Malwarebytes found PUP [Solved]

Malwarebytes found PUP.Optional….. I didn't get the whole name.

OTL logfile created on: 8/11/2013 3:45:14 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Jack\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

8.00 Gb Total Physical Memory | 5.49 Gb Available Physical Memory | 68.61% Memory free
16.05 Gb Paging File | 13.57 Gb Available in Paging File | 84.58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 685.45 Gb Total Space | 392.17 Gb Free Space | 57.21% Space Free | Partition Type: NTFS
Drive D: | 13.18 Gb Total Space | 1.80 Gb Free Space | 13.63% Space Free | Partition Type: NTFS

Computer Name: JACK-PC | User Name: Jack | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Jack\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Users\Jack\AppData\Local\Programs\Google\MusicManager\MusicManager.exe (Google Inc.)
PRC - C:\Users\Jack\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\PDF Architect\ConversionService.exe (pdfforge GbR)
PRC - C:\Program Files (x86)\PDF Architect\HelperService.exe (pdfforge GbR)
PRC - C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Users\Jack\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
PRC - C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe ()
PRC - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe ()
PRC - C:\Program Files (x86)\Motorola Media Link\Lite\NServiceEntry.exe (Nero AG)
PRC - C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)
PRC - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Easy Backup\HPBtnSrv.exe ()
PRC - C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Mindjet\MindManager 7\MmReminderService.exe (Mindjet)
PRC - C:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Java\jre7\bin\jp2native.dll ()
MOD - C:\Users\Jack\AppData\Local\Programs\Google\MusicManager\libaudioenc.dll ()
MOD - C:\Users\Jack\AppData\Local\Programs\Google\MusicManager\libmpgdec.dll ()
MOD - C:\Users\Jack\AppData\Local\Programs\Google\MusicManager\libid3tag.dll ()
MOD - C:\Users\Jack\AppData\Local\Programs\Google\MusicManager\libaacdec.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Users\Jack\AppData\Roaming\Dropbox\bin\libcef.dll ()
MOD - C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\extensions\[removed]\platform\WINNT_x86-msvc\components\lpxpcom.dll ()
MOD - C:\Users\Jack\AppData\Local\Programs\Google\MusicManager\imageformats\qgif4.dll ()
MOD - C:\Users\Jack\AppData\Local\Programs\Google\MusicManager\QtWebKit4.dll ()
MOD - C:\Users\Jack\AppData\Local\Programs\Google\MusicManager\QtNetwork4.dll ()
MOD - C:\Users\Jack\AppData\Local\Programs\Google\MusicManager\QtGui4.dll ()
MOD - C:\Users\Jack\AppData\Local\Programs\Google\MusicManager\QtCore4.dll ()
MOD - C:\Users\Jack\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll ()
MOD - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll ()
MOD - C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll ()
MOD - C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll ()
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll ()
MOD - C:\Program Files (x86)\Mindjet\MindManager 7\zlib.dll ()


========== Services (SafeList) ==========

SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (PDF Architect Service) – C:\Program Files (x86)\PDF Architect\ConversionService.exe (pdfforge GbR)
SRV - (PDF Architect Helper Service) – C:\Program Files (x86)\PDF Architect\HelperService.exe (pdfforge GbR)
SRV - (AVGIDSAgent) – C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (MotoHelper) – C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe ()
SRV - (DeviceMonitorService) – C:\Program Files (x86)\Motorola Media Link\Lite\NServiceEntry.exe (Nero AG)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (NAUpdate) – C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (IAANTMON) – C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (HPBtnSrv) – C:\Program Files (x86)\Hewlett-Packard\HP Easy Backup\HPBtnSrv.exe ()
SRV - (AdobeActiveFileMonitor7.0) – C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)


========== Driver Services (SafeList) ==========

DRV:64bit: - (avgtp) – C:\Windows\SysNative\drivers\avgtpx64.sys (AVG Technologies)
DRV:64bit: - (Avgmfx64) – C:\Windows\SysNative\DRIVERS\avgmfx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (AVGIDSDriver) – C:\Windows\SysNative\DRIVERS\avgidsdrivera.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (AVGIDSHA) – C:\Windows\SysNative\DRIVERS\avgidsha.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (Avgldx64) – C:\Windows\SysNative\DRIVERS\avgldx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Avgtdia) – C:\Windows\SysNative\DRIVERS\avgtdia.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Avgloga) – C:\Windows\SysNative\DRIVERS\avgloga.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Avgrkx64) – C:\Windows\SysNative\DRIVERS\avgrkx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (motusbdevice) – C:\Windows\SysNative\DRIVERS\motusbdevice.sys (Motorola Inc)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\Drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (motccgp) – C:\Windows\SysNative\DRIVERS\motccgp.sys (Motorola)
DRV:64bit: - (motmodem) – C:\Windows\SysNative\DRIVERS\motmodem.sys (Motorola)
DRV:64bit: - (Motousbnet) – C:\Windows\SysNative\DRIVERS\Motousbnet.sys (Motorola)
DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation)
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\Drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (motccgpfl) – C:\Windows\SysNative\DRIVERS\motccgpfl.sys (Motorola)
DRV:64bit: - (BTCFilterService) – C:\Windows\SysNative\DRIVERS\motfilt.sys (Motorola Inc)
DRV:64bit: - (RTL8169) – C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek Corporation )
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iastor.sys (Intel Corporation)
DRV:64bit: - (athr) – C:\Windows\SysNative\DRIVERS\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (PCD5SRVC{8AAF211B-043E02A9-05040000}) – C:\Program Files\PC-Doctor for Windows\pcd5srvc_x64.pkms (PC-Doctor, Inc.)
DRV:64bit: - (MotoSwitchService) – C:\Windows\SysNative\DRIVERS\motswch.sys (Motorola)
DRV - ({55662437-DA8C-40c0-AADA-2C816A897A49}) – C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl (CyberLink Corp.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{9D5D0B21-D8A6-413C-BAD3-235D5C74DD3E}: "URL" = http://www.ask.com/web?q={searchterms}&l;=dis&o;=ushpd
IE:64bit: - HKLM\..\SearchScopes\{CFA351F7-F131-439E-98E7-1F52AD440B6C}: "URL" = http://search.live.com/results.aspx?q={sea…amp;FORM=HPDTDF
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = Reg Error: Value error.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = Reg Error: Value error.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{3338EA82-1724-430B-BB5E-06132283ED37}: "URL" = http://search.conduit.com/ResultsExt.aspx?…537128&UM;=2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;192.168.*.*

========== FireFox ==========

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type;=971163"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledAddons: %7B45d8ff86-d909-11db-9705-005056c00008%7D:1.1.0
FF - prefs.js..extensions.enabledAddons: %7B582195F5-92E7-40a0-A127-DB71295901D7%7D:0.6.4.1
FF - prefs.js..extensions.enabledAddons: %7BAE93811A-5C9A-4d34-8462-F7B864FC4696%7D:4.16
FF - prefs.js..extensions.enabledAddons: %7B20a82645-c095-46ed-80e3-08825760534b%7D:0.0.0
FF - prefs.js..extensions.enabledAddons: FFPDFArchitectConverter%40pdfarchitect.com:1.0
FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0033-ABCDEFFEDCBA%7D:6.0.33
FF - prefs.js..extensions.enabledAddons: support%40lastpass.com:2.0.20
FF - prefs.js..extensions.enabledAddons: foxmarks%40kei.com:4.2.1
FF - prefs.js..extensions.enabledAddons: %7B37fa1426-b82d-11db-8314-0800200c9a66%7D:3.3.3
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: {45d8ff86-d909-11db-9705-005056c00008}:1.0.5
FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.81
FF - prefs.js..extensions.enabledItems: {37fa1426-b82d-11db-8314-0800200c9a66}:2.7.7
FF - prefs.js..extensions.enabledItems: [removed]:3.9.9
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: avg@igeared:6.103.018.001
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1319
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Jack\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Jack\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\Jack\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013/03/24 14:18:42 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/04/20 11:07:36 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/04/20 11:07:36 | 000,000,000 | —D | M]

[2009/08/19 21:57:12 | 000,000,000 | —D | M] (No name found) – C:\Users\Jack\AppData\Roaming\Mozilla\Extensions
[2013/08/11 15:20:37 | 000,000,000 | —D | M] (No name found) – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\extensions
[2011/03/28 06:28:04 | 000,000,000 | —D | M] (Gmail Manager) – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\extensions\{582195F5-92E7-40a0-A127-DB71295901D7}
[2013/08/11 15:20:33 | 000,000,000 | —D | M] ("Xmarks") – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\extensions\[removed]
[2012/07/30 07:00:16 | 000,000,000 | —D | M] (LastPass) – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\extensions\support@lastpass(118).com
[2013/04/25 23:55:28 | 000,000,000 | —D | M] (LastPass) – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\extensions\[removed]
[2013/03/24 15:12:56 | 000,164,858 | —- | M] () (No name found) – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}.xpi
[2013/08/11 15:08:49 | 000,216,803 | —- | M] () (No name found) – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\extensions\{37fa1426-b82d-11db-8314-0800200c9a66}.xpi
[2011/09/17 15:50:12 | 000,060,243 | —- | M] () (No name found) – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\extensions\{45d8ff86-d909-11db-9705-005056c00008}.xpi
[2013/03/24 14:11:35 | 000,377,738 | —- | M] () (No name found) – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi
[2013/08/02 14:19:32 | 000,824,302 | —- | M] () (No name found) – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2009/08/21 10:19:30 | 000,002,172 | —- | M] () – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\searchplugins\bing.xml
[2009/08/22 13:04:09 | 000,000,939 | —- | M] () – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\searchplugins\dictionary.xml
[2009/08/21 01:41:43 | 000,001,512 | —- | M] () – C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\searchplugins\imdb.xml
[2013/04/12 09:22:45 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2013/04/12 09:22:45 | 000,000,000 | —D | M] (pdfforge Toolbar Plugin) – C:\Program Files (x86)\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}
[2013/04/12 09:22:45 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/05/13 00:22:19 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions\[removed]
[2013/08/11 15:25:09 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\updated\extensions
[2013/08/11 15:25:06 | 000,000,000 | —D | M] (Default) – C:\Program Files (x86)\Mozilla Firefox\updated\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/08/11 15:25:09 | 000,000,000 | —D | M] (pdfforge Toolbar Plugin) – C:\Program Files (x86)\Mozilla Firefox\updated\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}
[2013/08/11 15:25:09 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\updated\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/08/11 15:24:56 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\updated\extensions\[removed]
[2013/03/24 14:18:42 | 000,000,000 | —D | M] (PDF Architect Converter For Firefox) – C:\PROGRAM FILES (X86)\PDF ARCHITECT\FFPDFARCHITECTEXT
[2009/09/02 03:00:51 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2013/04/12 09:22:51 | 000,263,064 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2009/09/01 14:40:48 | 000,072,960 | —- | M] (Foxit Software Company) – C:\Program Files (x86)\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2012/09/10 07:00:39 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013/03/17 21:19:26 | 000,002,086 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Conduit (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}
CHR - default_search_provider: suggest_url =
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Jack\AppData\Local\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Jack\AppData\Local\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Jack\AppData\Local\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: AVG SiteSafety plugin (Enabled) = C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\\npsitesafety.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U21 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: BrowserPlus (from Yahoo!) v2.9.8 (Enabled) = C:\Users\Jack\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: LastPass = C:\Users\Jack\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd\2.0.24_0\
CHR - Extension: AVG Security Toolbar = C:\Users\Jack\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\14.2.0.1_0\

O1 HOSTS File: ([2006/09/18 17:37:24 | 000,000,761 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (CmjBrowserHelperObject Object) - {07A11D74-9D25-4fea-A833-8B0D76A5577A} - C:\Program Files (x86)\Mindjet\MindManager 7\Mm7InternetExplorer.dll (Mindjet)
O2 - BHO: (PDF Architect Helper) - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [NvMediaCenter] C:\Windows\SysNative\NvMcTray.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CLMLServer for HP TouchSmart] c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [DVDAgent] C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [KBD] C:\Program Files (x86)\Hewlett-Packard\KBD\KbdStub.exe (Microsoft)
O4 - HKLM..\Run: [MMReminderService] C:\Program Files (x86)\Mindjet\MindManager 7\MmReminderService.exe (Mindjet)
O4 - HKLM..\Run: [TSMAgent] c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] c:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDIRShortCut] c:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] c:\Program Files (x86)\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: [doubleTwist] C:\Program Files (x86)\doubleTwist 2.0\DoubleTwist.DeviceHelper.exe File not found
O4 - HKCU..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe File not found
O4 - HKCU..\Run: [MusicManager] C:\Users\Jack\AppData\Local\Programs\Google\MusicManager\MusicManager.exe (Google Inc.)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Jack\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O4 - HKCU..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED File not found
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe File not found
O4 - Startup: C:\Users\Jack\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Jack\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Jack\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O8:64bit: - Extra context menu item: Open with WordPerfect - c:\Program Files (x86)\Corel\WordPerfect Office X5\Programs\WPLauncher.hta File not found
O8 - Extra context menu item: Open with WordPerfect - c:\Program Files (x86)\Corel\WordPerfect Office X5\Programs\WPLauncher.hta File not found
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre7\bin\jp2iexp.dll ()
O9 - Extra Button: Send to Mindjet MindManager - {941E1A34-C6AF-4baa-A973-224F9C3E04BF} - C:\Program Files (x86)\Mindjet\MindManager 7\Mm7InternetExplorer.dll (Mindjet)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {36299202-09EF-4ABF-ADB9-47C599DBE778} https://www.hpwindows7upgrade.arvato.com/no…PProdDetect.cab (HP Product Detection Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.25.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{93B08834-744D-4091-8EE3-9FACB0548FB7}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll File not found
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O22:64bit: - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - C:\Program Files (x86)\Stardock\Fences\FencesMenu64.dll (Stardock)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img31.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img31.jpg
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{661b48ca-ae41-11e1-ae33-002354493431}\Shell - "" = AutoRun
O33 - MountPoints2\{661b48ca-ae41-11e1-ae33-002354493431}\Shell\AutoRun\command - "" = J:\setup.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)


Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.ac3acm - C:\Windows\SysWow64\ac3acm.acm (fccHandler)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\SysWow64\lameACM.acm (http://www.mp3dev.org/)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: VIDC.DIVX - C:\Windows\SysWow64\divx.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: VIDC.XVID - C:\Windows\SysWow64\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\Windows\SysWow64\yv12vfw.dll (www.helixcommunity.org)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/08/11 15:09:41 | 000,000,000 | —D | C] – C:\Users\Jack\AppData\Roaming\Skype
[2013/08/11 15:09:24 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013/08/11 15:09:23 | 000,000,000 | R–D | C] – C:\Program Files (x86)\Skype
[2013/08/11 15:09:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Skype
[2013/08/11 15:08:49 | 000,263,592 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2013/08/11 15:08:33 | 000,175,016 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2013/08/11 15:08:33 | 000,175,016 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2013/08/11 15:08:33 | 000,096,168 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/08/11 15:07:11 | 000,000,000 | —D | C] – C:\ProgramData\Skype
[2013/08/11 14:50:43 | 000,000,000 | —D | C] – C:\Program Files (x86)\Dropbox
[2013/08/11 14:48:22 | 000,000,000 | —D | C] – C:\Users\Jack\AppData\Local\{8398C5F1-DBA1-42C5-B32B-61AB8EF3EE1B}
[2013/08/03 15:24:01 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2013/08/03 03:02:20 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2013/08/03 03:02:20 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2013/08/03 03:02:19 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2013/08/03 03:02:19 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2013/08/03 03:02:19 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2013/08/03 03:02:19 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2013/08/03 03:02:19 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2013/08/03 03:02:18 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2013/08/03 03:02:18 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2013/08/03 03:02:18 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2013/08/03 03:02:17 | 002,312,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2013/08/03 03:02:17 | 000,729,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2013/08/03 03:02:17 | 000,717,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2013/08/03 03:02:17 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2013/08/03 03:02:16 | 000,816,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2013/08/02 14:57:26 | 001,269,248 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\crypt32.dll
[2013/08/02 14:57:26 | 001,078,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\certutil.exe
[2013/08/02 14:57:26 | 000,812,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\certutil.exe
[2013/08/02 14:57:25 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cryptnet.dll
[2013/08/02 14:57:25 | 000,050,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\certenc.dll
[2013/08/02 14:57:25 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\certenc.dll
[2013/08/02 14:57:09 | 000,619,008 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\qedit.dll
[2013/08/02 14:57:09 | 000,505,344 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\qedit.dll
[2013/08/02 14:55:33 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cryptdlg.dll
[2013/08/02 14:55:33 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\cryptdlg.dll
[2013/08/02 14:55:04 | 001,556,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\DWrite.dll
[2013/08/02 14:55:03 | 000,566,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10level9.dll
[2013/08/02 14:55:03 | 000,327,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10_1core.dll
[2013/08/02 14:55:02 | 002,002,944 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10warp.dll
[2013/08/02 14:55:02 | 001,268,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10.dll
[2013/08/02 14:55:02 | 000,834,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d2d1.dll
[2013/08/02 14:55:02 | 000,287,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10core.dll
[2013/08/02 14:55:00 | 000,196,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10_1.dll
[2013/08/02 14:54:55 | 001,548,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WMVDECOD.DLL
[2013/08/02 14:54:54 | 001,706,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WMVDECOD.DLL
[2013/08/02 14:44:27 | 000,686,080 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\win32spl.dll
[2013/08/02 14:44:27 | 000,443,904 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\win32spl.dll
[2013/08/02 14:44:27 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\printcom.dll
[2013/08/02 14:12:12 | 000,000,000 | —D | C] – C:\Users\Jack\AppData\Local\{57AF052D-457B-479E-B074-4277D6A9A659}

