Slow Comp, please help [Closed]

I used OTL before I ran Hijack this. I am using Norton security and it says I am using a lot of CPU from time to time and my comp gets slow.

Here are my HIJACK THIS results:


OTL logfile created on: 20/01/2013 1:37:32 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Won\Desktop
64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16453)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

1.88 Gb Total Physical Memory | 0.98 Gb Available Physical Memory | 51.97% Memory free
3.82 Gb Paging File | 2.86 Gb Available in Paging File | 74.86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 275.30 Gb Total Space | 232.91 Gb Free Space | 84.60% Space Free | Partition Type: NTFS
Drive D: | 22.02 Gb Total Space | 2.69 Gb Free Space | 12.20% Space Free | Partition Type: NTFS
Drive E: | 317.12 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: COMPUTER | User Name: Won | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Won\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Norton Internet Security\Engine\20.2.0.19\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (CyberLink)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe (CyberLink)
PRC - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll ()
MOD - C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll ()
MOD - C:\Program Files (x86)\Norton Internet Security\Engine\20.2.0.19\wincfi39.dll ()


========== Services (SafeList) ==========

SRV:64bit: - (TimeBroker) – C:\Windows\SysNative\TimeBrokerServer.dll (Microsoft Corporation)
SRV:64bit: - (SystemEventsBroker) – C:\Windows\SysNative\SystemEventsBrokerServer.dll (Microsoft Corporation)
SRV:64bit: - (PrintNotify) – C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll (Microsoft Corporation)
SRV:64bit: - (AudioEndpointBuilder) – C:\Windows\SysNative\AudioEndpointBuilder.dll (Microsoft Corporation)
SRV:64bit: - (WSService) – C:\Windows\SysNative\WSService.dll (Microsoft Corporation)
SRV:64bit: - (fhsvc) – C:\Windows\SysNative\fhsvc.dll (Microsoft Corporation)
SRV:64bit: - (BrokerInfrastructure) – C:\Windows\SysNative\bisrv.dll (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (wlidsvc) – C:\Windows\SysNative\wlidsvc.dll (Microsoft Corporation)
SRV:64bit: - (WiaRpc) – C:\Windows\SysNative\wiarpc.dll (Microsoft Corporation)
SRV:64bit: - (Wcmsvc) – C:\Windows\SysNative\wcmsvc.dll (Microsoft Corporation)
SRV:64bit: - (VaultSvc) – C:\Windows\SysNative\vaultsvc.dll (Microsoft Corporation)
SRV:64bit: - (svsvc) – C:\Windows\SysNative\svsvc.dll (Microsoft Corporation)
SRV:64bit: - (netprofm) – C:\Windows\SysNative\netprofmsvc.dll (Microsoft Corporation)
SRV:64bit: - (Netlogon) – C:\Windows\SysNative\netlogon.dll (Microsoft Corporation)
SRV:64bit: - (NcaSvc) – C:\Windows\SysNative\NcaSvc.dll (Microsoft Corporation)
SRV:64bit: - (NcdAutoSetup) – C:\Windows\SysNative\NcdAutoSetup.dll (Microsoft Corporation)
SRV:64bit: - (LSM) – C:\Windows\SysNative\lsm.dll (Microsoft Corporation)
SRV:64bit: - (KeyIso) – C:\Windows\SysNative\keyiso.dll (Microsoft Corporation)
SRV:64bit: - (EFS) – C:\Windows\SysNative\efssvc.dll (Microsoft Corporation)
SRV:64bit: - (DsmSvc) – C:\Windows\SysNative\DeviceSetupManager.dll (Microsoft Corporation)
SRV:64bit: - (DeviceAssociationService) – C:\Windows\SysNative\das.dll (Microsoft Corporation)
SRV:64bit: - (AllUserInstallAgent) – C:\Windows\SysNative\AUInstallAgent.dll (Microsoft Corporation)
SRV:64bit: - (vmicvss) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmictimesync) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicshutdown) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicrdv) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmickvpexchange) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicheartbeat) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (Intel® – C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel® Corporation)
SRV:64bit: - (AERTFilters) – C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Andrea Electronics Corporation)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (PrintNotify) – C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll (Microsoft Corporation)
SRV - (NIS) – C:\Program Files (x86)\Norton Internet Security\Engine\20.2.0.19\ccSvcHst.exe (Symantec Corporation)
SRV - (McComponentHostService) – C:\Program Files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe (McAfee, Inc.)
SRV - (HP Support Assistant Service) – C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company)
SRV - (cphs) – C:\Windows\SysWOW64\IntelCpHeciSvc.exe (Intel Corporation)
SRV - (StorSvc) – C:\Windows\SysWOW64\StorSvc.dll (Microsoft Corporation)
SRV - (WAS) – C:\Windows\SysWOW64\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (AppHostSvc) – C:\Windows\SysWOW64\inetsrv\apphostsvc.dll (Microsoft Corporation)
SRV - (UNS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (jhi_service) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe (Intel Corporation)
SRV - (HPWMISVC) – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
SRV - (GamesAppService) – C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.)


