K here's the ADW scan:
# AdwCleaner v3.011 - Report created 07/11/2013 at 20:55:36
# Updated 03/11/2013 by Xplode
# Operating System : Windows 7 Home Premium (64 bits)
# Username : Lorna - LORNA-PC
# Running from : C:\Users\Lorna\Desktop\AdwCleaner.exe
# Option : Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Speedbit Video Downloader
Folder Deleted : C:\Program Files (x86)\SearchPredict
Folder Deleted : C:\Program Files (x86)\Speedbit Video Downloader
Folder Deleted : C:\Users\Lorna\AppData\Local\Temp\OCS
Folder Deleted : C:\Users\Lorna\AppData\Roaming\DesktopIconForAmazon
Folder Deleted : C:\Users\Lorna\AppData\Roaming\ExpressFiles
Folder Deleted : C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkjojgglmmcghgaiknnpgjgldgaocjfd
***** [ Shortcuts ] *****
***** [ Registry ] *****
Value Deleted : HKCU\Software\Mozilla\Firefox\Extensions [{442718d9-475e-452a-b3e1-fb1ee16b8e9f}]
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\djcpfkccckpeeghiklnhienllljccglb
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ledcpigomgblcmofccnacobhmcdkpiea
Key Deleted : HKCU\Software\Google\Chrome\Extensions\mkjojgglmmcghgaiknnpgjgldgaocjfd
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{389943B0-C3A2-4E69-82CB-8596A84CB3DC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3BDF4CE9-E81D-432B-A55E-9F0570CE811F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{92A9ACF4-9333-43AE-9698-DB283326F87F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9F34B17E-FF0D-4FAB-97C4-9713FEE79052}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C339D489-FABC-41DD-B39D-276101667C70}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D433A9D0-8267-40CB-8AD5-24F22FA5373F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FF7C3CF0-4B15-11D1-ABED-709549C10000}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0FA32667-9A8A-4E9C-902F-CA3323180003}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6B458F62-592F-4B25-8967-E6A350A59328}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FCC9CDD3-EFFF-11D1-A9F0-00A0244AC403}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{3BCF582D-CA87-4C6F-AF3D-B3548A976AB3}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B87F8B63-7274-43FD-87FA-09D3B7496148}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C4BAE205-5E02-4E32-876E-F34B4E2D000C}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EC4085F2-8DB3-45A6-AD0B-CA289F3C5D7E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{389943B0-C3A2-4E69-82CB-8596A84CB3DC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{92A9ACF4-9333-43AE-9698-DB283326F87F}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FF7C3CF0-4B15-11D1-ABED-709549C10000}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{389943B0-C3A2-4E69-82CB-8596A84CB3DC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{92A9ACF4-9333-43AE-9698-DB283326F87F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FF7C3CF0-4B15-11D1-ABED-709549C10000}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{389943B0-C3A2-4E69-82CB-8596A84CB3DC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{92A9ACF4-9333-43AE-9698-DB283326F87F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FF7C3CF0-4B15-11D1-ABED-709549C10000}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{603C4CC9-5DC6-4C44-873F-8281509DF953}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{0329E7D6-6F54-462D-93F6-F5C3118BADF2}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{0329E7D6-6F54-462D-93F6-F5C3118BADF2}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{0FA32667-9A8A-4E9C-902F-CA3323180003}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{6B458F62-592F-4B25-8967-E6A350A59328}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{FCC9CDD3-EFFF-11D1-A9F0-00A0244AC403}
Key Deleted : HKCU\Software\ExpressFiles
Key Deleted : HKCU\Software\OCS
Key Deleted : HKCU\Software\SBConvert
Key Deleted : HKLM\Software\ExpressFiles
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DesktopIconAmazon
***** [ Browsers ] *****
-\\ Internet Explorer v9.0.8112.16421
-\\ Mozilla Firefox v25.0 (en-GB)
[ File : C:\Users\Lorna\AppData\Roaming\Mozilla\Firefox\Profiles\nlrnclme.default-1382870013963\prefs.js ]
-\\ Google Chrome v
[ File : C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [8308 octets] - [07/11/2013 20:47:33]
AdwCleaner[S0].txt - [8213 octets] - [07/11/2013 20:55:36]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [8273 octets] ##########
and now OTL:
OTL logfile created on: 07/11/2013 21:08:38 - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Lorna\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
4.00 Gb Total Physical Memory | 2.05 Gb Available Physical Memory | 51.22% Memory free
7.99 Gb Paging File | 5.87 Gb Available in Paging File | 73.45% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 450.44 Gb Total Space | 272.35 Gb Free Space | 60.46% Space Free | Partition Type: NTFS
Drive D: | 465.76 Gb Total Space | 246.48 Gb Free Space | 52.92% Space Free | Partition Type: NTFS
Drive E: | 254.88 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF
Computer Name: LORNA-PC | User Name: Lorna | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - File not found
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\Lorna\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Lorna\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Users\Lorna\AppData\Roaming\Dashlane\Dashlane.exe ()
PRC - C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe ()
PRC - C:\Program Files (x86)\Common Files\Comodo\launcher_service.exe (Comodo Security Solutions Inc.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Common Files\Comodo\tvnserver.exe (GlavSoft LLC.)
PRC - C:\Program Files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe (CHENGDU YIWO Tech Development Co., Ltd)
PRC - C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe (CHENGDU YIWO Tech Development Co., Ltd)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
PRC - C:\Program Files (x86)\SpeedBit Video Accelerator\VideoAcceleratorService.exe (SpeedBit Ltd.)
PRC - C:\Windows\SysWOW64\nlssrv32.exe (Nalpeiron Ltd.)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe (Egis Technology Inc.)
PRC - c:\Program Files (x86)\Acer Bio Protection\BASVC.exe (Egis Technology Inc.)
PRC - c:\Program Files (x86)\Acer Bio Protection\CompPtcVUI.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
PRC - C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer)
PRC - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe (Acer Incorporated)
========== Modules (No Company Name) ==========
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Users\Lorna\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll ()
MOD - C:\Users\Lorna\AppData\Roaming\Dashlane\Dashlane.exe ()
MOD - C:\Users\Lorna\AppData\Roaming\Dashlane\2.2.1.47547\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}\components\KWUtils.2.2.1.47547.dll ()
MOD - C:\Users\Lorna\AppData\Roaming\Dashlane\2.2.1.47547\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}\components\KWMainLib_win.2.2.1.47547.dll ()
MOD - C:\Users\Lorna\AppData\Roaming\Dashlane\2.2.1.47547\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}\components\KWExternLib.2.2.1.47547.dll ()
MOD - C:\Users\Lorna\AppData\Roaming\Dashlane\2.2.1.47547\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}\components\KWData.2.2.1.47547.dll ()
MOD - C:\Users\Lorna\AppData\Roaming\Dashlane\2.2.1.47547\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}\components\KWApplication.2.2.1.47547.dll ()
MOD - C:\Users\Lorna\AppData\Roaming\Dashlane\2.2.1.47547\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}\components\KWDebug.2.2.1.47547.dll ()
MOD - C:\Users\Lorna\AppData\Roaming\Dashlane\2.2.1.47547\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}\components\KWDebugDll_win32.2.2.1.47547.dll ()
MOD - C:\Users\Lorna\AppData\Roaming\Dropbox\bin\libcef.dll ()
MOD - C:\Windows\SysWOW64\WinTab32.dll ()
========== Services (SafeList) ==========
SRV:64bit: - (HitmanProScheduler) -- C:\Program Files\HitmanPro\hmpsched.exe (SurfRight B.V.)
SRV:64bit: - (cmdAgent) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
SRV:64bit: - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV:64bit: - (!SASCORE) -- C:\Program Files\SUPERAntiSpyware\SASCore64.exe (SUPERAntiSpyware.com)
SRV:64bit: - (DAZContentManagementService) -- C:\Program Files\DAZ 3D\Content Management Service\ContentManagementServer.exe ()
SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (WinTabService) -- C:\Windows\SysNative\drivers\WTSrv.exe (Tablet Driver)
SRV:64bit: - (ePowerSvc) -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe (Acer Incorporated)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (Updater Service) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer)
SRV:64bit: - (AgereModemAudio) -- C:\Program Files\LSI SoftModem\agr64svc.exe (LSI Corporation)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (DragonUpdater) -- C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe ()
SRV - (CLPSLauncher) -- C:\Program Files (x86)\Common Files\Comodo\launcher_service.exe (Comodo Security Solutions Inc.)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (tvnserver) -- C:\Program Files (x86)\Common Files\Comodo\tvnserver.exe (GlavSoft LLC.)
SRV - (Guard Agent) -- C:\Program Files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe (CHENGDU YIWO Tech Development Co., Ltd)
SRV - (EaseUS Agent) -- C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe (CHENGDU YIWO Tech Development Co., Ltd)
SRV - (RapportMgmtService) -- C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
SRV - (VideoAcceleratorService) -- C:\Program Files (x86)\SpeedBit Video Accelerator\VideoAcceleratorService.exe (SpeedBit Ltd.)
SRV - (nlsX86cc) -- C:\Windows\SysWOW64\nlssrv32.exe (Nalpeiron Ltd.)
SRV - (HPSLPSVC) -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (MWLService) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe ()
SRV - (IGBASVC) -- c:\Program Files (x86)\Acer Bio Protection\BASVC.exe (Egis Technology Inc.)
SRV - (RS_Service) -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (Greg_Service) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe (Acer Incorporated)
========== Driver Services (SafeList) ==========
DRV:64bit: - (cmderd) -- C:\Windows\SysNative\drivers\cmderd.sys (COMODO)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (CFRMD) -- C:\Windows\SysNative\drivers\CFRMD.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (EUFDDISK) -- C:\Windows\SysNative\drivers\EuFdDisk.sys (CHENGDU YIWO Tech Development Co., Ltd)
DRV:64bit: - (EUBKMON) -- C:\Windows\SysNative\drivers\EUBKMON.sys ()
DRV:64bit: - (EUDSKACS) -- C:\Windows\SysNative\drivers\eudskacs.sys (CHENGDU YIWO Tech Development Co., Ltd)
DRV:64bit: - (EUBAKUP) -- C:\Windows\SysNative\drivers\eubakup.sys (CHENGDU YIWO Tech Development Co., Ltd)
DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr.sys (AVAST Software)
DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (silabser) -- C:\Windows\SysNative\drivers\silabser.sys (Silicon Laboratories)
DRV:64bit: - (silabenm) -- C:\Windows\SysNative\drivers\silabenm.sys (Silicon Laboratories)
DRV:64bit: - (Uim_IM) -- C:\Windows\SysNative\drivers\Uim_IMx64.sys (Paragon)
DRV:64bit: - (Uim_VIM) -- C:\Windows\SysNative\drivers\uim_vimx64.sys (Paragon)
DRV:64bit: - (UimBus) -- C:\Windows\SysNative\drivers\uimx64.sys (Windows ® 2000 DDK provider)
DRV:64bit: - (RapportKE64) -- C:\Windows\SysNative\drivers\RapportKE64.sys (Trusteer Ltd.)
DRV:64bit: - (SASDIFSV) -- C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (SASKUTIL) -- C:\Program Files\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (FPSensor) -- C:\Windows\SysNative\drivers\FPSensor.sys (Egistec)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (netr7364) -- C:\Windows\SysNative\drivers\netr7364.sys (Ralink Technology, Corp.)
DRV:64bit: - (Revoflt) -- C:\Windows\SysNative\drivers\revoflt.sys (VS Revo Group)
DRV:64bit: - (NETw5s64) -- C:\Windows\SysNative\drivers\NETw5s64.sys (Intel Corporation)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (AgereSoftModem) -- C:\Windows\SysNative\drivers\agrsm64.sys (LSI Corporation)
DRV:64bit: - (hidshim) -- C:\Windows\SysNative\drivers\hidshim.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (nuvotonhidgeneric) -- C:\Windows\SysNative\drivers\nuvotonhidgeneric.sys (Nuvoton Technology Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (ROOTMODEM) -- C:\Windows\SysNative\drivers\rootmdm.sys (Microsoft Corporation)
DRV:64bit: - (L1E) -- C:\Windows\SysNative\drivers\L1E62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (UCTblHid) -- C:\Windows\SysNative\drivers\UCTblHid.sys (Tablet Driver)
DRV:64bit: - (TClass2k) -- C:\Windows\SysNative\drivers\TClass2k.sys (Tablet Driver)
DRV:64bit: - (PTSimHid) -- C:\Windows\SysNative\drivers\PTSimHid.sys (PenTablet Driver)
DRV:64bit: - (PTSimBus) -- C:\Windows\SysNative\drivers\PTSimBus.sys (PenTablet Driver)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (BCM43XX) -- C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation)
DRV:64bit: - (k57nd60a) -- C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (RSUSBSTOR) -- C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (mwlPSDVDisk) -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDFilter) -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDNServ) -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys (Egis Technology Inc.)
DRV:64bit: - (netw5v64) -- C:\Windows\SysNative\drivers\NETw5v64.sys (Intel Corporation)
DRV:64bit: - (NTIDrvr) -- C:\Windows\SysNative\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV:64bit: - (UBHelper) -- C:\Windows\SysNative\drivers\UBHelper.sys (NewTech Infosystems Corporation)
DRV:64bit: - (SSPORT) -- C:\Windows\SysNative\drivers\SSPORT.SYS (Samsung Electronics)
DRV:64bit: - (DgiVecp) -- C:\Windows\SysNative\drivers\DGIVECP.SYS (Samsung Electronics Co., Ltd.)
DRV:64bit: - (RimVSerPort) -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys (Research in Motion Ltd)
DRV:64bit: - (BVRPMPR5a64) -- C:\Windows\SysNative\drivers\BVRPMPR5a64.SYS (Avanquest Software)
DRV - (cleanhlp) -- C:\EEK\Run\cleanhlp64.sys (Emsisoft GmbH)
DRV - (RapportCerberus_43926) -- C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\43926\RapportCerberus64_43926.sys ()
DRV - (CFRMD) -- C:\Windows\SysWOW64\drivers\CFRMD.sys (Windows ® Win 7 DDK provider)
DRV - (RapportPG64) -- C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys (Trusteer Ltd.)
DRV - (RapportEI64) -- C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys (Trusteer Ltd.)