========== Files - Modified Within 30 Days ==========

[2013/08/11 15:44:06 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Jack\Desktop\OTL.exe
[2013/08/11 15:34:39 | 000,713,778 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/08/11 15:34:39 | 000,611,548 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/08/11 15:34:39 | 000,106,990 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/08/11 15:32:34 | 000,000,890 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/08/11 15:28:19 | 000,003,616 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/08/11 15:28:17 | 000,003,616 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/08/11 15:28:09 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/08/11 15:23:10 | 000,000,904 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-90513374-351519211-1811497972-1000UA.job
[2013/08/11 15:23:10 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/08/11 15:13:10 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/08/11 15:09:54 | 000,000,784 | —- | M] () – C:\Users\Jack\Application Data\Microsoft\Internet Explorer\Quick Launch\Audacity.lnk
[2013/08/11 15:09:50 | 000,001,890 | —- | M] () – C:\Users\Jack\Application Data\Microsoft\Internet Explorer\Quick Launch\Skype.lnk
[2013/08/11 15:08:24 | 000,096,168 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/08/11 15:08:23 | 000,263,592 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2013/08/11 15:08:23 | 000,175,016 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2013/08/11 15:08:23 | 000,175,016 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2013/08/11 15:08:22 | 000,867,240 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\npdeployJava1.dll
[2013/08/11 15:08:22 | 000,789,416 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\deployJava1.dll
[2013/08/11 14:50:50 | 000,000,952 | —- | M] () – C:\Users\Jack\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013/08/11 14:50:36 | 000,000,918 | —- | M] () – C:\Users\Jack\Desktop\Dropbox.lnk
[2013/08/11 14:23:00 | 000,000,852 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-90513374-351519211-1811497972-1000Core.job
[2013/08/03 15:24:01 | 000,002,117 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk
[2013/08/03 03:32:35 | 000,524,472 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/08/02 14:24:20 | 000,002,041 | —- | M] () – C:\Users\Jack\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/08/02 14:14:06 | 000,692,104 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/08/02 14:14:06 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

========== Files Created - No Company Name ==========

[2013/08/11 15:09:54 | 000,000,784 | —- | C] () – C:\Users\Jack\Application Data\Microsoft\Internet Explorer\Quick Launch\Audacity.lnk
[2013/08/11 15:09:50 | 000,001,890 | —- | C] () – C:\Users\Jack\Application Data\Microsoft\Internet Explorer\Quick Launch\Skype.lnk
[2013/08/03 15:24:01 | 000,002,117 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2012/06/05 07:53:43 | 000,000,069 | —- | C] () – C:\Windows\NeroDigital.ini
[2011/12/26 12:20:39 | 000,000,658 | —- | C] () – C:\Windows\CDPlayer.ini
[2011/08/11 07:41:35 | 000,002,678 | —- | C] () – C:\Users\Jack\.recently-used.xbel
[2010/05/23 21:32:05 | 000,000,088 | RHS- | C] () – C:\ProgramData\B03BE8F32B.sys
[2010/05/23 21:32:04 | 000,002,828 | -HS- | C] () – C:\ProgramData\KGyGaAvL.sys
[2009/12/22 12:03:55 | 000,020,992 | —- | C] () – C:\Users\Jack\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/10 12:47:55 | 000,000,127 | —- | C] () – C:\Users\Jack\webct_upload_applet.properties
[2009/10/22 21:03:48 | 000,000,372 | —- | C] () – C:\Users\Jack\Documents - Shortcut.lnk
[2009/10/22 18:44:49 | 000,000,252 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2009/08/27 09:41:55 | 000,230,202 | —- | C] () – C:\Users\Jack\graphics card.odt
[2009/08/19 17:49:25 | 000,008,268 | —- | C] () – C:\Users\Jack\AppData\Local\d3d9caps.dat

========== ZeroAccess Check ==========

[2012/06/05 06:58:51 | 000,000,000 | —D | M] – C:\$Recycle.bin\S-1-5-21-90513374-351519211-1811497972-1000\$RX6GQ41\Albums\N
[2006/11/02 11:30:40 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/08 13:59:03 | 012,899,840 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 13:47:00 | 011,586,048 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/04/11 03:11:14 | 000,891,392 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/04/11 02:28:19 | 000,614,912 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2008/01/20 22:50:58 | 000,513,024 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2010/06/20 12:36:38 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Abine
[2010/01/12 11:41:12 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Amazon
[2009/08/19 22:59:58 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Autodesk
[2012/10/29 13:09:50 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\AVG2013
[2013/08/11 15:34:31 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Dropbox
[2009/08/19 22:57:20 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Foxit
[2011/08/11 07:43:17 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\gtk-2.0
[2009/11/05 11:47:48 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\HotSync
[2012/06/05 07:52:29 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Motorola
[2011/04/09 10:10:38 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Neat
[2011/04/09 10:10:36 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Nuance
[2009/08/21 00:27:36 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\OpenOffice.org
[2013/05/02 07:57:24 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Opera
[2013/05/12 17:56:31 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\PDF Architect
[2009/08/19 11:52:21 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\PictureMover
[2012/10/30 21:17:33 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Spotify
[2009/09/29 18:45:49 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\SSH
[2009/08/19 22:48:15 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\Stardock
[2012/10/29 12:54:21 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\TuneUp Software
[2013/05/12 09:49:05 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\uTorrent
[2009/10/16 01:49:26 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\WinBatch

========== Purity Check ==========



========== Custom Scans ==========

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.EXE >
[2008/10/29 02:20:29 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_b5f700fe698beb14\explorer.exe
[2008/10/29 02:29:41 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_b7eb106e66a7ac19\explorer.exe
[2008/10/29 02:15:50 | 003,087,360 | —- | M] (Microsoft Corporation) MD5=50514057C28A74BAC2BD04B7B990D615 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_aba256ac352b2919\explorer.exe
[2008/10/29 23:59:17 | 002,927,616 | —- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_b8583e9d7fda0512\explorer.exe
[2009/04/11 03:10:17 | 003,079,168 | —- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 – C:\Windows\explorer.exe
[2009/04/11 03:10:17 | 003,079,168 | —- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_afbebba22f3bab41\explorer.exe
[2008/10/27 22:30:12 | 003,086,848 | —- | M] (Microsoft Corporation) MD5=72B9990E45C25AA3C75C4FB50A9D6CE0 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_ac5266dd4e2b0a41\explorer.exe
[2008/10/29 02:49:22 | 003,080,704 | —- | M] (Microsoft Corporation) MD5=BBD8E74F23D7605CB0CDB57A1B25D826 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_ad96661c3246ea1e\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\SysWOW64\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_ba1365f4639c6d3c\explorer.exe
[2008/10/30 01:30:07 | 003,081,216 | —- | M] (Microsoft Corporation) MD5=E404A65EF890140410E9F3D405841C95 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_ae03944b4b794317\explorer.exe
[2008/10/27 22:15:02 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_b6a7112f828bcc3c\explorer.exe
[2008/01/20 22:48:44 | 003,080,704 | —- | M] (Microsoft Corporation) MD5=F6D765FB6B457542D954682F50C26E4F – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_add342963219dff5\explorer.exe
[2008/01/20 22:49:23 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_b827ece8667aa1f0\explorer.exe

< MD5 for: EXPLORER.EXE.MUI >
[2006/11/02 11:13:38 | 000,036,864 | —- | M] (Microsoft Corporation) MD5=192DD053B43250E264383CDC3D564A18 – C:\Windows\SysWOW64\en-US\explorer.exe.mui
[2006/11/02 11:13:38 | 000,036,864 | —- | M] (Microsoft Corporation) MD5=192DD053B43250E264383CDC3D564A18 – C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_6a2f0af76374ed51\explorer.exe.mui
[2006/11/02 11:13:32 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=872D519975CA4D7CC596FC93470D49E0 – C:\Windows\en-US\explorer.exe.mui
[2006/11/02 11:13:32 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=872D519975CA4D7CC596FC93470D49E0 – C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_5fda60a52f142b56\explorer.exe.mui

< MD5 for: EXPLORER.EXE-7A3328DA.PF >
[2013/08/11 15:32:34 | 000,273,294 | —- | M] () MD5=AE4A3486A59FC36CB59447D911537B89 – C:\Windows\Prefetch\EXPLORER.EXE-7A3328DA.pf

< MD5 for: EXPLORER.PNG >
[2006/01/04 18:41:16 | 000,017,279 | —- | M] () MD5=BA09A8A404C60E147624F10527F7EAF9 – C:\Users\Jack\Downloads\6000+ Icons Megapack\AllVistaIco\Other\Explorer.png

