Spyware / Malware / Virus Removal

Yielmanager pop up in firefox [Solved]

29 min read

Looking for the outcome? Ask AI

Dede Topic Starter

Post #1November 25, 2013, 4:37 PM UTC last edited November 25, 2013, 4:51 PM UTC

Hello everyone, just noticed typo in title, but cannot edit.

I am having problems with a popup window that I cannot getrid of every time I open firefox.

The pop up window is : content.yieldmanager.edgesuite.net

I attached the hijackthis results.

Thank you for your help.

Windows 7 64 bit home premium.

Logfile of Trend Micro HijackThis v2.0.4

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:11:34 AM, on 25-Nov-13
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.16428)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
C:\Windows\PLFSetI.exe
C:\Program Files (x86)\Microsoft Student\Microsoft Student with Encarta Reference Library 2009 DVD\EDICT.EXE
C:\Program Files (x86)\Microsoft Encarta\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE
C:\Program Files (x86)\Samsung\Kies\Kies.exe
C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe
C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
C:\Program Files (x86)\Launch Manager\LManager.EXE
C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Users\A M\AppData\Local\Temp\install_flashplayer11x32axau_gtbd_chrd_dn_aaa_aih.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Acer\Acer VCM\Vc.exe
C:\Users\A M\AppData\Local\Adobe\AIH.0549a44644304db0c6d18563f1cbc26ba3b53574\install_flash_player_ax.exe
C:\Users\A M\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer, optimized for Bing and MSN
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.87.1.220:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [EgisTecLiveUpdate] "C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe"
O4 - HKLM\..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files (x86)\Acer\Acer Assist\launcher.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Norton Ghost 15.0] "C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe"
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
O4 - HKLM\..\Run: [IME14 CHT Setup] C:\PROGRA~2\COMMON~1\MICROS~1\IME14\SHARED\IMEKLMG.EXE /SetPreload /CHT /Log
O4 - HKLM\..\Run: [IME14 JPN Setup] C:\PROGRA~2\COMMON~1\MICROS~1\IME14\SHARED\IMEKLMG.EXE /SetPreload /JPN /Log
O4 - HKLM\..\Run: [IME14 KOR Setup] C:\PROGRA~2\COMMON~1\MICROS~1\IME14\SHARED\IMEKLMG.EXE /SetPreload /KOR /Log
O4 - HKLM\..\Run: [IME14 CHS Setup] C:\PROGRA~2\COMMON~1\MICROS~1\IME14\SHARED\IMEKLMG.EXE /SetPreload /CHS /Log
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [L09ZXLRD_16295271] "C:\Program Files (x86)\Microsoft Student\Microsoft Student with Encarta Reference Library 2009 DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [Google Update] "C:\Users\A M\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [E09FXLRD_87317784] "C:\Program Files (x86)\Microsoft Encarta\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
O4 - HKCU\..\Run: [KiesAirMessage] C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
O4 - HKCU\..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKCU\..\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKCU\..\Run: [HP Officejet 6600 (NET)] "C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe" -deviceID "CN34T6RJ2705RN:NW" -scfn "HP Officejet 6600 (NET)" -AutoStart 1
O4 - HKCU\..\Run: [Spybot-S&D Cleaning] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe" /autoclean
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: Acer VCM.lnk = ?
O4 - Global Startup: Bluetooth.lnk = ?
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files (x86)\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Send to &Bluetooth Device… - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {9C65AB3E-C9A8-4789-AE24-B365A1C4A6F9} (SNRet Control) - http://acer.custhelp.com/euf/assets/activex/snret.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: BlackBerry Device Manager (Blackberry Device Manager) - Research In Motion Limited - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: Crypkey License - Unknown owner - crypserv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GenericMount Helper Service - Symantec - C:\Program Files (x86)\Norton Ghost\Shared\Drivers\GenericMountHelper.exe
O23 - Service: GRegService (Greg_Service) - Acer Incorporated - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~2\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxdf_device - Unknown owner - C:\Windows\system32\lxdfcoms.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: MyWinLocker Service (MWLService) - Egis Technology Inc. - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: Radmin Server V3 (RServer3) - Famatech Corp. - C:\Windows\SysWOW64\rserver30\RServer3.exe
O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SymSnapService - Symantec - C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Updater Service - Acer - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 17585 bytes

OCD

Post #2November 26, 2013, 11:16 PM UTC

Hi Dede,

My name is OCD. I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
Copy and Paste logs directly into the reply window. DO NOT attach the logs unless specifically instructed to do so.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Please stay with this topic until I let you know that your system appears to be "All Clear"

Important: All tools MUST be run from the Desktop.

=========================

HJT is not used extensively anymore, please run these tools below and post the corresponding logs generated.

=========================

[external image: bullseye_zpse9eaf36e.gif] Security Check

Download Security Check by screen317 from here or here.

Save it to your Desktop.
- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=========================

[external image: bullseye_zpse9eaf36e.gif] aswMBR

Download aswMBR.exe and save it to your desktop.

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
When asked if you want to download Avast's virus definitions please select Yes.
Click Scan
Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.

=========================
[external image: bullseye_zpse9eaf36e.gif] OTL

Download OTL to your desktop.

Make sure all other windows are closed and to let it run uninterrupted.
- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

%USERPROFILE%\..|smtmp;true;true;true /FP
%temp%\smtmp\*.* /s >
/md5start
iexplore.*
explorer.*
winlogon.*
dll
zx.dll
hlp.dat
consrv.dll
services.*
/md5stop
netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
dir "%systemdrive%\*" /S /A:L /C
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
BASESERVICES
DRIVES
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
- You may need two posts to fit them both in.

=========================

In your next post please provide the following:

checkup.txt
aswMBR.txt
attach MBR.zip
OTL.txt
Extras.txt

Dede

Post #3November 27, 2013, 12:55 AM UTC last edited November 27, 2013, 6:08 PM UTC

Hi OCD,

Firstly, thank you for helping me.

I will copy and paste the items as the come.

Starting with the Security Check.

