31 replies to this topic

[EricWoods]

McAfee installation errors attached.

[jeffce]

 
Please open OTL.

• Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, click the None button near the top (it may looked greyed out)
• In the Extra Registry section change it to All
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open 2 notepad windows, OTL.Txt and Extra.txt. Please post the Extra.txt.
----------

[EricWoods]

Had to keep LogMeInRescue window open, as that's how I'm accessing this machine.

 

OTL Extras logfile created on: 1/21/2014 2:24:04 PM - Run 7

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\SRE Lab\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.16428)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

7.80 Gb Total Physical Memory | 5.98 Gb Available Physical Memory | 76.63% Memory free

15.60 Gb Paging File | 13.41 Gb Available in Paging File | 85.94% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 573.97 Gb Total Space | 357.28 Gb Free Space | 62.25% Space Free | Partition Type: NTFS

Drive D: | 21.91 Gb Total Space | 3.19 Gb Free Space | 14.58% Space Free | Partition Type: NTFS

 

Computer Name: SRELAB-HP | User Name: SRE Lab | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

 

========== Extra Registry (All) ==========

 

 

========== File Associations ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.chm[@ = chm.file] -- C:\Windows\hh.exe (Microsoft Corporation)

.cpl[@ = cplfile] -- C:\Windows\SysNative\control.exe (Microsoft Corporation)

.hlp[@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.hta[@ = htafile] -- C:\Windows\SysWOW64\mshta.exe (Microsoft Corporation)

.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

.inf[@ = inffile] -- C:\Windows\SysNative\NOTEPAD.EXE (Microsoft Corporation)

.ini[@ = inifile] -- C:\Windows\SysNative\NOTEPAD.EXE (Microsoft Corporation)

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

.js[@ = JSFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)

.jse[@ = JSEFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)

.reg[@ = regfile] -- C:\Windows\regedit.exe (Microsoft Corporation)

.txt[@ = txtfile] -- C:\Windows\SysNative\NOTEPAD.EXE (Microsoft Corporation)

.vbe[@ = VBEFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)

.vbs[@ = VBSFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)

.wsf[@ = WSFFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)

.wsh[@ = WSHFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.bat [@ = batfile] -- "%1" %*

.chm [@ = chm.file] -- C:\Windows\hh.exe (Microsoft Corporation)

.cmd [@ = cmdfile] -- "%1" %*

.com [@ = comfile] -- "%1" %*

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.exe [@ = exefile] -- "%1" %*

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.hta [@ = htafile] -- C:\Windows\SysWOW64\mshta.exe (Microsoft Corporation)

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

.inf [@ = inffile] -- C:\Windows\SysWow64\NOTEPAD.EXE (Microsoft Corporation)

.ini [@ = inifile] -- C:\Windows\SysWow64\NOTEPAD.EXE (Microsoft Corporation)

.url [@ = InternetShortcut] -- C:\Windows\SysWow64\rundll32.exe (Microsoft Corporation)

.js [@ = JSFile] -- C:\Windows\SysWow64\WScript.exe (Microsoft Corporation)

.jse [@ = JSEFile] -- C:\Windows\SysWow64\WScript.exe (Microsoft Corporation)

.pif [@ = piffile] -- "%1" %*

.reg [@ = regfile] -- C:\Windows\SysWow64\regedit.exe (Microsoft Corporation)

.scr [@ = scrfile] -- "%1" /S

.txt [@ = txtfile] -- C:\Windows\SysWow64\NOTEPAD.EXE (Microsoft Corporation)

.vbe [@ = VBEFile] -- C:\Windows\SysWow64\WScript.exe (Microsoft Corporation)

.vbs [@ = VBSFile] -- C:\Windows\SysWow64\WScript.exe (Microsoft Corporation)

.wsf [@ = WSFFile] -- C:\Windows\SysWow64\WScript.exe (Microsoft Corporation)