< MD5 for: IEXPLORE.EXE >
[2012/06/02 07:47:54 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=004640AB259C1572EBD5FB0A32F63686 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20553_none_b5336068bd3ba567\iexplore.exe
[2013/01/08 21:53:45 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=0100BCF23941C83462E4A70F94C3392E – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16464_none_b49ff3fba4253ae5\iexplore.exe
[2012/05/17 19:21:54 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=0129BB16161C2FD9A6B19111AB047198 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16446_none_bf0c3eb9d873f7ac\iexplore.exe
[2009/07/18 08:51:34 | 000,711,432 | —- | M] (Microsoft Corporation) MD5=065536D14F91DC321FBFAED112B2A747 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21089_none_89d658d9ee8bf1ff\iexplore.exe
[2009/04/01 20:07:26 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=07ED775D6DB4BFA96D7CFB09EB228418 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16681_none_9399882309d61be8\iexplore.exe
[2012/10/03 22:07:39 | 000,754,824 | —- | M] (Microsoft Corporation) MD5=0B09588808D3865287BE65CF62D792B2 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20562_none_b5279032bd44a801\iexplore.exe
[2012/11/13 22:56:04 | 000,757,296 | —- | M] (Microsoft Corporation) MD5=0D286C0FE561D1A7EB30E83A0FF305B2 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16457_none_bf026f17d87b2cf4\iexplore.exe
[2009/04/01 20:15:21 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=157F8DE991396C536820D7FA5C8DCF7D – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16711_none_93e5397d099d5578\iexplore.exe
[2009/04/01 20:05:45 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=182CAF7403705ACCB51211A761080B8F – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20777_none_9433f69622e637cb\iexplore.exe
[2012/06/27 22:23:58 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=1A8A5634E778B0466BE0932B460ACCB3 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20554_none_b53460b2bd3abebe\iexplore.exe
[2009/04/01 20:07:25 | 000,701,440 | —- | M] (Microsoft Corporation) MD5=1ACD856D345FA54F89335C793B2B0874 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20823_none_8a115c9dee6081e6\iexplore.exe
[2009/11/21 11:04:19 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=1B5572B8B9CD678E814F57B245400F64 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22956_none_6ec34e240169f05e\iexplore.exe
[2009/11/21 02:42:38 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=1B6362BB14FCEB9E76BCF9A953B04788 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18865_none_78828b751cb61529\iexplore.exe
[2009/07/18 08:16:49 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=1D5A01AA2DE47C052AF46D7EBCB003A3 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16890_none_938dbbb909df18d0\iexplore.exe
[2009/07/18 17:39:09 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=1D8163DBFECAEDB9C48C5F55084BC491 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18294_none_9577fb8707020f1d\iexplore.exe
[2012/08/24 03:34:41 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=22CC6CDBA678790046693654C3B212E4 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16450_none_befb6d11d8817b93\iexplore.exe
[2013/02/22 03:04:50 | 000,763,520 | —- | M] (Microsoft Corporation) MD5=25B53709A37C3FD814B68EA0A92D18F9 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16476_none_b49724a3a42b8984\iexplore.exe
[2010/02/23 11:06:13 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=25DB705A7DC85C208B3CF2D20F118AA7 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22995_none_78ebb87c35ec08c6\iexplore.exe
[2012/05/17 18:59:46 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=268982F1FD671A077C6A2AF41E351436 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20551_none_bf860a26f19e34b4\iexplore.exe
[2012/06/28 00:16:03 | 000,754,784 | —- | M] (Microsoft Corporation) MD5=2BF1D4CA1D2DFDCA52421730CA46E851 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16448_none_b4b994fba411685f\iexplore.exe
[2009/04/11 02:27:44 | 000,636,080 | —- | M] (Microsoft Corporation) MD5=2C5168C856455CC43C4B4E1CC1920001 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6002.18005_none_97c0beeb03de7f46\iexplore.exe
[2012/08/24 07:23:44 | 000,754,824 | —- | M] (Microsoft Corporation) MD5=2D53C5F71653EF94E7829846405D4ED2 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16450_none_b4a6c2bfa420b998\iexplore.exe
[2009/08/27 01:23:17 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=2E48756F12C21F46895036AC089AAD97 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18828_none_78b0cc031c92f16a\iexplore.exe
[2011/02/22 02:50:19 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=2E70FE17239DFCA6209FD698D0F18C61 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19048_none_6e465be0e84297ba\iexplore.exe
[2009/04/01 20:05:45 | 000,701,440 | —- | M] (Microsoft Corporation) MD5=2EEE7F65B04F759FE7D238AD6EAB90B7 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20777_none_89df4c43ee8575d0\iexplore.exe
[2009/04/01 20:05:45 | 000,701,440 | —- | M] (Microsoft Corporation) MD5=31705413C889C5503F564C642D83C282 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16643_none_89721e14d5531cd7\iexplore.exe
[2013/02/22 00:10:00 | 000,757,376 | —- | M] (Microsoft Corporation) MD5=32732CEDE2A1106B736EF3D84054EE04 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16476_none_beebcef5d88c4b7f\iexplore.exe
[2012/06/27 21:08:59 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=32F1A71CC1943BD537DA1516E0CB6AF3 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16448_none_bf0e3f4dd8722a5a\iexplore.exe
[2009/07/18 18:19:00 | 000,711,432 | —- | M] (Microsoft Corporation) MD5=3336F6E73AD028FC310947DFA84CD554 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16890_none_89391166d57e56d5\iexplore.exe
[2013/05/28 23:32:47 | 000,757,400 | —- | M] (Microsoft Corporation) MD5=33E62E4EFC2ACA8EC63A8926F26D3889 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20606_none_bfc11d1af17124d9\iexplore.exe
[2012/06/02 05:08:27 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=34B01BBD8F00B6B9C9248DC4F1E3CD01 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16447_none_bf0d3f03d8731103\iexplore.exe
[2012/10/03 23:12:11 | 000,754,824 | —- | M] (Microsoft Corporation) MD5=367045AF10C4875707E0864E352EF3F1 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16455_none_b4abc431a41c384b\iexplore.exe
[2010/11/02 02:29:04 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=37302FCB9B7D54B0DBB43624E7A21B3C – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18999_none_6e11746ce86a0984\iexplore.exe
[2010/01/02 10:58:26 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=3D8DA00B028DEA9517066F1CECBFC4A2 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22973_none_78ff57c035dd9e36\iexplore.exe
[2013/04/04 18:47:49 | 000,757,360 | —- | M] (Microsoft Corporation) MD5=3F00BE80B9CEA20B7FE7363D15EDDB94 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16483_none_beddfe2bd8971b6b\iexplore.exe
[2013/02/22 00:10:31 | 000,757,360 | —- | M] (Microsoft Corporation) MD5=4145E2B5663F6FACC08EFDB17B658BB2 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20586_none_bf6a9bd4f1b2073a\iexplore.exe
[2010/05/04 02:32:18 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=48A6109E8DF0365195298CC527B7426A – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23019_none_7946112635a7c1dc\iexplore.exe
[2010/09/08 02:26:34 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=4A719476A6393B1DCACFEB4F3AC6599C – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23067_none_790e00f635d21ae3\iexplore.exe
[2009/07/22 02:04:09 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=4B5AEA50CE77FBA4C2D169622DC9B489 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22903_none_794b073435a4da9f\iexplore.exe
[2012/06/27 19:36:32 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=4B649ED3CDC17707898E4948AAB72528 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20554_none_bf890b04f19b80b9\iexplore.exe
[2009/04/01 20:15:21 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=4DBD95312B1C96C5285D38F1D748CD4D – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20868_none_943fc8b222dd3258\iexplore.exe
[2012/05/17 22:51:05 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=4E99F42504A99D5024C2EFA015001937 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16446_none_b4b79467a41335b1\iexplore.exe
[2009/07/18 08:39:30 | 000,711,432 | —- | M] (Microsoft Corporation) MD5=51B17FD4415B38F783F7C8EDABD3157D – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18294_none_8b235134d2a14d22\iexplore.exe
[2009/08/27 01:52:49 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=51BDD4A648CD937BC7111D09930114C3 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18828_none_6e5c21b0e8322f6f\iexplore.exe
[2009/04/11 03:11:08 | 000,712,864 | —- | M] (Microsoft Corporation) MD5=58136AB5A3DF2D44BBB483629188584A – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6002.18005_none_8d6c1498cf7dbd4b\iexplore.exe
[2012/08/24 06:49:07 | 000,754,824 | —- | M] (Microsoft Corporation) MD5=5A150AFABB25BEA50CEDC8650A7B8A9E – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20557_none_b5376190bd380ac3\iexplore.exe
[2010/11/02 02:03:13 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=5AB037B17F8A87D052F5A88E0D29A3C8 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18999_none_78661ebf1ccacb7f\iexplore.exe
[2008/01/20 22:48:06 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=5B92133D3E7FB2644677686305E29E81 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18000_none_95d545df06bcb3fa\iexplore.exe
[2010/05/04 02:00:35 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=5C9B1062EA7A44E8F6BFDE994B68C7AA – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18928_none_78b0cde91c92ee91\iexplore.exe
[2012/06/02 08:52:21 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=610F6596921C4BAA8834ADBB9BE272EE – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16447_none_b4b894b1a4124f08\iexplore.exe
[2012/08/24 03:49:25 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=62188720CE27B982B4285C03163C9FB3 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20557_none_bf8c0be2f198ccbe\iexplore.exe
[2013/01/08 18:42:06 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=698EB1E5F8C66344D97C00B5699E871D – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16464_none_bef49e4dd885fce0\iexplore.exe
[2009/04/01 20:07:26 | 000,701,440 | —- | M] (Microsoft Corporation) MD5=699D1D2EAF5C80E7361809B0ED8AE773 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16681_none_8944ddd0d57559ed\iexplore.exe
[2010/05/04 02:57:44 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=6E4A7132FE953AFFAE00B15835404564 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18928_none_6e5c2396e8322c96\iexplore.exe
[2010/06/26 02:06:48 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=7420BE0E7D3D1320054F7ACA0594953D – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18943_none_78962c9f1ca7a7c0\iexplore.exe
[2010/12/18 03:19:44 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=7852371DA9EFBC17B645558E23780EAC – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23111_none_793e10bc35aef44b\iexplore.exe
[2009/03/08 17:09:11 | 000,661,344 | —- | M] (Microsoft Corporation) MD5=7A81E0CECAE7B98459A073981F0124D5 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18702_none_6e6bbde6e827625c\iexplore.exe
[2013/02/02 04:09:12 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=7C2923004FFC497E54F38E835F108EE8 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20580_none_b50fefc6bd56ad35\iexplore.exe
[2009/08/27 09:31:08 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=7DD482E4A2E3CBB0A72F718C342F5B75 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22918_none_794538ba35a87543\iexplore.exe
[2012/10/03 18:53:29 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=7FC9E840B32E9DFBFBBA92BA5E9B97C2 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20562_none_bf7c3a84f1a569fc\iexplore.exe
[2009/07/18 08:16:45 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=7FCF4E704A48D95202F3E7A1E1A21412 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21089_none_942b032c22ecb3fa\iexplore.exe
[2010/02/23 03:03:07 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=81AF4A1549710310E56B43C4D3F3657C – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18904_none_6e6dc246e8258f58\iexplore.exe
[2010/09/08 02:49:26 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=827BE3F3C80787B00F19E36B19531197 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18975_none_6e23131ce85d6c46\iexplore.exe
[2009/04/01 20:15:21 | 000,701,440 | —- | M] (Microsoft Corporation) MD5=88BC0B30EE1C0344119778A6E8F2509F – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16711_none_89908f2ad53c937d\iexplore.exe
[2010/01/02 02:40:20 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=88BD42DAE7CFFEB256CA7145A15E4843 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18882_none_7869eabf1cc90106\iexplore.exe
[2012/11/14 01:19:40 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=8ACFFA754B6ED028B8689CAD00FC2BCB – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20565_none_b52a9110bd41f406\iexplore.exe
[2009/11/21 02:53:25 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=8ADB04E86E8A38307D0663CD002BFFD1 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18865_none_6e2de122e855532e\iexplore.exe
[2010/12/18 02:56:48 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=8F69AE4F1AC2E1D2C34348D519007A2C – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19019_none_6e67cbeee8295d3e\iexplore.exe
[2011/05/20 07:50:05 | 000,748,336 | —- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16421_none_bf1cdd1fd8684117\iexplore.exe
[2010/11/02 03:13:47 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=92A17B0A89D14815AACC62CD190B6CE3 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23091_none_78e78f7635efd6ac\iexplore.exe
[2009/04/01 20:05:45 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=9437CA21CD48C9B6BFD6F5AC0143D251 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16643_none_93c6c86709b3ded2\iexplore.exe
[2012/10/03 19:08:28 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=96A360002311ECE53952AF2F5B4CD64E – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16455_none_bf006e83d87cfa46\iexplore.exe
[2011/02/22 03:18:28 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=9CE5543464432CA73134F170FA2BF823 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23143_none_791fa18c35c57acc\iexplore.exe
[2010/05/04 02:59:11 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=9D0512508DBDD31DA29BC05941417101 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23019_none_6ef166d40146ffe1\iexplore.exe
[2009/04/01 20:07:25 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=9F1427F203CA078005C9943800929640 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20823_none_946606f022c143e1\iexplore.exe
[2010/02/23 02:39:16 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=9F52FBE99C749E3F32C75124F09F1B03 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18904_none_78c26c991c865153\iexplore.exe
[2013/04/04 21:55:57 | 000,763,504 | —- | M] (Microsoft Corporation) MD5=A1B0DEC3BB845C6369F97BC1A3542A07 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16483_none_b48953d9a4365970\iexplore.exe
[2013/02/02 00:19:03 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=A285E1965C115031DA02B777EE9D7689 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20580_none_bf649a18f1b76f30\iexplore.exe
[2013/02/02 03:37:58 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=A8EBEBCD9F5C49475194099FCD276992 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16470_none_b49122e7a430f17a\iexplore.exe
[2008/01/20 22:50:37 | 000,701,952 | —- | M] (Microsoft Corporation) MD5=AC2C3BAFD177B60C3B5E4DDBCC2C2DB3 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18000_none_8b809b8cd25bf1ff\iexplore.exe
[2013/05/29 02:24:18 | 000,763,544 | —- | M] (Microsoft Corporation) MD5=AFF2C99AD2C599108B6BD9E77C24B463 – C:\Program Files\Internet Explorer\iexplore.exe
[2013/05/29 02:24:18 | 000,763,544 | —- | M] (Microsoft Corporation) MD5=AFF2C99AD2C599108B6BD9E77C24B463 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16496_none_b48184cba43bc166\iexplore.exe
[2013/02/22 03:17:45 | 000,763,520 | —- | M] (Microsoft Corporation) MD5=B21A57AA4CB928059A0C0C58A9E77A02 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20586_none_b515f182bd51453f\iexplore.exe
[2013/04/04 14:50:32 | 000,218,184 | —- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2009/03/08 17:09:24 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18702_none_78c068391c882457\iexplore.exe
[2010/01/02 11:15:56 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=B7ECFA3A546360E2A39ADBE1D773F3DC – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22973_none_6eaaad6e017cdc3b\iexplore.exe
[2010/12/18 02:28:35 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=B988D7F127B94BD5BF8356FE81B985C4 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19019_none_78bc76411c8a1f39\iexplore.exe
[2012/06/02 04:51:58 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=BE967C74B89577B78FB57C061E12B04C – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20553_none_bf880abaf19c6762\iexplore.exe
[2013/04/04 17:55:02 | 000,757,360 | —- | M] (Microsoft Corporation) MD5=C036AB1ED8BAC04FE4A349BA263077BB – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20593_none_bf5ccb0af1bcd726\iexplore.exe
[2011/02/22 02:21:12 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=C1D36A2CBE0CEC4DF593DB1288CF586E – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.19048_none_789b06331ca359b5\iexplore.exe
[2009/07/21 17:53:43 | 000,638,216 | —- | M] (Microsoft Corporation) MD5=C33BD196A0301F9B23D9A003D30ED8B0 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18813_none_78b69a7d1c8f56c6\iexplore.exe
[2009/07/21 18:12:12 | 000,660,744 | —- | M] (Microsoft Corporation) MD5=C45FA4DA458E0B3C9636B09488029BDD – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18813_none_6e61f02ae82e94cb\iexplore.exe
[2013/04/04 20:40:37 | 000,763,504 | —- | M] (Microsoft Corporation) MD5=C4A4F4AD91677DA1659A9ADE63746B8B – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20593_none_b50820b8bd5c152b\iexplore.exe
[2009/07/18 08:25:05 | 000,711,448 | —- | M] (Microsoft Corporation) MD5=C6558E30E94FE3DF893CE85F6948B5DA – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22475_none_8bc39007ebadcb88\iexplore.exe
[2010/01/02 03:09:58 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=C9256212D298D96FE0F63D69ECD9CE97 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18882_none_6e15406ce8683f0b\iexplore.exe
[2013/05/29 01:56:53 | 000,763,544 | —- | M] (Microsoft Corporation) MD5=C9C29508A433DAF0118D28C4F38CDDFC – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20606_none_b56c72c8bd1062de\iexplore.exe
[2009/08/27 10:04:11 | 000,660,744 | —- | M] (Microsoft Corporation) MD5=CBDEB65EDCC5E574F43F1EF79E54C8A1 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22918_none_6ef08e680147b348\iexplore.exe
[2010/02/23 12:03:02 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=D1978C9901DAA9A1C2EE78A707B1449A – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22995_none_6e970e2a018b46cb\iexplore.exe
[2010/09/08 02:02:42 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=D5A730DFDEAE005373E62BC2A866E3BB – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18975_none_7877bd6f1cbe2e41\iexplore.exe
[2009/04/01 20:15:21 | 000,701,440 | —- | M] (Microsoft Corporation) MD5=D5A7B74CA0826CF5BCE4AE0152231A9B – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.20868_none_89eb1e5fee7c705d\iexplore.exe
[2010/09/08 03:28:01 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=D93AB1673986658EF1931FA751BCCF69 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23067_none_6eb956a4017158e8\iexplore.exe
[2013/02/02 00:19:04 | 000,757,296 | —- | M] (Microsoft Corporation) MD5=DDE5A0DFAF7C6370FB36402D7A746ED3 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16470_none_bee5cd39d891b375\iexplore.exe
[2011/02/22 03:54:38 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=E79C480F9DCD7512AAB9727A533CB152 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23143_none_6ecaf73a0164b8d1\iexplore.exe
[2009/11/21 11:05:17 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=E7F8DF50E483D165BB01F367D3519AA7 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22956_none_7917f87635cab259\iexplore.exe
[2010/06/26 02:31:23 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=E9D8A71AFDCA528A184C1498E22A8241 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18943_none_6e41824ce846e5c5\iexplore.exe
[2009/07/18 07:55:42 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=EBEE9E4421F35CD861107DDA0266FBB1 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22475_none_96183a5a200e8d83\iexplore.exe
[2013/05/28 22:24:32 | 000,757,400 | —- | M] (Microsoft Corporation) MD5=EE12BA876C4190532A4085994BA9B616 – C:\Program Files (x86)\Internet Explorer\iexplore.exe
[2013/05/28 22:24:32 | 000,757,400 | —- | M] (Microsoft Corporation) MD5=EE12BA876C4190532A4085994BA9B616 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16496_none_bed62f1dd89c8361\iexplore.exe
[2013/01/08 20:51:57 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=EF1F6F41FB2C9BBB484B21017F380201 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20573_none_b51dc090bd4bdd49\iexplore.exe
[2013/01/08 17:32:42 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=F05982E56ABD835AA8DF260EEC873E5B – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20573_none_bf726ae2f1ac9f44\iexplore.exe
[2010/06/26 02:52:42 | 000,638,232 | —- | M] (Microsoft Corporation) MD5=F05B3A2C6CB319DD1377AD566CF5ECE5 – C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23040_none_791c9ec835c831a0\iexplore.exe
[2011/05/20 07:50:01 | 000,754,480 | —- | M] (Microsoft Corporation) MD5=F1424C1B9B1813BF825E45DF3790BC8A – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16421_none_b4c832cda4077f1c\iexplore.exe
[2010/11/02 03:42:15 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=F686191623AC22EE2521C2D17157B199 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23091_none_6e92e524018f14b1\iexplore.exe
[2012/11/13 22:19:28 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=F691418EE9A6344AEB5C1B0518FBF8AE – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20565_none_bf7f3b62f1a2b601\iexplore.exe
[2010/06/28 14:17:01 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=F896A6A9965B9C64061BE97F6D84B075 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23040_none_6ec7f47601676fa5\iexplore.exe
[2012/05/17 21:37:57 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=F8B2D47ED17C1D087D14EC747E5AC57A – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.20551_none_b5315fd4bd3d72b9\iexplore.exe
[2010/12/18 03:54:56 | 000,660,760 | —- | M] (Microsoft Corporation) MD5=FC6DC0E786A4D2E7DA6E9C012ED2E64F – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.23111_none_6ee9666a014e3250\iexplore.exe
[2012/11/14 03:11:18 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=FD0D2E1FAEBAE5031BE2EB8000D973F1 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.1.8112.16457_none_b4adc4c5a41a6af9\iexplore.exe
[2009/07/22 02:30:13 | 000,660,744 | —- | M] (Microsoft Corporation) MD5=FDCF656D4B4E116D9C932AD2868FD811 – C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.22903_none_6ef65ce2014418a4\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2009/03/08 18:15:57 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=11E9431B29BD64A1FB13369BB8AD4116 – C:\Windows\winsxs\amd64_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_8.0.6001.18702_en-us_7c9630f422ee47f7\iexplore.exe.mui
[2011/05/20 07:50:02 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=17FAE936C452188D05852DE8D1082013 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2011/05/20 07:50:02 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=17FAE936C452188D05852DE8D1082013 – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.1.8112.16421_en-us_ae74c844dbb4c003\iexplore.exe.mui
[2006/11/02 11:13:34 | 000,016,384 | —- | M] (Microsoft Corporation) MD5=3CCDDDBC49DEACA370F39A9F0E146A1B – C:\Windows\winsxs\wow64_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_a1c8f6f0449888c1\iexplore.exe.mui
[2011/05/20 07:50:06 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui
[2011/05/20 07:50:06 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.1.8112.16421_en-us_b8c97297101581fe\iexplore.exe.mui
[2009/03/08 17:27:11 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Windows\winsxs\wow64_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_8.0.6001.18702_en-us_86eadb46574f09f2\iexplore.exe.mui
[2006/11/02 11:13:29 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=D421BD7B9646679254B0D855823C6F21 – C:\Windows\winsxs\amd64_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_97744c9e1037c6c6\iexplore.exe.mui

< MD5 for: SERVICES >
[2006/09/18 17:37:24 | 000,017,244 | —- | M] () MD5=9F534244B7F8F55D5C0BB498D8D481E7 – C:\Windows\winsxs\amd64_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.0.6001.18000_none_60a39df1afb86c9f\services

< MD5 for: SERVICES.CNF >
[2009/08/13 20:08:26 | 000,000,080 | —- | M] () MD5=0AB064E52A2106C42EE46301F78CAA8F – C:\Users\Jack\Documents\My Web Sites\_vti_pvt\services.cnf
[2002/05/15 19:32:04 | 000,000,003 | —- | M] () MD5=864E46AD77EBE7A312EB11241A5114B6 – C:\Users\Jack\Documents\My Web Sites\drexel old\_vti_pvt\services.cnf
[2001/06/27 17:14:37 | 000,000,003 | —- | M] () MD5=864E46AD77EBE7A312EB11241A5114B6 – C:\Users\Jack\Documents\My Web Sites\drexel old\AE391\1\_vti_pvt\services.cnf
[2001/07/03 15:53:26 | 000,000,003 | —- | M] () MD5=864E46AD77EBE7A312EB11241A5114B6 – C:\Users\Jack\Documents\My Web Sites\drexel old\AE391\2\_vti_pvt\services.cnf
[2001/07/12 16:50:27 | 000,000,003 | —- | M] () MD5=864E46AD77EBE7A312EB11241A5114B6 – C:\Users\Jack\Documents\My Web Sites\drexel old\AE391\3\_vti_pvt\services.cnf
[2001/08/09 16:30:13 | 000,000,003 | —- | M] () MD5=864E46AD77EBE7A312EB11241A5114B6 – C:\Users\Jack\Documents\My Web Sites\drexel old\AE391\5\_vti_pvt\services.cnf
[2008/04/02 21:07:22 | 000,000,003 | —- | M] () MD5=864E46AD77EBE7A312EB11241A5114B6 – C:\Users\Jack\Documents\My Web Sites\mysite\_vti_pvt\services.cnf
[2009/08/13 18:31:48 | 000,000,003 | —- | M] () MD5=864E46AD77EBE7A312EB11241A5114B6 – C:\Users\Jack\Documents\My Web Sites\Resume4\_vti_pvt\services.cnf
[2009/08/13 19:10:50 | 000,000,003 | —- | M] () MD5=864E46AD77EBE7A312EB11241A5114B6 – C:\Users\Jack\Documents\My Web Sites\Resume5\_vti_pvt\services.cnf
[2009/08/13 19:11:30 | 000,000,003 | —- | M] () MD5=864E46AD77EBE7A312EB11241A5114B6 – C:\Users\Jack\Documents\My Web Sites\Resume6\_vti_pvt\services.cnf
[2009/08/13 20:08:26 | 000,000,003 | —- | M] () MD5=864E46AD77EBE7A312EB11241A5114B6 – C:\Users\Jack\Documents\My Web Sites\Work\_vti_pvt\services.cnf
[2001/07/12 16:50:26 | 000,000,015 | —- | M] () MD5=E525708241C5824AB5F600626E0803AB – C:\Users\Jack\Documents\My Web Sites\drexel old\AE391\_vti_pvt\services.cnf