========== Driver Services (SafeList) ==========

DRV:64bit: - (sdbus) – C:\Windows\SysNative\Drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (BthAvrcpTg) – C:\Windows\SysNative\Drivers\BthAvrcpTg.sys (Microsoft Corporation)
DRV:64bit: - (bthhfhid) – C:\Windows\SysNative\Drivers\BthhfHid.sys (Microsoft Corporation)
DRV:64bit: - (hidi2c) – C:\Windows\SysNative\Drivers\hidi2c.sys (Microsoft Corporation)
DRV:64bit: - (USBHUB3) – C:\Windows\SysNative\Drivers\USBHUB3.SYS (Microsoft Corporation)
DRV:64bit: - (pdc) – C:\Windows\SysNative\Drivers\pdc.sys (Microsoft Corporation)
DRV:64bit: - (FxPPM) – C:\Windows\SysNative\Drivers\fxppm.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) – C:\Windows\SysNative\Drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (sdstor) – C:\Windows\SysNative\Drivers\sdstor.sys (Microsoft Corporation)
DRV:64bit: - (dam) – C:\Windows\SysNative\Drivers\dam.sys (Microsoft Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\Drivers\NISx64\1402000.013\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\Drivers\NISx64\1402000.013\symefa64.sys (Symantec Corporation)
DRV:64bit: - (SymDS) – C:\Windows\SysNative\Drivers\NISx64\1402000.013\symds64.sys (Symantec Corporation)
DRV:64bit: - (ccSet_NIS) – C:\Windows\SysNative\Drivers\NISx64\1402000.013\ccsetx64.sys (Symantec Corporation)
DRV:64bit: - (USBXHCI) – C:\Windows\SysNative\Drivers\USBXHCI.SYS (Microsoft Corporation)
DRV:64bit: - (UCX01000) – C:\Windows\SysNative\Drivers\UCX01000.SYS (Microsoft Corporation)
DRV:64bit: - (GPIOClx0101) – C:\Windows\SysNative\Drivers\msgpioclx.sys (Microsoft Corporation)
DRV:64bit: - (msgpiowin32) – C:\Windows\SysNative\Drivers\msgpiowin32.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\Drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\Drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (TPM) – C:\Windows\SysNative\Drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (SymEvent) – C:\Windows\SysNative\Drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (SymNetS) – C:\Windows\SysNative\Drivers\NISx64\1402000.013\symnets.sys (Symantec Corporation)
DRV:64bit: - (SymIRON) – C:\Windows\SysNative\Drivers\NISx64\1402000.013\ironx64.sys (Symantec Corporation)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\Drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (SmbDrvI) – C:\Windows\SysNative\Drivers\Smb_driver_Intel.sys (Synaptics Incorporated)
DRV:64bit: - (SmbDrv) – C:\Windows\SysNative\Drivers\Smb_driver_AMDASF.sys (Synaptics Incorporated)
DRV:64bit: - (netr28x) – C:\Windows\SysNative\Drivers\netr28x.sys (Ralink Technology, Corp.)
DRV:64bit: - (igfx) – C:\Windows\SysNative\Drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (WirelessButtonDriver) – C:\Windows\SysNative\Drivers\WirelessButtonDriver64.sys (Hewlett-Packard Development Company, L.P.)
DRV:64bit: - (iaStorA) – C:\Windows\SysNative\Drivers\iaStorA.sys (Intel Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (condrv) – C:\Windows\SysNative\Drivers\condrv.sys (Microsoft Corporation)
DRV:64bit: - (VSTXRAID) – C:\Windows\SysNative\Drivers\VSTXRAID.SYS (VIA Corporation)
DRV:64bit: - (VerifierExt) – C:\Windows\SysNative\Drivers\VerifierExt.sys (Microsoft Corporation)
DRV:64bit: - (UASPStor) – C:\Windows\SysNative\Drivers\uaspstor.sys (Microsoft Corporation)
DRV:64bit: - (acpiex) – C:\Windows\SysNative\Drivers\acpiex.sys (Microsoft Corporation)
DRV:64bit: - (spaceport) – C:\Windows\SysNative\Drivers\spaceport.sys (Microsoft Corporation)
DRV:64bit: - (storahci) – C:\Windows\SysNative\Drivers\storahci.sys (Microsoft Corporation)
DRV:64bit: - (mvumis) – C:\Windows\SysNative\Drivers\mvumis.sys (Marvell Semiconductor, Inc.)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\Drivers\stexstor.sys (Promise Technology, Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\Drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (LSI_SSS) – C:\Windows\SysNative\Drivers\lsi_sss.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\Drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (EhStorTcgDrv) – C:\Windows\SysNative\Drivers\EhStorTcgDrv.sys (Microsoft Corporation)
DRV:64bit: - (EhStorClass) – C:\Windows\SysNative\Drivers\EhStorClass.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\Drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (3ware) – C:\Windows\SysNative\Drivers\3ware.sys (LSI)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\Drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\Drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (CLFS) – C:\Windows\SysNative\Drivers\clfs.sys (Microsoft Corporation)
DRV:64bit: - (WFPLWFS) – C:\Windows\SysNative\Drivers\wfplwfs.sys (Microsoft Corporation)
DRV:64bit: - (vpci) – C:\Windows\SysNative\Drivers\vpci.sys (Microsoft Corporation)
DRV:64bit: - (WdFilter) – C:\Windows\SysNative\Drivers\WdFilter.sys (Microsoft Corporation)
DRV:64bit: - (WdBoot) – C:\Windows\SysNative\Drivers\WdBoot.sys (Microsoft Corporation)
DRV:64bit: - (terminpt) – C:\Windows\SysNative\Drivers\terminpt.sys (Microsoft Corporation)
DRV:64bit: - (mshidumdf) – C:\Windows\SysNative\Drivers\mshidumdf.sys (Microsoft Corporation)
DRV:64bit: - (BasicDisplay) – C:\Windows\SysNative\Drivers\BasicDisplay.sys (Microsoft Corporation)
DRV:64bit: - (HyperVideo) – C:\Windows\SysNative\Drivers\HyperVideo.sys (Microsoft Corporation)
DRV:64bit: - (BasicRender) – C:\Windows\SysNative\Drivers\BasicRender.sys (Microsoft Corporation)
DRV:64bit: - (gencounter) – C:\Windows\SysNative\Drivers\vmgencounter.sys (Microsoft Corporation)
DRV:64bit: - (kdnic) – C:\Windows\SysNative\Drivers\kdnic.sys (Microsoft Corporation)
DRV:64bit: - (acpitime) – C:\Windows\SysNative\Drivers\acpitime.sys (Microsoft Corporation)
DRV:64bit: - (npsvctrig) – C:\Windows\SysNative\Drivers\npsvctrig.sys (Microsoft Corporation)
DRV:64bit: - (WpdUpFltr) – C:\Windows\SysNative\Drivers\WpdUpFltr.sys (Microsoft Corporation)
DRV:64bit: - (acpipagr) – C:\Windows\SysNative\Drivers\acpipagr.sys (Microsoft Corporation)
DRV:64bit: - (hyperkbd) – C:\Windows\SysNative\Drivers\hyperkbd.sys (Microsoft Corporation)
DRV:64bit: - (SerCx) – C:\Windows\SysNative\Drivers\SerCx.sys (Microsoft Corporation)
DRV:64bit: - (SpbCx) – C:\Windows\SysNative\Drivers\SpbCx.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\Drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (BthHFEnum) – C:\Windows\SysNative\Drivers\bthhfenum.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) – C:\Windows\SysNative\Drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\Drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (wpcfltr) – C:\Windows\SysNative\Drivers\wpcfltr.sys (Microsoft Corporation)
DRV:64bit: - (NdisImPlatform) – C:\Windows\SysNative\Drivers\NdisImPlatform.sys (Microsoft Corporation)
DRV:64bit: - (MsLldp) – C:\Windows\SysNative\Drivers\mslldp.sys (Microsoft Corporation)
DRV:64bit: - (Ndu) – C:\Windows\SysNative\Drivers\Ndu.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) – C:\Windows\SysNative\Drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (CLVirtualDrive) – C:\Windows\SysNative\Drivers\CLVirtualDrive.sys (CyberLink)
DRV:64bit: - (SymELAM) – C:\Windows\SysNative\Drivers\NISx64\1402000.013\symelam.sys (Symantec Corporation)
DRV:64bit: - (IntcDAud) – C:\Windows\SysNative\Drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (RSP2STOR) – C:\Windows\SysNative\Drivers\RtsP2Stor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (RTL8168) – C:\Windows\SysNative\Drivers\Rt630x64.sys (Realtek )
DRV:64bit: - (SRTSPX) – C:\Windows\SysNative\Drivers\NISx64\1402000.013\srtspx64.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\VirusDefs\20130118.022\ex64.sys (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\VirusDefs\20130118.022\eng64.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\IPSDefs\20130118.001\IDSviA64.sys (Symantec Corporation)
DRV - (BHDrvx64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\BASHDefs\20130111.001\BHDrvx64.sys (Symantec Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.jp.msn.com/CQALL13/13
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.jp.msn.com/CQALL13/13
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;pc=CPNTDFJS
IE:64bit: - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
IE:64bit: - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://au.search.yahoo.com/search?p={searc…amp;type=CPNTDF
IE:64bit: - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.jp.msn.com/CQALL13/13
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.jp.msn.com/CQALL13/13
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;pc=CPNTDFJS
IE - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
IE - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://au.search.yahoo.com/search?p={searc…amp;type=CPNTDF
IE - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.jp.msn.com/CQALL13/13
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.jp.msn.com/CQALL13/13
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;pc=CPNTDFJS
IE - HKCU\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
IE - HKCU\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://au.search.yahoo.com/search?p={searc…amp;type=CPNTDF
IE - HKCU\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.13
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\coFFPlgn\ [2013/01/09 18:23:31 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\IPSFFPlgn\ [2012/12/16 12:33:20 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/01/19 08:33:26 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/01/19 08:33:26 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2012/12/29 22:40:28 | 000,000,000 | —D | M] (No name found) – C:\Users\Won\AppData\Roaming\Mozilla\Extensions
[2013/01/12 12:01:47 | 000,000,000 | —D | M] (No name found) – C:\Users\Won\AppData\Roaming\Mozilla\Firefox\Profiles\7yg7jjse.default\extensions
[2013/01/12 12:01:47 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Won\AppData\Roaming\Mozilla\Firefox\Profiles\7yg7jjse.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2013/01/19 08:33:21 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2013/01/19 08:33:26 | 000,262,552 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/11/29 19:27:12 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/11/29 19:27:12 | 000,002,058 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/07/26 16:26:49 | 000,000,824 | —- | M]) - C:\Windows\SysNative\Drivers\etc\hosts
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.2.0.19\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.2.0.19\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.2.0.19\coieplg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [CLVirtualDrive] C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe (CyberLink Corp.)
O4 - HKLM..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{042E8B2D-1CE4-4C61-A9E5-5D680BA98BFE}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O30 - LSA: Security Packages - (livessp) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/10/28 16:28:27 | 000,000,175 | R— | M] () - E:\autorun.inf – [ CDFS ]
O33 - MountPoints2\{f324f4a5-ffde-11e1-be71-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{f324f4a5-ffde-11e1-be71-806e6f6e6963}\Shell\AutoRun\command - "" = E:\SETUP.EXE – [2006/10/28 16:28:27 | 000,463,152 | R— | M] (Microsoft Corporation)
O33 - MountPoints2\{f324f4a5-ffde-11e1-be71-806e6f6e6963}\Shell\configure\command - "" = E:\setup.exe – [2006/10/28 16:28:27 | 000,463,152 | R— | M] (Microsoft Corporation)
O33 - MountPoints2\{f324f4a5-ffde-11e1-be71-806e6f6e6963}\Shell\install\command - "" = E:\setup.exe – [2006/10/28 16:28:27 | 000,463,152 | R— | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs:64bit: wlidsvc - C:\Windows\SysNative\wlidsvc.dll (Microsoft Corporation)
NetSvcs:64bit: DsmSvc - C:\Windows\SysNative\DeviceSetupManager.dll (Microsoft Corporation)
NetSvcs:64bit: NcaSvc - C:\Windows\SysNative\NcaSvc.dll (Microsoft Corporation)
NetSvcs:64bit: SystemEventsBroker - C:\Windows\SysNative\SystemEventsBrokerServer.dll (Microsoft Corporation)

