Problems after FBI Hijack

Hello. Needing your help with figuring out why I lost Internet Explorer and the PC is much slower. The PC has also lost some software functions. All this occurred after the FBI Locked screen hijack. A friend came in and at least got the PC to get going-plus put in Mozilla as the new browser- but I'm still left with some problems.

I am attaching the OTL, Hijack This and DDS reports in this and a second post. I appreciate your work.

Thanks,
hecrodfnp

Hijack This

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:34:21 PM, on 5/27/2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Acroprint\Attendance Rx\arxservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\WINDOWS\Dell\PanelMgr\SSMMgr.exe
C:\WINDOWS\twain_32\Dell\Dell2335\Scan2Pc.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Acroprint\Attendance Rx\arxsvc.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\Program Files\Acroprint\Attendance Rx\AttendanceRx.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Acroprint\Attendance Rx\ARXTQ100N.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acroprint\Attendance Rx\ARXTQ100S.exe
C:\Program Files\Citrix\GoToMyPC\g2svc.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\Citrix\GoToMyPC\g2comm.exe
C:\Program Files\Citrix\GoToMyPC\g2pre.exe
C:\Program Files\Citrix\GoToMyPC\g2tray.exe
c:\Program Files\Microsoft SQL Server\MSSQL10_50.ACROPRINT\MSSQL\Binn\sqlservr.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acroprint\timeQplusV4\Server\tQp.Service.Server.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\Intuit\SyncManager\Current\IntuitSyncManager.exe
C:\WINDOWS\system32\mstsc.exe
C:\Program Files\DELL\Dell 2335dn MFP\SPanel\Spanel.exe
C:\WINDOWS\system32\mstsc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\mstsc.exe
C:\Program Files\Real\RealPlayer\update\realsched.exe
C:\Documents and Settings\administrator.AFC.000\My Documents\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.opusdei.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USREL/1
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.msn.com/USREL/1
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Wajam IE BHO - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files\Wajam\IE\priam_bho.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [Dell PanelMgr] C:\WINDOWS\Dell\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [2335dn Scan2PC] "C:\WINDOWS\twain_32\Dell\Dell2335\Scan2Pc.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Real\RealPlayer\update\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe startup
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_7_700_169_Plugin.exe -update plugin
O4 - Global Startup: Attendance Rx.lnk = ?
O4 - Global Startup: Intuit Data Protect.lnk = C:\Program Files\Common Files\Intuit\DataProtect\IntuitDataProtect.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: QuickBooks_Standard_21.lnk = C:\Program Files\Intuit\QuickBooks 2013\QBW32.EXE
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1261514258078
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://e-mds.webex.com/client/T27LB/support/ieatgpc.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com//activex/ractrl.cab?lmi=972
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = afc.local
O17 - HKLM\Software\..\Telephony: DomainName = afc.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{763F0D47-11DC-4F77-BEF5-5C1D3BD62FC7}: NameServer = 192.168.77.10
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = afc.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = afc.local
O18 - Protocol: intu-help-qb6 - {6898B29B-BF49-43CB-A0B1-D0B9496AF491} - C:\Program Files\Intuit\QuickBooks 2013\HelpAsyncPluggableProtocol.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: arxservice - Unknown owner - C:\Program Files\Acroprint\Attendance Rx\arxservice.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GoToMyPC - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToMyPC\g2svc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: QBIDPService (QBVSS) - Intuit Inc. - C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: timeQplus Server - Unknown owner - C:\Program Files\Acroprint\timeQplusV4\Server\tQp.Service.Server.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

–
End of file - 12124 bytes

DDS:

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 10.21.2
Run by [removed] at 16:36:02 on 2013-05-27
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1427 [GMT -5:00]
.
.
============== Running Processes ================
.
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Acroprint\Attendance Rx\arxservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\WINDOWS\Dell\PanelMgr\SSMMgr.exe
C:\WINDOWS\twain_32\Dell\Dell2335\Scan2Pc.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Acroprint\Attendance Rx\arxsvc.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\Program Files\Acroprint\Attendance Rx\AttendanceRx.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Acroprint\Attendance Rx\ARXTQ100N.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acroprint\Attendance Rx\ARXTQ100S.exe
C:\Program Files\Citrix\GoToMyPC\g2svc.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\Citrix\GoToMyPC\g2comm.exe
C:\Program Files\Citrix\GoToMyPC\g2pre.exe
C:\Program Files\Citrix\GoToMyPC\g2tray.exe
c:\Program Files\Microsoft SQL Server\MSSQL10_50.ACROPRINT\MSSQL\Binn\sqlservr.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Acroprint\timeQplusV4\Server\tQp.Service.Server.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\Intuit\SyncManager\Current\IntuitSyncManager.exe
C:\WINDOWS\system32\mstsc.exe
C:\Program Files\DELL\Dell 2335dn MFP\SPanel\Spanel.exe
C:\WINDOWS\system32\mstsc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\mstsc.exe
C:\Program Files\Real\RealPlayer\update\realsched.exe
c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.opusdei.org/
uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
mDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} -
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Wajam: {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - c:\program files\wajam\ie\priam_bho.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.8313.1002\swg.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil32_11_7_700_169_Plugin.exe -update plugin
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [Dell PanelMgr] c:\windows\dell\panelmgr\SSMMgr.exe /autorun
mRun: [2335dn Scan2PC] "c:\windows\twain_32\dell\dell2335\Scan2Pc.exe"
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [BrMfcWnd] c:\program files\brother\brmfcmon\BrMfcWnd.exe /AUTORUN
mRun: [ControlCenter3] c:\program files\brother\controlcenter3\brctrcen.exe /autorun
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [Intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\attend~1.lnk - c:\program files\acroprint\attendance rx\AttendanceRx.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\intuit~1.lnk - c:\program files\common files\intuit\dataprotect\IntuitDataProtect.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~2.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\intuit\quickbooks 2013\QBW32.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:323
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1261514258078
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://e-mds.webex.com/client/T27LB/support/ieatgpc.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com//activex/ractrl.cab?lmi=972
TCP: Interfaces\{763F0D47-11DC-4F77-BEF5-5C1D3BD62FC7} : NameServer = 192.168.77.10
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: intu-help-qb6 - {6898B29B-BF49-43cb-A0B1-D0B9496AF491} - c:\program files\intuit\quickbooks 2013\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} -
Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\coreftp\pftpns.dll
Notify: GoToMyPC - c:\program files\citrix\gotomypc\G2WinLogon.dll
Notify: igfxcui - igfxdev.dll
Notify: LMIinit - LMIinit.dll
SEH: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\27.0.1453.94\installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level –multi-install –chrome
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\administrator.afc.000\application data\mozilla\firefox\profiles\econsfri.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.opusdei.org/
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\update\1.3.21.145\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.20125.0\npctrlui.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_7_700_169.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npptools.dll
.
============= SERVICES / DRIVERS ===============
.
R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [2009-12-14 24064]
R2 arxservice;arxservice;c:\program files\acroprint\attendance rx\arxservice.exe [2010-3-11 61440]
R2 BBUpdate;BBUpdate;c:\program files\microsoft\bingbar\SeaPort.EXE [2011-6-15 249648]
R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2012-1-31 374704]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2011-9-16 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2011-7-20 47640]
R2 monblanking;monblanking;c:\windows\system32\drivers\monblanking.sys [2013-4-26 28416]
R2 MSSQL$ACROPRINT;SQL Server (ACROPRINT);c:\program files\microsoft sql server\mssql10_50.acroprint\mssql\binn\sqlservr.exe [2011-6-17 43040096]
R2 QBVSS;QBIDPService;c:\program files\common files\intuit\dataprotect\QBIDPService.exe [2013-3-11 1248256]
R2 timeQplus Server;timeQplus Server;c:\program files\acroprint\timeqplusv4\server\tQp.Service.Server.exe [2013-5-10 15872]
R3 BrSerIb;Brother Serial Interface Driver(WDM);c:\windows\system32\drivers\BrSerIb.sys [2012-6-5 71424]
R3 BrUsbSIb;Brother Serial USB Driver(WDM);c:\windows\system32\drivers\BrUsbSib.sys [2012-6-5 11520]
R3 k57w2k;Broadcom NetLink ™ Gigabit Ethernet;c:\windows\system32\drivers\k57xp32.sys [2009-12-14 176640]
R3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S0 cerc6;cerc6; [x]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2010-4-3 44896]
S2 SQLAgent$ACROPRINT;SQL Server Agent (ACROPRINT);c:\program files\microsoft sql server\mssql10_50.acroprint\mssql\binn\SQLAGENT.EXE [2011-6-17 370016]
S2 SSPORT;SSPORT;\??\c:\windows\system32\drivers\ssport.sys –> c:\windows\system32\drivers\SSPORT.sys [?]
S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-7-7 195336]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [2012-7-15 18432]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
S4 RsFx0151;RsFx0151 Driver;c:\windows\system32\drivers\RsFx0151.sys [2011-6-17 240736]
.
=============== Created Last 30 ================
.
2013-05-19 16:53:01 ——– d—–w- c:\program files\iPod
2013-05-19 16:52:57 ——– d—–w- c:\program files\iTunes
2013-05-19 16:52:57 ——– d—–w- c:\documents and settings\all users\application data\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-05-11 10:37:28 209472 —-a-w- c:\program files\internet explorer\plugins\nppdf32.dll
2013-05-10 06:51:14 272128 -c—-w- c:\windows\system32\dllcache\bthport.sys
2013-05-10 06:50:28 456320 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys
2013-05-10 06:46:25 12928 -c—-w- c:\windows\system32\dllcache\usb8023x.sys
2013-05-10 06:42:42 2193408 -c—-w- c:\windows\system32\dllcache\ntoskrnl.exe
2013-05-10 06:42:42 2149888 -c—-w- c:\windows\system32\dllcache\ntkrnlmp.exe
2013-05-10 06:42:42 2070016 -c—-w- c:\windows\system32\dllcache\ntkrnlpa.exe
2013-05-10 06:42:42 2028544 -c—-w- c:\windows\system32\dllcache\ntkrpamp.exe
2013-05-10 06:35:44 ——– d—–w- c:\documents and settings\administrator.afc.000\local settings\application data\Sun
2013-05-10 06:25:05 144896 —-a-w- c:\windows\system32\javacpl.cpl
2013-05-10 06:25:04 866720 —-a-w- c:\windows\system32\npDeployJava1.dll
2013-05-10 06:24:46 94112 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-05-10 06:09:39 ——– d—–w- c:\documents and settings\administrator.afc.000\local settings\application data\NPE
2013-05-10 06:00:20 ——– d-sha-r- C:\cmdcons
2013-05-10 05:57:42 98816 —-a-w- c:\windows\sed.exe
2013-05-10 05:57:42 256000 —-a-w- c:\windows\PEV.exe
2013-05-10 05:57:42 208896 —-a-w- c:\windows\MBR.exe
2013-05-10 05:49:59 101376 -c–a-w- c:\windows\system32\dllcache\srusbusd.dll
2013-05-10 05:48:59 7680 -c–a-w- c:\windows\system32\dllcache\ftpctrs2.dll
2013-05-10 05:46:39 210968 -c–a-w- c:\windows\system32\dllcache\wuweb.dll
2013-05-10 05:35:54 24661 -c–a-w- c:\windows\system32\dllcache\spxcoins.dll
2013-05-10 05:35:54 24661 —-a-w- c:\windows\system32\spxcoins.dll
2013-05-10 05:35:54 13312 -c–a-w- c:\windows\system32\dllcache\irclass.dll
2013-05-10 05:35:54 13312 —-a-w- c:\windows\system32\irclass.dll
2013-05-10 05:35:35 16535 —-a-r- c:\windows\SET52.tmp
2013-05-10 05:35:33 1088840 —-a-r- c:\windows\SET46.tmp
2013-05-10 05:35:31 1296669 —-a-r- c:\windows\SET43.tmp
2013-05-10 04:57:55 ——– d—–w- C:\034500e9cbd934d3d535843d
2013-05-10 04:22:50 16535 —-a-r- c:\windows\SET173.tmp
2013-05-10 04:22:47 1088840 —-a-r- c:\windows\SET167.tmp
2013-05-10 04:22:46 1296669 —-a-r- c:\windows\SET164.tmp
2013-04-30 19:52:56 ——– d—–w- c:\documents and settings\all users\application data\Acroprint
2013-04-30 19:41:04 ——– d—–w- c:\documents and settings\administrator.afc.000\local settings\application data\LogMeIn Rescue Applet
.
==================== Find3M ====================
.
2013-05-10 06:24:21 788896 —-a-w- c:\windows\system32\deployJava1.dll
2013-04-16 21:18:26 81920 —-a-w- c:\windows\system32\ieencode.dll
2013-04-16 21:18:26 668672 —-a-w- c:\windows\system32\wininet.dll
2013-04-16 21:18:26 61952 —-a-w- c:\windows\system32\tdc.ocx
2013-04-13 00:53:33 369664 —-a-w- c:\windows\system32\html.iec
2013-04-10 13:40:09 691592 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-04-10 13:40:08 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-04-10 01:31:19 1876352 —-a-w- c:\windows\system32\win32k.sys
2013-03-13 11:26:56 53080 —-a-w- c:\windows\system32\spool\prtprocs\w32x86\GoToPrintProcessor.dll
2013-03-13 11:26:54 126296 —-a-w- c:\windows\system32\gotomon.dll
2013-03-13 11:15:48 28416 —-a-w- c:\windows\system32\drivers\monblanking.sys
2013-03-11 15:30:38 1721752 —-a-w- c:\windows\system32\InetClnt.dll
2013-03-11 15:15:00 1694992 —-a-w- c:\windows\system32\VBA6.DLL
2013-03-11 15:14:20 741008 —-a-w- c:\windows\system32\SPR32D30.DLL
2013-03-08 08:36:22 293376 —-a-w- c:\windows\system32\winsrv.dll
2013-03-07 01:32:25 2149888 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-03-07 00:50:30 2028544 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-02-27 07:56:51 2067456 —-a-w- c:\windows\system32\mstscax.dll
.
============= FINISH: 16:36:17.55 ===============
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 5/10/2013 12:50:32 AM
System Uptime: 5/16/2013 7:50:42 AM (273 hours ago)
.
Motherboard: Dell Inc. | | 0T656F
Processor: Intel Pentium III Xeon processor | CPU | 2926/1066mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 149 GiB total, 74.392 GiB free.
D: is CDROM ()
F: is NetworkDisk (NTFS) - 203 GiB total, 36.912 GiB free.
P: is NetworkDisk (NTFS) - 203 GiB total, 36.912 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP1: 5/10/2013 1:23:05 AM - Removed Java™ 6 Update 31
RP2: 5/10/2013 1:24:11 AM - Installed Java 7 Update 21
RP3: 5/10/2013 2:05:21 AM - Installed Windows XP KB942288-v3.
RP4: 5/10/2013 2:11:49 AM - Removed timeQplus
RP5: 5/10/2013 3:00:19 AM - Software Distribution Service 3.0
RP6: 5/10/2013 3:29:58 PM - Installed timeQplus
RP7: 5/10/2013 3:30:03 PM - Installed timeQplus
RP8: 5/10/2013 3:45:53 PM - Removed timeQplus
RP9: 5/10/2013 3:53:01 PM - Installed timeQplus
RP10: 5/10/2013 3:53:06 PM - Installed timeQplus
RP11: 5/11/2013 3:00:17 AM - Software Distribution Service 3.0
RP12: 5/12/2013 8:20:38 PM - System Checkpoint
RP13: 5/13/2013 9:05:02 PM - System Checkpoint
RP14: 5/14/2013 10:04:53 PM - System Checkpoint
RP15: 5/15/2013 11:04:49 PM - System Checkpoint
RP16: 5/16/2013 3:00:19 AM - Software Distribution Service 3.0
RP17: 5/17/2013 3:57:03 AM - System Checkpoint
RP18: 5/18/2013 4:56:54 AM - System Checkpoint
RP19: 5/19/2013 5:56:46 AM - System Checkpoint
RP20: 5/20/2013 6:56:39 AM - System Checkpoint
RP21: 5/21/2013 7:56:35 AM - System Checkpoint
RP22: 5/22/2013 9:15:54 AM - System Checkpoint
RP23: 5/23/2013 9:56:22 AM - System Checkpoint
RP24: 5/24/2013 10:56:16 AM - System Checkpoint
RP25: 5/25/2013 10:57:04 AM - System Checkpoint
RP26: 5/26/2013 11:56:56 AM - System Checkpoint
RP27: 5/27/2013 12:56:53 PM - System Checkpoint
RP28: 5/27/2013 4:23:23 PM - OTL Restore Point - 5/27/2013 4:23:18 PM
.
==== Installed Programs ======================
.
Acrobat.com
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader XI (11.0.03)
Adobe Shockwave Player 11.5
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Attendance Rx
Belarc Advisor 8.1
Bing Bar
Bonjour
Broadcom Management Programs
CCleaner
Cisco WebEx Meetings
Core FTP LE
Crystal Reports 2008 Runtime
Dell 2335dn MFP Software Uninstall
Dell Backup and Recovery Manager
e-MDs Solution Series
e-MDs Support Libraries
ERUNT 1.1j
Google Chrome
Google Toolbar for Internet Explorer
Google Update Helper
GoToMyPC
GPL Ghostscript 8.15
GPL Ghostscript Fonts
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2779562)
Hotfix for Windows XP (KB942288-v3)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Intel® Graphics Media Accelerator Driver
iTunes
Java 7 Update 21
Java Auto Updater
join.me
Junk Mail filter update
LogMeIn
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2698023)
Microsoft .NET Framework 1.1 Security Update (KB2742597)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office 2003 Primary Interop Assemblies
Microsoft Office File Validation Add-In
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft SQL Server 2008 R2
Microsoft SQL Server 2008 R2 Management Objects
Microsoft SQL Server 2008 R2 Native Client
Microsoft SQL Server 2008 R2 RsFx Driver
Microsoft SQL Server 2008 R2 Setup (English)
Microsoft SQL Server 2008 Setup Support Files
Microsoft SQL Server Browser
Microsoft SQL Server System CLR Types
Microsoft SQL Server VSS Writer
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual Studio 2005 Tools for Office Runtime
MobileMe Control Panel
Mozilla Firefox 21.0 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
MSXML 6.0 Parser (KB927977)
NDDF Framework
PowerDVD DX
PricePeep
QBFC 8.0
QBFC2
QuickBooks
QuickBooks Pro 2013
QuickTime
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
RealUpgrade 1.1
RedMon - Redirection Port Monitor
Roxio Creator Audio
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE 10.3
Roxio Creator Tools
Roxio Express Labeler 3
Roxio Update Manager
Safari
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2491683)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2510581)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219-v2)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135-v2)
Security Update for Windows XP (KB2727528)
Security Update for Windows XP (KB2753842-v2)
Security Update for Windows XP (KB2757638)
Security Update for Windows XP (KB2758857)
Security Update for Windows XP (KB2770660)
Security Update for Windows XP (KB2780091)
Security Update for Windows XP (KB2802968)
Security Update for Windows XP (KB2807986)
Security Update for Windows XP (KB2808735)
Security Update for Windows XP (KB2813170)
Security Update for Windows XP (KB2813345)
Security Update for Windows XP (KB2817183)
Security Update for Windows XP (KB2820197)
Security Update for Windows XP (KB2820917)
Security Update for Windows XP (KB2829361)
Security Update for Windows XP (KB2829530)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982665)
Segoe UI
Service Pack 1 for SQL Server 2008 R2 (KB2528583)
SQL Server 2008 R2 SP1 Common Files
SQL Server 2008 R2 SP1 Database Engine Services
SQL Server 2008 R2 SP1 Database Engine Shared
Sql Server Customer Experience Improvement Program
TIFF Printer
timeQplus
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2661254-v2)
Update for Windows XP (KB2749655)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB961503)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB973815)
VNC Free Edition 4.1.3
Wajam
WebEx Support Manager for Firefox or Chrome
WebFldrs XP
Windows Driver Package - Citrix Systems monblanking Citrix Driver (06/26/2012 6.3.0.48)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Windows Presentation Foundation
XML Paper Specification Shared Components Pack 1.0
.
==== End Of File ===========================