< MD5 for: SERVICES.EXE >
[2008/01/20 22:50:34 | 000,279,040 | —- | M] (Microsoft Corporation) MD5=2B336AB6286D6C81FA02CBAB914E3C6C – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.exe
[2009/04/11 03:10:50 | 000,384,512 | —- | M] (Microsoft Corporation) MD5=934E0B7D77FF78C18D9F8891221B6DE3 – C:\Windows\SysNative\services.exe
[2009/04/11 03:10:50 | 000,384,512 | —- | M] (Microsoft Corporation) MD5=934E0B7D77FF78C18D9F8891221B6DE3 – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_2d69d4f782c83d8c\services.exe
[2009/04/11 02:27:59 | 000,279,552 | —- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B – C:\Windows\SysWOW64\services.exe
[2009/04/11 02:27:59 | 000,279,552 | —- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe
[2008/01/20 22:49:44 | 000,384,512 | —- | M] (Microsoft Corporation) MD5=DFAC660F0F139276CC9299812DE42719 – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_2b7e5beb85a67240\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2006/11/02 11:13:31 | 000,017,920 | —- | M] (Microsoft Corporation) MD5=1626EACF0E7E59F85C59DDDD27C4169C – C:\Windows\SysWOW64\en-US\services.exe.mui
[2006/11/02 11:13:31 | 000,017,920 | —- | M] (Microsoft Corporation) MD5=1626EACF0E7E59F85C59DDDD27C4169C – C:\Windows\winsxs\x86_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.0.6000.16386_en-us_67c6851b290a1ced\services.exe.mui
[2006/11/02 11:13:56 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=F514B57C09E143F1E14415A9E9ADD695 – C:\Windows\SysNative\en-US\services.exe.mui
[2006/11/02 11:13:56 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=F514B57C09E143F1E14415A9E9ADD695 – C:\Windows\winsxs\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.0.6000.16386_en-us_c3e5209ee1678e23\services.exe.mui

< MD5 for: SERVICES.EXE-2260497F.PF >
[2013/08/03 03:32:59 | 000,010,736 | —- | M] () MD5=49CE2A930750A6FDB18B56E0252E91C8 – C:\Windows\Prefetch\SERVICES.EXE-2260497F.pf

< MD5 for: SERVICES.LNK >
[2008/01/20 23:20:59 | 000,001,688 | —- | M] () MD5=EFDD08F4E5E26430885F26F0C35B8C62 – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2008/01/20 23:20:59 | 000,001,688 | —- | M] () MD5=EFDD08F4E5E26430885F26F0C35B8C62 – C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk

< MD5 for: SERVICES.MOCHIADS.COM.SOL >
[2009/10/01 22:31:32 | 000,000,289 | —- | M] () MD5=71C33CDB1726DCCCE9C7CB928E6E7D8E – C:\Users\Jack\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6KYA2HPY\mochiads.com\services.mochiads.com.sol

< MD5 for: SERVICES.MOF >
[2006/09/18 17:44:54 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\SysNative\wbem\services.mof
[2006/09/18 17:46:11 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\SysWOW64\wbem\services.mof
[2006/09/18 17:44:54 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_2b7e5beb85a67240\services.mof
[2006/09/18 17:44:54 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_2d69d4f782c83d8c\services.mof
[2006/09/18 17:46:11 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.mof
[2006/09/18 17:46:11 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.mof

< MD5 for: SERVICES.MSC >
[2006/11/02 11:13:51 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysNative\en-US\services.msc
[2006/09/18 17:29:41 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysNative\services.msc
[2006/11/02 11:14:00 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysWOW64\en-US\services.msc
[2006/09/18 17:29:40 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysWOW64\services.msc
[2006/11/02 11:13:51 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\amd64_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.0.6000.16386_en-us_fe26f08ab7d12816\services.msc
[2006/09/18 17:29:41 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.0.6001.18000_none_2b827e27fe185619\services.msc
[2006/11/02 11:14:00 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.0.6000.16386_en-us_a2085506ff73b6e0\services.msc
[2006/09/18 17:29:40 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.0.6001.18000_none_cf63e2a445bae4e3\services.msc

< MD5 for: SERVICES.PNG >
[2008/09/09 21:20:30 | 000,000,875 | —- | M] () MD5=3382D191625A7528ED791FEDCCE3F212 – C:\Program Files\PC-Doctor for Windows\Images\img16_16\services.png
[2008/09/09 21:20:42 | 000,002,244 | —- | M] () MD5=8C5F2C34A5FB317B868565F9451BF74C – C:\Program Files\PC-Doctor for Windows\Images\img32_32\services.png
[2008/09/09 21:20:52 | 000,006,479 | —- | M] () MD5=AFCA60ED198BE9309943722FE8758392 – C:\Program Files\PC-Doctor for Windows\Images\img64_64\services.png
[2008/09/09 21:20:48 | 000,004,193 | —- | M] () MD5=E1C3A20056206C394E65B37CE1D43851 – C:\Program Files\PC-Doctor for Windows\Images\img48_48\services.png
[2008/09/09 21:20:38 | 000,001,509 | —- | M] () MD5=F4EC3ABEAE15FA9BB42D721E9D543F44 – C:\Program Files\PC-Doctor for Windows\Images\img24_24\services.png

< MD5 for: SERVICES.RDB >
[2009/04/24 00:34:14 | 005,472,256 | —- | M] () MD5=81CCB59A28A03DB55807B883CB679027 – C:\Program Files (x86)\OpenOffice.org 3\Basis\program\services.rdb
[2009/04/24 00:35:04 | 000,262,144 | —- | M] () MD5=81CCB59A28A03DB55807B883CB679027 – C:\Program Files (x86)\OpenOffice.org 3\URE\misc\services.rdb
[2009/04/24 00:34:14 | 005,472,256 | —- | M] () MD5=81CCB59A28A03DB55807B883CB679027 – C:\Users\Jack\AppData\Local\Temp\services.rdb

< MD5 for: SERVICES.SBS >
[2013/07/16 13:21:30 | 000,034,818 | —- | M] () MD5=E2ACBC77020C8D5CE97CA61D0D859A44 – C:\Program Files (x86)\Spybot - Search & Destroy\Includes\Services.sbs

< MD5 for: WINLOGON.EXE >
[2009/04/11 03:11:08 | 000,405,504 | —- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A – C:\Windows\SysNative\winlogon.exe
[2009/04/11 03:11:08 | 000,405,504 | —- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_cdcd15a68a70b877\winlogon.exe
[2008/01/20 22:49:47 | 000,406,016 | —- | M] (Microsoft Corporation) MD5=856491FCED98093D824B9EB2892F564A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_cbe19c9a8d4eed2b\winlogon.exe
[2009/04/11 02:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\SysWOW64\winlogon.exe
[2009/04/11 02:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2013/04/04 14:50:32 | 000,218,184 | —- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/01/20 22:50:38 | 000,314,880 | —- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2008/01/20 22:52:39 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=1DB95B0920FA9783476AC46F187C06F6 – C:\Windows\SysNative\en-US\winlogon.exe.mui
[2008/01/20 22:52:39 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=1DB95B0920FA9783476AC46F187C06F6 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.0.6001.18000_en-us_27172d0ebc73e370\winlogon.exe.mui
[2008/01/20 22:52:28 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=26AC28BF50DC112BAA794A83E08588F0 – C:\Windows\SysWOW64\en-US\winlogon.exe.mui
[2008/01/20 22:52:28 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=26AC28BF50DC112BAA794A83E08588F0 – C:\Windows\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.0.6001.18000_en-us_caf8918b0416723a\winlogon.exe.mui
[2006/11/02 11:13:52 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=2D30AB05DBA78517B34C0AAC71DF5299 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.0.6000.16386_en-us_24e06b12bf88d29c\winlogon.exe.mui
[2006/11/02 11:13:03 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=A1D2856F3EC3C86EBBF1442B0245A8B3 – C:\Windows\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.0.6000.16386_en-us_c8c1cf8f072b6166\winlogon.exe.mui

< MD5 for: WINLOGON.EXE-8163EECC.PF >
[2013/08/03 03:32:59 | 000,020,072 | —- | M] () MD5=6AE55DC9B18186957DE338FDEDB8DA3D – C:\Windows\Prefetch\WINLOGON.EXE-8163EECC.pf

< MD5 for: WINLOGON.MOF >
[2006/09/18 17:38:40 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\Windows\SysNative\wbem\winlogon.mof
[2006/09/18 17:41:56 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\Windows\SysWOW64\wbem\winlogon.mof
[2006/09/18 17:38:40 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.0.6000.16386_none_da20a358315a3dca\winlogon.mof
[2006/09/18 17:41:56 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\Windows\winsxs\x86_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.0.6000.16386_none_7e0207d478fccc94\winlogon.mof

< %SYSTEMDRIVE%\*.* >
[2013/05/13 00:22:37 | 000,017,958 | —- | M] () – C:\AdwCleaner[S1].txt
[2009/04/11 02:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2009/04/01 20:04:09 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2009/10/16 01:52:52 | 000,000,125 | —- | M] () – C:\FINIS_IT.TXT
[2010/08/24 07:21:37 | 000,000,109 | —- | M] () – C:\mbam-error.txt
[2013/08/11 15:27:47 | 312,819,710 | -HS- | M] () – C:\pagefile.sys
[2010/04/18 21:36:06 | 000,000,764 | —- | M] () – C:\updatedatfix.log

< %systemroot%\Fonts\*.com >
[2006/11/02 11:06:41 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 11:06:41 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 11:06:41 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/09/15 10:23:47 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 17:35:48 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >
[2011/10/30 14:30:30 | 000,052,609 | —- | M] () – C:\Windows\system32\FLASHINGLIGHTS.jpg

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/01/20 23:21:59 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< dir "%systemdrive%\*" /S /A:L /C >
Volume in drive C is HP
Volume Serial Number is 149D-84AB
Directory of C:\
11/02/2006 11:42 AM Documents and Settings [C:\Users]
0 File(s) 0 bytes
Directory of C:\ProgramData
11/02/2006 11:42 AM Application Data [C:\ProgramData]
11/02/2006 11:42 AM Desktop [C:\Users\Public\Desktop]
11/02/2006 11:42 AM Documents [C:\Users\Public\Documents]
11/02/2006 11:42 AM Favorites [C:\Users\Public\Favorites]
11/02/2006 11:42 AM Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
11/02/2006 11:42 AM Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users
11/02/2006 11:42 AM All Users [C:\ProgramData]
11/02/2006 11:42 AM Default User [C:\Users\Default]
0 File(s) 0 bytes
Directory of C:\Users\All Users
11/02/2006 11:42 AM Application Data [C:\ProgramData]
11/02/2006 11:42 AM Desktop [C:\Users\Public\Desktop]
11/02/2006 11:42 AM Documents [C:\Users\Public\Documents]
11/02/2006 11:42 AM Favorites [C:\Users\Public\Favorites]
11/02/2006 11:42 AM Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
11/02/2006 11:42 AM Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Default
11/02/2006 11:42 AM Application Data [C:\Users\Default\AppData\Roaming]
11/02/2006 11:42 AM Cookies [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies]
11/02/2006 11:42 AM Local Settings [C:\Users\Default\AppData\Local]
11/02/2006 11:42 AM My Documents [C:\Users\Default\Documents]
11/02/2006 11:42 AM NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
11/02/2006 11:42 AM PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
11/02/2006 11:42 AM Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]
11/02/2006 11:42 AM SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]
11/02/2006 11:42 AM Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]
11/02/2006 11:42 AM Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Default\AppData\Local
11/02/2006 11:42 AM Application Data [C:\Users\Default\AppData\Local]
11/02/2006 11:42 AM History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]
11/02/2006 11:42 AM Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Default\Documents
11/02/2006 11:42 AM My Music [C:\Users\Default\Music]
11/02/2006 11:42 AM My Pictures [C:\Users\Default\Pictures]
11/02/2006 11:42 AM My Videos [C:\Users\Default\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Jack
08/19/2009 11:40 AM Application Data [C:\Users\Jack\AppData\Roaming]
08/19/2009 11:40 AM Cookies [C:\Users\Jack\AppData\Roaming\Microsoft\Windows\Cookies]
08/19/2009 11:40 AM Local Settings [C:\Users\Jack\AppData\Local]
08/19/2009 11:40 AM My Documents [C:\Users\Jack\Documents]
08/19/2009 11:40 AM NetHood [C:\Users\Jack\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
08/19/2009 11:40 AM PrintHood [C:\Users\Jack\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
08/19/2009 11:40 AM Recent [C:\Users\Jack\AppData\Roaming\Microsoft\Windows\Recent]
08/19/2009 11:40 AM SendTo [C:\Users\Jack\AppData\Roaming\Microsoft\Windows\SendTo]
08/19/2009 11:40 AM Start Menu [C:\Users\Jack\AppData\Roaming\Microsoft\Windows\Start Menu]
08/19/2009 11:40 AM Templates [C:\Users\Jack\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Jack\AppData\Local
08/19/2009 11:40 AM Application Data [C:\Users\Jack\AppData\Local]
08/19/2009 11:40 AM History [C:\Users\Jack\AppData\Local\Microsoft\Windows\History]
08/19/2009 11:40 AM Temporary Internet Files [C:\Users\Jack\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Jack\Documents
08/19/2009 11:40 AM My Music [C:\Users\Jack\Music]
08/19/2009 11:40 AM My Pictures [C:\Users\Jack\Pictures]
08/19/2009 11:40 AM My Videos [C:\Users\Jack\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Jack Work
08/19/2009 11:44 PM Application Data [C:\Users\Jack Work\AppData\Roaming]
08/19/2009 11:44 PM Cookies [C:\Users\Jack Work\AppData\Roaming\Microsoft\Windows\Cookies]
08/19/2009 11:44 PM Local Settings [C:\Users\Jack Work\AppData\Local]
08/19/2009 11:44 PM My Documents [C:\Users\Jack Work\Documents]
08/19/2009 11:44 PM NetHood [C:\Users\Jack Work\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
08/19/2009 11:44 PM PrintHood [C:\Users\Jack Work\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
08/19/2009 11:44 PM Recent [C:\Users\Jack Work\AppData\Roaming\Microsoft\Windows\Recent]
08/19/2009 11:44 PM SendTo [C:\Users\Jack Work\AppData\Roaming\Microsoft\Windows\SendTo]
08/19/2009 11:44 PM Start Menu [C:\Users\Jack Work\AppData\Roaming\Microsoft\Windows\Start Menu]
08/19/2009 11:44 PM Templates [C:\Users\Jack Work\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Jack Work\AppData\Local
08/19/2009 11:44 PM Application Data [C:\Users\Jack Work\AppData\Local]
08/19/2009 11:44 PM History [C:\Users\Jack Work\AppData\Local\Microsoft\Windows\History]
08/19/2009 11:44 PM Temporary Internet Files [C:\Users\Jack Work\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Jack Work\Documents
08/19/2009 11:44 PM My Music [C:\Users\Jack Work\Music]
08/19/2009 11:44 PM My Pictures [C:\Users\Jack Work\Pictures]
08/19/2009 11:44 PM My Videos [C:\Users\Jack Work\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Public\Documents
11/02/2006 11:42 AM My Music [C:\Users\Public\Music]
11/02/2006 11:42 AM My Pictures [C:\Users\Public\Pictures]
11/02/2006 11:42 AM My Videos [C:\Users\Public\Videos]
0 File(s) 0 bytes
Directory of C:\Windows\System32\config\systemprofile
10/01/2009 01:36 AM Application Data [C:\Windows\system32\config\systemprofile\AppData\Roaming]
10/01/2009 01:36 AM Cookies [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies]
10/01/2009 01:36 AM Local Settings [C:\Windows\system32\config\systemprofile\AppData\Local]
10/01/2009 01:36 AM My Documents [C:\Windows\system32\config\systemprofile\Documents]
10/01/2009 01:36 AM NetHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
10/01/2009 01:36 AM PrintHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
10/01/2009 01:36 AM Recent [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent]
10/01/2009 01:36 AM SendTo [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo]
10/01/2009 01:36 AM Start Menu [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu]
10/01/2009 01:36 AM Templates [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Windows\System32\config\systemprofile\AppData\Local
10/01/2009 01:36 AM Application Data [C:\Windows\system32\config\systemprofile\AppData\Local]
10/01/2009 01:36 AM History [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History]
10/01/2009 01:36 AM Temporary Internet Files [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Windows\System32\config\systemprofile\Documents
10/01/2009 01:36 AM My Music [C:\Windows\system32\config\systemprofile\Music]
10/01/2009 01:36 AM My Pictures [C:\Windows\system32\config\systemprofile\Pictures]
10/01/2009 01:36 AM My Videos [C:\Windows\system32\config\systemprofile\Videos]
0 File(s) 0 bytes
Directory of C:\Windows\SysWOW64\config\systemprofile
10/01/2009 01:36 AM Application Data [C:\Windows\system32\config\systemprofile\AppData\Roaming]
10/01/2009 01:36 AM Cookies [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies]
10/01/2009 01:36 AM Local Settings [C:\Windows\system32\config\systemprofile\AppData\Local]
10/01/2009 01:36 AM My Documents [C:\Windows\system32\config\systemprofile\Documents]
10/01/2009 01:36 AM NetHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
10/01/2009 01:36 AM PrintHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
10/01/2009 01:36 AM Recent [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent]
10/01/2009 01:36 AM SendTo [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo]
10/01/2009 01:36 AM Start Menu [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu]
10/01/2009 01:36 AM Templates [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Windows\SysWOW64\config\systemprofile\AppData\Local
10/01/2009 01:36 AM Application Data [C:\Windows\system32\config\systemprofile\AppData\Local]
10/01/2009 01:36 AM History [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History]
10/01/2009 01:36 AM Temporary Internet Files [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Windows\SysWOW64\config\systemprofile\Documents
10/01/2009 01:36 AM My Music [C:\Windows\system32\config\systemprofile\Music]
10/01/2009 01:36 AM My Pictures [C:\Windows\system32\config\systemprofile\Pictures]
10/01/2009 01:36 AM My Videos [C:\Windows\system32\config\systemprofile\Videos]
0 File(s) 0 bytes
Total Files Listed:
0 File(s) 0 bytes
98 Dir(s) 419,170,439,168 bytes free