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/01/20 13:24:24 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2013/01/20 13:10:49 | 004,732,416 | —- | C] (AVAST Software) – C:\Users\Won\Desktop\aswmbr.exe
[2013/01/20 12:57:14 | 000,000,000 | —D | C] – C:\Users\Won\Desktop\In Australia, Is There ACut Off Time For Reporting Rape, Child Sex Crimes, Abuse On Children - Yahoo!7 Answers_files
[2013/01/19 08:33:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2013/01/12 12:12:34 | 001,131,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\AppXDeploymentServer.dll
[2013/01/12 12:12:33 | 000,707,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\AppXDeploymentExtensions.dll
[2013/01/12 12:12:32 | 000,178,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SystemEventsBrokerServer.dll
[2013/01/12 12:12:32 | 000,170,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TimeBrokerServer.dll
[2013/01/12 12:12:31 | 000,368,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\sppwinob.dll
[2013/01/12 12:12:03 | 005,974,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstscax.dll
[2013/01/12 12:12:03 | 005,088,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstscax.dll
[2013/01/12 12:12:03 | 001,096,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wmpmde.dll
[2013/01/12 12:12:02 | 001,145,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winmde.dll
[2013/01/12 12:12:01 | 003,245,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpcorets.dll
[2013/01/12 12:12:01 | 002,302,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\authui.dll
[2013/01/12 12:12:00 | 001,122,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Taskmgr.exe
[2013/01/12 12:12:00 | 001,027,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Taskmgr.exe
[2013/01/12 12:11:59 | 001,536,512 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\storagewmi.dll
[2013/01/12 12:11:59 | 000,955,904 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WebcamUi.dll
[2013/01/12 12:11:55 | 000,798,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WebcamUi.dll
[2013/01/12 12:11:54 | 000,245,248 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\usbmon.dll
[2013/01/12 12:11:50 | 000,631,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\UserLanguagesCpl.dll
[2013/01/12 12:11:49 | 002,033,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\authui.dll
[2013/01/12 12:11:49 | 000,891,904 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\winmde.dll
[2013/01/12 12:11:48 | 000,329,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\storport.sys
[2013/01/12 12:11:48 | 000,244,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wpnapps.dll
[2013/01/12 12:11:47 | 000,194,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\sdbus.sys
[2013/01/12 12:11:47 | 000,124,648 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\dumpsd.sys
[2013/01/12 12:11:46 | 000,560,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\UserLanguagesCpl.dll
[2013/01/12 12:11:46 | 000,058,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuauclt.exe
[2013/01/12 12:11:45 | 001,048,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstsc.exe
[2013/01/12 12:11:45 | 000,256,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WSDMon.dll
[2013/01/12 12:11:45 | 000,179,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wpnapps.dll
[2013/01/12 12:11:41 | 001,217,536 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\storagewmi.dll
[2013/01/12 12:11:35 | 001,123,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstsc.exe
[2013/01/12 12:11:34 | 000,888,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\nshwfp.dll
[2013/01/12 12:11:34 | 000,702,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\nshwfp.dll
[2013/01/12 12:11:34 | 000,190,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vdsutil.dll
[2013/01/12 12:11:33 | 000,378,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\FWPUCLNT.DLL
[2013/01/12 12:11:33 | 000,245,248 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\FWPUCLNT.DLL
[2013/01/12 12:11:33 | 000,173,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\storewuauth.dll
[2013/01/12 12:11:33 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vdsldr.exe
[2013/01/12 12:11:32 | 000,120,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vds_ps.dll
[2013/01/12 12:11:32 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\vds_ps.dll
[2013/01/12 12:11:32 | 000,031,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\BthAvrcpTg.sys
[2013/01/12 12:11:32 | 000,029,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\BthhfHid.sys
[2013/01/12 12:11:32 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\BtaMPM.sys
[2013/01/11 07:44:17 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Won\Desktop\OTL.exe
[2013/01/10 22:41:29 | 000,000,000 | —D | C] – C:\Users\Won\Desktop\Inheritance_files
[2013/01/10 18:45:31 | 002,367,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WSService.dll
[2013/01/10 18:45:29 | 013,640,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Windows.UI.Xaml.dll
[2013/01/10 18:45:17 | 003,265,256 | —- | C] (Broadcom Corporation) – C:\Windows\SysNative\drivers\evbda.sys
[2013/01/10 18:45:09 | 014,259,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wmp.dll
[2013/01/10 18:45:08 | 010,791,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Windows.UI.Xaml.dll
[2013/01/10 18:45:01 | 002,397,184 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WpcMon.exe
[2013/01/10 18:44:55 | 003,847,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d2d1.dll
[2013/01/10 18:44:52 | 003,964,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WinSAT.exe
[2013/01/10 18:44:51 | 011,875,328 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wmp.dll
[2013/01/10 18:44:49 | 000,533,224 | —- | C] (Broadcom Corporation) – C:\Windows\SysNative\drivers\bxvbda.sys
[2013/01/10 18:44:47 | 001,513,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vssapi.dll
[2013/01/10 18:44:42 | 001,825,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntdll.dll
[2013/01/10 18:44:39 | 001,739,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RacEngn.dll
[2013/01/10 18:44:39 | 001,019,392 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MsSpellCheckingFacility.dll
[2013/01/10 18:44:38 | 002,219,008 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10warp.dll
[2013/01/10 18:44:38 | 001,304,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Windows.Media.Streaming.dll
[2013/01/10 18:44:37 | 000,757,248 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\uDWM.dll
[2013/01/10 18:44:37 | 000,389,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MMDevAPI.dll
[2013/01/10 18:44:36 | 000,762,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\provcore.dll
[2013/01/10 18:44:34 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncsi.dll
[2013/01/10 18:44:32 | 000,543,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wlroamextension.dll
[2013/01/10 18:44:31 | 000,573,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WinSATAPI.dll
[2013/01/10 18:44:27 | 000,995,328 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Windows.Media.Streaming.dll
[2013/01/10 18:44:26 | 000,634,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\apphelp.dll
[2013/01/10 18:44:25 | 001,590,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WindowsCodecs.dll
[2013/01/10 18:44:25 | 000,468,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MFMediaEngine.dll
[2013/01/10 18:44:25 | 000,155,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\IPHLPAPI.DLL
[2013/01/10 18:44:24 | 000,709,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MsSpellCheckingFacility.dll
[2013/01/10 18:44:23 | 001,743,872 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\combase.dll
[2013/01/10 18:44:23 | 000,236,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MFPlay.dll
[2013/01/10 18:44:20 | 000,604,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dnsapi.dll
[2013/01/10 18:44:20 | 000,420,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WWAHost.exe
[2013/01/10 18:44:18 | 000,866,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WinTypes.dll
[2013/01/10 18:44:18 | 000,755,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fveapi.dll
[2013/01/10 18:44:17 | 000,344,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wlidcredprov.dll
[2013/01/10 18:44:17 | 000,108,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\rascfg.dll
[2013/01/10 18:44:16 | 000,617,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfsrcsnk.dll
[2013/01/10 18:44:16 | 000,545,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskeng.exe
[2013/01/10 18:44:16 | 000,355,328 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfsvr.dll
[2013/01/10 18:44:15 | 000,180,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\bcdsrv.dll
[2013/01/10 18:44:15 | 000,121,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rascfg.dll
[2013/01/10 18:44:06 | 000,249,344 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wpnprv.dll
[2013/01/10 18:44:05 | 000,337,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\USBXHCI.SYS
[2013/01/10 18:44:04 | 001,400,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\propsys.dll
[2013/01/10 18:44:04 | 000,332,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wintrust.dll
[2013/01/10 18:44:02 | 000,541,184 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\VAN.dll
[2013/01/10 18:44:02 | 000,410,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wlroamextension.dll
[2013/01/10 18:44:02 | 000,303,616 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WinSATAPI.dll
[2013/01/10 18:44:01 | 000,203,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WSClient.dll
[2013/01/10 18:44:00 | 000,410,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\services.exe
[2013/01/10 18:44:00 | 000,240,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fveapibase.dll
[2013/01/10 18:43:59 | 000,179,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\bisrv.dll
[2013/01/10 18:43:57 | 000,751,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\appwiz.cpl
[2013/01/10 18:43:57 | 000,361,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFMediaEngine.dll
[2013/01/10 18:43:57 | 000,093,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\psmsrv.dll
[2013/01/10 18:43:55 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fhengine.dll
[2013/01/10 18:43:55 | 000,177,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WSSync.dll
[2013/01/10 18:43:55 | 000,028,392 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\msgpiowin32.sys
[2013/01/10 18:43:54 | 000,166,912 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WSClient.dll
[2013/01/10 18:43:54 | 000,120,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\msgpioclx.sys
[2013/01/10 18:43:52 | 000,670,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\appwiz.cpl
[2013/01/10 18:43:52 | 000,333,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WWAHost.exe
[2013/01/10 18:43:52 | 000,180,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFPlay.dll
[2013/01/10 18:43:52 | 000,154,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WSSync.dll
[2013/01/10 18:43:52 | 000,112,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\PackageStateRoaming.dll
[2013/01/10 18:43:50 | 001,369,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RacEngn.dll
[2013/01/10 18:43:50 | 000,457,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wpncore.dll
[2013/01/10 18:43:50 | 000,390,144 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Windows.Networking.BackgroundTransfer.dll
[2013/01/10 18:43:50 | 000,172,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dwmredir.dll
[2013/01/10 18:43:50 | 000,090,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TpmTasks.dll
[2013/01/10 18:43:49 | 000,228,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ProximityService.dll
[2013/01/10 18:43:48 | 000,256,512 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msvproc.dll