Results of screen317's Security Check version 0.99.77
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
ESET Smart Security 7.0
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Norton Ghost
Java 7 Update 25
Java version out of Date!
Adobe Flash Player 11.9.900.152
Adobe Reader XI
Mozilla Firefox (25.0.1)
Google Chrome 30.0.1599.101
Google Chrome 31.0.1650.57
````````Process Check: objlist.exe by Laurent````````
ESET NOD32 Antivirus egui.exe
ESET NOD32 Antivirus ekrn.exe
Spybot Teatimer.exe is disabled!
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````

Nest aswMBR.

Here I have to note that I had to disable my eset temporarily to runs\n this.

Another thing is that my computer unexpectedly rebooted during the first run of this program, and this has not happened before. So this is the second run.

I am also changed the computer's name, replacing mine with A M

aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software
Run date: 2013-11-26 19:07:56
—————————–
19:07:56.717 OS Version: Windows x64 6.1.7601 Service Pack 1
19:07:56.717 Number of processors: 2 586 0x170A
19:07:56.717 ComputerName: AM UserName:
19:07:59.730 Initialize success
19:08:56.249 AVAST engine defs: 13112600
19:09:00.841 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
19:09:00.841 Disk 0 Vendor: WDC_WD32 01.0 Size: 305245MB BusType: 3
19:09:01.028 Disk 0 MBR read successfully
19:09:01.028 Disk 0 MBR scan
19:09:01.044 Disk 0 Windows 7 default MBR code
19:09:01.059 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 12288 MB offset 2048
19:09:01.075 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 25167872
19:09:01.091 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 292855 MB offset 25372672
19:09:01.153 Disk 0 scanning C:\Windows\system32\drivers
19:09:14.491 Service scanning
19:09:51.483 Modules scanning
19:09:51.499 Disk 0 trace - called modules:
19:09:51.561 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll
19:09:52.092 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80048a0240]
19:09:52.092 3 CLASSPNP.SYS[fffff88000e7543f] -> nt!IofCallDriver -> [0xfffffa80046ada10]
19:09:52.107 5 ACPI.sys[fffff880010f87a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0xfffffa80046ae050]
19:09:54.052 AVAST engine scan C:\Windows
19:09:57.712 AVAST engine scan C:\Windows\system32
19:15:18.088 AVAST engine scan C:\Windows\system32\drivers
19:15:33.922 AVAST engine scan C:\Users\A M
19:34:58.200 AVAST engine scan C:\ProgramData
19:40:24.041 Scan finished successfully
19:42:35.518 Disk 0 MBR has been saved successfully to "C:\Users\A M\Desktop\MBR.dat"
19:42:35.534 The log file has been saved successfully to "C:\Users\A M\Desktop\aswMBR.txt"

Dede

Post #4November 27, 2013, 12:59 AM UTC

I cannot find the attach option for attaching the compressed (ZIP FILE) of MBR

Never mind I got it, here it is

Attachments:

📎MBR.zip

Dede

Post #5November 27, 2013, 2:17 AM UTC last edited November 27, 2013, 2:22 AM UTC

OTL logfile created on: 26-Nov-13 8:05:30 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\A M\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16428)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: dd-MMM-yy

3.91 Gb Total Physical Memory | 1.91 Gb Available Physical Memory | 49.02% Memory free
7.81 Gb Paging File | 5.72 Gb Available in Paging File | 73.26% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 285.99 Gb Total Space | 74.55 Gb Free Space | 26.07% Space Free | Partition Type: NTFS

Computer Name: AM | User Name: A M | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found
PRC - C:\Users\A M\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe (ESET)
PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Opera\opera.exe (Opera Software)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
PRC - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
PRC - C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Launch Manager\LManager.EXE (Dritek System Inc.)
PRC - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe (Acer Incorporated)
PRC - C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
PRC - C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
PRC - C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer)
PRC - c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe ()
PRC - C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
PRC - C:\wamp\bin\apache\Apache2.2.11\bin\httpd.exe (Apache Software Foundation)
PRC - c:\wamp\bin\apache\Apache2.2.11\bin\httpd.exe (Apache Software Foundation)
PRC - C:\Windows\PLFSetI.exe ()
PRC - C:\Program Files (x86)\Microsoft Student\Microsoft Student with Encarta Reference Library 2009 DVD\EDICT.EXE (Microsoft Corporation)
PRC - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files (x86)\Microsoft Encarta\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ef0a534be135cd8f0d99d938d8b1814a\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\4eef5a3a4d0ed6d6fd882947a70df530\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\29f3ae8d313e62b4daed1107ccd29f9f\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\e9147e4c70d4e387dc4aea59ce0a219a\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\99bbd3424207d205e9e680fa712dba04\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\85a501f8b0cb271f1bfab6532523ac3c\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\55c245966c0b23a47587c18681457e48\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\b1ff5e4a64c0bb0a9b039aaefcde5ea7\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\ef63e29e24bf73b2a8659e13aa18fbbb\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\d473c19e69818875b9c739cad8f386a5\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\0149e914e4cfbde7da65d4558af19ce0\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5aa44bce7933e4de09d935848f868a4b\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\09db78d6068543df01862a023aca785a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5d22a30e587e2cac106b81fb351e7c08\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\d8f4106eee38420ac5eda7d630dc53fc\System.ServiceProcess.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\c8648331484537c338fe2b606a9db8b7\System.Xaml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b7285e9f3d19a05d5cc2c049e451685d\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\08c630893416f3379c9455870908ad6c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a01e07e47ecdd94ae099e8c4bf650516\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Windows\PLFSetI.exe ()
MOD - C:\Program Files (x86)\Common Files\microsoft shared\Reference 2009\MSENCXML.DLL ()
MOD - C:\Program Files (x86)\Common Files\microsoft shared\Reference 2009\ERSREGPR.DLL ()
MOD - C:\Program Files (x86)\Common Files\microsoft shared\Reference 2009\MSENCDAT.DLL ()
MOD - C:\Program Files (x86)\Common Files\microsoft shared\Reference 2009\ENCCONT.DLL ()
MOD - C:\Program Files (x86)\Microsoft Student\Microsoft Student with Encarta Reference Library 2009 DVD\EDICTEIT.EBK ()
MOD - C:\Program Files (x86)\Microsoft Encarta\Microsoft Encarta 2009 - Collection DVD\EDICTEIT.EBK ()

========== Services (SafeList) ==========

SRV:64bit: - (IEEtwCollectorService) – C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation)
SRV:64bit: - (ekrn) – C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe (ESET)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (ePowerSvc) – C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
SRV:64bit: - (Updater Service) – C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer)
SRV:64bit: - (btwdins) – C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV:64bit: - (Crypkey License) – C:\Windows\SysNative\Crypserv.exe (CrypKey (Canada) Ltd.)
SRV:64bit: - (lxdf_device) – C:\Windows\SysNative\lxdfcoms.exe ( )
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Blackberry Device Manager) – C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
SRV - (HPSLPSVC) – C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (IAStorDataMgrSvc) – C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (RServer3) – C:\Windows\SysWOW64\rserver30\RServer3.exe (Famatech Corp.)
SRV - (Norton Ghost) – C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe (Symantec Corporation)
SRV - (GenericMount Helper Service) – C:\Program Files (x86)\Norton Ghost\Shared\Drivers\GenericMountHelper.exe (Symantec)
SRV - (SymSnapService) – C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe (Symantec)
SRV - (MWLService) – C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe ()
SRV - (Greg_Service) – C:\Program Files (x86)\Acer\Registration\GregHSRW.exe (Acer Incorporated)
SRV - (RS_Service) – C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
SRV - (wampmysqld) – c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe ()
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (wampapache) – c:\wamp\bin\apache\Apache2.2.11\bin\httpd.exe (Apache Software Foundation)
SRV - (LiveUpdate) – C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (eamonm) – C:\Windows\SysNative\drivers\eamonm.sys (ESET)
DRV:64bit: - (epfw) – C:\Windows\SysNative\drivers\epfw.sys (ESET)
DRV:64bit: - (ehdrv) – C:\Windows\SysNative\drivers\ehdrv.sys (ESET)
DRV:64bit: - (epfwwfp) – C:\Windows\SysNative\drivers\epfwwfp.sys (ESET)
DRV:64bit: - (EpfwLWF) – C:\Windows\SysNative\drivers\EpfwLWF.sys (ESET)
DRV:64bit: - (ssudmdm) – C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) – C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (Point64) – C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:64bit: - (dc3d) – C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation)
DRV:64bit: - (usb_rndisx) – C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (usbrndis6) – C:\Windows\SysNative\drivers\usb80236.sys (Microsoft Corporation)
DRV:64bit: - (RimVSerPort) – C:\Windows\SysNative\drivers\RimSerial_AMD64.sys (Research in Motion Ltd)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) – C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (L1C) – C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (SCDEmu) – C:\Windows\SysNative\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV:64bit: - (mirrorv3) – C:\Windows\SysNative\drivers\rminiv3.sys (Famatech International Corp.)
DRV:64bit: - (WimFltr) – C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV:64bit: - (VProEventMonitor) – C:\Windows\SysNative\drivers\vproeventmonitor.sys (Symantec Corporation)
DRV:64bit: - (GenericMount) – C:\Windows\SysNative\drivers\GenericMount.sys (Symantec Corporation)
DRV:64bit: - (symsnap) – C:\Windows\SysNative\drivers\symsnap.sys (StorageCraft)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (NETw5s64) – C:\Windows\SysNative\drivers\NETw5s64.sys (Intel Corporation)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (StillCam) – C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (ROOTMODEM) – C:\Windows\SysNative\drivers\rootmdm.sys (Microsoft Corporation)
DRV:64bit: - (IntcHdmiAddService) – C:\Windows\SysNative\drivers\IntcHdmi.sys (Intel(R) Corporation)
DRV:64bit: - (btusbflt) – C:\Windows\SysNative\drivers\btusbflt.sys (Broadcom Corporation.)
DRV:64bit: - (btwaudio) – C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)
DRV:64bit: - (btwavdt) – C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)
DRV:64bit: - (btwrchid) – C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (mwlPSDVDisk) – C:\Windows\SysNative\drivers\mwlPSDVDisk.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDFilter) – C:\Windows\SysNative\drivers\mwlPSDFilter.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDNServ) – C:\Windows\SysNative\drivers\mwlPSDNserv.sys (Egis Technology Inc.)
DRV:64bit: - (AmUStor) – C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)
DRV:64bit: - (btwl2cap) – C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV:64bit: - (int15.sys) – C:\Windows\SysNative\OEM\factory\int15.sys (Acer, Inc.)
DRV:64bit: - (NetworkX) – C:\Windows\SysNative\Ckldrv.sys ()
DRV - (FsUsbExDisk) – C:\Windows\SysWOW64\FsUsbExDisk.Sys ()
DRV - (raddrvv3) – C:\Windows\SysWOW64\rserver30\raddrvv3.sys (Famatech Corp.)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&sourceid;=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q;={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&rlz;=1I7ACAW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&sourceid;=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/?ocid=EIE9HP&PC;=UP50
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ca.msn.com/
IE - HKCU\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src;=IE-SearchBox&FORM;=IE11SR
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.bing.com/search?FORM=UP50DF&PC;=UP50&q;={searchTerms}&src;=IE-SearchBox
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&sourceid;=ie7
IE - HKCU\..\SearchScopes\{A282C0E0-6769-4A11-BA2F-6173374A4919}: "URL" = http://www.google.com/search?sourceid=ie7&q;={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&rlz;=1I7ACAW_enUS361CA362
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.87.1.220:8080

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.msn.com/?pc=UP97&ocid;=UP97DHP"
FF - prefs.js..extensions.enabledAddons: %7Bc45c406e-ab73-11d8-be73-000a95be3b12%7D:1.2.5
FF - prefs.js..extensions.enabledAddons: %7Bd57c9ff1-6389-48fc-b770-f78bd89b6e8a%7D:1.46
FF - prefs.js..extensions.enabledAddons: en-GB%40dictionaries.addons.mozilla.org:1.19.1
FF - prefs.js..extensions.enabledAddons: fr-classique-reforme1990%40dictionaries.addons.mozilla.org:4.3
FF - prefs.js..extensions.enabledAddons: flashfirebug%40o-minds.com:4.69
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:25.0.1
FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.9
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "http://search.toolbars.alexa.com/?ver=alxf-2.14&src;=ab&aid;=wdIDe1K6Dx00gU&q;="
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Web Player Plug-In,version=1.0.0: C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\A M\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\A M\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\PROGRAM FILES\ESET\ESET SMART SECURITY\MOZILLA THUNDERBIRD [2013-11-21 00:08:07 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 25.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013-11-21 09:49:28 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 25.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013-11-21 09:49:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2013-11-21 00:08:07 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 25.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013-11-21 09:49:28 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 25.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013-11-21 09:49:30 | 000,000,000 | —D | M]

[2010-03-31 07:43:08 | 000,000,000 | —D | M] (No name found) – C:\Users\A M\AppData\Roaming\Mozilla\Extensions
[2010-03-31 07:43:08 | 000,000,000 | —D | M] (No name found) – C:\Users\A M\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2013-11-21 12:28:37 | 000,000,000 | —D | M] (No name found) – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions
[2013-11-20 12:28:29 | 000,000,000 | —D | M] (Canadian English Dictionary) – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions\[removed]
[2013-11-18 13:44:44 | 000,000,000 | —D | M] (British English Dictionary) – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions\[removed]
[2013-11-18 13:44:47 | 000,000,000 | —D | M] (FlashFirebug) – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions\[removed]
[2013-11-18 13:44:47 | 000,000,000 | —D | M] (Dictionnaire franÃ§ais Â«Classique & RÃ©forme 1990Â») – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions\[removed]
[2013-11-21 12:28:37 | 002,212,154 | —- | M] () (No name found) – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions\[removed]
[2013-08-08 07:07:04 | 000,249,988 | —- | M] () (No name found) – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions\[removed]
[2013-05-16 09:06:59 | 001,360,435 | —- | M] () (No name found) – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi
[2013-06-02 09:34:30 | 000,150,349 | —- | M] () (No name found) – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions\{d57c9ff1-6389-48fc-b770-f78bd89b6e8a}.xpi
[2013-11-21 09:49:29 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2013-11-21 09:49:29 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013-11-21 09:49:29 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013-11-21 09:49:28 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013-11-21 09:49:52 | 000,000,000 | —D | M] (Default) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q;={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: http://www.msn.com/?pc=UP97&ocid;=UP97DHP
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\A M\AppData\Local\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\A M\AppData\Local\Google\Chrome\Application\31.0.1650.57\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\A M\AppData\Local\Google\Chrome\Application\31.0.1650.57\gcswf32.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: RIM Handheld Application Loader (Enabled) = C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Windows Live Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: Error reading preferences file
CHR - Extension: Entanglement Web App = C:\Users\A M\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd\3.4.9_0\
CHR - Extension: FB Easy Logout = C:\Users\A M\AppData\Local\Google\Chrome\User Data\Default\Extensions\dngiackpkbhijljopnbakdabdfijafmd\1.3_0\
CHR - Extension: Poppit = C:\Users\A M\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi\2.2_0\
CHR - Extension: Google Wallet = C:\Users\A M\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0\

O1 HOSTS File: ([2011-02-25 17:20:21 | 000,000,849 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.)
O4:64bit: - HKLM..\Run: [egui] C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files (x86)\Acer\Acer Assist\launcher.exe ()
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe (DivX, LLC)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.EXE (Dritek System Inc.)
O4 - HKLM..\Run: [Norton Ghost 15.0] C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe (Symantec Corporation)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [SDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung)
O4 - HKCU..\Run: [E09FXLRD_87317784] C:\Program Files (x86)\Microsoft Encarta\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE (Microsoft Corporation)
O4 - HKCU..\Run: [HP Officejet 6600 (NET)] C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O4 - HKCU..\Run: [KiesAirMessage] C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe (Samsung Electronics)
O4 - HKCU..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung)
O4 - HKCU..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)
O4 - HKCU..\Run: [L09ZXLRD_16295271] C:\Program Files (x86)\Microsoft Student\Microsoft Student with Encarta Reference Library 2009 DVD\EDICT.EXE (Microsoft Corporation)
O4 - HKCU..\Run: [Spybot-S&D; Cleaning] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe (Safer-Networking Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Send to &Bluetooth; Device… - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {9C65AB3E-C9A8-4789-AE24-B365A1C4A6F9} http://acer.custhelp.com/euf/assets/activex/snret.cab (SNRet Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3DB6117A-A137-45BE-A623-F8E4F95493E7}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{521854D5-AAA4-4D2F-ADFC-C061365D8136}: DhcpNameServer = [removed] [removed] 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BEC80406-154B-4651-AE36-9C5C479C4AD2}: DhcpNameServer = [removed] [removed] [removed]
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\livecall - No CLSID value found
O18 - Protocol\Handler\msnim - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - AppInit_DLLs: (acaptuser64.dll) - C:\Windows\SysNative\acaptuser64.dll (Adobe Systems, Inc.)
O20 - AppInit_DLLs: (acaptuser32.dll) - C:\Windows\SysWow64\acaptuser32.dll (Adobe Systems, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013-11-16 06:11:12 | 000,000,000 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{1cb0c9dd-a6a9-11df-a9c9-00269e978d0d}\Shell - "" = AutoRun
O33 - MountPoints2\{1cb0c9dd-a6a9-11df-a9c9-00269e978d0d}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{a7497b33-0084-11e0-a253-00269e978d0d}\Shell - "" = AutoRun
O33 - MountPoints2\{a7497b33-0084-11e0-a253-00269e978d0d}\Shell\AutoRun\command - "" = F:\laucher.exe
O33 - MountPoints2\{cd11c2e2-4d11-11e2-9f0d-00269e978d0d}\Shell - "" = AutoRun
O33 - MountPoints2\{cd11c2e2-4d11-11e2-9f0d-00269e978d0d}\Shell\AutoRun\command - "" = E:\HPLauncher.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\Autoplay.exe -auto
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013-11-26 20:03:13 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\A M\Desktop\OTL.exe
[2013-11-26 19:05:18 | 000,000,000 | R–D | C] – C:\Users\A M\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 8
[2013-11-26 18:54:03 | 004,745,728 | —- | C] (AVAST Software) – C:\Users\A M\Desktop\aswMBR.exe
[2013-11-21 09:49:27 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2013-11-21 00:07:58 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
[2013-11-21 00:07:58 | 000,000,000 | —D | C] – C:\ProgramData\ESET
[2013-11-20 12:31:53 | 000,000,000 | —D | C] – C:\Users\A M\AppData\Roaming\langmaster.com
[2013-11-20 12:31:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\LANGMaster
[2013-11-19 10:11:31 | 000,028,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\IEUDINIT.EXE
[2013-11-19 10:05:44 | 000,940,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013-11-19 10:05:44 | 000,194,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\elshyph.dll
[2013-11-19 10:05:34 | 000,645,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jsIntl.dll
[2013-11-19 10:05:34 | 000,235,008 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\elshyph.dll
[2013-11-19 10:05:33 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013-11-19 10:05:31 | 000,440,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2013-11-19 10:05:31 | 000,164,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msrating.dll
[2013-11-19 10:05:26 | 000,337,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2013-11-19 10:05:26 | 000,062,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tdc.ocx
[2013-11-19 10:05:26 | 000,034,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2013-11-19 10:05:25 | 000,703,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2013-11-19 10:05:25 | 000,616,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dat
[2013-11-19 10:05:25 | 000,233,472 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2013-11-19 10:05:24 | 001,926,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2013-11-19 10:05:24 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\icardie.dll
[2013-11-19 10:05:23 | 001,051,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmlmedia.dll
[2013-11-19 10:05:23 | 000,083,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inseng.dll
[2013-11-19 10:05:23 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2013-11-19 10:05:23 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2013-11-19 10:05:23 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2013-11-19 10:05:22 | 000,151,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iexpress.exe
[2013-11-19 10:05:22 | 000,139,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wextract.exe
[2013-11-19 10:05:22 | 000,069,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2013-11-19 10:05:21 | 000,056,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\pngfilt.dll
[2013-11-19 10:05:15 | 000,127,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2013-11-19 10:05:15 | 000,112,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2013-11-19 10:05:15 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MshtmlDac.dll
[2013-11-19 10:05:14 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieetwproxystub.dll
[2013-11-19 10:05:13 | 000,610,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2013-11-19 10:05:13 | 000,116,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2013-11-19 10:05:13 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2013-11-19 10:05:12 | 000,111,616 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\IEAdvpack.dll
[2013-11-19 10:05:11 | 000,553,472 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript9diag.dll
[2013-11-19 10:05:11 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013-11-19 10:05:11 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmler.dll
[2013-11-19 10:05:10 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2013-11-19 10:05:09 | 000,942,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jsIntl.dll
[2013-11-19 10:05:09 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013-11-19 10:05:08 | 000,247,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msls31.dll
[2013-11-19 10:05:06 | 000,195,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msrating.dll
[2013-11-19 10:05:05 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2013-11-19 10:05:04 | 000,708,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9diag.dll
[2013-11-19 10:05:04 | 000,131,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\IEAdvpack.dll
[2013-11-19 10:05:04 | 000,090,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SetIEInstalledDate.exe