Attached are the OTL reports:

OTL logfile created on: 5/27/2013 4:21:25 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\administrator.AFC.000\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.42 Gb Available Physical Memory | 71.60% Memory free
3.84 Gb Paging File | 3.16 Gb Available in Paging File | 82.29% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 148.97 Gb Total Space | 74.42 Gb Free Space | 49.96% Space Free | Partition Type: NTFS
Drive F: | 203.25 Gb Total Space | 36.91 Gb Free Space | 18.16% Space Free | Partition Type: NTFS
Drive P: | 203.25 Gb Total Space | 36.91 Gb Free Space | 18.16% Space Free | Partition Type: NTFS

Computer Name: OFFICERODRIGUEZ | User Name: administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\administrator.AFC.000\My Documents\Downloads\OTL(1).exe (OldTimer Tools)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\Intuit\SyncManager\Current\IntuitSyncManager.exe (Intuit Inc. All rights reserved.)
PRC - C:\Program Files\Citrix\GoToMyPC\g2tray.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToMyPC\g2svc.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToMyPC\g2pre.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToMyPC\g2comm.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
PRC - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (Intuit)
PRC - C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe (Intuit Inc.)
PRC - C:\Program Files\Acroprint\timeQplusV4\Server\tQp.Service.Server.exe ()
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\LogMeIn\x86\ramaint.exe (LogMeIn, Inc.)
PRC - C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe (LogMeIn, Inc.)
PRC - C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
PRC - C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files\Dell\Dell 2335dn MFP\SPanel\SPanel.exe ()
PRC - C:\WINDOWS\Dell\PanelMgr\SSMMgr.exe ()
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\Program Files\RealVNC\VNC4\winvnc4.exe (RealVNC Ltd.)
PRC - C:\WINDOWS\twain_32\Dell\Dell2335\Scan2Pc.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Acroprint\Attendance Rx\arxsvc.exe (Acroprint)
PRC - C:\Program Files\Acroprint\Attendance Rx\AttendanceRx.exe (Acroprint Time Recorder Co. (USA).)
PRC - C:\Program Files\Acroprint\Attendance Rx\ARXTQ100N.exe (Acroprint Time Recorder Co. (USA).)
PRC - C:\Program Files\Acroprint\Attendance Rx\ARXTQ100S.exe (Acroprint Time Recorder Co. (USA).)
PRC - C:\Program Files\Acroprint\Attendance Rx\arxservice.exe ()


========== Modules (No Company Name) ==========

MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\e5c1fa6f921e7ced1cb600998e98994f\System.IdentityModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\77d51d287a12c482a1368515ac763f36\System.ServiceModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\42ccc367a40452b29ea051c116b5318f\System.Data.DataSetExtensions.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Core\c52b1734cefd25d5c8e7b4ebf4c1f76a\System.Core.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\81b85db6e9fe04e4d1c9547b993acfce\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\17440cd05eee7f87026b3c17119eed58\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\3c720ec622b80ab4733ca430fa03899c\System.Runtime.DurableInstancing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\e1e5fdef93d69dc13cb360d91fdcdf4c\System.Runtime.Serialization.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Web\4e1ff377281237b12152227a4f309bef\System.Web.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\261b2323f46266bf9039ebc350ef466a\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\347f5b43b525120fe2f33d92d75337f2\System.Core.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\2812eeab3ae456c112a3e3d768cf5ca4\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\7d1ad9ad328bbfe0d81f3f5490fd2f50\Microsoft.SqlServer.Smo.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\8e0b222a344a6b1971880115915294ef\Microsoft.SqlServer.Management.Sdk.Sfc.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\3ffe9071aa8769a66ebedd02238421c3\Microsoft.SqlServer.ConnectionInfo.ni.dll ()
MOD - C:\Program Files\Intuit\QuickBooks 2013\boost_regex-vc90-mt-p-1_33.dll ()
MOD - C:\Program Files\Acroprint\timeQplusV4\Server\tQpBusSma.dll ()
MOD - C:\Program Files\Acroprint\timeQplusV4\Server\tQp.Service.Server.exe ()
MOD - C:\Program Files\Acroprint\timeQplusV4\Server\tQp.Service.Common.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\e534d8e15df8611bc3174e5f2377a093\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\024c898ad1ccfde466d033c0a08d0564\Microsoft.VisualBasic.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\d7ee03714420b252415b952d40ef59e4\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Design\73225093c20182100aea1c88b30ddab3\System.Design.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\e143370f0583abe015d8e3d2d536185e\System.Web.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Transactions\6e903ce8719e50acd783f8726b11249f\System.Transactions.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\3b7f418545abc074940776fea9ad635e\SMDiagnostics.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xaml\7256e28382f57416b828a0cc143b67b3\System.Xaml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Accessibility\e290208a6d4ea4451ac118f1e0c3b488\Accessibility.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\1a6f9e23985e3159e6dd9827fd81c2fd\System.Management.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\d7a2248a76f0e94d56c92c5bf96f5175\System.Runtime.Remoting.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\04eea38364e5ced71d02bf104cb5892c\System.EnterpriseServices.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\ad737988d5bde126a3b7770eacc51e5b\System.Transactions.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\8462c03b4f10c4624feb95790d6d1e30\System.Data.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\7782f356a838c403b4a8e9c80df5a577\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\fe025743210c22bea2f009e1612c38bf\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aeac298c43c77d8860db8e7634d9f2eb\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\eab2340ead8e1a84bdf1a87868659979\mscorlib.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\3d6d9da56c9f607615b55d6742d8427d\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\8ba0620535aa28d509b9397500b7d530\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\c182d7a0bd88caf2cddccb7491a5fa6e\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\3f95a6d480ed1ebe45cf27b770ba94ed\mscorlib.ni.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlServerCe\9.0.242.0__89845dcd8080cc91\System.Data.SqlServerCe.dll ()
MOD - C:\Program Files\Dell\Dell 2335dn MFP\SPanel\spiomgr.dll ()
MOD - C:\Program Files\Dell\Dell 2335dn MFP\SPanel\SPanel.exe ()
MOD - C:\Program Files\Dell\Dell 2335dn MFP\SPanel\SMUI.dll ()
MOD - C:\Program Files\Dell\Dell 2335dn MFP\SPanel\SMBalloon.dll ()
MOD - C:\Program Files\Dell\Dell 2335dn MFP\SPanel\SecSNMP.dll ()
MOD - C:\WINDOWS\Dell\PanelMgr\SSMMgr.exe ()
MOD - C:\WINDOWS\system32\sdf1ml3.dll ()
MOD - C:\Program Files\Brother\BrUtilities\BrLogAPI.dll ()
MOD - C:\WINDOWS\system32\Dell2335Port_x86.dll ()
MOD - C:\WINDOWS\twain_32\Dell\Dell2335\Scan2Pc.exe ()
MOD - C:\WINDOWS\twain_32\Dell\Dell2335\SSOle.dll ()
MOD - C:\WINDOWS\twain_32\Dell\Dell2335\NetModule.dll ()
MOD - C:\WINDOWS\twain_32\Dell\Dell2335\IMFilter.dll ()
MOD - C:\WINDOWS\system32\msjetoledb40.dll ()
MOD - C:\Program Files\Acroprint\Attendance Rx\arxservice.exe ()
MOD - C:\WINDOWS\system32\redmonnt.dll ()