[2013/01/10 18:43:48 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\PackageStateRoaming.dll
[2013/01/10 18:43:47 | 000,533,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\provcore.dll
[2013/01/10 18:43:47 | 000,065,536 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\setbcdlocale.dll
[2013/01/10 18:43:45 | 000,509,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\twinapi.dll
[2013/01/10 18:43:45 | 000,480,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\VAN.dll
[2013/01/10 18:43:45 | 000,027,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\avrt.dll
[2013/01/10 18:43:44 | 001,247,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\combase.dll
[2013/01/10 18:43:44 | 000,449,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfsrcsnk.dll
[2013/01/10 18:43:44 | 000,103,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\microsoft-windows-kernel-power-events.dll
[2013/01/10 18:43:44 | 000,062,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\dumpfve.sys
[2013/01/10 18:43:42 | 002,016,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\batmeter.dll
[2013/01/10 18:43:42 | 002,007,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\batmeter.dll
[2013/01/10 18:43:42 | 000,411,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\FWPKCLNT.SYS
[2013/01/10 18:43:42 | 000,148,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\tpm.sys
[2013/01/10 18:43:42 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SettingSyncHost.exe
[2013/01/10 18:43:42 | 000,034,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\perfdisk.dll
[2013/01/10 18:43:40 | 000,465,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WinTypes.dll
[2013/01/10 18:43:40 | 000,303,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\dxgmms1.sys
[2013/01/10 18:43:40 | 000,212,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\UCX01000.SYS
[2013/01/10 18:43:39 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\perfdisk.dll
[2013/01/10 18:43:39 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\svchost.exe
[2013/01/10 18:43:38 | 000,270,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfsvr.dll
[2013/01/10 18:43:38 | 000,263,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wlidcredprov.dll
[2013/01/10 18:43:37 | 001,342,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\user32.dll
[2013/01/10 18:43:37 | 000,267,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Windows.Networking.BackgroundTransfer.dll
[2013/01/10 18:43:37 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fhevents.dll
[2013/01/10 18:43:36 | 000,194,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2013/01/10 18:43:35 | 000,214,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msvproc.dll
[2013/01/10 18:43:35 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\perfnet.dll
[2013/01/10 18:43:34 | 000,627,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lpksetup.exe
[2013/01/10 18:43:34 | 000,437,760 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfh264enc.dll
[2013/01/10 18:43:34 | 000,413,184 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfh264enc.dll
[2013/01/10 18:43:34 | 000,080,896 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\SettingSyncHost.exe
[2013/01/10 18:43:33 | 000,699,392 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\twinapi.dll
[2013/01/10 18:43:33 | 000,118,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\DevPropMgr.dll
[2013/01/10 18:43:33 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dwm.exe
[2013/01/10 18:43:32 | 000,080,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\drvinst.exe
[2013/01/10 18:43:31 | 000,315,392 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fhcfg.dll
[2013/01/10 18:43:31 | 000,092,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drvinst.exe
[2013/01/10 18:43:29 | 000,459,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxgi.dll
[2013/01/10 18:43:29 | 000,156,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\DAFWSD.dll
[2013/01/10 18:43:28 | 002,066,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d11.dll
[2013/01/10 18:43:28 | 000,080,896 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fhsrchapi.dll
[2013/01/10 18:43:28 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\perfnet.dll
[2013/01/10 18:43:27 | 001,701,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3d11.dll
[2013/01/10 18:43:27 | 000,588,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\webio.dll
[2013/01/10 18:43:27 | 000,189,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\perfos.dll
[2013/01/10 18:43:26 | 000,417,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\webio.dll
[2013/01/10 18:43:26 | 000,280,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fhcat.dll
[2013/01/10 18:43:25 | 000,116,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fhsvc.dll
[2013/01/10 18:43:24 | 000,092,160 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lpremove.exe
[2013/01/10 18:43:23 | 000,163,328 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\sspicli.dll
[2013/01/10 18:43:23 | 000,137,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fhshl.dll
[2013/01/10 18:43:23 | 000,075,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rasdiag.dll
[2013/01/10 18:43:23 | 000,064,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fhlisten.dll
[2013/01/10 18:43:23 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\rasdiag.dll
[2013/01/10 18:43:23 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cryptdlg.dll
[2013/01/10 18:43:23 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\cryptdlg.dll
[2013/01/10 18:43:22 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fhmanagew.exe
[2013/01/10 18:43:22 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fhcleanup.dll
[2013/01/10 18:43:21 | 000,069,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vsstrace.dll
[2013/01/10 18:43:21 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fhsrchph.dll
[2013/01/10 18:43:21 | 000,038,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fhtask.dll
[2013/01/10 18:43:21 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\sdbinst.exe
[2013/01/10 18:43:21 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\sdbinst.exe
[2013/01/10 18:43:20 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ndptsp.tsp
[2013/01/10 18:43:20 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rasmxs.dll
[2013/01/10 18:43:19 | 000,064,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fhautoplay.dll
[2013/01/10 18:43:19 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\rasmxs.dll
[2013/01/10 18:43:18 | 000,060,928 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ndptsp.tsp
[2013/01/10 18:43:18 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rasser.dll
[2013/01/10 18:43:17 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\perfctrs.dll
[2013/01/10 18:43:17 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\perfctrs.dll
[2013/01/10 18:43:17 | 000,037,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\perfproc.dll
[2013/01/10 18:43:17 | 000,034,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\perfproc.dll
[2013/01/10 18:43:17 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\perfos.dll
[2013/01/10 18:43:17 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\rasser.dll
[2013/01/10 18:43:16 | 000,047,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kmddsp.tsp
[2013/01/10 18:43:15 | 000,038,912 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\kmddsp.tsp
[2013/01/10 18:43:15 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\sspisrv.dll
[2013/01/10 18:43:15 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fhsvcctl.dll
[2013/01/10 18:43:14 | 000,037,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\LangCleanupSysprepAction.dll
[2013/01/10 18:43:14 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\eventcls.dll
[2013/01/10 18:43:14 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\eventcls.dll
[2013/01/10 18:43:13 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MUILanguageCleanup.dll
[2013/01/10 18:43:12 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lpksetupproxyserv.dll
[2013/01/10 18:43:08 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\spwmp.dll
[2013/01/10 18:43:07 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\spwmp.dll
[2013/01/10 18:43:07 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\shimeng.dll
[2013/01/10 18:43:06 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msdxm.ocx
[2013/01/10 18:43:06 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxmasf.dll
[2013/01/10 18:43:06 | 000,004,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msdxm.ocx
[2013/01/10 18:43:06 | 000,004,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dxmasf.dll
[2013/01/10 18:43:04 | 000,199,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cdd.dll
[2013/01/10 18:43:01 | 009,374,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wmploc.DLL
[2013/01/10 18:42:59 | 009,374,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wmploc.DLL
[2013/01/10 18:38:54 | 000,301,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\newdev.dll
[2013/01/10 18:38:49 | 000,275,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\newdev.dll
[2013/01/10 18:38:48 | 000,076,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\newdev.exe
[2013/01/10 18:38:48 | 000,075,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ndadmin.exe
[2013/01/10 18:38:48 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\newdev.exe
[2013/01/10 18:38:48 | 000,073,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ndadmin.exe
[2013/01/10 18:38:41 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wwanprotdim.dll
[2013/01/09 21:10:02 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncryptsslp.dll
[2013/01/09 21:10:02 | 000,071,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ncryptsslp.dll
[2013/01/09 21:09:42 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msxml6r.dll
[2013/01/09 21:09:42 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msxml6r.dll
[2013/01/09 21:09:42 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msxml3r.dll
[2013/01/09 21:09:42 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msxml3r.dll
[2013/01/05 15:50:48 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\{D27305E9-1BAB-4BDD-A3C2-9C5169718297}
[2013/01/04 18:40:03 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\{5722BF4C-096C-48BC-AF40-3E13843B4A40}
[2013/01/03 21:47:54 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\Diagnostics
[2013/01/02 10:39:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2012/12/31 18:45:23 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\{73E36C9E-B682-40CB-9629-256403489E1B}
[2012/12/30 10:26:54 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\{F880CE05-7FC5-4B1C-82B6-196D40F9368E}
[2012/12/29 22:47:42 | 000,000,000 | —D | C] – C:\Users\Won\dwhelper
[2012/12/29 22:47:19 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\Macromedia
[2012/12/29 22:45:39 | 000,000,000 | —D | C] – C:\ProgramData\McAfee Security Scan
[2012/12/29 22:45:37 | 000,000,000 | —D | C] – C:\ProgramData\McAfee
[2012/12/29 22:45:36 | 000,000,000 | —D | C] – C:\Program Files (x86)\McAfee Security Scan
[2012/12/29 22:45:03 | 000,000,000 | —D | C] – C:\ProgramData\Adobe
[2012/12/29 22:40:21 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Roaming\Mozilla
[2012/12/29 22:40:21 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\Mozilla
[2012/12/29 22:40:02 | 000,000,000 | —D | C] – C:\ProgramData\Mozilla
[2012/12/29 22:40:01 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Maintenance Service
[2012/12/29 22:26:34 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\{13FD6B07-2940-4465-A707-092DABA7B1DB}
[2012/12/29 22:26:33 | 000,000,000 | —D | C] – C:\Users\Won\AppData\Local\{AC16EB70-B1E9-4801-ABE7-80F6460AFAFE}
[2012/12/26 14:30:17 | 000,000,000 | —D | C] – C:\Users\Won\Desktop\Law job
[2012/12/26 14:29:57 | 000,000,000 | —D | C] – C:\Users\Won\Desktop\Restaurant Other job