[2013-11-19 10:05:03 | 005,765,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2013-11-19 10:05:03 | 000,105,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2013-11-19 10:05:03 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmler.dll
[2013-11-19 10:05:02 | 000,574,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2013-11-19 10:05:01 | 000,077,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tdc.ocx
[2013-11-19 10:05:00 | 000,413,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2013-11-19 10:05:00 | 000,296,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtrans.dll
[2013-11-19 10:05:00 | 000,040,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2013-11-19 10:04:59 | 000,817,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2013-11-19 10:04:59 | 000,616,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dat
[2013-11-19 10:04:59 | 000,453,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtmsft.dll
[2013-11-19 10:04:59 | 000,218,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2013-11-19 10:04:59 | 000,081,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\icardie.dll
[2013-11-19 10:04:59 | 000,066,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2013-11-19 10:04:59 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2013-11-19 10:04:58 | 001,993,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2013-11-19 10:04:58 | 001,228,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmlmedia.dll
[2013-11-19 10:04:58 | 000,235,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2013-11-19 10:04:57 | 000,167,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iexpress.exe
[2013-11-19 10:04:57 | 000,143,872 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wextract.exe
[2013-11-19 10:04:57 | 000,101,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inseng.dll
[2013-11-19 10:04:57 | 000,084,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2013-11-19 10:04:57 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2013-11-19 10:04:56 | 000,626,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2013-11-19 10:04:56 | 000,548,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2013-11-19 10:04:53 | 000,139,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2013-11-19 10:04:52 | 000,147,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\occache.dll
[2013-11-19 10:04:52 | 000,062,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\pngfilt.dll
[2013-11-19 10:04:51 | 000,774,144 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2013-11-19 10:04:51 | 000,111,616 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieetwcollector.exe
[2013-11-19 10:04:51 | 000,083,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MshtmlDac.dll
[2013-11-19 10:04:51 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieetwproxystub.dll
[2013-11-19 10:04:51 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshta.exe
[2013-11-19 10:04:51 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieetwcollectorres.dll
[2013-11-19 10:04:50 | 000,135,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2013-11-19 10:04:50 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\imgutil.dll
[2013-11-18 13:17:11 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013-11-18 13:16:22 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2013-11-18 13:16:21 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2013-11-18 13:16:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2013-11-18 13:16:21 | 000,000,000 | —D | C] – C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013-11-18 13:04:26 | 001,474,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\crypt32.dll
[2013-11-18 13:03:48 | 001,930,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\authui.dll
[2013-11-18 13:03:48 | 001,796,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\authui.dll
[2013-11-18 13:03:48 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\credui.dll
[2013-11-18 13:03:48 | 000,190,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SmartcardCredentialProvider.dll
[2013-11-18 13:03:47 | 000,152,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\SmartcardCredentialProvider.dll
[2013-11-18 13:01:47 | 001,447,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lsasrv.dll
[2013-11-18 13:01:47 | 000,307,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncrypt.dll
[2013-11-18 13:01:47 | 000,135,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\sspicli.dll
[2013-11-18 13:01:47 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\sspisrv.dll
[2013-11-18 13:01:47 | 000,028,160 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\secur32.dll
[2013-11-18 13:01:39 | 000,404,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\gdi32.dll
[2013-11-18 13:00:03 | 000,830,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\nshwfp.dll
[2013-11-18 13:00:03 | 000,656,896 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\nshwfp.dll
[2013-11-18 13:00:03 | 000,324,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\FWPUCLNT.DLL
[2013-11-18 13:00:03 | 000,216,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\FWPUCLNT.DLL
[2013-11-18 10:37:12 | 000,000,000 | —D | C] – C:\sh4ldr
[2013-11-16 06:09:20 | 000,000,000 | —D | C] – C:\Program Files\Enigma Software Group
[2013-11-15 20:56:56 | 000,000,000 | —D | C] – C:\Users\A M\AppData\Roaming\Anvisoft
[2013-11-15 20:56:38 | 000,000,000 | —D | C] – C:\ProgramData\Anvisoft
[2013-11-11 08:22:48 | 000,000,000 | —D | C] – C:\Program Files (x86)\Gophoto.it
[2013-11-11 08:21:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Magnet-TV.com
[2009-04-03 06:09:46 | 000,142,152 | —- | C] (Microsoft Corporation) – C:\Users\A M\oarpman.exe
[2 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[2 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013-11-26 20:15:05 | 000,000,948 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3951519764-547225608-714768077-1000UA1cec6df739957b0.job
[2013-11-26 20:15:05 | 000,000,896 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3951519764-547225608-714768077-1000Core.job
[2013-11-26 20:03:13 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\A M\Desktop\OTL.exe
[2013-11-26 20:03:07 | 000,789,612 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013-11-26 20:03:07 | 000,667,614 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013-11-26 20:03:07 | 000,124,252 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013-11-26 19:43:18 | 000,000,568 | —- | M] () – C:\Users\A M\Desktop\MBR.zip
[2013-11-26 19:42:35 | 000,000,512 | —- | M] () – C:\Users\A M\Desktop\MBR.dat
[2013-11-26 19:17:00 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA1cec50a497766a2.job
[2013-11-26 19:12:13 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013-11-26 19:12:13 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013-11-26 19:04:57 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013-11-26 19:04:01 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013-11-26 19:03:58 | 3144,871,936 | -HS- | M] () – C:\hiberfil.sys
[2013-11-26 19:03:55 | 567,645,639 | —- | M] () – C:\Windows\MEMORY.DMP
[2013-11-26 18:54:07 | 004,745,728 | —- | M] (AVAST Software) – C:\Users\A M\Desktop\aswMBR.exe
[2013-11-26 18:48:04 | 000,035,237 | —- | M] () – C:\Users\A M\Desktop\mode sécurisé..rtf
[2013-11-26 18:44:53 | 000,891,200 | —- | M] () – C:\Users\A M\Desktop\SecurityCheck.exe
[2013-11-25 11:11:38 | 000,692,616 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2013-11-25 11:11:38 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013-11-25 10:50:02 | 000,112,098 | —- | M] () – C:\Users\A M\Desktop\Reassignment_Grievancees-Nov-2013.pdf
[2013-11-25 10:13:00 | 001,587,657 | —- | M] () – C:\Users\A M\Documents\F-Jazz-CFAU-Reassignment Grievances.pdf
[2013-11-21 08:56:00 | 000,055,667 | —- | M] () – C:\Users\A M\Desktop\Dec 2013.htm
[2013-11-19 10:05:44 | 000,940,032 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013-11-19 10:05:44 | 000,194,048 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\elshyph.dll
[2013-11-19 10:05:34 | 000,645,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\jsIntl.dll
[2013-11-19 10:05:34 | 000,235,008 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\elshyph.dll
[2013-11-19 10:05:33 | 000,071,680 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013-11-19 10:05:31 | 000,440,832 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2013-11-19 10:05:31 | 000,164,864 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msrating.dll
[2013-11-19 10:05:26 | 000,337,408 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2013-11-19 10:05:26 | 000,062,464 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\tdc.ocx
[2013-11-19 10:05:26 | 000,034,816 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2013-11-19 10:05:25 | 000,703,488 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2013-11-19 10:05:25 | 000,616,104 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dat
[2013-11-19 10:05:25 | 000,233,472 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2013-11-19 10:05:24 | 001,926,656 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2013-11-19 10:05:24 | 000,069,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\icardie.dll
[2013-11-19 10:05:23 | 001,051,136 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmlmedia.dll
[2013-11-19 10:05:23 | 000,083,456 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\inseng.dll
[2013-11-19 10:05:23 | 000,061,952 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2013-11-19 10:05:23 | 000,032,768 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2013-11-19 10:05:23 | 000,024,576 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2013-11-19 10:05:23 | 000,016,284 | —- | M] () – C:\Windows\SysWow64\ieuinit.inf
[2013-11-19 10:05:22 | 000,151,552 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iexpress.exe
[2013-11-19 10:05:22 | 000,139,264 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\wextract.exe
[2013-11-19 10:05:22 | 000,069,632 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2013-11-19 10:05:21 | 000,056,832 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\pngfilt.dll
[2013-11-19 10:05:15 | 000,127,488 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2013-11-19 10:05:15 | 000,112,128 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2013-11-19 10:05:15 | 000,061,952 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\MshtmlDac.dll
[2013-11-19 10:05:14 | 000,051,200 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieetwproxystub.dll
[2013-11-19 10:05:13 | 000,610,304 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2013-11-19 10:05:13 | 000,116,736 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2013-11-19 10:05:13 | 000,012,800 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2013-11-19 10:05:12 | 000,111,616 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\IEAdvpack.dll
[2013-11-19 10:05:11 | 000,553,472 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\jscript9diag.dll
[2013-11-19 10:05:11 | 000,074,240 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013-11-19 10:05:11 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmler.dll
[2013-11-19 10:05:10 | 000,086,016 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2013-11-19 10:05:09 | 000,942,592 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jsIntl.dll
[2013-11-19 10:05:09 | 000,086,016 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013-11-19 10:05:08 | 000,247,808 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msls31.dll
[2013-11-19 10:05:06 | 000,195,584 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msrating.dll
[2013-11-19 10:05:05 | 000,013,312 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2013-11-19 10:05:04 | 000,708,608 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jscript9diag.dll
[2013-11-19 10:05:04 | 000,131,072 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\IEAdvpack.dll
[2013-11-19 10:05:04 | 000,090,112 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\SetIEInstalledDate.exe
[2013-11-19 10:05:03 | 005,765,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2013-11-19 10:05:03 | 000,105,984 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2013-11-19 10:05:03 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshtmler.dll
[2013-11-19 10:05:02 | 000,574,976 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2013-11-19 10:05:01 | 000,077,312 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\tdc.ocx
[2013-11-19 10:05:00 | 000,413,696 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2013-11-19 10:05:00 | 000,296,960 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxtrans.dll
[2013-11-19 10:05:00 | 000,040,448 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2013-11-19 10:04:59 | 000,817,664 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2013-11-19 10:04:59 | 000,616,104 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dat
[2013-11-19 10:04:59 | 000,453,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxtmsft.dll
[2013-11-19 10:04:59 | 000,218,624 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2013-11-19 10:04:59 | 000,081,408 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\icardie.dll
[2013-11-19 10:04:59 | 000,066,048 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2013-11-19 10:04:59 | 000,033,792 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2013-11-19 10:04:59 | 000,016,284 | —- | M] () – C:\Windows\SysNative\ieuinit.inf
[2013-11-19 10:04:58 | 001,993,728 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2013-11-19 10:04:58 | 001,228,800 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshtmlmedia.dll
[2013-11-19 10:04:58 | 000,235,520 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2013-11-19 10:04:57 | 000,167,424 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iexpress.exe
[2013-11-19 10:04:57 | 000,143,872 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wextract.exe
[2013-11-19 10:04:57 | 000,101,376 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\inseng.dll
[2013-11-19 10:04:57 | 000,084,992 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2013-11-19 10:04:57 | 000,030,208 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2013-11-19 10:04:56 | 000,626,176 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2013-11-19 10:04:56 | 000,548,352 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2013-11-19 10:04:53 | 000,139,264 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2013-11-19 10:04:52 | 000,147,968 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\occache.dll
[2013-11-19 10:04:52 | 000,062,464 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\pngfilt.dll
[2013-11-19 10:04:51 | 000,774,144 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2013-11-19 10:04:51 | 000,111,616 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieetwcollector.exe
[2013-11-19 10:04:51 | 000,083,968 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\MshtmlDac.dll
[2013-11-19 10:04:51 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieetwproxystub.dll
[2013-11-19 10:04:51 | 000,013,824 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshta.exe
[2013-11-19 10:04:51 | 000,004,096 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieetwcollectorres.dll
[2013-11-19 10:04:50 | 000,135,680 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2013-11-19 10:04:50 | 000,048,128 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\imgutil.dll
[2013-11-16 06:11:12 | 000,000,000 | —- | M] () – C:\autoexec.bat
[2013-11-14 00:01:23 | 000,000,000 | —- | M] () – C:\Windows\SysWow64\igfxext.exe
[2013-11-06 10:53:15 | 000,005,027 | —- | M] () – C:\Users\A M\Desktop\Filling of Positions - Hotel Uniform.odt
[2013-10-28 10:07:11 | 000,047,450 | —- | M] () – C:\Users\A M\Desktop\Translate to another language ClientExec Community.htm
[2 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[2 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013-11-26 19:43:18 | 000,000,568 | —- | C] () – C:\Users\A M\Desktop\MBR.zip
[2013-11-26 19:42:35 | 000,000,512 | —- | C] () – C:\Users\A M\Desktop\MBR.dat
[2013-11-26 19:03:55 | 567,645,639 | —- | C] () – C:\Windows\MEMORY.DMP
[2013-11-26 18:44:53 | 000,891,200 | —- | C] () – C:\Users\A M\Desktop\SecurityCheck.exe
[2013-11-25 10:50:00 | 000,112,098 | —- | C] () – C:\Users\A M\Desktop\Reassignment_Grievancees-Nov-2013.pdf
[2013-11-25 10:13:00 | 001,587,657 | —- | C] () – C:\Users\A M\Documents\F-Jazz-CFAU-Reassignment Grievances.pdf
[2013-11-21 08:55:59 | 000,055,667 | —- | C] () – C:\Users\A M\Desktop\Dec 2013.htm
[2013-11-19 10:05:23 | 000,016,284 | —- | C] () – C:\Windows\SysWow64\ieuinit.inf
[2013-11-19 10:04:59 | 000,016,284 | —- | C] () – C:\Windows\SysNative\ieuinit.inf
[2013-11-16 06:11:12 | 000,000,000 | —- | C] () – C:\autoexec.bat
[2013-11-14 00:01:23 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\igfxext.exe
[2013-11-06 10:53:05 | 000,005,027 | —- | C] () – C:\Users\A M\Desktop\Filling of Positions - Hotel Uniform.odt
[2013-10-28 10:07:11 | 000,047,450 | —- | C] () – C:\Users\A M\Desktop\Translate to another language ClientExec Community.htm
[2013-08-19 00:39:38 | 000,142,519 | —- | C] () – C:\Windows\hpwins26.dat
[2013-08-19 00:39:38 | 000,000,370 | —- | C] () – C:\Windows\hpwmdl26.dat
[2013-07-21 06:31:01 | 000,000,057 | —- | C] () – C:\ProgramData\Ament.ini
[2013-03-18 12:09:40 | 000,110,592 | —- | C] () – C:\Windows\SysWow64\FsUsbExDevice.Dll
[2013-03-18 12:09:40 | 000,037,344 | —- | C] () – C:\Windows\SysWow64\FsUsbExDisk.Sys
[2012-06-26 15:02:40 | 000,030,568 | —- | C] () – C:\Windows\MusiccityDownload.exe
[2012-06-26 15:02:38 | 000,974,848 | —- | C] () – C:\Windows\SysWow64\cis-2.4.dll
[2012-06-26 15:02:38 | 000,081,920 | —- | C] () – C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012-06-26 15:02:38 | 000,065,536 | —- | C] () – C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012-06-26 15:02:38 | 000,057,344 | —- | C] () – C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012-04-14 07:57:47 | 000,000,085 | —- | C] () – C:\Users\A M\mm_backup.cfg
[2011-09-22 13:59:13 | 000,000,005 | -H– | C] () – C:\Users\A M\.zs
[2011-08-06 16:21:13 | 000,014,336 | —- | C] () – C:\Users\A M\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011-07-03 12:30:41 | 000,004,096 | -H– | C] () – C:\Users\A M\AppData\Local\keyfile3.drm
[2011-03-02 05:48:40 | 000,019,414 | —- | C] () – C:\Users\A M\AppData\Roaming\UserTile.png
[2011-01-31 02:11:39 | 007,773,586 | —- | C] () – C:\Users\A M\AppData\Local\census.cache
[2011-01-31 02:07:26 | 000,111,976 | —- | C] () – C:\Users\A M\AppData\Local\ars.cache
[2011-01-29 12:46:25 | 000,007,626 | —- | C] () – C:\Users\A M\AppData\Local\Resmon.ResmonCfg
[2010-06-24 14:32:36 | 000,000,494 | —- | C] () – C:\Users\A M\AppData\Roaming\wklnhst.dat
[2010-04-01 16:11:11 | 000,000,036 | —- | C] () – C:\Users\A M\AppData\Local\housecall.guid.cache
[2010-01-13 17:48:59 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat

========== ZeroAccess Check ==========

[2009-07-13 23:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2013-07-25 21:24:57 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2013-07-25 20:55:59 | 012,872,704 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2012-08-21 08:11:31 | 000,857,088 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2012-08-21 08:37:44 | 000,636,928 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2012-08-21 08:08:38 | 000,453,120 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2013-01-05 16:38:51 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\6500 Series
[2010-01-11 00:36:30 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Acer
[2013-11-16 19:15:56 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Anvisoft
[2013-06-28 00:05:50 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\APP_NAME_NON_STRING
[2010-02-07 00:55:59 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Automatic Music Organizer
[2013-01-12 22:24:33 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\calibre
[2011-04-02 14:17:04 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\DriverCure
[2010-03-04 08:11:10 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\ESET
[2010-06-24 06:30:47 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\eSobi
[2013-02-24 21:30:33 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\FileMaker
[2013-02-25 19:19:25 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\FileMaker Pro Advanced
[2010-12-05 13:29:38 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\FileZilla
[2011-09-26 23:07:17 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\GroundSchool JAA ATPL
[2013-11-18 13:44:39 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\ImTOO
[2013-11-20 12:31:53 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\langmaster.com
[2010-01-11 00:36:29 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Leadertech
[2013-02-09 22:42:03 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Lexmark Productivity Studio
[2013-11-18 13:44:40 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\MD5 Checksum Verifier
[2010-02-07 01:03:56 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\MP3 Music Organizer
[2010-11-15 13:03:44 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Night Vision
[2013-11-18 13:44:47 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Notepad++
[2013-11-18 13:37:42 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Opera
[2013-07-08 20:04:56 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Oracle
[2011-04-02 14:17:04 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\ParetoLogic
[2013-11-18 13:44:47 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\PDF Software
[2013-11-18 13:44:47 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\PhotoFiltre
[2013-11-18 13:44:47 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\PhotoFiltre Studio X
[2010-01-15 22:50:16 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Radmin
[2013-11-18 13:37:44 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Research In Motion
[2010-09-29 20:36:46 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Sammsoft
[2013-11-18 13:37:51 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Samsung
[2011-02-28 13:00:23 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Scrabble Plus
[2013-11-18 13:38:48 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\SQL Maestro Group
[2013-11-18 13:44:57 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Stellarium
[2011-05-14 10:25:03 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\svBuilder
[2010-06-24 14:32:40 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Template
[2013-11-18 13:38:50 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Thinstall
[2013-11-18 13:44:57 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Thunderbird
[2010-02-07 01:05:52 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\TuneUpMedia
[2013-11-18 13:44:57 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\uTorrent
[2011-10-13 22:19:50 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Windows Live Writer
[2013-11-18 13:44:57 | 000,000,000 | —D | M] – C:\Users\A M\AppData\Roaming\Xilisoft

========== Purity Check ==========

========== Custom Scans ==========

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.ADML >
[2009-07-13 21:30:02 | 000,003,695 | —- | M] () MD5=7A4C7F3CB156543113596988479CAFCE – C:\Windows\winsxs\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7ef5713984067904\Explorer.adml

< MD5 for: EXPLORER.ADMX >
[2009-06-10 15:53:55 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\winsxs\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.1.7600.16385_none_71af9b5b0a86e6b7\Explorer.admx

< MD5 for: EXPLORER.EXE >
[2013-05-16 09:58:12 | 003,859,928 | —- | M] (Safer-Networking Ltd.) MD5=03250DB0886A23B1F6C077C5D9F152B0 – C:\Program Files (x86)\Spybot - Search & Destroy 2\explorer.exe
[2011-02-26 01:23:14 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011-02-26 00:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009-07-13 20:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011-02-26 00:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009-10-31 00:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011-02-26 00:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011-02-25 01:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011-02-25 01:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011-02-26 01:14:34 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010-11-20 07:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009-08-03 01:19:07 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011-02-25 00:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011-02-25 00:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009-10-31 01:34:59 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009-08-03 00:49:47 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010-11-20 08:24:45 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009-10-31 01:38:38 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009-08-03 00:35:50 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009-07-13 20:39:10 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009-10-31 01:00:51 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011-02-26 01:26:45 | 002,870,784 | —- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009-08-03 01:17:37 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe

< MD5 for: EXPLORER.EXE.MUI >
[2009-07-13 21:26:48 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 – C:\Windows\en-US\explorer.exe.mui
[2009-07-13 21:26:48 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 – C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_61e778c48d52d19b\explorer.exe.mui