========== Services (SafeList) ==========

SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (GoToMyPC) – C:\Program Files\Citrix\GoToMyPC\g2svc.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (QBCFMonitorService) – C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (Intuit)
SRV - (QBVSS) – C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe (Intuit Inc.)
SRV - (QBFCService) – C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe (Intuit Inc.)
SRV - (timeQplus Server) – C:\Program Files\Acroprint\timeQplusV4\Server\tQp.Service.Server.exe ()
SRV - (LMIMaint) – C:\Program Files\LogMeIn\x86\ramaint.exe (LogMeIn, Inc.)
SRV - (LMIGuardianSvc) – C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe (LogMeIn, Inc.)
SRV - (LogMeIn) – C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
SRV - (BBSvc) – C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (BBUpdate) – C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (WinVNC4) – C:\Program Files\RealVNC\VNC4\winvnc4.exe (RealVNC Ltd.)
SRV - (arxservice) – C:\Program Files\Acroprint\Attendance Rx\arxservice.exe ()


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (SSPORT) – C:\WINDOWS\system32\Drivers\SSPORT.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (MBAMSwissArmy) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (DgiVecp) – C:\WINDOWS\system32\Drivers\DgiVecp.sys File not found
DRV - (Changer) – File not found
DRV - (cerc6) – File not found
DRV - (catchme) – C:\DOCUME~1\ADMINI~1.000\LOCALS~1\Temp\catchme.sys File not found
DRV - (monblanking) – C:\WINDOWS\system32\drivers\monblanking.sys (Citrix Systems, Inc.)
DRV - (LMIRfsClientNP) – C:\WINDOWS\System32\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV - (LMIRfsDriver) – C:\WINDOWS\system32\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV - (LMIInfo) – C:\Program Files\LogMeIn\x86\rainfo.sys (LogMeIn, Inc.)
DRV - (RsFx0151) – C:\WINDOWS\system32\drivers\RsFx0151.sys (Microsoft Corporation)
DRV - (Netaapl) – C:\WINDOWS\system32\drivers\netaapl.sys (Apple Inc.)
DRV - (BrSerIb) – C:\WINDOWS\system32\drivers\BrSerIb.sys (Brother Industries Ltd.)
DRV - (BrUsbSIb) – C:\WINDOWS\system32\drivers\BrUsbSib.sys (Brother Industries Ltd.)
DRV - (k57w2k) – C:\WINDOWS\system32\drivers\k57xp32.sys (Broadcom Corporation)
DRV - (SFAUDIO) – C:\WINDOWS\system32\drivers\sfaudio.sys (Sonic Focus, Inc)
DRV - (BANTExt) – C:\WINDOWS\system32\drivers\BANTExt.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USREL/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://g.msn.com/USREL/1
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.opusdei.org/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…1I7GGLL_enUS359
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.opusdei.org/"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.6.14: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.6.14: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.6.14: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.6.14: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.6.14: C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{0153E448-190B-4987-BDE1-F256CADA672F}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/11/25 17:24:51 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/04/11 21:29:53 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/05/20 08:41:49 | 000,000,000 | —D | M]