========== Files - Modified Within 30 Days ==========

[2013/01/20 13:29:23 | 000,941,050 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/01/20 13:29:23 | 000,788,176 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/01/20 13:29:23 | 000,162,458 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/01/20 13:26:21 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/01/20 13:24:14 | 268,435,456 | -HS- | M] () – C:\swapfile.sys
[2013/01/20 13:24:11 | 366,610,369 | —- | M] () – C:\Windows\MEMORY.DMP
[2013/01/20 13:24:08 | 1615,872,000 | -HS- | M] () – C:\hiberfil.sys
[2013/01/20 13:14:38 | 000,000,512 | —- | M] () – C:\Users\Won\Desktop\MBR.dat
[2013/01/20 13:10:49 | 004,732,416 | —- | M] (AVAST Software) – C:\Users\Won\Desktop\aswmbr.exe
[2013/01/20 13:00:57 | 000,321,856 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/01/20 12:57:18 | 000,067,677 | —- | M] () – C:\Users\Won\Desktop\In Australia, Is There ACut Off Time For Reporting Rape, Child Sex Crimes, Abuse On Children - Yahoo!7 Answers.htm
[2013/01/16 18:35:29 | 000,415,635 | —- | M] () – C:\Users\Won\Desktop\2006 September - Limitation periods and child sexual abuse cases Limitation periods and child sexual abuse cases_php.mht
[2013/01/11 07:44:18 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Won\Desktop\OTL.exe
[2013/01/10 22:42:41 | 000,138,824 | —- | M] () – C:\Users\Won\Desktop\Inheritance.htm
[2013/01/09 09:58:54 | 000,396,300 | —- | M] () – C:\Users\Won\Desktop\notional estate.pdf
[2013/01/09 09:32:04 | 000,024,622 | —- | M] () – C:\Users\Won\Desktop\Thai Heirs.pdf
[2013/01/09 09:14:54 | 000,302,627 | —- | M] () – C:\Users\Won\Desktop\Overseas assets.pdf
[2013/01/02 10:39:14 | 000,002,046 | —- | M] () – C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2013/01/02 10:39:14 | 000,002,046 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/12/29 22:40:05 | 000,001,147 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk

