Malware Toolbars doing Re-directs, Zombie processes and More!

I was able to run HJT and OTL but could not run DDS.
I tried to run in regular and safe mode but encountered an issue: "Program too big to fit in memory".
I tried to kill all the background processes but my memory is still low. Is there anything I can do without DDS or to make DDS run?

Logs here
=================

OTL logfile created on: 8/10/2013 4:35:40 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\William Randle\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16635)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.44 Gb Total Physical Memory | 1.17 Gb Available Physical Memory | 48.15% Memory free
6.09 Gb Paging File | 4.41 Gb Available in Paging File | 72.51% Paging File free
Paging file location(s): c:\pagefile.sys 3741 5000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 142.08 Gb Total Space | 35.52 Gb Free Space | 25.00% Space Free | Partition Type: NTFS
Drive D: | 6.96 Gb Total Space | 0.01 Gb Free Space | 0.17% Space Free | Partition Type: FAT32
Unable to calculate disk information.

Computer Name: WILLIAMRANDLE | User Name: William Randle | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\William Randle\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\William Randle\AppData\Roaming\Tepfel\WebCakeDesktop.exe (Bake Cake)
PRC - C:\Program Files\Tepfel\WebCakeDesktop.Updater.exe (cake bake)
PRC - C:\Program Files\Browsersafeguard\BrowserSafeguard.exe (BrowserSafeguard)
PRC - C:\Program Files\Sendori\SendoriUp.exe (Sendori, Inc.)
PRC - C:\Program Files\Sendori\SendoriSvc.exe (Sendori, Inc.)
PRC - C:\Program Files\Sendori\SendoriTray.exe (Sendori, Inc.)
PRC - C:\Program Files\Sendori\sndappv2.exe (Sendori)
PRC - C:\Program Files\Sendori\Sendori.Service.exe (sendori)
PRC - C:\Program Files\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
PRC - C:\Program Files\MapsGalaxy_39\bar\1.bin\39barsvc.exe (COMPANYVERS_NAME)
PRC - C:\Program Files\MapsGalaxy_39\bar\1.bin\39brmon.exe (VER_COMPANY_NAME)
PRC - C:\Program Files\Fast Free Converter\FastFreeConverterUpdt.exe ()
PRC - C:\Program Files\SearchProtect\bin\CltMngSvc.exe (Conduit)
PRC - C:\Program Files\RecipeHub_2j\bar\1.bin\2jbarsvc.exe (COMPANYVERS_NAME)
PRC - C:\Program Files\RecipeHub_2j\bar\1.bin\2jbrmon.exe (VER_COMPANY_NAME)
PRC - C:\Program Files\PCFixSpeed\PCFixTray.exe (Crawler.com)
PRC - C:\Program Files\24x7Help\App24x7Svc.exe (PCRx.com, LLC)
PRC - C:\Program Files\24x7Help\App24x7Hook.exe (PCRx.com, LLC)
PRC - C:\Program Files\24x7Help\App24x7Help.exe (Crawler, LLC)
PRC - C:\Program Files\TotalRecipeSearch_14\bar\1.bin\14SrchMn.exe (MindSpark)
PRC - C:\Program Files\TotalRecipeSearch_14\bar\1.bin\14barsvc.exe (COMPANYVERS_NAME)
PRC - C:\Program Files\TotalRecipeSearch_14\bar\1.bin\14brmon.exe (VER_COMPANY_NAME)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Users\William Randle\AppData\Local\Google\Chrome\Application\28.0.1500.95\ppgooglenaclpluginchrome.dll ()
MOD - C:\Users\William Randle\AppData\Local\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll ()
MOD - C:\Users\William Randle\AppData\Local\Google\Chrome\Application\28.0.1500.95\pdf.dll ()
MOD - C:\Users\William Randle\AppData\Local\Google\Chrome\Application\28.0.1500.95\ffmpegsumo.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\59a12d8db2a29bbe4e597124682cc4f7\System.EnterpriseServices.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\dca6df8260d6c4c0bd66cb3be72eb73a\System.Transactions.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\f95e6b6a92e3e28a3b553fe2998dd308\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\178644ab40108f3becd8b91049a254c3\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\bfa7a95284aec941f4b03bae0debe07c\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\32066405eb9ab14056b2af3115d2a6de\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\9e24b9ffd816c0c90efc4d3fc9fd745f\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\187c13e8967097d2ed1e5f123e7d890a\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll ()
MOD - C:\Program Files\MyPC Backup\GetText.dll ()
MOD - C:\Program Files\MyPC Backup\x86\System.Data.SQLite.dll ()
MOD - c:\Program Files\Optimizer Pro\OptProCrash.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll ()


========== Services (SafeList) ==========

SRV - (WebCakeUpdater) – C:\Program Files\Tepfel\WebCakeDesktop.Updater.exe (cake bake)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Application Sendori) – C:\Program Files\Sendori\SendoriSvc.exe (Sendori, Inc.)
SRV - (sndappv2) – C:\Program Files\Sendori\sndappv2.exe (Sendori)
SRV - (Service Sendori) – C:\Program Files\Sendori\Sendori.Service.exe (sendori)
SRV - (BackupStack) – C:\Program Files\MyPC Backup\BackupStack.exe (Just Develop It)
SRV - (MapsGalaxy_39Service) – C:\Program Files\MapsGalaxy_39\bar\1.bin\39barsvc.exe (COMPANYVERS_NAME)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (FastFreeConverterUpdt) – C:\Program Files\Fast Free Converter\FastFreeConverterUpdt.exe ()
SRV - (CltMngSvc) – C:\Program Files\SearchProtect\bin\CltMngSvc.exe (Conduit)
SRV - (RecipeHub_2jService) – C:\Program Files\RecipeHub_2j\bar\1.bin\2jbarsvc.exe (COMPANYVERS_NAME)
SRV - (24x7HelpSvc) – C:\Program Files\24x7Help\App24x7Svc.exe (PCRx.com, LLC)
SRV - (TotalRecipeSearch_14Service) – C:\Program Files\TotalRecipeSearch_14\bar\1.bin\14barsvc.exe (COMPANYVERS_NAME)
SRV - (DefaultTabUpdate) – C:\Users\William Randle\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe ()
SRV - (McAfee SiteAdvisor Service) – c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (DefaultTabSearch) – C:\Program Files\DefaultTab\DefaultTabSearch.exe ()
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (CareMon) – C:\Program Files\TuneUp360\CareMon.exe ()
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (RosettaStoneLtdController) – C:\Program Files\RosettaStoneLtdServices\RosettaStoneLtdController.exe (Rosetta Stone Ltd.)


========== Driver Services (SafeList) ==========

DRV - (PalmUSBD) – system32\drivers\PalmUSBD.sys File not found
DRV - (MpKsla20b9243) – c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{EC4A9A91-CAC9-4E32-A919-0A70C65DF8B3}\MpKsla20b9243.sys File not found
DRV - (SWDUMon) – C:\Windows\System32\drivers\SWDUMon.sys ()
DRV - (dc3d) – C:\Windows\System32\drivers\dc3d.sys (Microsoft Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (swmsflt) – C:\Windows\System32\drivers\swmsflt.sys ()
DRV - (rcmirror) – C:\Windows\System32\drivers\rcmirror.sys (Windows ® Win 7 DDK provider)
DRV - (swvspser) – C:\Windows\System32\drivers\swvspser.sys (Sierra Wireless Inc.)
DRV - (SWNC5E00) – C:\Windows\System32\drivers\SWNC5E00.sys (Sierra Wireless Inc.)
DRV - (SWMX00) – C:\Windows\System32\drivers\swmx00.sys (Sierra Wireless Inc.)
DRV - (WSDPrintDevice) – C:\Windows\System32\drivers\WSDPrint.sys (Microsoft Corporation)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (LSI Corp)
DRV - (RTL8023xp) – C:\Windows\System32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (ALCXWDM) – C:\Windows\System32\drivers\RTKVAC.SYS (Realtek Semiconductor Corp.)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {07cbf788-1359-421b-a4e3-5a8d041b90a3} - C:\Program Files\InternetHelper3.1\prxtbInte.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {0bc52218-c3c2-4a28-88f7-cdc0f27bc60d} - C:\Program Files\Vgrabber_v1.9\prxtbVgra.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {739df940-c5ee-4bab-9d7e-270894ae687a} - C:\Program Files\WhiteSmoke_New\prxtbWhi0.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {173BFF59-D1F7-4806-A525-4E1E21DDE070}
IE - HKLM\..\SearchScopes\{031949b3-28b6-43a4-90e2-dde1cfe21390}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.google.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.mywebsearch.com/index.jhtml?n=…DA-232658361BE0
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\..\URLSearchHook: {07cbf788-1359-421b-a4e3-5a8d041b90a3} - C:\Program Files\InternetHelper3.1\prxtbInte.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {0bc52218-c3c2-4a28-88f7-cdc0f27bc60d} - C:\Program Files\Vgrabber_v1.9\prxtbVgra.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {26842a09-ffa8-4e2c-ae12-0c80f01c3295} - No CLSID value found
IE - HKCU\..\URLSearchHook: {739df940-c5ee-4bab-9d7e-270894ae687a} - C:\Program Files\WhiteSmoke_New\prxtbWhi0.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {8a7d2060-824d-4b17-b00a-759b1b5f30d9} - No CLSID value found
IE - HKCU\..\URLSearchHook: {9234F5E0-56CC-4F0B-AAE4-0D4BD5032180} - C:\Program Files\Crawler Toolbar\Crawler.dll (Crawler.com, LLC)
IE - HKCU\..\URLSearchHook: {cc8ae5b8-005b-4b1a-a27d-307eddffe5c8} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {173BFF59-D1F7-4806-A525-4E1E21DDE070}
IE - HKCU\..\SearchScopes\{031949b3-28b6-43a4-90e2-dde1cfe21390}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE10SR
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}…0000015f249dea1
IE - HKCU\..\SearchScopes\{173BFF59-D1F7-4806-A525-4E1E21DDE070}: "URL" = http://search.conduit.com/ResultsExt.aspx?…amp;SSPV=TB_TS7
IE - HKCU\..\SearchScopes\{21CA3F90-6D8C-4E39-93DA-28764A3737E9}: "URL" = http://search.yahoo.com/search?fr=mcafee&p;={SearchTerms}
IE - HKCU\..\SearchScopes\{26713B2E-E749-4E05-A31D-FED0A6775083}: "URL" = http://www.mysearchresults.com/search?&…q={searchTerms}
IE - HKCU\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = http://blekkosearch.mystart.com/blekkotb_s…q={searchTerms}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…;rlz=1I7ADFA_en
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={BCB6BFE…mp;d=2012-02-22 19:26:58&v;=10.0.0.7&sap;=dsp&q;={searchTerms}
IE - HKCU\..\SearchScopes\{A26C36F3-9D6C-4551-86A4-B3E9C4B7B3CD}: "URL" = http://www.crawler.com/search/dispatcher.a…0002&lng;=en
IE - HKCU\..\SearchScopes\{A7BEA8F1-9B01-48AB-92BF-1A8F600FD00E}: "URL" = http://websearch.ask.com/redirect?client=i…9A-48F88B898921
IE - HKCU\..\SearchScopes\{B272A2C0-D921-4FE2-8F51-FD86B985F5BB}: "URL" = http://delicious.com/search?p={searchTerms}
IE - HKCU\..\SearchScopes\{DFFC8BA0-0A74-4A0D-92F5-6C0E2CCAE760}: "URL" = http://www.flickr.com/search/?q={searchTerms}
IE - HKCU\..\SearchScopes\{E003646A-9461-46DE-91CD-281A4106EA1A}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;fr=chr-yie9
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:61521;https=127.0.0.1:61521


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@MapsGalaxy_39.com/Plugin: C:\Program Files\MapsGalaxy_39\bar\1.bin\NP39Stub.dll (MindSpark)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@RecipeHub_2j.com/Plugin: C:\Program Files\RecipeHub_2j\bar\1.bin\NP2jStub.dll (MindSpark)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@TotalRecipeSearch_14.com/Plugin: C:\Program Files\TotalRecipeSearch_14\bar\1.bin\NP14Stub.dll (MindSpark)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\William Randle\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\William Randle\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2012/07/31 13:29:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\SiteRanker\firefox\ [2012/12/18 21:29:34 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\14ffxtbr@TotalRecipeSearch_14.com: C:\Program Files\TotalRecipeSearch_14\bar\1.bin [2013/04/15 18:18:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\2jffxtbr@RecipeHub_2j.com: C:\Program Files\RecipeHub_2j\bar\1.bin [2013/04/24 18:45:23 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\39ffxtbr@MapsGalaxy_39.com: C:\Program Files\MapsGalaxy_39\bar\1.bin [2013/06/25 08:33:37 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\LyricsParty\126.xpi [2013/08/08 12:50:26 | 000,009,797 | —- | M] ()