DRV - (usbscan) -- C:\Windows\SysWOW64\drivers\USBSCAN.SYS (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer...c8z185t5701w78n
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.co...ng}&rlz=1I7ACAW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{3D41F773-C2A2-4541-8F58-DF94FA1311D3}: "URL" = http://search.yahoo....q={searchTerms}
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.co...AW_enGB378GB379
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://yandex.ru/yan...t={searchTerms}
IE - HKCU\..\SearchScopes\{A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6}: "URL" = http://ws.infospace....=7?_IceUrl=true
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo....q={searchTerms}
IE - HKCU\..\SearchScopes\Moikrug: "URL" = http://moikrug.ru/pe...ms}&submitted=1
IE - HKCU\..\SearchScopes\Yandex: "URL" = http://www.google.co...AW_enGB378GB379
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:25.0
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@spoon.net/Spoon Plugin 3.32: C:\Users\Lorna\AppData\Local\Spoon\3.32.2.12\npMozillaSpoonPlugin.dll (Code Systems Corporation)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Lorna\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Lorna\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/07/01 08:40:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/04/02 13:09:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 25.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/11/06 10:17:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 25.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/07/01 08:40:23 | 000,000,000 | ---D | M]
[2012/02/10 13:34:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lorna\AppData\Roaming\Mozilla\Extensions
[2013/10/27 10:41:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lorna\AppData\Roaming\Mozilla\Firefox\Profiles\nlrnclme.default-1382870013963\extensions
[2013/11/06 10:17:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2013/11/06 10:17:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013/11/06 10:17:41 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
========== Chrome ==========
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: http://www.addthis.c...n3&clickbacks=1
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Lorna\AppData\Local\Google\Chrome\Application\31.0.1650.34\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Lorna\AppData\Local\Google\Chrome\Application\31.0.1650.34\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Lorna\AppData\Local\Google\Chrome\Application\31.0.1650.34\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Chrome SVD extension (Enabled) = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\djcpfkccckpeeghiklnhienllljccglb\2.0.4_0\lib/npdownloaderchrome.dll
CHR - plugin: Chrome DAP extension (Enabled) = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffdcfjdljhbehggjdkdioajnknjcpbjb\2.0.6_0\lib/npdapchrome.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java Platform SE 6 U20 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL
CHR - plugin: RIM Handheld Application Loader (Enabled) = C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: BlackBerry AppWorld (Enabled) = C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll
CHR - plugin: Windows Live Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: RockMelt Update (Enabled) = C:\Users\Lorna\AppData\Local\RockMelt\Update\1.2.189.1\npRockMeltOneClick8.dll
CHR - plugin: Spoon Plugin (Enabled) = C:\Users\Lorna\AppData\Local\Spoon\3.32.2.12\npMozillaSpoonPlugin.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - Extension: Google Translate = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.2.5_0\
CHR - Extension: Spybot - Search & Destroy = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahmcccagmbagkpbdgpammblejlmiempb\2.0.6.819_0\
CHR - Extension: YouTube = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Adblock Plus = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.6.1_0\
CHR - Extension: Add to Amazon Wish List = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\ciagpekplgpbepdgggflgmahnjgiaced\1.0.0.10_0\
CHR - Extension: Google Search = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: avast! WebRep = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\6.0.1374_0\
CHR - Extension: Disconnect = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\jeoacafpbcihiomhlakheieifhpjdfeo\5.10.0_0\
CHR - Extension: Window Close Protector = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\lnpifgapnmpninomacbhdlconlpikdai\2.2_0\
CHR - Extension: Google Wallet = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0\
CHR - Extension: Google Chrome to Phone Extension = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\oadboiipflhobonjjffjbfekfjcgkhco\2.3.2_0\
CHR - Extension: Short URL = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\obbdcmhkndhionekooeeiilbicfdkhml\1.0_0\
CHR - Extension: Instagram for Chrome = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\opnbmdkdflhjiclaoiiifmheknpccalb\4.9.1_0\
CHR - Extension: Instagram for Chrome = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\opnbmdkdflhjiclaoiiifmheknpccalb\4.9.2_0\
CHR - Extension: Evernote Web Clipper = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc\6.0.3_0\
CHR - Extension: Gmail = C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
O1 HOSTS File: ([2012/08/17 07:48:50 | 000,443,169 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 15224 more lines...
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (Dashlane BHO) - {42D79B50-CC4A-4A8E-860F-BE674AF053A2} - C:\Users\Lorna\AppData\Roaming\Dashlane\ie\Dashlanei.dll (Dashlane)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKCU..\Run: [Dashlane] C:\Users\Lorna\AppData\Roaming\Dashlane\Dashlane.exe ()
O4 - HKLM..\RunOnceEx: [Flags] Reg Error: Invalid data type. File not found
O4 - HKLM..\RunOnceEx: [Title] UnHackMe Rootkit Check File not found
O4 - Startup: C:\Users\Lorna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Lorna\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O9:64bit: - Extra Button: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\Program Files (x86)\Acer Bio Protection\PwdBank.exe (Egis Technology Inc.)
O9:64bit: - Extra 'Tools' menuitem : Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\Program Files (x86)\Acer Bio Protection\PwdBank.exe (Egis Technology Inc.)
O9 - Extra Button: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\Program Files (x86)\Acer Bio Protection\PwdBank.exe (Egis Technology Inc.)
O9 - Extra 'Tools' menuitem : Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\Program Files (x86)\Acer Bio Protection\PwdBank.exe (Egis Technology Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: fellfromgrace.com ([www] https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{454243BE-109D-452A-96DD-5779CAC699AD}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{454243BE-109D-452A-96DD-5779CAC699AD}: NameServer = 8.26.56.26,156.154.70.22
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - AppInit_DLLs: (C:\Windows\System32\guard64.dll) - C:\Windows\SysNative\guard64.dll (COMODO)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\guard64.dll) - C:\Windows\SysNative\guard64.dll (COMODO)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\guard32.dll) - C:\Windows\SysWOW64\guard32.dll (COMODO)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (sdnclean64.exe)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Value error. File not found
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2013/11/07 20:47:28 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2013/11/06 12:59:12 | 000,391,168 | ---- | C] (CANON INC.) -- C:\Windows\SysNative\CNMLM9T.DLL
[2013/11/06 10:17:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013/11/04 11:06:27 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/11/04 11:04:44 | 001,033,335 | ---- | C] (Thisisu) -- C:\Users\Lorna\Desktop\JRT.exe
[2013/11/03 22:38:59 | 000,116,440 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2013/11/03 22:38:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
[2013/11/03 22:37:18 | 000,091,352 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
[2013/11/03 22:35:41 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Desktop\mbar
[2013/11/03 22:26:29 | 012,576,792 | ---- | C] (Malwarebytes Corp.) -- C:\Users\Lorna\Desktop\mbar-1.07.0.1007.exe
[2013/11/03 21:52:44 | 000,000,000 | ---D | C] -- C:\Users\Lorna\AppData\Local\VS Revo Group
[2013/11/03 21:52:29 | 000,031,800 | ---- | C] (VS Revo Group) -- C:\Windows\SysNative\drivers\revoflt.sys
[2013/11/03 21:52:29 | 000,000,000 | ---D | C] -- C:\ProgramData\VS Revo Group
[2013/11/03 21:52:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
[2013/11/03 21:52:27 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2013/11/03 21:51:04 | 010,031,224 | ---- | C] (VS Revo Group ) -- C:\Users\Lorna\Desktop\RevoUninProSetup.exe
[2013/11/03 12:02:56 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Lorna\Desktop\OTL.exe
[2013/11/03 11:58:56 | 004,745,728 | ---- | C] (AVAST Software) -- C:\Users\Lorna\Desktop\aswMBR.exe
[2013/10/29 10:54:07 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\Lorna\Desktop\HijackThis.exe
[2013/10/27 10:49:03 | 000,000,000 | ---D | C] -- C:\EEK
[2013/10/27 10:34:01 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Desktop\Old Firefox Data
[2013/10/25 18:06:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Nevercenter
[2013/10/25 17:58:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CameraBag 2
[2013/10/25 15:15:28 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Documents\My Collages
[2013/10/24 21:26:29 | 000,000,000 | -HSD | C] -- C:\Windows\SysNative\%APPDATA%
[2013/10/24 21:24:55 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2013/10/24 16:43:58 | 000,000,000 | ---D | C] -- C:\3a3f13d26556370d06bc1f
[2013/10/24 16:20:44 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\MRT
[2013/10/22 11:33:01 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Documents\word docs
[2013/10/22 11:32:20 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Documents\pageplus stuff
[2013/10/22 11:31:21 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Documents\robfossett
[2013/10/22 11:22:34 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Documents\ie6 only
[2013/10/22 11:22:34 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Documents\IE Kaleidoscope
[2013/10/22 11:22:21 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Documents\Font Groups
[2013/10/22 11:22:21 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Documents\flipphotos
[2013/10/22 11:22:20 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Documents\files
[2013/10/22 11:18:40 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Documents\data
[2013/10/22 11:18:36 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Documents\com.nevercenter.camerabag2
[2013/10/22 11:15:43 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Documents\Arcade Deluxe
[2013/10/22 11:15:43 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Documents\application forms
[2013/10/22 11:15:43 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Documents\Anvsoft
[2013/10/22 11:15:42 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Documents\Amazon MP3
[2013/10/22 11:15:24 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Documents\accounts excel
[2013/10/22 11:15:19 | 000,530,528 | ---- | C] (Yahoo! Inc.) -- C:\Users\Lorna\Documents\yahoo_installer.exe
[2013/10/22 11:15:12 | 002,500,664 | ---- | C] (CyberDefender Corp.) -- C:\Users\Lorna\Documents\toolbar_v2toolbarsite.exe
[2013/10/22 11:15:07 | 022,690,600 | ---- | C] (Skype Technologies S.A.) -- C:\Users\Lorna\Documents\SkypeSetup.exe
[2013/10/22 11:14:59 | 018,649,560 | ---- | C] (eBay ) -- C:\Users\Lorna\Documents\setupUK.exe
[2013/10/22 11:14:57 | 006,798,200 | ---- | C] (Brajusta Publishing, Inc. ) -- C:\Users\Lorna\Documents\setup.exe
[2013/10/22 11:14:31 | 005,911,719 | ---- | C] (Free-Software-Forever.com) -- C:\Users\Lorna\Documents\googlein24.exe
[2013/10/22 11:14:25 | 011,028,800 | ---- | C] (Flock) -- C:\Users\Lorna\Documents\flock-2.0b2.en-US.win32.exe
[2013/10/21 17:33:07 | 000,000,000 | ---D | C] -- C:\Users\Lorna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dashlane
[2013/10/21 17:31:50 | 000,000,000 | ---D | C] -- C:\Users\Lorna\AppData\Roaming\Dashlane
[2013/10/20 14:20:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox.bak
[2013/10/19 12:33:25 | 000,000,000 | ---D | C] -- C:\Users\Lorna\Documents\DAZ 3D
[2013/10/19 12:24:10 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\My DAZ 3D Library
[2013/10/19 12:18:02 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\DAZ 3D
[2013/10/19 12:03:05 | 000,000,000 | ---D | C] -- C:\Users\Lorna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DAZ 3D
[2013/10/19 12:02:43 | 000,000,000 | ---D | C] -- C:\ProgramData\DAZ 3D
[2013/10/19 12:02:41 | 000,000,000 | ---D | C] -- C:\Program Files\DAZ 3D
[2013/10/19 10:26:16 | 000,057,096 | ---- | C] (COMODO CA Limited) -- C:\Windows\SysNative\certsentry.dll
[2009/08/22 08:44:20 | 000,036,136 | ---- | C] (Oberon Media) -- C:\ProgramData\FullRemove.exe
[1 C:\Users\Lorna\Documents\*.tmp files -> C:\Users\Lorna\Documents\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013/11/07 21:17:42 | 001,474,832 | ---- | M] () -- C:\Windows\SysNative\drivers\sfi.dat
[2013/11/07 21:07:23 | 000,017,600 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/11/07 21:07:23 | 000,017,600 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/11/07 21:06:08 | 000,797,238 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/11/07 21:06:08 | 000,677,048 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/11/07 21:06:08 | 000,130,846 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/11/07 21:03:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/11/07 20:59:23 | 000,000,436 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.ics
[2013/11/07 20:58:37 | 000,000,362 | ---- | M] () -- C:\Windows\tasks\Check for updates (Spybot - Search & Destroy).job
[2013/11/07 20:58:36 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/11/07 20:58:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/11/07 20:57:59 | 3217,235,968 | -HS- | M] () -- C:\hiberfil.sys