========== Files Created - No Company Name ==========

[2013/01/20 13:24:11 | 366,610,369 | —- | C] () – C:\Windows\MEMORY.DMP
[2013/01/20 13:14:38 | 000,000,512 | —- | C] () – C:\Users\Won\Desktop\MBR.dat
[2013/01/20 13:00:43 | 000,321,856 | —- | C] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/01/20 12:57:16 | 000,067,677 | —- | C] () – C:\Users\Won\Desktop\In Australia, Is There ACut Off Time For Reporting Rape, Child Sex Crimes, Abuse On Children - Yahoo!7 Answers.htm
[2013/01/16 18:35:22 | 000,415,635 | —- | C] () – C:\Users\Won\Desktop\2006 September - Limitation periods and child sexual abuse cases Limitation periods and child sexual abuse cases_php.mht
[2013/01/10 22:42:40 | 000,138,824 | —- | C] () – C:\Users\Won\Desktop\Inheritance.htm
[2013/01/10 18:43:21 | 000,110,592 | —- | C] () – C:\Windows\SysNative\OEMLicense.dll
[2013/01/10 18:43:21 | 000,083,968 | —- | C] () – C:\Windows\SysWow64\OEMLicense.dll
[2013/01/09 09:58:54 | 000,396,300 | —- | C] () – C:\Users\Won\Desktop\notional estate.pdf
[2013/01/09 09:32:04 | 000,024,622 | —- | C] () – C:\Users\Won\Desktop\Thai Heirs.pdf
[2013/01/09 09:14:54 | 000,302,627 | —- | C] () – C:\Users\Won\Desktop\Overseas assets.pdf
[2012/12/29 22:45:37 | 000,002,046 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/12/29 22:45:36 | 000,002,046 | —- | C] () – C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2012/12/29 22:40:04 | 000,001,147 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/12/29 22:40:03 | 000,001,159 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/08/09 07:18:04 | 000,272,928 | —- | C] () – C:\Windows\SysWow64\igvpkrng600.bin
[2012/08/09 07:17:54 | 000,064,512 | —- | C] () – C:\Windows\SysWow64\igdde32.dll
[2012/08/09 07:17:52 | 000,963,388 | —- | C] () – C:\Windows\SysWow64\igcodeckrng600.bin
[2012/08/04 09:40:09 | 000,916,510 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2012/07/26 19:13:10 | 000,215,943 | —- | C] () – C:\Windows\SysWow64\dssec.dat
[2012/07/26 19:13:09 | 000,000,741 | —- | C] () – C:\Windows\SysWow64\NOISE.DAT
[2012/07/26 18:21:26 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2012/07/26 12:17:42 | 000,043,520 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2012/07/26 07:37:29 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2012/07/26 07:28:31 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2012/07/26 07:22:56 | 000,733,840 | —- | C] () – C:\Windows\SysWow64\igcodeckrng700.bin
[2012/07/26 07:22:56 | 000,492,340 | —- | C] () – C:\Windows\SysWow64\igvpkrng700.bin
[2012/07/26 07:22:54 | 000,982,240 | —- | C] () – C:\Windows\SysWow64\igkrng500.bin
[2012/07/26 07:22:54 | 000,439,308 | —- | C] () – C:\Windows\SysWow64\igcompkrng500.bin
[2012/07/26 07:22:54 | 000,092,356 | —- | C] () – C:\Windows\SysWow64\igfcg500m.bin
[2012/06/03 01:31:19 | 000,673,088 | —- | C] () – C:\Windows\SysWow64\mlang.dat
[2012/04/21 07:59:44 | 000,001,536 | —- | C] () – C:\Windows\SysWow64\IusEventLog.dll

========== ZeroAccess Check ==========

[2012/08/18 04:43:16 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/11/06 15:19:27 | 019,789,824 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/11/06 15:20:00 | 017,560,576 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2012/07/26 14:05:38 | 001,004,544 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2012/07/26 14:18:27 | 000,784,896 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2012/07/26 14:07:41 | 000,455,680 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/12/16 12:35:21 | 000,000,000 | —D | M] – C:\Users\Won\AppData\Roaming\Synaptics
[2012/12/16 12:57:46 | 000,000,000 | —D | M] – C:\Users\Won\AppData\Roaming\WebApp
[2012/12/16 12:47:52 | 000,000,000 | —D | M] – C:\Users\Won\AppData\Roaming\WildTangent

========== Purity Check ==========



========== Custom Scans ==========

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.ADML >
[2012/07/26 18:50:44 | 000,003,671 | —- | M] () MD5=007B16AEF3E958080573CDB80648167D – C:\Windows\WinSxS\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.2.9200.16384_en-us_7bca26f6f419a854\Explorer.adml
[2012/07/26 18:50:44 | 000,003,671 | —- | M] () MD5=007B16AEF3E958080573CDB80648167D – C:\Windows\WinSxS\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.2.9200.16433_en-us_7bff382ef3f2006f\Explorer.adml
[2012/07/26 18:50:44 | 000,003,671 | —- | M] () MD5=007B16AEF3E958080573CDB80648167D – C:\Windows\WinSxS\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.2.9200.20534_en-us_7c89d5440d0eb990\Explorer.adml

< MD5 for: EXPLORER.ADMX >
[2012/06/03 01:32:35 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.16384_none_6e8451187a9a1607\Explorer.admx
[2012/06/03 01:32:35 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.16420_none_6ec1315e7a6d062c\Explorer.admx
[2012/06/03 01:32:35 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.16433_none_6eb962507a726e22\Explorer.admx
[2012/06/03 01:32:35 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.20521_none_6f4bce739389bf4d\Explorer.admx
[2012/06/03 01:32:35 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.20534_none_6f43ff65938f2743\Explorer.admx

< MD5 for: EXPLORER.EXE >
[2012/10/11 16:53:24 | 002,115,952 | —- | M] (Microsoft Corporation) MD5=0AD19A3CA61271BA872AD90771BA47DC – C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.20534_none_b592a71650d677ed\explorer.exe
[2012/10/11 19:09:58 | 002,380,944 | —- | M] (Microsoft Corporation) MD5=0DDFEAA2AA18D4295EF220EB666B2312 – C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.20534_none_ab3dfcc41c75b5f2\explorer.exe
[2012/07/26 14:50:01 | 002,114,936 | —- | M] (Microsoft Corporation) MD5=5B6ED1B57DBFF18D405A0260559B571E – C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16384_none_b4d2f8c937e166b1\explorer.exe
[2012/07/26 15:49:13 | 002,380,440 | —- | M] (Microsoft Corporation) MD5=928791755FDDEA721B053535EF84FA17 – C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16384_none_aa7e4e770380a4b6\explorer.exe
[2012/10/11 16:56:41 | 002,115,952 | —- | M] (Microsoft Corporation) MD5=953ADECFF08202A01EFC6110214FDE02 – C:\Windows\SysWOW64\explorer.exe
[2012/10/11 16:56:41 | 002,115,952 | —- | M] (Microsoft Corporation) MD5=953ADECFF08202A01EFC6110214FDE02 – C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16433_none_b5080a0137b9becc\explorer.exe
[2012/10/11 18:35:16 | 002,380,944 | —- | M] (Microsoft Corporation) MD5=E13A31D5254C25406A7946BDD9B06364 – C:\Windows\explorer.exe
[2012/10/11 18:35:16 | 002,380,944 | —- | M] (Microsoft Corporation) MD5=E13A31D5254C25406A7946BDD9B06364 – C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16433_none_aab35faf0358fcd1\explorer.exe

< MD5 for: EXPLORER.EXE.MUI >
[2012/07/26 18:50:36 | 000,020,480 | —- | M] (Microsoft Corporation) MD5=C25D32FEDB5AA6FF87B5A29D56D35FFA – C:\Windows\en-US\explorer.exe.mui
[2012/07/26 18:50:36 | 000,020,480 | —- | M] (Microsoft Corporation) MD5=C25D32FEDB5AA6FF87B5A29D56D35FFA – C:\Windows\SysWOW64\en-US\explorer.exe.mui
[2012/07/26 18:50:36 | 000,020,480 | —- | M] (Microsoft Corporation) MD5=C25D32FEDB5AA6FF87B5A29D56D35FFA – C:\Windows\WinSxS\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.2.9200.16384_en-us_5ebc2e81fd6600eb\explorer.exe.mui
[2012/07/26 18:50:36 | 000,020,480 | —- | M] (Microsoft Corporation) MD5=C25D32FEDB5AA6FF87B5A29D56D35FFA – C:\Windows\WinSxS\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.2.9200.16384_en-us_6910d8d431c6c2e6\explorer.exe.mui

< MD5 for: EXPLORER.EXE-03C49D11.PF >
[2013/01/11 07:39:56 | 000,234,078 | —- | M] () MD5=72B0839A5607EFB40EB99B1917EC543B – C:\Windows\Prefetch\EXPLORER.EXE-03C49D11.pf