[2012/08/07 22:09:41 | 000,000,000 | —D | M] (No name found) – C:\Users\William Randle\AppData\Roaming\Mozilla\Extensions
[2012/08/07 22:07:14 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Conduit (Enabled)
CHR - default_search_provider: search_url = http://search.conduit.com/Results.aspx?q={…amp;sspv=CHNTR3
CHR - default_search_provider: suggest_url = http://suggest.search.conduit.com/CSuggest…CHNTR3&UM;=2
CHR - homepage: http://search.conduit.com/?ctid=CT3289847&…amp;sspv=CHNTR3
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\William Randle\AppData\Local\Google\Chrome\Application\28.0.1500.95\gcswf32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\William Randle\AppData\Local\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\William Randle\AppData\Local\Google\Chrome\Application\28.0.1500.95\pdf.dll
CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Users\William Randle\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.122.1_0\McChPlg.dll
CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: MindSpark Toolbar Platform Plugin Stub (Enabled) = C:\Program Files\RadioPI_4e\bar\1.bin\NP4eStub.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: RivalGaming = C:\Users\William Randle\AppData\Local\Google\Chrome\User Data\Default\Extensions\adhmhclafdhfabmmglbcngpddpdeijgd\
CHR - Extension: AppGraffiti - Free Facebook Layouts = C:\Users\William Randle\AppData\Local\Google\Chrome\User Data\Default\Extensions\angobeimajilfhlcpeiccndaifchnppl\1.0.0.11_0\
CHR - Extension: SiteRanker = C:\Users\William Randle\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgldkplledicnbnnliodeffobaiaodaf\1.0.0.0_0\
CHR - Extension: Vgrabber v1.9 = C:\Users\William Randle\AppData\Local\Google\Chrome\User Data\Default\Extensions\dijhkeelgcfckackbgkkdaamdhaiplod\10.16.100.4_0\
CHR - Extension: SiteAdvisor = C:\Users\William Randle\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.50.146.1_0\
CHR - Extension: Web Cake = C:\Users\William Randle\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjoijdanhaiflhibkljeklcghcmmfffh\1.0.3_0\
CHR - Extension: Privacy SafeGuard = C:\Users\William Randle\AppData\Local\Google\Chrome\User Data\Default\Extensions\geggofhlfbcmanadhknllmlajiafopoh\1.1_0\
CHR - Extension: DefaultTab = C:\Users\William Randle\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc\1.1.3_0\
CHR - Extension: WhiteSmoke New = C:\Users\William Randle\AppData\Local\Google\Chrome\User Data\Default\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi\10.16.9.9_0\
CHR - Extension: LyricsParty = C:\Users\William Randle\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmhcioafdnaphcmlajkgbnghloomafka\1.126_0\
CHR - Extension: getsav-in = C:\Users\William Randle\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjildcbkilmkddbbpbjljljdmmlfeppl\5.0_0\
CHR - Extension: InternetHelper3.1 = C:\Users\William Randle\AppData\Local\Google\Chrome\User Data\Default\Extensions\nemfjadlboooiffmcelkafilagddogim\10.16.9.9_0\
CHR - Extension: ClipConverter = C:\Users\William Randle\AppData\Local\Google\Chrome\User Data\Default\Extensions\njjjgjlocdhecpgdcfjblcnfebfnmhpp\1.2.7_0\