[2013/11/07 20:39:13 | 001,073,262 | ---- | M] () -- C:\Users\Lorna\Desktop\AdwCleaner.exe
[2013/11/07 20:34:10 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1062119836-663356838-3640058548-1001UA.job
[2013/11/07 20:34:10 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/11/07 20:27:03 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1062119836-663356838-3640058548-1001Core.job
[2013/11/07 20:13:07 | 000,000,346 | ---- | M] () -- C:\Windows\tasks\Refresh immunization (Spybot - Search & Destroy).job
[2013/11/06 12:30:58 | 000,001,915 | ---- | M] () -- C:\Users\Lorna\Desktop\Dashlane.lnk
[2013/11/06 09:36:35 | 000,001,053 | ---- | M] () -- C:\Users\Lorna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013/11/06 09:36:23 | 000,001,164 | ---- | M] () -- C:\Windows\wininit.ini
[2013/11/06 09:35:53 | 000,001,021 | ---- | M] () -- C:\Users\Lorna\Desktop\Dropbox.lnk
[2013/11/04 11:04:37 | 001,033,335 | ---- | M] (Thisisu) -- C:\Users\Lorna\Desktop\JRT.exe
[2013/11/04 11:04:01 | 000,001,036 | ---- | M] () -- C:\Windows\tasks\Paragon Archive name arc_080112231151836.job
[2013/11/03 22:38:59 | 000,116,440 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2013/11/03 22:37:18 | 000,091,352 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
[2013/11/03 22:26:49 | 012,576,792 | ---- | M] (Malwarebytes Corp.) -- C:\Users\Lorna\Desktop\mbar-1.07.0.1007.exe
[2013/11/03 21:52:31 | 000,001,117 | ---- | M] () -- C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
[2013/11/03 21:51:16 | 010,031,224 | ---- | M] (VS Revo Group ) -- C:\Users\Lorna\Desktop\RevoUninProSetup.exe
[2013/11/03 16:10:37 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat
[2013/11/03 16:10:37 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat
[2013/11/03 12:02:53 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Lorna\Desktop\OTL.exe
[2013/11/03 11:59:04 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Users\Lorna\Desktop\aswMBR.exe
[2013/11/03 11:58:42 | 000,891,184 | ---- | M] () -- C:\Users\Lorna\Desktop\SecurityCheck.exe
[2013/10/30 18:33:49 | 576,721,544 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013/10/29 10:54:05 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Lorna\Desktop\HijackThis.exe
[2013/10/27 15:49:48 | 000,002,145 | ---- | M] () -- C:\Users\Lorna\Desktop\avast! Free Antivirus 8.0.1489 Setup.lnk
[2013/10/27 14:46:41 | 000,001,149 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/10/27 10:55:07 | 000,002,370 | ---- | M] () -- C:\Users\Lorna\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/10/27 10:55:07 | 000,002,368 | ---- | M] () -- C:\Users\Lorna\Desktop\Google Chrome.lnk
[2013/10/27 10:52:52 | 000,001,482 | ---- | M] () -- C:\Users\Lorna\Desktop\Amazon.lnk
[2013/10/27 10:52:52 | 000,001,482 | ---- | M] () -- C:\Users\Lorna\Application Data\Microsoft\Internet Explorer\Quick Launch\Amazon.lnk
[2013/10/27 10:50:45 | 000,000,586 | ---- | M] () -- C:\Users\Lorna\Desktop\Emsisoft Emergency Kit.lnk
[2013/10/24 16:37:01 | 000,783,150 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013/10/21 19:25:52 | 000,032,399 | ---- | M] () -- C:\Windows\Q-Dir.ini
[2013/10/21 19:21:24 | 000,002,560 | ---- | M] () -- C:\Windows\_MSRSTRT.EXE
[2013/10/20 18:59:46 | 000,002,087 | ---- | M] () -- C:\Users\Lorna\Desktop\DAZ 3D Install Manager 1.lnk
[2013/10/19 12:24:31 | 000,000,974 | ---- | M] () -- C:\Users\Lorna\Desktop\DAZ Studio 4.6 (64-bit).lnk
[2013/10/19 11:03:56 | 000,692,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/10/19 11:03:56 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/10/19 10:26:23 | 000,048,392 | ---- | M] (COMODO CA Limited) -- C:\Windows\SysWow64\certsentry.dll
[2013/10/19 10:26:16 | 000,057,096 | ---- | M] (COMODO CA Limited) -- C:\Windows\SysNative\certsentry.dll
[2013/10/15 23:07:31 | 000,033,184 | ---- | M] () -- C:\Users\Lorna\Documents\cc_20131016_000724.reg
[1 C:\Users\Lorna\Documents\*.tmp files -> C:\Users\Lorna\Documents\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013/11/07 20:39:09 | 001,073,262 | ---- | C] () -- C:\Users\Lorna\Desktop\AdwCleaner.exe
[2013/11/03 21:52:31 | 000,001,117 | ---- | C] () -- C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
[2013/11/03 11:58:44 | 000,891,184 | ---- | C] () -- C:\Users\Lorna\Desktop\SecurityCheck.exe
[2013/10/27 15:49:47 | 000,002,145 | ---- | C] () -- C:\Users\Lorna\Desktop\avast! Free Antivirus 8.0.1489 Setup.lnk
[2013/10/27 14:46:41 | 000,001,149 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/10/27 10:55:07 | 000,002,368 | ---- | C] () -- C:\Users\Lorna\Desktop\Google Chrome.lnk
[2013/10/27 10:52:52 | 000,001,482 | ---- | C] () -- C:\Users\Lorna\Desktop\Amazon.lnk
[2013/10/27 10:52:52 | 000,001,482 | ---- | C] () -- C:\Users\Lorna\Application Data\Microsoft\Internet Explorer\Quick Launch\Amazon.lnk
[2013/10/27 10:49:58 | 000,000,586 | ---- | C] () -- C:\Users\Lorna\Desktop\Emsisoft Emergency Kit.lnk
[2013/10/25 17:58:48 | 000,002,991 | ---- | C] () -- C:\Users\Lorna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CameraBag 2.lnk
[2013/10/22 11:15:20 | 005,505,155 | ---- | C] () -- C:\Users\Lorna\Documents\ZinioReader4.air
[2013/10/22 11:15:19 | 000,006,195 | ---- | C] () -- C:\Users\Lorna\Documents\xmas2012.html
[2013/10/22 11:15:18 | 007,919,073 | ---- | C] () -- C:\Users\Lorna\Documents\Weave-ItBkTwo.pdf
[2013/10/22 11:15:18 | 003,956,220 | ---- | C] ( ) -- C:\Users\Lorna\Documents\webgobbler126_setup.exe
[2013/10/22 11:15:18 | 000,256,521 | ---- | C] () -- C:\Users\Lorna\Documents\Winged Pig Crochet Pattern - Flying Pigs Crochet Pattern.mht
[2013/10/22 11:15:18 | 000,111,060 | ---- | C] () -- C:\Users\Lorna\Documents\WM0270.pdf
[2013/10/22 11:15:18 | 000,032,159 | ---- | C] () -- C:\Users\Lorna\Documents\Welcome to.png
[2013/10/22 11:15:18 | 000,008,500 | ---- | C] () -- C:\Users\Lorna\Documents\wordchart1.pdf
[2013/10/22 11:15:17 | 008,679,978 | ---- | C] () -- C:\Users\Lorna\Documents\Weave-ItBkThree.pdf
[2013/10/22 11:15:16 | 000,786,846 | ---- | C] () -- C:\Users\Lorna\Documents\vintage_knitting_tips.pdf
[2013/10/22 11:15:14 | 007,850,491 | ---- | C] () -- C:\Users\Lorna\Documents\vichallflyerfinal.ppp
[2013/10/22 11:15:14 | 006,729,331 | ---- | C] () -- C:\Users\Lorna\Documents\vertigo-source.png
[2013/10/22 11:15:14 | 000,145,212 | ---- | C] () -- C:\Users\Lorna\Documents\vertigo-logo-source.png
[2013/10/22 11:15:13 | 001,323,805 | ---- | C] () -- C:\Users\Lorna\Documents\tyroknit.pdf
[2013/10/22 11:15:13 | 000,852,185 | ---- | C] () -- C:\Users\Lorna\Documents\vertigo-footer-source.png
[2013/10/22 11:15:13 | 000,086,999 | ---- | C] () -- C:\Users\Lorna\Documents\Untitled-2.ai
[2013/10/22 11:15:13 | 000,006,219 | ---- | C] () -- C:\Users\Lorna\Documents\Untitled.htm
[2013/10/22 11:15:13 | 000,000,652 | ---- | C] () -- C:\Users\Lorna\Documents\Untitled-1.ai
[2013/10/22 11:15:11 | 007,070,390 | ---- | C] () -- C:\Users\Lorna\Documents\TheWeave-ItBook.pdf
[2013/10/22 11:15:11 | 000,000,163 | ---- | C] () -- C:\Users\Lorna\Documents\timesheet_20090216.csv
[2013/10/22 11:15:10 | 002,809,683 | ---- | C] () -- C:\Users\Lorna\Documents\testpdf.PDF
[2013/10/22 11:15:10 | 000,080,482 | ---- | C] () -- C:\Users\Lorna\Documents\tgest.xps
[2013/10/22 11:15:10 | 000,000,096 | ---- | C] () -- C:\Users\Lorna\Documents\test.key.prepare
[2013/10/22 11:15:09 | 003,761,664 | ---- | C] () -- C:\Users\Lorna\Documents\test.exe
[2013/10/22 11:15:09 | 000,001,207 | ---- | C] () -- C:\Users\Lorna\Documents\test.ebp
[2013/10/22 11:15:09 | 000,000,096 | ---- | C] () -- C:\Users\Lorna\Documents\test.key
[2013/10/22 11:15:08 | 001,690,966 | ---- | C] () -- C:\Users\Lorna\Documents\surveys.pdf
[2013/10/22 11:15:08 | 000,650,583 | ---- | C] () -- C:\Users\Lorna\Documents\TechniqueColoredPencil.pdf
[2013/10/22 11:15:08 | 000,557,191 | ---- | C] () -- C:\Users\Lorna\Documents\stitchy.pdf
[2013/10/22 11:15:08 | 000,364,234 | ---- | C] () -- C:\Users\Lorna\Documents\steampunkflier.png
[2013/10/22 11:15:08 | 000,329,320 | ---- | C] () -- C:\Users\Lorna\Documents\steamunkflier2.png
[2013/10/22 11:15:08 | 000,056,028 | ---- | C] () -- C:\Users\Lorna\Documents\sv_028.jpg
[2013/10/22 11:15:08 | 000,025,574 | ---- | C] () -- C:\Users\Lorna\Documents\swfobject.js
[2013/10/22 11:15:08 | 000,015,263 | ---- | C] () -- C:\Users\Lorna\Documents\steamstam tables.svg
[2013/10/22 11:15:08 | 000,011,906 | ---- | C] () -- C:\Users\Lorna\Documents\steamstam tables.pdf
[2013/10/22 11:15:07 | 003,144,125 | ---- | C] () -- C:\Users\Lorna\Documents\Spool221.pdf
[2013/10/22 11:15:07 | 002,196,497 | ---- | C] () -- C:\Users\Lorna\Documents\steampunk-bug.pdf
[2013/10/22 11:15:07 | 000,060,235 | ---- | C] () -- C:\Users\Lorna\Documents\stamford-artisans-guild-logo.jpg
[2013/10/22 11:15:07 | 000,009,469 | ---- | C] () -- C:\Users\Lorna\Documents\star_template.pdf
[2013/10/22 11:15:00 | 011,973,628 | ---- | C] () -- C:\Users\Lorna\Documents\showcase-source.png
[2013/10/22 11:15:00 | 000,055,038 | ---- | C] () -- C:\Users\Lorna\Documents\shkdd10.zip
[2013/10/22 11:14:56 | 000,103,326 | ---- | C] () -- C:\Users\Lorna\Documents\Sea%20Breeze%20Angelina%20instructions.pdf
[2013/10/22 11:14:56 | 000,034,959 | ---- | C] () -- C:\Users\Lorna\Documents\SEASCAPEPEYOTE.png
[2013/10/22 11:14:56 | 000,029,223 | ---- | C] () -- C:\Users\Lorna\Documents\SEASCAPELOOM.png
[2013/10/22 11:14:55 | 001,769,648 | ---- | C] () -- C:\Users\Lorna\Documents\saSetup.exe
[2013/10/22 11:14:54 | 001,252,686 | ---- | C] () -- C:\Users\Lorna\Documents\SAGEBACK010508.002
[2013/10/22 11:14:53 | 001,651,183 | ---- | C] () -- C:\Users\Lorna\Documents\rt_infuse_j15.tgz
[2013/10/22 11:14:53 | 001,561,078 | ---- | C] () -- C:\Users\Lorna\Documents\rt_vertigo_j15.tgz
[2013/10/22 11:14:52 | 001,190,402 | ---- | C] () -- C:\Users\Lorna\Documents\rt_affinity_j15.tgz
[2013/10/22 11:14:52 | 000,193,534 | ---- | C] () -- C:\Users\Lorna\Documents\replicant2-source.png
[2013/10/22 11:14:52 | 000,142,251 | ---- | C] () -- C:\Users\Lorna\Documents\Render 1.png
[2013/10/22 11:14:52 | 000,007,834 | ---- | C] () -- C:\Users\Lorna\Documents\rabbit2.png
[2013/10/22 11:14:51 | 000,114,202 | ---- | C] () -- C:\Users\Lorna\Documents\phtos unusul.nri
[2013/10/22 11:14:51 | 000,042,836 | ---- | C] () -- C:\Users\Lorna\Documents\PIXL_E.zip
[2013/10/22 11:14:51 | 000,014,915 | ---- | C] () -- C:\Users\Lorna\Documents\pic for payperhour.gif
[2013/10/22 11:14:50 | 006,213,246 | ---- | C] () -- C:\Users\Lorna\Documents\Photo Album.wmv
[2013/10/22 11:14:50 | 000,043,319 | ---- | C] () -- C:\Users\Lorna\Documents\penguin peyote.png
[2013/10/22 11:14:50 | 000,035,309 | ---- | C] () -- C:\Users\Lorna\Documents\penguin loom.png
[2013/10/22 11:14:50 | 000,026,816 | ---- | C] () -- C:\Users\Lorna\Documents\pdftedst.pdf
[2013/10/22 11:14:50 | 000,000,257 | R--- | C] () -- C:\Users\Lorna\Documents\PC Support.url
[2013/10/22 11:14:50 | 000,000,000 | ---- | C] () -- C:\Users\Lorna\Documents\PDFVistaPort
[2013/10/22 11:14:49 | 007,364,137 | ---- | C] () -- C:\Users\Lorna\Documents\orwell145b.exe
[2013/10/22 11:14:49 | 000,083,305 | ---- | C] () -- C:\Users\Lorna\Documents\paper doll maryjane.jpg
[2013/10/22 11:14:49 | 000,075,404 | R--- | C] () -- C:\Users\Lorna\Documents\Order-10527301-Docs-090326maggi.pdf
[2013/10/22 11:14:48 | 000,195,703 | R--- | C] () -- C:\Users\Lorna\Documents\Omotchama.rar
[2013/10/22 11:14:48 | 000,074,773 | R--- | C] () -- C:\Users\Lorna\Documents\Order-10520030-Docs-120335 Katrina .pdf
[2013/10/22 11:14:48 | 000,042,943 | ---- | C] () -- C:\Users\Lorna\Documents\oldtimeladypeyote.png
[2013/10/22 11:14:48 | 000,035,888 | ---- | C] () -- C:\Users\Lorna\Documents\oldtimeladyloom.png
[2013/10/22 11:14:46 | 058,615,296 | ---- | C] () -- C:\Users\Lorna\Documents\NOF-Essentials.exe
[2013/10/22 11:14:46 | 000,139,356 | ---- | C] () -- C:\Users\Lorna\Documents\NLP.zip
[2013/10/22 11:14:45 | 000,699,591 | ---- | C] () -- C:\Users\Lorna\Documents\Mysnowflakes.rtf
[2013/10/22 11:14:45 | 000,694,574 | ---- | C] () -- C:\Users\Lorna\Documents\nettie.png
[2013/10/22 11:14:45 | 000,351,585 | ---- | C] () -- C:\Users\Lorna\Documents\Mysnowflakes.pdf
[2013/10/22 11:14:45 | 000,187,007 | ---- | C] () -- C:\Users\Lorna\Documents\mysignature.png
[2013/10/22 11:14:45 | 000,161,621 | ---- | C] () -- C:\Users\Lorna\Documents\mywatchmanual.pdf
[2013/10/22 11:14:45 | 000,037,445 | ---- | C] () -- C:\Users\Lorna\Documents\MyMicroBalance2006.mmb
[2013/10/22 11:14:45 | 000,037,426 | ---- | C] () -- C:\Users\Lorna\Documents\MyMicroBalance2006.mmb.backup2
[2013/10/22 11:14:45 | 000,030,600 | ---- | C] () -- C:\Users\Lorna\Documents\MyMicroBalance2006.mmb.backup1
[2013/10/22 11:14:45 | 000,028,283 | ---- | C] () -- C:\Users\Lorna\Documents\MyMicroBalance2007.mmb
[2013/10/22 11:14:45 | 000,000,559 | ---- | C] () -- C:\Users\Lorna\Documents\My Sharing Folders.lnk
[2013/10/22 11:14:44 | 007,268,458 | ---- | C] () -- C:\Users\Lorna\Documents\Migrated Documents Report.csv
[2013/10/22 11:14:44 | 000,062,535 | ---- | C] () -- C:\Users\Lorna\Documents\modules-source.png
[2013/10/22 11:14:44 | 000,041,462 | ---- | C] () -- C:\Users\Lorna\Documents\Microsoft Word - r conboy webvert march 08.pdf
[2013/10/22 11:14:43 | 020,029,198 | ---- | C] () -- C:\Users\Lorna\Documents\Merry Christmas2.wmv
[2013/10/22 11:14:42 | 012,845,162 | ---- | C] () -- C:\Users\Lorna\Documents\Merry Christmas.wmv
[2013/10/22 11:14:42 | 000,182,928 | ---- | C] () -- C:\Users\Lorna\Documents\Making Wool Felt Booties.mht
[2013/10/22 11:14:42 | 000,140,974 | ---- | C] () -- C:\Users\Lorna\Documents\magicbutton.zip
[2013/10/22 11:14:42 | 000,103,521 | ---- | C] () -- C:\Users\Lorna\Documents\lv pl airInsurancePdf_2012.pdf
[2013/10/22 11:14:42 | 000,054,102 | ---- | C] () -- C:\Users\Lorna\Documents\menu-dropdown-source.png
[2013/10/22 11:14:42 | 000,023,034 | ---- | C] () -- C:\Users\Lorna\Documents\lv signature.png
[2013/10/22 11:14:40 | 002,171,605 | ---- | C] () -- C:\Users\Lorna\Documents\LoaderBackup-(2012-07-13)-3.bbb
[2013/10/22 11:14:40 | 002,169,420 | ---- | C] () -- C:\Users\Lorna\Documents\LoaderBackup-(2012-07-13)-2.bbb
[2013/10/22 11:14:40 | 002,169,411 | ---- | C] () -- C:\Users\Lorna\Documents\LoaderBackup-(2012-07-13).bbb
[2013/10/22 11:14:40 | 000,010,826 | ---- | C] () -- C:\Users\Lorna\Documents\logo.png
[2013/10/22 11:14:40 | 000,006,433 | ---- | C] () -- C:\Users\Lorna\Documents\logo1.gif