[2009-07-13 21:06:56 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\SysWOW64\en-US\explorer.exe.mui
[2009-07-13 21:06:56 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6c3c2316c1b39396\explorer.exe.mui

< MD5 for: EXPLORER.EXE-D5E97654.PF >
[2013-11-25 11:11:03 | 000,029,484 | —- | M] () MD5=25F3C9590CD330FD2F451793EEAE33CD – C:\Windows\Prefetch\EXPLORER.EXE-D5E97654.pf

< MD5 for: EXPLORER.JPG >
[2011-04-12 18:48:30 | 000,054,213 | —- | M] () MD5=7FC68BA403CF9686E3BF71A2A64A259F – C:\E\AM_Novice backup 12Apr2011\Images\FR\Informatique\Windows\explorer.jpg
[2009-08-27 14:54:54 | 000,054,213 | —- | M] () MD5=7FC68BA403CF9686E3BF71A2A64A259F – C:\E\AM-Novice\Images\FR\Informatique\Windows\explorer.jpg
[2009-08-16 21:42:04 | 000,054,213 | —- | M] () MD5=7FC68BA403CF9686E3BF71A2A64A259F – C:\F\AM-Novices enligne\Images\FR\Informatique\Windows\explorer.jpg
[2011-04-12 18:51:14 | 000,042,640 | —- | M] () MD5=C8BD915415DD62913FFA76A40016B520 – C:\E\AM_Novice backup 12Apr2011\Images\US\Informatique\Windows\explorer.jpg
[2009-08-27 14:55:32 | 000,042,640 | —- | M] () MD5=C8BD915415DD62913FFA76A40016B520 – C:\E\AM-Novice\Images\US\Informatique\Windows\explorer.jpg
[2009-08-16 21:42:34 | 000,042,640 | —- | M] () MD5=C8BD915415DD62913FFA76A40016B520 – C:\F\AM-Novices enligne\Images\US\Informatique\Windows\explorer.jpg

< MD5 for: IEXPLORE.EXE >
[2012-06-02 06:47:54 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=004640AB259C1572EBD5FB0A32F63686 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20553_none_0dbfc836999db0ca\iexplore.exe
[2013-01-08 20:53:45 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=0100BCF23941C83462E4A70F94C3392E – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16464_none_0d2c5bc980874648\iexplore.exe
[2012-05-17 18:21:54 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=0129BB16161C2FD9A6B19111AB047198 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16446_none_1798a687b4d6030f\iexplore.exe
[2013-11-19 10:05:09 | 000,804,560 | —- | M] (Microsoft Corporation) MD5=0685765C0CBE095BA0C6C8790BAE21EF – C:\Program Files\Internet Explorer\iexplore.exe
[2013-11-19 10:05:09 | 000,804,560 | —- | M] (Microsoft Corporation) MD5=0685765C0CBE095BA0C6C8790BAE21EF – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.2.9600.16428_none_7b0d6f67c2d3f97a\iexplore.exe
[2013-05-16 21:32:12 | 000,770,648 | —- | M] (Microsoft Corporation) MD5=07DFD28E57879554D054464EE4A5662D – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16614_none_20d88bb252a3770f\iexplore.exe
[2012-11-13 21:56:04 | 000,757,296 | —- | M] (Microsoft Corporation) MD5=0D286C0FE561D1A7EB30E83A0FF305B2 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16457_none_178ed6e5b4dd3857\iexplore.exe
[2012-06-29 00:02:52 | 000,754,784 | —- | M] (Microsoft Corporation) MD5=1223ACBFC1093852DFF039E189599BBD – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16448_none_0d45fcc9807373c2\iexplore.exe
[2013-07-26 01:23:39 | 000,775,256 | —- | M] (Microsoft Corporation) MD5=133CEF30905806A35606652D409EEEBA – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16660_none_16893df21e3dcd43\iexplore.exe
[2010-09-07 23:36:39 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=14803EA3E5DD7CB37CB446C74CFDA38F – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20795_none_1a39121b8bff3c23\iexplore.exe
[2013-08-10 01:31:28 | 000,775,256 | —- | M] (Microsoft Corporation) MD5=1F3B062444AD6F667B5336E78D5A02B7 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20794_none_ffb36d2837eafb72\iexplore.exe
[2012-08-24 02:34:41 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=22CC6CDBA678790046693654C3B212E4 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16450_none_1787d4dfb4e386f6\iexplore.exe
[2012-05-17 17:59:46 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=268982F1FD671A077C6A2AF41E351436 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20551_none_181271f4ce004017\iexplore.exe
[2012-10-08 03:37:24 | 000,748,704 | —- | M] (Microsoft Corporation) MD5=270A1342BD5AF95CA25A586B4C2F1522 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16455_none_178cd651b4df05a9\iexplore.exe
[2013-03-14 09:46:01 | 000,770,560 | —- | M] (Microsoft Corporation) MD5=2859EBC065D2E1CCC94161CE28BAC085 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16521_none_20e4a040529a2792\iexplore.exe
[2013-02-24 19:58:09 | 000,775,232 | —- | M] (Microsoft Corporation) MD5=28F93BAFB3EB407E99A7ED3D9DBDE04C – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20644_none_ffb93ba237e760ce\iexplore.exe
[2013-06-11 23:41:27 | 000,770,648 | —- | M] (Microsoft Corporation) MD5=2A5F565327BFD679EC5F790DC15BBF25 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20742_none_0a0343986c500b78\iexplore.exe
[2009-07-13 20:17:29 | 000,673,048 | —- | M] (Microsoft Corporation) MD5=2C32E3E596CFE660353753EABEFB0540 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_19ba3f8a72d988f3\iexplore.exe
[2012-08-24 06:23:44 | 000,754,824 | —- | M] (Microsoft Corporation) MD5=2D53C5F71653EF94E7829846405D4ED2 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16450_none_0d332a8d8082c4fb\iexplore.exe
[2013-04-05 00:55:38 | 000,770,624 | —- | M] (Microsoft Corporation) MD5=2DC6BD1047553611DAEF97C751131A5D – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20681_none_0a122b746c443b42\iexplore.exe
[2013-06-11 19:23:57 | 000,770,648 | —- | M] (Microsoft Corporation) MD5=30E7CA4620500FE012EB464F0E1DE91E – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16635_none_20da757e52a1c35e\iexplore.exe
[2012-06-02 04:08:27 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=34B01BBD8F00B6B9C9248DC4F1E3CD01 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16447_none_1799a6d1b4d51c66\iexplore.exe
[2013-08-10 01:10:22 | 000,775,256 | —- | M] (Microsoft Corporation) MD5=351657C79B62B91E16A95AD23EA3710D – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16686_none_168ab5d61e3c99b7\iexplore.exe
[2013-08-09 23:18:11 | 000,770,648 | —- | M] (Microsoft Corporation) MD5=37287D98A1BF5D56AA729CEB9B27C6B1 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16686_none_20df6028529d5bb2\iexplore.exe
[2013-05-16 20:57:28 | 000,770,648 | —- | M] (Microsoft Corporation) MD5=3902E280F6117A468D5573343A7AA1F6 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20719_none_09ffa3426c5372da\iexplore.exe
[2013-10-12 16:42:28 | 000,775,344 | —- | M] (Microsoft Corporation) MD5=39D0074C59F6D1A62731942C7FA8B60B – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16736_none_167ae4781e4936f5\iexplore.exe
[2013-10-12 04:49:48 | 000,775,344 | —- | M] (Microsoft Corporation) MD5=3C8C00380462B1023C9F8EA2A9A7A137 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20848_none_ffa340aa37f7ff34\iexplore.exe
[2010-09-08 00:37:57 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=4879CB864E290BED38C5BDB641144B1B – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20795_none_0fe467c9579e7a28\iexplore.exe
[2013-08-10 00:13:42 | 000,770,648 | —- | M] (Microsoft Corporation) MD5=48A1306191216997F717C451B8D15139 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20794_none_0a08177a6c4bbd6d\iexplore.exe
[2012-10-08 07:29:46 | 000,754,848 | —- | M] (Microsoft Corporation) MD5=49442BA6DCE4B4E3C1CB0AB193FE29AD – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16455_none_0d382bff807e43ae\iexplore.exe
[2010-09-08 00:49:01 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=498035ABCCF1ED47AE6791D239187587 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16671_none_0f6c69ae3e743d20\iexplore.exe
[2012-05-17 21:51:05 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=4E99F42504A99D5024C2EFA015001937 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16446_none_0d43fc3580754114\iexplore.exe
[2010-11-04 00:54:54 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=58CF468D3FF4CF830339FE5E45356355 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16700_none_1a0bc510729d1f54\iexplore.exe
[2012-08-24 05:49:07 | 000,754,824 | —- | M] (Microsoft Corporation) MD5=5A150AFABB25BEA50CEDC8650A7B8A9E – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20557_none_0dc3c95e999a1626\iexplore.exe
[2012-06-28 21:45:31 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=5D03518409F37D1483C98869D86E23FF – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20554_none_0dc0c880999cca21\iexplore.exe
[2012-06-02 07:52:21 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=610F6596921C4BAA8834ADBB9BE272EE – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16447_none_0d44fc7f80745a6b\iexplore.exe
[2010-09-07 23:31:24 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=61EDBCE47ADF3E52AB0B9F49EE4AEBB8 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16671_none_19c1140072d4ff1b\iexplore.exe
[2012-08-24 02:49:25 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=62188720CE27B982B4285C03163C9FB3 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20557_none_181873b0cdfad821\iexplore.exe
[2013-02-21 07:59:57 | 000,775,216 | —- | M] (Microsoft Corporation) MD5=6554208814632C25C77EE02355EB8E95 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16540_none_16920d4a1e377ea4\iexplore.exe
[2013-03-14 09:45:44 | 000,775,184 | —- | M] (Microsoft Corporation) MD5=681B380492ACB571ED6CCC1F37F53343 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16521_none_168ff5ee1e396597\iexplore.exe
[2013-01-08 17:42:06 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=698EB1E5F8C66344D97C00B5699E871D – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16464_none_1781061bb4e80843\iexplore.exe
[2010-11-04 00:54:59 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=6B2258FF6D2332073FE9E90122FA4168 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20831_none_1a75f2618bd22c48\iexplore.exe
[2010-12-18 01:17:48 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=700B40EA39DFB25517A81032F03D6D20 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16722_none_0fa37b7a3e4ac7e9\iexplore.exe
[2013-07-25 22:49:06 | 000,770,648 | —- | M] (Microsoft Corporation) MD5=7BA1862B8A5698DC5FCFDFF3BC359DE9 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16660_none_20dde844529e8f3e\iexplore.exe
[2013-02-02 03:09:12 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=7C2923004FFC497E54F38E835F108EE8 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20580_none_0d9c579499b8b898\iexplore.exe
[2010-11-20 08:28:25 | 000,695,056 | —- | M] (Microsoft Corporation) MD5=86257731DDB311FBC283534CC0091634 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1196a9003b674a92\iexplore.exe
[2010-12-18 01:11:10 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=8C6C32E4AF8A3D7155656F5897C504E0 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20861_none_1000d84b5789be20\iexplore.exe
[2013-07-26 00:47:06 | 000,775,256 | —- | M] (Microsoft Corporation) MD5=8D805B4EEEE0ECF6B604BE284978F135 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20768_none_ffb0112a37ee15f1\iexplore.exe
[2013-05-16 22:02:08 | 000,775,256 | —- | M] (Microsoft Corporation) MD5=8F00471CA24ADF8D2AFAACF856EB70A4 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20719_none_ffaaf8f037f2b0df\iexplore.exe
[2011-05-12 09:38:50 | 000,748,336 | —- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16421_none_17a944edb4ca4c7a\iexplore.exe
[2010-12-18 00:32:25 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=9321CF0D023528C71E3645F8433C86C8 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20861_none_1a55829d8bea801b\iexplore.exe
[2012-06-28 20:00:47 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=93569D46D79F9756ED077156496AFE23 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16448_none_179aa71bb4d435bd\iexplore.exe
[2013-06-11 21:28:00 | 000,775,256 | —- | M] (Microsoft Corporation) MD5=98C6F2A9A981A54222602B87C6310BDE – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16635_none_1685cb2c1e410163\iexplore.exe
[2013-10-12 02:16:06 | 000,770,736 | —- | M] (Microsoft Corporation) MD5=9DFE1678738DD968D7BA5559B52706D1 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20848_none_09f7eafc6c58c12f\iexplore.exe
[2013-02-24 18:52:40 | 000,770,624 | —- | M] (Microsoft Corporation) MD5=A11C5E3E288256C540B7ED8BE3A04B01 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20644_none_0a0de5f46c4822c9\iexplore.exe
[2013-02-01 23:19:03 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=A285E1965C115031DA02B777EE9D7689 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20580_none_17f101e6ce197a93\iexplore.exe
[2013-02-02 02:37:58 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=A8EBEBCD9F5C49475194099FCD276992 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16470_none_0d1d8ab58092fcdd\iexplore.exe
[2010-12-18 00:33:54 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=AA08B68EF4E35EFA170CF85A44B23B70 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16722_none_19f825cc72ab89e4\iexplore.exe
[2013-04-05 01:02:26 | 000,770,608 | —- | M] (Microsoft Corporation) MD5=AAD90795E84E710543C6C7C2F7048E30 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16576_none_20e92fca5296266a\iexplore.exe
[2011-02-24 00:45:11 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=AB2BB40A5FE49AD236791AC22BD08869 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20908_none_1a9d66118bb386fd\iexplore.exe
[2012-11-15 22:08:58 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=AC4957E154F750DF54F36ADC8E3E040D – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20565_none_0db6f8de99a3ff69\iexplore.exe
[2011-02-24 01:29:19 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=B4881B8F6EDB48CABD44BCC9FB5475C4 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20908_none_1048bbbf5752c502\iexplore.exe
[2012-06-02 03:51:58 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=BE967C74B89577B78FB57C061E12B04C – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20553_none_18147288cdfe72c5\iexplore.exe
[2010-11-20 07:22:51 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=C613E69C3B191BB02C7A191741A1D024 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1beb53526fc80c8d\iexplore.exe
[2011-02-24 00:32:52 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=C6697A46554E36541E81182B258A19D6 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16766_none_19d0e74472c85f04\iexplore.exe
[2013-11-19 10:05:34 | 000,806,096 | —- | M] (Microsoft Corporation) MD5=C8A8321292A459B0A17FB39A782A5C74 – C:\Program Files (x86)\Internet Explorer\iexplore.exe
[2013-11-19 10:05:34 | 000,806,096 | —- | M] (Microsoft Corporation) MD5=C8A8321292A459B0A17FB39A782A5C74 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.2.9600.16428_none_856219b9f734bb75\iexplore.exe
[2013-06-12 02:51:43 | 000,775,256 | —- | M] (Microsoft Corporation) MD5=CA88A25280B1D85ED0BC26B042ABBCCF – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20742_none_ffae994637ef497d\iexplore.exe
[2013-04-05 02:53:33 | 000,775,232 | —- | M] (Microsoft Corporation) MD5=CEA304830B4770BDA3572B87D0841848 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16576_none_169485781e35646f\iexplore.exe
[2012-10-08 03:22:05 | 000,748,704 | —- | M] (Microsoft Corporation) MD5=CECB15F834FC2B4B150449717ADE18DD – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20562_none_1808a252ce07755f\iexplore.exe
[2013-09-22 18:54:30 | 000,770,648 | —- | M] (Microsoft Corporation) MD5=D6B7DDB68436F13C3CAE2B92524F1FEC – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16721_none_20cf006852aa5f74\iexplore.exe
[2013-10-12 02:44:13 | 000,770,736 | —- | M] (Microsoft Corporation) MD5=D7D5768B8A697FCBAEE2CFE137070F02 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16736_none_20cf8eca52a9f8f0\iexplore.exe
[2010-11-04 01:37:41 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=D8E00EA671A1EFE95C69C7566C505AD4 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16700_none_0fb71abe3e3c5d59\iexplore.exe
[2013-09-22 19:01:39 | 000,770,648 | —- | M] (Microsoft Corporation) MD5=DB352EBF77E8655E0C46B6923F3C9950 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20831_none_09f78a2a6c58f471\iexplore.exe
[2013-02-01 23:19:04 | 000,757,296 | —- | M] (Microsoft Corporation) MD5=DDE5A0DFAF7C6370FB36402D7A746ED3 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16470_none_17723507b4f3bed8\iexplore.exe
[2013-04-05 02:23:03 | 000,775,216 | —- | M] (Microsoft Corporation) MD5=DE751E18F8DBF7BCCE46989CBA4A9828 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20681_none_ffbd812237e37947\iexplore.exe
[2011-02-24 01:32:09 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=E1BBDE0F187194D4B08335234A4B9FC7 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16766_none_0f7c3cf23e679d09\iexplore.exe
[2010-11-04 01:42:22 | 000,696,592 | —- | M] (Microsoft Corporation) MD5=E220FB009F54AAF649C6A278A5156764 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20831_none_1021480f57716a4d\iexplore.exe
[2013-02-21 06:28:11 | 000,770,608 | —- | M] (Microsoft Corporation) MD5=E4F6125ED5185F8FA37CC4F449B85526 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16540_none_20e6b79c5298409f\iexplore.exe
[2013-07-26 00:09:39 | 000,770,648 | —- | M] (Microsoft Corporation) MD5=E70D60B3A350BD09D86CDAD9CF55F36B – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20768_none_0a04bb7c6c4ed7ec\iexplore.exe
[2013-09-22 20:55:58 | 000,775,256 | —- | M] (Microsoft Corporation) MD5=E9F843E7E412AE9A507FD5ABBBD06462 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20831_none_ffa2dfd837f83276\iexplore.exe
[2012-06-28 18:35:27 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=EB4105348272018D096FEB655CD1608C – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20554_none_181572d2cdfd8c1c\iexplore.exe
[2013-05-16 22:30:45 | 000,775,256 | —- | M] (Microsoft Corporation) MD5=EDC77CF787FA015205936C9A3228486E – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16614_none_1683e1601e42b514\iexplore.exe
[2013-01-08 19:51:57 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=EF1F6F41FB2C9BBB484B21017F380201 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20573_none_0daa285e99ade8ac\iexplore.exe
[2013-01-08 16:32:42 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=F05982E56ABD835AA8DF260EEC873E5B – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20573_none_17fed2b0ce0eaaa7\iexplore.exe
[2011-05-12 09:38:49 | 000,754,480 | —- | M] (Microsoft Corporation) MD5=F1424C1B9B1813BF825E45DF3790BC8A – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16421_none_0d549a9b80698a7f\iexplore.exe
[2009-07-13 20:43:43 | 000,696,600 | —- | M] (Microsoft Corporation) MD5=F2B0D41E1D08D0B2006DF5AA2E74C81E – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_0f6595383e78c6f8\iexplore.exe
[2012-10-08 06:09:10 | 000,754,824 | —- | M] (Microsoft Corporation) MD5=F61714ABCF9BF0CEF0A6249AD4FD490B – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20562_none_0db3f80099a6b364\iexplore.exe
[2012-11-13 21:19:28 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=F691418EE9A6344AEB5C1B0518FBF8AE – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20565_none_180ba330ce04c164\iexplore.exe
[2013-09-22 20:25:59 | 000,775,256 | —- | M] (Microsoft Corporation) MD5=F6A7D9C0BC326F695526069C1DA1E8B7 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16721_none_167a56161e499d79\iexplore.exe
[2012-05-17 20:37:57 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=F8B2D47ED17C1D087D14EC747E5AC57A – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20551_none_0dbdc7a2999f7e1c\iexplore.exe
[2012-11-14 02:11:18 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=FD0D2E1FAEBAE5031BE2EB8000D973F1 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16457_none_0d3a2c93807c765c\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2013-11-19 10:05:35 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=0B33787AB6EE3BB5FDB0C7C52E4E06A6 – C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui
[2013-11-19 10:05:10 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=0B33787AB6EE3BB5FDB0C7C52E4E06A6 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2013-11-19 10:05:10 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=0B33787AB6EE3BB5FDB0C7C52E4E06A6 – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_11.2.9600.16428_en-us_74ba04defa813a61\iexplore.exe.mui
[2013-11-19 10:05:35 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=0B33787AB6EE3BB5FDB0C7C52E4E06A6 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_11.2.9600.16428_en-us_7f0eaf312ee1fc5c\iexplore.exe.mui
[2011-05-12 09:38:49 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=17FAE936C452188D05852DE8D1082013 – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_en-us_07013012b816cb66\iexplore.exe.mui
[2011-05-12 09:38:51 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_en-us_1155da64ec778d61\iexplore.exe.mui
[2013-03-14 09:45:44 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=8EDDC50FD07326E7DF9C4EEA422F0918 – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_10.2.9200.16521_en-us_103c8b6555e6a67e\iexplore.exe.mui
[2013-03-14 09:46:02 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=8EDDC50FD07326E7DF9C4EEA422F0918 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_10.2.9200.16521_en-us_1a9135b78a476879\iexplore.exe.mui
[2009-07-13 21:29:20 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=C29BCFB504E33FEADDFA2D0183CEF62F – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7600.16385_en-us_09122aaf762607df\iexplore.exe.mui
[2009-07-13 21:29:20 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=C29BCFB504E33FEADDFA2D0183CEF62F – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_0b433e7773148b79\iexplore.exe.mui
[2009-07-13 21:05:06 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7600.16385_en-us_1366d501aa86c9da\iexplore.exe.mui
[2009-07-13 21:05:06 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_1597e8c9a7754d74\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-058FE8F5.PF >
[2013-11-26 18:43:51 | 000,103,430 | —- | M] () MD5=C1BFDF69F8B3409E02DC26E9597E4B3D – C:\Windows\Prefetch\IEXPLORE.EXE-058FE8F5.pf

< MD5 for: IEXPLORE.EXE-A033F7A0.PF >
[2013-11-25 11:58:34 | 000,364,054 | —- | M] () MD5=5661A25BF3AC2AFB9876FEEB89105386 – C:\Windows\Prefetch\IEXPLORE.EXE-A033F7A0.pf

< MD5 for: SERVICES >
[2009-06-10 16:00:26 | 000,017,463 | —- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 – C:\Windows\winsxs\amd64_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_6079f415110c0210\services

< MD5 for: SERVICES.CFG >
[2012-09-23 19:43:36 | 000,603,848 | R— | M] () MD5=81B120EAEE296F0E54F66C16C5A21367 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744BA0000000010\11.0.0\services.cfg
[2013-09-05 09:04:00 | 000,559,090 | —- | M] () MD5=8ADD48E413D05BF2E7AEC00173DDFABC – C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Services\Services.cfg

< MD5 for: SERVICES.EXE >
[2009-07-13 20:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\SysNative\services.exe
[2009-07-13 20:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2009-07-13 21:25:40 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=6507BF0DC2D1F5F32493C288EAA59277 – C:\Windows\SysNative\en-US\services.exe.mui
[2009-07-13 21:25:40 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=6507BF0DC2D1F5F32493C288EAA59277 – C:\Windows\winsxs\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c5f238be3fa63468\services.exe.mui

< MD5 for: SERVICES.LNK >
[2009-07-13 23:54:05 | 000,001,288 | —- | M] () MD5=CA0D9F4743DFF86EBAF09D763139E958 – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009-07-13 23:54:05 | 000,001,288 | —- | M] () MD5=CA0D9F4743DFF86EBAF09D763139E958 – C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk

< MD5 for: SERVICES.MOF >
[2009-06-10 15:44:06 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\SysNative\wbem\services.mof
[2009-06-10 15:44:06 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.mof

< MD5 for: SERVICES.MSC >
[2009-07-13 21:23:30 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysNative\en-US\services.msc
[2009-06-10 15:38:36 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysNative\services.msc
[2009-07-13 21:08:50 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysWOW64\en-US\services.msc
[2009-06-10 16:21:09 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysWOW64\services.msc
[2009-07-13 21:23:30 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\amd64_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_003408aa160fce5b\services.msc
[2009-06-10 15:38:36 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_2b58d44b5f6beb8a\services.msc
[2009-07-13 21:08:50 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a4156d265db25d25\services.msc
[2009-06-10 16:21:09 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_cf3a38c7a70e7a54\services.msc

< MD5 for: SERVICES.PTXML >
[2009-07-13 15:16:17 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\SysNative\wdi\perftrack\Services.ptxml
[2009-07-13 15:16:17 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\Services.ptxml

< MD5 for: SERVICES.SBS >
[2011-03-01 00:00:00 | 000,034,818 | —- | M] () MD5=62AFD4B2025CE6D4706B36F4C4808F9B – C:\Program Files (x86)\Spybot - Search & Destroy 2\Includes\Services.sbs
[2011-03-01 02:58:46 | 000,034,818 | —- | M] () MD5=62AFD4B2025CE6D4706B36F4C4808F9B – C:\Program Files (x86)\Spybot - Search & Destroy 2\Updates\Extracts\Services.sbs

< MD5 for: SERVICES.SBS-20110301.CAB >
[2013-11-11 11:37:28 | 000,041,248 | —- | M] () MD5=149FF3413EED31253183D6E65E383138 – C:\Program Files (x86)\Spybot - Search & Destroy 2\Updates\Downloads\Services.sbs-20110301.cab

< MD5 for: WINLOGON.ADML >