< MD5 for: IEXPLORE.EXE >
[2012/10/11 17:34:54 | 000,770,544 | —- | M] (Microsoft Corporation) MD5=06E77B5F6BB60E11A377B68BA4AA1DA7 – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20534_none_2b74d7cd3a353a33\iexplore.exe
[2012/10/11 18:33:47 | 000,775,168 | —- | M] (Microsoft Corporation) MD5=0A5074651C95792D32BCF536D64D0463 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20534_none_21202d7b05d47838\iexplore.exe
[2012/07/26 14:36:56 | 000,770,504 | —- | M] (Microsoft Corporation) MD5=1249974F2A658D07E2647DD9C3592B9E – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16384_none_425d1fb32079214f\iexplore.exe
[2012/10/11 18:24:22 | 000,775,168 | —- | M] (Microsoft Corporation) MD5=13F97D5006C3E37D0A4AABC767C0E553 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16433_none_37f8bacaec24e2f1\iexplore.exe
[2012/07/26 15:58:31 | 000,775,112 | —- | M] (Microsoft Corporation) MD5=29CD24D8CA72FDB986B39277E70A48B6 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16384_none_38087560ec185f54\iexplore.exe
[2012/11/08 17:58:26 | 000,775,152 | —- | M] (Microsoft Corporation) MD5=2F92EE7EE7E189EBDDADD5BEEB7E9DE0 – C:\Program Files\Internet Explorer\iexplore.exe
[2012/11/08 17:58:26 | 000,775,152 | —- | M] (Microsoft Corporation) MD5=2F92EE7EE7E189EBDDADD5BEEB7E9DE0 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16453_none_37fabb5eec23159f\iexplore.exe
[2012/10/24 14:14:41 | 000,770,528 | —- | M] (Microsoft Corporation) MD5=39F90724C1A98648CCCDDF13631F2D4A – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16442_none_424e7c2f2084a4a2\iexplore.exe
[2012/11/08 17:48:39 | 000,775,152 | —- | M] (Microsoft Corporation) MD5=4B33704E4B071EC44806846CBE50EB2A – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20557_none_2121e9b705d2f7c9\iexplore.exe
[2012/10/24 14:20:45 | 000,770,528 | —- | M] (Microsoft Corporation) MD5=79FF6755B94FF918441D8F8162E5AC9C – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20544_none_2b75d8173a34538a\iexplore.exe
[2012/11/08 15:52:27 | 000,770,544 | —- | M] (Microsoft Corporation) MD5=7EBFC838C815C3DACA135837D8F7906E – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20557_none_2b7694093a33b9c4\iexplore.exe
[2012/10/24 15:43:41 | 000,775,136 | —- | M] (Microsoft Corporation) MD5=8E1B68702CDB0DDC6597357766E941D9 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16442_none_37f9d1dcec23e2a7\iexplore.exe
[2012/10/11 16:41:41 | 000,770,560 | —- | M] (Microsoft Corporation) MD5=BCF25D644DF1288CD9A6524FF7AB23C8 – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16433_none_424d651d2085a4ec\iexplore.exe
[2012/11/08 15:45:20 | 000,770,520 | —- | M] (Microsoft Corporation) MD5=D05965C02FD5781503968225B22189F4 – C:\Program Files (x86)\Internet Explorer\iexplore.exe
[2012/11/08 15:45:20 | 000,770,520 | —- | M] (Microsoft Corporation) MD5=D05965C02FD5781503968225B22189F4 – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16453_none_424f65b12083d79a\iexplore.exe
[2012/10/24 17:08:39 | 000,775,152 | —- | M] (Microsoft Corporation) MD5=F78F14096EB41341C4D880CEA6D681A2 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20544_none_21212dc505d3918f\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2012/07/26 18:50:45 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C724BBF739D40D8AA3023943F3450A7 – C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui
[2012/07/26 18:50:45 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C724BBF739D40D8AA3023943F3450A7 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2012/07/26 18:50:45 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C724BBF739D40D8AA3023943F3450A7 – C:\Users\Won\AppData\Local\Temp\iexplore.exe.mui
[2012/07/26 18:50:45 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C724BBF739D40D8AA3023943F3450A7 – C:\Windows\WinSxS\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_10.0.9200.16384_en-us_31b50ad823c5a03b\iexplore.exe.mui
[2012/07/26 18:50:45 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C724BBF739D40D8AA3023943F3450A7 – C:\Windows\WinSxS\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_10.0.9200.16384_en-us_3c09b52a58266236\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-6C28DB75.PF >
[2012/12/29 22:32:50 | 000,212,164 | —- | M] () MD5=26AE83B13228CAD5DB803164C5C42C0B – C:\Windows\Prefetch\IEXPLORE.EXE-6C28DB75.pf

< MD5 for: IEXPLORE.EXE-6C28DB76.PF >
[2012/12/28 17:15:40 | 000,303,462 | —- | M] () MD5=C1943CE0BE87AB3AF8D782E86667A367 – C:\Windows\Prefetch\IEXPLORE.EXE-6C28DB76.pf

< MD5 for: IEXPLORE.EXE-7A9337F2.PF >
[2013/01/20 13:04:06 | 000,118,522 | —- | M] () MD5=DDCC290DA325852534EC62D82A20E5DF – C:\Windows\Prefetch\IEXPLORE.EXE-7A9337F2.pf

< MD5 for: IEXPLORE.EXE-F4FB5D2F.PF >
[2013/01/20 13:32:40 | 000,335,670 | —- | M] () MD5=D9415FCAEF12C77A5D778DB8402F1B2B – C:\Windows\Prefetch\IEXPLORE.EXE-F4FB5D2F.pf

< MD5 for: SERVICES >
[2012/07/26 16:26:47 | 000,017,463 | —- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 – C:\Windows\WinSxS\amd64_microsoft-windows-w..ucture-other-minwin_31bf3856ad364e35_6.2.9200.16384_none_8e0944daeed62829\services

< MD5 for: SERVICES.EXE >
[2012/09/20 17:33:11 | 000,410,624 | —- | M] (Microsoft Corporation) MD5=581190907DA1CF8CB7B87B35FFE64A07 – C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.2.9200.20521_none_98a9ea2e9f571eb2\services.exe
[2012/07/26 16:26:45 | 000,410,624 | —- | M] (Microsoft Corporation) MD5=754A2CC1F32107EA87CBD305ABE3E618 – C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.2.9200.16384_none_97e26cd38667756c\services.exe
[2012/09/20 17:33:46 | 000,410,624 | —- | M] (Microsoft Corporation) MD5=8F226143046435C75C033B0C52E90FFE – C:\Windows\SysNative\services.exe
[2012/09/20 17:33:46 | 000,410,624 | —- | M] (Microsoft Corporation) MD5=8F226143046435C75C033B0C52E90FFE – C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.2.9200.16420_none_981f4d19863a6591\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2012/07/26 18:50:12 | 000,018,944 | —- | M] (Microsoft Corporation) MD5=8BCB19134E995FA62587DCE26E13B36C – C:\Windows\SysNative\en-US\services.exe.mui
[2012/07/26 18:50:12 | 000,018,944 | —- | M] (Microsoft Corporation) MD5=8BCB19134E995FA62587DCE26E13B36C – C:\Windows\WinSxS\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.2.9200.16384_en-us_c2c6ee7bafb963b8\services.exe.mui

< MD5 for: SERVICES.JS >
[2012/07/26 18:53:58 | 000,056,775 | —- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 – C:\Program Files\WindowsApps\Microsoft.BingFinance_1.2.0.135_x64__8wekyb3d8bbwe\platform\js\services.js
[2012/07/26 18:53:49 | 000,056,775 | —- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 – C:\Program Files\WindowsApps\Microsoft.BingNews_1.2.0.135_x64__8wekyb3d8bbwe\platform\js\services.js
[2012/07/26 18:53:45 | 000,056,775 | —- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 – C:\Program Files\WindowsApps\Microsoft.BingSports_1.2.0.135_x64__8wekyb3d8bbwe\platform\js\services.js
[2012/07/26 18:54:27 | 000,056,775 | —- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 – C:\Program Files\WindowsApps\Microsoft.BingTravel_1.2.0.145_x64__8wekyb3d8bbwe\platform\js\services.js
[2012/07/26 18:53:53 | 000,056,775 | —- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 – C:\Program Files\WindowsApps\Microsoft.BingWeather_1.2.0.135_x64__8wekyb3d8bbwe\platform\js\services.js
[2012/12/17 13:45:50 | 000,069,359 | —- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 – C:\Program Files\WindowsApps\Microsoft.BingFinance_1.7.0.26_x64__8wekyb3d8bbwe\common\js\services.js
[2012/12/17 13:45:50 | 000,069,359 | —- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 – C:\Program Files\WindowsApps\Microsoft.BingFinance_1.7.0.29_x64__8wekyb3d8bbwe\common\js\services.js
[2012/12/17 13:48:00 | 000,069,359 | —- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 – C:\Program Files\WindowsApps\Microsoft.BingNews_1.7.0.26_x64__8wekyb3d8bbwe\common\js\services.js
[2012/12/17 13:48:00 | 000,069,359 | —- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 – C:\Program Files\WindowsApps\Microsoft.BingNews_1.7.0.27_x64__8wekyb3d8bbwe\common\js\services.js
[2012/12/17 13:48:00 | 000,069,359 | —- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 – C:\Program Files\WindowsApps\Microsoft.BingNews_1.7.0.31_x64__8wekyb3d8bbwe\common\js\services.js
[2012/12/17 13:49:38 | 000,069,359 | —- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 – C:\Program Files\WindowsApps\Microsoft.BingSports_1.7.0.26_x64__8wekyb3d8bbwe\common\js\services.js
[2012/12/17 13:49:54 | 000,069,359 | —- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 – C:\Program Files\WindowsApps\Microsoft.BingTravel_1.7.0.26_x64__8wekyb3d8bbwe\Common\js\services.js
[2012/12/17 13:48:12 | 000,069,359 | —- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 – C:\Program Files\WindowsApps\Microsoft.BingWeather_1.7.0.26_x64__8wekyb3d8bbwe\common\js\services.js