O1 HOSTS File: ([2009/06/10 14:39:37 | 000,000,824 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (Toolbar BHO) - {06e3475c-5521-4de8-bb12-50720f21631c} - C:\Program Files\RecipeHub_2j\bar\1.bin\2jbar.dll (MindSpark)
O2 - BHO: (InternetHelper3.1 Toolbar) - {07cbf788-1359-421b-a4e3-5a8d041b90a3} - C:\Program Files\InternetHelper3.1\prxtbInte.dll (Conduit Ltd.)
O2 - BHO: (Vgrabber v1.9 Toolbar) - {0bc52218-c3c2-4a28-88f7-cdc0f27bc60d} - C:\Program Files\Vgrabber_v1.9\prxtbVgra.dll (Conduit Ltd.)
O2 - BHO: (no name) - {1036AD63-AEAC-460B-9060-C96005D4DC86} - No CLSID value found.
O2 - BHO: (no name) - {11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5} - C:\Program Files\SiteRanker\SiteRank.dll (Crawler, LLC)
O2 - BHO: (Toolbar BHO) - {1e91a655-bb4b-4693-a05e-2edebc4c9d89} - C:\Program Files\MapsGalaxy_39\bar\1.bin\39bar.dll (MindSpark)
O2 - BHO: (RivalGaming Games) - {26D675AC-D925-4bbf-A720-62C2AA4A81EB} - C:\Users\William Randle\AppData\Local\RivalGaming\RivalGaming.dll (RivalGaming)
O2 - BHO: (WebCake) - {2A5A2A90-3B30-4E6E-A955-2F232C6EF517} - C:\Program Files\Tepfel\WebCakeIEClient.dll (Let Them Eat Web-Cake LLC)
O2 - BHO: (AppGraffiti) - {6F6A5334-78E9-4D9B-8182-8B41EA8C39EF} - C:\Program Files\AppGraffiti\AppGraffiti.dll (Omega Partners Ltd)
O2 - BHO: (Search Assistant BHO) - {71c1d63a-c944-428a-a5bd-ba513190e5d2} - C:\Program Files\MapsGalaxy_39\bar\1.bin\39SrcAs.dll (MindSpark)
O2 - BHO: (WhiteSmoke New Toolbar) - {739df940-c5ee-4bab-9d7e-270894ae687a} - C:\Program Files\WhiteSmoke_New\prxtbWhi0.dll (Conduit Ltd.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (DefaultTab Browser Helper) - {7F6AFBF1-E065-4627-A2FD-810366367D01} - C:\Users\William Randle\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabBHO.dll (Search Results LLC.)
O2 - BHO: (Crawler Toolbar) - {9234F5E0-56CC-4F0B-AAE4-0D4BD5032180} - C:\Program Files\Crawler Toolbar\Crawler.dll (Crawler.com, LLC)
O2 - BHO: (Privacy Safeguard BHO) - {A42D2EB4-DD31-4BB5-8AA5-8D4E04806DBE} - C:\Program Files\PrivacySafeGuard\PrivacySafeGuard.dll (PrivacySafeguard)
O2 - BHO: (Toolbar BHO) - {ab56dfde-0c14-45b3-9df6-7b0eba617870} - C:\Program Files\TotalRecipeSearch_14\bar\1.bin\14bar.dll (MindSpark)
O2 - BHO: (GetSavin 5.0) - {AC3CC5EA-AA7D-4A03-BFBE-B7D6DFE821C9} - C:\Users\William Randle\AppData\Local\getsavin\ie\getsavin_1376175007.dll ()
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Cartwheel) - {B50DF051-E1D4-439C-B94E-F4DE82B56542} - C:\Users\William Randle\AppData\Roaming\Cartwheel\Cartwheel.dll (Cartwheel, Inc.)
O2 - BHO: (Search Assistant BHO) - {b7acdf9c-c4f9-4d5d-998e-b147866b4d4c} - C:\Program Files\RecipeHub_2j\bar\1.bin\2jSrcAs.dll (MindSpark)
O2 - BHO: (getsav-in 5.0) - {BC950AA0-979A-4EBE-9A10-6294F6457221} - C:\Users\William Randle\AppData\Local\getsav-in\ie\getsav-in_1375841101.dll ()
O2 - BHO: (LyricsParty) - {bd0d2596-eead-4b3f-a84e-7c0644366e45} - C:\Program Files\LyricsParty\126.dll (LyricsParty)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Search Assistant BHO) - {df22384f-cf68-4d19-969f-10423715528b} - C:\Program Files\TotalRecipeSearch_14\bar\1.bin\14SrcAs.dll (MindSpark)
O2 - BHO: (Bucksbee Loyalty Plugin - 100815) - {E5C2A1FE-86DB-87B4-11F0-1AA2579E81DD} - C:\Program Files\Bucksbee Loyalty Plugin - 100815\BucksBee Loyalty Plugin.dll (Freecause Inc.)
O2 - BHO: (Fast Free Converter 4.1) - {F5580E24-8416-4DFD-90B3-078D4EDF4FCB} - C:\Program Files\Fast Free Converter\FastFreeConverter\FastFreeConverter.dll (Fast Free Converter)
O3 - HKLM\..\Toolbar: (InternetHelper3.1 Toolbar) - {07cbf788-1359-421b-a4e3-5a8d041b90a3} - C:\Program Files\InternetHelper3.1\prxtbInte.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Vgrabber v1.9 Toolbar) - {0bc52218-c3c2-4a28-88f7-cdc0f27bc60d} - C:\Program Files\Vgrabber_v1.9\prxtbVgra.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (MapsGalaxy) - {364ea597-e728-4ce4-bb4a-ed846ef47970} - C:\Program Files\MapsGalaxy_39\bar\1.bin\39bar.dll (MindSpark)
O3 - HKLM\..\Toolbar: (WhiteSmoke New Toolbar) - {739df940-c5ee-4bab-9d7e-270894ae687a} - C:\Program Files\WhiteSmoke_New\prxtbWhi0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (TotalRecipeSearch) - {a0154e07-2b48-475c-a82a-80efd84ea33e} - C:\Program Files\TotalRecipeSearch_14\bar\1.bin\14bar.dll (MindSpark)
O3 - HKLM\..\Toolbar: (&Crawler; Toolbar) - {C4D78C72-08DB-4A3F-9175-B265157283F3} - C:\Program Files\Crawler Toolbar\Crawler.dll (Crawler.com, LLC)
O3 - HKLM\..\Toolbar: (Recipe Hub) - {cf51de5b-eb36-4114-bb69-84df63fbadb4} - C:\Program Files\RecipeHub_2j\bar\1.bin\2jbar.dll (MindSpark)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (InternetHelper3.1 Toolbar) - {07CBF788-1359-421B-A4E3-5A8D041B90A3} - C:\Program Files\InternetHelper3.1\prxtbInte.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Vgrabber v1.9 Toolbar) - {0BC52218-C3C2-4A28-88F7-CDC0F27BC60D} - C:\Program Files\Vgrabber_v1.9\prxtbVgra.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (MapsGalaxy) - {364EA597-E728-4CE4-BB4A-ED846EF47970} - C:\Program Files\MapsGalaxy_39\bar\1.bin\39bar.dll (MindSpark)
O3 - HKCU\..\Toolbar\WebBrowser: (WhiteSmoke New Toolbar) - {739DF940-C5EE-4BAB-9D7E-270894AE687A} - C:\Program Files\WhiteSmoke_New\prxtbWhi0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (TotalRecipeSearch) - {A0154E07-2B48-475C-A82A-80EFD84EA33E} - C:\Program Files\TotalRecipeSearch_14\bar\1.bin\14bar.dll (MindSpark)
O3 - HKCU\..\Toolbar\WebBrowser: (&Crawler; Toolbar) - {C4D78C72-08DB-4A3F-9175-B265157283F3} - C:\Program Files\Crawler Toolbar\Crawler.dll (Crawler.com, LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (Recipe Hub) - {CF51DE5B-EB36-4114-BB69-84DF63FBADB4} - C:\Program Files\RecipeHub_2j\bar\1.bin\2jbar.dll (MindSpark)
O4 - HKLM..\Run: [24x7HELP] C:\Program Files\24x7Help\App24x7Help.exe (Crawler, LLC)
O4 - HKLM..\Run: [MapsGalaxy Search Scope Monitor] C:\Program Files\MapsGalaxy_39\bar\1.bin\39SrchMn.exe (MindSpark)
O4 - HKLM..\Run: [MapsGalaxy_39 Browser Plugin Loader] C:\Program Files\MapsGalaxy_39\bar\1.bin\39brmon.exe (VER_COMPANY_NAME)
O4 - HKLM..\Run: [PCFixSpeed] C:\Program Files\PCFixSpeed\PCFixTray.exe (Crawler.com)
O4 - HKLM..\Run: [Recipe Hub Search Scope Monitor] C:\Program Files\RecipeHub_2j\bar\1.bin\2jSrchMn.exe (MindSpark)
O4 - HKLM..\Run: [RecipeHub_2j Browser Plugin Loader] C:\Program Files\RecipeHub_2j\bar\1.bin\2jbrmon.exe (VER_COMPANY_NAME)
O4 - HKLM..\Run: [SearchProtectAll] C:\Program Files\SearchProtect\bin\cltmng.exe (Conduit)
O4 - HKLM..\Run: [Sendori Tray] C:\Program Files\Sendori\SendoriTray.exe (Sendori, Inc.)
O4 - HKLM..\Run: [TotalRecipeSearch Search Scope Monitor] C:\Program Files\TotalRecipeSearch_14\bar\1.bin\14SrchMn.exe (MindSpark)
O4 - HKLM..\Run: [TotalRecipeSearch_14 Browser Plugin Loader] C:\Program Files\TotalRecipeSearch_14\bar\1.bin\14brmon.exe (VER_COMPANY_NAME)
O4 - HKCU..\Run: [BrowserSafeguard] C:\Program Files\Browsersafeguard\BrowserSafeguard.exe (BrowserSafeguard)
O4 - HKCU..\Run: [ConduitFloatingPlugin_dijhkeelgcfckackbgkkdaamdhaiplod] C:\Program Files\Conduit\CT3303797\plugins\TBVerifier.dll (Conduit Ltd.)
O4 - HKCU..\Run: [ConduitFloatingPlugin_klibnahbojhkanfgaglnlalfkgpcppfi] C:\Program Files\Conduit\CT3289847\plugins\TBVerifier.dll (Conduit Ltd.)
O4 - HKCU..\Run: [ConduitFloatingPlugin_nemfjadlboooiffmcelkafilagddogim] C:\Program Files\Conduit\CT3289663\plugins\TBVerifier.dll (Conduit Ltd.)
O4 - HKCU..\Run: [Optimizer Pro] C:\Program Files\Optimizer Pro\OptProLauncher.exe (PC Utilities Pro)
O4 - HKCU..\Run: [PC Health Kit] C:\Program Files\PC Health Kit\PCHKLauncher.exe (PC Health Labs)
O4 - HKCU..\Run: [SearchProtect] C:\Users\William Randle\AppData\Roaming\SearchProtect\bin\cltmng.exe (Conduit)
O4 - HKCU..\Run: [WebCake Desktop] C:\Users\William Randle\AppData\Roaming\Tepfel\WebCakeDesktop.exe (Bake Cake)
O4 - Startup: C:\Users\William Randle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk = C:\Program Files\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: verbosestatus = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispCPL = 0
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked; Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked; Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\Sendori.dll (Sendori)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\Sendori.dll (Sendori)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\Sendori.dll (Sendori)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\Sendori.dll (Sendori)
O10 - Protocol_Catalog9\Catalog_Entries\000000000031 - C:\Windows\System32\Sendori.dll (Sendori)
O13 - gopher Prefix: missing
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.theregistrycollection.com/flash…me/qtplugin.cab (QuickTime Object)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{21B3A31A-50FA-4CC9-BBA7-9C15D38C29C8}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2B448C2B-154C-49A6-8F10-10C1ED996781}: DhcpNameServer = 75.75.75.75 75.75.76.76
O18 - Protocol\Handler\crawler {4545C96B-15D0-4E22-8DDE-6F2CAF531281} - C:\Program Files\Crawler Toolbar\Crawler.dll (Crawler.com, LLC)
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O20 - AppInit_DLLs: (c:\progra~1\optimi~1\optpro~1.dll) - c:\Program Files\Optimizer Pro\OptProCrash.dll ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2001/07/28 07:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O33 - MountPoints2\{bac4ef7e-33fb-11e2-85db-0015f249dea1}\Shell - "" = AutoRun
O33 - MountPoints2\{bac4ef7e-33fb-11e2-85db-0015f249dea1}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/08/10 16:33:34 | 000,000,000 | —D | C] – C:\Users\William Randle\Desktop\Antivirus
[2013/08/10 16:32:46 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\William Randle\Desktop\HiJackThis.exe
[2013/08/10 16:30:52 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\William Randle\Desktop\OTL.exe
[2013/08/10 15:59:28 | 000,325,920 | —- | C] (Sendori) – C:\Windows\System32\Sendori.dll
[2013/08/10 15:59:24 | 000,000,000 | —D | C] – C:\ProgramData\Sendori
[2013/08/10 15:59:17 | 000,000,000 | —D | C] – C:\Program Files\Sendori
[2013/08/10 15:58:58 | 000,000,000 | —D | C] – C:\Users\William Randle\AppData\Roaming\24x7 Help
[2013/08/10 15:58:52 | 000,000,000 | —D | C] – C:\Program Files\24x7Help
[2013/08/10 15:58:52 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\24x7 Help
[2013/08/10 15:58:51 | 000,000,000 | —D | C] – C:\Users\William Randle\AppData\Roaming\PCFixSpeed
[2013/08/10 15:58:50 | 000,000,000 | —D | C] – C:\ProgramData\PCFixSpeed
[2013/08/10 15:58:50 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Fix Speed
[2013/08/10 15:58:49 | 000,000,000 | —D | C] – C:\Program Files\PCFixSpeed
[2013/08/10 15:58:16 | 000,000,000 | —D | C] – C:\Users\William Randle\AppData\Local\getsavin
[2013/08/10 15:55:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BrowserSafeguard
[2013/08/10 15:55:56 | 000,000,000 | —D | C] – C:\Program Files\Browsersafeguard
[2013/08/10 15:55:02 | 000,000,000 | —D | C] – C:\Program Files\WhiteSmoke_New
[2013/08/10 15:54:44 | 000,000,000 | —D | C] – C:\Users\William Randle\AppData\Local\SwvUpdater
[2013/08/10 15:51:56 | 000,000,000 | —D | C] – C:\Users\William Randle\AppData\Roaming\Optimizer Pro
[2013/08/10 15:47:11 | 000,000,000 | —D | C] – C:\Users\William Randle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Video Downloader
[2013/08/10 15:47:05 | 000,000,000 | —D | C] – C:\Program Files\vGrabber-software
[2013/08/10 15:46:48 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro
[2013/08/10 15:46:45 | 000,000,000 | —D | C] – C:\Program Files\Optimizer Pro
[2013/08/10 15:46:24 | 000,000,000 | —D | C] – C:\Users\William Randle\AppData\Roaming\Tepfel
[2013/08/10 15:46:24 | 000,000,000 | —D | C] – C:\Program Files\Tepfel
[2013/08/10 15:45:46 | 000,000,000 | —D | C] – C:\Program Files\Vgrabber_v1.9
[2013/08/10 15:45:03 | 000,000,000 | —D | C] – C:\Users\William Randle\AppData\Local\Programs
[2013/08/08 12:51:00 | 000,000,000 | —D | C] – C:\ProgramData\TEMP
[2013/08/08 12:51:00 | 000,000,000 | —D | C] – C:\Users\William Randle\AppData\Roaming\PC Health Kit
[2013/08/08 12:50:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Health Kit
[2013/08/08 12:50:56 | 000,000,000 | —D | C] – C:\Program Files\PC Health Kit
[2013/08/08 12:50:26 | 000,000,000 | —D | C] – C:\Program Files\LyricsParty
[2013/08/08 12:50:07 | 000,000,000 | —D | C] – C:\Program Files\File Type Helper
[2013/08/08 12:50:05 | 000,000,000 | —D | C] – C:\Program Files\Fast Free Converter
[2013/08/06 19:33:17 | 000,000,000 | —D | C] – C:\Windows\Sun
[2013/08/06 19:06:03 | 000,000,000 | —D | C] – C:\Users\William Randle\AppData\Roaming\Cartwheel
[2013/08/06 19:06:01 | 000,000,000 | —D | C] – C:\Users\William Randle\AppData\Roaming\Cartwheel Qwiklinx Combo Installer
[2013/08/06 19:05:49 | 000,000,000 | —D | C] – C:\Users\William Randle\AppData\Local\getsav-in
[2013/08/06 19:05:41 | 000,000,000 | —D | C] – C:\Users\William Randle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
[2013/08/06 19:05:40 | 000,000,000 | —D | C] – C:\Program Files\MyPC Backup
[2013/08/06 19:04:12 | 000,770,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msvcr100.dll
[2013/08/06 19:04:12 | 000,421,200 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msvcp100.dll
[2013/08/06 19:04:12 | 000,000,000 | —D | C] – C:\Program Files\SearchProtect
[2013/08/06 19:04:11 | 000,000,000 | —D | C] – C:\Users\William Randle\AppData\Roaming\SearchProtect
[2013/08/06 19:04:03 | 000,000,000 | —D | C] – C:\Program Files\InternetHelper3.1
[2013/08/06 19:04:03 | 000,000,000 | —D | C] – C:\Users\William Randle\AppData\Local\Conduit
[2013/08/06 19:03:50 | 000,000,000 | —D | C] – C:\Users\William Randle\AppData\Local\CRE
[2013/08/06 19:03:49 | 000,000,000 | —D | C] – C:\Program Files\Conduit
[2013/07/25 22:04:39 | 000,000,000 | —D | C] – C:\Windows\Minidump
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/08/10 16:33:32 | 000,625,664 | —- | M] () – C:\Users\William Randle\Desktop\dds.scr
[2013/08/10 16:32:50 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\William Randle\Desktop\HiJackThis.exe
[2013/08/10 16:31:02 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\William Randle\Desktop\OTL.exe
[2013/08/10 16:29:40 | 000,013,440 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/08/10 16:29:40 | 000,013,440 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/08/10 16:02:17 | 000,000,902 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/08/10 15:58:52 | 000,000,984 | —- | M] () – C:\Users\Public\Desktop\24x7 Help.lnk
[2013/08/10 15:58:50 | 000,000,937 | —- | M] () – C:\Users\Public\Desktop\Optimize Your PC.lnk
[2013/08/10 15:58:43 | 000,000,000 | —- | M] () – C:\END
[2013/08/10 15:58:17 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/08/10 15:54:44 | 000,000,392 | —- | M] () – C:\Windows\tasks\AmiUpdXp.job
[2013/08/10 15:50:22 | 000,000,944 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3423064485-3066240515-1033730325-1002UA.job
[2013/08/10 15:47:13 | 000,098,003 | —- | M] () – C:\Windows\unins000.dat
[2013/08/10 15:47:11 | 000,001,949 | —- | M] () – C:\Users\William Randle\Desktop\Video Downloader.lnk
[2013/08/10 15:46:48 | 000,001,024 | —- | M] () – C:\Users\William Randle\Desktop\Optimizer Pro.lnk
[2013/08/10 15:45:03 | 001,169,609 | —- | M] () – C:\Windows\unins000.exe
[2013/08/10 15:39:40 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/08/10 14:41:00 | 000,000,296 | —- | M] () – C:\Windows\tasks\RGames Updater.job
[2013/08/10 12:40:07 | 000,000,378 | —- | M] () – C:\Windows\tasks\LyricsParty Update.job
[2013/08/09 17:12:13 | 000,000,296 | —- | M] () – C:\Windows\tasks\TuneUp360 Reminder.job
[2013/08/09 17:11:04 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/08/09 17:10:16 | 1961,795,584 | -HS- | M] () – C:\hiberfil.sys
[2013/08/08 16:57:04 | 000,000,892 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3423064485-3066240515-1033730325-1002Core.job
[2013/08/08 16:51:10 | 000,002,418 | —- | M] () – C:\Users\William Randle\Desktop\Google Chrome.lnk
[2013/08/08 12:50:01 | 000,692,104 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2013/08/08 12:50:01 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013/08/06 19:05:55 | 000,000,000 | —- | M] () – C:\extensions.sqlite
[2013/08/06 19:05:42 | 000,001,059 | —- | M] () – C:\Users\William Randle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
[2013/08/05 15:27:19 | 000,012,984 | —- | M] () – C:\Windows\System32\drivers\SWDUMon.sys
[2013/07/25 22:04:28 | 298,725,608 | —- | M] () – C:\Windows\MEMORY.DMP
[2013/07/22 15:12:28 | 000,325,920 | —- | M] (Sendori) – C:\Windows\System32\Sendori.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/08/10 16:33:21 | 000,625,664 | —- | C] () – C:\Users\William Randle\Desktop\dds.scr
[2013/08/10 15:58:52 | 000,000,984 | —- | C] () – C:\Users\Public\Desktop\24x7 Help.lnk
[2013/08/10 15:58:50 | 000,000,937 | —- | C] () – C:\Users\Public\Desktop\Optimize Your PC.lnk
[2013/08/10 15:54:44 | 000,000,392 | —- | C] () – C:\Windows\tasks\AmiUpdXp.job
[2013/08/10 15:47:12 | 001,169,609 | —- | C] () – C:\Windows\unins000.exe
[2013/08/10 15:47:12 | 000,098,003 | —- | C] () – C:\Windows\unins000.dat
[2013/08/10 15:47:11 | 000,001,949 | —- | C] () – C:\Users\William Randle\Desktop\Video Downloader.lnk
[2013/08/10 15:46:48 | 000,001,024 | —- | C] () – C:\Users\William Randle\Desktop\Optimizer Pro.lnk
[2013/08/10 15:45:25 | 000,000,000 | —- | C] () – C:\END
[2013/08/08 12:50:26 | 000,000,378 | —- | C] () – C:\Windows\tasks\LyricsParty Update.job
[2013/08/06 19:05:55 | 000,000,000 | —- | C] () – C:\extensions.sqlite
[2013/08/06 19:05:42 | 000,001,059 | —- | C] () – C:\Users\William Randle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
[2013/07/25 22:04:28 | 298,725,608 | —- | C] () – C:\Windows\MEMORY.DMP
[2013/01/10 13:19:32 | 000,088,688 | —- | C] () – C:\Windows\System32\cpwmon2k.dll
[2012/08/07 22:06:40 | 000,116,224 | —- | C] () – C:\Windows\System32\pdfcmnnt.dll
[2012/08/07 22:05:22 | 000,000,258 | RHS- | C] () – C:\Users\William Randle\ntuser.pol
[2012/02/22 20:26:31 | 000,012,984 | —- | C] () – C:\Windows\System32\drivers\SWDUMon.sys
[2012/01/23 14:28:52 | 000,068,141 | —- | C] () – C:\Users\William Randle\AppData\Roaming\userenv.xml.urlencode
[2012/01/23 14:28:51 | 000,051,192 | —- | C] () – C:\Users\William Randle\AppData\Roaming\userenv.xml
[2011/05/07 12:59:07 | 000,008,832 | -HS- | C] () – C:\Users\William Randle\AppData\Local\jh1h385xqn850t40818n0jdim3v81qmg51o56y
[2011/05/07 12:59:07 | 000,008,832 | -HS- | C] () – C:\ProgramData\jh1h385xqn850t40818n0jdim3v81qmg51o56y

========== ZeroAccess Check ==========

[2009/07/13 21:42:31 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2013/02/26 21:55:05 | 012,872,704 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 05:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2009/07/13 18:16:17 | 000,342,528 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2013/08/10 15:58:58 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\24x7 Help
[2012/08/07 22:07:06 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\Babylon
[2013/08/06 19:06:05 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\Cartwheel
[2013/08/06 19:08:10 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\Cartwheel Qwiklinx Combo Installer
[2012/08/07 22:09:51 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\DefaultTab
[2012/01/23 12:21:44 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\DriverCure
[2012/08/08 11:52:08 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\EurekaLog
[2012/08/08 11:47:45 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\Expert PDF 7
[2012/08/07 22:10:01 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\Genieo
[2011/06/29 13:37:20 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\Leadertech
[2013/01/25 10:39:24 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\OnlineVault
[2013/08/10 15:51:56 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\Optimizer Pro
[2011/10/08 15:21:17 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\PC Cleaner
[2013/08/08 12:51:00 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\PC Health Kit
[2013/08/10 15:59:01 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\PCFixSpeed
[2012/10/15 13:33:47 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\QuickScan
[2011/10/08 15:21:17 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\RegistryKeys
[2012/01/23 17:29:32 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\Sammsoft
[2013/08/08 12:49:56 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\SearchProtect
[2012/11/21 15:06:26 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\Sierra Wireless
[2012/08/07 22:39:50 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\Smart PC Cleaner
[2012/01/23 12:21:44 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\SpeedMaxPc
[2012/01/23 14:28:55 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\spotmau
[2013/01/14 12:02:11 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\TeamViewer
[2013/08/10 15:46:52 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\Tepfel
[2012/08/07 22:06:18 | 000,000,000 | —D | M] – C:\Users\William Randle\AppData\Roaming\WeatherBug