[2012/12/04 18:44:18 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\administrator.AFC.000\Application Data\Mozilla\Extensions
[2013/04/11 21:29:32 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2013/05/16 20:58:30 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\updated\browser\extensions
[2013/05/16 20:58:30 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\updated\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/04/11 21:29:53 | 000,263,064 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/10/29 06:46:28 | 000,305,744 | —- | M] (Cisco WebEx LLC) – C:\Program Files\mozilla firefox\plugins\ieatgpc.dll
[2012/10/29 06:46:38 | 000,225,360 | —- | M] (Cisco WebEx LLC) – C:\Program Files\mozilla firefox\plugins\npatgpc.dll
[2012/11/29 03:27:12 | 000,002,465 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013/02/26 22:16:35 | 000,002,086 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{
google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - homepage: http://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll
CHR - plugin: ActiveTouch General Plugin Container (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npatgpc.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 6 U31 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: RealPlayer Download Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: YouTube = C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: YouTube = C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Search = C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Wajam = C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.24_0\
CHR - Extension: PricePeep = C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\licjnkifamhpbaefhdpacpmihicfbomb\2.1.293.0_0\
CHR - Extension: Gmail = C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2013/05/10 01:07:03 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Wajam) - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files\Wajam\IE\priam_bho.dll (Wajam)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: [2335dn Scan2PC] C:\WINDOWS\twain_32\Dell\Dell2335\Scan2Pc.exe ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [Dell PanelMgr] C:\WINDOWS\Dell\PanelMgr\SSMMgr.exe ()
O4 - HKLM..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe (Intuit Inc. All rights reserved.)
O4 - HKLM..\Run: [LogMeIn GUI] C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil32_11_7_700_169_Plugin.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Attendance Rx.lnk = C:\Program Files\Acroprint\Attendance Rx\AttendanceRx.exe (Acroprint Time Recorder Co. (USA).)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Intuit Data Protect.lnk = C:\Program Files\Common Files\Intuit\DataProtect\IntuitDataProtect.exe (Intuit Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks_Standard_21.lnk = C:\Program Files\Intuit\QuickBooks 2013\QBW32.EXE (Intuit Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1261514258078 (WUWebControl Class)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://e-mds.webex.com/client/T27LB/support/ieatgpc.cab (GpcContainer Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com//activex/ractrl.cab?lmi=972 (Performance Viewer Activex Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = afc.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{763F0D47-11DC-4F77-BEF5-5C1D3BD62FC7}: NameServer = 192.168.77.10
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\intu-help-qb6 {6898B29B-BF49-43cb-A0B1-D0B9496AF491} - C:\Program Files\Intuit\QuickBooks 2013\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToMyPC: DllName - (C:\Program Files\Citrix\GoToMyPC\G2WinLogon.dll) - C:\Program Files\Citrix\GoToMyPC\g2winlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O20 - Winlogon\Notify\LMIinit: DllName - (LMIinit.dll) - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/04/25 16:29:32 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/05/19 17:50:37 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Sun
[2013/05/19 11:53:01 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2013/05/19 11:52:57 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2013/05/19 11:52:57 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2013/05/19 11:49:53 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2013/05/10 15:53:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\timeQplus v4
[2013/05/10 13:54:01 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2013/05/10 01:51:14 | 000,272,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bthport.sys
[2013/05/10 01:50:28 | 000,456,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mrxsmb.sys
[2013/05/10 01:46:25 | 000,012,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usb8023x.sys
[2013/05/10 01:42:42 | 002,193,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntoskrnl.exe
[2013/05/10 01:42:42 | 002,149,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrnlmp.exe
[2013/05/10 01:42:42 | 002,070,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrnlpa.exe
[2013/05/10 01:42:42 | 002,028,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrpamp.exe
[2013/05/10 01:35:44 | 000,000,000 | —D | C] – C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\Sun
[2013/05/10 01:25:12 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2013/05/10 01:25:05 | 000,144,896 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2013/05/10 01:25:04 | 000,866,720 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\npDeployJava1.dll
[2013/05/10 01:25:04 | 000,263,584 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2013/05/10 01:24:46 | 000,174,496 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2013/05/10 01:24:46 | 000,174,496 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2013/05/10 01:24:46 | 000,094,112 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2013/05/10 01:17:00 | 000,045,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wups2.dll
[2013/05/10 01:14:39 | 000,000,000 | —D | C] – C:\WINDOWS\Prefetch
[2013/05/10 01:09:39 | 000,000,000 | —D | C] – C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\NPE
[2013/05/10 01:00:20 | 000,000,000 | RHSD | C] – C:\cmdcons
[2013/05/10 00:57:42 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2013/05/10 00:57:42 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2013/05/10 00:57:42 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2013/05/10 00:57:42 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2013/05/10 00:57:31 | 000,000,000 | —D | C] – C:\Qoobox
[2013/05/10 00:50:13 | 000,156,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winzm.ime
[2013/05/10 00:50:13 | 000,156,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winsp.ime
[2013/05/10 00:50:13 | 000,156,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winpy.ime
[2013/05/10 00:50:12 | 000,079,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winar30.ime
[2013/05/10 00:50:12 | 000,072,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wingb.ime
[2013/05/10 00:50:12 | 000,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winime.ime
[2013/05/10 00:50:11 | 000,041,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\weitekp9.dll
[2013/05/10 00:50:11 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\weitekp9.sys
[2013/05/10 00:50:10 | 000,364,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w3svc.dll
[2013/05/10 00:50:10 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wam51.dll
[2013/05/10 00:50:10 | 000,073,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w3ext.dll
[2013/05/10 00:50:10 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wamreg51.dll
[2013/05/10 00:50:10 | 000,048,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w32.dll
[2013/05/10 00:50:10 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wamps51.dll
[2013/05/10 00:50:10 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w3svapi.dll
[2013/05/10 00:50:10 | 000,004,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w3ctrs51.dll
[2013/05/10 00:50:09 | 000,426,041 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\voicepad.dll
[2013/05/10 00:50:09 | 000,086,073 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\voicesub.dll
[2013/05/10 00:50:06 | 000,103,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\uihelper.dll
[2013/05/10 00:50:06 | 000,076,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\uniime.dll
[2013/05/10 00:50:06 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\unicdime.ime
[2013/05/10 00:50:05 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tsprof.exe
[2013/05/10 00:50:04 | 000,571,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tintlgnt.ime
[2013/05/10 00:50:04 | 000,455,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tintsetp.exe
[2013/05/10 00:50:04 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tintlphr.exe
[2013/05/10 00:50:04 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tools.dll
[2013/05/10 00:50:04 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tmigrate.dll
[2013/05/10 00:50:03 | 000,185,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\thawbrkr.dll
[2013/05/10 00:50:03 | 000,021,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tdipx.sys
[2013/05/10 00:50:03 | 000,019,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tdspx.sys
[2013/05/10 00:50:03 | 000,013,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tdasync.sys
[2013/05/10 00:50:01 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\svcext51.dll
[2013/05/10 00:50:00 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sspifilt.dll
[2013/05/10 00:50:00 | 000,045,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ssinc51.dll
[2013/05/10 00:50:00 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\status.dll
[2013/05/10 00:49:59 | 000,101,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srusbusd.dll
[2013/05/10 00:49:58 | 000,143,422 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\softkey.dll
[2013/05/10 00:49:57 | 000,358,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpincl.dll
[2013/05/10 00:49:57 | 000,259,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpcl.dll
[2013/05/10 00:49:57 | 000,188,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpsmir.dll
[2013/05/10 00:49:57 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpthrd.dll
[2013/05/10 00:49:57 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmp.exe
[2013/05/10 00:49:57 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpstup.dll
[2013/05/10 00:49:57 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmptrap.exe
[2013/05/10 00:49:57 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_snprfdll.dll
[2013/05/10 00:49:57 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpmib.dll
[2013/05/10 00:49:56 | 000,456,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smtpsvc.dll
[2013/05/10 00:49:56 | 000,236,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smi2smir.exe
[2013/05/10 00:49:56 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smierrsm.dll
[2013/05/10 00:49:56 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_smtpctrs.dll
[2013/05/10 00:49:56 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smtpapi.dll
[2013/05/10 00:49:56 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smimsgif.dll
[2013/05/10 00:49:56 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smierrsy.dll
[2013/05/10 00:49:55 | 000,038,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm9aw.dll
[2013/05/10 00:49:55 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smb6w.dll
[2013/05/10 00:49:55 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sma3w.dll
[2013/05/10 00:49:55 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm87w.dll
[2013/05/10 00:49:55 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm81w.dll
[2013/05/10 00:49:55 | 000,029,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm8cw.dll
[2013/05/10 00:49:55 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm93w.dll
[2013/05/10 00:49:55 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm92w.dll
[2013/05/10 00:49:55 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm90w.dll
[2013/05/10 00:49:55 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm8dw.dll
[2013/05/10 00:49:55 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm8aw.dll
[2013/05/10 00:49:55 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm89w.dll
[2013/05/10 00:49:55 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm59w.dll
[2013/05/10 00:49:54 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\simptcp.dll
[2013/05/10 00:49:51 | 000,221,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\seo.dll
[2013/05/10 00:49:51 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_scripto.dll
[2013/05/10 00:49:51 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_seos.dll
[2013/05/10 00:49:50 | 000,079,872 | —- | C] (Ricoh Co., Ltd.) – C:\WINDOWS\System32\dllcache\rwia330.dll
[2013/05/10 00:49:50 | 000,079,872 | —- | C] (Ricoh Co., Ltd.) – C:\WINDOWS\System32\dllcache\rwia001.dll
[2013/05/10 00:49:50 | 000,029,184 | —- | C] (Ricoh Co., Ltd.) – C:\WINDOWS\System32\dllcache\rw330ext.dll
[2013/05/10 00:49:50 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rwnh.dll
[2013/05/10 00:49:49 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rw001ext.dll
[2013/05/10 00:49:49 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rpcref.dll
[2013/05/10 00:49:48 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\romanime.ime
[2013/05/10 00:49:48 | 000,023,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_regtrace.exe
[2013/05/10 00:49:48 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\register.exe
[2013/05/10 00:49:46 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\quick.ime
[2013/05/10 00:49:46 | 000,020,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ramdisk.sys
[2013/05/10 00:49:46 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\quser.exe
[2013/05/10 00:49:45 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\query.exe
[2013/05/10 00:49:45 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pwsdata.dll
[2013/05/10 00:49:43 | 000,482,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pintlgnt.ime
[2013/05/10 00:49:43 | 000,131,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pmxviceo.dll
[2013/05/10 00:49:43 | 000,070,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pintlphr.exe
[2013/05/10 00:49:43 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pmigrate.dll
[2013/05/10 00:49:43 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pintlcsd.dll
[2013/05/10 00:49:43 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pmxmcro.dll
[2013/05/10 00:49:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pmxgl.dll
[2013/05/10 00:49:42 | 000,079,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\phon.ime
[2013/05/10 00:49:42 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\permchk.dll
[2013/05/10 00:49:41 | 000,036,927 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\padrs411.dll
[2013/05/10 00:49:41 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pagecnt.dll
[2013/05/10 00:49:41 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\padrs404.dll
[2013/05/10 00:49:41 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\padrs804.dll
[2013/05/10 00:49:41 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\padrs412.dll
[2013/05/10 00:49:38 | 000,038,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_ntfsdrv.dll
[2013/05/10 00:49:37 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nextlink.dll
[2013/05/10 00:49:37 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nsepm.dll
[2013/05/10 00:49:35 | 000,229,439 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\multibox.dll
[2013/05/10 00:49:34 | 000,119,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mtstocom.exe
[2013/05/10 00:49:31 | 001,875,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msir3jp.lex
[2013/05/10 00:49:31 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msir3jp.dll
[2013/05/10 00:49:24 | 000,092,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mga.sys
[2013/05/10 00:49:24 | 000,092,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mga.dll
[2013/05/10 00:49:24 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\metada51.dll
[2013/05/10 00:49:24 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mdsync.dll
[2013/05/10 00:49:24 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\migregdb.exe
[2013/05/10 00:49:23 | 000,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_mailmsg.dll
[2013/05/10 00:49:23 | 000,037,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\md5filt.dll
[2013/05/10 00:49:22 | 000,022,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lpdsvc.dll
[2013/05/10 00:49:22 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\logscrpt.dll
[2013/05/10 00:49:22 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lprmon.dll
[2013/05/10 00:49:22 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lonsint.dll
[2013/05/10 00:49:21 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lmmib2.dll
[2013/05/10 00:49:20 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\korwbrkr.dll
[2013/05/10 00:49:20 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdvntc.dll
[2013/05/10 00:49:19 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdnecnt.dll
[2013/05/10 00:49:19 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth3.dll
[2013/05/10 00:49:19 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth2.dll
[2013/05/10 00:49:19 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdusa.dll
[2013/05/10 00:49:19 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdurdu.dll
[2013/05/10 00:49:19 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth1.dll
[2013/05/10 00:49:19 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth0.dll
[2013/05/10 00:49:19 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsyr2.dll
[2013/05/10 00:49:19 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsyr1.dll
[2013/05/10 00:49:18 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdnecat.dll
[2013/05/10 00:49:18 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdnec95.dll
[2013/05/10 00:49:18 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlk41a.dll
[2013/05/10 00:49:18 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlk41j.dll
[2013/05/10 00:49:18 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinpun.dll
[2013/05/10 00:49:18 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdintel.dll
[2013/05/10 00:49:18 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdintam.dll
[2013/05/10 00:49:18 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinmar.dll
[2013/05/10 00:49:18 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinkan.dll
[2013/05/10 00:49:17 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdibm02.dll
[2013/05/10 00:49:17 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinhin.dll
[2013/05/10 00:49:17 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinguj.dll
[2013/05/10 00:49:17 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdindev.dll
[2013/05/10 00:49:17 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdheb.dll
[2013/05/10 00:49:17 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdfa.dll
[2013/05/10 00:49:17 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbddiv2.dll
[2013/05/10 00:49:17 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdgeo.dll
[2013/05/10 00:49:16 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jupiw.dll
[2013/05/10 00:49:16 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdax2.dll
[2013/05/10 00:49:16 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd106n.dll
[2013/05/10 00:49:16 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd101a.dll
[2013/05/10 00:49:16 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd101.dll
[2013/05/10 00:49:16 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbddiv1.dll
[2013/05/10 00:49:16 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbda3.dll
[2013/05/10 00:49:16 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbda2.dll
[2013/05/10 00:49:16 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbda1.dll
[2013/05/10 00:49:16 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdarmw.dll
[2013/05/10 00:49:16 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdarme.dll
[2013/05/10 00:49:15 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iscomlog.dll
[2013/05/10 00:49:15 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iwrps.dll
[2013/05/10 00:49:15 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\isapips.dll
[2013/05/10 00:49:14 | 000,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iprip.dll
[2013/05/10 00:49:13 | 000,471,102 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imskdic.dll
[2013/05/10 00:49:13 | 000,315,455 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imskf.dll
[2013/05/10 00:49:13 | 000,257,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\infocomm.dll
[2013/05/10 00:49:13 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetin51.exe
[2013/05/10 00:49:13 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\infoctrs.dll
[2013/05/10 00:49:12 | 000,307,257 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpdct.exe
[2013/05/10 00:49:12 | 000,274,489 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjputyc.dll
[2013/05/10 00:49:12 | 000,262,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjputy.exe
[2013/05/10 00:49:12 | 000,233,527 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjprw.exe
[2013/05/10 00:49:12 | 000,208,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpmig.exe
[2013/05/10 00:49:12 | 000,155,705 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpdsvr.exe
[2013/05/10 00:49:12 | 000,102,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imlang.dll
[2013/05/10 00:49:12 | 000,059,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imkrinst.exe
[2013/05/10 00:49:12 | 000,045,109 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpuex.exe
[2013/05/10 00:49:11 | 000,811,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjp81k.dll
[2013/05/10 00:49:11 | 000,716,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpcus.dll
[2013/05/10 00:49:11 | 000,368,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpcic.dll
[2013/05/10 00:49:11 | 000,340,023 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjp81.ime
[2013/05/10 00:49:11 | 000,311,359 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imepadsv.exe
[2013/05/10 00:49:11 | 000,102,463 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imepadsm.dll
[2013/05/10 00:49:11 | 000,081,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpdct.dll
[2013/05/10 00:49:11 | 000,057,398 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpdadm.exe
[2013/05/10 00:49:11 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imekrmig.exe
[2013/05/10 00:49:10 | 000,145,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iische51.dll
[2013/05/10 00:49:10 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imekrcic.dll
[2013/05/10 00:49:10 | 000,094,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imekr61.ime
[2013/05/10 00:49:10 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imekrmbx.dll
[2013/05/10 00:49:10 | 000,079,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iislog51.dll
[2013/05/10 00:49:10 | 000,060,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisclex4.dll
[2013/05/10 00:49:10 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iiscrmap.dll
[2013/05/10 00:49:10 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisfecnv.dll
[2013/05/10 00:49:10 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iissync.exe
[2013/05/10 00:49:10 | 000,003,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iismui.dll
[2013/05/10 00:49:09 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisadmin.dll
[2013/05/10 00:49:06 | 010,129,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hwxkor.dll
[2013/05/10 00:49:02 | 010,096,640 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hwxcht.dll
[2013/05/10 00:49:02 | 000,268,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\httpext.dll
[2013/05/10 00:49:02 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\httpod51.dll
[2013/05/10 00:49:02 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\httpmb51.dll
[2013/05/10 00:49:01 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hostmib.dll
[2013/05/10 00:49:01 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hanjadic.dll
[2013/05/10 00:49:00 | 000,032,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\gzip.dll
[2013/05/10 00:48:59 | 000,125,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ftpsv251.dll
[2013/05/10 00:48:59 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ftpctrs2.dll
[2013/05/10 00:48:59 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ftpmib.dll
[2013/05/10 00:48:59 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ftlx041e.dll
[2013/05/10 00:48:58 | 000,024,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpadmcgi.exe
[2013/05/10 00:48:58 | 000,020,541 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpadmdll.dll
[2013/05/10 00:48:58 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\flattemp.exe
[2013/05/10 00:48:57 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_fcachdll.dll
[2013/05/10 00:48:57 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\exstrace.dll
[2013/05/10 00:48:57 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\f3ahvoas.dll
[2013/05/10 00:48:56 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\evntagnt.dll
[2013/05/10 00:48:56 | 000,092,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\evntwin.exe
[2013/05/10 00:48:56 | 000,057,856 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\dllcache\esuimgd.dll
[2013/05/10 00:48:56 | 000,045,056 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\dllcache\esunid.dll
[2013/05/10 00:48:56 | 000,031,744 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\dllcache\esucmd.dll
[2013/05/10 00:48:56 | 000,025,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\et4000.sys
[2013/05/10 00:48:56 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\evntcmd.exe
[2013/05/10 00:48:50 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dayi.ime
[2013/05/10 00:48:50 | 000,042,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\davcdata.exe
[2013/05/10 00:48:48 | 000,057,399 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cplexe.exe
[2013/05/10 00:48:48 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\convlog.exe
[2013/05/10 00:48:48 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\counters.dll
[2013/05/10 00:48:48 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cprofile.exe
[2013/05/10 00:48:47 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\controt.dll
[2013/05/10 00:48:47 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\compfilt.dll
[2013/05/10 00:48:46 | 000,480,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cintsetp.exe
[2013/05/10 00:48:46 | 000,198,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cintime.dll
[2013/05/10 00:48:46 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cintlgnt.ime
[2013/05/10 00:48:45 | 001,677,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chsbrkr.dll
[2013/05/10 00:48:45 | 000,838,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chtbrkr.dll
[2013/05/10 00:48:45 | 000,097,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chtmbx.dll
[2013/05/10 00:48:45 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chtskdic.dll
[2013/05/10 00:48:44 | 000,078,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chajei.ime
[2013/05/10 00:48:44 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chgport.exe
[2013/05/10 00:48:44 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chgusr.exe
[2013/05/10 00:48:44 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chglogon.exe
[2013/05/10 00:48:44 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\change.exe
[2013/05/10 00:48:43 | 000,218,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\c_g18030.dll
[2013/05/10 00:48:43 | 000,054,528 | —- | C] (Philips Semiconductors GmbH) – C:\WINDOWS\System32\dllcache\cap7146.sys
[2013/05/10 00:48:43 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\c_iscii.dll
[2013/05/10 00:48:43 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\c_is2022.dll
[2013/05/10 00:48:37 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\browscap.dll
[2013/05/10 00:48:36 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\authfilt.dll
[2013/05/10 00:48:35 | 000,369,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\asp51.dll
[2013/05/10 00:48:35 | 000,029,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\asptxn.dll
[2013/05/10 00:48:35 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aspperf.dll
[2013/05/10 00:48:34 | 000,331,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aqueue.dll
[2013/05/10 00:48:34 | 000,108,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\appconf.dll
[2013/05/10 00:48:34 | 000,045,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_aqadmin.dll
[2013/05/10 00:48:33 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0804.dll
[2013/05/10 00:48:33 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0412.dll
[2013/05/10 00:48:33 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0411.dll
[2013/05/10 00:48:33 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt040d.dll
[2013/05/10 00:48:33 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0404.dll
[2013/05/10 00:48:33 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0401.dll
[2013/05/10 00:48:32 | 000,049,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\adrot.dll
[2013/05/10 00:48:32 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\admxprox.dll
[2013/05/10 00:48:32 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_adsiisex.dll
[2013/05/10 00:48:31 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\admexs.dll
[2013/05/10 00:48:28 | 000,032,827 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tcptest.exe
[2013/05/10 00:48:28 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tcptsat.dll
[2013/05/10 00:48:28 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wamregps.dll
[2013/05/10 00:48:27 | 002,134,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smtpsnap.dll
[2013/05/10 00:48:27 | 000,189,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smtpadm.dll
[2013/05/10 00:48:27 | 000,016,437 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shtml.exe
[2013/05/10 00:48:27 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\staxmem.dll
[2013/05/10 00:48:26 | 000,020,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shtml.dll
[2013/05/10 00:48:22 | 000,829,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetmgr.dll
[2013/05/10 00:48:22 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\logui.ocx
[2013/05/10 00:48:22 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\isatq.dll
[2013/05/10 00:48:22 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetsloc.dll
[2013/05/10 00:48:22 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\infoadmn.dll
[2013/05/10 00:48:22 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetmgr.exe
[2013/05/10 00:48:21 | 000,169,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisui.dll
[2013/05/10 00:48:21 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisrtl.dll
[2013/05/10 00:48:21 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisext51.dll
[2013/05/10 00:48:21 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iismap.dll
[2013/05/10 00:48:21 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisrstas.exe
[2013/05/10 00:48:21 | 000,020,538 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpremadm.exe
[2013/05/10 00:48:21 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisreset.exe
[2013/05/10 00:48:21 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ftpsapi2.dll
[2013/05/10 00:48:21 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisrstap.dll
[2013/05/10 00:48:19 | 000,876,653 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4awel.dll
[2013/05/10 00:48:19 | 000,598,071 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpmmc.dll
[2013/05/10 00:48:19 | 000,208,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpmmcsat.dll
[2013/05/10 00:48:19 | 000,188,494 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpcount.exe
[2013/05/10 00:48:19 | 000,109,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp98swin.exe
[2013/05/10 00:48:19 | 000,102,509 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4atxt.dll
[2013/05/10 00:48:19 | 000,049,212 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4awebs.dll
[2013/05/10 00:48:19 | 000,041,020 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4avnb.dll
[2013/05/10 00:48:19 | 000,032,826 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4avss.dll
[2013/05/10 00:48:19 | 000,020,541 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpexedll.dll
[2013/05/10 00:48:19 | 000,014,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp98sadm.exe
[2013/05/10 00:48:18 | 000,184,435 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4amsft.dll
[2013/05/10 00:48:18 | 000,147,513 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4apws.dll
[2013/05/10 00:48:18 | 000,082,035 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4anscp.dll
[2013/05/10 00:48:18 | 000,076,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cnfgprts.ocx
[2013/05/10 00:48:18 | 000,049,210 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4areg.dll
[2013/05/10 00:48:18 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\coadmin.dll
[2013/05/10 00:48:17 | 000,275,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\certwiz.ocx
[2013/05/10 00:48:17 | 000,188,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cfgwiz.exe
[2013/05/10 00:48:17 | 000,094,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\certmap.ocx
[2013/05/10 00:48:17 | 000,020,540 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\author.dll
[2013/05/10 00:48:17 | 000,016,439 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\author.exe
[2013/05/10 00:48:16 | 000,290,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\adsiis51.dll
[2013/05/10 00:48:16 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\admwprox.dll
[2013/05/10 00:48:16 | 000,016,439 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\admin.exe
[2013/05/10 00:48:15 | 000,020,540 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\admin.dll
[2013/05/10 00:46:39 | 000,210,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wuweb.dll
[2013/05/10 00:35:54 | 000,024,661 | —- | C] (Perle Systems Ltd.) – C:\WINDOWS\System32\spxcoins.dll
[2013/05/10 00:35:54 | 000,024,661 | —- | C] (Perle Systems Ltd.) – C:\WINDOWS\System32\dllcache\spxcoins.dll
[2013/05/10 00:35:54 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\irclass.dll
[2013/05/10 00:35:54 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\irclass.dll
[2013/05/09 23:57:55 | 000,000,000 | —D | C] – C:\034500e9cbd934d3d535843d
[2013/05/09 22:19:33 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2013/04/30 14:52:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Acroprint
[2013/04/30 14:41:04 | 000,000,000 | —D | C] – C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\LogMeIn Rescue Applet
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/27 16:13:30 | 000,002,390 | —- | M] () – C:\WINDOWS\ilan_txt.ini
[2013/05/27 16:13:30 | 000,000,041 | —- | M] () – C:\WINDOWS\iltwain.ini
[2013/05/27 16:11:00 | 000,000,906 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/27 04:11:00 | 000,000,902 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/26 13:33:24 | 000,000,426 | —- | M] () – C:\WINDOWS\BRWMARK.INI
[2013/05/25 23:59:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013/05/23 22:20:02 | 000,000,302 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3272544874-3166413241-1926064316-500.job
[2013/05/23 22:20:01 | 000,000,294 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3272544874-3166413241-1926064316-500.job
[2013/05/23 17:57:25 | 000,000,064 | —- | M] () – C:\DEFAULT.APF
[2013/05/23 17:55:28 | 000,002,497 | —- | M] () – C:\Documents and Settings\administrator.AFC.000\Desktop\Microsoft Office Word 2003.lnk
[2013/05/19 11:53:28 | 000,001,544 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2013/05/16 07:53:49 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/05/16 07:52:08 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/05/16 07:52:07 | 000,209,696 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/05/16 07:52:06 | 2135,912,448 | -HS- | M] () – C:\hiberfil.sys
[2013/05/16 03:13:45 | 000,595,950 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/05/16 03:13:45 | 000,123,170 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/05/16 03:03:14 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2013/05/10 15:53:01 | 000,001,886 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Virtual Clock.lnk
[2013/05/10 15:53:01 | 000,001,862 | —- | M] () – C:\Documents and Settings\All Users\Desktop\timeQplus.lnk
[2013/05/10 02:35:43 | 000,002,205 | —- | M] () – C:\Documents and Settings\administrator.AFC.000\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2013/05/10 01:24:25 | 000,094,112 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2013/05/10 01:24:22 | 000,263,584 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2013/05/10 01:24:22 | 000,174,496 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2013/05/10 01:24:22 | 000,174,496 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2013/05/10 01:24:22 | 000,144,896 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2013/05/10 01:24:21 | 000,866,720 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\npDeployJava1.dll
[2013/05/10 01:24:21 | 000,788,896 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2013/05/10 01:13:44 | 000,000,345 | RHS- | M] () – C:\boot.ini
[2013/05/10 01:07:03 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2013/05/10 00:51:16 | 000,000,317 | —- | M] () – C:\WINDOWS\System32\$winnt$.inf
[2013/05/10 00:47:49 | 000,316,640 | —- | M] () – C:\WINDOWS\WMSysPr9.prx
[2013/05/10 00:47:48 | 000,023,392 | —- | M] () – C:\WINDOWS\System32\nscompat.tlb
[2013/05/10 00:47:48 | 000,016,832 | —- | M] () – C:\WINDOWS\System32\amcompat.tlb
[2013/05/10 00:47:40 | 000,004,161 | —- | M] () – C:\WINDOWS\ODBCINST.INI
[2013/05/10 00:45:43 | 000,023,428 | —- | M] () – C:\WINDOWS\System32\emptyregdb.dat
[2013/05/10 00:45:12 | 000,000,535 | —- | M] () – C:\WINDOWS\System32\mapisvc.inf
[2013/05/10 00:44:19 | 000,000,229 | —- | M] () – C:\Boot.bak
[2013/05/10 00:21:48 | 000,289,314 | —- | M] () – C:\WINDOWS\setupapi.old
[2013/05/10 00:00:20 | 2135,941,120 | —- | M] () – C:\WINDOWS\MEMORY.DMP
[2013/05/09 23:23:22 | 000,004,444 | —- | M] () – C:\WINDOWS\System32\pid.PNF
[2013/05/09 22:12:34 | 002,250,054 | —- | M] () – C:\Documents and Settings\All Users\Application Data\1.bmp
[2013/05/09 22:12:32 | 000,350,795 | —- | M] () – C:\Documents and Settings\All Users\Application Data\1.jpg
[2013/05/06 12:21:09 | 000,001,726 | -H– | M] () – C:\Documents and Settings\administrator.AFC.000\My Documents\Default.rdp
[2013/04/30 15:05:17 | 000,652,017 | —- | M] () – C:\Documents and Settings\administrator.AFC.000\Desktop\Acroprint_20130430_16_04fixed2.dbtqp
[2013/04/30 14:53:27 | 000,652,017 | —- | M] () – C:\Documents and Settings\administrator.AFC.000\Desktop\Acroprint_20130430_14_52.dbtqp
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/19 11:53:28 | 000,001,544 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2013/05/10 15:53:01 | 000,001,886 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Virtual Clock.lnk
[2013/05/10 15:53:01 | 000,001,862 | —- | C] () – C:\Documents and Settings\All Users\Desktop\timeQplus.lnk
[2013/05/10 15:38:01 | 000,652,017 | —- | C] () – C:\Documents and Settings\administrator.AFC.000\Desktop\Acroprint_20130430_14_52.dbtqp
[2013/05/10 01:14:21 | 2135,912,448 | -HS- | C] () – C:\hiberfil.sys
[2013/05/10 01:00:27 | 000,000,229 | —- | C] () – C:\Boot.bak
[2013/05/10 01:00:23 | 000,260,272 | RHS- | C] () – C:\cmldr
[2013/05/10 00:57:42 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2013/05/10 00:57:42 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2013/05/10 00:57:42 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2013/05/10 00:57:42 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2013/05/10 00:57:42 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2013/05/10 00:49:43 | 000,175,104 | —- | C] () – C:\WINDOWS\System32\dllcache\pintlcsa.dll
[2013/05/10 00:49:20 | 001,158,818 | —- | C] () – C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2013/05/10 00:49:13 | 000,059,392 | —- | C] () – C:\WINDOWS\System32\dllcache\imscinst.exe
[2013/05/10 00:49:12 | 000,196,665 | —- | C] () – C:\WINDOWS\System32\dllcache\imjpinst.exe
[2013/05/10 00:49:10 | 000,134,339 | —- | C] () – C:\WINDOWS\System32\dllcache\imekr.lex
[2013/05/10 00:49:04 | 013,463,552 | —- | C] () – C:\WINDOWS\System32\dllcache\hwxjpn.dll
[2013/05/10 00:49:01 | 000,108,827 | —- | C] () – C:\WINDOWS\System32\dllcache\hanja.lex
[2013/05/10 00:48:58 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\dllcache\fpencode.dll
[2013/05/10 00:48:45 | 000,173,568 | —- | C] () – C:\WINDOWS\System32\dllcache\chtskf.dll
[2013/05/10 00:35:43 | 002,144,487 | —- | C] () – C:\WINDOWS\System32\dllcache\NT5.CAT
[2013/05/10 00:35:43 | 001,296,669 | —- | C] () – C:\WINDOWS\System32\dllcache\SP3.CAT
[2013/05/10 00:35:43 | 000,797,189 | —- | C] () – C:\WINDOWS\System32\dllcache\NT5IIS.CAT
[2013/05/10 00:35:43 | 000,399,645 | —- | C] () – C:\WINDOWS\System32\dllcache\MAPIMIG.CAT
[2013/05/10 00:35:43 | 000,144,484 | —- | C] () – C:\WINDOWS\System32\dllcache\netfx.cat
[2013/05/10 00:35:43 | 000,112,918 | —- | C] () – C:\WINDOWS\System32\dllcache\tabletpc.cat
[2013/05/10 00:35:43 | 000,037,484 | —- | C] () – C:\WINDOWS\System32\dllcache\MW770.CAT
[2013/05/10 00:35:43 | 000,034,747 | —- | C] () – C:\WINDOWS\System32\dllcache\mediactr.cat
[2013/05/10 00:35:43 | 000,034,063 | —- | C] () – C:\WINDOWS\System32\dllcache\FP4.CAT
[2013/05/10 00:35:43 | 000,026,991 | —- | C] () – C:\WINDOWS\System32\dllcache\msn7.cat
[2013/05/10 00:35:43 | 000,016,535 | —- | C] () – C:\WINDOWS\System32\dllcache\IMS.CAT
[2013/05/10 00:35:43 | 000,014,433 | —- | C] () – C:\WINDOWS\System32\dllcache\msn9.cat
[2013/05/10 00:35:43 | 000,013,472 | —- | C] () – C:\WINDOWS\System32\dllcache\HPCRDP.CAT
[2013/05/10 00:35:43 | 000,012,363 | —- | C] () – C:\WINDOWS\System32\dllcache\MSMSGS.CAT
[2013/05/10 00:35:43 | 000,010,027 | —- | C] () – C:\WINDOWS\System32\dllcache\MSTSWEB.CAT
[2013/05/10 00:35:43 | 000,008,574 | —- | C] () – C:\WINDOWS\System32\dllcache\IASNT4.CAT
[2013/05/10 00:35:43 | 000,007,710 | —- | C] () – C:\WINDOWS\System32\dllcache\OEMBIOS.CAT
[2013/05/10 00:35:42 | 000,522,220 | —- | C] () – C:\WINDOWS\System32\dllcache\NT5INF.CAT
[2013/05/09 23:58:36 | 000,209,632 | —- | C] () – C:\WINDOWS\System32\wuweb.dll.wusetup.159984.new
[2013/05/09 23:22:53 | 000,007,334 | —- | C] () – C:\WINDOWS\System32\dllcache\wmerrenu.cat
[2013/05/09 22:12:33 | 002,250,054 | —- | C] () – C:\Documents and Settings\All Users\Application Data\1.bmp
[2013/05/09 22:12:16 | 000,350,795 | —- | C] () – C:\Documents and Settings\All Users\Application Data\1.jpg
[2013/05/09 18:14:42 | 2135,941,120 | —- | C] () – C:\WINDOWS\MEMORY.DMP
[2013/04/30 15:02:44 | 000,652,017 | —- | C] () – C:\Documents and Settings\administrator.AFC.000\Desktop\Acroprint_20130430_16_04fixed2.dbtqp
[2013/04/10 03:19:52 | 000,516,868 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-3272544874-3166413241-1926064316-500-0.dat
[2013/04/10 03:19:51 | 000,197,594 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2013/04/10 03:03:48 | 000,000,215 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2013/01/09 04:29:41 | 000,534,600 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2012/11/25 17:25:16 | 020,480,000 | —- | C] () – C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\store-pp.jbs
[2012/10/29 00:28:42 | 000,007,273 | —- | C] () – C:\Documents and Settings\administrator.AFC.000\Application Data\Dell2335Options.xml
[2012/06/05 17:51:36 | 000,000,747 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2012/06/05 17:51:36 | 000,000,094 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2012/06/05 17:51:26 | 000,000,050 | —- | C] () – C:\WINDOWS\System32\BD9320CW.DAT
[2012/06/05 17:50:53 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2012/06/05 17:50:53 | 000,000,086 | —- | C] () – C:\WINDOWS\Brfaxrx.ini
[2012/06/05 17:50:52 | 000,000,000 | —- | C] () – C:\WINDOWS\brdfxspd.dat
[2012/02/23 14:56:21 | 000,000,036 | —- | C] () – C:\WINDOWS\PAYSUB.INI
[2012/02/15 05:28:36 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/12/01 09:52:29 | 005,875,200 | —- | C] () – C:\WINDOWS\System32\pdftk.exe
[2011/01/24 09:23:16 | 000,011,479 | —- | C] () – C:\Documents and Settings\administrator.AFC.000\Application Data\generated-answers.xml
[2009/12/29 16:09:02 | 000,002,958 | RHS- | C] () – C:\Documents and Settings\All Users\ntuser.pol