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/05/21 00:24:53 | 000,000,286 | -HS- | M] () – C:\Users\Jack\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2013/05/13 00:17:28 | 000,628,743 | —- | M] () – C:\Users\Jack\Desktop\AdwCleaner.exe
[2013/05/13 00:18:59 | 004,745,728 | —- | M] (AVAST Software) – C:\Users\Jack\Desktop\aswMBR.exe
[2013/08/11 15:44:06 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Jack\Desktop\OTL.exe
[2013/05/13 00:17:09 | 000,890,825 | —- | M] () – C:\Users\Jack\Desktop\SecurityCheck.exe
[2009/11/03 18:10:13 | 000,874,736 | —- | M] (LogMeIn, Inc.) – C:\Users\Jack\Desktop\Support-LogMeInRescue.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:DFC5A2B2
@Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:5C321E34
@Alternate Data Stream - 102 bytes -> C:\ProgramData\Temp:430C6D84

< End of report >

Hi and Welcome!! jaclyn

My name is Robybel.

I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Vista and Windows 7 users:

These tools MUST be run from the executable. (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

Having said that….Let's get going!!

========================


Run OTL.exe

• Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
  
  

  :OTL
  IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…ion&pf=cndt
  IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…ion&pf=cndt
  IE:64bit: - HKLM\..\SearchScopes\{9D5D0B21-D8A6-413C-BAD3-235D5C74DD3E}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
  IE:64bit: - HKLM\..\SearchScopes\{CFA351F7-F131-439E-98E7-1F52AD440B6C}: "URL" = http://search.live.com/results.aspx?q={sea…amp;FORM=HPDTDF
  IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…ion&pf=cndt
  IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…ion&pf=cndt
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…ion&pf=cndt
  IE - HKCU\..\SearchScopes\{3338EA82-1724-430B-BB5E-06132283ED37}: "URL" = http://search.conduit.com/ResultsExt.aspx?…537128&UM=2
  FF - user.js - File not found
  O1 - Hosts: 127.0.0.1 localhost
  O1 - Hosts: ::1 localhost
  O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
  O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
  O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
  O4 - HKLM..\Run: [] File not found
  O4 - HKCU..\Run: [doubleTwist] C:\Program Files (x86)\doubleTwist 2.0\DoubleTwist.DeviceHelper.exe File not found
  O4 - HKCU..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED File not found
  O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe File not found
  O8:64bit: - Extra context menu item: Open with WordPerfect - c:\Program Files (x86)\Corel\WordPerfect Office X5\Programs\WPLauncher.hta File not found
  O8 - Extra context menu item: Open with WordPerfect - c:\Program Files (x86)\Corel\WordPerfect Office X5\Programs\WPLauncher.hta File not found
  O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
  O18:64bit: - Protocol\Handler\livecall - No CLSID value found
  O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
  O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
  O18:64bit: - Protocol\Handler\msnim - No CLSID value found
  O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
  O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll File not found
  O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll File not found
  O33 - MountPoints2\{661b48ca-ae41-11e1-ae33-002354493431}\Shell - "" = AutoRun
  O33 - MountPoints2\{661b48ca-ae41-11e1-ae33-002354493431}\Shell\AutoRun\command - "" = J:\setup.exe -a
  [2013/05/12 09:49:05 | 000,000,000 | —D | M] – C:\Users\Jack\AppData\Roaming\uTorrent
  @Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:DFC5A2B2
  @Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:5C321E34
  @Alternate Data Stream - 102 bytes -> C:\ProgramData\Temp:430C6D84
  
  :Files
  ipconfig /flushdns /c
  
  
  :Commands
  [EMPTYFLASH]
  [REBOOT]
  [RESETHOSTS]
  [CREATERESTOREPOINT]

• Then click the Run Fix button at the top
• Let the program run unhindered.
• OTL may ask to reboot the machine. Please do so if asked.
• The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

Next

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Next

AdwCleaner

• Please download AdwCleaner by Xplode onto your desktop.
• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click on Delete.
• Confirm each time with Ok.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next answer.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.

Next

[external image: Posted Image] Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

Next

• Download RogueKiller and save it to your desktop.
• Quit all other programs
• Start RogueKiller.exe
• Wait until the Prescan has finished …
• Click on Scan
  [external image: Posted Image]
• Wait for the end of the scan
• A report will be created on your desktop.
• Click on the Delete button
  [external image: Posted Image]
• Next click on the ShortcutsFix
  [external image: Posted Image]
• another report will be created on your desktop.

Please post: All RKreport.txt text files located on your desktop.

On your next reply please post :

• OTL log after fix
• checkup.txt
• AdwCleaner[S1].txt
• JRT.txt
• All RKreport.txt

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9D5D0B21-D8A6-413C-BAD3-235D5C74DD3E}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D5D0B21-D8A6-413C-BAD3-235D5C74DD3E}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CFA351F7-F131-439E-98E7-1F52AD440B6C}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFA351F7-F131-439E-98E7-1F52AD440B6C}\ not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{3338EA82-1724-430B-BB5E-06132283ED37}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3338EA82-1724-430B-BB5E-06132283ED37}\ not found.
127.0.0.1 localhost removed from HOSTS file successfully
::1 localhost removed from HOSTS file successfully
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{472734EA-242A-422B-ADF8-83D1E48CC825} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{472734EA-242A-422B-ADF8-83D1E48CC825}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\doubleTwist deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\uTorrent deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\WMPNSCFG deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Open with WordPerfect\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Open with WordPerfect\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\grooveLocalGWS\ deleted successfully.
File Protocol\Handler\grooveLocalGWS - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\livecall\ deleted successfully.
File Protocol\Handler\livecall - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ deleted successfully.
File Protocol\Handler\ms-help - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-itss\ deleted successfully.
File Protocol\Handler\ms-itss - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msnim\ deleted successfully.
File Protocol\Handler\msnim - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype4com\ deleted successfully.
File Protocol\Handler\skype4com - No CLSID value found not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\livecall\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{828030A1-22C1-4009-854F-8E305202313F}\ deleted successfully.
File {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll File not found not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msnim\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{828030A1-22C1-4009-854F-8E305202313F}\ not found.
File {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll File not found not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{661b48ca-ae41-11e1-ae33-002354493431}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661b48ca-ae41-11e1-ae33-002354493431}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{661b48ca-ae41-11e1-ae33-002354493431}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{661b48ca-ae41-11e1-ae33-002354493431}\ not found.
File J:\setup.exe -a not found.
C:\Users\Jack\AppData\Roaming\uTorrent\dlimagecache folder moved successfully.
C:\Users\Jack\AppData\Roaming\uTorrent\apps folder moved successfully.
C:\Users\Jack\AppData\Roaming\uTorrent folder moved successfully.
ADS C:\ProgramData\Temp:DFC5A2B2 deleted successfully.
ADS C:\ProgramData\Temp:5C321E34 deleted successfully.
ADS C:\ProgramData\Temp:430C6D84 deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Jack\Desktop\cmd.bat deleted successfully.
C:\Users\Jack\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: AppData

User: Default

User: Default User

User: Jack
->Flash cache emptied: 332410 bytes

User: Jack Work
->Flash cache emptied: 2311 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.
HOSTS file reset successfully
Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 08132013_073430

Files\Folders moved on Reboot…
File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.

