a48c843e7e7c" = Letters from Nowhere 2
"WTA-d10fe24a-a395-4471-bf67-4a2111070c4d" = Aloha TriPeaks
"WTA-d4860f2c-2aa6-4340-9bea-2827f832535e" = Mahjongg Dimensions Deluxe: Tiles in Time
"WTA-dbec44c7-852c-497d-91bf-b17a23e39ee1" = Crazy Chicken Soccer
"WTA-de04b025-4712-4c1d-b777-3d288430dc24" = Build-a-lot 4 - Power Source
"WTA-ebedc29f-f87f-4e16-8b88-b155b5c94fd0" = John Deere Drive Green

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 24/12/2012 5:41:31 PM | Computer Name = Computer | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 26498938

Error - 25/12/2012 3:27:00 AM | Computer Name = Computer | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 25/12/2012 3:27:01 AM | Computer Name = Computer | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 519609

Error - 25/12/2012 3:27:01 AM | Computer Name = Computer | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 519609

Error - 25/12/2012 11:32:33 PM | Computer Name = Computer | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 10.0.9200.16453 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 1874 Start
Time: 01cde2fd4b90abf3 Termination Time: 172 Application Path: C:\Program Files\Internet
Explorer\iexplore.exe Report Id: df5bc594-4f0c-11e2-be75-78e3b57e0187 Faulting package
full name: Faulting package-relative application ID:

Error - 26/12/2012 8:48:49 AM | Computer Name = Computer | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 10.0.9200.16453 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 13a8 Start
Time: 01cde2f149c032f7 Termination Time: 88 Application Path: C:\Program Files\Internet
Explorer\iexplore.exe Report Id: 93d9c875-4f5a-11e2-be75-78e3b57e0187 Faulting package
full name: Faulting package-relative application ID:

Error - 26/12/2012 8:49:21 AM | Computer Name = Computer | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 10.0.9200.16453 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 3d0 Start
Time: 01cde2e77e0cbc62 Termination Time: 0 Application Path: C:\Program Files\Internet
Explorer\iexplore.exe Report Id: a8ca46af-4f5a-11e2-be75-78e3b57e0187 Faulting package
full name: Faulting package-relative application ID:

Error - 28/12/2012 4:39:28 AM | Computer Name = Computer | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 10.0.9200.16453 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 237c Start
Time: 01cde3676bcee811 Termination Time: 953 Application Path: C:\Program Files\Internet
Explorer\iexplore.exe Report Id: 1426551a-50ca-11e2-be75-78e3b57e0187 Faulting package
full name: Faulting package-relative application ID:

Error - 29/12/2012 7:27:03 AM | Computer Name = Computer | Source = Microsoft-Windows-Immersive-Shell | ID = 2484
Description = Package DefaultBrowser_NOPUBLISHERID was terminated because it took
too long to suspend.

Error - 29/12/2012 7:27:48 AM | Computer Name = Computer | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 10.0.9200.16453 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 8fc Start
Time: 01cde551eda5054d Termination Time: 4294967295 Application Path: C:\Program
Files\Internet Explorer\iexplore.exe Report Id: ae258664-51aa-11e2-be75-78e3b57e0187

Faulting
package full name: Faulting package-relative application ID:

[ System Events ]
Error - 18/12/2012 12:28:53 AM | Computer Name = Computer | Source = Schannel | ID = 36887
Description = A fatal alert was received from the remote endpoint. The TLS protocol
defined fatal alert code is 51.

Error - 18/12/2012 12:28:53 AM | Computer Name = Computer | Source = Schannel | ID = 36888
Description = A fatal alert was generated and sent to the remote endpoint. This
may result in termination of the connection. The TLS protocol defined fatal error
code is 51. The Windows SChannel error state is 900.

Error - 18/12/2012 12:40:10 AM | Computer Name = Computer | Source = DCOM | ID = 10010
Description =

Error - 18/12/2012 12:40:21 AM | Computer Name = Computer | Source = DCOM | ID = 10010
Description =

Error - 18/12/2012 7:19:34 AM | Computer Name = Computer | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the FontCache3.0.0.0 service.

Error - 19/12/2012 9:12:18 AM | Computer Name = Computer | Source = DCOM | ID = 10010
Description =

Error - 19/12/2012 9:12:18 AM | Computer Name = Computer | Source = DCOM | ID = 10010
Description =

Error - 19/12/2012 9:12:22 AM | Computer Name = Computer | Source = DCOM | ID = 10010
Description =

Error - 19/12/2012 9:12:22 AM | Computer Name = Computer | Source = DCOM | ID = 10010
Description =

Error - 21/12/2012 5:50:27 PM | Computer Name = Computer | Source = Schannel | ID = 36888
Description = A fatal alert was generated and sent to the remote endpoint. This
may result in termination of the connection. The TLS protocol defined fatal error
code is 51. The Windows SChannel error state is 900.


< End of report >