.wsh [@ = WSHFile] -- C:\Windows\SysWow64\WScript.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

 

========== Shell Spawning ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)

batfile [open] -- "%1" %*

batfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

chm.file [open] -- "C:\Windows\hh.exe" %1 (Microsoft Corporation)

cmdfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)

cmdfile [open] -- "%1" %*

cmdfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htafile [open] -- C:\Windows\SysWOW64\mshta.exe "%1" %* (Microsoft Corporation)

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

inffile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)

inffile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

inifile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)

inifile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

jsfile [edit] -- C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)

jsfile [open] -- C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)

jsfile [print] -- C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)

jsefile [edit] -- C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)

jsefile [open] -- C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)

jsefile [print] -- C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [edit] -- %SystemRoot%\system32\notepad.exe "%1" (Microsoft Corporation)

regfile [open] -- regedit.exe "%1" (Microsoft Corporation)

regfile [merge] -- Reg Error: Key error.

regfile [print] -- %SystemRoot%\system32\notepad.exe /p "%1" (Microsoft Corporation)

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

txtfile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)

txtfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

txtfile [printto] -- %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" (Microsoft Corporation)

vbefile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)

vbefile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)

vbefile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)

vbsfile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)

vbsfile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)

vbsfile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)

wsffile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)

wsffile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)

wsffile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)

wshfile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [Browse with Corel PaintShop Photo Pro X3] -- "c:\Program Files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\Corel Paint Shop Pro Photo.exe" "%L" (Corel, Inc.)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)

batfile [open] -- "%1" %*

batfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

chm.file [open] -- "C:\Windows\hh.exe" %1 (Microsoft Corporation)

cmdfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)

cmdfile [open] -- "%1" %*

cmdfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htafile [open] -- C:\Windows\SysWOW64\mshta.exe "%1" %* (Microsoft Corporation)

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

inffile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)

inffile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

inifile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)

inifile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

jsfile [edit] -- C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)

jsfile [open] -- C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)

jsfile [print] -- C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)

jsefile [edit] -- C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)

jsefile [open] -- C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)

jsefile [print] -- C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [edit] -- %SystemRoot%\system32\notepad.exe "%1" (Microsoft Corporation)

regfile [open] -- regedit.exe "%1" (Microsoft Corporation)

regfile [merge] -- Reg Error: Key error.

regfile [print] -- %SystemRoot%\system32\notepad.exe /p "%1" (Microsoft Corporation)

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

txtfile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)

txtfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

txtfile [printto] -- %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" (Microsoft Corporation)

vbefile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)

vbefile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)

vbefile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)

vbsfile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)

vbsfile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)

vbsfile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)

wsffile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)

wsffile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)

wsffile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)

wshfile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [Browse with Corel PaintShop Photo Pro X3] -- "c:\Program Files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\Corel Paint Shop Pro Photo.exe" "%L" (Corel, Inc.)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

 

========== Security Center Settings ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 

========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

 

 

========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{4168F917-BE49-4E00-A278-74EBFA193AA8}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe | 

"{8D5E278C-213D-4CE3-8911-90B8800B929C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 

"{979C2EA4-46E3-46CE-B1EB-6DF8F05B7DCD}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{B99ADA06-7F1B-45E0-97CF-111F9757A78F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{CE673816-3393-4E25-B87A-1B3DDD974AE5}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 

"{D35FCAD1-99C5-4214-8E47-A2D7ACB638EB}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{E9E4751D-0124-4FC5-82AE-DD3D66386412}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 

 

========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{04F3BBA4-5DDA-48E0-9F47-086467164F88}" = protocol=6 | dir=in | app=c:\users\sre lab\appdata\roaming\spotify\spotify.exe | 

"{06067CB7-F81F-4612-A66A-DC7A681C9ED8}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hpdvdsmart.exe | 

"{08BED549-B4F7-49F9-B577-35129845CC23}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{0A5A734E-0E07-4734-88E9-3AFBEC275021}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 