PendingFileRenameOperations files…

Registry entries deleted on Reboot…

Results of screen317's Security Check version 0.99.63
Windows Vista Service Pack 2 x64 (UAC is disabled!)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
AVG AntiVirus Free Edition 2013
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
SpywareBlaster 5.0
Spybot - Search & Destroy
Malwarebytes Anti-Malware version 1.75.0.1300
Java 7 Update 21
Java™ 6 Update 7
Adobe Flash Player 11.6.602.180
Mozilla Firefox (20.0.1)
Google Chrome 26.0.1410.43
Google Chrome 26.0.1410.64
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
AVG avgwdsvc.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0 %
````````````````````End of Log``````````````````````

# AdwCleaner v2.306 - Logfile created 08/13/2013 at 07:53:38
# Updated 19/07/2013 by Xplode
# Operating system : Windows ™ Vista Home Premium Service Pack 2 (64 bits)
# User : Jack - JACK-PC
# Boot Mode : Normal
# Running from : C:\Users\Jack\Desktop\AdwCleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Deleted on reboot : C:\Program Files (x86)\Zynga
Deleted on reboot : C:\Users\Jack\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Deleted on reboot : C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\StumbleUpon

***** [Registry] *****

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{4EF8BE6A-899C-4196-94E7-297C5F7A203E}
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16496

[OK] Registry is clean.

-\\ Mozilla Firefox v20.0.1 (en-US)

File : C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\prefs.js

[OK] File is clean.

File : C:\Users\Jack Work\AppData\Roaming\Mozilla\Firefox\Profiles\6jtc6ps7.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v28.0.1500.95

File : C:\Users\Jack\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

-\\ Opera v12.15.1748.0

File : C:\Users\Jack\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[S1].txt - [17958 octets] - [13/05/2013 00:22:11]
AdwCleaner[S2].txt - [2208 octets] - [13/08/2013 07:53:38]

########## EOF - C:\AdwCleaner[S2].txt - [2268 octets] ##########

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.4.5 (08.13.2013:1)
OS: Windows ™ Vista Home Premium x64
Ran by [removed] on Tue 08/13/2013 at 23:55:33.80
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Jack\appdata\local\cre"
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{01917B86-8A6D-4D67-A2F4-36D22134E5ED}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{019A8847-6E9D-4388-A4BE-EFB657747953}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{02C7020C-0671-41B6-A237-67B147C92244}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{033DDD5E-3010-46E4-94AA-4B0C47560CBB}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{04A06F9E-18AA-4E0F-8D01-A39EB2EA377C}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{058C0013-901D-4C8F-88BB-3E778D1BC864}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{067E7739-B31A-4E97-B250-2EEE12D3C02D}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{087B0815-7B03-4D26-BDC9-2A27A59181C9}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{093FB2EA-CE0A-45E0-B168-696F56509560}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{0A7FE265-000D-47B9-B00E-EDB23151FE5A}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{0B899E17-F9ED-4904-811B-9B9499E464FA}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{0D2F634B-5BF2-43DA-A106-F6C43EA07E0B}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{0D4352A6-B3F5-40CE-B4B5-38D578AE22DE}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{0F185954-020C-414E-B6CB-3A6C9B53D0FB}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{0F61AA03-9D18-4C34-B72E-E389E1F71253}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{11AD6A97-C895-46DA-870E-99227AC2CE5A}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{11FB1A41-ECD9-43D8-AF7F-3717A04A8A54}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{1225421A-EC24-4459-9B6F-5C6F2A301ABC}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{1396EDE6-D4BC-4315-8182-42BA821DCC83}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{13C5A67C-E47D-47A2-AB9F-5F82F2364A61}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{1501A8AC-25CF-4AF8-89AA-CAB1F162055B}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{1711552C-694B-4F58-B150-C2D32DDFCE76}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{17D8886F-B809-4FF0-854B-93100A3EE3F7}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{17DBD12F-FD5F-4285-947C-3288B21B0F93}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{1831E9F9-D227-418D-B901-DDA6D66BAFF6}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{187045C4-B366-46D5-840D-B28C3EC93D20}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{194C4996-E114-4770-8DCD-5DDC50C1C526}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{1AE6D1D9-20D4-401C-AF78-44914795B185}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{1AF38CFE-067C-4B56-8E71-348E806A16EE}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{1C1B1950-7F98-40FE-92C4-318DF5C82952}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{1C59B332-3A42-4208-BD53-D153BDAE293B}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{1CEA742A-207D-4BEE-8CBE-9EC307E0DFA0}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{1F1E94F3-B133-48A0-AE79-598BAFAA5922}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{1F9FF30E-CA25-40BF-91F3-5229EC438559}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{20A4B2C2-1EB6-49B4-ACDF-866DC6D2BFC5}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{2148B746-5975-401B-BD45-E4FD85BB6662}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{231A9DD3-38A8-4504-9700-F8DE7AB398A1}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{24C24AB5-2150-4E4B-AE9A-CDB76B77A033}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{253DE4F8-7634-4CB5-9FD3-0CA862AE6F8F}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{26F27F6B-034B-4A8D-8A83-FAEF38E90777}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{275B9716-5E75-43E0-9189-6BB99E2F6441}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{2927B98D-009C-47AD-B212-F705D4FBE43A}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{2C32CC64-4518-467B-94A9-72A0190395D4}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{2C645FEA-9783-4785-84AF-DEFD43D22688}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{304886DB-495D-4F40-847E-803650DBD1AE}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{307D611E-41FD-47ED-8432-AC0DF92A4B3E}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{315F97F3-D12F-47EE-A6A2-72DA03626460}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{32687C89-38C4-4B27-822C-52D019EDCFB3}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{3298867A-2EF2-4762-A92E-6077338F9B66}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{33A07E6F-5CC8-43B2-A630-8D2C7D50399F}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{33BF88D3-890A-42F8-9F88-9DBE972ED9C2}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{3420BF52-739E-4010-8581-B8B9E2F6DEB7}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{3437986F-2B17-4650-B547-E7862F911F51}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{3508810E-7772-4A20-9CEC-71CFB66337C8}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{351F826B-D6B4-4247-A874-CE1D47D7C97C}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{367CC937-7FF7-4BEE-9B76-41D4951CC140}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{3688CBC1-56A7-4134-8036-1B19EEBF90BD}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{36DB5EF0-2096-4085-9BEC-C40F40469AC3}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{371918E7-586D-48B9-9E24-B95132A5DE36}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{3794D5BC-CE23-4080-9CFF-4D590CA3D42A}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{37B0488E-9E99-4685-A896-4C6DB23FA621}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{3848697B-E9A1-487F-87C6-631BD0BC80EA}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{399C4030-7EA3-4A71-8F30-EA8F66597E9E}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{3B89716E-291C-4731-9782-739FF5F9A940}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{3CACD510-EC7D-4F1D-82E5-6199247FE351}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{3CE527F1-6292-412C-BB3C-FEE8D99163D6}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{3D610425-417A-4A68-8D71-5935008B5506}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{3D90A071-3B60-41EE-9A08-EBE2A31F605D}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{3D95B8D5-9FC3-4172-A1AF-2BB8C190E48D}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{3DAEEC94-9C67-4E3A-B9BD-B5155EA704FC}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{3DCF712F-9F01-479F-8196-730F82F26298}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{3EE96524-5446-4E2F-B1BE-5859AD3D990C}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{3FCDADA7-54CE-4B99-9B17-7450C51405EC}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{4208F5AF-BA65-4AF2-B02E-BA1D5D475BE2}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{42859BDD-044D-4780-A46D-E949A4ABF268}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{4293ACA1-211B-417B-AFB3-DC824AD151D7}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{44D426FB-B591-415D-8169-1FA36C5E0D30}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{458BD7D0-5009-4F9F-B83A-B036162764E5}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{45DF263A-3605-4C0A-94A9-1ACCCFECEB43}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{4770C36B-AC09-4ABF-8DB3-5E70E3A6353A}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{487724A8-8951-43DD-94C4-62B5786F47A1}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{487FB6BB-956B-4EE4-BE38-8B5335F17011}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{488C9BED-B727-4973-9D3C-727B19A0F3D0}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{48EADB15-3603-4993-A510-199604DD3FAD}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{49A7DE60-AC0C-448F-8C4A-C846B88B7BB0}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{49D8BB06-DC3F-48A8-BDB3-0ACAA2BB5CB6}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{4C026B00-A172-44D9-A599-4B2727BF1546}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{4C225B15-F4BB-44AC-919F-A7F61D634A2F}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{4CB99985-5CBB-41F5-9DA0-207DBB2141BB}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{4D18A811-D841-44A9-B476-8A96B9A5256B}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{4D5B223C-284F-412C-82EB-717921898AF9}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{4D5B68F9-A53E-45E2-8520-6E7C3AB60A2E}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{4EAF0DA3-271C-4EF0-AA95-6B9697B9A963}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{5040D9B2-65B3-44E2-A2AB-359BDA9DABED}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{5064C07D-E92F-4C43-BD7E-64A7BAC691FB}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{507251E5-74C4-48CB-9605-9AE66F67B2FF}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{50CE2C05-C723-4332-90BD-85A06F3205CA}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{5223D7D8-AB2E-4927-ACBA-477E20BCAEF4}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{53144F55-0F1D-4307-B437-2515324D2D16}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{5371F75E-3C19-4185-BEAC-D5237BD6C8F0}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{549E209F-E677-4E46-AD3B-60DBCD448119}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{54F4001A-0701-41E4-97C6-72BC6F514BE9}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{558825D1-1311-47B4-80EF-E0B817DE20CB}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{57AF052D-457B-479E-B074-4277D6A9A659}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{58C4DAB9-AAE2-46F2-91F0-46302978EA63}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{593B3160-AADA-4E53-B114-286402D8108F}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{59B0D72A-E96D-4E7A-B1DC-960408814BAB}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{5AD97A25-9945-4298-AF5E-91C53FE5F09E}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{5B258C09-C03B-49F4-87B0-E3E24C49CDE0}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{5C19D810-C3A2-45F1-82FC-F149458F6F91}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{5D589A34-8DE9-4933-9A5D-CB737C5182F9}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{5DBB7647-95B3-40F7-BE81-497226F2D4D0}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{5DFEF1E4-F867-4389-B072-10B827C01664}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{5E68C175-BC65-4F2D-981E-DE8420637308}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{5EB27441-DCA3-400E-9733-67E325B07F7D}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{62BC54B7-2925-4D4B-BEE3-BE5A0B29AD15}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{6388692C-8B41-42C6-BBE1-0566B41B0AC5}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{65C54121-9569-4E93-978D-D814D6482065}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{662DE043-F351-47AA-97DE-F6675EA1EF08}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{66ABBDC1-A5E6-4836-8CC6-A3560C3DE935}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{67563912-318A-40F3-9383-F62DDCB4C352}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{680659A8-1BAB-4188-B1B2-CDA38D155361}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{69D4FF92-ABEF-41B1-9D81-EC8E79856B03}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{6A771B38-18FB-40BD-950E-826490D2764C}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{6AC69632-F1EA-4579-9BD0-6CF19A933B4F}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{6B5D3AEB-F9CD-468A-A186-09B22818AD7A}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{6B913404-B3B4-4133-BE7F-57A14E1B6A24}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{6D5FBD32-1103-4D0B-A783-E463A4EEFCF2}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{6D74D4FB-BAEE-44A7-8215-E92876E6BFF2}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{6E0AAF6A-1C2E-462C-99CC-9A22C01D3F67}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{6E1EF43C-FEF2-48D8-971A-06B4223ED762}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{6ED3DD5A-2493-4150-B903-AD0C32DB560B}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{6FD1828D-7861-42F7-80BC-C0152D529E2C}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{7432233A-62F3-4002-A78F-5BD08DE08DB1}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{7438869D-2306-4630-959C-F31AE252447B}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{7467FB1B-E54F-44E9-87FF-5BD00322FA92}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{75D08D68-02F8-4C01-BB4F-95DD083D83D0}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{77BB5CDB-6B51-41DA-A2C5-1340610F2EE0}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{77C4F8B0-73B6-4DD9-ACFD-BA3B67195F68}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{78142B6E-5E3D-4BCD-A17F-3105804423F4}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{78EDFDA7-5263-470D-B6A5-41D91F47C638}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{799A6063-C345-48CB-A33D-82F0AA1515F4}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{7AF1F237-57C6-4B51-B6DE-B7E9F5FB4E20}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{7BB6DD09-A522-4E72-86AE-1E9457602B2A}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{7D083CD8-F0A4-4740-AF5C-61523A808526}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{80511C4C-2A96-437A-9A4D-D06930895FE0}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{80B47189-F64D-4312-B7BD-95498FC25A20}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{8109A318-D7C7-4C77-94D0-B6B9026F53B7}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{81E51B4C-D041-4FB0-9720-6258E3B34923}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{824BD421-80AA-45EE-9AD5-9DA202C0E780}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{8398C5F1-DBA1-42C5-B32B-61AB8EF3EE1B}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{83C4D694-9196-45FA-B92F-3BF1614D19A9}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{842F3CA6-5B1F-4A54-B405-F66D1B2C1D1C}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{84E639FF-5BF9-46C5-91B9-250AE9EBA9A1}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{86F4EFBE-68D3-42F6-AF00-6A77F68FAEF6}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{877B0B4A-6308-4422-B3B1-CE8F1433F3A3}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{87A3B927-0EED-4714-801C-3C9B9BD3EF8B}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{8921D39C-7826-4751-AF59-8F13FC5EE527}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{89EA75D5-191B-4549-8A23-191FFF1A1337}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{8C462493-593F-474B-A06A-92408B5613D3}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{8DEFFC60-AE4F-4AD4-B24C-066256191386}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{8E0D98E9-1182-48F4-9929-CBA02431BB28}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{8E53B1A8-A62A-4E81-BF7C-C005D29CECE0}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{8F1A7502-28E3-4155-8FB4-F14DD0E61AE8}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{8F5F2941-CC43-4AAA-BF3B-79F2D6F6D9E1}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{8FD6DFD0-E4E8-4AD8-A679-2B7293B3EF4F}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{90358ABB-5E5C-4777-92E6-EDE11F3649AE}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{93261E97-2164-4A04-B008-34214EE9E5D4}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{9380AD38-5EF8-433A-B434-1D4D8C57F94B}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{95308AB9-6793-4CB6-8EFF-8062E2D67BB3}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{95BD4A4B-1DAA-454C-81DC-6EBA290AD13D}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{95DF6F71-57C5-4711-A90E-A69F42146D60}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{96107B5F-EEC9-4E8E-8200-D0149DD30C90}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{97E26D34-7A19-42ED-ABDF-40DFD331279B}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{994619E2-4B52-41B2-BF8D-0CD02709E061}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{99B6ECDC-E4CC-4789-9BF7-D80117A9F390}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{9A1F11FF-8EAA-4E62-93A8-AD8531FDD2B3}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{9B35DE67-BAB4-42B7-8DCD-AD44A9BB6FFE}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{9B8880A4-205A-4EAB-821F-0FC4117AA69A}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{9BE1C3CB-891D-4C6F-924F-D6576055F77A}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{9CD233F5-EF7F-486C-8336-D4C34384CB6C}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{9F174EF6-1B3F-43D5-B210-EFF38985FE72}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{9F4624FE-0740-44E8-AF26-9D2166D94BA4}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{9FC29263-EB62-49B5-A969-D71E698A2EAA}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{A0F250BB-1B95-48A1-AD21-2B4C15BA53AA}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{A1CDCD66-11F9-4D9B-B255-86B304CBC7CF}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{A36A0ECD-3DFF-4994-8DA9-FD8376E2A850}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{A3D15710-04A1-4F23-BBAA-F3D2FF5CC665}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{A4270499-B5E9-4FD1-96E8-FB31DC513E92}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{A4D5423A-887C-4555-993E-1FC3A932F941}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{A569085E-9D02-4051-8CA4-B53A36929DD0}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{A6319291-AEC3-4307-8881-E37732B106E5}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{A7014429-9CB1-421C-8EB2-4CD1A4505E24}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{A70D4DBF-8533-4DBD-91CB-A0BFF47C596B}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{A9E44EB2-98AB-4C5C-942D-2E79EB761AA5}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{AA26B4E4-5397-4F96-A89F-D89894AC42ED}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{AB5C8E0F-9E9C-46F3-91D3-C06F80728F15}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{AD2948EA-AE18-48D4-BE94-70FA268C4AF4}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{AE71DFD8-5D4D-48F7-AC90-EF1794994EF9}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{AEB0194B-4882-42A4-8F79-D71DA1EFD944}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{AEF12E81-2740-4F6D-865F-987F7F96F4C4}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{AF59E058-A105-43C9-B1B3-6031383752BB}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{AF6242FC-D4B3-4B53-8B27-87ED8CC55471}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{AFE18B18-2FB8-4EF9-AF0A-0668163AA912}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{B0B4CC0A-7562-4C64-89E8-7C8780115A75}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{B1780335-2A47-4E9D-B719-CAE4C6CBBAF5}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{B2BCBDA8-D5C2-407A-A676-FD16A5C58E4A}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{B30911B1-2A3E-4665-9950-23EB0E80E62B}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{B30EF523-B45A-403C-B0B4-A403936BA567}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{B390CB79-8408-4E89-96BB-29C8E9D1BF8E}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{B3E2A428-E190-468F-A165-3FA03C06F454}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{B4AAF16F-76EE-4CC0-AB72-DD996173C844}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{B4AD3EBD-65B4-44EA-861D-533A7F533252}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{B4EF2F66-5FFD-4B7B-BDE8-55C7DCF60C19}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{B7DF7755-EE02-40A6-B072-EAC08AE47DE6}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{B8286A88-519B-4E72-AADA-CC104ABF168C}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{B8519A2A-ACDD-4D5E-B2B0-6A617557F7FB}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{B930FEF3-4AF4-44AE-902E-F9048D6AFE74}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{BA71A0E4-52D5-444D-88DB-ADF6213CAA43}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{BB4A3E84-FD6F-4C11-8397-DA0BC0EF3508}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{BB55D151-D7AB-47FB-980F-83B1F532C1FD}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{BC7CD0A4-3301-49D7-A88B-242B7C174D6E}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{BCD3B9FF-3A1C-473D-BDCC-F0E9F30A9AF0}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{BCF88778-1D55-4853-9FFD-503EB88CA63B}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{BD11F1FA-BC24-48BB-9C99-96C6CD240704}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{BD1B7D80-107F-4A3C-BDB0-BA3EBDD3281A}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{BE4D7079-F6C9-462D-B13D-2FE048ADAB90}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{BF4E7775-AB23-4637-ACC0-BA5999368C61}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{BF5A531A-F438-4CD3-81FF-DC5C0C0923BF}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{BF89E016-A4EC-4ED5-8B9C-DE39D6459840}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{C1CF5663-3BE1-4A8E-8BA4-492F5E2BC001}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{C21AD008-2475-4769-BC83-2470194FB269}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{C284D22E-21DB-41FF-A9BD-54DE48278CF1}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{C3D7CB96-1C75-4026-BBC9-B1F0B1B007B2}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{C4A7EFD2-91B2-4BF2-8CDB-70E2AE6895B2}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{C62738D8-1B6D-4F46-9D77-729E6914CD95}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{C690663A-52C6-47DA-8314-59C9A5108F47}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{C6E6F552-A1EC-4D2F-BD9E-04753440C90A}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{C73BF23C-E0A3-4C05-A304-593219569977}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{C775CC68-1B87-4B37-A05C-CA16DD59D15B}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{C7E99066-D06D-4C4B-987B-C54BE7F6E489}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{C9DF1884-628C-43E3-882E-2F40482797DF}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{CA24F661-28B0-407D-BDAA-884838C6018C}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{CAB8FCC9-78A6-40BF-9097-AB5E6B18FF9F}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{CBC46065-0F6B-4DBF-A077-4482DDF9A60A}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{CC330729-DD2E-4C57-8970-3E8F1F3AC767}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{CED21C22-DD7D-4AFF-8C08-479348244D86}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{CF910EE9-3EA6-4297-95E6-52B08BF45A50}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{D07BB75D-0589-4C60-A866-628F65326265}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{D20FBB7E-0BCE-4D7B-8846-975A2672A383}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{D2204BE1-EA24-471B-A2AE-BE4F395D594D}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{D30231E4-C0F2-4662-A2B0-E5E6FD1797B5}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{D4CC098A-2D74-46A6-AB68-61382858E635}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{D61EBC7D-CD56-46B6-884E-50500C6220A1}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{D7B9F8E2-D03D-4054-8365-A645A99AA7A9}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{D7DF05B9-5F3C-4251-9FAF-CB73B21F3330}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{D8A14246-DDB0-4F75-9889-B979C61C7CE5}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{D8C5B37D-DAA3-496B-AF69-C02E6A385DFD}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{D967922B-0757-43C2-BC85-412CAEC25746}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{D977FB2A-5849-4A24-BCA7-29E2B4F587F3}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{D9B7BACA-2A7D-4B42-940D-B8FE21B03A29}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{DA7B4368-E9BD-473F-B662-F1FDC5E80BD3}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{DAE92603-5EAD-4433-8ECA-9B6F5900872D}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{DB11027B-35D4-4124-96C6-4C3947B64691}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{DCC1BD2B-C9D4-4AD6-901B-AEFF5E04078A}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{DD1E14FF-E521-4497-A4FC-D9CC33E4D7C9}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{DD5A1356-0F57-44C8-B01B-BA0239CAD5B7}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{DDA82C80-83B5-483A-9942-9A1ACB9FBFCF}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{DE6CACD6-8E57-4462-A324-54F3910B7C59}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{DE7B36BF-21A4-450D-ACB6-92A652F1A34E}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{DEB627E4-3624-4800-8FAB-B47D943FC866}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{DFCD868F-96B0-420E-92BF-68A20F918F2C}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{E08BBE8C-A1F6-4E20-81C1-E65990FA210F}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{E09D792E-BBE3-47D7-96C8-6E922E2793DE}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{E341D7BD-7AAC-433B-92CA-00E35FD2A530}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{E4F43A1F-095F-401A-815C-488B2BD37B04}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{E621B52C-85B4-4D3C-B892-ACB006584B74}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{E67F6EDE-6B83-4CC4-B6B8-090B5D6D326C}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{E706AC7D-F180-4CD4-B2B6-24F4347D2EAC}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{E709B478-9B20-42DA-AFF7-3BA4DADB6AE3}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{E73CD4BF-D305-499D-91D4-8BAEB5A3E8EE}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{E8666074-9732-40A9-8BDA-E99DBD11D956}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{E997FC0E-C2DA-428B-835E-AA9EA78FD0F4}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{E998214E-C64D-46E6-B433-ABD207BFCD79}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{E9CEECBF-B6E1-4F9C-8797-73302415CC21}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{EA061A54-6544-407D-96B3-63CB63A4B00C}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{EC57F1F3-351B-4E3A-96FB-1AFDB0C99EDA}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{ED59F302-030B-46F5-A683-32D062157149}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{EF804871-0D45-41E8-8301-45746B88C46B}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{EFA206C6-7571-4227-9E6A-33B07CFB8CD3}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{F0CF401B-8D2B-4804-B8BA-435B2A4ACD3E}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{F107F849-0488-42C1-869A-6BDF51403930}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{F179F18D-2AEA-4329-A0D3-CC271BBF293E}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{F1A6BBE1-4ED9-49C6-9E77-551D18DBE509}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{F1FC4A17-99B2-4A98-903C-D448C184F0E1}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{F2D99024-A454-41A4-B7EC-E5627ED7CE9B}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{F37EBCBA-EDA2-499F-8D60-BA276D13A880}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{F3812763-0B78-40B5-9CE6-EC8FBD50AF6E}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{F3978E27-D7B5-46AB-B78A-B0712895D687}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{F4520856-3C97-4316-B3E7-98FACE9CD593}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{F56FA6B0-A960-489A-94F8-582286CDFBBF}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{F5E2771C-6F4B-406A-968F-BEB395FD23F8}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{F95C84F7-4999-4954-829F-179DEB178EA9}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{FA2F8D93-C365-4118-A02C-DFE79BB4BB3E}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{FA72D7A1-6A86-4E76-A0FB-41EF26943FC0}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{FAF9A2A9-401F-4A6C-B74A-1CC0FA874219}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{FB64A080-C656-4EFC-88CB-50D9AB26F506}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{FB889A09-7D2C-4369-BD59-A27DFA6FB8E4}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{FE5B56C6-CE55-478A-BC4D-E05BAEE5A7B7}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{FE62BB0C-6F0D-4788-8259-7873FDD5C9F6}
Successfully deleted: [Empty Folder] C:\Users\Jack\appdata\local\{FFE3E50B-6C0B-453D-BE8F-5DA23EF50EDE}