========== Purity Check ==========



========== Custom Scans ==========

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.ADML >
[2009/07/13 19:07:10 | 000,003,695 | —- | M] () MD5=7A4C7F3CB156543113596988479CAFCE – C:\Windows\winsxs\x86_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_en-us_22d6d5b5cba907ce\Explorer.adml

< MD5 for: EXPLORER.ADMX >
[2009/06/10 14:34:46 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\winsxs\x86_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.1.7600.16385_none_1590ffd752297581\Explorer.admx

< MD5 for: EXPLORER.BMP >
[2000/11/21 18:10:14 | 000,043,062 | —- | M] () MD5=1D521FF507E2E05969A9E3B396ABD3A8 – C:\Windows.old\Program Files\PowerArchiver\EXPLORER.BMP

< MD5 for: EXPLORER.EX_ >
[2004/08/04 05:00:00 | 000,359,533 | —- | M] () MD5=4F061B12F3D5457315A0314954E7EF46 – C:\Windows.old\Windows\I386\EXPLORER.EX_

< MD5 for: EXPLORER.EXE >
[2011/02/25 22:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2008/04/13 17:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\Windows.old\Windows\ERDNT\cache\explorer.exe
[2008/04/13 17:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\Windows.old\Windows\explorer.exe
[2008/04/13 17:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\Windows.old\Windows\ServicePackFiles\i386\explorer.exe
[2008/04/13 17:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\Windows.old\Windows\system32\dllcache\explorer.exe
[2009/07/13 18:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011/02/25 22:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009/10/30 22:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011/02/25 22:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010/11/20 05:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2007/06/13 04:26:03 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 – C:\Windows.old\Windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2011/02/24 22:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\explorer.exe
[2011/02/24 22:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2007/06/13 03:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 – C:\Windows.old\Windows\$NtServicePackUninstall$\explorer.exe
[2009/08/02 22:49:47 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2004/08/04 05:00:00 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\Windows.old\Windows\$NtUninstallKB938828$\explorer.exe
[2009/08/02 22:35:50 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009/10/30 23:00:51 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

< MD5 for: EXPLORER.EXE.MUI >
[2009/07/13 19:06:56 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\en-US\explorer.exe.mui
[2009/07/13 19:06:56 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\winsxs\x86_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_05c8dd40d4f56065\explorer.exe.mui

< MD5 for: EXPLORER.EXE-02121B1A.PF >
[2011/04/29 11:46:30 | 000,069,730 | —- | M] () MD5=D0E52887341FAD7249268A62E52CB9A4 – C:\Windows.old\Windows\Prefetch\EXPLORER.EXE-02121B1A.pf

< MD5 for: EXPLORER.SC_ >
[2004/08/04 05:00:00 | 000,000,181 | —- | M] () MD5=BC5B38879C56DFBC05C8B5C43AC4D739 – C:\Windows.old\Windows\I386\EXPLORER.SC_

< MD5 for: EXPLORER.SCF >
[2004/08/04 05:00:00 | 000,000,080 | —- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 – C:\Windows.old\Windows\explorer.scf

< MD5 for: IEXPLORE.CH_ >
[2004/08/04 05:00:00 | 000,199,077 | —- | M] () MD5=5F64795662F162CCD8B30969B6682029 – C:\Windows.old\Windows\I386\IEXPLORE.CH_

< MD5 for: IEXPLORE.CHM >
[2009/02/21 01:21:24 | 000,529,818 | —- | M] () MD5=1435F4731719DF5F57D17DC38196245D – C:\Windows.old\Windows\Help\iexplore.chm
[2004/08/04 05:00:00 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\Windows.old\Windows\ie7\iexplore.chm
[2006/09/01 08:43:50 | 000,503,758 | —- | M] () MD5=652E46500C149D1DC948BF9CEA8C4933 – C:\Windows.old\Windows\ie8\iexplore.chm

< MD5 for: IEXPLORE.EX_ >
[2004/08/04 05:00:00 | 000,037,895 | —- | M] () MD5=F83009589844F0C30801CC2221F06AB9 – C:\Windows.old\Windows\I386\IEXPLORE.EX_

< MD5 for: IEXPLORE.EXE >
[2012/05/17 16:21:54 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=0129BB16161C2FD9A6B19111AB047198 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16446_none_b12560b1c817cfde\iexplore.exe
[2008/12/18 22:25:25 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=030D78FE84A086ED376EFCBD2D72C522 – C:\Windows.old\Windows\ie7updates\KB963027-IE7\iexplore.exe
[2008/10/14 23:34:58 | 000,633,632 | —- | M] (Microsoft Corporation) MD5=056C927CF7207857E8B34F7A8FFD9B9E – C:\Windows.old\Windows\$hf_mig$\KB958215-IE7\SP2QFE\iexplore.exe
[2009/04/24 22:27:50 | 000,636,088 | —- | M] (Microsoft Corporation) MD5=092A7F2B49A19ECCE5369D3CB2276148 – C:\Windows.old\Windows\ie8\iexplore.exe
[2008/12/18 22:25:30 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=15E8A89499741D5CF59A9CF6463A4339 – C:\Windows.old\Windows\$hf_mig$\KB961260-IE7\SP2QFE\iexplore.exe
[2008/04/22 01:02:46 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=197B7E4030CFBD8D2979D375E1787AA2 – C:\Windows.old\Windows\$hf_mig$\KB950759-IE7\SP2QFE\iexplore.exe
[2008/04/22 01:02:46 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=197B7E4030CFBD8D2979D375E1787AA2 – C:\Windows.old\Windows\SoftwareDistribution\Download\b3bf74f55136e7636e609c29522f7318\SP2QFE\iexplore.exe
[2008/08/22 22:56:15 | 000,635,848 | —- | M] (Microsoft Corporation) MD5=1F03216084447F990AE797317D0A6E70 – C:\Windows.old\Windows\ie7updates\KB958215-IE7\iexplore.exe
[2012/08/24 00:34:41 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=22CC6CDBA678790046693654C3B212E4 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16450_none_b1148f09c82553c5\iexplore.exe
[2008/04/22 00:40:18 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=232B22817B90AE0AFF2D189E3E3735AC – C:\Windows.old\Windows\ie7updates\KB953838-IE7\iexplore.exe
[2008/04/22 00:40:18 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=232B22817B90AE0AFF2D189E3E3735AC – C:\Windows.old\Windows\SoftwareDistribution\Download\b3bf74f55136e7636e609c29522f7318\SP2GDR\iexplore.exe
[2012/05/17 15:59:46 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=268982F1FD671A077C6A2AF41E351436 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20551_none_b19f2c1ee1420ce6\iexplore.exe
[2012/10/08 01:37:24 | 000,748,704 | —- | M] (Microsoft Corporation) MD5=270A1342BD5AF95CA25A586B4C2F1522 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16455_none_b119907bc820d278\iexplore.exe
[2013/06/11 21:41:27 | 000,770,648 | —- | M] (Microsoft Corporation) MD5=2A5F565327BFD679EC5F790DC15BBF25 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20742_none_a38ffdc27f91d847\iexplore.exe
[2009/07/13 18:17:29 | 000,673,048 | —- | M] (Microsoft Corporation) MD5=2C32E3E596CFE660353753EABEFB0540 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_b346f9b4861b55c2\iexplore.exe
[2013/06/11 17:23:57 | 000,770,648 | —- | M] (Microsoft Corporation) MD5=30E7CA4620500FE012EB464F0E1DE91E – C:\Program Files\Internet Explorer\iexplore.exe
[2013/06/11 17:23:57 | 000,770,648 | —- | M] (Microsoft Corporation) MD5=30E7CA4620500FE012EB464F0E1DE91E – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16635_none_ba672fa865e3902d\iexplore.exe
[2013/02/21 21:10:00 | 000,757,376 | —- | M] (Microsoft Corporation) MD5=32732CEDE2A1106B736EF3D84054EE04 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16476_none_b104f0edc83023b1\iexplore.exe
[2012/06/02 02:08:27 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=34B01BBD8F00B6B9C9248DC4F1E3CD01 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16447_none_b12660fbc816e935\iexplore.exe
[2013/04/04 15:47:49 | 000,757,360 | —- | M] (Microsoft Corporation) MD5=3F00BE80B9CEA20B7FE7363D15EDDB94 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16483_none_b0f72023c83af39d\iexplore.exe
[2013/02/21 21:10:31 | 000,757,360 | —- | M] (Microsoft Corporation) MD5=4145E2B5663F6FACC08EFDB17B658BB2 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20586_none_b183bdcce155df6c\iexplore.exe
[2008/04/13 17:12:22 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\Windows.old\Windows\ServicePackFiles\i386\iexplore.exe
[2012/08/24 00:49:25 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=62188720CE27B982B4285C03163C9FB3 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20557_none_b1a52ddae13ca4f0\iexplore.exe
[2008/06/23 02:20:52 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=64E376A47763DAEABCDA14BD5B6EA286 – C:\Windows.old\Windows\ie7updates\KB956390-IE7\iexplore.exe
[2011/04/22 12:29:16 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=64EFAF916C4009F1B84153D0BB491FB0 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16800_none_b398812085dee94a\iexplore.exe
[2013/05/16 16:34:33 | 000,757,400 | —- | M] (Microsoft Corporation) MD5=67EE46FD4D3B56531C5DD1BDC149275A – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16490_none_b0e94f59c845c389\iexplore.exe
[2013/01/08 15:42:06 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=698EB1E5F8C66344D97C00B5699E871D – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16464_none_b10dc045c829d512\iexplore.exe
[2011/06/20 22:25:30 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=6BB506124872ACDFAC5BD912CA1334CE – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20992_none_b3c2cf339f43b73b\iexplore.exe
[2011/08/18 09:01:58 | 000,748,336 | —- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16421_none_b135ff17c80c1949\iexplore.exe
[2012/06/28 18:00:47 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=93569D46D79F9756ED077156496AFE23 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16448_none_b1276145c816028c\iexplore.exe
[2008/10/15 00:06:26 | 000,633,632 | —- | M] (Microsoft Corporation) MD5=9D3DB9ADFABD2F0BC778EC03250A3ABB – C:\Windows.old\Windows\ie7updates\KB961260-IE7\iexplore.exe
[2009/02/27 21:54:41 | 000,636,072 | —- | M] (Microsoft Corporation) MD5=A251068640DDB69FD7805B57D89D7FF7 – C:\Windows.old\Windows\ie7updates\KB969897-IE7\iexplore.exe
[2013/02/01 21:19:03 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=A285E1965C115031DA02B777EE9D7689 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20580_none_b17dbc10e15b4762\iexplore.exe
[2011/06/20 22:37:00 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=A3AB0A260049BE22AB52E302D9220A92 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16839_none_b38113f685ef212c\iexplore.exe
[2013/05/16 15:27:11 | 000,757,400 | —- | M] (Microsoft Corporation) MD5=A8732CEDB2C0EE7AFC08F867A47BB3EC – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20600_none_b1d43d56e11a6501\iexplore.exe
[2011/02/23 22:45:11 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=AB2BB40A5FE49AD236791AC22BD08869 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20908_none_b42a203b9ef553cc\iexplore.exe
[2012/11/16 09:33:24 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=B201AF83DF2E85323E29EB83E4046810 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16457_none_b11b910fc81f0526\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | -HS- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Windows.old\Program Files\Internet Explorer\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Windows.old\Windows\ERDNT\cache\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Windows.old\Windows\system32\dllcache\iexplore.exe
[2009/02/27 21:54:44 | 000,636,088 | —- | M] (Microsoft Corporation) MD5=BCD8E48709BE4A79606F0B6E8E9A6162 – C:\Windows.old\Windows\$hf_mig$\KB963027-IE7\SP3QFE\iexplore.exe
[2012/06/02 01:51:58 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=BE967C74B89577B78FB57C061E12B04C – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20553_none_b1a12cb2e1403f94\iexplore.exe
[2013/04/04 14:55:02 | 000,757,360 | —- | M] (Microsoft Corporation) MD5=C036AB1ED8BAC04FE4A349BA263077BB – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20593_none_b175ed02e160af58\iexplore.exe
[2009/04/24 22:27:39 | 000,636,088 | —- | M] (Microsoft Corporation) MD5=C0503FD8D163652735C1EE900672A75C – C:\Windows.old\Windows\$hf_mig$\KB969897-IE7\SP3QFE\iexplore.exe
[2012/11/15 20:08:47 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=C0BA71C1B3FB6E3DD432FF3CCAEBDC62 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20565_none_b1985d5ae1468e33\iexplore.exe
[2008/06/23 01:23:52 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=C52A9EF571E91535EB78DB4B8B95EA07 – C:\Windows.old\Windows\$hf_mig$\KB953838-IE7\SP2QFE\iexplore.exe
[2010/11/20 05:22:51 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=C613E69C3B191BB02C7A191741A1D024 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_b5780d7c8309d95c\iexplore.exe
[2011/02/23 22:32:52 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=C6697A46554E36541E81182B258A19D6 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16766_none_b35da16e860a2bd3\iexplore.exe
[2012/10/08 01:22:05 | 000,748,704 | —- | M] (Microsoft Corporation) MD5=CECB15F834FC2B4B150449717ADE18DD – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20562_none_b1955c7ce149422e\iexplore.exe
[2013/06/18 03:05:26 | 000,770,648 | —- | M] (Microsoft Corporation) MD5=CEE28BCBC3251595396EE7FDA2B5F3CF – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16618_none_ba64eabc65e5aa62\iexplore.exe
[2013/02/01 21:19:04 | 000,757,296 | —- | M] (Microsoft Corporation) MD5=DDE5A0DFAF7C6370FB36402D7A746ED3 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16470_none_b0feef31c8358ba7\iexplore.exe
[2007/08/13 18:43:56 | 000,622,080 | —- | M] (Microsoft Corporation) MD5=DE49B348A18369B4626FBA1D49B07FB4 – C:\Windows.old\Windows\ie7updates\KB950759-IE7\iexplore.exe
[2004/08/04 05:00:00 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=E7484514C0464642BE7B4DC2689354C8 – C:\Windows.old\Windows\ie7\iexplore.exe
[2008/08/22 22:56:16 | 000,635,848 | —- | M] (Microsoft Corporation) MD5=E8305C30D35E85D6657ED3E9934CB302 – C:\Windows.old\Windows\$hf_mig$\KB956390-IE7\SP2QFE\iexplore.exe
[2012/06/28 16:35:27 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=EB4105348272018D096FEB655CD1608C – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20554_none_b1a22cfce13f58eb\iexplore.exe
[2013/01/08 14:32:42 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=F05982E56ABD835AA8DF260EEC873E5B – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20573_none_b18b8cdae1507776\iexplore.exe
[2011/04/22 12:11:29 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=F94877A94996B3C12BB31AD722840457 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20949_none_b3ffe0d59f14dce7\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2011/08/18 09:01:58 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Windows\winsxs\x86_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_en-us_aae2948effb95a30\iexplore.exe.mui
[2013/06/18 03:05:26 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=8EDDC50FD07326E7DF9C4EEA422F0918 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2013/06/18 03:05:26 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=8EDDC50FD07326E7DF9C4EEA422F0918 – C:\Windows\winsxs\x86_microsoft-windows-i..-optional.resources_31bf3856ad364e35_10.2.9200.16521_en-us_b41defe19d893548\iexplore.exe.mui
[2009/03/08 14:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Windows.old\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 14:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Windows.old\Program Files\Internet Explorer\iexplore.exe.mui
[2007/08/13 18:43:36 | 000,573,440 | —- | M] (Microsoft Corporation) MD5=B58D8A1C7EE0E922EC7D2616DA136FC3 – C:\Windows.old\Windows\ie8\iexplore.exe.mui
[2009/07/13 19:05:06 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Windows\winsxs\x86_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7600.16385_en-us_acf38f2bbdc896a9\iexplore.exe.mui
[2009/07/13 19:05:06 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Windows\winsxs\x86_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_af24a2f3bab71a43\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-2D97EBE6.PF >
[2011/04/27 22:09:22 | 000,101,048 | —- | M] () MD5=E14ACE3D229704CC0B35BBCE76481F5F – C:\Windows.old\Windows\Prefetch\IEXPLORE.EXE-2D97EBE6.pf