"{10DADACC-FCBF-490C-B296-AD9E66EC721D}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\kernel\clml\clmlsvc.exe | 

"{156C006E-B97C-49D0-94F8-1FBCD6D7307A}" = protocol=17 | dir=in | app=c:\program files (x86)\cinemanow\cinemanow media manager\cinemanowshell.exe | 

"{1F00C63F-93DE-41AD-9C39-5AA6BCAFC473}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 

"{2115D4E4-AD61-404B-A0C7-D8239C612A9D}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{2DDF4D22-28AE-4725-B00C-49F49ABCFA03}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 

"{3359ABE1-D3AB-4692-BE9E-383D11E92215}" = dir=in | app=c:\program files (x86)\hewlett-packard\mediasmart\photo\hpmediasmartphoto.exe | 

"{34F2ACBB-324A-4726-A7EB-709B11C058E2}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\tsmagent.exe | 

"{3DE3C434-69C0-4EDA-A8EB-FF290B70DCCD}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe | 

"{49EDC7DB-4A30-4A2F-8A43-68B649769CDD}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{4B657FAB-3886-4D71-B736-40F299CD8173}" = protocol=6 | dir=in | app=c:\program files (x86)\hewlett-packard\mediasmart\cinemanow\cinemanow.exe | 

"{4BFF18A1-0254-4268-8C22-37029B776360}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{51E421D5-3E97-4D4E-A900-910941E8647E}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartphoto.exe | 

"{5328FC72-25DA-4769-8E5B-DF9C6DC9BDE1}" = protocol=6 | dir=in | app=c:\program files (x86)\cinemanow\cinemanow media manager\cinemanowshell.exe | 

"{56D93D51-EE38-494D-B92B-58B07FC6A0E3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{691F19B6-4A18-42E9-81CA-B2EA836D35E5}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 

"{7DF74D46-7097-4D42-8572-B21E0C939135}" = protocol=6 | dir=in | app=c:\users\sre lab\appdata\roaming\spotify\spotify.exe | 

"{7F7DE8BF-B2B0-4B96-814E-65720BBC5BC8}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartvideo.exe | 

"{948809D4-5E3D-4F9A-81EE-DF6C51B0D5D4}" = protocol=17 | dir=in | app=c:\users\sre lab\appdata\roaming\spotify\spotify.exe | 

"{B4A3D79C-9A8A-4F1C-9CBC-A7263D50584E}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 

"{C39736AB-74A4-4087-9647-9680CF4CBC11}" = dir=in | app=c:\program files (x86)\hewlett-packard\mediasmart\video\hpmediasmartvideo.exe | 

"{C91F606E-4766-47E8-B3E4-A926CB2B2083}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 

"{CBBD288B-F033-4015-8B4A-F082F1032AF5}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe | 

"{D1D198EB-855F-4C0C-A15E-E209575C43FE}" = protocol=17 | dir=in | app=c:\program files (x86)\hewlett-packard\mediasmart\cinemanow\cinemanow.exe | 

"{DE3AE2B4-012C-423D-9ED3-8DDBECA92D72}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartmusic.exe | 

"{E55AF624-9929-4C70-9EF1-82C224443BF8}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 

"{E7ACA930-B9A9-4D51-BD57-AE59E44A7C89}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\music\hptouchsmartmusic.exe | 

"{EE2ED78E-D6E7-4C6C-B9E7-57E74D8E5780}" = protocol=17 | dir=in | app=c:\users\sre lab\appdata\roaming\spotify\spotify.exe | 

"{EEBB8EDC-84BD-4B96-A1A8-481730009B20}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe | 

"{F6FB9858-0230-46C0-B104-DBA1AFACD782}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr8.exe | 

"{FCB35597-E50F-4752-A89F-2A55C78CE0D1}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 