========== ZeroAccess Check ==========

[2008/04/25 16:34:35 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2013/04/16 16:18:26 | 001,510,400 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/02/09 07:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2008/04/14 07:00:00 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2013/04/25 15:46:16 | 000,000,000 | —D | M] – C:\Documents and Settings\administrator.AFC.000\Application Data\CoreFTP
[2012/04/15 16:48:44 | 000,000,000 | —D | M] – C:\Documents and Settings\administrator.AFC.000\Application Data\e-MDs
[2013/04/10 09:22:57 | 000,000,000 | —D | M] – C:\Documents and Settings\administrator.AFC.000\Application Data\PC-FAX TX
[2009/12/14 12:16:25 | 000,000,000 | —D | M] – C:\Documents and Settings\administrator.AFC.000\Application Data\Windows Desktop Search
[2010/01/18 15:26:44 | 000,000,000 | —D | M] – C:\Documents and Settings\administrator.AFC.000\Application Data\Windows Search
[2013/05/19 11:53:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2013/04/30 14:52:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Acroprint
[2012/02/23 14:55:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2013/04/26 14:35:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CitrixLogs
[2011/03/14 09:26:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\COMMON FILES
[2013/05/23 15:46:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\e-MDs
[2013/05/26 18:58:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\LogMeIn
[2013/04/08 18:27:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nuance
[2010/06/19 15:35:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SQL Anywhere 11
[2009/12/14 12:18:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Uninstall
[2010/04/14 16:21:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/01/06 21:02:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/12/24 17:35:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