[2013/10/22 11:14:40 | 000,005,437 | ---- | C] () -- C:\Users\Lorna\Documents\logo-alt.png
[2013/10/22 11:14:40 | 000,000,681 | ---- | C] () -- C:\Users\Lorna\Documents\Lorna - Shortcut.lnk
[2013/10/22 11:14:39 | 007,108,414 | ---- | C] () -- C:\Users\Lorna\Documents\lasvegas.craft
[2013/10/22 11:14:39 | 002,169,408 | ---- | C] () -- C:\Users\Lorna\Documents\LoaderBackup-(2012-07-13)-1.bbb
[2013/10/22 11:14:39 | 002,125,788 | ---- | C] () -- C:\Users\Lorna\Documents\len and nell page 11 i think cmyk.pdf
[2013/10/22 11:14:39 | 000,202,368 | ---- | C] () -- C:\Users\Lorna\Documents\LayoutTool - Legacy.pdf
[2013/10/22 11:14:39 | 000,024,551 | ---- | C] () -- C:\Users\Lorna\Documents\lasvegaslv.jpg
[2013/10/22 11:14:38 | 010,469,136 | ---- | C] () -- C:\Users\Lorna\Documents\largexmas2011.craft
[2013/10/22 11:14:38 | 004,280,249 | ---- | C] () -- C:\Users\Lorna\Documents\joomla_15_quickstart.pdf
[2013/10/22 11:14:38 | 000,489,432 | ---- | C] () -- C:\Users\Lorna\Documents\IS SHAKESPEARE DEAD.pdf
[2013/10/22 11:14:38 | 000,122,285 | ---- | C] () -- C:\Users\Lorna\Documents\jemjoker.png
[2013/10/22 11:14:38 | 000,025,102 | ---- | C] () -- C:\Users\Lorna\Documents\JumpingJacks.pdf
[2013/10/22 11:14:38 | 000,011,379 | ---- | C] () -- C:\Users\Lorna\Documents\JumpingJacks(1).pdf
[2013/10/22 11:14:36 | 001,755,757 | ---- | C] () -- C:\Users\Lorna\Documents\Inside Front Cover.pdf
[2013/10/22 11:14:36 | 000,271,884 | ---- | C] () -- C:\Users\Lorna\Documents\invite square copy.jpg
[2013/10/22 11:14:36 | 000,083,274 | ---- | C] () -- C:\Users\Lorna\Documents\install_7-zip_.exe
[2013/10/22 11:14:35 | 002,019,964 | ---- | C] () -- C:\Users\Lorna\Documents\inside back cover cmyk.pdf
[2013/10/22 11:14:35 | 000,804,036 | ---- | C] () -- C:\Users\Lorna\Documents\Image3.psp
[2013/10/22 11:14:34 | 038,197,265 | ---- | C] () -- C:\Users\Lorna\Documents\hhswholething.pdf
[2013/10/22 11:14:34 | 001,669,393 | ---- | C] () -- C:\Users\Lorna\Documents\High-Raw-Kevin-Gianni.pdf
[2013/10/22 11:14:34 | 000,001,361 | ---- | C] () -- C:\Users\Lorna\Documents\hosts
[2013/10/22 11:14:31 | 000,513,317 | ---- | C] () -- C:\Users\Lorna\Documents\heartsnflowerspng.png
[2013/10/22 11:14:31 | 000,186,339 | ---- | C] () -- C:\Users\Lorna\Documents\Hearts.pdf
[2013/10/22 11:14:31 | 000,121,673 | ---- | C] () -- C:\Users\Lorna\Documents\HEARTSfinal layout.pdf
[2013/10/22 11:14:31 | 000,020,769 | ---- | C] () -- C:\Users\Lorna\Documents\Heart_templates.pdf
[2013/10/22 11:14:28 | 000,695,282 | ---- | C] () -- C:\Users\Lorna\Documents\GoogleAdwordsProduct.zip
[2013/10/22 11:14:28 | 000,324,804 | ---- | C] () -- C:\Users\Lorna\Documents\front cover cmyk.pdf
[2013/10/22 11:14:28 | 000,045,708 | ---- | C] () -- C:\Users\Lorna\Documents\girl1lpey.png
[2013/10/22 11:14:28 | 000,037,505 | ---- | C] () -- C:\Users\Lorna\Documents\girl1loom.png
[2013/10/22 11:14:28 | 000,002,390 | ---- | C] () -- C:\Users\Lorna\Documents\glutole.hottnote
[2013/10/22 11:14:27 | 015,425,536 | ---- | C] () -- C:\Users\Lorna\Documents\From the time I was a little girl.pps
[2013/10/22 11:14:25 | 001,313,030 | ---- | C] () -- C:\Users\Lorna\Documents\flowersp.bmp
[2013/10/22 11:14:25 | 000,202,368 | ---- | C] () -- C:\Users\Lorna\Documents\flower.pdf
[2013/10/22 11:14:25 | 000,201,436 | ---- | C] () -- C:\Users\Lorna\Documents\floral1peyote1.pdf
[2013/10/22 11:14:25 | 000,196,909 | ---- | C] () -- C:\Users\Lorna\Documents\flower1
[2013/10/22 11:14:25 | 000,113,685 | ---- | C] () -- C:\Users\Lorna\Documents\fox2crop.JPG
[2013/10/22 11:14:25 | 000,104,770 | ---- | C] () -- C:\Users\Lorna\Documents\floralpeyote v2.pdf
[2013/10/22 11:14:25 | 000,100,773 | ---- | C] () -- C:\Users\Lorna\Documents\floral1 peyote1.pdf
[2013/10/22 11:14:25 | 000,100,692 | ---- | C] () -- C:\Users\Lorna\Documents\floral1.pdf
[2013/10/22 11:14:25 | 000,009,948 | ---- | C] () -- C:\Users\Lorna\Documents\flower_template.pdf
[2013/10/22 11:14:24 | 000,215,381 | ---- | C] () -- C:\Users\Lorna\Documents\FlipBook3DMain.swf
[2013/10/22 11:14:24 | 000,138,468 | ---- | C] () -- C:\Users\Lorna\Documents\farm1a.JPG
[2013/10/22 11:14:23 | 000,089,180 | ---- | C] () -- C:\Users\Lorna\Documents\Fact Find 2 TESTGeneral.pdf
[2013/10/22 11:14:23 | 000,068,240 | ---- | C] () -- C:\Users\Lorna\Documents\Fact Find 2test1l.pdf
[2013/10/22 11:14:22 | 004,868,248 | ---- | C] () -- C:\Users\Lorna\Documents\ETSToysA.pdf
[2013/10/22 11:14:22 | 002,717,291 | ---- | C] () -- C:\Users\Lorna\Documents\ETSToysB.pdf
[2013/10/22 11:14:22 | 000,606,891 | ---- | C] () -- C:\Users\Lorna\Documents\Elfic_doll.pdf
[2013/10/22 11:14:22 | 000,334,132 | ---- | C] () -- C:\Users\Lorna\Documents\Etsy sylver Sylver Designs.mht
[2013/10/22 11:14:21 | 000,925,138 | ---- | C] () -- C:\Users\Lorna\Documents\edge.xps
[2013/10/22 11:14:21 | 000,112,236 | ---- | C] () -- C:\Users\Lorna\Documents\DVLA Vehicle Licensing Online Apply for a tax disc NOW.mht
[2013/10/22 11:14:21 | 000,034,652 | ---- | C] () -- C:\Users\Lorna\Documents\earlylady1peyote.png
[2013/10/22 11:14:21 | 000,029,265 | ---- | C] () -- C:\Users\Lorna\Documents\earlylady1loom.png
[2013/10/22 11:14:21 | 000,016,137 | ---- | C] () -- C:\Users\Lorna\Documents\decoladypeyote.png
[2013/10/22 11:14:21 | 000,013,977 | ---- | C] () -- C:\Users\Lorna\Documents\decoladyloom.png
[2013/10/22 11:14:21 | 000,013,396 | ---- | C] () -- C:\Users\Lorna\Documents\dvlalicenceapp.pdf
[2013/10/22 11:14:21 | 000,002,322 | ---- | C] () -- C:\Users\Lorna\Documents\Document2.wpd
[2013/10/22 11:14:20 | 004,017,882 | ---- | C] () -- C:\Users\Lorna\Documents\CTMJanFeb08 FINAL.pdf
[2013/10/22 11:14:20 | 000,002,859 | ---- | C] () -- C:\Users\Lorna\Documents\dddd.csv
[2013/10/22 11:14:19 | 000,023,005 | ---- | C] () -- C:\Users\Lorna\Documents\CTFEB07CrochetFroggyHatCheerioEssentials.pdf
[2013/10/22 11:14:18 | 000,292,350 | ---- | C] () -- C:\Users\Lorna\Documents\Crocheted Frog Treasure Pocket.mht
[2013/10/22 11:14:17 | 000,166,321 | ---- | C] () -- C:\Users\Lorna\Documents\copyrightnotice.pdf
[2013/10/22 11:14:16 | 003,559,424 | ---- | C] () -- C:\Users\Lorna\Documents\Charitable contributions.accdb
[2013/10/22 11:14:14 | 043,144,704 | ---- | C] () -- C:\Users\Lorna\Documents\CGSX3SP2.msp
[2013/10/22 11:14:14 | 029,478,912 | ---- | C] () -- C:\Users\Lorna\Documents\CGSX3SP1.msp
[2013/10/22 11:14:07 | 001,107,100 | ---- | C] () -- C:\Users\Lorna\Documents\CD30 BUTTERFLY KINETIC SWING CA.svg
[2013/10/22 11:14:06 | 000,480,086 | ---- | C] () -- C:\Users\Lorna\Documents\Card07.pdf
[2013/10/22 11:14:06 | 000,319,332 | ---- | C] () -- C:\Users\Lorna\Documents\cc_20130614_200931.reg
[2013/10/22 11:14:06 | 000,101,094 | ---- | C] () -- C:\Users\Lorna\Documents\CD30 BUTTERFLY KINETIC SWING CA.pdf
[2013/10/22 11:14:06 | 000,094,760 | ---- | C] () -- C:\Users\Lorna\Documents\cc_20130717_222003.reg
[2013/10/22 11:14:06 | 000,062,746 | ---- | C] () -- C:\Users\Lorna\Documents\cc_20130614_202503.reg
[2013/10/22 11:14:06 | 000,050,750 | ---- | C] () -- C:\Users\Lorna\Documents\cctreescrop.JPG
[2013/10/22 11:14:06 | 000,033,184 | ---- | C] () -- C:\Users\Lorna\Documents\cc_20131016_000724.reg
[2013/10/22 11:14:06 | 000,030,030 | ---- | C] () -- C:\Users\Lorna\Documents\cc_20111214_181813.reg
[2013/10/22 11:14:06 | 000,018,942 | ---- | C] () -- C:\Users\Lorna\Documents\cc_20130902_153501.reg
[2013/10/22 11:14:06 | 000,007,302 | ---- | C] () -- C:\Users\Lorna\Documents\cc_20120108_154432.reg
[2013/10/22 11:14:06 | 000,005,750 | ---- | C] () -- C:\Users\Lorna\Documents\cc_20130614_203430.reg
[2013/10/22 11:14:05 | 001,998,134 | ---- | C] () -- C:\Users\Lorna\Documents\broadsheetsteampunk.pdf
[2013/10/22 11:14:05 | 000,467,168 | ---- | C] () -- C:\Users\Lorna\Documents\Card06.pdf
[2013/10/22 11:14:05 | 000,315,773 | ---- | C] () -- C:\Users\Lorna\Documents\Card04.pdf
[2013/10/22 11:14:05 | 000,138,078 | ---- | C] () -- C:\Users\Lorna\Documents\bookmarks_10_02_2012.html
[2013/10/22 11:14:05 | 000,100,676 | ---- | C] () -- C:\Users\Lorna\Documents\Bulk_Certificate_Posting_Signature.pdf
[2013/10/22 11:14:05 | 000,036,419 | ---- | C] () -- C:\Users\Lorna\Documents\calendar_organizer_months.pdf
[2013/10/22 11:14:05 | 000,036,385 | ---- | C] () -- C:\Users\Lorna\Documents\Bulk_Certificate_Posting_Standard.pdf
[2013/10/22 11:14:04 | 011,721,211 | ---- | C] () -- C:\Users\Lorna\Documents\bigbadges.craft
[2013/10/22 11:14:04 | 001,581,606 | ---- | C] () -- C:\Users\Lorna\Documents\Bookkeeping
[2013/10/22 11:14:03 | 002,807,643 | ---- | C] () -- C:\Users\Lorna\Documents\BABYmocsBtys.pdf
[2013/10/22 11:14:03 | 000,305,408 | ---- | C] () -- C:\Users\Lorna\Documents\banner.png
[2013/10/22 11:14:02 | 010,676,572 | ---- | C] () -- C:\Users\Lorna\Documents\auctamerpro.exe
[2013/10/22 11:14:02 | 000,161,621 | ---- | C] () -- C:\Users\Lorna\Documents\B023_ebook.pdf
[2013/10/22 11:14:01 | 010,676,572 | ---- | C] () -- C:\Users\Lorna\Documents\auctamerpro(1).exe
[2013/10/22 11:14:00 | 002,355,200 | ---- | C] () -- C:\Users\Lorna\Documents\amclassical_silent_night.mp3
[2013/10/22 11:14:00 | 000,511,137 | ---- | C] () -- C:\Users\Lorna\Documents\AmazonDealProduct.zip
[2013/10/22 11:13:59 | 004,844,131 | R--- | C] () -- C:\Users\Lorna\Documents\Alien_Blaster_PePaKuRa_File_by_billybob884.rar
[2013/10/22 11:13:59 | 003,533,600 | ---- | C] () -- C:\Users\Lorna\Documents\alice1.ppp
[2013/10/22 11:13:59 | 001,231,224 | ---- | C] () -- C:\Users\Lorna\Documents\agendusstd_ota_en.prc
[2013/10/22 11:13:59 | 000,161,278 | ---- | C] () -- C:\Users\Lorna\Documents\aglaciercrop.JPG
[2013/10/22 11:13:59 | 000,109,943 | ---- | C] () -- C:\Users\Lorna\Documents\alicewivbaby.jpg
[2013/10/22 11:13:59 | 000,059,844 | ---- | C] () -- C:\Users\Lorna\Documents\Absolut_Pro_Bold.otf
[2013/10/22 11:13:59 | 000,000,406 | ---- | C] () -- C:\Users\Lorna\Documents\348059.vcf
[2013/10/22 11:13:59 | 000,000,081 | ---- | C] () -- C:\Users\Lorna\Documents\1Click.cfg
[2013/10/22 11:13:58 | 004,485,072 | ---- | C] () -- C:\Users\Lorna\Documents\1940sxmas2.craft
[2013/10/22 11:13:58 | 000,000,364 | ---- | C] () -- C:\Users\Lorna\Documents\08-10-30.sv
[2013/10/21 19:21:23 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2013/10/21 17:33:07 | 000,001,915 | ---- | C] () -- C:\Users\Lorna\Desktop\Dashlane.lnk
[2013/10/20 18:59:46 | 000,002,087 | ---- | C] () -- C:\Users\Lorna\Desktop\DAZ 3D Install Manager 1.lnk
[2013/10/19 12:24:31 | 000,000,974 | ---- | C] () -- C:\Users\Lorna\Desktop\DAZ Studio 4.6 (64-bit).lnk
[2012/05/24 20:24:55 | 000,001,269 | ---- | C] () -- C:\Users\Lorna\.recently-used.xbel
[2012/05/08 18:29:44 | 000,000,132 | ---- | C] () -- C:\Users\Lorna\AppData\Roaming\Adobe IllExport Filter CS5 Prefs
[2012/03/19 00:24:05 | 000,006,168 | ---- | C] () -- C:\Users\Lorna\AppData\Local\recently-used.xbel
[2012/03/07 20:12:53 | 000,035,328 | ---- | C] () -- C:\Windows\INETWH32.DLL
[2012/03/07 20:12:53 | 000,009,136 | ---- | C] () -- C:\Windows\INETWH16.DLL
[2012/03/07 20:12:53 | 000,004,528 | ---- | C] () -- C:\Windows\SETBROWS.EXE
[2012/03/07 20:06:35 | 000,044,544 | ---- | C] () -- C:\Windows\AWuninstall.exe
[2012/03/04 15:54:23 | 000,002,800 | ---- | C] () -- C:\Users\Lorna\2px-80percentransparencyblack.png
[2012/02/27 21:48:53 | 000,111,661 | ---- | C] () -- C:\Users\Lorna\Image2.jpg
[2012/02/26 17:49:45 | 000,000,084 | ---- | C] () -- C:\Users\Lorna\pathinfo.php
[2012/02/15 14:23:05 | 000,000,092 | -HS- | C] () -- C:\Windows\WSYS049.SYS
[2012/02/15 14:18:01 | 000,212,233 | ---- | C] () -- C:\Windows\Photo Pos Pro Uninstaller.exe.bak
[2012/02/12 20:44:55 | 000,172,032 | ---- | C] () -- C:\Users\Lorna\abrViewer.NET.exe
[2012/01/08 15:21:55 | 000,004,800 | ---- | C] () -- C:\ProgramData\NTIRegistry.REG
[2011/12/23 23:32:32 | 000,001,164 | ---- | C] () -- C:\Windows\wininit.ini
[2011/11/21 18:44:45 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
[2011/11/21 18:44:45 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
[2011/11/05 17:12:38 | 000,543,531 | ---- | C] () -- C:\Users\Lorna\New document 1.2011_11_05_17_12_38.0.svg
[2011/06/22 08:08:33 | 000,000,000 | ---- | C] () -- C:\Users\Lorna\AppData\Local\{5975D6E1-F7BB-4A5D-AD55-1634EB9C6B35}
[2011/06/13 15:12:39 | 000,000,000 | ---- | C] () -- C:\Users\Lorna\AppData\Local\{0DBB6458-1470-4D4F-9753-7EAB03AE0100}
[2011/03/04 12:56:48 | 000,040,907 | ---- | C] () -- C:\Users\Lorna\kitty_headbang.gif
[2011/01/14 22:53:58 | 000,000,132 | ---- | C] () -- C:\Users\Lorna\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2010/12/19 23:48:49 | 000,000,048 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/10/04 21:58:22 | 000,000,837 | ---- | C] () -- C:\Users\Lorna\AppData\Roaming\FrameFun.ini
[2010/10/03 16:26:15 | 000,001,456 | ---- | C] () -- C:\Users\Lorna\AppData\Local\Adobe Save for Web 12.0 Prefs
[2010/10/03 10:44:53 | 000,006,144 | ---- | C] () -- C:\Users\Lorna\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/01 20:42:00 | 000,000,036 | ---- | C] () -- C:\Users\Lorna\AppData\Local\housecall.guid.cache
[2010/09/22 08:57:37 | 000,033,134 | ---- | C] () -- C:\Users\Lorna\AppData\Roaming\UserTile.png
[2010/09/13 08:10:50 | 000,149,504 | ---- | C] () -- C:\Users\Lorna\AppData\Roaming\SharedSettings.ccs
[2010/08/27 16:51:33 | 000,000,132 | ---- | C] () -- C:\Users\Lorna\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2010/08/17 11:14:46 | 002,064,206 | ---- | C] () -- C:\Users\Lorna\vichallflyerfinal.pdf
[2010/06/30 16:48:41 | 000,004,943 | ---- | C] () -- C:\ProgramData\pyknfeyt.slj
[2010/06/21 08:25:44 | 000,000,104 | ---- | C] () -- C:\Users\Lorna\AppData\Roaming\wklnhst.dat
[2010/05/10 08:55:47 | 000,135,441 | ---- | C] () -- C:\Program Files\VH1946-09.jpg
[2008/01/18 21:23:30 | 000,031,766 | ---- | C] () -- C:\Users\Lorna\20067.tdb
[2008/01/18 21:22:33 | 000,000,407 | ---- | C] () -- C:\Users\Lorna\tbook.properties
========== ZeroAccess Check ==========
[2009/08/19 09:40:19 | 000,054,458 | ---- | M] () -- C:\$Recycle.bin\S-1-5-21-1062119836-663356838-3640058548-1001\$R819B5X\My Downloaded Artwork\Metallic Alphabet\L.png
[2009/08/19 09:40:42 | 000,077,456 | ---- | M] () -- C:\$Recycle.bin\S-1-5-21-1062119836-663356838-3640058548-1001\$R819B5X\My Downloaded Artwork\Metallic Alphabet\N.png
[2009/08/19 09:42:00 | 000,069,609 | ---- | M] () -- C:\$Recycle.bin\S-1-5-21-1062119836-663356838-3640058548-1001\$R819B5X\My Downloaded Artwork\Metallic Alphabet\U.png