[2009-07-13 21:25:22 | 000,008,013 | —- | M] () MD5=CED0EAD8D152B3D0F114698DE2316C5E – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f0f9032ef6930070\WinLogon.adml

< MD5 for: WINLOGON.ADMX >
[2009-06-10 16:04:41 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm_31bf3856ad364e35_6.1.7600.16385_none_d7024e6992f3424d\WinLogon.admx

< MD5 for: WINLOGON.EXE >
[2010-11-20 08:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SysNative\winlogon.exe
[2010-11-20 08:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009-07-13 20:39:52 | 000,389,120 | —- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009-10-28 02:01:57 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009-10-28 01:24:40 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2010-11-20 08:00:25 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=34C7D2E30868EDAFB191341D963ABA5F – C:\Windows\SysNative\en-US\winlogon.exe.mui
[2010-11-20 08:00:25 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=34C7D2E30868EDAFB191341D963ABA5F – C:\Windows\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7601.17514_en-us_291e96fa1ab5fc7b\winlogon.exe.mui
[2009-07-13 21:29:52 | 000,022,528 | —- | M] (Microsoft Corporation) MD5=56D03B64B8C483C1D12A8E4577B3B332 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7600.16385_en-us_26ed83321dc778e1\winlogon.exe.mui

< MD5 for: WINLOGON.MFL >
[2009-07-13 21:27:22 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\SysNative\wbem\en-US\winlogon.mfl
[2009-07-13 21:27:22 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.1.7600.16385_en-us_84afd4fd38ffd276\winlogon.mfl

< MD5 for: WINLOGON.MOF >
[2009-07-13 15:30:01 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\SysNative\wbem\winlogon.mof
[2009-07-13 15:30:01 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.1.7600.16385_none_dc2dbb778f98e40f\winlogon.mof

< %SYSTEMDRIVE%\*.* >
[2010-06-07 07:05:58 | 000,014,092 | —- | M] () – C:\amnsignature.JPG
[2013-11-16 06:11:12 | 000,000,000 | —- | M] () – C:\autoexec.bat
[2009-10-29 03:21:27 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2013-11-26 19:03:58 | 3144,871,936 | -HS- | M] () – C:\hiberfil.sys
[2013-11-26 19:03:57 | 4193,165,312 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2009-07-14 00:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009-07-14 00:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009-07-14 00:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009-07-14 00:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009-06-10 15:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2012-09-12 14:57:44 | 000,322,048 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009-07-13 23:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini
[2011-08-07 09:21:01 | 000,000,676 | —- | M] () – C:\Program Files (x86)\RejoinCommandLine.txt

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< dir "%systemdrive%\*" /S /A:L /C >
Volume in drive C is Acer
Volume Serial Number is BA50-8A59
Directory of C:\
14-Jul-09 12:08 AM Documents and Settings [C:\Users]
0 File(s) 0 bytes
Directory of C:\ProgramData
14-Jul-09 12:08 AM Application Data [C:\ProgramData]
14-Jul-09 12:08 AM Desktop [C:\Users\Public\Desktop]
14-Jul-09 12:08 AM Documents [C:\Users\Public\Documents]
14-Jul-09 12:08 AM Favorites [C:\Users\Public\Favorites]
14-Jul-09 12:08 AM Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
14-Jul-09 12:08 AM Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users
14-Jul-09 12:08 AM All Users [C:\ProgramData]
14-Jul-09 12:08 AM Default User [C:\Users\Default]
0 File(s) 0 bytes
Directory of C:\Users\All Users
14-Jul-09 12:08 AM Application Data [C:\ProgramData]
14-Jul-09 12:08 AM Desktop [C:\Users\Public\Desktop]
14-Jul-09 12:08 AM Documents [C:\Users\Public\Documents]
14-Jul-09 12:08 AM Favorites [C:\Users\Public\Favorites]
14-Jul-09 12:08 AM Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
14-Jul-09 12:08 AM Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\A M
11-Jan-10 12:32 AM Application Data [C:\Users\A M\AppData\Roaming]
11-Jan-10 12:32 AM Cookies [C:\Users\A M\AppData\Roaming\Microsoft\Windows\Cookies]
11-Jan-10 12:32 AM Local Settings [C:\Users\A M\AppData\Local]
11-Jan-10 12:32 AM My Documents [C:\Users\A M\Documents]
11-Jan-10 12:32 AM NetHood [C:\Users\A M\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
11-Jan-10 12:32 AM PrintHood [C:\Users\A M\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
11-Jan-10 12:32 AM Recent [C:\Users\A M\AppData\Roaming\Microsoft\Windows\Recent]
11-Jan-10 12:32 AM SendTo [C:\Users\A M\AppData\Roaming\Microsoft\Windows\SendTo]
11-Jan-10 12:32 AM Start Menu [C:\Users\A M\AppData\Roaming\Microsoft\Windows\Start Menu]
11-Jan-10 12:32 AM Templates [C:\Users\A M\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\A M\AppData\Local
11-Jan-10 12:32 AM Application Data [C:\Users\A M\AppData\Local]
11-Jan-10 12:32 AM History [C:\Users\A M\AppData\Local\Microsoft\Windows\History]
11-Jan-10 12:32 AM Temporary Internet Files [C:\Users\A M\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\A M\AppData\LocalLow
02-Jun-12 11:13 PM PlayReady [C:\ProgramData\Microsoft\PlayReady]
0 File(s) 0 bytes
Directory of C:\Users\A M\Documents
11-Jan-10 12:32 AM My Music [C:\Users\A M\Music]
11-Jan-10 12:32 AM My Pictures [C:\Users\A M\Pictures]
11-Jan-10 12:32 AM My Videos [C:\Users\A M\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Default
14-Jul-09 12:08 AM Application Data [C:\Users\Default\AppData\Roaming]
14-Jul-09 12:08 AM Cookies [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies]
14-Jul-09 12:08 AM Local Settings [C:\Users\Default\AppData\Local]
14-Jul-09 12:08 AM My Documents [C:\Users\Default\Documents]
14-Jul-09 12:08 AM NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
14-Jul-09 12:08 AM PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
14-Jul-09 12:08 AM Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]
14-Jul-09 12:08 AM SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]
14-Jul-09 12:08 AM Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]
14-Jul-09 12:08 AM Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Default\AppData\Local
14-Jul-09 12:08 AM Application Data [C:\Users\Default\AppData\Local]
14-Jul-09 12:08 AM History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]
14-Jul-09 12:08 AM Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Default\Documents
14-Jul-09 12:08 AM My Music [C:\Users\Default\Music]
14-Jul-09 12:08 AM My Pictures [C:\Users\Default\Pictures]
14-Jul-09 12:08 AM My Videos [C:\Users\Default\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Guest
26-Jul-10 09:06 AM Application Data [C:\Users\Guest\AppData\Roaming]
26-Jul-10 09:06 AM Cookies [C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies]
26-Jul-10 09:06 AM Local Settings [C:\Users\Guest\AppData\Local]
26-Jul-10 09:06 AM My Documents [C:\Users\Guest\Documents]
26-Jul-10 09:06 AM NetHood [C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
26-Jul-10 09:06 AM PrintHood [C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
26-Jul-10 09:06 AM Recent [C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Recent]
26-Jul-10 09:06 AM SendTo [C:\Users\Guest\AppData\Roaming\Microsoft\Windows\SendTo]
26-Jul-10 09:06 AM Start Menu [C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu]
26-Jul-10 09:06 AM Templates [C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Guest\AppData\Local
26-Jul-10 09:06 AM Application Data [C:\Users\Guest\AppData\Local]
26-Jul-10 09:06 AM History [C:\Users\Guest\AppData\Local\Microsoft\Windows\History]
26-Jul-10 09:06 AM Temporary Internet Files [C:\Users\Guest\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Guest\Documents
26-Jul-10 09:06 AM My Music [C:\Users\Guest\Music]
26-Jul-10 09:06 AM My Pictures [C:\Users\Guest\Pictures]
26-Jul-10 09:06 AM My Videos [C:\Users\Guest\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Public\Documents
14-Jul-09 12:08 AM My Music [C:\Users\Public\Music]
14-Jul-09 12:08 AM My Pictures [C:\Users\Public\Pictures]
14-Jul-09 12:08 AM My Videos [C:\Users\Public\Videos]
0 File(s) 0 bytes
Total Files Listed:
0 File(s) 0 bytes
67 Dir(s) 79,951,831,040 bytes free

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011-12-21 10:55:05 | 000,000,221 | -HS- | M] () – C:\Users\A M\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2013-11-26 18:54:07 | 004,745,728 | —- | M] (AVAST Software) – C:\Users\A M\Desktop\aswMBR.exe
[2001-03-04 16:01:06 | 000,013,824 | —- | M] (http://keir.net) – C:\Users\A M\Desktop\IP2.exe
[2013-11-26 20:03:13 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\A M\Desktop\OTL.exe
[2013-11-26 18:44:53 | 000,891,200 | —- | M] () – C:\Users\A M\Desktop\SecurityCheck.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >
[2011-12-19 02:04:46 | 000,000,698 | —- | M] () – C:\Windows\AppPatch\Custom\{a9264802-8a7a-40fe-a135-5c6d204aed7a}.sdb

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Base Services ==========
SRV:64bit: - [2009-07-13 20:40:01 | 000,072,192 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\aelupsvc.dll – (AeLookupSvc)
SRV:64bit: - [2013-02-27 00:47:10 | 000,070,144 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\appinfo.dll – (Appinfo)
SRV:64bit: - [2009-07-13 20:38:55 | 000,079,360 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\alg.exe – (ALG)
SRV:64bit: - [2010-11-20 08:27:23 | 000,849,920 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\qmgr.dll – (BITS)
SRV:64bit: - [2010-11-20 08:25:45 | 000,705,024 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\BFE.DLL – (BFE)
SRV:64bit: - [2013-09-24 20:03:24 | 000,030,720 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\lsass.exe – (KeyIso)
SRV:64bit: - [2009-07-13 20:40:50 | 000,402,944 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\es.dll – (EventSystem)
SRV - [2009-07-13 20:15:19 | 000,271,360 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysWOW64\es.dll – (EventSystem)
SRV:64bit: - [2012-07-04 17:13:27 | 000,136,704 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\browser.dll – (Browser)
SRV:64bit: - [2013-07-09 00:46:20 | 000,184,320 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\cryptsvc.dll – (CryptSvc)
SRV - [2013-07-08 23:46:31 | 000,140,288 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysWOW64\cryptsvc.dll – (CryptSvc)
SRV:64bit: - [2010-11-20 08:27:24 | 000,512,000 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\rpcss.dll – (DcomLaunch)
SRV:64bit: - [2010-11-20 08:26:04 | 000,317,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\dhcpcore.dll – (Dhcp)
SRV - [2010-11-20 07:18:30 | 000,254,464 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysWOW64\dhcpcore.dll – (Dhcp)
SRV:64bit: - [2011-03-03 01:24:16 | 000,183,296 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\dnsrslvr.dll – (Dnscache)
SRV:64bit: - [2009-07-13 20:40:35 | 000,111,104 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\eapsvc.dll – (EapHost)
SRV:64bit: - [2009-07-13 20:41:00 | 000,038,912 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\hidserv.dll – (hidserv)
SRV - [2009-07-13 20:15:24 | 000,049,152 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysWOW64\hidserv.dll – (hidserv)
SRV:64bit: - [2009-07-13 20:41:10 | 000,359,424 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\ipnathlp.dll – (SharedAccess)
SRV:64bit: - [2010-11-20 08:26:39 | 000,501,248 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\IPSECSVC.DLL – (PolicyAgent)
No service found with a name of MsMpSvc
No service found with a name of NisSrv
SRV:64bit: - [2009-07-13 20:41:54 | 000,524,288 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\swprv.dll – (swprv)
SRV:64bit: - [2009-07-13 20:41:26 | 000,067,584 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\SysNative\mmcss.dll – (MMCSS)
SRV:64bit: - [2009-07-13 20:41:52 | 000,360,448 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\netman.dll – (Netman)
SRV:64bit: - [2009-07-13 20:41:52 | 000,459,776 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\netprofm.dll – (netprofm)
SRV - [2009-07-13 20:16:03 | 000,360,448 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysWOW64\netprofm.dll – (netprofm)
SRV:64bit: - [2012-10-03 12:44:21 | 000,303,104 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\nlasvc.dll – (NlaSvc)
SRV:64bit: - [2009-07-13 20:41:53 | 000,025,600 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\nsisvc.dll – (nsi)
SRV:64bit: - [2011-05-24 06:42:55 | 000,404,480 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\umpnpmgr.dll – (PlugPlay)
SRV:64bit: - [2012-02-11 01:36:02 | 000,559,104 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\spoolsv.exe – (Spooler)
SRV:64bit: - [2013-09-24 20:03:24 | 000,030,720 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\lsass.exe – (ProtectedStorage)
No service found with a name of EMDMgmt
SRV:64bit: - [2009-07-13 20:41:53 | 000,099,328 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\rasauto.dll – (RasAuto)
SRV:64bit: - [2010-11-20 08:27:24 | 000,344,064 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\rasmans.dll – (RasMan)
SRV:64bit: - [2010-11-20 08:27:24 | 000,512,000 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\rpcss.dll – (RpcSs)
SRV:64bit: - [2010-11-20 08:27:25 | 000,030,720 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\seclogon.dll – (seclogon)
SRV:64bit: - [2013-09-24 20:03:24 | 000,030,720 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\lsass.exe – (SamSs)
SRV:64bit: - [2009-07-13 20:41:58 | 000,097,280 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wscsvc.dll – (wscsvc)
SRV:64bit: - [2010-11-20 08:27:26 | 000,236,032 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\srvsvc.dll – (LanmanServer)
SRV:64bit: - [2010-11-20 08:27:25 | 000,370,688 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\shsvcs.dll – (ShellHWDetection)
SRV - [2010-11-20 07:21:19 | 000,328,192 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysWOW64\shsvcs.dll – (ShellHWDetection)
No service found with a name of slsvc
SRV:64bit: - [2010-11-20 08:27:25 | 001,110,016 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\schedsvc.dll – (Schedule)
SRV:64bit: - [2010-11-20 08:27:26 | 000,316,928 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\tapisrv.dll – (TapiSrv)
SRV - [2010-11-20 07:21:28 | 000,242,176 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysWOW64\tapisrv.dll – (TapiSrv)
SRV:64bit: - [2009-07-13 20:41:55 | 000,044,544 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\themeservice.dll – (Themes)
SRV:64bit: - [2012-05-01 00:40:20 | 000,209,920 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\profsvc.dll – (ProfSvc)
SRV:64bit: - [2010-11-20 08:25:27 | 001,600,512 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\VSSVC.exe – (VSS)
SRV:64bit: - [2010-11-20 08:25:42 | 000,679,424 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\audiosrv.dll – (AudioSrv)
SRV:64bit: - [2010-11-20 08:25:42 | 000,679,424 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\audiosrv.dll – (AudioEndpointBuilder)
SRV:64bit: - [2010-11-20 08:27:25 | 000,170,496 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\sdrsvc.dll – (SDRSVC)
SRV:64bit: - [2013-05-27 00:50:47 | 001,011,712 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV:64bit: - [2010-11-20 08:27:28 | 001,646,080 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wevtsvc.dll – (eventlog)
SRV:64bit: - [2010-11-20 08:26:59 | 000,828,416 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\MPSSVC.dll – (MpsSvc)
SRV:64bit: - [2010-11-20 08:27:28 | 000,580,096 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wiaservc.dll – (stisvc)
SRV:64bit: - [2010-11-20 08:24:58 | 000,128,000 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\SysNative\msiexec.exe – (msiserver)
SRV - [2010-11-20 07:17:22 | 000,073,216 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\SysWow64\msiexec.exe – (msiserver)
SRV:64bit: - [2012-08-21 08:09:40 | 000,219,136 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wbem\WMIsvc.dll – (Winmgmt)
SRV:64bit: - [2012-06-02 17:19:43 | 002,428,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wuaueng.dll – (wuauserv)
SRV:64bit: - [2010-11-20 08:26:07 | 000,252,416 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\dot3svc.dll – (dot3svc)
SRV:64bit: - [2009-07-13 20:41:56 | 000,886,784 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wlansvc.dll – (Wlansvc)
SRV:64bit: - [2010-11-20 08:27:28 | 000,118,784 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wkssvc.dll – (LanmanWorkstation)

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: WDC WD3200BEKT-00KA9T0
Partitions: 3
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 12.00GB
Starting Offset: 1048576
Hidden sectors: 0

DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 100.00MB
Starting Offset: 12885950464
Hidden sectors: 0

DeviceID: Disk #0, Partition #2
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 286.00GB
Starting Offset: 12990808064
Hidden sectors: 0

< End of report >

Dede

Post #6November 27, 2013, 2:18 AM UTC last edited November 27, 2013, 2:23 AM UTC

OTL Extras logfile created on: 26-Nov-13 8:05:30 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\A M\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16428)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: dd-MMM-yy

3.91 Gb Total Physical Memory | 1.91 Gb Available Physical Memory | 49.02% Memory free
7.81 Gb Paging File | 5.72 Gb Available in Paging File | 73.26% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 285.99 Gb Total Space | 74.55 Gb Free Space | 26.07% Space Free | Partition Type: NTFS

Computer Name: AM | User Name: A M | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = Opera.HTML] – C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] – C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.js [@ = Reg Error: Value error.] – Reg Error: Key error. File not found
.txt [@ = Reg Error: Value error.] – Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.txt [@ = txt_auto_file] – C:\Program Files (x86)\Notepad++\notepad++.exe (Don HO [removed])

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] – "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] – "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsfile – "C:\Program Files (x86)\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1" (Macromedia, Inc.)
jsfile [open] – Reg Error: Value error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] – "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] – "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsfile – "C:\Program Files (x86)\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1" (Macromedia, Inc.)
jsfile [open] – Reg Error: Value error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – Reg Error: Value error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service – (Safer-Networking Ltd.)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02F7BF69-B985-4722-A0D6-8818089DDE10}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{05D86FC1-51D2-4578-A7F6-B0CAEB970658}" = lport=4482 | protocol=6 | dir=in | name=blackberry desktop software wireless music sync data transfer |
"{160F7C40-9B2A-4C27-83E2-9C3FAB1550A7}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1EFA05AD-F3AB-495E-A5A7-CBBE77347D10}" = rport=10243 | protocol=6 | dir=out | app=system |
"{2C2AE808-A3BC-4629-8326-987A2D3988A6}" = lport=2799 | protocol=17 | dir=in | name=altova license metering port (udp) |
"{32C9ADEA-8FFF-4378-B3FD-588402E9B592}" = lport=2799 | protocol=6 | dir=in | name=altova license metering port (tcp) |
"{383EE224-FC06-4D3A-A3EB-CB9801D650F4}" = lport=137 | protocol=17 | dir=in | app=system |
"{3A0C166E-099F-42E0-8CAA-56099A7F2458}" = rport=445 | protocol=6 | dir=out | app=system |
"{4188C557-E0CE-4086-B18D-6A5B67FE37F6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{533053B9-364F-46BA-9AA3-6CAA187B5900}" = lport=139 | protocol=6 | dir=in | app=system |
"{581209C9-44C8-48A8-9A32-2637C71909F7}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{58F8B105-1FEF-4CE2-8C90-DEEF31A63AC1}" = lport=138 | protocol=17 | dir=in | app=system |
"{5B80AABF-F379-4868-9219-CBA154D68DA7}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5C60BBEE-83BE-401C-AD0D-30D70A0FB2F7}" = lport=2869 | protocol=6 | dir=in | app=system |
"{5F5D5956-1846-4EF0-925D-D0587015AA0B}" = lport=2869 | protocol=6 | dir=in | app=system |
"{6BB4E27F-1DE2-4F98-9DF8-0077E53D9A93}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{6DF7A59A-321E-479C-B8FB-6C0CEDD354B0}" = lport=4481 | protocol=17 | dir=in | name=blackberry desktop software wireless music sync discovery |
"{73FB9790-39D2-4B8E-BBFA-FD743F17EC48}" = lport=4481 | protocol=6 | dir=in | name=blackberry desktop software wireless music sync data transfer |
"{7B7CC015-D254-46A3-9857-BB667D118FE3}" = lport=10243 | protocol=6 | dir=in | app=system |
"{875781E5-8C27-48EE-9523-5A135F087EAD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{88BA249F-FC96-4B13-9094-13AEF69D0BBA}" = lport=4481 | protocol=6 | dir=in | name=blackberry desktop software wireless music sync data transfer |
"{8D74892A-436D-43A1-8792-C1DEFCC6C907}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{927B69EF-27FF-4741-95FC-09BF6DE7405F}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe |
"{958AA8C6-C943-498D-8236-7A0344514F06}" = lport=2799 | protocol=6 | dir=in | name=altova license metering port (tcp) |
"{9E18F82C-87EF-432B-AA75-3241182C7F5D}" = lport=2799 | protocol=17 | dir=in | name=altova license metering port (udp) |
"{9F6F6AE4-54C3-465A-BC3E-1ED88DA44C09}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A4F674A2-97F1-40EF-9618-1EE8AC593CC3}" = lport=4482 | protocol=17 | dir=in | name=blackberry desktop software wireless music sync discovery |
"{B8568B5B-02A7-4A93-A314-C67001B2B3B0}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{B961C232-E7B1-46D3-82B7-5CFDD85C0E75}" = rport=138 | protocol=17 | dir=out | app=system |
"{BA904C61-B8DA-4894-BCAD-1E0B88D199CA}" = lport=4481 | protocol=17 | dir=in | name=blackberry desktop software wireless music sync discovery |
"{C5B297C8-226F-4E3B-A0DA-C07F6486E449}" = lport=445 | protocol=6 | dir=in | app=system |
"{CC06B8B4-6406-406C-88C4-CC77B0883E30}" = rport=137 | protocol=17 | dir=out | app=system |
"{D6D65B1D-7646-4786-9EA3-6EC3240798D6}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DC7941FF-C1BB-4584-BC71-A4ABCF0C35E5}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E24B08D4-F13C-43D5-A9A6-4271BEA0E91B}" = lport=4482 | protocol=6 | dir=in | name=blackberry desktop software wireless music sync data transfer |
"{E98CDD1C-3745-4B11-9DED-0EDB000F4A92}" = rport=139 | protocol=6 | dir=out | app=system |
"{EA5AA4B2-04C5-463B-8B74-CE06CA9A7C86}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{EAED533C-5AAC-40B4-A2D0-3A146E7EC9DD}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{EE64CCB3-28DC-4B74-A814-2D0F201D635B}" = lport=4482 | protocol=17 | dir=in | name=blackberry desktop software wireless music sync discovery |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01151D9D-82D8-4F71-9744-2BAE520F06D2}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpiscnapp.exe |
"{0567A264-9C8C-41B3-B46B-8932139EA693}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 |
"{068E0709-FF73-4F0F-8B9D-F99748B4DC8F}" = protocol=58 | dir=in | app=system |
"{1E92E703-D13D-479C-8666-69D0554E9B3E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{1F8C1ABF-30F7-4615-B4D4-EE1FA01A28B6}" = dir=in | app=c:\program files (x86)\hp\hp software update\hpwucli.exe |
"{225B0066-2E70-4FB8-BE01-E307855148B8}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\x64\3\lxdftime.exe |
"{24D855B7-A310-41DB-8598-34D7014C75F2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2511B2B5-7BB4-49F4-8987-1AF4EF61D490}" = protocol=6 | dir=in | app=c:\users\A M\appdata\roaming\utorrent\utorrent.exe |
"{2701D6E7-745B-42C4-B4D4-883BFA5F3E1B}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{2D0B05AA-D642-44B0-80C9-648658E82F2F}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{2ECA67DD-3BF1-48BF-93D8-4D4D1A35A3F4}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqkygrp.exe |
"{32B2F277-4652-4B22-85EA-1C2096544CCE}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{38D42D33-F6B2-454E-AE09-626848605C8B}" = protocol=17 | dir=in | app=c:\program files (x86)\research in motion\blackberry desktop\rim.desktop.exe |
"{3A5C02CD-9932-4A2A-8C9A-A0F5FD45296A}" = dir=in | app=c:\program files\hp\hp officejet 6600\bin\digitalwizards.exe |
"{3BD6BD63-216C-46C4-8E4F-9F050E463FF1}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\x64\3\lxdfpswx.exe |
"{3EC42107-7DB0-49D6-B407-E0BDC521408F}" = dir=in | app=c:\program files (x86)\acer\acer vcm\rs_service.exe |
"{3FB4C526-F641-4F51-B5F7-7049695801FB}" = protocol=17 | dir=in | app=c:\windows\system32\lxdfcoms.exe |
"{40FD7DC6-8EB6-4ACC-B7C5-DFFED8FAC865}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{413E5776-6F43-487A-9BA2-065C15771AFF}" = dir=in | app=c:\program files\hp\hp officejet 6600\bin\hpnetworkcommunicatorcom.exe |
"{41957CC5-E241-46DC-BF5E-8AC9B8DDA599}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{41DEA996-4481-4129-9DF0-1AC2A07CD237}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{46EC6464-0E6A-4E2A-811F-4A1E5A7B1753}" = dir=in | app=c:\program files\hp\hp officejet 6600\bin\sendafax.exe |
"{4A76F782-AB8F-4021-A5CF-345B4632C498}" = protocol=17 | dir=in | app=c:\windows\system32\lxdfcfg.exe |
"{4A771557-E15E-4360-99A3-AC0F8E94C85B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4C297756-8752-447C-AA25-67982C331047}" = protocol=17 | dir=in | app=c:\program files (x86)\research in motion\blackberry desktop\rim.desktop.exe |