========== Purity Check ==========



========== Custom Scans ==========

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.EX_ >
[2008/04/14 07:00:00 | 000,356,615 | —- | M] () MD5=D7B59A7EC9CB1429FDCEC84A22228555 – C:\I386\EXPLORER.EX_
[2008/04/14 04:00:00 | 000,356,615 | —- | M] () MD5=D7B59A7EC9CB1429FDCEC84A22228555 – C:\Program Files\Dell\DBRM\osmedia\I386\EXPLORER.EX_

< MD5 for: EXPLORER.EXE >
[2008/04/14 02:00:00 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ERDNT\cache\explorer.exe
[2008/04/14 02:00:00 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/14 02:00:00 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\system32\dllcache\explorer.exe

< MD5 for: EXPLORER.SC_ >
[2008/04/14 07:00:00 | 000,000,181 | —- | M] () MD5=BC5B38879C56DFBC05C8B5C43AC4D739 – C:\I386\EXPLORER.SC_
[2008/04/14 04:00:00 | 000,000,181 | —- | M] () MD5=BC5B38879C56DFBC05C8B5C43AC4D739 – C:\Program Files\Dell\DBRM\osmedia\I386\EXPLORER.SC_

< MD5 for: EXPLORER.SCF >
[2008/04/14 02:00:00 | 000,000,080 | —- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 – C:\WINDOWS\explorer.scf

< MD5 for: IEXPLORE.CH_ >
[2008/04/14 07:00:00 | 000,199,077 | —- | M] () MD5=1D662719AB9BB40BA7526B3973D3F626 – C:\I386\IEXPLORE.CH_
[2008/04/14 04:00:00 | 000,199,077 | —- | M] () MD5=1D662719AB9BB40BA7526B3973D3F626 – C:\Program Files\Dell\DBRM\osmedia\I386\IEXPLORE.CH_

< MD5 for: IEXPLORE.CHM >
[2008/04/14 02:00:00 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\WINDOWS\Help\iexplore.chm
[2008/04/14 07:00:00 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\WINDOWS\ie8\iexplore.chm

< MD5 for: IEXPLORE.EX_ >
[2008/04/14 07:00:00 | 000,037,887 | —- | M] () MD5=2B46169148FFD81CAE84572CD32BDF86 – C:\I386\IEXPLORE.EX_
[2008/04/14 04:00:00 | 000,037,887 | —- | M] () MD5=2B46169148FFD81CAE84572CD32BDF86 – C:\Program Files\Dell\DBRM\osmedia\I386\IEXPLORE.EX_

< MD5 for: IEXPLORE.EXE >
[2008/04/14 02:00:00 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\Program Files\Internet Explorer\IEXPLORE.EXE
[2008/04/14 02:00:00 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\ERDNT\cache\IEXPLORE.EXE
[2008/04/14 07:00:00 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\ie8\iexplore.exe
[2008/04/14 02:00:00 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\system32\dllcache\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2009/03/08 15:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 15:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\iexplore.exe.mui

< MD5 for: IEXPLORE.HL_ >
[2008/04/14 07:00:00 | 000,059,881 | —- | M] () MD5=D23388C8D5D82D4D1C3B0B6A256E3CB7 – C:\I386\IEXPLORE.HL_
[2008/04/14 04:00:00 | 000,059,881 | —- | M] () MD5=D23388C8D5D82D4D1C3B0B6A256E3CB7 – C:\Program Files\Dell\DBRM\osmedia\I386\IEXPLORE.HL_

< MD5 for: IEXPLORE.HLP >
[2008/04/14 02:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\WINDOWS\Help\iexplore.hlp

< MD5 for: SERVICES >
[2009/12/29 14:47:31 | 000,007,139 | —- | M] () MD5=82BEFFE8558A55731AE7074591E8A194 – C:\WINDOWS\system32\drivers\etc\services

< MD5 for: SERVICES._ >
[2008/04/14 07:00:00 | 000,001,989 | —- | M] () MD5=29BB3BBBE3D49156A42BFB3DD000F554 – C:\I386\SERVICES._
[2008/04/14 04:00:00 | 000,001,989 | —- | M] () MD5=29BB3BBBE3D49156A42BFB3DD000F554 – C:\Program Files\Dell\DBRM\osmedia\I386\SERVICES._

< MD5 for: SERVICES.CFG >
[2012/09/23 20:43:36 | 000,603,848 | R— | M] () MD5=81B120EAEE296F0E54F66C16C5A21367 – C:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744BA0000000010\11.0.0\services.cfg
[2013/05/11 05:37:26 | 000,558,990 | —- | M] () MD5=FE8FB005031C2574E990DAC1F9F5ACF8 – C:\Program Files\Adobe\Reader 11.0\Reader\Services\Services.cfg

< MD5 for: SERVICES.CSS >
[2005/06/29 15:48:58 | 000,014,339 | —- | M] () MD5=9D415BDEF74ADF7B0CD791E40A911A38 – C:\Documents and Settings\Hector Rodriguez\Desktop\QuickBooks2010\Components\Services\services.css
[2013/03/11 10:12:00 | 000,014,339 | —- | M] () MD5=9D415BDEF74ADF7B0CD791E40A911A38 – C:\Program Files\Intuit\QuickBooks 2013\Components\Services\services.css

< MD5 for: SERVICES.EX_ >
[2008/04/14 07:00:00 | 000,049,959 | —- | M] () MD5=EE4885163C0C0729A3C5F1416A6E5F48 – C:\I386\SERVICES.EX_
[2008/04/14 04:00:00 | 000,049,959 | —- | M] () MD5=EE4885163C0C0729A3C5F1416A6E5F48 – C:\Program Files\Dell\DBRM\osmedia\I386\SERVICES.EX_

< MD5 for: SERVICES.EXE >
[2009/02/06 06:06:24 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 – C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe
[2008/04/14 02:00:00 | 000,108,544 | —- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 – C:\WINDOWS\$NtUninstallKB956572$\services.exe
[2008/04/14 02:00:00 | 000,108,544 | —- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 – C:\WINDOWS\ERDNT\cache\services.exe
[2009/02/06 06:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\system32\dllcache\services.exe
[2009/02/06 06:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\system32\services.exe

< MD5 for: SERVICES.LNK >
[2013/05/10 00:47:51 | 000,001,604 | —- | M] () MD5=BA5B0D72684C534D969D1589B1F8B7F3 – C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.LNK

< MD5 for: SERVICES.MS_ >
[2008/04/14 07:00:00 | 000,003,649 | —- | M] () MD5=64E9F61D2ED093C361862DE36433B5E1 – C:\I386\SERVICES.MS_
[2008/04/14 04:00:00 | 000,003,649 | —- | M] () MD5=64E9F61D2ED093C361862DE36433B5E1 – C:\Program Files\Dell\DBRM\osmedia\I386\SERVICES.MS_

< MD5 for: SERVICES.MSC >
[2008/04/14 02:00:00 | 000,033,464 | —- | M] () MD5=E8089AA2A6F7FEE89B38C1F2D77BA6C6 – C:\WINDOWS\system32\services.msc

< MD5 for: WINLOGON.EX_ >
[2008/04/14 07:00:00 | 000,265,069 | —- | M] () MD5=063EF1A46C58A731F78AE5AF47070D65 – C:\I386\WINLOGON.EX_
[2008/04/14 04:00:00 | 000,265,069 | —- | M] () MD5=063EF1A46C58A731F78AE5AF47070D65 – C:\Program Files\Dell\DBRM\osmedia\I386\WINLOGON.EX_

< MD5 for: WINLOGON.EXE >
[2008/04/14 02:00:00 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008/04/14 02:00:00 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\dllcache\winlogon.exe
[2008/04/14 02:00:00 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< MD5 for: WINLOGON.LOG >
[2013/05/27 11:31:15 | 000,017,238 | —- | M] () MD5=72FCF4957605355D2F844F5D5A0B8BCE – C:\WINDOWS\security\logs\winlogon.log

< MD5 for: WINLOGON.OLD >
[2013/05/22 12:28:25 | 001,049,330 | —- | M] () MD5=419D3F42FAD0C270FC2A2C92B9ACA714 – C:\WINDOWS\security\logs\winlogon.old

< %SYSTEMDRIVE%\*.* >
[2011/07/20 15:14:41 | 000,001,024 | —- | M] () – C:\.rnd
[2012/11/12 21:40:43 | 000,001,732 | —- | M] () – C:\AdwCleaner[R1].txt
[2012/11/12 22:04:50 | 000,001,814 | —- | M] () – C:\AdwCleaner[S1].txt
[2012/11/21 00:04:55 | 000,000,861 | —- | M] () – C:\AdwCleaner[S2].txt
[2008/04/25 16:29:32 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2013/05/10 00:44:19 | 000,000,229 | —- | M] () – C:\Boot.bak
[2013/05/10 01:13:44 | 000,000,345 | RHS- | M] () – C:\boot.ini
[2008/01/19 01:45:46 | 000,333,203 | RHS- | M] () – C:\bootmgr
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () – C:\cmldr
[2013/05/10 01:08:52 | 000,016,114 | —- | M] () – C:\ComboFix.txt
[2008/04/25 16:29:32 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2013/05/23 17:57:25 | 000,000,064 | —- | M] () – C:\DEFAULT.APF
[2009/12/14 14:03:45 | 000,003,969 | RH– | M] () – C:\dell.sdr
[2013/05/16 07:52:06 | 2135,912,448 | -HS- | M] () – C:\hiberfil.sys
[2008/04/25 16:29:32 | 000,000,000 | -H– | M] () – C:\IO.SYS
[2008/04/25 16:29:32 | 000,000,000 | -H– | M] () – C:\MSDOS.SYS
[2002/01/05 03:40:20 | 000,487,424 | —- | M] (Microsoft Corporation) – C:\msvcp70.dll
[2002/01/05 03:37:28 | 000,344,064 | —- | M] (Microsoft Corporation) – C:\msvcr70.dll
[2008/04/14 02:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/04/14 02:00:00 | 000,250,048 | RHS- | M] () – C:\ntldr
[2013/05/16 07:52:05 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2011/04/06 17:20:30 | 000,000,002 | —- | M] () – C:\SmartIDResponseXML.XML

< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2013/05/10 00:47:23 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2013/03/13 06:26:56 | 000,053,080 | —- | M] (Citrix Online, a division of Citrix Systems, Inc.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\GoToPrintProcessor.dll
[2012/11/05 17:08:18 | 000,052,648 | —- | M] (LogMeIn, Inc.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\LMIproc.dll
[2007/04/09 13:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 05:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
[2009/05/08 00:44:51 | 000,019,968 | —- | M] (Windows ® 2000 DDK provider) – C:\WINDOWS\system32\spool\prtprocs\w32x86\sdf1mpc.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2009/07/10 13:15:46 | 000,306,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WLXPGSS.SCR
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2013/05/09 19:34:09 | 000,319,488 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2013/05/10 00:23:00 | 000,262,144 | —- | M] () – C:\WINDOWS\System32\config\security.sav
[2013/05/09 19:34:09 | 050,069,504 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2013/05/09 19:34:09 | 004,980,736 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2013/05/10 00:47:52 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/01/18 11:33:28 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\administrator.AFC.000\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2008/04/25 16:33:01 | 000,000,079 | —- | M] () – C:\Documents and Settings\administrator.AFC.000\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2013-05-16 08:14:59

< End of report >
OTL Extras logfile created on: 5/27/2013 4:21:25 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\administrator.AFC.000\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.42 Gb Available Physical Memory | 71.60% Memory free
3.84 Gb Paging File | 3.16 Gb Available in Paging File | 82.29% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 148.97 Gb Total Space | 74.42 Gb Free Space | 49.96% Space Free | Partition Type: NTFS
Drive F: | 203.25 Gb Total Space | 36.91 Gb Free Space | 18.16% Space Free | Partition Type: NTFS
Drive P: | 203.25 Gb Total Space | 36.91 Gb Free Space | 18.16% Space Free | Partition Type: NTFS