[2009/07/14 04:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012/01/04 09:59:19 | 014,164,480 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/01/04 09:03:45 | 012,868,096 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 01:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/07/14 01:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 01:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2012/02/10 12:09:24 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Avant Downloader
[2012/04/02 13:09:02 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Azureus
[2012/04/02 13:09:02 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\BeadTool
[2012/08/15 20:17:46 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Canon
[2010/07/23 20:43:03 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/04/02 13:08:04 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Chrysanth
[2010/09/15 20:26:58 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\CoffeeCup Software
[2010/07/27 15:55:43 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/05/10 16:24:20 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Craftwell Inc
[2012/04/02 13:08:05 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\CTdeveloping
[2010/06/18 21:52:46 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\CustomBrushesMini
[2013/11/06 12:30:57 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Dashlane
[2013/10/19 12:33:25 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\DAZ 3D
[2010/08/11 09:06:07 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\DeviceDoctorSoftware
[2013/11/07 21:19:15 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Dropbox
[2012/05/10 17:06:29 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\eCraftShop Pro
[2010/08/30 19:35:45 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Filter Forge Freepack 3 - Frames
[2012/04/02 13:09:03 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\gtk-2.0
[2011/01/21 23:19:58 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\inkscape
[2011/09/15 15:10:27 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Kaleider
[2012/03/19 20:29:22 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\LumaPix
[2012/04/02 13:09:04 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Maxthon2
[2012/05/02 18:03:16 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\NexusFont
[2010/06/07 01:01:05 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Nuance
[2012/04/05 16:02:11 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\onOne Software
[2012/04/02 13:08:22 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Opera
[2010/09/07 10:00:26 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\PC Suite
[2010/09/22 08:57:36 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\PeerNetworking
[2010/07/19 11:06:22 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\PhotoEchoes
[2012/04/02 13:08:22 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Poser Debut
[2012/04/02 13:09:05 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\PowerCinema
[2012/04/02 13:09:05 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Q-Dir
[2012/04/02 13:08:37 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Serif
[2012/04/02 13:09:06 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\SoftDMA
[2011/09/14 15:34:38 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\SPE
[2010/07/27 20:43:06 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010/06/21 08:25:51 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Template
[2012/04/02 13:08:39 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Trusteer
[2012/05/04 20:52:46 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\XnView
[2012/03/30 17:03:32 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Yandex
[2012/04/02 13:08:40 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\Zeon
[2011/11/03 10:59:55 | 000,000,000 | ---D | M] -- C:\Users\Lorna\AppData\Roaming\ZinioReader4.9310D8F796442B71068C511E15D70529A702D19D.1
========== Purity Check ==========
========== Custom Scans ==========
< %USERPROFILE%\..|smtmp;true;true;true /FP >
< %temp%\smtmp\*.* /s > >
< MD5 for: EXPLORER.ADML >
[2009/07/14 02:30:02 | 000,003,695 | ---- | M] () MD5=7A4C7F3CB156543113596988479CAFCE -- C:\Windows\winsxs\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7ef5713984067904\Explorer.adml
< MD5 for: EXPLORER.ADMX >
[2009/06/10 20:53:55 | 000,003,836 | ---- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 -- C:\Windows\winsxs\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.1.7600.16385_none_71af9b5b0a86e6b7\Explorer.admx
< MD5 for: EXPLORER.EXE >
[2011/02/26 06:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\ERDNT\cache86\explorer.exe
[2011/02/26 06:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\explorer.exe
[2011/02/26 06:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/10/05 15:46:38 | 003,167,656 | ---- | M] (Safer-Networking Ltd.) MD5=0AB68BFCE1579A61C36B79CAAFDCE992 -- C:\Program Files (x86)\Spybot - Search & Destroy 2\explorer.exe
[2011/02/26 05:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/14 01:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 05:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009/10/31 05:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 05:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\SysWOW64\explorer.exe
[2011/02/26 05:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 06:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 06:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 12:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009/08/03 06:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 05:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009/10/31 06:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009/08/03 05:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 13:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009/10/31 06:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009/08/03 05:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/14 01:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009/10/31 06:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011/02/26 06:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009/08/03 06:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
< MD5 for: EXPLORER.EXE.MUI >
[2009/07/14 02:26:48 | 000,022,016 | ---- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 -- C:\Windows\en-US\explorer.exe.mui
[2009/07/14 02:26:48 | 000,022,016 | ---- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_61e778c48d52d19b\explorer.exe.mui
[2009/07/14 02:06:56 | 000,022,016 | ---- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 -- C:\Windows\SysWOW64\en-US\explorer.exe.mui
[2009/07/14 02:06:56 | 000,022,016 | ---- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6c3c2316c1b39396\explorer.exe.mui
< MD5 for: EXPLORER.EXE-03C49D11.PF >
[2013/11/07 21:00:27 | 000,204,044 | ---- | M] () MD5=437A1EC8FFBB8C329F4911AC239FBBF1 -- C:\Windows\Prefetch\EXPLORER.EXE-03C49D11.pf
< MD5 for: IEXPLORE.BAT >
[2013/10/15 22:05:47 | 000,031,414 | ---- | M] () MD5=75C9C20DD9839BF287B43B0E179822DC -- C:\Users\Lorna\AppData\Local\Temp\jrt\iexplore.bat
< MD5 for: IEXPLORE.EXE >
[2011/11/05 05:28:03 | 000,696,600 | ---- | M] (Microsoft Corporation) MD5=0377589BF14A6E5667B730D6D6DB59B4 -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16912_none_0fae4f323e42a646\iexplore.exe
[2010/09/08 04:36:39 | 000,673,040 | ---- | M] (Microsoft Corporation) MD5=14803EA3E5DD7CB37CB446C74CFDA38F -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20795_none_1a39121b8bff3c23\iexplore.exe
[2011/04/22 20:15:52 | 000,696,592 | ---- | M] (Microsoft Corporation) MD5=281C23EC5BCB1853A5D571F1A6E52FB1 -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20949_none_101e7c5957724e1d\iexplore.exe
[2009/07/14 01:17:29 | 000,673,048 | ---- | M] (Microsoft Corporation) MD5=2C32E3E596CFE660353753EABEFB0540 -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_19ba3f8a72d988f3\iexplore.exe
[2011/12/16 08:03:08 | 000,673,048 | ---- | M] (Microsoft Corporation) MD5=38668C6CADABC9487C683FADD3D165D0 -- C:\Windows\SoftwareDistribution\Download\b0feba321cfd1099562f871d1ce948a1\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16930_none_19eb591872b56d75\iexplore.exe
[2011/08/20 04:35:15 | 000,673,024 | ---- | M] (Microsoft Corporation) MD5=41FE5E37EFE0B587A688BA0E4FA41288 -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16869_none_19d3ea0872c5a830\iexplore.exe
[2011/11/05 05:34:31 | 000,696,600 | ---- | M] (Microsoft Corporation) MD5=441C397A9ECF07747920F7F5E40B419B -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21085_none_0fef13a357968bc7\iexplore.exe
[2010/09/08 05:37:57 | 000,696,592 | ---- | M] (Microsoft Corporation) MD5=4879CB864E290BED38C5BDB641144B1B -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20795_none_0fe467c9579e7a28\iexplore.exe
[2010/09/08 05:49:01 | 000,696,592 | ---- | M] (Microsoft Corporation) MD5=498035ABCCF1ED47AE6791D239187587 -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16671_none_0f6c69ae3e743d20\iexplore.exe
[2010/11/04 05:54:54 | 000,673,040 | ---- | M] (Microsoft Corporation) MD5=58CF468D3FF4CF830339FE5E45356355 -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16700_none_1a0bc510729d1f54\iexplore.exe
[2010/09/08 04:31:24 | 000,673,040 | ---- | M] (Microsoft Corporation) MD5=61EDBCE47ADF3E52AB0B9F49EE4AEBB8 -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16671_none_19c1140072d4ff1b\iexplore.exe
[2011/04/22 19:29:16 | 000,673,040 | ---- | M] (Microsoft Corporation) MD5=64EFAF916C4009F1B84153D0BB491FB0 -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16800_none_1a0bc6f6729d1c7b\iexplore.exe
[2010/11/04 05:54:59 | 000,673,040 | ---- | M] (Microsoft Corporation) MD5=6B2258FF6D2332073FE9E90122FA4168 -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20831_none_1a75f2618bd22c48\iexplore.exe
[2011/06/21 06:14:22 | 000,696,592 | ---- | M] (Microsoft Corporation) MD5=6B2383EDA3956983E3219A62D8408DAB -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20992_none_0fe16ab757a12871\iexplore.exe
[2011/06/21 05:25:30 | 000,673,040 | ---- | M] (Microsoft Corporation) MD5=6BB506124872ACDFAC5BD912CA1334CE -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20992_none_1a3615098c01ea6c\iexplore.exe
[2010/12/18 06:17:48 | 000,696,592 | ---- | M] (Microsoft Corporation) MD5=700B40EA39DFB25517A81032F03D6D20 -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16722_none_0fa37b7a3e4ac7e9\iexplore.exe
[2010/11/20 13:28:25 | 000,695,056 | ---- | M] (Microsoft Corporation) MD5=86257731DDB311FBC283534CC0091634 -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1196a9003b674a92\iexplore.exe
[2010/12/18 06:11:10 | 000,696,592 | ---- | M] (Microsoft Corporation) MD5=8C6C32E4AF8A3D7155656F5897C504E0 -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20861_none_1000d84b5789be20\iexplore.exe
[2011/11/05 04:38:00 | 000,673,048 | ---- | M] (Microsoft Corporation) MD5=8ED7C19AEFA3673AADB0D6864B03FBCE -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16912_none_1a02f98472a36841\iexplore.exe
[2012/02/20 10:18:11 | 000,748,336 | ---- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
[2012/02/20 10:18:11 | 000,748,336 | ---- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16421_none_17a944edb4ca4c7a\iexplore.exe
[2010/12/18 05:32:25 | 000,673,040 | ---- | M] (Microsoft Corporation) MD5=9321CF0D023528C71E3645F8433C86C8 -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20861_none_1a55829d8bea801b\iexplore.exe
[2011/06/21 05:37:00 | 000,673,040 | ---- | M] (Microsoft Corporation) MD5=A3AB0A260049BE22AB52E302D9220A92 -- C:\Windows\ERDNT\cache86\iexplore.exe
[2011/06/21 05:37:00 | 000,673,040 | ---- | M] (Microsoft Corporation) MD5=A3AB0A260049BE22AB52E302D9220A92 -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16839_none_19f459cc72ad545d\iexplore.exe
[2011/12/16 08:45:57 | 000,696,600 | ---- | M] (Microsoft Corporation) MD5=A3F56CED7B94A30BE8954387F0E2B5D2 -- C:\Windows\SoftwareDistribution\Download\b0feba321cfd1099562f871d1ce948a1\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16930_none_0f96aec63e54ab7a\iexplore.exe
[2011/11/05 04:39:45 | 000,673,048 | ---- | M] (Microsoft Corporation) MD5=A8A14CD0CB499B80412F75D53996AE29 -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21085_none_1a43bdf58bf74dc2\iexplore.exe
[2010/12/18 05:33:54 | 000,673,040 | ---- | M] (Microsoft Corporation) MD5=AA08B68EF4E35EFA170CF85A44B23B70 -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16722_none_19f825cc72ab89e4\iexplore.exe
[2011/02/24 05:45:11 | 000,673,040 | ---- | M] (Microsoft Corporation) MD5=AB2BB40A5FE49AD236791AC22BD08869 -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20908_none_1a9d66118bb386fd\iexplore.exe
[2011/08/20 05:46:07 | 000,696,576 | ---- | M] (Microsoft Corporation) MD5=AC1CC7CD5CBE60EFF105BB3C0DC199C5 -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16869_none_0f7f3fb63e64e635\iexplore.exe
[2011/06/21 06:21:24 | 000,696,592 | ---- | M] (Microsoft Corporation) MD5=B38DE184AC135A4B0AE7D286476FA33F -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16839_none_0f9faf7a3e4c9262\iexplore.exe
[2011/02/24 06:29:19 | 000,696,592 | ---- | M] (Microsoft Corporation) MD5=B4881B8F6EDB48CABD44BCC9FB5475C4 -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20908_none_1048bbbf5752c502\iexplore.exe
[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2011/12/16 08:42:35 | 000,696,600 | ---- | M] (Microsoft Corporation) MD5=C152529FD67ABB61F0609EF5A299794C -- C:\Windows\SoftwareDistribution\Download\b0feba321cfd1099562f871d1ce948a1\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21108_none_104895c75752f56b\iexplore.exe
[2011/12/16 09:19:51 | 000,673,048 | ---- | M] (Microsoft Corporation) MD5=C53E41F92B19EC97D987F968403BEC49 -- C:\Windows\SoftwareDistribution\Download\b0feba321cfd1099562f871d1ce948a1\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21108_none_1a9d40198bb3b766\iexplore.exe
[2010/11/20 12:22:51 | 000,673,040 | ---- | M] (Microsoft Corporation) MD5=C613E69C3B191BB02C7A191741A1D024 -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1beb53526fc80c8d\iexplore.exe
[2011/02/24 05:32:52 | 000,673,040 | ---- | M] (Microsoft Corporation) MD5=C6697A46554E36541E81182B258A19D6 -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16766_none_19d0e74472c85f04\iexplore.exe