"{4DD3C5A6-18FF-476F-91FD-63DA0C5B9326}" = protocol=6 | dir=in | app=c:\program files (x86)\research in motion\blackberry desktop\rim.desktop.exe |
"{547200EA-43A8-4436-9F4E-34DCF95997BE}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\x64\3\lxdftime.exe |
"{56551092-980B-4407-8616-81045DA8A546}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{62FBD0AD-E6BF-46F3-AC28-9AF3AE036939}" = protocol=6 | dir=in | app=c:\program files (x86)\research in motion\blackberry desktop\rim.desktop.exe |
"{64DC8AAD-E7EF-4798-9ACF-E934558BBD83}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\x64\3\lxdfpswx.exe |
"{66AD1679-4DAB-418A-A1C0-9574A54089ED}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{66B1478B-7F24-4122-B13E-8E1045662A25}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{7375EE73-BF15-4349-AC72-345369B2587D}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{7432995A-AC98-4DDD-8134-DC4FB5BA48D3}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{77F2AF35-A421-4694-8BC5-5888F12BDCE7}" = protocol=17 | dir=in | app=c:\windows\syswow64\rserver30\rserver3.exe |
"{789AB4EF-0599-461F-B7C2-A41B45C9DEC7}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{7B2E3DF6-DECF-4F90-8D61-F79532346DC9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7DB1500A-764E-43C3-9A8B-27F3AA8030A2}" = protocol=17 | dir=in | app=c:\program files (x86)\abbyy finereader 6.0 sprint\scan\scanman6.exe |
"{7EB872FC-8F53-4859-85E4-5C35D48510B0}" = dir=in | app=c:\program files\hp\hp officejet 6600\bin\devicesetup.exe |
"{8317E4AB-7BED-477F-A6CC-FAEF16411F53}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{8AD8A135-0745-4312-A8D5-9228C4F210EA}" = protocol=6 | dir=in | app=c:\windows\system32\lxdfcoms.exe |
"{8EC5E658-E0A5-4A8F-AA0E-9A9A9BAB26FA}" = protocol=6 | dir=in | app=c:\windows\system32\lxdfcfg.exe |
"{94960ADE-E05D-4FD7-9875-CBDE9F67867D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{A7DA8CB2-7BF9-4D77-B9DE-D7C913F4425A}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{AA6D3CA1-4FC6-4E26-A463-016458CFBD85}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB3D8976-C540-4444-AE3E-F552922C5406}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd8\powerdvd8.exe |
"{AB48BD61-968F-4CB4-A79C-6482C1CB5ACF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B30891A1-A46A-4757-AD27-ED3347ED7F78}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{B7275217-F03F-4C45-A23B-65D8FB00D308}" = protocol=6 | dir=out | app=system |
"{B96E6E93-1DE8-4734-B463-6CDA73756EF2}" = protocol=6 | dir=in | app=c:\windows\syswow64\rserver30\rserver3.exe |
"{BC2C8528-C346-4AAF-AB7D-B2367CDBD2DB}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BD24B904-26D4-4301-A49C-90D7A7E61E29}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{C2F635B2-D570-47EB-918C-C797FDEC9EF5}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{C3FD0FD5-6340-4674-98C7-C27188B7DADD}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpfccopy.exe |
"{C41B3A34-6CFA-4DCA-B236-FDFE25DB2226}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{C5494978-ACBA-4C42-A3B9-DE55DBB9031A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C76C21EB-E73E-44AD-B1D2-078C3D0ED04D}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{D23AB8A8-F99D-4D69-BB7A-2D2216131737}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{D2448973-8B59-459D-A02B-2FC1FCC82881}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{D4D22390-640A-4FEA-A136-296091C61B92}" = dir=in | app=c:\program files (x86)\acer\acer vcm\vc.exe |
"{D6841BB7-F773-4D6F-ABD0-097E0DDC30D8}" = dir=in | app=c:\users\A M\appdata\local\microsoft\skydrive\skydrive.exe |
"{D7ADC5D3-B27D-4925-AEE3-D5834598EBC6}" = protocol=6 | dir=in | app=c:\program files (x86)\abbyy finereader 6.0 sprint\scan\scanman6.exe |
"{DBBAC974-4292-4104-BB12-D94618AF243C}" = dir=in | app=c:\program files\hp\hp officejet 6600\bin\hpnetworkcommunicator.exe |
"{DE08F957-F0CE-4326-BCC0-D95CFCB7C75C}" = dir=in | app=c:\program files\hp\hp officejet 6600\bin\faxapplications.exe |
"{E46CFACC-CFFB-4286-8F21-966824F30002}" = protocol=17 | dir=in | app=c:\users\A M\appdata\roaming\utorrent\utorrent.exe |
"{E9E76AE8-B17C-467E-817D-3CDC0E43ECEB}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{EB39813D-21FA-4FD1-A635-A0711CF39B44}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{F3DA7DEE-8C0D-49B1-91CA-7F123401A936}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F8DB3389-C288-45E8-82D8-F83E640415FC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{015C5B35-B678-451C-9AEE-821E8D69621C}_is1" = PeerBlock 1.1 (r518)
"{05EFBF37-0E52-4579-875C-7EEF0DFB4FCB}" = Network64
"{08184040-959A-4B0D-8825-2C533F0DDB19}" = Barre de recherche Encarta (64 bits)
"{08684040-959A-4B0D-8825-2C533F0DDB19}" = Encarta - Search Bar (64-bit)
"{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}" = Apple Mobile Device Support
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{5F611ADA-B98C-4DBB-ADDE-414F08457ECF}" = Windows Live Family Safety
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6BFAB6C1-6D46-46DB-A538-A269907C9F2F}" = Network64
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-0028-0404-1000-0000000FF1CE}" = Microsoft Office IME (Chinese (Traditional)) 2010
"{90140000-0028-0411-1000-0000000FF1CE}" = Microsoft Office IME (Japanese) 2010
"{90140000-0028-0412-1000-0000000FF1CE}" = Microsoft Office IME (Korean) 2010
"{90140000-0028-0804-1000-0000000FF1CE}" = Microsoft Office IME (Chinese (Simplified)) 2010
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = WIDCOMM Bluetooth Software
"{a9264802-8a7a-40fe-a135-5c6d204aed7a}.sdb" = Internet Explorer (Enable DEP)
"{AC76BA86-1033-0000-0064-0003D0000004}" = Adobe Acrobat 9 Pro Extended 64-bit Add-On
"{B38968E0-778F-47C3-8781-BAD4E497801C}" = HP Officejet 4500 G510g-m
"{B407F586-D027-45C3-9109-CC2943E839FA}" = HP Officejet 6600 Basic Device Software
"{CE52672C-A0E9-4450-8875-88A221D5CD50}" = Windows Live ID Sign-in Assistant
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D601CEAD-2E4F-4BBB-85CC-C29A4CE6A3C0}" = iTunes
"{E9FA781F-3E80-4399-825A-AD3E11C28C77}" = MSVCRT110_amd64
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F6822EFD-3F7D-4B35-8845-757A26AEC8E2}" = Windows Live MIME IFilter
"{F7C525E7-659A-47F6-A25A-7A63FA10E767}" = ESET Smart Security
"{FF21C3E6-97FD-474F-9518-8DCBE94C2854}" = 64 Bit HP CIO Components Installer
"CCleaner" = CCleaner
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR archiver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0454BB9A-2A7A-4214-BDFF-937F7A711A44}" = Windows Live Communications Platform
"{047F790A-7A2A-4B6A-AD02-38092BA63DAC}" = Acer VCM
"{07683840-959A-4B0D-8825-2C533F0DDB19}" = Microsoft Maths
"{0837A661-FEC3-48B3-876C-91E7D32048A9}" = Macromedia Dreamweaver 8
"{08F32589-5E39-42B8-8BC5-6A8126ED2A70}" = Microsoft Visual C++ 2008 Redistributable Package
"{09180081-2C94-4A67-8E55-8483C019C7D2}" = Microsoft Encarta 2009 - Collection
"{09681881-2C94-4A67-8E55-8483C019C7D2}" = Microsoft Student with Encarta Reference Library 2009
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{12BAA98C-F8DD-4BC9-BBE6-1C8463114197}" = BlackBerry Device Software Updater
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18272881-CFC0-434D-A975-E5BE44206AA0}" = Windows Live UX Platform Language Pack
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1EA7C505-E6DA-4B85-9432-EBD3C70D510D}" = Windows Live Messenger
"{23A3E560-069F-4CFC-8F6C-1B526EC735FC}" = Windows Live Writer Resources
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 25
"{28379381-B56A-43e1-B505-3098D82B1C30}" = 4500G510gm_Software_Min
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{2EEEC858-21F8-419B-8FE2-820621BFFCD7}" = GetDataBack for FAT
"{2FA81482-5570-4CF0-9A10-D61D2F164916}" = HP Officejet 6600 Help
"{30F99474-EBE3-4134-A02B-F6CD38CFE243}" = Photo Gallery
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{3A8C4C87-D460-488A-A0AA-8993F6D355B1}" = Radmin Server 3.4
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{400C31E4-796F-4E86-8FDC-C3C4FACC6847}" = Junk Mail filter update
"{415FA9AD-DA10-4ABE-97B6-5051D4795C90}" = HP FWUpdateEDO2
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{46F044A5-CE8B-4196-984E-5BD6525E361D}" = Apple Application Support
"{470BE281-42FE-42D3-AA24-C5B7182EE9F8}_is1" = Block Builder Viewer version 2010.01.00
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CCBD1F4-CEEC-452A-9CB8-46564B501315}" = Windows Live UX Platform
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.11
"{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}" = Macromedia Extension Manager
"{56582EEA-3AEF-4D84-8B9D-C87A3CD9250F}" = GetDataBack for NTFS
"{5A22D889-FBDD-4AE8-86EC-089D45FC133E}" = Alcor Micro USB Card Reader
"{5BABDA39-61CF-41EE-992D-4054B6649A9B}" = Movie Maker
"{64630268-1833-4461-9EC3-857EEB8A0540}" = DiskExplorer for NTFS
"{67E03279-F703-408F-B4BF-46B5FC8D70CD}" = Microsoft Works
"{68301905-2DEA-41CE-A4D4-E8B443B099BA}" = MyWinLocker
"{698BBAD8-B116-495D-B879-0F07A533E57F}" = Samsung Story Album Viewer
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A8DB215-7BCD-4377-B015-2E4541A3E7C6}" = Windows Live PIMT Platform
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{70854FE6-3BF1-4C69-94D0-BEB821102E34}" = Windows Live Mail
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72199E33-4F2A-4B7F-8E25-95DDDD50A678}" = Acer System Information
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{75F3A4B2-F6E8-434D-A2EF-DBBC016C6CB2}" = Learning Essentials for Microsoft Office
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7760D94E-B1B5-40A0-9AA0-ABF942108755}" = Acer Crystal Eye Webcam
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7B0C5EF6-DE4C-4E20-8889-C17604FFE5CD}" = Windows Live Family Safety
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{7E7A5A7D-1045-4075-9808-60C0DE69D38A}" = 4500G510gm_web
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{86C40513-B5A4-476E-9EAB-EC118DCF4502}" = Windows Live Writer
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8A642ACD-CE3A-4A23-A8B1-A0F7EB12B214}" = Windows Live SOXE Definitions
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2010
"{90140000-001F-0402-0000-0000000FF1CE}" = Microsoft Office Proof (Bulgarian) 2010
"{90140000-001F-0403-0000-0000000FF1CE}" = Microsoft Office Proof (Catalan) 2010
"{90140000-001F-0404-0000-0000000FF1CE}" = Microsoft Office Proof (Chinese (Traditional)) 2010
"{90140000-001F-0405-0000-0000000FF1CE}" = Microsoft Office Proof (Czech) 2010
"{90140000-001F-0406-0000-0000000FF1CE}" = Microsoft Office Proof (Danish) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0408-0000-0000000FF1CE}" = Microsoft Office Proof (Greek) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040B-0000-0000000FF1CE}" = Microsoft Office Proof (Finnish) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040D-0000-0000000FF1CE}" = Microsoft Office Proof (Hebrew) 2010
"{90140000-001F-040E-0000-0000000FF1CE}" = Microsoft Office Proof (Hungarian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0411-0000-0000000FF1CE}" = Microsoft Office Proof (Japanese) 2010
"{90140000-001F-0412-0000-0000000FF1CE}" = Microsoft Office Proof (Korean) 2010
"{90140000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2010
"{90140000-001F-0414-0000-0000000FF1CE}" = Microsoft Office Proof (Norwegian (Bokmål)) 2010
"{90140000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2010
"{90140000-001F-0416-0000-0000000FF1CE}" = Microsoft Office Proof (Portuguese (Brazil)) 2010
"{90140000-001F-0418-0000-0000000FF1CE}" = Microsoft Office Proof (Romanian) 2010
"{90140000-001F-0419-0000-0000000FF1CE}" = Microsoft Office Proof (Russian) 2010
"{90140000-001F-041A-0000-0000000FF1CE}" = Microsoft Office Proof (Croatian) 2010
"{90140000-001F-041B-0000-0000000FF1CE}" = Microsoft Office Proof (Slovak) 2010
"{90140000-001F-041D-0000-0000000FF1CE}" = Microsoft Office Proof (Swedish) 2010
"{90140000-001F-041E-0000-0000000FF1CE}" = Microsoft Office Proof (Thai) 2010
"{90140000-001F-041F-0000-0000000FF1CE}" = Microsoft Office Proof (Turkish) 2010
"{90140000-001F-0420-0000-0000000FF1CE}" = Microsoft Office Proof (Urdu) 2010
"{90140000-001F-0422-0000-0000000FF1CE}" = Microsoft Office Proof (Ukrainian) 2010
"{90140000-001F-0424-0000-0000000FF1CE}" = Microsoft Office Proof (Slovenian) 2010
"{90140000-001F-0425-0000-0000000FF1CE}" = Microsoft Office Proof (Estonian) 2010
"{90140000-001F-0426-0000-0000000FF1CE}" = Microsoft Office Proof (Latvian) 2010
"{90140000-001F-0427-0000-0000000FF1CE}" = Microsoft Office Proof (Lithuanian) 2010
"{90140000-001F-042D-0000-0000000FF1CE}" = Microsoft Office Proof (Basque) 2010
"{90140000-001F-0439-0000-0000000FF1CE}" = Microsoft Office Proof (Hindi) 2010
"{90140000-001F-043F-0000-0000000FF1CE}" = Microsoft Office Proof (Kazakh) 2010
"{90140000-001F-0446-0000-0000000FF1CE}" = Microsoft Office Proof (Punjabi) 2010
"{90140000-001F-0447-0000-0000000FF1CE}" = Microsoft Office Proof (Gujarati) 2010
"{90140000-001F-0449-0000-0000000FF1CE}" = Microsoft Office Proof (Tamil) 2010
"{90140000-001F-044A-0000-0000000FF1CE}" = Microsoft Office Proof (Telugu) 2010
"{90140000-001F-044B-0000-0000000FF1CE}" = Microsoft Office Proof (Kannada) 2010
"{90140000-001F-044E-0000-0000000FF1CE}" = Microsoft Office Proof (Marathi) 2010
"{90140000-001F-0456-0000-0000000FF1CE}" = Microsoft Office Proof (Galician) 2010
"{90140000-001F-0804-0000-0000000FF1CE}" = Microsoft Office Proof (Chinese (Simplified)) 2010
"{90140000-001F-0814-0000-0000000FF1CE}" = Microsoft Office Proof (Norwegian (Nynorsk)) 2010
"{90140000-001F-0816-0000-0000000FF1CE}" = Microsoft Office Proof (Portuguese (Portugal)) 2010
"{90140000-001F-081A-0000-0000000FF1CE}" = Microsoft Office Proof (Serbian (Latin)) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-0028-0404-0000-0000000FF1CE}" = Microsoft Office IME (Chinese (Traditional)) 2010
"{90140000-0028-0411-0000-0000000FF1CE}" = Microsoft Office IME (Japanese) 2010
"{90140000-0028-0412-0000-0000000FF1CE}" = Microsoft Office IME (Korean) 2010
"{90140000-0028-0804-0000-0000000FF1CE}" = Microsoft Office IME (Chinese (Simplified)) 2010
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-004A-0409-0000-0000000FF1CE}" = Microsoft Office ProofMUI (English) 2010
"{90140000-004B-0000-0000-0000000FF1CE}" = Microsoft Office Proofing Kit 2010
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00D1-0409-0000-0000000FF1CE}" = Microsoft Access database engine 2010 (English)
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{935B40F5-6994-4868-9155-F9FB77A5048F}" = Microsoft Expression Encoder 4
"{95140000-007A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{95140000-007D-0409-0000-0000000FF1CE}" = Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit
"{952DCCD8-4039-46C8-BC8B-5C1EB6C8E130}" = Microsoft Expression Encoder 4 Screen Capture Codec
"{96AD3B61-EAE2-11E2-9E72-B8AC6F98CCE3}" = Google Earth
"{97486FBE-A3FC-4783-8D55-EA37E9D171CC}" = HP Update
"{97C79BEC-43F7-4BD8-A6A7-85C0257E488A}" = Windows Live Writer
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B8A821E-1FCE-45D1-8BEC-738F5AAB20D8}" = Radmin Viewer 3.4
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet TV for Windows Media Center
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AC76BA86-1033-F400-7761-000000000004}{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.05)
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{AD88355B-A4E0-4DA1-BAC3-EA4FEA930691}" = Ipswitch WS_FTP Pro
"{B0255743-165B-4BD5-8DA8-37DFB9930015}" = Norton Ghost
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy
"{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime
"{B80D3EA9-A252-4AE5-AC51-81729F5C586F}" = Windows Live Mail
"{BD1DE035-9656-4E7E-A098-C56B639C9636}" = GenuTax Standard
"{BE5B0450-DCCB-4FE9-93E2-3B38D88A745B}" = BlackBerry Desktop Software 7.1
"{C034A6F9-6569-491B-B3BF-F5D15221A708}" = Windows Live Essentials
"{C424CD5E-EA05-4D3E-B5DA-F9F149E1D3AC}" = Windows Live Installer
"{C82185E8-C27B-4EF4-2010-3333BC2C2B6D}" = Microsoft AutoRoute 2010
"{C82185E8-C27B-4EF4-2013-4444BC2C2B6D}" = Microsoft Streets & Trips 2013
"{C9B6EFD0-4F01-4BBA-8374-39AD99A3ED72}" = Windows Live Photo Common
"{C9CEC6F3-3944-92B4-6CCA-995182394542}" = svBuilder
"{CA6BCA2F-EDEB-408F-850B-31404BE16A61}" = I.R.I.S. OCR
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BB}" = WinZip 14.0
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D2C146B1-948D-47EF-8387-5D1C6B980F7C}" = Windows Live Writer
"{D888F114-7537-4D48-AF03-5DA9C82D7540}" = Photo Common
"{DF0B357C-5874-47D0-81E7-79AA890B0CE0}" = 4500_G510gm_Help_Web
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E2D09AC2-4153-4817-AAEB-24F92A8BCE88}" = Windows Media Center Add-in for Flash
"{E38BBAD2-E89C-4C15-9727-1D284F088667}_is1" = ScrabblePLUS v1.0
"{EC21B3F4-6A5B-4D77-A796-BB4F1A646C8B}" = FileMaker Pro 12 Advanced
"{EC21B3F4-6A5B-4D77-A796-BB4F1A646C8B}_FileMaker" = FileMaker Pro 12 Advanced
"{ED6C77F9-4D7E-447C-9EC0-9A212D075535}" = Movie Maker
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F2235E5E-7881-4293-9B6F-04B2609FBFF0}" = Windows Live Messenger
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{FA4C2D53-205F-4245-9717-F3761154824D}" = Safari
"{FC6C7107-7D72-41A1-A031-3CE751159BAB}" = Photo Gallery
"{FE7C0B3D-50B9-4951-BE78-A321CBF86552}" = Windows Live SOXE
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Acer Assist" = Acer Assist
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"BlackBerry_Desktop" = BlackBerry Desktop Software 7.1
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup" = DivX Setup
"Encoder_4.0.1651.0" = Microsoft Expression Encoder 4
"GridVista" = Acer GridVista
"GroundSchool JAA ATPL - All Test Banks_is1" = GroundSchool JAA ATPL - All Test Banks
"HP Photo Creations" = HP Photo Creations
"Identity Card" = Identity Card
"InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"InstallShield_{5A22D889-FBDD-4AE8-86EC-089D45FC133E}" = Alcor Micro USB Card Reader
"InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}" = Samsung Story Album Viewer
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"LManager" = Launch Manager
"MD5 Checksum Verifier_is1" = MD5 Checksum Verifier 4.2
"Mozilla Firefox 25.0.1 (x86 en-US)" = Mozilla Firefox 25.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Notepad++" = Notepad++
"Office14.PROOFKIT" = Microsoft Office Proofing Tools Kit Compilation 2010
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"ONEWORLD" = oneworld Timetables
"Opera 12.16.1860" = Opera 12.16
"PowerISO" = PowerISO
"SkyTeam TravelDesk_is1" = SkyTeam TravelDesk
"star" = Star Alliance Timetable
"Stellarium_is1" = Stellarium 0.10.5
"svBuilder" = svBuilder
"VeryPDF PDF2Word v3.0_is1" = VeryPDF PDF2Word v3.0
"WampServer 2_is1" = WampServer 2.1
"WinLiveSuite" = Windows Live Essentials

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"ImTOO iPod Computer Transfer" = ImTOO iPod Computer Transfer
"MyFreeCodec" = MyFreeCodec
"PhotoFiltre Studio X" = PhotoFiltre Studio X
"SkyDriveSetup.exe" = Microsoft SkyDrive
"uTorrent" = µTorrent

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 26-Nov-13 12:34:01 AM | Computer Name = AM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 14886208

Error - 26-Nov-13 12:34:01 AM | Computer Name = AM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 14886208

Error - 26-Nov-13 1:10:34 PM | Computer Name = AM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 26-Nov-13 1:10:34 PM | Computer Name = AM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 45087004

Error - 26-Nov-13 1:10:34 PM | Computer Name = AM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 45087004

Error - 26-Nov-13 1:12:51 PM | Computer Name = AM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 26-Nov-13 1:12:51 PM | Computer Name = AM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2230

Error - 26-Nov-13 1:12:51 PM | Computer Name = AM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2230

Error - 26-Nov-13 7:34:18 PM | Computer Name = AM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 26-Nov-13 7:34:18 PM | Computer Name = AM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 22889215

Error - 26-Nov-13 7:34:18 PM | Computer Name = AM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 22889215

[ Media Center Events ]
Error - 08-Oct-12 2:20:58 PM | Computer Name = AM | Source = MCUpdate | ID = 0
Description = 2:20:58 PM - Failed to retrieve SportsSchedule (Error: The underlying
connection was closed: Could not establish trust relationship for the SSL/TLS secure
channel.)

Error - 08-Oct-12 2:20:59 PM | Computer Name = AM | Source = MCUpdate | ID = 0
Description = 2:20:59 PM - Failed to retrieve SportsV2 (Error: The underlying connection
was closed: Could not establish trust relationship for the SSL/TLS secure channel.)

Error - 08-Oct-12 2:20:59 PM | Computer Name = AM | Source = MCUpdate | ID = 0
Description = 2:20:59 PM - Failed to retrieve Broadband (Error: The underlying connection
was closed: Could not establish trust relationship for the SSL/TLS secure channel.)

Error - 19-Oct-12 8:29:47 PM | Computer Name = AM | Source = MCUpdate | ID = 0
Description = 8:29:47 PM - Failed to retrieve Directory (Error: Unable to connect
to the remote server)

Error - 24-Oct-12 12:48:34 PM | Computer Name = AM | Source = MCUpdate | ID = 0
Description = 12:48:33 PM - Failed to retrieve NetTV (Error: The underlying connection
was closed: An unexpected error occurred on a receive.)

Error - 24-Oct-12 12:48:34 PM | Computer Name = AM | Source = MCUpdate | ID = 0
Description = 12:48:34 PM - Failed to retrieve MCESpotlight (Error: The remote name
could not be resolved: 'data.tvdownload.microsoft.com')

Error - 24-Oct-12 12:48:34 PM | Computer Name = AM | Source = MCUpdate | ID = 0
Description = 12:48:34 PM - Failed to retrieve MCEClientUX (Error: The remote name
could not be resolved: 'data.tvdownload.microsoft.com')

Error - 24-Oct-12 12:48:34 PM | Computer Name = AM | Source = MCUpdate | ID = 0
Description = 12:48:34 PM - Failed to retrieve SportsSchedule (Error: The remote
name could not be resolved: 'data.tvdownload.microsoft.com')

Error - 24-Oct-12 12:48:34 PM | Computer Name = AM | Source = MCUpdate | ID = 0
Description = 12:48:34 PM - Failed to retrieve SportsV2 (Error: The remote name
could not be resolved: 'data.tvdownload.microsoft.com')

Error - 24-Oct-12 12:48:37 PM | Computer Name = AM | Source = MCUpdate | ID = 0
Description = 12:48:34 PM - Failed to retrieve Broadband (Error: The remote name
could not be resolved: 'data.tvdownload.microsoft.com')

[ System Events ]
Error - 25-Nov-13 12:06:03 PM | Computer Name = AM | Source = DCOM | ID = 10010
Description =

Error - 25-Nov-13 12:07:39 PM | Computer Name = AM | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
cdrom

Error - 25-Nov-13 12:08:06 PM | Computer Name = AM | Source = VDS Basic Provider | ID = 33554433
Description =

Error - 25-Nov-13 12:08:13 PM | Computer Name = AM | Source = VDS Basic Provider | ID = 33554433
Description =

Error - 25-Nov-13 12:08:17 PM | Computer Name = AM | Source = VDS Basic Provider | ID = 33554433
Description =

Error - 25-Nov-13 12:08:20 PM | Computer Name = AM | Source = VDS Basic Provider | ID = 33554433
Description =

Error - 26-Nov-13 1:10:38 PM | Computer Name = AM | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the PlugPlay service.

Error - 26-Nov-13 8:04:02 PM | Computer Name = AM | Source = EventLog | ID = 6008
Description = The previous system shutdown at 7:02:54 PM on ?11/?26/?2013 was unexpected.

Error - 26-Nov-13 8:04:15 PM | Computer Name = AM | Source = BugCheck | ID = 1001
Description =

Error - 26-Nov-13 8:04:37 PM | Computer Name = AM | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
cdrom

< End of report >

OCD

Post #7November 27, 2013, 3:00 AM UTC

Hi Dede,

I am also changed the computer's name, replacing mine with A M

That won't effect the cleaning process.

Did you set this proxy Server?
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.87.1.220:8080

=========================

[external image: bullseye_zpse9eaf36e.gif] Run OTL.exe

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
FF - prefs.js..keyword.URL: "http://search.toolba…De1K6Dx00gU&q="

:Files
ipconfig /flushdns /c

:Commands
[purity]
[createrestorepoint]
[emptyjava]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done

=========================

[external image: bullseye_zpse9eaf36e.gif] Flush the FireFox Cache

(these directions are specific to Firefox 19, if you have a different version the exact steps might be slightly different)

In Firefox, Options
Select Options
Select Privacy tab
Find the section that reads: You might want to clear your recent history or remove individual cookies
Select clear your recent history
Click the Details drop-down arrow
Make sure a check mark is placed in the following boxes:
- Cookies
- Cache

Next select the Time Range to Clear drop-down menu
Select Everything (this will only delete all the cookies and cache, and will save the other items not selected)
Click Clear Now
=========================

[external image: bullseye_zpse9eaf36e.gif] Reboot

=========================

[external image: bullseye_zpse9eaf36e.gif] Re-run OTL (it should be located on your desktop).
- - Windows XP : Double click on the icon to run it.
  - Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
- Make sure all other windows are closed and to let it run uninterrupted.
- When the window appears, underneath Output at the top change it to Minimal Output.