Computer Name: OFFICERODRIGUEZ | User Name: administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = ChromeHTML] – C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
http [open] – Reg Error: Key error.
https [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Acroprint\timeQplusV4\Server\tQp.Service.Server.exe" = C:\Program Files\Acroprint\timeQplusV4\Server\tQp.Service.Server.exe:*:Enabled:tQp.Service.Server.exe – ()
"C:\Program Files\Acroprint\timeQplusV4\Client\TimeAttendance.exe" = C:\Program Files\Acroprint\timeQplusV4\Client\TimeAttendance.exe:*:Enabled:TimeAttendance.exe – (Acroprint)
"C:\Program Files\Acroprint\timeQplusV4\Client\TimeAttendanceImportV3.exe" = C:\Program Files\Acroprint\timeQplusV4\Client\TimeAttendanceImportV3.exe:*:Enabled:TimeAttendanceImportV3.exe – (Acroprint)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit – (Apple Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03EAB07B-8EF0-4017-8CD8-714178F0A3C3}" = timeQplus
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE 10.3
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{11E568E0-3244-4BCB-875E-F334269DFDCB}" = iTunes
"{16D0F2D2-242C-4885-BEF1-4B1655C141AE}" = Bing Bar
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{185292F7-7C0A-4F72-B2CC-CBEBD40B050E}" = Microsoft SQL Server 2008 R2 Native Client
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{29D322D0-3481-4784-A8F6-C5FD8775B467}" = Attendance Rx
"{2BFDA78F-39F7-4537-9995-71424CFA88BB}" = LogMeIn
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3167CC62-C775-4E47-92C1-73EBB845751A}" = QuickBooks
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3C631966-387E-4054-85D9-BBFFABE32BD8}" = QuickBooks Pro 2013
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{47BE41E6-2F0F-4D17-9C2D-3850FFD9D405}" = Microsoft SQL Server VSS Writer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C9D82EB-9001-4E59-8F64-0BEEE5F4A30A}" = SQL Server 2008 R2 SP1 Database Engine Shared
"{58721EC3-8D4E-4B79-BC51-1054E2DDCD10}" = SQL Server 2008 R2 SP1 Database Engine Services
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6421F085-1FAA-DE13-D02A-CFB412C522A4}" = Acrobat.com
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7139C864-6D17-4C2E-97B9-82F25576080D}" = QBFC 8.0
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{7419AE1A-D1A5-4B24-BD78-C7ABCC26016F}" = Microsoft SQL Server 2008 R2 Setup (English)
"{74EA06CC-9EFD-410D-88B4-CB5ABD2BE785}" = GoToMyPC
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{795F2EA4-9798-4BA5-B31A-C8F41A124FC8}" = QBFC2
"{7BB045C3-D5E4-4620-B536-DC11AACD5942}" = Broadcom Management Programs
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91490409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Primary Interop Assemblies
"{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}" = MobileMe Control Panel
"{93968FB2-C67A-4A9B-80C2-5D4D9393058E}" = Microsoft SQL Server 2008 R2 RsFx Driver
"{93998800-1608-403F-9A51-420A77D23C25}" = Sql Server Customer Experience Improvement Program
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9D59AC32-B0FA-4CD7-A2EC-4B57C06CD9D9}" = Dell Backup and Recovery Manager
"{A1BBEE16-49B1-42F2-95B8-54C8C6A1C0C3}" =
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A47FD1BF-A815-4A76-BE65-53A15BD5D25D}" = Microsoft SQL Server System CLR Types
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.03)
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{B5153233-9AEE-4CD4-9D2C-4FAAC870DBE2}" = SQL Server 2008 R2 SP1 Database Engine Services
"{B692E59A-055C-43B7-BE0A-9C2FE0AB88B6}" = Microsoft SQL Server 2008 R2 Management Objects
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BCD91E48-2ABA-478B-AA30-0D0E5AF15F1C}" = NDDF Framework
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BF9BF038-FE03-429D-9B26-2FA0FD756052}" = Microsoft SQL Server Browser
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C484CC8D-03CF-4022-89C4-DB4F02E8A15B}" = Crystal Reports 2008 Runtime
"{CACEA8C8-3D38-4F51-953D-1E6FC3346FEF}" = SQL Server 2008 R2 SP1 Common Files
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D441BD04-E548-4F8E-97A4-1B66135BAAA8}" = Microsoft SQL Server 2008 Setup Support Files
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{D6D36B81-6FA8-4E09-9112-15EF4EE8094D}" = Attendance Rx
"{DFB3F4C7-88F9-43D8-A717-37F833B40DC4}" = e-MDs Solution Series
"{E0A0812F-C34C-4604-8AA2-1A4472248B49}" = Attendance Rx
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE 10.3
"{F021CC0C-21C3-4038-AA4A-6E3CBC669CE8}" = SQL Server 2008 R2 SP1 Database Engine Shared
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0BC0E0C-C82D-46D7-B848-BC1951232B40}" = WebEx Support Manager for Firefox or Chrome
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F5D1366F-9ABE-40B7-8FFC-FB261092B6F8}" = e-MDs Support Libraries
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FA4C2D53-205F-4245-9717-F3761154824D}" = Safari
"{FC835376-FF3B-4CAA-83E0-2148B3FB7C98}" = SQL Server 2008 R2 SP1 Common Files
"{FF934B36-183E-4C38-AD0C-A678B6E4EC94}" = e-MDs Solution Series
"ActiveTouchMeetingClient" = Cisco WebEx Meetings
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"B55781558C6FAB4237DDEE317F2409086B83E855" = Windows Driver Package - Citrix Systems monblanking Citrix Driver (06/26/2012 6.3.0.48)
"Belarc Advisor" = Belarc Advisor 8.1
"CCleaner" = CCleaner
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"CoreFTP" = Core FTP LE
"Dell 2335dn MFP" = Dell 2335dn MFP Software Uninstall
"ERUNT_is1" = ERUNT 1.1j
"Google Chrome" = Google Chrome
"GPL Ghostscript 8.15" = GPL Ghostscript 8.15
"GPL Ghostscript Fonts" = GPL Ghostscript Fonts
"HDMI" = Intel® Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft SQL Server 10" = Microsoft SQL Server 2008 R2
"Microsoft SQL Server 2008 R2" = Microsoft SQL Server 2008 R2
"Microsoft Visual Studio 2005 Tools for Office Runtime" = Microsoft Visual Studio 2005 Tools for Office Runtime
"Mozilla Firefox 20.0.1 (x86 en-US)" = Mozilla Firefox 20.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"PricePeep" = PricePeep
"RealPlayer 15.0" = RealPlayer
"RealVNC_is1" = VNC Free Edition 4.1.3
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"TIFF Printer_is1" = TIFF Printer
"Wajam" = Wajam
"WinLiveSuite_Wave3" = Windows Live Essentials
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"JoinMe" = join.me

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 5/23/2013 6:47:02 PM | Computer Name = OFFICERODRIGUEZ | Source = Application Hang | ID = 1002
Description = Hanging application QBW32.EXE, version 23.0.4006.2305, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/23/2013 6:47:45 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": Connection
Error:Invalid user ID or passwo

Error - 5/23/2013 6:47:45 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": Connection
String:CON=QBConnectionPool-Probe-QB_data_engine_23; ;DBF=\\afc1\finance$\Alton
Family Clinic.QBW;ENG=QB_data_engine_23;DBN=b4ede26f8dbe4c18b418795b5c5dd7

Error - 5/23/2013 6:47:45 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": DBConnPool::HandleConnectionError
errorCode:-6069, dbCode:-103 from file:'.\.\src\ConnPool.cpp' at line 1038 from
function:'DBMgr::DBConnPool::ini

Error - 5/23/2013 9:03:03 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": Connection
Error:Invalid user ID or passwo

Error - 5/23/2013 9:03:03 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": Connection
String:CON=QBConnectionPool-Probe-QB_data_engine_23; ;DBF=\\afc1\finance$\Alton
Family Clinic.QBW;ENG=QB_data_engine_23;DBN=08015b4362ce405ea4022d0f37cdb6

Error - 5/23/2013 9:03:03 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": DBConnPool::HandleConnectionError
errorCode:-6069, dbCode:-103 from file:'.\.\src\ConnPool.cpp' at line 1038 from
function:'DBMgr::DBConnPool::ini

Error - 5/26/2013 1:29:18 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": Connection
Error:Invalid user ID or passwo

Error - 5/26/2013 1:29:18 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": Connection
String:CON=QBConnectionPool-Probe-QB_data_engine_23; ;DBF=\\afc1\finance$\Alton
Family Clinic.QBW;ENG=QB_data_engine_23;DBN=d4a98b8c90a84fbb9cbf78f7ed6b54

Error - 5/26/2013 1:29:18 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": DBConnPool::HandleConnectionError
errorCode:-6069, dbCode:-103 from file:'.\.\src\ConnPool.cpp' at line 1038 from
function:'DBMgr::DBConnPool::ini

[ Application Events ]
Error - 5/23/2013 6:47:02 PM | Computer Name = OFFICERODRIGUEZ | Source = Application Hang | ID = 1002
Description = Hanging application QBW32.EXE, version 23.0.4006.2305, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/23/2013 6:47:45 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": Connection
Error:Invalid user ID or passwo

Error - 5/23/2013 6:47:45 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": Connection
String:CON=QBConnectionPool-Probe-QB_data_engine_23; ;DBF=\\afc1\finance$\Alton
Family Clinic.QBW;ENG=QB_data_engine_23;DBN=b4ede26f8dbe4c18b418795b5c5dd7

Error - 5/23/2013 6:47:45 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": DBConnPool::HandleConnectionError
errorCode:-6069, dbCode:-103 from file:'.\.\src\ConnPool.cpp' at line 1038 from
function:'DBMgr::DBConnPool::ini

Error - 5/23/2013 9:03:03 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": Connection
Error:Invalid user ID or passwo

Error - 5/23/2013 9:03:03 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": Connection
String:CON=QBConnectionPool-Probe-QB_data_engine_23; ;DBF=\\afc1\finance$\Alton
Family Clinic.QBW;ENG=QB_data_engine_23;DBN=08015b4362ce405ea4022d0f37cdb6

Error - 5/23/2013 9:03:03 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": DBConnPool::HandleConnectionError
errorCode:-6069, dbCode:-103 from file:'.\.\src\ConnPool.cpp' at line 1038 from
function:'DBMgr::DBConnPool::ini

Error - 5/26/2013 1:29:18 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": Connection
Error:Invalid user ID or passwo

Error - 5/26/2013 1:29:18 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": Connection
String:CON=QBConnectionPool-Probe-QB_data_engine_23; ;DBF=\\afc1\finance$\Alton
Family Clinic.QBW;ENG=QB_data_engine_23;DBN=d4a98b8c90a84fbb9cbf78f7ed6b54

Error - 5/26/2013 1:29:18 PM | Computer Name = OFFICERODRIGUEZ | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2013": DBConnPool::HandleConnectionError
errorCode:-6069, dbCode:-103 from file:'.\.\src\ConnPool.cpp' at line 1038 from
function:'DBMgr::DBConnPool::ini

[ System Events ]
Error - 5/12/2013 8:00:05 PM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7024
Description = The SQL Active Directory Helper Service service terminated with service-specific
error 3221225572 (0xC0000064).

Error - 5/12/2013 8:00:05 PM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7000
Description = The SSPORT service failed to start due to the following error: %%2

Error - 5/12/2013 8:03:11 PM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7000
Description = The DgiVecp service failed to start due to the following error: %%2

Error - 5/12/2013 8:03:11 PM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7024
Description = The SQL Active Directory Helper Service service terminated with service-specific
error 3221225572 (0xC0000064).

Error - 5/12/2013 8:03:11 PM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7000
Description = The SSPORT service failed to start due to the following error: %%2

Error - 5/12/2013 8:03:11 PM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7000
Description = The DgiVecp service failed to start due to the following error: %%2

Error - 5/16/2013 8:53:48 AM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7000
Description = The DgiVecp service failed to start due to the following error: %%2

Error - 5/16/2013 8:53:48 AM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7024
Description = The SQL Active Directory Helper Service service terminated with service-specific
error 3221225572 (0xC0000064).

Error - 5/16/2013 8:53:48 AM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7000
Description = The SSPORT service failed to start due to the following error: %%2

Error - 5/16/2013 8:53:48 AM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7000
Description = The DgiVecp service failed to start due to the following error: %%2

[ System Events ]
Error - 5/12/2013 8:00:05 PM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7024
Description = The SQL Active Directory Helper Service service terminated with service-specific
error 3221225572 (0xC0000064).

Error - 5/12/2013 8:00:05 PM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7000
Description = The SSPORT service failed to start due to the following error: %%2

Error - 5/12/2013 8:03:11 PM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7000
Description = The DgiVecp service failed to start due to the following error: %%2

Error - 5/12/2013 8:03:11 PM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7024
Description = The SQL Active Directory Helper Service service terminated with service-specific
error 3221225572 (0xC0000064).

Error - 5/12/2013 8:03:11 PM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7000
Description = The SSPORT service failed to start due to the following error: %%2

Error - 5/12/2013 8:03:11 PM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7000
Description = The DgiVecp service failed to start due to the following error: %%2

Error - 5/16/2013 8:53:48 AM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7000
Description = The DgiVecp service failed to start due to the following error: %%2

Error - 5/16/2013 8:53:48 AM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7024
Description = The SQL Active Directory Helper Service service terminated with service-specific
error 3221225572 (0xC0000064).

Error - 5/16/2013 8:53:48 AM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7000
Description = The SSPORT service failed to start due to the following error: %%2

Error - 5/16/2013 8:53:48 AM | Computer Name = OFFICERODRIGUEZ | Source = Service Control Manager | ID = 7000
Description = The DgiVecp service failed to start due to the following error: %%2


< End of report >

Thank you Robybel for waiting.

You'll find the AdwCleaner and Security Check documents posted; I tried installing the RogueKiller but as it tried to run from the zipfile the message "unable to initialize installer GUI" would pop up and the run would stop. I seem to be having some issues with downloading some other software programs lately as well. Let me know what's next. Thanks.
———————————–

# AdwCleaner v2.301 - Logfile created 06/04/2013 at 17:49:33
# Updated 16/05/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : administrator - OFFICERODRIGUEZ
# Boot Mode : Normal
# Running from : C:\Documents and Settings\administrator.AFC.000\My Documents\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Deleted on reboot : C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Deleted on reboot : C:\Documents and Settings\administrator.AFC.000\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\licjnkifamhpbaefhdpacpmihicfbomb
Folder Deleted : C:\Program Files\PricePeep
Folder Deleted : C:\Program Files\Wajam

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\PricePeep
Key Deleted : HKCU\Software\Crossrider
Key Deleted : HKCU\Software\InstalledBrowserExtensions
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKCU\Software\Wajam
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\priam_bho.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\PricePeep.DLL
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0003491.BHO
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamBHO
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamBHO.1
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamDownloader
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamDownloader.1
Key Deleted : HKLM\Software\Description
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\licjnkifamhpbaefhdpacpmihicfbomb
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\PricePeep
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Vid-Saver
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Wajam
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PricePeep
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wajam
Key Deleted : HKLM\Software\Wajam

***** [Internet Browsers] *****

-\\ Internet Explorer v6.0.2900.5512

[OK] Registry is clean.