"TCP Query User{9484A0A7-ACC6-4A8D-A986-9F860EF3A261}C:\users\sre lab\appdata\local\logmein rescue applet\lmir000a.tmp\lmi_rescue.exe" = protocol=6 | dir=in | app=c:\users\sre lab\appdata\local\logmein rescue applet\lmir000a.tmp\lmi_rescue.exe | 

"UDP Query User{AD6C9560-BF37-4BF3-BA6F-CFE774C95290}C:\users\sre lab\appdata\local\logmein rescue applet\lmir000a.tmp\lmi_rescue.exe" = protocol=17 | dir=in | app=c:\users\sre lab\appdata\local\logmein rescue applet\lmir000a.tmp\lmi_rescue.exe | 

 

========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{1F6B7CB0-66D8-4B31-BF1F-D2318E58080E}" = HP SimplePass Identity Protection

"{23401053-03B3-845A-A946-32BEB58AB5AC}" = ccc-utility64

"{299625B9-6C69-462C-9CEA-8E06D878B1C5}" = HP 3D DriveGuard

"{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support

"{34DA4817-68E1-CC8B-A9A5-392095FA28C9}" = ATI Catalyst Install Manager

"{426FAE9F-7373-496E-A215-9DB7EF4398CF}" = Validity Sensors DDK

"{4B4E2FA2-3B1E-4147-99DB-5033981D8C2F}" = HP MediaSmart Movies and TV

"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

"{5EEC477F-8E9B-4420-8829-16E7426227DB}" = Windows Live MIME IFilter

"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour

"{731A1D36-BF17-4C76-B7E7-CC055AF8C54E}" = HP MediaSmart SmartMenu

"{76FF0F03-B707-4332-B5D1-A56C8303514E}" = iTunes

"{7DEBE4EB-6B40-3766-BB35-5CBBC385DA37}" = Microsoft .NET Framework 4.5.1

"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{90140000-0015-0409-1000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010

"{90140000-0016-0409-1000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010

"{90140000-0018-0409-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010

"{90140000-0019-0409-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010

"{90140000-001A-0409-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010

"{90140000-001B-0409-1000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010

"{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010

"{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010

"{90140000-001F-0C0A-1000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010

"{90140000-002C-0409-1000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010

"{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010

"{90140000-0043-0409-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (English) 2010

"{90140000-0044-0409-1000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010

"{90140000-006E-0409-1000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010

"{90140000-00A1-0409-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010

"{90140000-00BA-0409-1000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010

"{90140000-0115-0409-1000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010

"{90140000-0117-0409-1000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010

"{91140000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2010

"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.1

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{B5FC1E1B-E70D-45F1-8E40-A3C30698B323}" = HP Wireless Assistant

"{CE52672C-A0E9-4450-8875-88A221D5CD50}" = Windows Live ID Sign-in Assistant

"{E9FA781F-3E80-4399-825A-AD3E11C28C77}" = MSVCRT110_amd64

"{EF79C448-6946-4D71-8134-03407888C054}" = Shared C Run-time for x64

"{F6246243-CF06-4E40-8A37-C3B537695C36}" = Share64

"{F83779DF-E1F5-43A2-A7BE-732F856FADB7}" = Microsoft SQL Server Compact 3.5 SP1 x64 English

"Broadcom 802.11 Wireless LAN Adapter" = Broadcom 802.11 Wireless LAN Adapter

"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010

"SynTPDeinstKey" = Synaptics Pointing Device Driver

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"_{D1AEB5DB-04FA-489D-94EF-8600898B93EE}" = Corel PaintShop Photo Pro X3