~~~ FireFox

Successfully deleted: [Folder] "C:\Program Files (x86)\Mozilla Firefox\extensions\[removed]"
Successfully deleted the following from C:\Users\Jack\AppData\Roaming\mozilla\firefox\profiles\li3ujspd.default\prefs.js

user_pref("browser.bdtoolbar.search_searchbar", false);
user_pref("[removed]-event-fired", true);
Emptied folder: C:\Users\Jack\AppData\Roaming\mozilla\firefox\profiles\li3ujspd.default\minidumps [11 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 08/14/2013 at 0:02:21.88
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

RogueKiller V8.6.5 _x64_ [Aug 5 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows Vista (6.0.6002 Service Pack 2) 64 bits version
Started in : Normal mode
User : Jack [Admin rights]
Mode : Scan – Date : 08/14/2013 00:05:54
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 8 ¤¤¤
[RUN][SUSP PATH] HKCU\[…]\Run : Google Update ("C:\Users\Jack\AppData\Local\Google\Update\GoogleUpdate.exe" /c [7]) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-21-90513374-351519211-1811497972-1000\[…]\Run : Google Update ("C:\Users\Jack\AppData\Local\Google\Update\GoogleUpdate.exe" /c [7]) -> FOUND
[HJ POL] HKCU\[…]\System : DisableTaskMgr (0) -> FOUND
[HJ POL] HKCU\[…]\System : DisableRegistryTools (0) -> FOUND
[HJ POL] HKLM\[…]\System : EnableLUA (0) -> FOUND
[HJ POL] HKLM\[…]\Wow6432Node\[…]\System : EnableLUA (0) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 4 ¤¤¤
[V1][SUSP PATH] GoogleUpdateTaskUserS-1-5-21-90513374-351519211-1811497972-1000UA.job : C:\Users\Jack\AppData\Local\Google\Update\GoogleUpdate.exe - /ua /installsource scheduler [7][x] -> FOUND
[V1][SUSP PATH] GoogleUpdateTaskUserS-1-5-21-90513374-351519211-1811497972-1000Core.job : C:\Users\Jack\AppData\Local\Google\Update\GoogleUpdate.exe - /c [7] -> FOUND
[V2][SUSP PATH] GoogleUpdateTaskUserS-1-5-21-90513374-351519211-1811497972-1000Core : C:\Users\Jack\AppData\Local\Google\Update\GoogleUpdate.exe - /c [7] -> FOUND
[V2][SUSP PATH] GoogleUpdateTaskUserS-1-5-21-90513374-351519211-1811497972-1000UA : C:\Users\Jack\AppData\Local\Google\Update\GoogleUpdate.exe - /ua /installsource scheduler [7][x] -> FOUND

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
–> %SystemRoot%\System32\drivers\etc\hosts


ÿþ1

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: SAMSUNG HD753LJ +++++
— User —
[MBR] d5b0f6c4faaf7078d2dfe30a3dbc11d5
[BSP] 75fa2fd6adc9252bfbacafe2701b9baf : MBR Code unknown
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 701902 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 1437496200 | Size: 13499 Mo
User = LL1 … OK!
User = LL2 … OK!

+++++ PhysicalDrive1: SAMSUNG HD753LJ +++++
Error reading User MBR!
User = LL1 … OK!
Error reading LL2 MBR!

+++++ PhysicalDrive2: SAMSUNG HD753LJ +++++
Error reading User MBR!
User = LL1 … OK!
Error reading LL2 MBR!

+++++ PhysicalDrive3: SAMSUNG HD753LJ +++++
Error reading User MBR!
User = LL1 … OK!
Error reading LL2 MBR!

+++++ PhysicalDrive4: SAMSUNG HD753LJ +++++
Error reading User MBR!
User = LL1 … OK!
Error reading LL2 MBR!

Finished : << RKreport[0]_S_08142013_000554.txt >>

RogueKiller V8.6.5 _x64_ [Aug 5 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows Vista (6.0.6002 Service Pack 2) 64 bits version
Started in : Normal mode
User : Jack [Admin rights]
Mode : Remove – Date : 08/14/2013 00:06:59
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 8 ¤¤¤
[RUN][SUSP PATH] HKCU\[…]\Run : Google Update ("C:\Users\Jack\AppData\Local\Google\Update\GoogleUpdate.exe" /c [7]) -> DELETED
[RUN][SUSP PATH] HKUS\S-1-5-21-90513374-351519211-1811497972-1000\[…]\Run : Google Update ("C:\Users\Jack\AppData\Local\Google\Update\GoogleUpdate.exe" /c [7]) -> [0x2] The system cannot find the file specified.
[HJ POL] HKCU\[…]\System : DisableTaskMgr (0) -> DELETED
[HJ POL] HKCU\[…]\System : DisableRegistryTools (0) -> DELETED
[HJ POL] HKLM\[…]\System : EnableLUA (0) -> REPLACED (1)
[HJ POL] HKLM\[…]\Wow6432Node\[…]\System : EnableLUA (0) -> REPLACED (1)
[HJ DESK] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Scheduled tasks : 4 ¤¤¤
[V1][SUSP PATH] GoogleUpdateTaskUserS-1-5-21-90513374-351519211-1811497972-1000UA.job : C:\Users\Jack\AppData\Local\Google\Update\GoogleUpdate.exe - /ua /installsource scheduler [7][x] -> DELETED
[V1][SUSP PATH] GoogleUpdateTaskUserS-1-5-21-90513374-351519211-1811497972-1000Core.job : C:\Users\Jack\AppData\Local\Google\Update\GoogleUpdate.exe - /c [7] -> DELETED
[V2][SUSP PATH] GoogleUpdateTaskUserS-1-5-21-90513374-351519211-1811497972-1000Core : C:\Users\Jack\AppData\Local\Google\Update\GoogleUpdate.exe - /c [7] -> DELETED
[V2][SUSP PATH] GoogleUpdateTaskUserS-1-5-21-90513374-351519211-1811497972-1000UA : C:\Users\Jack\AppData\Local\Google\Update\GoogleUpdate.exe - /ua /installsource scheduler [7][x] -> DELETED

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
–> %SystemRoot%\System32\drivers\etc\hosts


ÿþ1

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: SAMSUNG HD753LJ +++++
— User —
[MBR] d5b0f6c4faaf7078d2dfe30a3dbc11d5
[BSP] 75fa2fd6adc9252bfbacafe2701b9baf : MBR Code unknown
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 701902 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 1437496200 | Size: 13499 Mo
User = LL1 … OK!
User = LL2 … OK!

+++++ PhysicalDrive1: SAMSUNG HD753LJ +++++
Error reading User MBR!
User = LL1 … OK!
Error reading LL2 MBR!

+++++ PhysicalDrive2: SAMSUNG HD753LJ +++++
Error reading User MBR!
User = LL1 … OK!
Error reading LL2 MBR!

+++++ PhysicalDrive3: SAMSUNG HD753LJ +++++
Error reading User MBR!
User = LL1 … OK!
Error reading LL2 MBR!

+++++ PhysicalDrive4: SAMSUNG HD753LJ +++++
Error reading User MBR!
User = LL1 … OK!
Error reading LL2 MBR!

Finished : << RKreport[0]_D_08142013_000659.txt >>
RKreport[0]_S_08142013_000554.txt



RogueKiller V8.6.5 _x64_ [Aug 5 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows Vista (6.0.6002 Service Pack 2) 64 bits version
Started in : Normal mode
User : Jack [Admin rights]
Mode : Shortcuts HJfix – Date : 08/14/2013 00:07:25
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ File attributes restored: ¤¤¤
Desktop: Success 0 / Fail 0
Quick launch: Success 0 / Fail 0
Programs: Success 0 / Fail 0
Start menu: Success 0 / Fail 0
User folder: Success 9 / Fail 0
My documents: Success 0 / Fail 0
My favorites: Success 0 / Fail 0
My pictures: Success 0 / Fail 0
My music: Success 8 / Fail 0
My videos: Success 0 / Fail 0
Local drives: Success 155 / Fail 0
Backup: [NOT FOUND]

Drives:
[C:] \Device\HarddiskVolume1 – 0x3 –> Restored
[D:] \Device\HarddiskVolume2 – 0x3 –> Restored
[E:] \Device\CdRom0 – 0x5 –> Skipped
[F:] \Device\HarddiskVolume3 – 0x2 –> Restored
[G:] \Device\HarddiskVolume4 – 0x2 –> Restored
[H:] \Device\HarddiskVolume5 – 0x2 –> Restored
[I:] \Device\HarddiskVolume6 – 0x2 –> Restored

¤¤¤ Infection : ¤¤¤

Finished : << RKreport[0]_SC_08142013_000725.txt >>
RKreport[0]_D_08142013_000659.txt;RKreport[0]_S_08142013_000554.txt

ComboFix 13-08-16.03 - Jack 08/17/2013 17:59:26.1.4 - x64 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.8190.5698 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe c:\programdata\B03BE8F32B.sys c:\users\Jack\Favorites\bookmarks-2010-03-02.json c:\users\Jack\Favorites\Bookmarks 2009-08-18.json c:\users\Jack\Favorites\bookmarks.html c:\users\Jack\Favorites\bookmarks_firefox.html . . ((((((((((((((((((((((((( Files Created from 2013-07-17 to 2013-08-17 ))))))))))))))))))))))))))))))) . . 2013-08-17 22:08 . 2013-08-17 22:08 ——– d—–w- c:\users\Jack\AppData\Local\temp 2013-08-17 22:08 . 2013-08-17 22:08 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-08-17 22:08 . 2013-08-17 22:08 ——– d—–w- c:\users\Jack Work\AppData\Local\temp 2013-08-14 07:04 . 2013-08-14 07:07 ——– d—–w- c:\windows\system32\MRT 2013-08-14 04:03 . 2013-07-09 12:04 1585256 —-a-w- c:\windows\system32\ntdll.dll 2013-08-14 04:02 . 2013-07-17 20:01 2048 —-a-w- c:\windows\system32\tzres.dll 2013-08-14 04:02 . 2013-07-17 19:41 2048 —-a-w- c:\windows\SysWow64\tzres.dll 2013-08-14 03:55 . 2013-08-14 03:55 ——– d—–w- c:\windows\ERUNT 2013-08-13 11:34 . 2013-08-13 11:34 ——– d—–w- C:\_OTL 2013-08-11 19:24 . 2012-08-23 11:34 2106216 —-a-w- c:\program files (x86)\Mozilla Firefox\updated\D3DCompiler_43.dll 2013-08-11 19:24 . 2012-08-23 11:34 1998168 —-a-w- c:\program files (x86)\Mozilla Firefox\updated\d3dx9_43.dll 2013-08-11 19:24 . 2013-08-11 19:25 74136 —-a-w- c:\program files (x86)\Mozilla Firefox\updated\breakpadinjector.dll 2013-08-11 19:24 . 2013-04-12 13:22 263064 —-a-w- c:\program files (x86)\Mozilla Firefox\updated\components\browsercomps.dll 2013-08-11 19:24 . 2013-08-11 19:25 19352 —-a-w- c:\program files (x86)\Mozilla Firefox\updated\AccessibleMarshal.dll 2013-08-11 19:09 . 2013-08-11 19:09 ——– d—–w- c:\users\Jack\AppData\Roaming\Skype 2013-08-11 19:09 . 2013-08-11 19:09 ——– d—–w- c:\program files (x86)\Common Files\Skype 2013-08-11 19:09 . 2013-08-11 19:09 ——– d—–r- c:\program files (x86)\Skype 2013-08-11 19:08 . 2013-08-11 19:08 96168 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2013-08-11 19:07 . 2013-08-11 19:09 ——– d—–w- c:\programdata\Skype 2013-08-11 18:50 . 2013-08-11 18:50 ——– d—–w- c:\program files (x86)\Dropbox 2013-08-02 18:57 . 2013-04-24 02:10 1078272 —-a-w- c:\windows\system32\certutil.exe 2013-08-02 18:57 . 2013-04-24 01:46 812544 —-a-w- c:\windows\SysWow64\certutil.exe 2013-08-02 18:57 . 2013-04-24 04:09 50688 —-a-w- c:\windows\system32\certenc.dll 2013-08-02 18:57 . 2013-04-24 04:00 41984 —-a-w- c:\windows\SysWow64\certenc.dll 2013-08-02 18:57 . 2013-06-01 04:19 619008 —-a-w- c:\windows\system32\qedit.dll 2013-08-02 18:57 . 2013-06-01 04:06 505344 —-a-w- c:\windows\SysWow64\qedit.dll 2013-08-02 18:57 . 2013-04-09 04:08 1815552 —-a-w- c:\program files\Windows Journal\NBDoc.DLL 2013-08-02 18:57 . 2013-04-09 04:07 1447936 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll 2013-08-02 18:57 . 2013-04-09 04:07 1500672 —-a-w- c:\program files\Windows Journal\JNWDRV.dll 2013-08-02 18:57 . 2013-04-09 04:07 1476608 —-a-w- c:\program files\Windows Journal\JNTFiltr.dll 2013-08-02 18:57 . 2013-04-09 03:51 936960 —-a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll 2013-08-02 18:54 . 2013-05-08 04:04 1548288 —-a-w- c:\windows\SysWow64\WMVDECOD.DLL 2013-08-02 18:54 . 2013-05-08 04:18 1706496 —-a-w- c:\windows\system32\WMVDECOD.DLL 2013-08-02 18:54 . 2013-06-04 02:03 2775040 —-a-w- c:\windows\system32\win32k.sys 2013-08-02 18:44 . 2013-05-02 04:16 686080 —-a-w- c:\windows\system32\win32spl.dll 2013-08-02 18:44 . 2013-05-02 04:04 443904 —-a-w- c:\windows\SysWow64\win32spl.dll 2013-08-02 18:44 . 2013-05-02 04:03 37376 —-a-w- c:\windows\SysWow64\printcom.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-08-14 07:04 . 2006-11-02 12:35 78161360 —-a-w- c:\windows\system32\mrt.exe 2013-08-11 19:08 . 2012-06-18 04:15 867240 —-a-w- c:\windows\SysWow64\npdeployJava1.dll 2013-08-11 19:08 . 2010-06-13 14:46 789416 —-a-w- c:\windows\SysWow64\deployJava1.dll 2013-08-02 18:14 . 2012-04-17 11:09 692104 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-08-02 18:14 . 2011-08-12 11:36 71048 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-08-02 18:08 . 2010-06-24 15:33 22240 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2013-07-08 04:16 . 2013-08-14 04:03 43008 —-a-w- c:\windows\apppatch\acwow64.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 —-a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 —-a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 —-a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 —-a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968] "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392] "MusicManager"="c:\users\Jack\AppData\Local\Programs\Google\MusicManager\MusicManager.exe" [2013-06-20 7345664] "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] "Spotify Web Helper"="c:\users\Jack\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-10-29 1199576] "Steam"="c:\program files (x86)\Steam\Steam.exe" [2013-07-26 1807272] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536] "KBD"="c:\program files (x86)\Hewlett-Packard\KBD\KbdStub.EXE" [2008-07-21 12288] "HP Health Check Scheduler"="c:\program files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008] "UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216] "UpdatePDIRShortCut"="c:\program files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216] "UpdatePSTShortCut"="c:\program files (x86)\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" [2008-09-11 210216] "TSMAgent"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-10-17 1152296] "CLMLServer for HP TouchSmart"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-10-17 189736] "DVDAgent"="c:\program files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-12-01 1148200] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "MMReminderService"="c:\program files (x86)\Mindjet\MindManager 7\MMReminderService.exe" [2007-05-18 37392] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208] "AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720] "AVG_UI"="c:\program files (x86)\AVG\AVG2013\avgui.exe" [2012-12-11 3147384] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816] . c:\users\Jack\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\Jack\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-24 27776968] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe -det [2008-9-8 430080] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux3"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [x] . . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs Themes . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2009-06-17 16:11 451872 —-a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder . 2013-08-14 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-17 18:14] . 2013-08-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-09-14 18:15] . 2013-08-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-09-14 18:15] . 2009-04-02 c:\windows\Tasks\HPCeeScheduleForAdministrator.job - c:\program files (x86)\hewlett-packard\sdp\ceement\HPCEE.exe [2009-04-01 18:12] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 164016 —-a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 164016 —-a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 164016 —-a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 164016 —-a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-15 15853088] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-15 82464] "IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-11-03 182808] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler] "{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files (x86)\Stardock\Fences\FencesMenu64.dll" [2009-10-02 134656] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = about:blank mStart Page = mDefault_Page_URL = mLocal Page = c:\windows\system32\blank.htm uInternet Settings,ProxyOverride = *.local;192.168.*.* TCP: DhcpNameServer = 192.168.0.1 DPF: {36299202-09EF-4ABF-ADB9-47C599DBE778} - hxxps://www.hpwindows7upgrade.arvato.com/north_america/Endcustomer/HPProdDetect.cab FF - ProfilePath - c:\users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ . - - - - ORPHANS REMOVED - - - - . URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file) Wow6432Node-HKCU-Run-MobileDocuments - c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe c:\users\Jack Work\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe c:\users\Jack\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe SafeBoot-WudfPf SafeBoot-WudfRd HKLM_Wow6432Node-ActiveSetup-Neat ADF Scanner 2008 - reg copy HKLM\Software\Wow6432Node\The Neat Company\Neat ADF Scanner 2008 HKCU\Software\The Neat Company\Neat ADF Scanner 2008 HKLM-Run-SmartMenu - c:\program files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe AddRemove-sp41099 - c:\hp\Softpaq\sp41099\sp41099.exe AddRemove-sp43111 - c:\hp\Softpaq\sp43111\sp43111.exe AddRemove-sp44626 - c:\hp\Softpaq\sp44626\sp44626.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton Internet Security] "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PCD5SRVC{8AAF211B-043E02A9-05040000}] "ImagePath"="\??\c:\progra~1\PC-DOC~1\PCD5SRVC_x64.pkms" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PCDSRVC{4942F9C0-0B403F17-06000000}_0] "ImagePath"="\??\c:\pcdr5\pcdsrvc_x64.pkms" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}] "ImagePath"="\??\c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{1E61ED7C-7CB8-49D6-B9E9-AB4C880C8414}"=hex:51,66,7a,6c,4c,1d,38,12,12,ee,72, 1a,8a,32,b8,0c,c6,ff,e8,0c,8d,52,c0,00 "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"=hex:51,66,7a,6c,4c,1d,38,12,50,d3,52, 34,79,b3,8e,01,c8,54,6e,db,8d,6e,1b,8c "{95B7759C-8C7F-4BF1-B163-73684A933233}"=hex:51,66,7a,6c,4c,1d,38,12,f2,76,a4, 91,4d,c2,9f,0e,ce,75,30,28,4f,cd,76,27 "{07A11D74-9D25-4FEA-A833-8B0D76A5577A}"=hex:51,66,7a,6c,4c,1d,38,12,1a,1e,b2, 03,17,d3,84,0a,d7,25,c8,4d,73,fb,13,6e "{201F27D4-3704-41D6-89C1-AA35E39143ED}"=hex:51,66,7a,6c,4c,1d,38,12,ba,24,0c, 24,36,79,b8,04,f6,d7,e9,75,e6,cf,07,f9 "{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}"=hex:51,66,7a,6c,4c,1d,38,12,7c,f0,b1, 38,5c,21,3d,0e,d9,78,0d,25,e1,c9,8c,d4 "{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96, 76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a "{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07, 72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57 "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23, 94,30,02,d1,0f,f1,da,12,24,73,56,27,d2 "{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd, d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db, df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd "{E312764E-7706-43F1-8DAB-FCDD2B1E416D}"=hex:51,66,7a,6c,4c,1d,38,12,20,75,01, e7,34,39,9f,06,f2,bd,bf,9d,2e,40,05,79 "{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47, 2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85 "{B0DE3308-5D5A-470D-81B9-634FC078393B}"=hex:51,66,7a,6c,4c,1d,38,12,66,30,cd, b4,68,13,63,02,fe,af,20,0f,c5,26,7d,2f "{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16, fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17 "{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9, b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b "{336D0C35-8A85-403a-B9D2-65C292C39087}"=hex:51,66,7a,6c,4c,1d,3b,1b,08,22,4f, 1a,82,e9,65,3d,9d,e9,17,af,a2,b0,e5,ab . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (LocalSystem) "Timestamp"=hex:b0,f5,cb,f5,56,1d,cd,01 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.9" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}] @Denied: (A 2) (Everyone) @SACL= @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil9f.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation] @SACL= "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32] @SACL= @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil9f.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib] @SACL= @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}] @Denied: (A 2) (Everyone) @SACL= @="IFlashBroker" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32] @SACL= @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib] @SACL= @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}] @Denied: (A 2) (Everyone) @SACL= . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0] @SACL= @="Shockwave Flash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}] @Denied: (A 2) (Everyone) @SACL= @="" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0] @SACL= @="FlashBroker" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2013-08-17 18:11:29 ComboFix-quarantined-files.txt 2013-08-17 22:11 . Pre-Run: 434,970,017,792 bytes free Post-Run: 434,129,182,720 bytes free . - - End Of File - - EFA344F96B6677B4759B3DECCAB37065 81CD5EC01DB0CE57EDD853F82462EF27