[2011/08/20 05:42:38 | 000,696,576 | ---- | M] (Microsoft Corporation) MD5=C66C8BF791F9DB974022506265518EE0 -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21033_none_102322ab576fcd64\iexplore.exe
[2011/04/22 20:16:25 | 000,696,592 | ---- | M] (Microsoft Corporation) MD5=D6F57A9ECB4606076FB9519D1698FCBA -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16800_none_0fb71ca43e3c5a80\iexplore.exe
[2010/11/04 06:37:41 | 000,696,592 | ---- | M] (Microsoft Corporation) MD5=D8E00EA671A1EFE95C69C7566C505AD4 -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16700_none_0fb71abe3e3c5d59\iexplore.exe
[2011/02/24 06:32:09 | 000,696,592 | ---- | M] (Microsoft Corporation) MD5=E1BBDE0F187194D4B08335234A4B9FC7 -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16766_none_0f7c3cf23e679d09\iexplore.exe
[2010/11/04 06:42:22 | 000,696,592 | ---- | M] (Microsoft Corporation) MD5=E220FB009F54AAF649C6A278A5156764 -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20831_none_1021480f57716a4d\iexplore.exe
[2012/02/20 10:18:00 | 000,754,480 | ---- | M] (Microsoft Corporation) MD5=F1424C1B9B1813BF825E45DF3790BC8A -- C:\Program Files\Internet Explorer\iexplore.exe
[2012/02/20 10:18:00 | 000,754,480 | ---- | M] (Microsoft Corporation) MD5=F1424C1B9B1813BF825E45DF3790BC8A -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16421_none_0d549a9b80698a7f\iexplore.exe
[2009/07/14 01:43:43 | 000,696,600 | ---- | M] (Microsoft Corporation) MD5=F2B0D41E1D08D0B2006DF5AA2E74C81E -- C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_0f6595383e78c6f8\iexplore.exe
[2011/04/22 19:11:29 | 000,673,040 | ---- | M] (Microsoft Corporation) MD5=F94877A94996B3C12BB31AD722840457 -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20949_none_1a7326ab8bd31018\iexplore.exe
[2011/08/20 04:32:44 | 000,673,024 | ---- | M] (Microsoft Corporation) MD5=FA623BE79902A7B49FF4F21117B63C83 -- C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.21033_none_1a77ccfd8bd08f5f\iexplore.exe
< MD5 for: IEXPLORE.EXE.MUI >
[2012/02/20 10:18:01 | 000,005,632 | ---- | M] (Microsoft Corporation) MD5=17FAE936C452188D05852DE8D1082013 -- C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2012/02/20 10:18:01 | 000,005,632 | ---- | M] (Microsoft Corporation) MD5=17FAE936C452188D05852DE8D1082013 -- C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_en-us_07013012b816cb66\iexplore.exe.mui
[2012/02/20 10:18:15 | 000,005,632 | ---- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F -- C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui
[2012/02/20 10:18:15 | 000,005,632 | ---- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F -- C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_en-us_1155da64ec778d61\iexplore.exe.mui
[2009/07/14 02:29:20 | 000,005,120 | ---- | M] (Microsoft Corporation) MD5=C29BCFB504E33FEADDFA2D0183CEF62F -- C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7600.16385_en-us_09122aaf762607df\iexplore.exe.mui
[2009/07/14 02:29:20 | 000,005,120 | ---- | M] (Microsoft Corporation) MD5=C29BCFB504E33FEADDFA2D0183CEF62F -- C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_0b433e7773148b79\iexplore.exe.mui
[2009/07/14 02:05:06 | 000,005,120 | ---- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 -- C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7600.16385_en-us_1366d501aa86c9da\iexplore.exe.mui
[2009/07/14 02:05:06 | 000,005,120 | ---- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 -- C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_1597e8c9a7754d74\iexplore.exe.mui
< MD5 for: SERVICES >
[2009/06/10 21:00:26 | 000,017,463 | ---- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 -- C:\Windows\winsxs\amd64_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_6079f415110c0210\services
< MD5 for: SERVICES.DAT >
[2013/10/15 19:36:22 | 000,003,075 | ---- | M] () MD5=6806FCE3B99E6913439FB220BF6544B0 -- C:\Users\Lorna\AppData\Local\Temp\jrt\services.dat
< MD5 for: SERVICES.DTD >
[2012/03/28 20:40:18 | 000,007,693 | ---- | M] () MD5=0167EEA0CD182E558850B3E3BF241D88 -- C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Yandex\Toolbar\branding\{06990470-8417-465F-8B58-A3008B344A95}\locale\ru\services.dtd
[2012/03/28 20:40:18 | 000,007,080 | ---- | M] () MD5=5ED0DE2E8771F3061E8A5EA7E83858C4 -- C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Yandex\Toolbar\branding\{06990470-8417-465F-8B58-A3008B344A95}\locale\en\services.dtd
[2012/03/28 20:40:18 | 000,007,679 | ---- | M] () MD5=6F349841B35825885251E27954AC2F43 -- C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Yandex\Toolbar\branding\{06990470-8417-465F-8B58-A3008B344A95}\locale\be\services.dtd
[2012/03/28 20:40:18 | 000,007,109 | ---- | M] () MD5=863C33EF25373CD8D1103ECEDF027D6F -- C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Yandex\Toolbar\branding\{06990470-8417-465F-8B58-A3008B344A95}\locale\cs\services.dtd
[2012/03/28 20:40:18 | 000,007,701 | ---- | M] () MD5=B0758798DEEF23E1D7EF07112D281FCA -- C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Yandex\Toolbar\branding\{06990470-8417-465F-8B58-A3008B344A95}\locale\uk\services.dtd
[2012/03/28 20:40:18 | 000,007,859 | ---- | M] () MD5=ECD85452EF5E94D66560797B64751E28 -- C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Yandex\Toolbar\branding\{06990470-8417-465F-8B58-A3008B344A95}\locale\kk\services.dtd
[2012/03/28 20:40:18 | 000,007,088 | ---- | M] () MD5=F2F23D6C79AF6CE288C9CC71A99A8C59 -- C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Yandex\Toolbar\branding\{06990470-8417-465F-8B58-A3008B344A95}\locale\tr\services.dtd
< MD5 for: SERVICES.EXE >
[2009/07/14 01:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\ERDNT\cache64\services.exe
[2009/07/14 01:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\SysNative\services.exe
[2009/07/14 01:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
< MD5 for: SERVICES.EXE.MUI >
[2009/07/14 02:25:40 | 000,017,408 | ---- | M] (Microsoft Corporation) MD5=6507BF0DC2D1F5F32493C288EAA59277 -- C:\Windows\SysNative\en-US\services.exe.mui
[2009/07/14 02:25:40 | 000,017,408 | ---- | M] (Microsoft Corporation) MD5=6507BF0DC2D1F5F32493C288EAA59277 -- C:\Windows\winsxs\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c5f238be3fa63468\services.exe.mui
< MD5 for: SERVICES.JS >
[2013/10/19 11:09:43 | 000,005,711 | ---- | M] () MD5=92C58E360CF2E2E364275DB15E9D0289 -- C:\Users\Lorna\AppData\Local\Google\Chrome\User Data\Default\Extensions\jeoacafpbcihiomhlakheieifhpjdfeo\5.10.0_0\scripts\services.js
< MD5 for: SERVICES.LNK >
[2009/07/14 04:54:05 | 000,001,288 | ---- | M] () MD5=CA0D9F4743DFF86EBAF09D763139E958 -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009/07/14 04:54:05 | 000,001,288 | ---- | M] () MD5=CA0D9F4743DFF86EBAF09D763139E958 -- C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
< MD5 for: SERVICES.MOF >
[2009/06/10 20:44:06 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\SysNative\wbem\services.mof
[2009/06/10 20:44:06 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.mof
< MD5 for: SERVICES.MSC >
[2009/07/14 02:23:30 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\SysNative\en-US\services.msc
[2009/06/10 20:38:36 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\SysNative\services.msc
[2009/07/14 02:08:50 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\SysWOW64\en-US\services.msc
[2009/06/10 21:21:09 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\SysWOW64\services.msc
[2009/07/14 02:23:30 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\amd64_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_003408aa160fce5b\services.msc
[2009/06/10 20:38:36 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_2b58d44b5f6beb8a\services.msc
[2009/07/14 02:08:50 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a4156d265db25d25\services.msc
[2009/06/10 21:21:09 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_cf3a38c7a70e7a54\services.msc
< MD5 for: SERVICES.PTXML >
[2009/07/13 20:16:17 | 000,001,061 | ---- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 -- C:\Windows\SysNative\wdi\perftrack\Services.ptxml
[2009/07/13 20:16:17 | 000,001,061 | ---- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\Services.ptxml
< MD5 for: SERVICES.SBS >
[2011/03/01 09:58:46 | 000,034,818 | ---- | M] () MD5=62AFD4B2025CE6D4706B36F4C4808F9B -- C:\Program Files (x86)\Spybot - Search & Destroy 2\Includes\Services.sbs
< MD5 for: SERVICES.XML >
[2012/03/28 20:40:29 | 000,018,507 | ---- | M] () MD5=C4950F1359292A158B143327D6AEB90B -- C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Yandex\Toolbar\packages\{D02A3D80-B37F-4DB7-8B7A-3E07D5239D7F}\services\services.xml
< MD5 for: WINLOGON.ADML >
[2009/07/14 02:25:22 | 000,008,013 | ---- | M] () MD5=CED0EAD8D152B3D0F114698DE2316C5E -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f0f9032ef6930070\WinLogon.adml
< MD5 for: WINLOGON.ADMX >
[2009/06/10 21:04:41 | 000,005,237 | ---- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm_31bf3856ad364e35_6.1.7600.16385_none_d7024e6992f3424d\WinLogon.admx
< MD5 for: WINLOGON.EXE >
[2010/11/20 13:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/14 01:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009/10/28 07:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009/10/28 06:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\ERDNT\cache64\winlogon.exe
[2009/10/28 06:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\SysNative\winlogon.exe
[2009/10/28 06:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
< MD5 for: WINLOGON.EXE.MUI >
[2010/11/20 13:00:25 | 000,023,040 | ---- | M] (Microsoft Corporation) MD5=34C7D2E30868EDAFB191341D963ABA5F -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7601.17514_en-us_291e96fa1ab5fc7b\winlogon.exe.mui
[2009/07/14 02:29:52 | 000,022,528 | ---- | M] (Microsoft Corporation) MD5=56D03B64B8C483C1D12A8E4577B3B332 -- C:\Windows\SysNative\en-US\winlogon.exe.mui
[2009/07/14 02:29:52 | 000,022,528 | ---- | M] (Microsoft Corporation) MD5=56D03B64B8C483C1D12A8E4577B3B332 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7600.16385_en-us_26ed83321dc778e1\winlogon.exe.mui
< MD5 for: WINLOGON.MFL >
[2009/07/14 02:27:22 | 000,001,080 | ---- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A -- C:\Windows\SysNative\wbem\en-US\winlogon.mfl
[2009/07/14 02:27:22 | 000,001,080 | ---- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.1.7600.16385_en-us_84afd4fd38ffd276\winlogon.mfl
< MD5 for: WINLOGON.MOF >
[2009/07/13 20:30:01 | 000,003,192 | ---- | M] () MD5=DF722B96F32A61783BC310FACF10240B -- C:\Windows\SysNative\wbem\winlogon.mof
[2009/07/13 20:30:01 | 000,003,192 | ---- | M] () MD5=DF722B96F32A61783BC310FACF10240B -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.1.7600.16385_none_dc2dbb778f98e40f\winlogon.mof
< %SYSTEMDRIVE%\*.* >
[2013/10/30 18:33:49 | 000,028,220 | ---- | M] () -- C:\aaw7boot.log
[2013/10/27 10:54:50 | 000,000,002 | ---- | M] () -- C:\AvastSetup.log
[2009/07/14 01:38:58 | 000,383,562 | RHS- | M] () -- C:\bootmgr
[2009/07/27 20:40:53 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2010/07/02 08:51:00 | 000,013,757 | ---- | M] () -- C:\CDAVFSuser.log
[2010/07/01 09:01:47 | 000,017,570 | ---- | M] () -- C:\CDAVFSuserBackup.log
[2011/10/09 12:17:21 | 000,045,546 | ---- | M] () -- C:\ComboFix.txt
[2008/10/27 13:19:23 | 000,064,883 | ---- | M] () -- C:\converterv_mzr64rr1.jar
[2008/10/08 11:48:50 | 000,075,174 | ---- | M] () -- C:\CybDefInstallInfo.log
[2008/10/27 13:30:51 | 000,132,104 | ---- | M] () -- C:\dap050015_ciqqkzpv.jar
[2012/05/01 23:21:53 | 000,000,089 | ---- | M] () -- C:\data
[2002/07/28 23:40:00 | 001,059,840 | ---- | M] (Auto FX Software) -- C:\DS_Bonus_Plugin.8bf
[2012/01/09 18:10:47 | 000,461,824 | -HS- | M] () -- C:\EUMONBMP.SYS
[2010/01/03 00:00:36 | 000,004,047 | ---- | M] () -- C:\EyeCandyLog.txt
[2009/01/04 07:40:46 | 000,003,275 | ---- | M] () -- C:\flpalbm.opf
[2008/10/27 13:17:57 | 000,060,114 | ---- | M] () -- C:\gintris_u77v9ril.jar
[2007/11/07 07:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini
[2008/10/27 13:08:33 | 000,051,408 | ---- | M] () -- C:\greatertha_bhihclc7.jar
[2005/01/21 04:12:14 | 000,000,011 | ---- | M] () -- C:\H07542EN.tag
[2013/11/07 20:57:59 | 3217,235,968 | -HS- | M] () -- C:\hiberfil.sys
[2013/10/29 10:39:32 | 000,016,629 | ---- | M] () -- C:\hijackthis.log
[2007/11/07 07:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini
[2010/02/25 09:20:32 | 000,000,490 | ---- | M] () -- C:\INSTALL.LOG
[2007/11/07 07:03:18 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll
[2007/11/07 07:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll
[2007/11/07 07:03:18 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll
[2007/11/07 07:03:18 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll
[2007/11/07 07:03:18 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll
[2007/11/07 07:03:18 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll
[2007/11/07 07:03:18 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll
[2007/11/07 07:03:18 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll
[2007/11/07 07:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll
[2012/01/19 16:57:49 | 000,000,863 | ---- | M] () -- C:\InstallHelper.log
[2010/03/22 18:11:13 | 000,696,747 | ---- | M] () -- C:\jemshorthair1.jpg
[2010/03/22 18:11:33 | 001,754,727 | ---- | M] () -- C:\jemshorthair2.jpg
[2010/03/22 18:12:13 | 000,650,199 | ---- | M] () -- C:\jemshorthair3.jpg
[2010/03/22 18:13:01 | 000,916,381 | ---- | M] () -- C:\jemshorthair4.jpg
[2010/03/22 18:13:42 | 001,051,683 | ---- | M] () -- C:\jemshorthair6.jpg
[2010/03/22 18:14:35 | 000,761,656 | ---- | M] () -- C:\jemshorthair7.jpg
[2010/03/22 18:15:11 | 000,838,946 | ---- | M] () -- C:\jemshorthair8.jpg
[2009/03/23 21:26:52 | 000,047,183 | ---- | M] () -- C:\me.jpg
[2010/03/22 18:07:55 | 001,293,737 | ---- | M] () -- C:\merlinlas4t.jpg
[2010/03/22 18:00:47 | 000,654,981 | ---- | M] () -- C:\merlinlast1.jpg
[2010/03/22 18:01:29 | 000,709,909 | ---- | M] () -- C:\merlinlast2.jpg
[2010/03/22 18:02:11 | 000,833,637 | ---- | M] () -- C:\merlinlast3.jpg
[2010/03/22 18:08:37 | 000,599,749 | ---- | M] () -- C:\merlinlast5.jpg
[2010/03/22 18:09:28 | 000,565,526 | ---- | M] () -- C:\merlinlast6.jpg
[2010/03/22 18:10:08 | 000,596,533 | ---- | M] () -- C:\merlinlast7.jpg