"_{F072CA07-A781-45E4-9975-C033A73019CF}" = Corel VideoStudio Pro X3

"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam 5

"{03D562B5-C4E2-4846-A920-33178788BE00}" = Windows Live Communications Platform

"{07E49BC1-24FF-4D7A-AC74-727BE95801AF}" = LightScribe System Software

"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements

"{0A653E82-9056-A08A-8262-62F59FF285C7}" = CCC Help Korean

"{0D542538-335E-08BA-21C5-62E9A7B2BE60}" = Catalyst Control Center InstallProxy

"{0F929651-F516-4956-90F2-FFBD2CD5D30E}" = Photo Gallery

"{0FF9CC94-EF23-401E-BDBD-37403D1A2B38}" = Windows Live SOXE Definitions

"{11A63D4E-6512-6D57-8690-3D656A483AB0}" = CCC Help French

"{120262A6-7A4B-4889-AE85-F5E5688D3683}" = Roxio CinemaNow 2.0

"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime

"{147D8BB7-FEE8-5D53-390D-7FB94FC26BC8}" = CCC Help Italian

"{16734097-34B9-C5E3-7863-7A9CAAEB391F}" = ccc-core-static

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite

"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com

"{2AC01935-3774-4981-98C8-14E93C14372C}" = Windows Live UX Platform Language Pack

"{3023EBDA-BF1B-4831-B347-E5018555F26E}" = Movie Theme Pack for HP MediaSmart Video

"{35772A32-7A3D-A8FC-840C-B84B536E62FD}" = CCC Help Swedish

"{3877C901-7B90-4727-A639-B6ED2DD59D43}" = ESU for Microsoft Windows 7

"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology

"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go

"{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}" = HP Advisor

"{42C095E5-4CE2-A376-9893-93431C6A236E}" = CCC Help Dutch

"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = Recovery Manager

"{45898170-E68C-4F02-AA35-C2186BF347A3}" = Movie Maker

"{4B156358-CE9C-4E9F-8CAD-79AE86A68C60}" = HP Power Manager

"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.11

"{543F949F-2B95-448F-9F2E-56F0C5FF8E2C}" = Catalyst Control Center - Branding

"{5A0EE0F0-E909-4F3B-B437-AAD9252427CB}" = Windows Live Installer

"{5BA6D86E-AA0D-05FF-09B5-ED3CD5277A42}" = CCC Help German

"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support

"{5E094C92-6288-4F43-AA9A-D452D0218F3F}" = Windows Live Essentials

"{6389F199-1D6C-4974-9557-693F9DD48736}" = Windows Live Writer Resources

"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components

"{6B65BA9C-2E00-3BCB-8EA5-94A7841B39C1}" = CCC Help Thai

"{6B6923B9-8719-425B-916C-CD2908F31AAF}" = Windows Live SOXE

"{6C122441-1861-4CD7-B1C5-A163A6984E12}" = CinemaNow Media Manager

"{6DAF8CDC-9B04-413B-A0F2-BCC13CF8A5BF}" = HP MediaSmart Photo

"{70743ADB-DD63-DA15-1E6C-32D88C54E04D}" = CCC Help English

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{72D90DB3-A16A-4545-B555-868471101833}" = HP Setup

"{778E3C06-48EB-79CA-775E-BEA3086896AD}" = CCC Help Japanese

"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update

"{7A083F0E-189D-9100-8883-3B7E75B53E3F}" = CCC Help Chinese Traditional

"{7C6F0282-3DCD-4A80-95AC-BB298E821C44}" = Windows Live Writer

"{7D4318AC-9560-46F0-910F-0B38D6CDC009}" = HP Documentation

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows 7

"{89870E0D-9602-41F8-9E83-14F6849346A4}" = Windows Live Mail

"{89C7E0A7-4D9D-4DCC-8834-A9A2B92D7EBB}" = Photo Gallery

"{8AE4C1DF-D685-56CB-4B4E-181A12FFAF55}" = CCC Help Turkish

"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT

"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110

"{9008D736-35CA-40DB-A2BE-5F32D954E5AA}" = HP MediaSmart CinemaNow 2.0

"{91A34181-9FAD-43AB-A35F-E7A8945B7E1C}" = HP MediaSmart Music

"{925BC35B-CA11-577E-95C7-67C5BD4776BA}" = Catalyst Control Center Graphics Previews Common