- Uncheck the boxes beside LOP Check and Purity Check.
- Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open one notepad window. OTL.Txt. (No Extras.txt will be produced)
  Note:The log can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
- Please copy (Edit->Select All, Edit->Copy) the contents of the file, and post it with your next reply.
=========================

In your next post please provide the following:
- Answer about the Proxy Server.
- OTL fix log
- Fresh OTL.txt
- How is the computer running, still getting the pop-ups?

Dede

Post #8November 27, 2013, 4:21 PM UTC

Hello OCD.

I did not set that proxy server, it's not mine.

The computer rebooted again.

Hence I do not know if this is the correct file. I will copy the one on the C drive next

OTL logfile created on: 27-Nov-13 1:25:01 AM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\A M\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16428)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: dd-MMM-yy

3.91 Gb Total Physical Memory | 1.83 Gb Available Physical Memory | 46.94% Memory free
7.81 Gb Paging File | 5.73 Gb Available in Paging File | 73.36% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 285.99 Gb Total Space | 77.28 Gb Free Space | 27.02% Space Free | Partition Type: NTFS

Computer Name: AM | User Name: A M | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found
PRC - C:\Users\A M\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe (ESET)
PRC - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung)
PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
PRC - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
PRC - C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Launch Manager\LManager.EXE (Dritek System Inc.)
PRC - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe (Acer Incorporated)
PRC - C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
PRC - C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
PRC - C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer)
PRC - c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe ()
PRC - C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
PRC - c:\wamp\bin\apache\Apache2.2.11\bin\httpd.exe (Apache Software Foundation)
PRC - C:\wamp\bin\apache\Apache2.2.11\bin\httpd.exe (Apache Software Foundation)
PRC - C:\Windows\PLFSetI.exe ()
PRC - C:\Program Files (x86)\Microsoft Student\Microsoft Student with Encarta Reference Library 2009 DVD\EDICT.EXE (Microsoft Corporation)
PRC - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files (x86)\Microsoft Encarta\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ef0a534be135cd8f0d99d938d8b1814a\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\4eef5a3a4d0ed6d6fd882947a70df530\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\29f3ae8d313e62b4daed1107ccd29f9f\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\e9147e4c70d4e387dc4aea59ce0a219a\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\99bbd3424207d205e9e680fa712dba04\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\85a501f8b0cb271f1bfab6532523ac3c\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\55c245966c0b23a47587c18681457e48\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\b1ff5e4a64c0bb0a9b039aaefcde5ea7\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\ef63e29e24bf73b2a8659e13aa18fbbb\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\d473c19e69818875b9c739cad8f386a5\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\0149e914e4cfbde7da65d4558af19ce0\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5aa44bce7933e4de09d935848f868a4b\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\09db78d6068543df01862a023aca785a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5d22a30e587e2cac106b81fb351e7c08\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\d8f4106eee38420ac5eda7d630dc53fc\System.ServiceProcess.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\c8648331484537c338fe2b606a9db8b7\System.Xaml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b7285e9f3d19a05d5cc2c049e451685d\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\08c630893416f3379c9455870908ad6c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a01e07e47ecdd94ae099e8c4bf650516\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Windows\PLFSetI.exe ()
MOD - C:\Program Files (x86)\Common Files\microsoft shared\Reference 2009\MSENCXML.DLL ()
MOD - C:\Program Files (x86)\Common Files\microsoft shared\Reference 2009\ERSREGPR.DLL ()
MOD - C:\Program Files (x86)\Common Files\microsoft shared\Reference 2009\MSENCDAT.DLL ()
MOD - C:\Program Files (x86)\Common Files\microsoft shared\Reference 2009\ENCCONT.DLL ()
MOD - C:\Program Files (x86)\Microsoft Student\Microsoft Student with Encarta Reference Library 2009 DVD\EDICTEIT.EBK ()
MOD - C:\Program Files (x86)\Microsoft Encarta\Microsoft Encarta 2009 - Collection DVD\EDICTEIT.EBK ()

========== Services (SafeList) ==========

SRV:64bit: - (IEEtwCollectorService) – C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation)
SRV:64bit: - (ekrn) – C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe (ESET)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (ePowerSvc) – C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
SRV:64bit: - (Updater Service) – C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer)
SRV:64bit: - (btwdins) – C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV:64bit: - (Crypkey License) – C:\Windows\SysNative\Crypserv.exe (CrypKey (Canada) Ltd.)
SRV:64bit: - (lxdf_device) – C:\Windows\SysNative\lxdfcoms.exe ( )
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Blackberry Device Manager) – C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
SRV - (HPSLPSVC) – C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (IAStorDataMgrSvc) – C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (RServer3) – C:\Windows\SysWOW64\rserver30\RServer3.exe (Famatech Corp.)
SRV - (Norton Ghost) – C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe (Symantec Corporation)
SRV - (GenericMount Helper Service) – C:\Program Files (x86)\Norton Ghost\Shared\Drivers\GenericMountHelper.exe (Symantec)
SRV - (SymSnapService) – C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe (Symantec)
SRV - (MWLService) – C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe ()
SRV - (Greg_Service) – C:\Program Files (x86)\Acer\Registration\GregHSRW.exe (Acer Incorporated)
SRV - (RS_Service) – C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
SRV - (wampmysqld) – c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe ()
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (wampapache) – c:\wamp\bin\apache\Apache2.2.11\bin\httpd.exe (Apache Software Foundation)
SRV - (LiveUpdate) – C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (eamonm) – C:\Windows\SysNative\drivers\eamonm.sys (ESET)
DRV:64bit: - (epfw) – C:\Windows\SysNative\drivers\epfw.sys (ESET)
DRV:64bit: - (ehdrv) – C:\Windows\SysNative\drivers\ehdrv.sys (ESET)
DRV:64bit: - (epfwwfp) – C:\Windows\SysNative\drivers\epfwwfp.sys (ESET)
DRV:64bit: - (EpfwLWF) – C:\Windows\SysNative\drivers\EpfwLWF.sys (ESET)
DRV:64bit: - (ssudmdm) – C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) – C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (Point64) – C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:64bit: - (dc3d) – C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation)
DRV:64bit: - (usb_rndisx) – C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (usbrndis6) – C:\Windows\SysNative\drivers\usb80236.sys (Microsoft Corporation)
DRV:64bit: - (RimVSerPort) – C:\Windows\SysNative\drivers\RimSerial_AMD64.sys (Research in Motion Ltd)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) – C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (L1C) – C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (SCDEmu) – C:\Windows\SysNative\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV:64bit: - (mirrorv3) – C:\Windows\SysNative\drivers\rminiv3.sys (Famatech International Corp.)
DRV:64bit: - (WimFltr) – C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV:64bit: - (VProEventMonitor) – C:\Windows\SysNative\drivers\vproeventmonitor.sys (Symantec Corporation)
DRV:64bit: - (GenericMount) – C:\Windows\SysNative\drivers\GenericMount.sys (Symantec Corporation)
DRV:64bit: - (symsnap) – C:\Windows\SysNative\drivers\symsnap.sys (StorageCraft)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (NETw5s64) – C:\Windows\SysNative\drivers\NETw5s64.sys (Intel Corporation)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (StillCam) – C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (ROOTMODEM) – C:\Windows\SysNative\drivers\rootmdm.sys (Microsoft Corporation)
DRV:64bit: - (IntcHdmiAddService) – C:\Windows\SysNative\drivers\IntcHdmi.sys (Intel(R) Corporation)
DRV:64bit: - (btusbflt) – C:\Windows\SysNative\drivers\btusbflt.sys (Broadcom Corporation.)
DRV:64bit: - (btwaudio) – C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)
DRV:64bit: - (btwavdt) – C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)
DRV:64bit: - (btwrchid) – C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (mwlPSDVDisk) – C:\Windows\SysNative\drivers\mwlPSDVDisk.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDFilter) – C:\Windows\SysNative\drivers\mwlPSDFilter.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDNServ) – C:\Windows\SysNative\drivers\mwlPSDNserv.sys (Egis Technology Inc.)
DRV:64bit: - (AmUStor) – C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)
DRV:64bit: - (btwl2cap) – C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV:64bit: - (int15.sys) – C:\Windows\SysNative\OEM\factory\int15.sys (Acer, Inc.)
DRV:64bit: - (NetworkX) – C:\Windows\SysNative\Ckldrv.sys ()
DRV - (FsUsbExDisk) – C:\Windows\SysWOW64\FsUsbExDisk.Sys ()
DRV - (raddrvv3) – C:\Windows\SysWOW64\rserver30\raddrvv3.sys (Famatech Corp.)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&sourceid;=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q;={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&rlz;=1I7ACAW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&sourceid;=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/?ocid=EIE9HP&PC;=UP50
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ca.msn.com/
IE - HKCU\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src;=IE-SearchBox&FORM;=IE11SR
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.bing.com/search?FORM=UP50DF&PC;=UP50&q;={searchTerms}&src;=IE-SearchBox
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&sourceid;=ie7
IE - HKCU\..\SearchScopes\{A282C0E0-6769-4A11-BA2F-6173374A4919}: "URL" = http://www.google.com/search?sourceid=ie7&q;={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&rlz;=1I7ACAW_enUS361CA362
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.87.1.220:8080

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.msn.com/?pc=UP97&ocid;=UP97DHP"
FF - prefs.js..extensions.enabledAddons: %7Bc45c406e-ab73-11d8-be73-000a95be3b12%7D:1.2.5
FF - prefs.js..extensions.enabledAddons: %7Bd57c9ff1-6389-48fc-b770-f78bd89b6e8a%7D:1.46
FF - prefs.js..extensions.enabledAddons: en-GB%40dictionaries.addons.mozilla.org:1.19.1
FF - prefs.js..extensions.enabledAddons: fr-classique-reforme1990%40dictionaries.addons.mozilla.org:4.3
FF - prefs.js..extensions.enabledAddons: flashfirebug%40o-minds.com:4.69
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:25.0.1
FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.9
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "http://search.toolbars.alexa.com/?ver=alxf-2.14&src;=ab&aid;=wdIDe1K6Dx00gU&q;="
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Web Player Plug-In,version=1.0.0: C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\A M\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\A M\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\PROGRAM FILES\ESET\ESET SMART SECURITY\MOZILLA THUNDERBIRD [2013-11-21 00:08:07 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 25.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013-11-21 09:49:28 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 25.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013-11-21 09:49:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2013-11-21 00:08:07 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 25.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013-11-21 09:49:28 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 25.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013-11-21 09:49:30 | 000,000,000 | —D | M]

[2010-03-31 07:43:08 | 000,000,000 | —D | M] (No name found) – C:\Users\A M\AppData\Roaming\Mozilla\Extensions
[2010-03-31 07:43:08 | 000,000,000 | —D | M] (No name found) – C:\Users\A M\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2013-11-21 12:28:37 | 000,000,000 | —D | M] (No name found) – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions
[2013-11-20 12:28:29 | 000,000,000 | —D | M] (Canadian English Dictionary) – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions\[removed]
[2013-11-18 13:44:44 | 000,000,000 | —D | M] (British English Dictionary) – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions\[removed]
[2013-11-18 13:44:47 | 000,000,000 | —D | M] (FlashFirebug) – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions\[removed]
[2013-11-18 13:44:47 | 000,000,000 | —D | M] (Dictionnaire franÃ§ais Â«Classique & RÃ©forme 1990Â») – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions\[removed]
[2013-11-21 12:28:37 | 002,212,154 | —- | M] () (No name found) – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions\[removed]
[2013-08-08 07:07:04 | 000,249,988 | —- | M] () (No name found) – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions\[removed]
[2013-05-16 09:06:59 | 001,360,435 | —- | M] () (No name found) – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi
[2013-06-02 09:34:30 | 000,150,349 | —- | M] () (No name found) – C:\Users\A M\AppData\Roaming\Mozilla\Firefox\Profiles\5m0rokzq.default\extensions\{d57c9ff1-6389-48fc-b770-f78bd89b6e8a}.xpi
[2013-11-21 09:49:29 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2013-11-21 09:49:29 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013-11-21 09:49:29 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013-11-21 09:49:28 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013-11-21 09:49:52 | 000,000,000 | —D | M] (Default) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q;={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: http://www.msn.com/?pc=UP97&ocid;=UP97DHP
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\A M\AppData\Local\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\A M\AppData\Local\Google\Chrome\Application\31.0.1650.57\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\A M\AppData\Local\Google\Chrome\Application\31.0.1650.57\gcswf32.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: RIM Handheld Application Loader (Enabled) = C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Windows Live Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: Error reading preferences file
CHR - Extension: Entanglement Web App = C:\Users\A M\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd\3.4.9_0\
CHR - Extension: FB Easy Logout = C:\Users\A M\AppData\Local\Google\Chrome\User Data\Default\Extensions\dngiackpkbhijljopnbakdabdfijafmd\1.3_0\
CHR - Extension: Poppit = C:\Users\A M\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi\2.2_0\
CHR - Extension: Google Wallet = C:\Users\A M\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0\

O1 HOSTS File: ([2011-02-25 17:20:21 | 000,000,849 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.)
O4:64bit: - HKLM..\Run: [egui] C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files (x86)\Acer\Acer Assist\launcher.exe ()
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe (DivX, LLC)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.EXE (Dritek System Inc.)
O4 - HKLM..\Run: [Norton Ghost 15.0] C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe (Symantec Corporation)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [SDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung)
O4 - HKCU..\Run: [E09FXLRD_87317784] C:\Program Files (x86)\Microsoft Encarta\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE (Microsoft Corporation)
O4 - HKCU..\Run: [HP Officejet 6600 (NET)] C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O4 - HKCU..\Run: [KiesAirMessage] C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe (Samsung Electronics)
O4 - HKCU..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung)
O4 - HKCU..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)
O4 - HKCU..\Run: [L09ZXLRD_16295271] C:\Program Files (x86)\Microsoft Student\Microsoft Student with Encarta Reference Library 2009 DVD\EDICT.EXE (Microsoft Corporation)
O4 - HKCU..\Run: [Spybot-S&D; Cleaning] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe (Safer-Networking Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Send to &Bluetooth; Device… - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {9C65AB3E-C9A8-4789-AE24-B365A1C4A6F9} http://acer.custhelp.com/euf/assets/activex/snret.cab (SNRet Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3DB6117A-A137-45BE-A623-F8E4F95493E7}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{521854D5-AAA4-4D2F-ADFC-C061365D8136}: DhcpNameServer = [removed] [removed] 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BEC80406-154B-4651-AE36-9C5C479C4AD2}: DhcpNameServer = [removed] [removed] [removed]
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\livecall - No CLSID value found
O18 - Protocol\Handler\msnim - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - AppInit_DLLs: (acaptuser64.dll) - C:\Windows\SysNative\acaptuser64.dll (Adobe Systems, Inc.)
O20 - AppInit_DLLs: (acaptuser32.dll) - C:\Windows\SysWow64\acaptuser32.dll (Adobe Systems, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013-11-16 06:11:12 | 000,000,000 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{1cb0c9dd-a6a9-11df-a9c9-00269e978d0d}\Shell - "" = AutoRun
O33 - MountPoints2\{1cb0c9dd-a6a9-11df-a9c9-00269e978d0d}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{a7497b33-0084-11e0-a253-00269e978d0d}\Shell - "" = AutoRun
O33 - MountPoints2\{a7497b33-0084-11e0-a253-00269e978d0d}\Shell\AutoRun\command - "" = F:\laucher.exe
O33 - MountPoints2\{cd11c2e2-4d11-11e2-9f0d-00269e978d0d}\Shell - "" = AutoRun
O33 - MountPoints2\{cd11c2e2-4d11-11e2-9f0d-00269e978d0d}\Shell\AutoRun\command - "" = E:\HPLauncher.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\Autoplay.exe -auto
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013-11-27 01:22:01 | 000,000,000 | R–D | C] – C:\Users\A M\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 8
[2013-11-27 01:09:46 | 000,000,000 | —D | C] – C:\_OTL
[2013-11-26 20:03:13 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\A M\Desktop\OTL.exe
[2013-11-26 18:54:03 | 004,745,728 | —- | C] (AVAST Software) – C:\Users\A M\Desktop\aswMBR.exe
[2013-11-21 09:49:27 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2013-11-21 00:07:58 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
[2013-11-21 00:07:58 | 000,000,000 | —D | C] – C:\ProgramData\ESET
[2013-11-20 12:31:53 | 000,000,000 | —D | C] – C:\Users\A M\AppData\Roaming\langmaster.com
[2013-11-20 12:31:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\LANGMaster
[2013-11-19 10:11:31 | 000,028,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\IEUDINIT.EXE
[2013-11-19 10:05:44 | 000,940,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013-11-19 10:05:44 | 000,194,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\elshyph.dll
[2013-11-19 10:05:34 | 000,645,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jsIntl.dll
[2013-11-19 10:05:34 | 000,235,008 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\elshyph.dll
[2013-11-19 10:05:33 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013-11-19 10:05:31 | 000,440,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2013-11-19 10:05:31 | 000,164,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msrating.dll
[2013-11-19 10:05:26 | 000,337,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2013-11-19 10:05:26 | 000,062,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tdc.ocx
[2013-11-19 10:05:26 | 000,034,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2013-11-19 10:05:25 | 000,703,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2013-11-19 10:05:25 | 000,616,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dat
[2013-11-19 10:05:25 | 000,233,472 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2013-11-19 10:05:24 | 001,926,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2013-11-19 10:05:24 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\icardie.dll
[2013-11-19 10:05:23 | 001,051,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmlmedia.dll
[2013-11-19 10:05:23 | 000,083,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inseng.dll
[2013-11-19 10:05:23 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2013-11-19 10:05:23 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2013-11-19 10:05:23 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2013-11-19 10:05:22 | 000,151,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iexpress.exe
[2013-11-19 10:05:22 | 000,139,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wextract.exe
[2013-11-19 10:05:22 | 000,069,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2013-11-19 10:05:21 | 000,056,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\pngfilt.dll
[2013-11-19 10:05:15 | 000,127,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2013-11-19 10:05:15 | 000,112,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2013-11-19 10:05:15 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MshtmlDac.dll
[2013-11-19 10:05:14 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieetwproxystub.dll
[2013-11-19 10:05:13 | 000,610,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2013-11-19 10:05:13 | 000,116,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2013-11-19 10:05:13 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2013-11-19 10:05:12 | 000,111,616 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\IEAdvpack.dll
[2013-11-19 10:05:11 | 000,553,472 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript9diag.dll
[2013-11-19 10:05:11 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013-11-19 10:05:11 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmler.dll
[2013-11-19 10:05:10 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2013-11-19 10:05:09 | 000,942,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jsIntl.dll
[2013-11-19 10:05:09 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013-11-19 10:05:08 | 000,247,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msls31.dll
[2013-11-19 10:05:06 | 000,195,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msrating.dll
[2013-11-19 10:05:05 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2013-11-19 10:05:04 | 000,708,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9diag.dll
[2013-11-19 10:05:04 | 000,131,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\IEAdvpack.dll
[2013-11-19 10:05:04 | 000,090,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SetIEInstalledDate.exe
[2013-11-19 10:05:03 | 005,765,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2013-11-19 10:05:03 | 000,105,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2013-11-19 10:05:03 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmler.dll
[2013-11-19 10:05:02 | 000,574,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2013-11-19 10:05:01 | 000,077,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tdc.ocx
[2013-11-19 10:05:00 | 000,413,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2013-11-19 10:05:00 | 000,296,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtrans.dll
[2013-11-19 10:05:00 | 000,040,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2013-11-19 10:04:59 | 000,817,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2013-11-19 10:04:59 | 000,616,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dat
[2013-11-19 10:04:59 | 000,453,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtmsft.dll
[2013-11-19 10:04:59 | 000,218,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2013-11-19 10:04:59 | 000,081,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\icardie.dll
[2013-11-19 10:04:59 | 000,066,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2013-11-19 10:04:59 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2013-11-19 10:04:58 | 001,993,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2013-11-19 10:04:58 | 001,228,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmlmedia.dll
[2013-11-19 10:04:58 | 000,235,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2013-11-19 10:04:57 | 000,167,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iexpress.exe
[2013-11-19 10:04:57 | 000,143,872 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wextract.exe
[2013-11-19 10:04:57 | 000,101,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inseng.dll
[2013-11-19 10:04:57 | 000,084,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2013-11-19 10:04:57 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2013-11-19 10:04:56 | 000,626,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2013-11-19 10:04:56 | 000,548,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2013-11-19 10:04:53 | 000,139,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2013-11-19 10:04:52 | 000,147,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\occache.dll