[2000/05/21 23:00:00 | 000,115,920 | ---- | M] (Microsoft Corporation) -- C:\Msinet.ocx
[2002/01/05 02:38:38 | 000,054,784 | ---- | M] (Microsoft Corporation) -- C:\msvci70.dll
[2013/11/07 20:58:02 | 4289,650,688 | -HS- | M] () -- C:\pagefile.sys
[2009/09/04 16:15:12 | 000,003,011 | RHS- | M] () -- C:\Patch.rev
[2010/05/09 18:16:33 | 000,000,218 | RHS- | M] () -- C:\Preload.rev
[2009/04/23 19:46:30 | 000,017,408 | ---- | M] (Microsoft Corporation) -- C:\psapi.dll
[2007/03/07 16:40:40 | 000,000,345 | ---- | M] () -- C:\RHDSetup (1).log
[2010/05/09 18:25:31 | 000,001,989 | ---- | M] () -- C:\RHDSetup.log
[2008/05/15 15:04:28 | 000,000,479 | ---- | M] () -- C:\sghmmail.ECF
[2009/09/12 22:17:37 | 000,115,224 | ---- | M] () -- C:\snp2sxp-001.raw
[2007/06/11 10:28:58 | 000,000,600 | -H-- | M] () -- C:\SWSTAMP.TXT
[2009/10/26 21:46:58 | 000,005,966 | ---- | M] () -- C:\SyncTraceFile.txt
[2011/04/28 09:07:54 | 000,067,488 | ---- | M] () -- C:\TDSSKiller.2.4.3.0_28.04.2011_10.04.28_log.txt
[2011/10/09 13:26:05 | 000,000,414 | ---- | M] () -- C:\TDSSKiller.2.5.22.0_09.10.2011_14.25.57_log.txt
[2011/09/14 15:30:40 | 000,074,170 | ---- | M] () -- C:\TDSSKiller.2.5.22.0_14.09.2011_16.29.14_log.txt
[2011/10/09 13:30:57 | 000,171,428 | ---- | M] () -- C:\TDSSKiller.2.6.6.0_09.10.2011_14.28.05_log.txt
[2007/11/07 07:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp
[2007/10/05 15:13:30 | 000,470,582 | ---- | M] () -- C:\vcredist_x86.log
[2007/11/07 07:09:22 | 001,442,522 | ---- | M] () -- C:\VC_RED.cab
[2007/11/07 07:12:28 | 000,232,960 | ---- | M] () -- C:\VC_RED.MSI
[2008/10/27 13:09:33 | 000,000,839 | ---- | M] () -- C:\worms08_kz4me3av.jad
[2010/11/06 15:56:03 | 003,656,870 | ---- | M] () -- C:\xcards.ppp
[2008/06/04 11:37:03 | 000,000,162 | ---- | M] () -- C:\YServer.txt
[2008/10/27 13:05:41 | 000,269,414 | ---- | M] () -- C:\zuma_mp7zxmpq.jar
[2012/01/09 19:17:22 | 000,004,096 | -HS- | M] () -- C:\{37CC1B76-A9E8-4D00-8A60-DE2D72F75C1D}.CBM
< %systemroot%\Fonts\*.com >
[2009/07/14 05:32:31 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 05:32:31 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 05:32:31 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 05:32:31 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont
< %systemroot%\Fonts\*.dll >
< %systemroot%\Fonts\*.ini >
[2009/06/10 20:49:50 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini
< %systemroot%\Fonts\*.ini2 >
< %systemroot%\Fonts\*.exe >
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
< %systemroot%\REPAIR\*.bak1 >
< %systemroot%\REPAIR\*.ini >
< %systemroot%\system32\*.jpg >
< %systemroot%\*.jpg >
< %systemroot%\*.png >
< %systemroot%\*.scr >
[2011/11/28 18:01:25 | 000,041,184 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2009/09/22 16:15:26 | 000,220,672 | ---- | M] (Juan Trujillo Tarradas; http://www.jttsoft.com) -- C:\Windows\PhotoEchoes.scr
[2010/11/10 01:28:46 | 000,301,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR
< %systemroot%\*._sy >
< %APPDATA%\Adobe\Update\*.* >
< %ALLUSERSPROFILE%\Favorites\*.* >
< %APPDATA%\Microsoft\*.* >
< %PROGRAMFILES%\*.* >
[2009/07/14 04:54:24 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini
< %APPDATA%\Update\*.* >
< %systemroot%\*. /mp /s >
< dir "%systemdrive%\*" /S /A:L /C >
Volume in drive C is ACER
Volume Serial Number is 046D-856D
Directory of C:\
14/07/2009 05:08 <JUNCTION> Documents and Settings [C:\Users]
0 File(s) 0 bytes
Directory of C:\ProgramData
14/07/2009 05:08 <JUNCTION> Application Data [C:\ProgramData]
14/07/2009 05:08 <JUNCTION> Desktop [C:\Users\Public\Desktop]
14/07/2009 05:08 <JUNCTION> Documents [C:\Users\Public\Documents]
14/07/2009 05:08 <JUNCTION> Favorites [C:\Users\Public\Favorites]
14/07/2009 05:08 <JUNCTION> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
14/07/2009 05:08 <JUNCTION> Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users
14/07/2009 05:08 <SYMLINKD> All Users [C:\ProgramData]
14/07/2009 05:08 <JUNCTION> Default User [C:\Users\Default]
0 File(s) 0 bytes
Directory of C:\Users\All Users
14/07/2009 05:08 <JUNCTION> Application Data [C:\ProgramData]
14/07/2009 05:08 <JUNCTION> Desktop [C:\Users\Public\Desktop]
14/07/2009 05:08 <JUNCTION> Documents [C:\Users\Public\Documents]
14/07/2009 05:08 <JUNCTION> Favorites [C:\Users\Public\Favorites]
14/07/2009 05:08 <JUNCTION> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
14/07/2009 05:08 <JUNCTION> Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Default
14/07/2009 05:08 <JUNCTION> Application Data [C:\Users\Default\AppData\Roaming]
14/07/2009 05:08 <JUNCTION> Local Settings [C:\Users\Default\AppData\Local]
14/07/2009 05:08 <JUNCTION> My Documents [C:\Users\Default\Documents]
14/07/2009 05:08 <JUNCTION> NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
14/07/2009 05:08 <JUNCTION> PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
14/07/2009 05:08 <JUNCTION> Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]
14/07/2009 05:08 <JUNCTION> SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]
14/07/2009 05:08 <JUNCTION> Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]
14/07/2009 05:08 <JUNCTION> Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Default\AppData\Local
14/07/2009 05:08 <JUNCTION> Application Data [C:\Users\Default\AppData\Local]
14/07/2009 05:08 <JUNCTION> History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]
14/07/2009 05:08 <JUNCTION> Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Default\Documents
14/07/2009 05:08 <JUNCTION> My Music [C:\Users\Default\Music]
14/07/2009 05:08 <JUNCTION> My Pictures [C:\Users\Default\Pictures]
14/07/2009 05:08 <JUNCTION> My Videos [C:\Users\Default\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Lorna
09/05/2010 18:16 <JUNCTION> Application Data [C:\Users\Lorna\AppData\Roaming]
09/05/2010 18:16 <JUNCTION> Cookies [C:\Users\Lorna\AppData\Roaming\Microsoft\Windows\Cookies]
09/05/2010 18:16 <JUNCTION> Local Settings [C:\Users\Lorna\AppData\Local]
09/05/2010 18:16 <JUNCTION> My Documents [C:\Users\Lorna\Documents]
09/05/2010 18:16 <JUNCTION> NetHood [C:\Users\Lorna\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
09/05/2010 18:16 <JUNCTION> PrintHood [C:\Users\Lorna\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
09/05/2010 18:16 <JUNCTION> Recent [C:\Users\Lorna\AppData\Roaming\Microsoft\Windows\Recent]
09/05/2010 18:16 <JUNCTION> SendTo [C:\Users\Lorna\AppData\Roaming\Microsoft\Windows\SendTo]
09/05/2010 18:16 <JUNCTION> Start Menu [C:\Users\Lorna\AppData\Roaming\Microsoft\Windows\Start Menu]
09/05/2010 18:16 <JUNCTION> Templates [C:\Users\Lorna\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Lorna\AppData\Local
09/05/2010 18:16 <JUNCTION> Application Data [C:\Users\Lorna\AppData\Local]
09/05/2010 18:16 <JUNCTION> History [C:\Users\Lorna\AppData\Local\Microsoft\Windows\History]
09/05/2010 18:16 <JUNCTION> Temporary Internet Files [C:\Users\Lorna\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Lorna\Documents
09/05/2010 18:16 <JUNCTION> My Music [C:\Users\Lorna\Music]
09/05/2010 18:16 <JUNCTION> My Pictures [C:\Users\Lorna\Pictures]
09/05/2010 18:16 <JUNCTION> My Videos [C:\Users\Lorna\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Public\Documents
14/07/2009 05:08 <JUNCTION> My Music [C:\Users\Public\Music]
14/07/2009 05:08 <JUNCTION> My Pictures [C:\Users\Public\Pictures]
14/07/2009 05:08 <JUNCTION> My Videos [C:\Users\Public\Videos]
0 File(s) 0 bytes
Directory of C:\Windows\System32\config\systemprofile
06/09/2010 17:51 <JUNCTION> Application Data [C:\Windows\system32\config\systemprofile\AppData\Roaming]
06/09/2010 17:51 <JUNCTION> Local Settings [C:\Windows\system32\config\systemprofile\AppData\Local]
06/09/2010 17:51 <JUNCTION> My Documents [C:\Windows\system32\config\systemprofile\Documents]
06/09/2010 17:51 <JUNCTION> NetHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
06/09/2010 17:51 <JUNCTION> PrintHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
06/09/2010 17:51 <JUNCTION> Recent [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent]
06/09/2010 17:51 <JUNCTION> SendTo [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo]
06/09/2010 17:51 <JUNCTION> Start Menu [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu]
06/09/2010 17:51 <JUNCTION> Templates [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Windows\System32\config\systemprofile\AppData\Local
06/09/2010 17:51 <JUNCTION> Application Data [C:\Windows\system32\config\systemprofile\AppData\Local]
06/09/2010 17:51 <JUNCTION> History [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History]
06/09/2010 17:51 <JUNCTION> Temporary Internet Files [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Windows\System32\config\systemprofile\Documents
06/09/2010 17:51 <JUNCTION> My Music [C:\Windows\system32\config\systemprofile\Music]
06/09/2010 17:51 <JUNCTION> My Pictures [C:\Windows\system32\config\systemprofile\Pictures]
06/09/2010 17:51 <JUNCTION> My Videos [C:\Windows\system32\config\systemprofile\Videos]
0 File(s) 0 bytes
Directory of C:\Windows\SysWOW64\config\systemprofile
06/09/2010 17:51 <JUNCTION> Application Data [C:\Windows\system32\config\systemprofile\AppData\Roaming]
06/09/2010 17:51 <JUNCTION> Local Settings [C:\Windows\system32\config\systemprofile\AppData\Local]
06/09/2010 17:51 <JUNCTION> My Documents [C:\Windows\system32\config\systemprofile\Documents]
06/09/2010 17:51 <JUNCTION> NetHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
06/09/2010 17:51 <JUNCTION> PrintHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
06/09/2010 17:51 <JUNCTION> Recent [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent]
06/09/2010 17:51 <JUNCTION> SendTo [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo]
06/09/2010 17:51 <JUNCTION> Start Menu [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu]
06/09/2010 17:51 <JUNCTION> Templates [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Windows\SysWOW64\config\systemprofile\AppData\Local
06/09/2010 17:51 <JUNCTION> Application Data [C:\Windows\system32\config\systemprofile\AppData\Local]
06/09/2010 17:51 <JUNCTION> History [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History]
06/09/2010 17:51 <JUNCTION> Temporary Internet Files [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Windows\SysWOW64\config\systemprofile\Documents
06/09/2010 17:51 <JUNCTION> My Music [C:\Windows\system32\config\systemprofile\Music]
06/09/2010 17:51 <JUNCTION> My Pictures [C:\Windows\system32\config\systemprofile\Pictures]
06/09/2010 17:51 <JUNCTION> My Videos [C:\Windows\system32\config\systemprofile\Videos]
0 File(s) 0 bytes
Total Files Listed:
0 File(s) 0 bytes
79 Dir(s) 292,182,855,680 bytes free
< %systemroot%\System32\config\*.sav >
< %PROGRAMFILES%\bak. /s >
< %systemroot%\system32\bak. /s >
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
< %systemroot%\system32\config\systemprofile\*.dat /x >
< %systemroot%\*.config >
< %systemroot%\system32\*.db >
< %PROGRAMFILES%\Internet Explorer\*.dat >
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/03/29 09:35:59 | 000,000,286 | -HS- | M] () -- C:\Users\Lorna\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini
[2012/02/23 14:27:21 | 000,000,221 | -HS- | M] () -- C:\Users\Lorna\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
< %USERPROFILE%\Desktop\*.exe >
[2013/11/07 20:39:13 | 001,073,262 | ---- | M] () -- C:\Users\Lorna\Desktop\AdwCleaner.exe
[2013/11/03 11:59:04 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Users\Lorna\Desktop\aswMBR.exe
[2013/10/29 10:54:05 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Lorna\Desktop\HijackThis.exe
[2013/11/04 11:04:37 | 001,033,335 | ---- | M] (Thisisu) -- C:\Users\Lorna\Desktop\JRT.exe
[2013/11/03 22:26:49 | 012,576,792 | ---- | M] (Malwarebytes Corp.) -- C:\Users\Lorna\Desktop\mbar-1.07.0.1007.exe
[2013/11/03 12:02:53 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Lorna\Desktop\OTL.exe
[2013/11/03 21:51:16 | 010,031,224 | ---- | M] (VS Revo Group ) -- C:\Users\Lorna\Desktop\RevoUninProSetup.exe
[2013/11/03 11:58:42 | 000,891,184 | ---- | M] () -- C:\Users\Lorna\Desktop\SecurityCheck.exe
< %PROGRAMFILES%\Common Files\*.* >
[2009/02/10 19:23:42 | 000,192,484 | ---- | M] () -- C:\Program Files (x86)\Common Files\Acer GameZone online.ico
< %systemroot%\*.src >
< %systemroot%\install\*.* >
< %systemroot%\system32\DLL\*.* >
< %systemroot%\system32\HelpFiles\*.* >
< %systemroot%\system32\rundll\*.* >
< %systemroot%\winn32\*.* >
< %systemroot%\Java\*.* >
< %systemroot%\system32\test\*.* >
< %systemroot%\system32\Rundll32\*.* >
< %systemroot%\AppPatch\Custom\*.* >
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
========== Base Services ==========
SRV:64bit: - [2009/07/14 01:40:01 | 000,072,192 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\aelupsvc.dll -- (AeLookupSvc)
SRV:64bit: - [2009/07/14 01:40:01 | 000,070,144 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\appinfo.dll -- (Appinfo)
SRV:64bit: - [2009/07/14 01:38:55 | 000,079,360 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\alg.exe -- (ALG)
SRV:64bit: - [2009/07/14 01:41:53 | 000,848,384 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\qmgr.dll -- (BITS)
SRV:64bit: - [2009/07/14 01:40:10 | 000,703,488 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\BFE.DLL -- (BFE)
SRV:64bit: - [2011/11/17 07:05:16 | 000,031,232 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\lsass.exe -- (KeyIso)
SRV:64bit: - [2009/07/14 01:40:50 | 000,402,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\es.dll -- (EventSystem)
SRV - [2009/07/14 01:15:19 | 000,271,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\es.dll -- (EventSystem)
SRV:64bit: - [2009/07/14 01:40:13 | 000,136,192 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\browser.dll -- (Browser)
SRV:64bit: - [2009/07/14 01:40:24 | 000,175,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\cryptsvc.dll -- (CryptSvc)
SRV - [2009/07/14 01:15:07 | 000,135,680 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\cryptsvc.dll -- (CryptSvc)
SRV:64bit: - [2009/07/14 01:41:53 | 000,509,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (DcomLaunch)
SRV:64bit: - [2009/07/14 01:40:28 | 000,314,368 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dhcpcore.dll -- (Dhcp)
SRV - [2009/07/14 01:15:11 | 000,253,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\dhcpcore.dll -- (Dhcp)