ComboFix 13-08-16.03 - Jack 08/20/2013 6:15.2.4 - x64 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.8190.5751 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Jack\Desktop\CFScript.txt AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2013-07-20 to 2013-08-20 ))))))))))))))))))))))))))))))) . . 2013-08-20 10:24 . 2013-08-20 10:24 ——– d—–w- c:\users\Jack\AppData\Local\temp 2013-08-20 10:24 . 2013-08-20 10:24 ——– d—–w- c:\users\Jack Work\AppData\Local\temp 2013-08-20 10:24 . 2013-08-20 10:24 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-08-14 07:04 . 2013-08-14 07:07 ——– d—–w- c:\windows\system32\MRT 2013-08-14 04:03 . 2013-07-09 12:04 1585256 —-a-w- c:\windows\system32\ntdll.dll 2013-08-14 04:02 . 2013-07-17 20:01 2048 —-a-w- c:\windows\system32\tzres.dll 2013-08-14 04:02 . 2013-07-17 19:41 2048 —-a-w- c:\windows\SysWow64\tzres.dll 2013-08-14 03:55 . 2013-08-14 03:55 ——– d—–w- c:\windows\ERUNT 2013-08-13 11:34 . 2013-08-13 11:34 ——– d—–w- C:\_OTL 2013-08-11 19:24 . 2012-08-23 11:34 2106216 —-a-w- c:\program files (x86)\Mozilla Firefox\updated\D3DCompiler_43.dll 2013-08-11 19:24 . 2012-08-23 11:34 1998168 —-a-w- c:\program files (x86)\Mozilla Firefox\updated\d3dx9_43.dll 2013-08-11 19:24 . 2013-08-11 19:25 74136 —-a-w- c:\program files (x86)\Mozilla Firefox\updated\breakpadinjector.dll 2013-08-11 19:24 . 2013-04-12 13:22 263064 —-a-w- c:\program files (x86)\Mozilla Firefox\updated\components\browsercomps.dll 2013-08-11 19:24 . 2013-08-11 19:25 19352 —-a-w- c:\program files (x86)\Mozilla Firefox\updated\AccessibleMarshal.dll 2013-08-11 19:09 . 2013-08-11 19:09 ——– d—–w- c:\users\Jack\AppData\Roaming\Skype 2013-08-11 19:09 . 2013-08-11 19:09 ——– d—–w- c:\program files (x86)\Common Files\Skype 2013-08-11 19:09 . 2013-08-11 19:09 ——– d—–r- c:\program files (x86)\Skype 2013-08-11 19:08 . 2013-08-11 19:08 96168 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2013-08-11 19:07 . 2013-08-11 19:09 ——– d—–w- c:\programdata\Skype 2013-08-11 18:50 . 2013-08-11 18:50 ——– d—–w- c:\program files (x86)\Dropbox 2013-08-02 18:57 . 2013-04-24 02:10 1078272 —-a-w- c:\windows\system32\certutil.exe 2013-08-02 18:57 . 2013-04-24 01:46 812544 —-a-w- c:\windows\SysWow64\certutil.exe 2013-08-02 18:57 . 2013-04-24 04:09 50688 —-a-w- c:\windows\system32\certenc.dll 2013-08-02 18:57 . 2013-04-24 04:00 41984 —-a-w- c:\windows\SysWow64\certenc.dll 2013-08-02 18:57 . 2013-06-01 04:19 619008 —-a-w- c:\windows\system32\qedit.dll 2013-08-02 18:57 . 2013-06-01 04:06 505344 —-a-w- c:\windows\SysWow64\qedit.dll 2013-08-02 18:57 . 2013-04-09 04:08 1815552 —-a-w- c:\program files\Windows Journal\NBDoc.DLL 2013-08-02 18:57 . 2013-04-09 04:07 1447936 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll 2013-08-02 18:57 . 2013-04-09 04:07 1500672 —-a-w- c:\program files\Windows Journal\JNWDRV.dll 2013-08-02 18:57 . 2013-04-09 04:07 1476608 —-a-w- c:\program files\Windows Journal\JNTFiltr.dll 2013-08-02 18:57 . 2013-04-09 03:51 936960 —-a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll 2013-08-02 18:54 . 2013-05-08 04:04 1548288 —-a-w- c:\windows\SysWow64\WMVDECOD.DLL 2013-08-02 18:54 . 2013-05-08 04:18 1706496 —-a-w- c:\windows\system32\WMVDECOD.DLL 2013-08-02 18:54 . 2013-06-04 02:03 2775040 —-a-w- c:\windows\system32\win32k.sys 2013-08-02 18:44 . 2013-05-02 04:16 686080 —-a-w- c:\windows\system32\win32spl.dll 2013-08-02 18:44 . 2013-05-02 04:04 443904 —-a-w- c:\windows\SysWow64\win32spl.dll 2013-08-02 18:44 . 2013-05-02 04:03 37376 —-a-w- c:\windows\SysWow64\printcom.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-08-14 07:04 . 2006-11-02 12:35 78161360 —-a-w- c:\windows\system32\mrt.exe 2013-08-11 19:08 . 2012-06-18 04:15 867240 —-a-w- c:\windows\SysWow64\npdeployJava1.dll 2013-08-11 19:08 . 2010-06-13 14:46 789416 —-a-w- c:\windows\SysWow64\deployJava1.dll 2013-08-02 18:14 . 2012-04-17 11:09 692104 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-08-02 18:14 . 2011-08-12 11:36 71048 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-08-02 18:08 . 2010-06-24 15:33 22240 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2013-07-08 04:16 . 2013-08-14 04:03 43008 —-a-w- c:\windows\apppatch\acwow64.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 —-a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 —-a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 —-a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 —-a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968] "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392] "MusicManager"="c:\users\Jack\AppData\Local\Programs\Google\MusicManager\MusicManager.exe" [2013-06-20 7345664] "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] "Spotify Web Helper"="c:\users\Jack\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-10-29 1199576] "Steam"="c:\program files (x86)\Steam\Steam.exe" [2013-07-26 1807272] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536] "KBD"="c:\program files (x86)\Hewlett-Packard\KBD\KbdStub.EXE" [2008-07-21 12288] "HP Health Check Scheduler"="c:\program files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008] "UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216] "UpdatePDIRShortCut"="c:\program files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216] "UpdatePSTShortCut"="c:\program files (x86)\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" [2008-09-11 210216] "TSMAgent"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-10-17 1152296] "CLMLServer for HP TouchSmart"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-10-17 189736] "DVDAgent"="c:\program files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-12-01 1148200] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "MMReminderService"="c:\program files (x86)\Mindjet\MindManager 7\MMReminderService.exe" [2007-05-18 37392] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208] "AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720] "AVG_UI"="c:\program files (x86)\AVG\AVG2013\avgui.exe" [2012-12-11 3147384] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816] . c:\users\Jack\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\Jack\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-24 27776968] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe -det [2008-9-8 430080] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux3"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [x] . . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs Themes . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2009-06-17 16:11 451872 —-a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder . 2013-08-20 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-17 18:14] . 2013-08-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-09-14 18:15] . 2013-08-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-09-14 18:15] . 2009-04-02 c:\windows\Tasks\HPCeeScheduleForAdministrator.job - c:\program files (x86)\hewlett-packard\sdp\ceement\HPCEE.exe [2009-04-01 18:12] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 164016 —-a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 164016 —-a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 164016 —-a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 164016 —-a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-15 15853088] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-15 82464] "SmartMenu"="c:\program files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [BU] "IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-11-03 182808] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler] "{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files (x86)\Stardock\Fences\FencesMenu64.dll" [2009-10-02 134656] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = about:blank mStart Page = mDefault_Page_URL = mLocal Page = c:\windows\system32\blank.htm uInternet Settings,ProxyOverride = *.local;192.168.*.* TCP: DhcpNameServer = 192.168.0.1 DPF: {36299202-09EF-4ABF-ADB9-47C599DBE778} - hxxps://www.hpwindows7upgrade.arvato.com/north_america/Endcustomer/HPProdDetect.cab FF - ProfilePath - c:\users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\li3ujspd.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ . - - - - ORPHANS REMOVED - - - - . AddRemove-sp41099 - c:\hp\Softpaq\sp41099\sp41099.exe AddRemove-sp43111 - c:\hp\Softpaq\sp43111\sp43111.exe AddRemove-sp44626 - c:\hp\Softpaq\sp44626\sp44626.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton Internet Security] "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PCD5SRVC{8AAF211B-043E02A9-05040000}] "ImagePath"="\??\c:\progra~1\PC-DOC~1\PCD5SRVC_x64.pkms" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PCDSRVC{4942F9C0-0B403F17-06000000}_0] "ImagePath"="\??\c:\pcdr5\pcdsrvc_x64.pkms" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}] "ImagePath"="\??\c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{1E61ED7C-7CB8-49D6-B9E9-AB4C880C8414}"=hex:51,66,7a,6c,4c,1d,38,12,12,ee,72, 1a,8a,32,b8,0c,c6,ff,e8,0c,8d,52,c0,00 "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"=hex:51,66,7a,6c,4c,1d,38,12,50,d3,52, 34,79,b3,8e,01,c8,54,6e,db,8d,6e,1b,8c "{95B7759C-8C7F-4BF1-B163-73684A933233}"=hex:51,66,7a,6c,4c,1d,38,12,f2,76,a4, 91,4d,c2,9f,0e,ce,75,30,28,4f,cd,76,27 "{07A11D74-9D25-4FEA-A833-8B0D76A5577A}"=hex:51,66,7a,6c,4c,1d,38,12,1a,1e,b2, 03,17,d3,84,0a,d7,25,c8,4d,73,fb,13,6e "{201F27D4-3704-41D6-89C1-AA35E39143ED}"=hex:51,66,7a,6c,4c,1d,38,12,ba,24,0c, 24,36,79,b8,04,f6,d7,e9,75,e6,cf,07,f9 "{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}"=hex:51,66,7a,6c,4c,1d,38,12,7c,f0,b1, 38,5c,21,3d,0e,d9,78,0d,25,e1,c9,8c,d4 "{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96, 76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a "{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07, 72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57 "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23, 94,30,02,d1,0f,f1,da,12,24,73,56,27,d2 "{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd, d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db, df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd "{E312764E-7706-43F1-8DAB-FCDD2B1E416D}"=hex:51,66,7a,6c,4c,1d,38,12,20,75,01, e7,34,39,9f,06,f2,bd,bf,9d,2e,40,05,79 "{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47, 2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85 "{B0DE3308-5D5A-470D-81B9-634FC078393B}"=hex:51,66,7a,6c,4c,1d,38,12,66,30,cd, b4,68,13,63,02,fe,af,20,0f,c5,26,7d,2f "{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16, fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17 "{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9, b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b "{336D0C35-8A85-403a-B9D2-65C292C39087}"=hex:51,66,7a,6c,4c,1d,3b,1b,08,22,4f, 1a,82,e9,65,3d,9d,e9,17,af,a2,b0,e5,ab . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (LocalSystem) "Timestamp"=hex:b0,f5,cb,f5,56,1d,cd,01 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.9" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}] @Denied: (A 2) (Everyone) @SACL= @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil9f.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation] @SACL= "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32] @SACL= @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil9f.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib] @SACL= @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}] @Denied: (A 2) (Everyone) @SACL= @="IFlashBroker" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32] @SACL= @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib] @SACL= @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}] @Denied: (A 2) (Everyone) @SACL= . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0] @SACL= @="Shockwave Flash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}] @Denied: (A 2) (Everyone) @SACL= @="" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0] @SACL= @="FlashBroker" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2013-08-20 06:27:03 ComboFix-quarantined-files.txt 2013-08-20 10:27 ComboFix2.txt 2013-08-17 22:11 . Pre-Run: 434,596,192,256 bytes free Post-Run: 433,490,014,208 bytes free . - - End Of File - - 49240B44A61C66EE27A5C40B6ACDFC35 81CD5EC01DB0CE57EDD853F82462EF27 Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.08.20.01 Windows Vista Service Pack 2 x64 NTFS Internet Explorer 9.0.8112.16421 Jack :: JACK-PC [administrator] 8/20/2013 6:29:11 AM mbam-log-2013-08-20 (06-29-11).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 261892 Time elapsed: 3 minute(s), 27 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) ESET Scanner didn't find anything or create a report. AVG thinks JRT.exe is a Trojan. I clicked ignore.