[2013-11-19 10:04:52 | 000,062,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\pngfilt.dll
[2013-11-19 10:04:51 | 000,774,144 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2013-11-19 10:04:51 | 000,111,616 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieetwcollector.exe
[2013-11-19 10:04:51 | 000,083,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MshtmlDac.dll
[2013-11-19 10:04:51 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieetwproxystub.dll
[2013-11-19 10:04:51 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshta.exe
[2013-11-19 10:04:51 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieetwcollectorres.dll
[2013-11-19 10:04:50 | 000,135,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2013-11-19 10:04:50 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\imgutil.dll
[2013-11-18 13:17:11 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013-11-18 13:16:22 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2013-11-18 13:16:21 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2013-11-18 13:16:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2013-11-18 13:16:21 | 000,000,000 | —D | C] – C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013-11-18 13:04:26 | 001,474,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\crypt32.dll
[2013-11-18 13:03:48 | 001,930,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\authui.dll
[2013-11-18 13:03:48 | 001,796,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\authui.dll
[2013-11-18 13:03:48 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\credui.dll
[2013-11-18 13:03:48 | 000,190,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SmartcardCredentialProvider.dll
[2013-11-18 13:03:47 | 000,152,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\SmartcardCredentialProvider.dll
[2013-11-18 13:01:47 | 001,447,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lsasrv.dll
[2013-11-18 13:01:47 | 000,307,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncrypt.dll
[2013-11-18 13:01:47 | 000,135,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\sspicli.dll
[2013-11-18 13:01:47 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\sspisrv.dll
[2013-11-18 13:01:47 | 000,028,160 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\secur32.dll
[2013-11-18 13:01:39 | 000,404,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\gdi32.dll
[2013-11-18 13:00:03 | 000,830,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\nshwfp.dll
[2013-11-18 13:00:03 | 000,656,896 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\nshwfp.dll
[2013-11-18 13:00:03 | 000,324,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\FWPUCLNT.DLL
[2013-11-18 13:00:03 | 000,216,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\FWPUCLNT.DLL
[2013-11-18 10:37:12 | 000,000,000 | —D | C] – C:\sh4ldr
[2013-11-16 06:09:20 | 000,000,000 | —D | C] – C:\Program Files\Enigma Software Group
[2013-11-15 20:56:56 | 000,000,000 | —D | C] – C:\Users\A M\AppData\Roaming\Anvisoft
[2013-11-15 20:56:38 | 000,000,000 | —D | C] – C:\ProgramData\Anvisoft
[2013-11-11 08:22:48 | 000,000,000 | —D | C] – C:\Program Files (x86)\Gophoto.it
[2013-11-11 08:21:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Magnet-TV.com
[2009-04-03 06:09:46 | 000,142,152 | —- | C] (Microsoft Corporation) – C:\Users\A M\oarpman.exe
[2 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[2 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013-11-27 01:29:06 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013-11-27 01:29:06 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013-11-27 01:21:43 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013-11-27 01:21:15 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013-11-27 01:21:08 | 3144,871,936 | -HS- | M] () – C:\hiberfil.sys
[2013-11-27 01:17:01 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA1cec50a497766a2.job
[2013-11-27 01:15:00 | 000,000,948 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3951519764-547225608-714768077-1000UA1cec6df739957b0.job
[2013-11-26 21:15:28 | 000,789,612 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013-11-26 21:15:28 | 000,667,614 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013-11-26 21:15:28 | 000,124,252 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013-11-26 20:15:05 | 000,000,896 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3951519764-547225608-714768077-1000Core.job
[2013-11-26 20:03:13 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\A M\Desktop\OTL.exe
[2013-11-26 19:43:18 | 000,000,568 | —- | M] () – C:\Users\A M\Desktop\MBR.zip
[2013-11-26 19:42:35 | 000,000,512 | —- | M] () – C:\Users\A M\Desktop\MBR.dat
[2013-11-26 19:03:55 | 567,645,639 | —- | M] () – C:\Windows\MEMORY.DMP
[2013-11-26 18:54:07 | 004,745,728 | —- | M] (AVAST Software) – C:\Users\A M\Desktop\aswMBR.exe
[2013-11-26 18:48:04 | 000,035,237 | —- | M] () – C:\Users\A M\Desktop\mode sécurisé..rtf
[2013-11-26 18:44:53 | 000,891,200 | —- | M] () – C:\Users\A M\Desktop\SecurityCheck.exe
[2013-11-25 11:11:38 | 000,692,616 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2013-11-25 11:11:38 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013-11-25 10:50:02 | 000,112,098 | —- | M] () – C:\Users\A M\Desktop\Reassignment_Grievancees-Nov-2013.pdf
[2013-11-25 10:13:00 | 001,587,657 | —- | M] () – C:\Users\A M\Documents\F-Jazz-CFAU-Reassignment Grievances.pdf
[2013-11-21 08:56:00 | 000,055,667 | —- | M] () – C:\Users\A M\Desktop\Dec 2013.htm
[2013-11-19 10:05:44 | 000,940,032 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013-11-19 10:05:44 | 000,194,048 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\elshyph.dll
[2013-11-19 10:05:34 | 000,645,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\jsIntl.dll
[2013-11-19 10:05:34 | 000,235,008 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\elshyph.dll
[2013-11-19 10:05:33 | 000,071,680 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013-11-19 10:05:31 | 000,440,832 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2013-11-19 10:05:31 | 000,164,864 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msrating.dll
[2013-11-19 10:05:26 | 000,337,408 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2013-11-19 10:05:26 | 000,062,464 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\tdc.ocx
[2013-11-19 10:05:26 | 000,034,816 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2013-11-19 10:05:25 | 000,703,488 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2013-11-19 10:05:25 | 000,616,104 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dat
[2013-11-19 10:05:25 | 000,233,472 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2013-11-19 10:05:24 | 001,926,656 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2013-11-19 10:05:24 | 000,069,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\icardie.dll
[2013-11-19 10:05:23 | 001,051,136 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmlmedia.dll
[2013-11-19 10:05:23 | 000,083,456 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\inseng.dll
[2013-11-19 10:05:23 | 000,061,952 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2013-11-19 10:05:23 | 000,032,768 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2013-11-19 10:05:23 | 000,024,576 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2013-11-19 10:05:23 | 000,016,284 | —- | M] () – C:\Windows\SysWow64\ieuinit.inf
[2013-11-19 10:05:22 | 000,151,552 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iexpress.exe
[2013-11-19 10:05:22 | 000,139,264 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\wextract.exe
[2013-11-19 10:05:22 | 000,069,632 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2013-11-19 10:05:21 | 000,056,832 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\pngfilt.dll
[2013-11-19 10:05:15 | 000,127,488 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2013-11-19 10:05:15 | 000,112,128 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2013-11-19 10:05:15 | 000,061,952 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\MshtmlDac.dll
[2013-11-19 10:05:14 | 000,051,200 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieetwproxystub.dll
[2013-11-19 10:05:13 | 000,610,304 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2013-11-19 10:05:13 | 000,116,736 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2013-11-19 10:05:13 | 000,012,800 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2013-11-19 10:05:12 | 000,111,616 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\IEAdvpack.dll
[2013-11-19 10:05:11 | 000,553,472 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\jscript9diag.dll
[2013-11-19 10:05:11 | 000,074,240 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013-11-19 10:05:11 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmler.dll
[2013-11-19 10:05:10 | 000,086,016 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2013-11-19 10:05:09 | 000,942,592 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jsIntl.dll
[2013-11-19 10:05:09 | 000,086,016 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013-11-19 10:05:08 | 000,247,808 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msls31.dll
[2013-11-19 10:05:06 | 000,195,584 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msrating.dll
[2013-11-19 10:05:05 | 000,013,312 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2013-11-19 10:05:04 | 000,708,608 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jscript9diag.dll
[2013-11-19 10:05:04 | 000,131,072 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\IEAdvpack.dll
[2013-11-19 10:05:04 | 000,090,112 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\SetIEInstalledDate.exe
[2013-11-19 10:05:03 | 005,765,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2013-11-19 10:05:03 | 000,105,984 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2013-11-19 10:05:03 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshtmler.dll
[2013-11-19 10:05:02 | 000,574,976 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2013-11-19 10:05:01 | 000,077,312 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\tdc.ocx
[2013-11-19 10:05:00 | 000,413,696 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2013-11-19 10:05:00 | 000,296,960 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxtrans.dll
[2013-11-19 10:05:00 | 000,040,448 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2013-11-19 10:04:59 | 000,817,664 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2013-11-19 10:04:59 | 000,616,104 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dat
[2013-11-19 10:04:59 | 000,453,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxtmsft.dll
[2013-11-19 10:04:59 | 000,218,624 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2013-11-19 10:04:59 | 000,081,408 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\icardie.dll
[2013-11-19 10:04:59 | 000,066,048 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2013-11-19 10:04:59 | 000,033,792 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2013-11-19 10:04:59 | 000,016,284 | —- | M] () – C:\Windows\SysNative\ieuinit.inf
[2013-11-19 10:04:58 | 001,993,728 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2013-11-19 10:04:58 | 001,228,800 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshtmlmedia.dll
[2013-11-19 10:04:58 | 000,235,520 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2013-11-19 10:04:57 | 000,167,424 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iexpress.exe
[2013-11-19 10:04:57 | 000,143,872 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wextract.exe
[2013-11-19 10:04:57 | 000,101,376 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\inseng.dll
[2013-11-19 10:04:57 | 000,084,992 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2013-11-19 10:04:57 | 000,030,208 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2013-11-19 10:04:56 | 000,626,176 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2013-11-19 10:04:56 | 000,548,352 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2013-11-19 10:04:53 | 000,139,264 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2013-11-19 10:04:52 | 000,147,968 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\occache.dll
[2013-11-19 10:04:52 | 000,062,464 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\pngfilt.dll
[2013-11-19 10:04:51 | 000,774,144 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2013-11-19 10:04:51 | 000,111,616 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieetwcollector.exe
[2013-11-19 10:04:51 | 000,083,968 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\MshtmlDac.dll
[2013-11-19 10:04:51 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieetwproxystub.dll
[2013-11-19 10:04:51 | 000,013,824 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshta.exe
[2013-11-19 10:04:51 | 000,004,096 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieetwcollectorres.dll
[2013-11-19 10:04:50 | 000,135,680 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2013-11-19 10:04:50 | 000,048,128 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\imgutil.dll
[2013-11-16 06:11:12 | 000,000,000 | —- | M] () – C:\autoexec.bat
[2013-11-14 00:01:23 | 000,000,000 | —- | M] () – C:\Windows\SysWow64\igfxext.exe
[2013-11-06 10:53:15 | 000,005,027 | —- | M] () – C:\Users\A M\Desktop\Filling of Positions - Hotel Uniform.odt
[2013-10-28 10:07:11 | 000,047,450 | —- | M] () – C:\Users\A M\Desktop\Translate to another language ClientExec Community.htm
[2 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[2 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013-11-26 19:43:18 | 000,000,568 | —- | C] () – C:\Users\A M\Desktop\MBR.zip
[2013-11-26 19:42:35 | 000,000,512 | —- | C] () – C:\Users\A M\Desktop\MBR.dat
[2013-11-26 19:03:55 | 567,645,639 | —- | C] () – C:\Windows\MEMORY.DMP
[2013-11-26 18:44:53 | 000,891,200 | —- | C] () – C:\Users\A M\Desktop\SecurityCheck.exe
[2013-11-25 10:50:00 | 000,112,098 | —- | C] () – C:\Users\A M\Desktop\Reassignment_Grievancees-Nov-2013.pdf
[2013-11-25 10:13:00 | 001,587,657 | —- | C] () – C:\Users\A M\Documents\F-Jazz-CFAU-Reassignment Grievances.pdf
[2013-11-21 08:55:59 | 000,055,667 | —- | C] () – C:\Users\A M\Desktop\Dec 2013.htm
[2013-11-19 10:05:23 | 000,016,284 | —- | C] () – C:\Windows\SysWow64\ieuinit.inf
[2013-11-19 10:04:59 | 000,016,284 | —- | C] () – C:\Windows\SysNative\ieuinit.inf
[2013-11-16 06:11:12 | 000,000,000 | —- | C] () – C:\autoexec.bat
[2013-11-14 00:01:23 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\igfxext.exe
[2013-11-06 10:53:05 | 000,005,027 | —- | C] () – C:\Users\A M\Desktop\Filling of Positions - Hotel Uniform.odt
[2013-10-28 10:07:11 | 000,047,450 | —- | C] () – C:\Users\A M\Desktop\Translate to another language ClientExec Community.htm
[2013-08-19 00:39:38 | 000,142,519 | —- | C] () – C:\Windows\hpwins26.dat
[2013-08-19 00:39:38 | 000,000,370 | —- | C] () – C:\Windows\hpwmdl26.dat
[2013-07-21 06:31:01 | 000,000,057 | —- | C] () – C:\ProgramData\Ament.ini
[2013-03-18 12:09:40 | 000,110,592 | —- | C] () – C:\Windows\SysWow64\FsUsbExDevice.Dll
[2013-03-18 12:09:40 | 000,037,344 | —- | C] () – C:\Windows\SysWow64\FsUsbExDisk.Sys
[2012-06-26 15:02:40 | 000,030,568 | —- | C] () – C:\Windows\MusiccityDownload.exe
[2012-06-26 15:02:38 | 000,974,848 | —- | C] () – C:\Windows\SysWow64\cis-2.4.dll
[2012-06-26 15:02:38 | 000,081,920 | —- | C] () – C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012-06-26 15:02:38 | 000,065,536 | —- | C] () – C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012-06-26 15:02:38 | 000,057,344 | —- | C] () – C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012-04-14 07:57:47 | 000,000,085 | —- | C] () – C:\Users\A M\mm_backup.cfg
[2011-09-22 13:59:13 | 000,000,005 | -H– | C] () – C:\Users\A M\.zs
[2011-08-06 16:21:13 | 000,014,336 | —- | C] () – C:\Users\A M\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011-07-03 12:30:41 | 000,004,096 | -H– | C] () – C:\Users\A M\AppData\Local\keyfile3.drm
[2011-03-02 05:48:40 | 000,019,414 | —- | C] () – C:\Users\A M\AppData\Roaming\UserTile.png
[2011-01-31 02:11:39 | 007,773,586 | —- | C] () – C:\Users\A M\AppData\Local\census.cache
[2011-01-31 02:07:26 | 000,111,976 | —- | C] () – C:\Users\A M\AppData\Local\ars.cache
[2011-01-29 12:46:25 | 000,007,626 | —- | C] () – C:\Users\A M\AppData\Local\Resmon.ResmonCfg
[2010-06-24 14:32:36 | 000,000,494 | —- | C] () – C:\Users\A M\AppData\Roaming\wklnhst.dat
[2010-04-01 16:11:11 | 000,000,036 | —- | C] () – C:\Users\A M\AppData\Local\housecall.guid.cache
[2010-01-13 17:48:59 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat

========== ZeroAccess Check ==========

[2009-07-13 23:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2013-07-25 21:24:57 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2013-07-25 20:55:59 | 012,872,704 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2012-08-21 08:11:31 | 000,857,088 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2012-08-21 08:37:44 | 000,636,928 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2012-08-21 08:08:38 | 000,453,120 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >

Dede

Post #9November 27, 2013, 4:27 PM UTC

All processes killed
========== OTL ==========
Prefs.js: "http://search.toolba…De1K6Dx00gU&q=" removed from keyword.URL
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\A M\Desktop\cmd.bat deleted successfully.
C:\Users\A M\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
Restore point Set: OTL Restore Point

[EMPTYJAVA]

User: All Users

User: A M
->Java cache emptied: 0 bytes

User: Default

User: Default User

User: Guest
->Java cache emptied: 0 bytes

User: Public

Total Java Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: A M
->Temp folder emptied: 142782830 bytes
->Temporary Internet Files folder emptied: 118103075 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 136935748 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Opera cache emptied: 8548864 bytes
->Flash cache emptied: 57013 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56502 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 664856 bytes
->Temporary Internet Files folder emptied: 55273627 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 42590 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 48592 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 4776116 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 753 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33298 bytes
RecycleBin emptied: 2645303747 bytes

Total Files Cleaned = 2,968.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 11272013_010946

Files\Folders moved on Reboot…
C:\Users\A M\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\A M\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
File move failed. C:\Windows\SysWow64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat scheduled to be moved on reboot.

PendingFileRenameOperations files…

Registry entries deleted on Reboot…

Dede

Post #10November 27, 2013, 4:30 PM UTC

On my C drive I found a suspicious file named sh4ldr. Any idea what that is?

Dede

Post #11November 27, 2013, 6:17 PM UTC

I have tried to make the pop up appear under the same conditions as it appeared before, and it does not pop up anymore.

OCD

Post #12November 27, 2013, 8:33 PM UTC

Hi Dede,

[external image: bullseye_zpse9eaf36e.gif] Run OTL.exe

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.87.1.220:8080
FF - prefs.js..keyword.URL: "http://search.toolba…De1K6Dx00gU&q="
FF - user.js - File not found

:Commands
[purity]
[createrestorepoint]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done

=========================

[external image: bullseye_zpse9eaf36e.gif] Malwarebytes' Anti-Malware

Locate Malwarebytes' Anti-Malware (it should be on your desktop).
If not, download it here

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
Once the program has loaded, select the Update tab to get the latest updates before performing the scan.
Select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

=========================

[external image: bullseye_zpse9eaf36e.gif] ESET Online Scanner

*Note:

It is recommended to disable on-board antivirus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your anti-spyware programs.

** You need to run your browser with Administrator Rights, to do so right click your browsers short cut and select "Run as Administrator".

= = = = = = = = = = = = = = = = = = = =

Go here to run ESET Online Scanner

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Disable your Antivirus software. You can usually do this with its Notification Tray icon near the clock
Click Start
Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
Click Scan.
Wait for the scan to finish.
When the scan completes, click List of found threats
click Export to Text file and save the file to your desktop using a unique name, such as ESETScan.
Include the contents of this report in your next reply

Note - when ESET doesn't find any threats, no report will be created.
Push the back button.
Push Finish
Re-enable your Antivirus software.

=========================

[external image: bullseye_zpse9eaf36e.gif] Show Hidden Files & Folders in Windows 7

To show hidden files, just click on the Organize button in any folder, and then select “Folder and Search Options” from the menu.
Click the View tab, and then you should select “Show hidden files and folders” in the list.
Then click OK.

=========================

On my C drive I found a suspicious file named sh4ldr. Any idea what that is?

Your log shows this as a folder, is there anything in the folder?

[2013-11-18 10:37:12 | 000,000,000 | —D | C] – C:\sh4ldr

=========================

In your next post please provide the following:

OTL fix log
MBAM log
ESET's log.txt
How is the computer running?

Dede

Post #13November 29, 2013, 5:11 AM UTC last edited November 29, 2013, 3:03 PM UTC

Hi OCD.

C:\sh4ldr is a folder, and it contains these files:

initrd.gz

shldr

shldr.mbr

vmlinuz

Next the files:

OTL fix log;

All processes killed
========== OTL ==========
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Prefs.js: "http://search.toolba…De1K6Dx00gU&q=" removed from keyword.URL
========== COMMANDS ==========
Restore point Set: OTL Restore Point

[EMPTYTEMP]

User: All Users

User: A M
->Temp folder emptied: 418575 bytes
->Temporary Internet Files folder emptied: 2553 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 20543435 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Opera cache emptied: 3135343 bytes
->Flash cache emptied: 814 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 25207 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 23.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 11282013_132954

Files\Folders moved on Reboot…
C:\Users\A M\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files…

Registry entries deleted on Reboot…

MBAM log

Malwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org

Database version: v2013.11.28.10

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16428
A M :: AM [administrator]

Protection: Enabled

28-Nov-13 1:41:20 PM
mbam-log-2013-11-28 (13-41-20).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 238839
Time elapsed: 12 minute(s), 8 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

ESET log

C:\Users\A M\Downloads\cbsidlm-cbsi145-FrenchEnglish_Collins_Dictionary-ORG-75329826.exe a variant of Win32/CNETInstaller.B application

I just had the pop up come back.

transfering data from content.yieldmanager.edgesuite.net…

A popup telling me that I am runing low on disk space…

OCD

Post #14November 29, 2013, 5:37 PM UTC

Hi Dede,

Offline yesterday due to Thanksgiving I appreciate your patience.

=========================

C:\sh4ldr is a folder, and it contains these files:

Do you have a dual boot system?
Did you have SpyHunter installed at one time?

=========================

What browser are you using when you get the pop-ups?

=========================

A popup telling me that I am runing low on disk space…

Drive C: | 285.99 Gb Total Space | 74.55 Gb Free Space | 26.07% Space Free | Partition Type: NTFS

As you can see by this line from your OTL log you are getting close to 20% of free space on your hard drive. Some system tools (defrag) may not run efficiently when your free space is below 20%. It's basically just a warning. You might want to see if there are any old programs you no longer use that can be removed, or if you have extensive audio, photo or video files move them to an external source. (burn to CD's of an external drive)

Dede

Post #15November 29, 2013, 7:04 PM UTC

Happy Thanks giving OCD.

I am not in a hurry, and I am also fully prepared to reformat if necessary even though that would involve a lot of work.

Here is a bit more info on what is happening:

The HDD is fairly full, but nothing too bad yet.

I believe that I had spy hunter installed.

This is not a dual boot system, It only has Windows 7 home premium 64 bit instaled.

The pop-up's only happen with Firefox.

Specifically when I click on login on the site that is in the attached photo.

I thought that if I attached a picture, you would understand better. (I cannot find the attach option).

The pop-up shows transfering data from content.yieldmanager.com and in the top left corner of the pop-up, the url address of the underlying website is shown.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Yielmanager pop up in firefox [Solved]

✨ Ask AI

Ask AI