< MD5 for: IEXPLORE.EXE-908C99F8.PF >
[2013/08/10 16:25:49 | 000,285,638 | —- | M] () MD5=798EC24ED1979AB2D7B3928319E0D650 – C:\Windows\Prefetch\IEXPLORE.EXE-908C99F8.pf

< MD5 for: IEXPLORE.HL_ >
[2004/08/04 05:00:00 | 000,059,881 | —- | M] () MD5=D23388C8D5D82D4D1C3B0B6A256E3CB7 – C:\Windows.old\Windows\I386\IEXPLORE.HL_

< MD5 for: IEXPLORE.HLP >
[2004/08/04 05:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\Windows.old\Windows\Help\iexplore.hlp

< MD5 for: SERVICES >
[2004/08/04 12:00:00 | 000,007,116 | —- | M] () MD5=95826940E657FE0567A8EC0F2A6AD11A – C:\Windows.old\Windows\system32\drivers\etc\services
[2009/06/10 14:39:37 | 000,017,463 | —- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 – C:\Windows\System32\drivers\etc\services
[2009/06/10 14:39:37 | 000,017,463 | —- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 – C:\Windows\winsxs\x86_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_045b589158ae90da\services

< MD5 for: SERVICES._ >
[2004/08/04 05:00:00 | 000,001,989 | —- | M] () MD5=29BB3BBBE3D49156A42BFB3DD000F554 – C:\Windows.old\Windows\I386\SERVICES._

< MD5 for: SERVICES.EX_ >
[2004/08/04 05:00:00 | 000,049,955 | —- | M] () MD5=85A738BA493104ED103B26CADEB8B543 – C:\Windows.old\Windows\I386\SERVICES.EX_

< MD5 for: SERVICES.EXE >
[2009/02/06 04:06:24 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 – C:\Windows.old\Windows\$hf_mig$\KB956572\SP3QFE\services.exe
[2008/04/13 17:12:34 | 000,108,544 | —- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 – C:\Windows.old\Windows\$NtUninstallKB956572$\services.exe
[2008/04/13 17:12:34 | 000,108,544 | —- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 – C:\Windows.old\Windows\ServicePackFiles\i386\services.exe
[2009/07/13 18:14:36 | 000,259,072 | —- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 – C:\Windows\System32\services.exe
[2009/07/13 18:14:36 | 000,259,072 | —- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe
[2009/02/06 04:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\Windows.old\Windows\ERDNT\cache\services.exe
[2009/02/06 04:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\Windows.old\Windows\system32\dllcache\services.exe
[2009/02/06 04:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\Windows.old\Windows\system32\services.exe
[2004/08/04 05:00:00 | 000,108,032 | —- | M] (Microsoft Corporation) MD5=C6CE6EEC82F187615D1002BB3BB50ED4 – C:\Windows.old\Windows\$NtServicePackUninstall$\services.exe

< MD5 for: SERVICES.EXE.20090513-010055-00.HDMP >
[2009/05/12 18:01:11 | 004,507,885 | —- | M] () MD5=889AA1A861C6165C6CF212D2F85CFFE1 – C:\Windows.old\Windows\pchealth\ERRORREP\UserDumps\services.exe.20090513-010055-00.hdmp

< MD5 for: SERVICES.EXE.20090513-010055-00.MDMP >
[2009/05/12 18:00:58 | 000,072,688 | —- | M] () MD5=B3E92ED1FEC5ADB625B47F1D66DF66CC – C:\Windows.old\Windows\pchealth\ERRORREP\UserDumps\services.exe.20090513-010055-00.mdmp

< MD5 for: SERVICES.EXE.MUI >
[2009/07/13 19:03:06 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=0DA5F221169DEB5AC3A22465CD6F0281 – C:\Windows\System32\en-US\services.exe.mui
[2009/07/13 19:03:06 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=0DA5F221169DEB5AC3A22465CD6F0281 – C:\Windows\winsxs\x86_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.1.7600.16385_en-us_69d39d3a8748c332\services.exe.mui

< MD5 for: SERVICES.LNK >
[2009/07/13 21:41:45 | 000,001,288 | —- | M] () MD5=021B1B178776500E54560EDCFFE0EE21 – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009/07/13 21:41:45 | 000,001,288 | —- | M] () MD5=021B1B178776500E54560EDCFFE0EE21 – C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009/04/11 01:49:38 | 000,001,610 | —- | M] () MD5=2193F11DEA4B258908BFF241315E4E4F – C:\Users\William Randle\Documents\Windows.old - Copy\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk
[2009/04/11 01:49:38 | 000,001,610 | —- | M] () MD5=2193F11DEA4B258908BFF241315E4E4F – C:\Users\William Randle\Documents\Windows.old\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk
[2009/04/11 01:49:38 | 000,001,610 | —- | M] () MD5=2193F11DEA4B258908BFF241315E4E4F – C:\Windows.old\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk

< MD5 for: SERVICES.MOF >
[2009/06/10 14:26:14 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\System32\wbem\services.mof
[2009/06/10 14:26:14 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.mof

< MD5 for: SERVICES.MS_ >
[2004/08/04 05:00:00 | 000,003,649 | —- | M] () MD5=64E9F61D2ED093C361862DE36433B5E1 – C:\Windows.old\Windows\I386\SERVICES.MS_

< MD5 for: SERVICES.MSC >
[2009/07/13 19:08:50 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\System32\en-US\services.msc
[2009/06/10 14:21:09 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\System32\services.msc
[2009/07/13 19:08:50 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a4156d265db25d25\services.msc
[2009/06/10 14:21:09 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_cf3a38c7a70e7a54\services.msc
[2004/08/04 05:00:00 | 000,033,464 | —- | M] () MD5=E8089AA2A6F7FEE89B38C1F2D77BA6C6 – C:\Windows.old\Windows\system32\services.msc

< MD5 for: SERVICES.PTXML >
[2009/07/13 13:20:01 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\System32\wdi\perftrack\Services.ptxml
[2009/07/13 13:20:01 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\Services.ptxml

< MD5 for: SERVICES.RDB >
[2006/06/22 20:28:24 | 004,521,984 | —- | M] () MD5=7ED89C21C6BF40EC2EFAA9E090CF916C – C:\Windows.old\Program Files\OpenOffice.org 2.0\program\services.rdb

< MD5 for: SERVICES.SBS >
[2006/10/10 13:26:34 | 000,014,374 | —- | M] () MD5=2162FB29D7DBA388B933C9178300A9C2 – C:\Windows.old\Program Files\Spybot - Search & Destroy\Includes\Services.sbs

< MD5 for: WINLOGON.ADML >
[2009/07/13 19:05:00 | 000,008,013 | —- | M] () MD5=CED0EAD8D152B3D0F114698DE2316C5E – C:\Windows\winsxs\x86_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_94da67ab3e358f3a\WinLogon.adml

< MD5 for: WINLOGON.ADMX >
[2009/06/10 14:43:18 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\winsxs\x86_microsoft-windows-winlogon-adm_31bf3856ad364e35_6.1.7600.16385_none_7ae3b2e5da95d117\WinLogon.admx

< MD5 for: WINLOGON.EX_ >
[2004/08/04 05:00:00 | 000,261,115 | —- | M] () MD5=F41C4F5745589D0BB8268C02B71594CA – C:\Windows.old\Windows\I386\WINLOGON.EX_

< MD5 for: WINLOGON.EXE >
[2004/08/04 05:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\Windows.old\Windows\$NtServicePackUninstall$\winlogon.exe
[2009/10/27 23:17:59 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009/10/27 22:52:08 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010/11/20 05:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\System32\winlogon.exe
[2010/11/20 05:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009/07/13 18:14:45 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
[2008/04/13 17:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\Windows.old\Windows\ERDNT\cache\winlogon.exe
[2008/04/13 17:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\Windows.old\Windows\ServicePackFiles\i386\winlogon.exe
[2008/04/13 17:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\Windows.old\Windows\system32\dllcache\winlogon.exe
[2008/04/13 17:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\Windows.old\Windows\system32\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2010/11/20 05:12:53 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=65C2C2EE8F334EE07F66876551DE1827 – C:\Windows\System32\en-US\winlogon.exe.mui
[2010/11/20 05:12:53 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=65C2C2EE8F334EE07F66876551DE1827 – C:\Windows\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7601.17514_en-us_ccfffb7662588b45\winlogon.exe.mui
[2009/07/13 19:05:28 | 000,022,528 | —- | M] (Microsoft Corporation) MD5=DB61D28A59DEE68F77811B291D83AD1B – C:\Windows\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7600.16385_en-us_cacee7ae656a07ab\winlogon.exe.mui

< MD5 for: WINLOGON.EXE-B020DC41.PF >
[2013/08/09 17:12:00 | 000,018,022 | —- | M] () MD5=22E4E57BB69D2584FB55215337E9F910 – C:\Windows\Prefetch\WINLOGON.EXE-B020DC41.pf

< MD5 for: WINLOGON.MFL >
[2009/07/13 19:09:40 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\System32\wbem\en-US\winlogon.mfl
[2009/07/13 19:09:40 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\winsxs\x86_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2891397980a26140\winlogon.mfl

< MD5 for: WINLOGON.MOF >
[2009/07/13 13:37:34 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\System32\wbem\winlogon.mof
[2009/07/13 13:37:34 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\winsxs\x86_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.1.7600.16385_none_800f1ff3d73b72d9\winlogon.mof

< MD5 for: WINLOGON.REG >
[2001/10/23 13:49:08 | 000,000,278 | —- | M] () MD5=329635F24C2EB6E4B850598AC7CC7AA4 – C:\hp\bin\winlogon.reg

< %SYSTEMDRIVE%\*.* >
[2009/06/10 14:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2011/04/29 12:20:43 | 000,000,295 | RHS- | M] () – C:\boot.ini
[2011/04/29 13:14:10 | 000,000,425 | RHS- | M] () – C:\Boot.ini.saved
[2010/11/20 05:40:07 | 000,383,786 | RHS- | M] () – C:\bootmgr
[2010/09/29 15:54:32 | 000,001,316 | —- | M] () – C:\CD3rdPartyWrapper.log
[2010/09/29 16:55:58 | 000,045,568 | —- | M] (Atribune.org) – C:\cleaner.exe
[2004/08/04 05:00:00 | 000,260,272 | RHS- | M] () – C:\cmldr
[2010/09/29 16:16:27 | 000,023,236 | —- | M] () – C:\ComboFix.txt
[2009/06/10 14:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2009/06/16 11:56:03 | 000,210,328 | —- | M] () – C:\coreuninstall.log
[2010/09/29 15:54:20 | 000,063,046 | —- | M] () – C:\CybDefInstallInfo.log
[2009/01/15 18:22:38 | 000,000,020 | —- | M] () – C:\dirref.ini
[2013/08/10 15:58:43 | 000,000,000 | —- | M] () – C:\END
[2013/08/06 19:05:55 | 000,000,000 | —- | M] () – C:\extensions.sqlite
[2013/08/09 17:10:16 | 1961,795,584 | -HS- | M] () – C:\hiberfil.sys
[2008/09/12 13:51:15 | 000,000,164 | —- | M] () – C:\install.dat
[2005/06/24 22:32:00 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/04/11 11:20:08 | 024,440,427 | —- | M] () – C:\lma_log.html
[2009/04/11 02:08:14 | 000,034,940 | —- | M] () – C:\log.html
[2005/06/24 22:32:00 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2007/05/25 15:49:01 | 000,000,988 | —- | M] () – C:\net_save.dna
[2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2009/04/11 05:28:09 | 000,250,048 | RHS- | M] () – C:\ntldr
[2013/08/09 17:10:17 | 3922,722,816 | -HS- | M] () – C:\pagefile.sys
[2006/10/05 04:32:11 | 000,386,158 | —- | M] () – C:\testlog.html
[2013/05/16 12:02:02 | 000,095,092 | —- | M] () – C:\updater.exe
[2012/08/07 22:07:15 | 000,000,304 | —- | M] () – C:\user.js