SRV:64bit: - [2011/03/03 06:17:10 | 000,182,272 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dnsrslvr.dll -- (Dnscache)
SRV:64bit: - [2009/07/14 01:40:35 | 000,111,104 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\eapsvc.dll -- (EapHost)
SRV:64bit: - [2009/07/14 01:41:00 | 000,038,912 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\hidserv.dll -- (hidserv)
SRV - [2009/07/14 01:15:24 | 000,049,152 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\hidserv.dll -- (hidserv)
SRV:64bit: - [2009/07/14 01:41:10 | 000,359,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\ipnathlp.dll -- (SharedAccess)
SRV:64bit: - [2009/07/14 01:41:10 | 000,500,224 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\IPSECSVC.DLL -- (PolicyAgent)
No service found with a name of MsMpSvc
No service found with a name of NisSrv
SRV:64bit: - [2009/07/14 01:41:54 | 000,524,288 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\swprv.dll -- (swprv)
SRV:64bit: - [2009/07/14 01:41:26 | 000,067,584 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\mmcss.dll -- (MMCSS)
SRV:64bit: - [2009/07/14 01:41:52 | 000,360,448 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netman.dll -- (Netman)
SRV:64bit: - [2009/07/14 01:41:52 | 000,459,776 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofm.dll -- (netprofm)
SRV - [2009/07/14 01:16:03 | 000,360,448 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\netprofm.dll -- (netprofm)
SRV:64bit: - [2009/07/14 01:41:52 | 000,302,080 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\nlasvc.dll -- (NlaSvc)
SRV:64bit: - [2009/07/14 01:41:53 | 000,025,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\nsisvc.dll -- (nsi)
SRV:64bit: - [2011/05/24 11:21:59 | 000,404,992 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\umpnpmgr.dll -- (PlugPlay)
SRV:64bit: - [2010/08/21 06:29:47 | 000,558,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\spoolsv.exe -- (Spooler)
SRV:64bit: - [2011/11/17 07:05:16 | 000,031,232 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\lsass.exe -- (ProtectedStorage)
No service found with a name of EMDMgmt
SRV:64bit: - [2009/07/14 01:41:53 | 000,099,328 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\rasauto.dll -- (RasAuto)
SRV:64bit: - [2009/07/14 01:41:53 | 000,343,552 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\rasmans.dll -- (RasMan)
SRV:64bit: - [2009/07/14 01:41:53 | 000,509,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (RpcSs)
SRV:64bit: - [2009/07/14 01:41:53 | 000,030,720 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\seclogon.dll -- (seclogon)
SRV:64bit: - [2011/11/17 07:05:16 | 000,031,232 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsass.exe -- (SamSs)
SRV:64bit: - [2010/12/21 06:16:27 | 000,097,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wscsvc.dll -- (wscsvc)
SRV:64bit: - [2010/08/27 06:14:02 | 000,236,032 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\srvsvc.dll -- (LanmanServer)
SRV:64bit: - [2009/07/14 01:41:54 | 000,369,664 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\shsvcs.dll -- (ShellHWDetection)
SRV - [2009/07/14 01:16:14 | 000,328,192 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\shsvcs.dll -- (ShellHWDetection)
No service found with a name of slsvc
SRV:64bit: - [2010/11/02 05:16:53 | 001,114,624 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\schedsvc.dll -- (Schedule)
SRV:64bit: - [2009/07/14 01:41:55 | 000,316,416 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\tapisrv.dll -- (TapiSrv)
SRV - [2009/07/14 01:16:15 | 000,241,664 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\tapisrv.dll -- (TapiSrv)
SRV:64bit: - [2009/07/14 01:41:55 | 000,044,544 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\themeservice.dll -- (Themes)
SRV:64bit: - [2009/07/14 01:41:53 | 000,208,384 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\profsvc.dll -- (ProfSvc)
SRV:64bit: - [2009/07/14 01:39:50 | 001,598,976 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\VSSVC.exe -- (VSS)
SRV:64bit: - [2009/07/14 01:40:04 | 000,676,864 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\audiosrv.dll -- (AudioSrv)
SRV:64bit: - [2009/07/14 01:40:04 | 000,676,864 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\audiosrv.dll -- (AudioEndpointBuilder)
SRV:64bit: - [2009/07/14 01:41:53 | 000,170,496 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\sdrsvc.dll -- (SDRSVC)
SRV:64bit: - [2009/07/14 01:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/14 01:41:56 | 001,646,080 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wevtsvc.dll -- (eventlog)
SRV:64bit: - [2009/07/14 01:41:27 | 000,824,832 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\MPSSVC.dll -- (MpsSvc)
SRV:64bit: - [2009/07/14 01:41:56 | 000,578,560 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wiaservc.dll -- (stisvc)
SRV:64bit: - [2009/07/14 01:39:21 | 000,127,488 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\msiexec.exe -- (msiserver)
SRV - [2009/07/14 01:14:25 | 000,073,216 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWow64\msiexec.exe -- (msiserver)
SRV:64bit: - [2009/07/14 01:41:56 | 000,242,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wbem\WMIsvc.dll -- (Winmgmt)
SRV:64bit: - [2012/06/02 22:19:43 | 002,428,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wuaueng.dll -- (wuauserv)
SRV:64bit: - [2009/07/14 01:40:32 | 000,252,416 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\dot3svc.dll -- (dot3svc)
SRV:64bit: - [2009/07/14 01:41:56 | 000,886,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wlansvc.dll -- (Wlansvc)
SRV:64bit: - [2009/07/14 01:41:56 | 000,118,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wkssvc.dll -- (LanmanWorkstation)
========== Drive Information ==========
Physical Drives
---------------
Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: Hitachi HTS545050B9A300
Partitions: 4
Status: OK
Status Info: 0
Drive: \\\\.\\PHYSICALDRIVE1 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: Hitachi HTS545050B9A300
Partitions: 1
Status: OK
Status Info: 0
Partitions
---------------
DeviceID: Disk #0, Partition #0
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 12.00GB
Starting Offset: 1048576
Hidden sectors: 0
DeviceID: Disk #0, Partition #1
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 4.00GB
Starting Offset: 12583960576
Hidden sectors: 0
DeviceID: Disk #0, Partition #2
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 100.00MB
Starting Offset: 16342056960
Hidden sectors: 0
DeviceID: Disk #0, Partition #3
PartitionType: Extended w/Extended Int 13
Bootable: False
BootPartition: False
PrimaryPartition: False
Size: 450.00GB
Starting Offset: 16446914560
Hidden sectors: 0
DeviceID: Disk #1, Partition #0
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 466.00GB
Starting Offset: 32256
Hidden sectors: 0
========== Alternate Data Streams ==========
@Alternate Data Stream - 95 bytes -> C:\ProgramData\Temp:5C321E34
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\wordchart1.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\WM0270.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\Weave-ItBkTwo.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\Weave-ItBkThree.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\vintage_knitting_tips.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\vintage_knitting_tips.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\vertigo-source.png:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\vertigo-logo-source.png:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\vertigo-footer-source.png:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\Valsaddress.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\tyroknit.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\TheWeave-ItBook.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\testpdf.PDF:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\TechniqueColoredPencil.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\sv_028.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\surveys.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\stitchy.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\steampunk-bug.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\star_template.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\stamford-artisans-guild-logo.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\Spool221.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\showcase-source.png:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\Sea%20Breeze%20Angelina%20instructions.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\SAGE INVOICES.xls:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\replicant2-source.png:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\PRESS RELEASEoldword.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\press release vic hall lorna.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\pic for payperhour.gif:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\pdftedst.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\paper doll maryjane.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\office10beta.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\OFFICE PROFESSIONAL KEY.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\mywatchmanual.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\Mysnowflakes.rtf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\Mysnowflakes.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\Microsoft Word - r conboy webvert march 08.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\m names.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\linked in us search.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\len and nell page 11 i think cmyk.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\LayoutTool - Legacy.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\JumpingJacks.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\JumpingJacks(1).pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\joomla_15_quickstart.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\jemjoker.png:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\jemcvnewtxtonly.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\jem cv.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\jem cv new.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\jem coverletterbarclays.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\IS SHAKESPEARE DEAD.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\invite square copy.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\Inside Front Cover.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\inside back cover cmyk.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\High-Raw-Kevin-Gianni.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\hhswholething.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\heartsnflowerspng.png:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\HEARTSfinal layout2up.docx.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\HEARTSfinal layout.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\Hearts.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\Heart_templates.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\googlebase-ezlibris-200806231005.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\googlebase-ezlibris-200806230956.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\front cover cmyk.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\From the time I was a little girl.pps:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\fox2crop.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\flowersp.bmp:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\flower_template.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\flower.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\floralpeyote v2.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\floral1peyote1.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\floral1.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\floral1 peyote1.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\farm1a.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\ETSToysB.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\ETSToysA.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\Elfic_doll.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\dvlalicenceapp.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\CTMJanFeb08 FINAL.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\CTFEB07CrochetFroggyHatCheerioEssentials.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\cs5serial.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\COURIER.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\CorelDRAW Graphics Suite X3.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\copyrightnotice.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\copyrightnotice.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\cctreescrop.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\cash_book_pro_v2.0.xls:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\Card07.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\Card06.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\Card04.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\calendar_organizer_months.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\broadsheetsteampunk.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\BABYmocsBtys.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\B023_ebook.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\amclassical_silent_night.mp3:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\alicewivbaby.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Lorna\Documents\aglaciercrop.JPG:Roxio EMC Stream
@Alternate Data Stream - 452 bytes -> C:\Users\Lorna\Documents\vichallflyerfinal.ppp:SummaryInformation
@Alternate Data Stream - 436 bytes -> C:\xcards.ppp:SummaryInformation
@Alternate Data Stream - 432 bytes -> C:\Users\Lorna\Documents\alice1.ppp:SummaryInformation
@Alternate Data Stream - 211 bytes -> C:\ProgramData\Temp:BC3DB898
@Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:AB689DEA
@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:4CF61E54
@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:2B11E0DF
< End of report >
Thanks