-\\ Mozilla Firefox v21.0 (en-US)

-\\ Google Chrome v27.0.1453.94

*************************

AdwCleaner[R1].txt - [1732 octets] - [12/11/2012 21:40:40]
AdwCleaner[S1].txt - [1814 octets] - [12/11/2012 22:04:46]
AdwCleaner[S2].txt - [861 octets] - [21/11/2012 00:04:51]
AdwCleaner[S3].txt - [3845 octets] - [04/06/2013 17:49:33]

########## EOF - C:\AdwCleaner[S3].txt - [3905 octets] ##########


Results of screen317's Security Check version 0.99.64
Windows XP Service Pack 3 x86
``````````````Antivirus/Firewall Check:``````````````
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Disabled!
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Out of date HijackThis installed!
HijackThis 2.0.2
CCleaner
Java 7 Update 21
Adobe Flash Player 11.7.700.169
Adobe Reader XI
Mozilla Firefox (21.0)
Google Chrome 27.0.1453.93
Google Chrome 27.0.1453.94
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 5%
````````````````````End of Log``````````````````````

Hi hecrodfnp

I tried installing the RogueKiller but as it tried to run from the zipfile the message "unable to initialize installer GUI" would pop up and the run would stop. I seem to be having some issues with downloading some other software programs lately as well

<_<

Please read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Hi Robybel. Ran TDSSKiller as instructed and after a scan it states no threats found. A few problems remain on the computer including: When doing a restart, the computer will not fully power off, but remain in a blue screen and a hard shut down is required. Internet Explorer won't open, but instantly state an error has occurred Some software programs stall or don't work when attempting to use functions or perform certain actions within them Let me know what's next. Thanks.

Hi Robybel.

The ComboFix log follows:

ComboFix 13-06-06.04 - administrator 06/06/2013 17:35:56.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1067 [GMT -5:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\docume~1\ADMINI~1.000\LOCALS~1\Temp\{16AA8FB8-4A98-4757-B7A5-0FF22C0A6E33}_1101_1\dbdata11.dll
c:\documents and settings\administrator.AFC.000\Local Settings\temp\{16AA8FB8-4A98-4757-B7A5-0FF22C0A6E33}_1101_1\dbdata11.dll
.
c:\windows\system32\drivers\i8042prt.sys . . . is missing!!
.
.
((((((((((((((((((((((((( Files Created from 2013-05-06 to 2013-06-06 )))))))))))))))))))))))))))))))
.
.
2013-05-19 22:50 . 2013-05-19 22:50 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Sun
2013-05-19 16:53 . 2013-05-19 16:53 ——– d—–w- c:\program files\iPod
2013-05-19 16:52 . 2013-05-19 16:53 ——– d—–w- c:\program files\iTunes
2013-05-19 16:52 . 2013-05-19 16:53 ——– d—–w- c:\documents and settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-05-11 10:37 . 2013-05-11 10:37 209472 —-a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
2013-05-10 06:51 . 2008-06-13 11:05 272128 -c—-w- c:\windows\system32\dllcache\bthport.sys
2013-05-10 06:50 . 2011-07-15 13:29 456320 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys
2013-05-10 06:46 . 2013-02-12 00:32 12928 -c—-w- c:\windows\system32\dllcache\usb8023x.sys
2013-05-10 06:42 . 2013-03-07 01:32 2149888 -c—-w- c:\windows\system32\dllcache\ntkrnlmp.exe
2013-05-10 06:42 . 2013-03-07 01:28 2193408 -c—-w- c:\windows\system32\dllcache\ntoskrnl.exe
2013-05-10 06:42 . 2013-03-07 00:50 2028544 -c—-w- c:\windows\system32\dllcache\ntkrpamp.exe
2013-05-10 06:42 . 2013-03-07 00:50 2070016 -c—-w- c:\windows\system32\dllcache\ntkrnlpa.exe
2013-05-10 06:35 . 2013-05-10 06:35 ——– d—–w- c:\documents and settings\administrator.AFC.000\Local Settings\Application Data\Sun
2013-05-10 06:25 . 2013-05-10 06:25 ——– d—–w- c:\program files\Common Files\Java
2013-05-10 06:25 . 2013-05-10 06:24 144896 —-a-w- c:\windows\system32\javacpl.cpl
2013-05-10 06:25 . 2013-05-10 06:24 866720 —-a-w- c:\windows\system32\npDeployJava1.dll
2013-05-10 06:24 . 2013-05-10 06:24 94112 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-05-10 06:17 . 2012-06-02 20:19 45080 —-a-w- c:\windows\system32\wups2.dll
2013-05-10 06:09 . 2013-05-10 06:18 ——– d—–w- c:\documents and settings\administrator.AFC.000\Local Settings\Application Data\NPE
2013-05-10 05:49 . 2008-04-14 07:00 101376 -c–a-w- c:\windows\system32\dllcache\srusbusd.dll
2013-05-10 05:48 . 2008-04-14 07:00 7680 -c–a-w- c:\windows\system32\dllcache\ftpctrs2.dll
2013-05-10 05:46 . 2012-06-02 20:19 210968 —-a-w- c:\windows\system32\wuweb.dll
2013-05-10 05:35 . 2008-04-14 07:00 24661 -c–a-w- c:\windows\system32\dllcache\spxcoins.dll
2013-05-10 05:35 . 2008-04-14 07:00 24661 —-a-w- c:\windows\system32\spxcoins.dll
2013-05-10 05:35 . 2008-04-14 07:00 13312 -c–a-w- c:\windows\system32\dllcache\irclass.dll
2013-05-10 05:35 . 2008-04-14 07:00 13312 —-a-w- c:\windows\system32\irclass.dll
2013-05-10 05:35 . 2008-04-14 07:00 16535 —-a-r- c:\windows\SET52.tmp
2013-05-10 05:35 . 2008-04-14 07:00 1088840 —-a-r- c:\windows\SET46.tmp
2013-05-10 05:35 . 2008-04-14 07:00 1296669 —-a-r- c:\windows\SET43.tmp
2013-05-10 04:57 . 2013-05-10 04:58 ——– d—–w- C:\034500e9cbd934d3d535843d
2013-05-10 04:22 . 2008-04-14 07:00 16535 —-a-r- c:\windows\SET173.tmp
2013-05-10 04:22 . 2008-04-14 07:00 1088840 —-a-r- c:\windows\SET167.tmp
2013-05-10 04:22 . 2008-04-14 07:00 1296669 —-a-r- c:\windows\SET164.tmp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-03 00:02 . 2011-07-20 20:14 86888 —-a-w- c:\windows\system32\LMIRfsClientNP.dll
2013-06-03 00:02 . 2011-07-20 20:14 53064 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll
2013-06-03 00:02 . 2011-07-20 20:14 31560 —-a-w- c:\windows\system32\LMIport.dll
2013-06-03 00:02 . 2011-07-20 20:14 92488 —-a-w- c:\windows\system32\LMIinit.dll
2013-05-10 06:24 . 2010-05-26 23:44 788896 —-a-w- c:\windows\system32\deployJava1.dll
2013-04-16 21:18 . 2008-04-14 07:00 81920 —-a-w- c:\windows\system32\ieencode.dll
2013-04-16 21:18 . 2008-04-14 07:00 668672 —-a-w- c:\windows\system32\wininet.dll
2013-04-16 21:18 . 2008-04-14 07:00 61952 —-a-w- c:\windows\system32\tdc.ocx
2013-04-13 00:53 . 2008-04-14 07:00 369664 —-a-w- c:\windows\system32\html.iec
2013-04-10 13:40 . 2012-05-21 15:36 691592 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-04-10 13:40 . 2011-05-21 17:09 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-04-10 01:31 . 2008-04-14 07:00 1876352 —-a-w- c:\windows\system32\win32k.sys
2013-03-13 11:26 . 2013-04-26 19:50 53080 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\GoToPrintProcessor.dll
2013-03-13 11:26 . 2013-04-26 19:35 126296 —-a-w- c:\windows\system32\gotomon.dll
2013-03-13 11:15 . 2013-04-26 19:35 28416 —-a-w- c:\windows\system32\drivers\monblanking.sys
2013-03-11 15:30 . 2013-03-11 15:30 1721752 —-a-w- c:\windows\system32\InetClnt.dll
2013-03-11 15:15 . 2013-03-11 15:15 1694992 —-a-w- c:\windows\system32\VBA6.DLL
2013-03-11 15:14 . 2013-03-11 15:14 741008 —-a-w- c:\windows\system32\SPR32D30.DLL
2012-10-29 11:46 . 2013-05-17 01:58 305744 —-a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-23 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-02-05 128232]
"Dell PanelMgr"="c:\windows\Dell\PanelMgr\SSMMgr.exe" [2009-05-08 541936]
"2335dn Scan2PC"="c:\windows\twain_32\Dell\Dell2335\Scan2Pc.exe" [2008-09-26 495616]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2011-09-16 63048]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2011-04-01 1163264]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2012-11-25 296096]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-10-25 421888]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2013-03-11 2778424]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-17 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-17 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-17 141848]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2009-06-22 1044480]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-05-15 152392]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Attendance Rx.lnk - c:\program files\Acroprint\Attendance Rx\AttendanceRx.exe [2010-3-11 5742592]
Intuit Data Protect.lnk - c:\program files\Common Files\Intuit\DataProtect\IntuitDataProtect.exe [2013-3-11 6189944]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2013-3-11 1182536]
QuickBooks_Standard_21.lnk - c:\program files\Intuit\QuickBooks 2013\QBW32.EXE [2013-3-11 1185096]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToMyPC]
2013-03-13 11:26 16216 —-a-w- c:\program files\Citrix\GoToMyPC\g2winlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2013-06-03 00:02 92488 —-a-w- c:\windows\system32\LMIinit.dll
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
.
R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [12/14/2009 2:02 PM 24064]
R2 arxservice;arxservice;c:\program files\Acroprint\Attendance Rx\arxservice.exe [3/11/2010 12:16 PM 61440]
R2 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\SeaPort.EXE [6/15/2011 5:33 PM 249648]
R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [1/31/2012 9:30 PM 375120]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [9/16/2011 2:10 PM 13624]
R2 monblanking;monblanking;c:\windows\system32\drivers\monblanking.sys [4/26/2013 2:35 PM 28416]
R2 MSSQL$ACROPRINT;SQL Server (ACROPRINT);c:\program files\Microsoft SQL Server\MSSQL10_50.ACROPRINT\MSSQL\Binn\sqlservr.exe [6/17/2011 10:19 PM 43040096]
R2 QBVSS;QBIDPService;c:\program files\Common Files\Intuit\DataProtect\QBIDPService.exe [3/11/2013 10:23 AM 1248256]
R2 timeQplus Server;timeQplus Server;c:\program files\Acroprint\timeQplusV4\Server\tQp.Service.Server.exe [5/10/2013 3:52 PM 15872]
R3 BrSerIb;Brother Serial Interface Driver(WDM);c:\windows\system32\drivers\BrSerIb.sys [6/5/2012 5:51 PM 71424]
R3 BrUsbSIb;Brother Serial USB Driver(WDM);c:\windows\system32\drivers\BrUsbSib.sys [6/5/2012 5:51 PM 11520]
R3 k57w2k;Broadcom NetLink ™ Gigabit Ethernet;c:\windows\system32\drivers\k57xp32.sys [12/14/2009 2:02 PM 176640]
S0 cerc6;cerc6; [x]
S2 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [4/3/2010 1:56 PM 44896]
S2 SQLAgent$ACROPRINT;SQL Server Agent (ACROPRINT);c:\program files\Microsoft SQL Server\MSSQL10_50.ACROPRINT\MSSQL\Binn\SQLAGENT.EXE [6/17/2011 10:19 PM 370016]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys –> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [7/7/2011 7:31 PM 195336]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [7/15/2012 4:06 PM 18432]
S4 RsFx0151;RsFx0151 Driver;c:\windows\system32\drivers\RsFx0151.sys [6/17/2011 9:28 PM 240736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-06-06 14:11 1165776 —-a-w- c:\program files\Google\Chrome\Application\27.0.1453.110\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]
.
2013-06-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-23 04:50]
.
2013-06-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-23 04:50]
.
2013-06-06 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3272544874-3166413241-1926064316-500.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 20:27]
.
2013-06-04 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3272544874-3166413241-1926064316-500.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 20:27]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.opusdei.org/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
TCP: Interfaces\{763F0D47-11DC-4F77-BEF5-5C1D3BD62FC7}: NameServer = 192.168.77.10
Handler: intu-help-qb6 - {6898B29B-BF49-43cb-A0B1-D0B9496AF491} - c:\program files\Intuit\QuickBooks 2013\HelpAsyncPluggableProtocol.dll
FF - ProfilePath - c:\documents and settings\administrator.AFC.000\Application Data\Mozilla\Firefox\Profiles\econsfri.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.opusdei.org/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-06-06 18:02
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-3272544874-3166413241-1926064316-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,1e,93,64,c1,80,32,6a,45,9f,d5,9a,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,1e,93,64,c1,80,32,6a,45,9f,d5,9a,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(688)
c:\program files\Citrix\GoToMyPC\G2WinLogon.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
.
- - - - - - - > 'explorer.exe'(2028)
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Acroprint\Attendance Rx\arxsvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Citrix\GoToMyPC\g2svc.exe
c:\program files\Acroprint\Attendance Rx\ARXTQ100N.exe
c:\program files\Citrix\GoToMyPC\g2comm.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\program files\Citrix\GoToMyPC\g2pre.exe
c:\program files\Citrix\GoToMyPC\g2tray.exe
c:\program files\LogMeIn\x86\RaMaint.exe
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\RealVNC\VNC4\WinVNC4.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\Brother\ControlCenter3\brccMCtl.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Acroprint\Attendance Rx\ARXTQ100S.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2013-06-06 18:06:42 - machine was rebooted
ComboFix-quarantined-files.txt 2013-06-06 23:06
ComboFix2.txt 2013-05-10 06:08
.
Pre-Run: 79,383,293,952 bytes free
Post-Run: 79,463,292,928 bytes free
.
- - End Of File - - 86D01AFF95782713E51D7F53ABA69D2A
CDB4DE4BBD714F152979DA2DCBEF57EB


THANKS!