< %systemroot%\Fonts\*.com >
[2009/07/13 21:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 21:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 21:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 21:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 14:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/13 18:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2010/11/20 05:21:36 | 000,030,208 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 21:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< dir "%systemdrive%\*" /S /A:L /C >
Volume in drive C has no label.
Volume Serial Number is 4C10-C8E1
Directory of C:\
07/13/2009 09:53 PM Documents and Settings [C:\Users]
0 File(s) 0 bytes
Directory of C:\ProgramData
07/13/2009 09:53 PM Application Data [C:\ProgramData]
07/13/2009 09:53 PM Desktop [C:\Users\Public\Desktop]
07/13/2009 09:53 PM Documents [C:\Users\Public\Documents]
07/13/2009 09:53 PM Favorites [C:\Users\Public\Favorites]
07/13/2009 09:53 PM Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
07/13/2009 09:53 PM Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users
07/13/2009 09:53 PM All Users [C:\ProgramData]
07/13/2009 09:53 PM Default User [C:\Users\Default]
0 File(s) 0 bytes
Directory of C:\Users\All Users
07/13/2009 09:53 PM Application Data [C:\ProgramData]
07/13/2009 09:53 PM Desktop [C:\Users\Public\Desktop]
07/13/2009 09:53 PM Documents [C:\Users\Public\Documents]
07/13/2009 09:53 PM Favorites [C:\Users\Public\Favorites]
07/13/2009 09:53 PM Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
07/13/2009 09:53 PM Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Default
07/13/2009 09:53 PM Application Data [C:\Users\Default\AppData\Roaming]
07/13/2009 09:53 PM Cookies [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies]
07/13/2009 09:53 PM Local Settings [C:\Users\Default\AppData\Local]
07/13/2009 09:53 PM My Documents [C:\Users\Default\Documents]
07/13/2009 09:53 PM NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
07/13/2009 09:53 PM PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
07/13/2009 09:53 PM Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]
07/13/2009 09:53 PM SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]
07/13/2009 09:53 PM Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]
07/13/2009 09:53 PM Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Default\AppData\Local
07/13/2009 09:53 PM Application Data [C:\Users\Default\AppData\Local]
07/13/2009 09:53 PM History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]
07/13/2009 09:53 PM Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Default\Documents
07/13/2009 09:53 PM My Music [C:\Users\Default\Music]
07/13/2009 09:53 PM My Pictures [C:\Users\Default\Pictures]
07/13/2009 09:53 PM My Videos [C:\Users\Default\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Microsoft
05/07/2011 01:59 PM Application Data [C:\Users\Microsoft\AppData\Roaming]
05/07/2011 01:59 PM Cookies [C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Cookies]
05/07/2011 01:59 PM Local Settings [C:\Users\Microsoft\AppData\Local]
05/07/2011 01:59 PM My Documents [C:\Users\Microsoft\Documents]
05/07/2011 01:59 PM NetHood [C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
05/07/2011 01:59 PM PrintHood [C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
05/07/2011 01:59 PM Recent [C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Recent]
05/07/2011 01:59 PM SendTo [C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\SendTo]
05/07/2011 01:59 PM Start Menu [C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Start Menu]
05/07/2011 01:59 PM Templates [C:\Users\Microsoft\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Microsoft\AppData\Local
05/07/2011 01:59 PM Application Data [C:\Users\Microsoft\AppData\Local]
05/07/2011 01:59 PM History [C:\Users\Microsoft\AppData\Local\Microsoft\Windows\History]
05/07/2011 01:59 PM Temporary Internet Files [C:\Users\Microsoft\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Microsoft\Documents
05/07/2011 01:59 PM My Music [C:\Users\Microsoft\Music]
05/07/2011 01:59 PM My Pictures [C:\Users\Microsoft\Pictures]
05/07/2011 01:59 PM My Videos [C:\Users\Microsoft\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Public\Documents
07/13/2009 09:53 PM My Music [C:\Users\Public\Music]
07/13/2009 09:53 PM My Pictures [C:\Users\Public\Pictures]
07/13/2009 09:53 PM My Videos [C:\Users\Public\Videos]
0 File(s) 0 bytes
Directory of C:\Users\William Randle
04/29/2011 12:53 PM Application Data [C:\Users\William Randle\AppData\Roaming]
04/29/2011 12:53 PM Cookies [C:\Users\William Randle\AppData\Roaming\Microsoft\Windows\Cookies]
04/29/2011 12:53 PM Local Settings [C:\Users\William Randle\AppData\Local]
04/29/2011 12:53 PM My Documents [C:\Users\William Randle\Documents]
04/29/2011 12:53 PM NetHood [C:\Users\William Randle\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
04/29/2011 12:53 PM PrintHood [C:\Users\William Randle\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
04/29/2011 12:53 PM Recent [C:\Users\William Randle\AppData\Roaming\Microsoft\Windows\Recent]
04/29/2011 12:53 PM SendTo [C:\Users\William Randle\AppData\Roaming\Microsoft\Windows\SendTo]
04/29/2011 12:53 PM Start Menu [C:\Users\William Randle\AppData\Roaming\Microsoft\Windows\Start Menu]
04/29/2011 12:53 PM Templates [C:\Users\William Randle\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\William Randle\AppData\Local
04/29/2011 12:53 PM Application Data [C:\Users\William Randle\AppData\Local]
04/29/2011 12:53 PM History [C:\Users\William Randle\AppData\Local\Microsoft\Windows\History]
04/29/2011 12:53 PM Temporary Internet Files [C:\Users\William Randle\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\William Randle\Documents
04/29/2011 12:53 PM My Music [C:\Users\William Randle\Music]
04/29/2011 12:53 PM My Pictures [C:\Users\William Randle\Pictures]
04/29/2011 12:53 PM My Videos [C:\Users\William Randle\Videos]
0 File(s) 0 bytes
Directory of C:\Windows.old\Windows\assembly\GAC_32\System.EnterpriseServices
08/12/2010 12:06 PM 2.0.0.0__b03f5f7f11d50a3a [C:\Windows.old\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790]
0 File(s) 0 bytes
Directory of C:\Windows.old\Windows\assembly\GAC_MSIL\IEExecRemote
08/12/2010 12:06 PM 2.0.0.0__b03f5f7f11d50a3a [C:\Windows.old\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e]
0 File(s) 0 bytes
Total Files Listed:
0 File(s) 0 bytes
68 Dir(s) 40,006,721,536 bytes free

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/08/18 09:16:11 | 000,000,221 | -HS- | M] () – C:\Users\William Randle\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2013/08/10 16:32:50 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\William Randle\Desktop\HiJackThis.exe
[2013/08/10 16:31:02 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\William Randle\Desktop\OTL.exe
[2013/02/26 11:54:50 | 002,301,952 | —- | M] () – C:\Users\William Randle\Desktop\RentalValuatorPremium2007-2010.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2013-08-10 00:16:58

========== Alternate Data Streams ==========

@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:D346F792

< End of report >

OTL Extras logfile created on: 8/10/2013 4:35:40 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\William Randle\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16635)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.44 Gb Total Physical Memory | 1.17 Gb Available Physical Memory | 48.15% Memory free
6.09 Gb Paging File | 4.41 Gb Available in Paging File | 72.51% Paging File free
Paging file location(s): c:\pagefile.sys 3741 5000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 142.08 Gb Total Space | 35.52 Gb Free Space | 25.00% Space Free | Partition Type: NTFS
Drive D: | 6.96 Gb Total Space | 0.01 Gb Free Space | 0.17% Space Free | Partition Type: FAT32
Unable to calculate disk information.