< MD5 for: SERVICES.LNK >
[2012/07/26 07:19:37 | 000,001,158 | —- | M] () MD5=5C11B0E362D426FD6E99B07705BA4A48 – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2012/07/26 07:19:37 | 000,001,158 | —- | M] () MD5=5C11B0E362D426FD6E99B07705BA4A48 – C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2012/07/26 07:19:37 | 000,001,158 | —- | M] () MD5=5C11B0E362D426FD6E99B07705BA4A48 – C:\Windows\WinSxS\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.2.9200.16384_none_282d8a08cf7f1ada\services.lnk

< MD5 for: SERVICES.MOF >
[2012/06/03 01:35:05 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\SysNative\wbem\services.mof
[2012/06/03 01:35:05 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\WinSxS\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.2.9200.16384_none_282967cc570d3701\services.mof

< MD5 for: SERVICES.MSC >
[2012/07/26 18:50:36 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\SysNative\en-US\services.msc
[2012/06/03 01:31:20 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\SysNative\services.msc
[2012/07/26 18:50:36 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\SysWOW64\en-US\services.msc
[2012/06/03 01:31:13 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\SysWOW64\services.msc
[2012/07/26 18:50:36 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\WinSxS\amd64_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.2.9200.16384_en-us_fd08be678622fdab\services.msc
[2012/06/03 01:31:20 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\WinSxS\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.2.9200.16384_none_282d8a08cf7f1ada\services.msc
[2012/06/03 01:31:13 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\WinSxS\wow64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.2.9200.16384_none_3282345b03dfdcd5\services.msc
[2012/07/26 18:50:36 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\WinSxS\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.2.9200.16384_en-us_a0ea22e3cdc58c75\services.msc

< MD5 for: SERVICES.PTXML >
[2012/07/26 07:30:54 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\SysNative\wdi\perftrack\Services.ptxml
[2012/07/26 07:30:54 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\WinSxS\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.2.9200.16384_none_282967cc570d3701\Services.ptxml

< MD5 for: WINLOGON.ADML >
[2012/07/26 18:50:44 | 000,008,017 | —- | M] () MD5=C270056255498A723E7331EFF1AA162F – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_6.2.9200.16384_en-us_edcdb8ec66a62fc0\WinLogon.adml

< MD5 for: WINLOGON.ADMX >
[2012/06/03 01:34:22 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-adm_31bf3856ad364e35_6.2.9200.16384_none_d3d704270306719d\WinLogon.admx

< MD5 for: WINLOGON.EXE >
[2012/09/20 17:33:55 | 000,516,608 | —- | M] (Microsoft Corporation) MD5=1F84B5F8DBDFFD36DF143C61CE25F12A – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.16420_none_c8c988c15e88a211\winlogon.exe
[2012/09/20 17:33:17 | 000,516,608 | —- | M] (Microsoft Corporation) MD5=6522E98C94A2A81AE11EB66D2AF5743A – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.20521_none_c95425d677a55b32\winlogon.exe
[2012/07/26 14:08:50 | 000,516,608 | —- | M] (Microsoft Corporation) MD5=93AB226C07A9789B2EC7B41F73602F76 – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.16384_none_c88ca87b5eb5b1ec\winlogon.exe
[2012/10/11 16:46:58 | 000,517,120 | —- | M] (Microsoft Corporation) MD5=BCF2036A0DD579E47C008C133550283E – C:\Windows\SysNative\winlogon.exe
[2012/10/11 16:46:58 | 000,517,120 | —- | M] (Microsoft Corporation) MD5=BCF2036A0DD579E47C008C133550283E – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.16433_none_c8c1b9b35e8e0a07\winlogon.exe
[2012/10/11 16:45:27 | 000,517,120 | —- | M] (Microsoft Corporation) MD5=CBFD56B4EC07CB056A6ABD55DD33671F – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.20534_none_c94c56c877aac328\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2012/07/26 18:50:31 | 000,024,064 | —- | M] (Microsoft Corporation) MD5=B9094B7088CD579E5AED57A693F9BFBD – C:\Windows\SysNative\en-US\winlogon.exe.mui
[2012/07/26 18:50:31 | 000,024,064 | —- | M] (Microsoft Corporation) MD5=B9094B7088CD579E5AED57A693F9BFBD – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.2.9200.16384_en-us_23c238ef8ddaa831\winlogon.exe.mui

< MD5 for: WINLOGON.EXE-0D9AB72B.PF >
[2013/01/20 12:58:52 | 000,031,738 | —- | M] () MD5=284A9579CCEF1C25759EE758F8915490 – C:\Windows\Prefetch\WINLOGON.EXE-0D9AB72B.pf

< MD5 for: WINLOGON.MFL >
[2012/07/26 18:50:31 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\SysNative\wbem\en-US\winlogon.mfl
[2012/07/26 18:50:31 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.2.9200.16384_en-us_81848abaa91301c6\winlogon.mfl

< MD5 for: WINLOGON.MOF >
[2012/07/26 07:30:16 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\SysNative\wbem\winlogon.mof
[2012/07/26 07:30:16 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.2.9200.16384_none_d9027134ffac135f\winlogon.mof

< %SYSTEMDRIVE%\*.* >
[2012/07/26 14:44:30 | 000,398,156 | RHS- | M] () – C:\bootmgr
[2012/06/03 01:30:55 | 000,000,001 | -HS- | M] () – C:\BOOTNXT
[2012/08/04 10:21:37 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2013/01/20 13:24:08 | 1615,872,000 | -HS- | M] () – C:\hiberfil.sys
[2013/01/20 13:24:14 | 2080,374,784 | -HS- | M] () – C:\pagefile.sys
[2013/01/20 13:24:14 | 268,435,456 | -HS- | M] () – C:\swapfile.sys

< %systemroot%\Fonts\*.com >
[2012/08/04 09:37:24 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2012/08/04 09:37:24 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2012/08/04 09:37:24 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2012/08/04 09:37:24 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2012/07/26 19:11:41 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2012/03/09 12:37:20 | 000,302,448 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2012/07/26 19:11:35 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2012/12/16 12:37:21 | 000,000,223 | -HS- | M] () – C:\Users\Won\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2013/01/20 13:10:49 | 004,732,416 | —- | M] (AVAST Software) – C:\Users\Won\Desktop\aswmbr.exe
[2013/01/11 07:44:18 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Won\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >

Hi and Welcome!! My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  
• The fixes are specific to your problem and should only be used for the issues on this machine.
  
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  
• It's often worth reading through these instructions and printing them for ease of reference.
  
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  
• Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.
———

[external image: Posted Image] Please download TDSSKiller

• Double click TDSSKiller.exe
• Press Start Scan
• If Malicious objects are found, select Skip by changing the Cure dropdown in the upper right.
• Do Not Attempt To Fix Anything Now. We just need to look over the report and be sure we are removing the correct items.
• Attach the log in your next reply
  
• A copy of the log will be saved automatically to the root of the drive (typically C:\)

———-