Computer Name: WILLIAMRANDLE | User Name: William Randle | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – C:\Program Files\File Type Helper\FileTypeHelper.exe "%1" (Microsoft)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{113CB133-E63D-4EB1-92AA-281CF3BC8433}" = rport=138 | protocol=17 | dir=out | app=system |
"{24429168-7E29-4CE0-A265-424195877D92}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{24F19BD8-C82C-49A5-8EEC-566FD6B8C725}" = lport=10243 | protocol=6 | dir=in | app=system |
"{28E4448A-EE88-4B0B-8292-31FB9EF945E1}" = lport=137 | protocol=17 | dir=in | app=system |
"{38DF4AFF-7A63-4DF2-9289-92B93D0CDF37}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{43FEF5F5-DA88-4C8B-A279-DFBBEA839A5B}" = lport=139 | protocol=6 | dir=in | app=system |
"{524174A5-A7B4-427C-A9E5-C5DE3B0BFEBD}" = rport=139 | protocol=6 | dir=out | app=system |
"{5D3157FB-6793-49DA-B9D3-B39FEF87C01F}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6562B1E4-9324-4DD4-9A55-AE62003057FB}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{78C416C3-DE88-47FF-AE6C-5F59BF2547BE}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{7A06CC8D-1ED2-4AB2-AD71-42EE7CADEFF2}" = lport=445 | protocol=6 | dir=in | app=system |
"{91469AC5-439A-4305-91DB-E9325C45D26E}" = lport=138 | protocol=17 | dir=in | app=system |
"{97B29C0E-7E6D-4292-8A69-289A9DFD7F2D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A4C1D4AD-C83A-4B02-AEE4-A3C5A3C2F23F}" = rport=445 | protocol=6 | dir=out | app=system |
"{ACCF737D-4A43-42C4-9EDC-8033E0224A7B}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B560E0DC-AD65-4E35-8AE3-7105C13FC88A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B8AF58DC-49FE-4BB5-9FFC-352AC993B81C}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C8140F87-2655-4759-92AD-0B61E7CD794B}" = rport=10243 | protocol=6 | dir=out | app=system |
"{CD32D688-42AA-4336-BADC-B3641E3CEC95}" = rport=137 | protocol=17 | dir=out | app=system |
"{D0971531-42DE-4F1B-878A-8ABAC49A7171}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D88C3F8B-AED9-4E37-B945-42033E829080}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E246E542-AE10-41B2-B038-DB99E7060BB0}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe |
"{ED809DD7-0F38-4930-A3DA-1B51A8AE322D}" = lport=2869 | protocol=6 | dir=in | app=system |
"{FDB0F084-05C0-4472-899C-CE5B5E8B4A0F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{077F788A-8EB1-4758-8789-5CE2E1E1E5A7}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{08C4C5B6-5CFB-4C28-9CD9-BAA3A6BC8804}" = protocol=6 | dir=out | app=c:\program files\rosetta stone\rosetta stone version 3\support\bin\win\rosettastoneltdservices.exe |
"{0DC74F46-5EA9-4B46-B010-34B1A8479AD9}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1E9866C6-469B-442E-AF6C-5888B64641F6}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{1F971B02-466A-4F4D-B991-78252F7DB04B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{252EADA1-0A5E-40ED-9557-F9EC84699BDC}" = protocol=17 | dir=in | app=c:\users\william randle\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{2A710FDA-B1C2-4B96-9E5D-AE7DDAE8B659}" = protocol=6 | dir=out | app=system |
"{35E23B4D-63BF-44B7-AC2E-9CDD1A3E86D1}" = protocol=6 | dir=in | app=c:\users\william randle\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{3868E171-E59B-40AC-AC27-5875A5B4FB62}" = protocol=17 | dir=in | app=c:\program files\bucksbee loyalty plugin - 100815\troubleshooter.exe |
"{4B2D3205-231C-4F56-A764-1048BB771B27}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{4DE13A89-40D8-438D-B9E7-A675148C7E6B}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{4E3FE19D-8932-4CFC-BBC2-68F1A3DE2AF1}" = dir=in | app=c:\program files\rosetta stone\rosetta stone version 3\rosettastoneversion3.exe |
"{580EEF20-1A4A-4C1F-9F59-A4E4D49F0BFD}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{5A9AB70B-AD81-4D15-AE9E-62FDED4AC3AA}" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\hpnetworkcommunicator.exe |
"{83CE6B1C-D275-4BC8-90E5-81A2DD3A4DE9}" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\devicesetup.exe |
"{85DAD00D-06AB-42D8-A18C-EB51212CB6BE}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8941361D-1148-4FEB-B72F-C4B67D2C4114}" = protocol=6 | dir=in | app=c:\program files\bucksbee loyalty plugin - 100815\troubleshooter.exe |
"{8BA232BC-13AD-4A05-B2F2-CCBB2711BA0F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A532C216-7B2B-426E-A84E-B33BA93F3984}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{AC6D7419-5566-4B92-A7F8-1E19B7696CE4}" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\devicesetup.exe |
"{B05FC477-D44E-458A-A1C4-22006CCF5CD3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C19E1BD3-0A4B-436C-8628-8E7CBC780E65}" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\hpnetworkcommunicator.exe |
"{C3BFD503-8137-49A3-8A78-17F00BEB0941}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C583616F-70FF-4209-B19D-8097F3149EAA}" = protocol=6 | dir=out | app=c:\program files\rosetta stone\rosetta stone version 3\rosettastoneversion3.exe |
"{C62407D7-9723-4732-9B51-76A5D9F13AD6}" = dir=in | app=c:\program files\rosetta stone\rosetta stone version 3\support\bin\win\rosettastoneltdservices.exe |
"{CF84ADC4-1C1A-4BFA-9B15-780C088D804C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{D147B3A7-B2BE-457D-B2AD-84942F84083B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D94172FD-B938-44E7-9BDB-1C6F12DCCB82}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{ED8634BA-DE0A-4C35-935B-218A10FAC1C7}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{EEA3FAEF-43F2-4A34-B6D4-A701B6815795}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{302A7207-2B37-4E08-8001-BEC809CB62E1}C:\windows\system32\wfs.exe" = protocol=6 | dir=in | app=c:\windows\system32\wfs.exe |
"TCP Query User{A6EEAA4C-0612-4833-A4CD-D84D1B401A25}C:\windows\system32\wfs.exe" = protocol=6 | dir=in | app=c:\windows\system32\wfs.exe |
"TCP Query User{C9033728-9687-48D5-8F1A-100547FFA547}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{E44BE036-F452-4C9B-97E7-0749C85EEE46}C:\program files\hp\hp officejet pro 8500 a910\bin\hpnetworkcommunicator.exe" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\hpnetworkcommunicator.exe |
"TCP Query User{F37C04C5-084D-47B2-9FBC-F714261A5B8E}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{01309AAF-F49C-43FA-A447-6453F8BBD757}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{3F5B2E83-6F05-4AE3-A4A4-EB8A0398FF77}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{B505CA3E-EEBC-43B0-9A83-E4D92CBCDD8A}C:\windows\system32\wfs.exe" = protocol=17 | dir=in | app=c:\windows\system32\wfs.exe |
"UDP Query User{C12C9444-F6F5-424D-9CD2-59EAC25F589B}C:\windows\system32\wfs.exe" = protocol=17 | dir=in | app=c:\windows\system32\wfs.exe |
"UDP Query User{CC9C0B53-3C16-43DC-ACFD-98160BFA01C5}C:\program files\hp\hp officejet pro 8500 a910\bin\hpnetworkcommunicator.exe" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\hpnetworkcommunicator.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}_is1" = SiteRanker
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{2110AF8F-F6E9-4712-A185-1B839C60822E}" = Rosetta Stone Ltd Services
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java™ 7 Update 5
"{297DCADA-86A1-4A42-8A13-66B7D7A09FD2}" = WeatherBug
"{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}" = McAfee SiteAdvisor
"{3AE5A1B4-D6AE-48D4-A07F-46A806CD53E6}" = HP Officejet Pro 8500 A910 Basic Device Software
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E7E8E6A-15F1-4E26-9352-26AD235131E9}" = Documents To Go
"{5600094C-5EA0-4BE8-9ECE-4C9B726AC9D9}" = Sierra Wireless USB MUX Driver Package
"{63E29D1A-D6B5-4295-BFAC-967606232411}_is1" = Cartwheel Shopping
"{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}_is1" = AppGraffiti
"{871B2A9D-0F12-44B3-88C1-E0CB10A232E4}" = HP Officejet Pro 8500 A910 Help
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0015-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.SingleImage_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-0000-0000000FF1CE}_Office14.SingleImage_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{95140000-007F-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{99011A6E-5200-11DE-BDB8-7ACD56D89593}" = Rosetta Stone Version 3
"{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}" = Software Version Updater
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A957F04C-49F4-4375-8C8A-D04B769EFE47}_is1" = 24x7 Help
"{B2BF6842-FFC6-4183-A294-2F08DC70A7E5}" = Microsoft Store Download Manager
"{B820C985-D9F1-45B5-A7F5-0C5863CBEA04}_is1" = Privacy SafeGuard version 1.1
"{C1F2EF4E-CDAA-9B4C-A934-911D4B0D12KC}_is1" = TuneUp360 (Version 7.0.0)
"{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}" = Web-Cake 3.00
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{F13E61C0-917B-4AAD-96CD-7A5860E25A73}_is1" = Crawler Toolbar
"{F7B34B38-02A6-44D5-B8CC-06EB3B8ACFC9}_is1" = PC Fix Speed [removed]
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FC279721-37A6-4777-AFD8-7A56681EBA14}" = Expert PDF 7 Reader
"{FE60B87C-63A2-4A45-AC06-FFEFD5DB7846}_is1" = Online Vault
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ARO 2011_is1" = ARO 2011
"Browsersafeguard" = BrowserSafeguard
"Bucksbee Loyalty Plugin - 100815" = Bucksbee Loyalty Plugin - 100815
"BurnToDisk_is1" = BurnToDisk version 1.0
"CCleaner" = CCleaner
"CutePDF Writer Installation" = CutePDF Writer 3.0
"DefaultTab" = DefaultTab
"DefaultTab Chrome" = DefaultTab Chrome
"Fast Free Converter" = Fast Free Converter
"GetSavin" = GetSavin
"InternetHelper3.1 Toolbar" = InternetHelper3.1 Toolbar
"[removed]" = LyricsParty
"MapsGalaxy_39bar Uninstall" = MapsGalaxy Toolbar
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"MyPC Backup" = MyPC Backup
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"Optimizer Pro_is1" = Optimizer Pro v3.0
"PC Cleaner_is1" = PC Cleaner v3.0
"PC Health Kit_is1" = PC Health Kit v3.2
"RecipeHub_2jbar Uninstall" = Recipe Hub toolbar
"SearchProtect" = Search Protect by conduit
"Sendori" = Sendori
"Smart PC Cleaner_is1" = Smart PC Cleaner v3.0
"TotalRecipeSearch_14bar Uninstall" = TotalRecipeSearch Toolbar
"Vgrabber_v1.9 Toolbar" = Vgrabber v1.9 Toolbar
"Video Downloader" = Video Downloader
"Video Downloader_is1" = Video Downloader version 2.0
"WhiteSmoke_New Toolbar" = WhiteSmoke New Toolbar
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"genieo" = Genieo
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 8/8/2013 11:50:41 PM | Computer Name = WilliamRandle | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 10.0.9200.16635,
time stamp: 0x51b7a921 Faulting module name: getsav-in_1375841101.dll, version:
0.0.0.0, time stamp: 0x5201ab5d Exception code: 0xc0000005 Fault offset: 0x00001e8c
Faulting
process id: 0x1124 Faulting application start time: 0x01ce94b27516d726 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Users\William
Randle\AppData\Local\getsav-in\ie\getsav-in_1375841101.dll Report Id: dbb5f565-00a6-11e3-ad03-0015f249dea1

Error - 8/9/2013 1:03:43 AM | Computer Name = WilliamRandle | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 10.0.9200.16635,
time stamp: 0x51b7a921 Faulting module name: getsav-in_1375841101.dll, version:
0.0.0.0, time stamp: 0x5201ab5d Exception code: 0xc0000005 Fault offset: 0x00001e8c
Faulting
process id: 0xd7c Faulting application start time: 0x01ce94bd6f5eed19 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Users\William
Randle\AppData\Local\getsav-in\ie\getsav-in_1375841101.dll Report Id: 0f9ccd02-00b1-11e3-9349-0015f249dea1

Error - 8/9/2013 8:13:34 PM | Computer Name = WilliamRandle | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 10.0.9200.16635,
time stamp: 0x51b7a921 Faulting module name: getsav-in_1375841101.dll, version:
0.0.0.0, time stamp: 0x5201ab5d Exception code: 0xc0000005 Fault offset: 0x00001e8c
Faulting
process id: 0xa44 Faulting application start time: 0x01ce955e4d7c1779 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Users\William
Randle\AppData\Local\getsav-in\ie\getsav-in_1375841101.dll Report Id: b1583f2b-0151-11e3-b99b-0015f249dea1

Error - 8/9/2013 8:47:39 PM | Computer Name = WilliamRandle | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\onlinevault\OVShell64.dll".
Dependent
Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="ia64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 8/10/2013 5:42:36 PM | Computer Name = WilliamRandle | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 10.0.9200.16635,
time stamp: 0x51b7a921 Faulting module name: getsav-in_1375841101.dll, version:
0.0.0.0, time stamp: 0x5201ab5d Exception code: 0xc0000005 Fault offset: 0x00001e8c
Faulting
process id: 0x2e8 Faulting application start time: 0x01ce96127eae1389 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Users\William
Randle\AppData\Local\getsav-in\ie\getsav-in_1375841101.dll Report Id: c542a637-0205-11e3-b99b-0015f249dea1

Error - 8/10/2013 6:39:56 PM | Computer Name = WilliamRandle | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 10.0.9200.16635,
time stamp: 0x51b7a921 Faulting module name: getsav-in_1375841101.dll, version:
0.0.0.0, time stamp: 0x5201ab5d Exception code: 0xc0000005 Fault offset: 0x00001e8c
Faulting
process id: 0x163c Faulting application start time: 0x01ce961a7f5fd0e8 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Users\William
Randle\AppData\Local\getsav-in\ie\getsav-in_1375841101.dll Report Id: c7aa2f65-020d-11e3-b99b-0015f249dea1

Error - 8/10/2013 6:41:10 PM | Computer Name = WilliamRandle | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 10.0.9200.16635,
time stamp: 0x51b7a921 Faulting module name: getsav-in_1375841101.dll, version:
0.0.0.0, time stamp: 0x5201ab5d Exception code: 0xc0000005 Fault offset: 0x00001e8c
Faulting
process id: 0xe28 Faulting application start time: 0x01ce961a9c56ee90 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Users\William
Randle\AppData\Local\getsav-in\ie\getsav-in_1375841101.dll Report Id: f3a5f317-020d-11e3-b99b-0015f249dea1

Error - 8/10/2013 6:47:00 PM | Computer Name = WilliamRandle | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 10.0.9200.16635,
time stamp: 0x51b7a921 Faulting module name: getsav-in_1375841101.dll, version:
0.0.0.0, time stamp: 0x5201ab5d Exception code: 0xc0000005 Fault offset: 0x00001e8c
Faulting
process id: 0xea0 Faulting application start time: 0x01ce961af066bde9 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Users\William
Randle\AppData\Local\getsav-in\ie\getsav-in_1375841101.dll Report Id: c3f3fd75-020e-11e3-b99b-0015f249dea1

Error - 8/10/2013 6:51:49 PM | Computer Name = WilliamRandle | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 10.0.9200.16635 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 1920 Start
Time: 01ce961bca39456e Termination Time: 500 Application Path: C:\Program Files\Internet
Explorer\iexplore.exe Report Id:

Error - 8/10/2013 7:05:30 PM | Computer Name = WilliamRandle | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 10.0.9200.16635,
time stamp: 0x51b7a921 Faulting module name: getsavin_1376175007.dll, version: 0.0.0.0,
time stamp: 0x5206c3c2 Exception code: 0xc0000005 Fault offset: 0x00001e92 Faulting
process id: 0x19d8 Faulting application start time: 0x01ce961e0b8c8059 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Users\William
Randle\AppData\Local\getsavin\ie\getsavin_1376175007.dll Report Id: 59d8d1bd-0211-11e3-b99b-0015f249dea1

[ System Events ]
Error - 8/9/2013 12:05:15 AM | Computer Name = WilliamRandle | Source = DCOM | ID = 10016
Description =

Error - 8/9/2013 1:12:16 AM | Computer Name = WilliamRandle | Source = DCOM | ID = 10010
Description =

Error - 8/9/2013 8:11:06 PM | Computer Name = WilliamRandle | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Computer
Backup (MyPC Backup) service to connect.

Error - 8/9/2013 8:11:06 PM | Computer Name = WilliamRandle | Source = Service Control Manager | ID = 7000
Description = The Computer Backup (MyPC Backup) service failed to start due to the
following error: %%1053

Error - 8/9/2013 8:12:04 PM | Computer Name = WilliamRandle | Source = DCOM | ID = 10016
Description =

Error - 8/10/2013 2:10:57 PM | Computer Name = WilliamRandle | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the IPBusEnum service.

Error - 8/10/2013 6:54:44 PM | Computer Name = WilliamRandle | Source = Service Control Manager | ID = 7031
Description = The WebCakeUpdater service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 5000 milliseconds:
Restart the service.

Error - 8/10/2013 7:45:31 PM | Computer Name = WilliamRandle | Source = Service Control Manager | ID = 7034
Description = The TotalRecipeSearchService service terminated unexpectedly. It
has done this 1 time(s).

Error - 8/10/2013 7:45:44 PM | Computer Name = WilliamRandle | Source = Service Control Manager | ID = 7034
Description = The Recipe HubService service terminated unexpectedly. It has done
this 1 time(s).

Error - 8/10/2013 7:45:56 PM | Computer Name = WilliamRandle | Source = Service Control Manager | ID = 7034
Description = The MapsGalaxyService service terminated unexpectedly. It has done
this 1 time(s).


< End of report >

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:18:21 PM, on 8/11/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16635)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\TotalRecipeSearch_14\bar\1.bin\14SrchMn.exe
C:\Program Files\TotalRecipeSearch_14\bar\1.bin\14brmon.exe
C:\Program Files\RecipeHub_2j\bar\1.bin\2jbrmon.exe
C:\Program Files\MapsGalaxy_39\bar\1.bin\39brmon.exe
C:\Program Files\PCFixSpeed\PCFixTray.exe
C:\Program Files\24x7Help\App24x7Help.exe
C:\Program Files\Sendori\SendoriTray.exe
C:\Windows\System32\rundll32.exe
C:\Users\William Randle\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\System32\rundll32.exe
C:\Users\William Randle\AppData\Roaming\Tepfel\WebCakeDesktop.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\PC Health Kit\PCHKReminder.exe
C:\Program Files\Browsersafeguard\BrowserSafeguard.exe
C:\Program Files\MyPC Backup\MyPC Backup.exe
C:\Program Files\Optimizer Pro\OptProReminder.exe
C:\Program Files\24x7Help\App24x7Hook.exe
C:\Users\William Randle\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\William Randle\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\William Randle\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\William Randle\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\William Randle\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\William Randle\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\William Randle\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\William Randle\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\William Randle\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\William Randle\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\William Randle\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Users\William Randle\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\William Randle\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Users\William Randle\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\William Randle\Desktop\Antivirus\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.mywebsearch.com/index.jhtml?n=…DA-232658361BE0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:49162;https=127.0.0.1:49162
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <-loopback>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Crawler Toolbar - {9234F5E0-56CC-4F0B-AAE4-0D4BD5032180} - C:\PROGRA~1\CRAWLE~1\Crawler.dll
R3 - URLSearchHook: (no name) - {8a7d2060-824d-4b17-b00a-759b1b5f30d9} - C:\Program Files\TotalRecipeSearch_14\bar\1.bin\14SrcAs.dll
R3 - URLSearchHook: (no name) - {cc8ae5b8-005b-4b1a-a27d-307eddffe5c8} - C:\Program Files\RecipeHub_2j\bar\1.bin\2jSrcAs.dll
R3 - URLSearchHook: (no name) - {26842a09-ffa8-4e2c-ae12-0c80f01c3295} - C:\Program Files\MapsGalaxy_39\bar\1.bin\39SrcAs.dll
R3 - URLSearchHook: InternetHelper3.1 Toolbar - {07cbf788-1359-421b-a4e3-5a8d041b90a3} - C:\Program Files\InternetHelper3.1\prxtbInte.dll
R3 - URLSearchHook: Vgrabber v1.9 Toolbar - {0bc52218-c3c2-4a28-88f7-cdc0f27bc60d} - C:\Program Files\Vgrabber_v1.9\prxtbVgra.dll
R3 - URLSearchHook: WhiteSmoke New Toolbar - {739df940-c5ee-4bab-9d7e-270894ae687a} - C:\Program Files\WhiteSmoke_New\prxtbWhi0.dll
O2 - BHO: &Yahoo;! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Toolbar BHO - {06e3475c-5521-4de8-bb12-50720f21631c} - C:\PROGRA~1\RECIPE~2\bar\1.bin\2jbar.dll
O2 - BHO: InternetHelper3.1 - {07cbf788-1359-421b-a4e3-5a8d041b90a3} - C:\Program Files\InternetHelper3.1\prxtbInte.dll
O2 - BHO: Vgrabber v1.9 - {0bc52218-c3c2-4a28-88f7-cdc0f27bc60d} - C:\Program Files\Vgrabber_v1.9\prxtbVgra.dll
O2 - BHO: (no name) - {1036AD63-AEAC-460B-9060-C96005D4DC86} - (no file)
O2 - BHO: (no name) - {11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5} - C:\PROGRA~1\SITERA~1\SiteRank.dll
O2 - BHO: Toolbar BHO - {1e91a655-bb4b-4693-a05e-2edebc4c9d89} - C:\PROGRA~1\MAPSGA~2\bar\1.bin\39bar.dll
O2 - BHO: RivalGaming Games - {26D675AC-D925-4bbf-A720-62C2AA4A81EB} - C:\Users\William Randle\AppData\Local\RivalGaming\RivalGaming.dll
O2 - BHO: WebCake Layers - {2A5A2A90-3B30-4E6E-A955-2F232C6EF517} - C:\Program Files\Tepfel\WebCakeIEClient.dll
O2 - BHO: AppGraffiti - {6F6A5334-78E9-4D9B-8182-8B41EA8C39EF} - C:\PROGRA~1\APPGRA~1\APPGRA~1.DLL
O2 - BHO: Search Assistant BHO - {71c1d63a-c944-428a-a5bd-ba513190e5d2} - C:\Program Files\MapsGalaxy_39\bar\1.bin\39SrcAs.dll
O2 - BHO: WhiteSmoke New - {739df940-c5ee-4bab-9d7e-270894ae687a} - C:\Program Files\WhiteSmoke_New\prxtbWhi0.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: DefaultTabBHO - {7F6AFBF1-E065-4627-A2FD-810366367D01} - C:\Users\William Randle\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabBHO.dll
O2 - BHO: Crawler Toolbar - {9234F5E0-56CC-4F0B-AAE4-0D4BD5032180} - C:\PROGRA~1\CRAWLE~1\Crawler.dll
O2 - BHO: Privacy SafeGuard - {A42D2EB4-DD31-4BB5-8AA5-8D4E04806DBE} - C:\Program Files\PrivacySafeGuard\PrivacySafeGuard.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Toolbar BHO - {ab56dfde-0c14-45b3-9df6-7b0eba617870} - C:\PROGRA~1\TOTALR~2\bar\1.bin\14bar.dll
O2 - BHO: GetSavin 5.0 - {AC3CC5EA-AA7D-4A03-BFBE-B7D6DFE821C9} - C:\Users\William Randle\AppData\Local\getsavin\ie\getsavin_1376175007.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL
O2 - BHO: Cartwheel - {B50DF051-E1D4-439C-B94E-F4DE82B56542} - C:\Users\William Randle\AppData\Roaming\Cartwheel\Cartwheel.dll
O2 - BHO: Search Assistant BHO - {b7acdf9c-c4f9-4d5d-998e-b147866b4d4c} - C:\Program Files\RecipeHub_2j\bar\1.bin\2jSrcAs.dll
O2 - BHO: getsav-in 5.0 - {BC950AA0-979A-4EBE-9A10-6294F6457221} - C:\Users\William Randle\AppData\Local\getsav-in\ie\getsav-in_1375841101.dll
O2 - BHO: LyricsParty - {bd0d2596-eead-4b3f-a84e-7c0644366e45} - C:\Program Files\LyricsParty\126.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O2 - BHO: Search Assistant BHO - {df22384f-cf68-4d19-969f-10423715528b} - C:\Program Files\TotalRecipeSearch_14\bar\1.bin\14SrcAs.dll
O2 - BHO: FCTBPos00Pos - {E5C2A1FE-86DB-87B4-11F0-1AA2579E81DD} - C:\Program Files\Bucksbee Loyalty Plugin - 100815\BucksBee Loyalty Plugin.dll
O2 - BHO: Fast Free Converter 4.1 - {F5580E24-8416-4DFD-90B3-078D4EDF4FCB} - C:\PROGRA~1\FASTFR~1\FASTFR~1\FASTFR~1.DLL
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Crawler; Toolbar - {C4D78C72-08DB-4A3F-9175-B265157283F3} - C:\PROGRA~1\CRAWLE~1\Crawler.dll
O3 - Toolbar: TotalRecipeSearch - {a0154e07-2b48-475c-a82a-80efd84ea33e} - C:\Program Files\TotalRecipeSearch_14\bar\1.bin\14bar.dll
O3 - Toolbar: Recipe Hub - {cf51de5b-eb36-4114-bb69-84df63fbadb4} - C:\Program Files\RecipeHub_2j\bar\1.bin\2jbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: MapsGalaxy - {364ea597-e728-4ce4-bb4a-ed846ef47970} - C:\Program Files\MapsGalaxy_39\bar\1.bin\39bar.dll
O3 - Toolbar: InternetHelper3.1 Toolbar - {07cbf788-1359-421b-a4e3-5a8d041b90a3} - C:\Program Files\InternetHelper3.1\prxtbInte.dll
O3 - Toolbar: Vgrabber v1.9 Toolbar - {0bc52218-c3c2-4a28-88f7-cdc0f27bc60d} - C:\Program Files\Vgrabber_v1.9\prxtbVgra.dll
O3 - Toolbar: WhiteSmoke New Toolbar - {739df940-c5ee-4bab-9d7e-270894ae687a} - C:\Program Files\WhiteSmoke_New\prxtbWhi0.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TotalRecipeSearch Search Scope Monitor] "C:\PROGRA~1\TOTALR~2\bar\1.bin\14srchmn.exe" /m=2 /w /h
O4 - HKLM\..\Run: [TotalRecipeSearch_14 Browser Plugin Loader] C:\PROGRA~1\TOTALR~2\bar\1.bin\14brmon.exe
O4 - HKLM\..\Run: [Recipe Hub Search Scope Monitor] "C:\PROGRA~1\RECIPE~2\bar\1.bin\2jsrchmn.exe" /m=2 /w /h
O4 - HKLM\..\Run: [RecipeHub_2j Browser Plugin Loader] C:\PROGRA~1\RECIPE~2\bar\1.bin\2jbrmon.exe
O4 - HKLM\..\Run: [MapsGalaxy Search Scope Monitor] "C:\PROGRA~1\MAPSGA~2\bar\1.bin\39srchmn.exe" /m=2 /w /h
O4 - HKLM\..\Run: [MapsGalaxy_39 Browser Plugin Loader] C:\PROGRA~1\MAPSGA~2\bar\1.bin\39brmon.exe
O4 - HKLM\..\Run: [SearchProtectAll] C:\Program Files\SearchProtect\bin\cltmng.exe
O4 - HKLM\..\Run: [PCFixSpeed] "C:\Program Files\PCFixSpeed\PCFixTray.exe" /startup
O4 - HKLM\..\Run: [24x7HELP] "C:\Program Files\24x7Help\App24x7Help.exe" /STARTUP
O4 - HKLM\..\Run: [Sendori Tray] "C:\Program Files\Sendori\SendoriTray.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ConduitFloatingPlugin_nemfjadlboooiffmcelkafilagddogim] "C:\Windows\system32\Rundll32.exe" "C:\Program Files\Conduit\CT3289663\plugins\TBVerifier.dll",RunConduitFloatingPlugin nemfjadlboooiffmcelkafilagddogim
O4 - HKCU\..\Run: [SearchProtect] C:\Users\William Randle\AppData\Roaming\SearchProtect\bin\cltmng.exe
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_C775B383A3848C5FDA2D3D83B3E035CF] "C:\Users\William Randle\AppData\Local\Google\Chrome\Application\chrome.exe" –no-startup-window
O4 - HKCU\..\Run: [PC Health Kit] C:\Program Files\PC Health Kit\PCHKLauncher.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\William Randle\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ConduitFloatingPlugin_dijhkeelgcfckackbgkkdaamdhaiplod] "C:\Windows\system32\Rundll32.exe" "C:\Program Files\Conduit\CT3303797\plugins\TBVerifier.dll",RunConduitFloatingPlugin dijhkeelgcfckackbgkkdaamdhaiplod
O4 - HKCU\..\Run: [WebCake Desktop] "C:\Users\William Randle\AppData\Roaming\Tepfel\WebCakeDesktop.exe"
O4 - HKCU\..\Run: [Optimizer Pro] C:\Program Files\Optimizer Pro\OptProLauncher.exe
O4 - HKCU\..\Run: [ConduitFloatingPlugin_klibnahbojhkanfgaglnlalfkgpcppfi] "C:\Windows\system32\Rundll32.exe" "C:\Program Files\Conduit\CT3289847\plugins\TBVerifier.dll",RunConduitFloatingPlugin klibnahbojhkanfgaglnlalfkgpcppfi
O4 - HKCU\..\Run: [BrowserSafeguard] C:\Program Files\Browsersafeguard\Browsersafeguard.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Bomgar_Cleanup_ZD4657815684] cmd.exe /C rd /S /Q "C:\ProgramData\iyogi-scc-507C6FEA" & reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Bomgar_Cleanup_ZD4657815684 /f (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Bomgar_Cleanup_ZD4657815684] cmd.exe /C rd /S /Q "C:\ProgramData\iyogi-scc-507C6FEA" & reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Bomgar_Cleanup_ZD4657815684 /f (User 'Default user')
O4 - Startup: MyPC Backup.lnk = C:\Program Files\MyPC Backup\MyPC Backup.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked; Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked; Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\sendori.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\sendori.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\sendori.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\sendori.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\sendori.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.theregistrycollection.com/flash…me/qtplugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: crawler - {4545C96B-15D0-4E22-8DDE-6F2CAF531281} - C:\PROGRA~1\CRAWLE~1\Crawler.dll
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs: c:\progra~1\optimi~1\optpro~1.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (file missing)
O23 - Service: 24x7HelpService (24x7HelpSvc) - PCRx.com, LLC - C:\Program Files\24x7Help\App24x7Svc.exe
O23 - Service: Application Sendori - Sendori, Inc. - C:\Program Files\Sendori\SendoriSvc.exe
O23 - Service: Computer Backup (MyPC Backup) (BackupStack) - Just Develop It - C:\Program Files\MyPC Backup\BackupStack.exe
O23 - Service: Search Protect by Conduit Updater (CltMngSvc) - Conduit - C:\Program Files\SearchProtect\bin\CltMngSvc.exe
O23 - Service: FastFreeConverterUpdt - Unknown owner - C:\Program Files\Fast Free Converter\FastFreeConverterUpdt.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MapsGalaxyService (MapsGalaxy_39Service) - COMPANYVERS_NAME - C:\PROGRA~1\MAPSGA~2\bar\1.bin\39barsvc.exe
O23 - Service: Recipe HubService (RecipeHub_2jService) - COMPANYVERS_NAME - C:\PROGRA~1\RECIPE~2\bar\1.bin\2jbarsvc.exe
O23 - Service: Service Sendori - sendori - C:\Program Files\Sendori\Sendori.Service.exe
O23 - Service: sndappv2 - Sendori - C:\Program Files\Sendori\sndappv2.exe
O23 - Service: TotalRecipeSearchService (TotalRecipeSearch_14Service) - COMPANYVERS_NAME - C:\PROGRA~1\TOTALR~2\bar\1.bin\14barsvc.exe
O23 - Service: WebCakeUpdater - cake bake - C:\Program Files\Tepfel\WebCakeDesktop.Updater.exe

–
End of file - 16826 bytes