"{93138715-2252-4107-C3C6-D7F8ACAD4956}" = CCC Help Finnish

"{95A73EEC-18CA-0C70-2E88-C6F901C69583}" = CCC Help Russian

"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9C6D5C94-386A-4DE7-B99F-523D3F167B9A}" = Windows Live Messenger

"{9C7243A7-5C0E-3190-A042-01D88F7BB791}" = CCC Help Portuguese

"{9ECF7817-DB11-4FBA-9DF1-296A578D513A}" = Adobe Shockwave Player 11.5

"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AA6F75E4-1807-4AAF-8CCC-4B9A48476BA5}" = Catalyst Control Center Localization All

"{AAA94EAA-40A4-458C-9D86-D1DA765B51D5}" = Windows Live Writer

"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.06)

"{ACF5C43A-3E69-ED63-FCF9-831B3B9D1516}" = CCC Help Polish

"{AF144D2F-E890-B537-DC7C-DE01A8AC5405}" = CCC Help Norwegian

"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync

"{B286BAC3-CBE6-4854-BF68-EB72A34CEA56}" = Windows Live Messenger

"{B39A6825-EA20-43EA-AB2D-A6BC0298D9A1}" = Movie Maker

"{B4201487-FA15-8BCC-6833-E355A43CCCDB}" = Catalyst Control Center Graphics Previews Vista

"{B5DE2511-C5D3-0AAC-0470-606067398EBB}" = CCC Help Chinese Standard

"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call

"{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}" = Energy Star Digital Logo

"{BDDA1E1E-204E-4368-B0C2-737F16B76307}" = HP MediaSmart/TouchSmart Netflix

"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint

"{C6B0EE9E-2128-4448-B7AE-5E2B46E0F0E7}" = Windows Live Photo Common

"{C77A8D2F-DE6E-E548-FA06-C56251441D95}" = CCC Help Spanish

"{C8871195-1265-0859-CC55-ADE112EEF7D3}" = Times Reader

"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector

"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64

"{D12E3E7F-1B13-4933-A915-16C7DD37A095}" = HP MediaSmart Video

"{D1612A3D-0DCC-4055-BB6A-0036F31158A0}" = Setup

"{D1AEB5DB-04FA-489D-94EF-8600898B93EE}" = ICA

"{D1F80EFD-A032-4E8E-A367-70C44AD4DCE0}" = ISCOM

"{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow!

"{D604900F-A275-416C-AF9D-CDEDF58B72DB}" = Windows Live Mail

"{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}" = Intel® Turbo Boost Technology Driver

"{DA4BF4BE-3CDC-43B5-BBDA-DDDA73103111}" = Corel PaintShop Photo Pro X3

"{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD

"{DCD941B6-F2E7-4FAF-B102-F7D4DE5FF99A}" = IPM_PSP_Pro

"{DCF1928A-FC01-48E7-A7E6-4651D42EF6A1}" = PSPPRO_DCRAW

"{DD7C5FC1-DCA5-487A-AF23-658B1C00243F}" = Photo Common

"{DF8B9311-ADE7-4EDE-B121-326CAA3D225D}" = PSPPContent

"{E05DB9F9-C8E7-45F2-BE9E-76D4C447CE9B}" = HP Software Framework

"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10

"{E2A97415-BD97-4867-B906-05E39E9EE51F}" = HL-2270DW

"{E342D296-DB9D-4FC7-ACB0-39926C0BFA16}" = HP Quick Launch

"{E3445598-4424-4EE2-B71C-C23325F7FB71}" = Windows Live PIMT Platform

"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series

"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio

"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime

"{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}" = Microsoft SQL Server Compact 3.5 SP1 English

"{E93EAD24-E483-52AA-2E6F-C792E51E3F92}" = CCC Help Czech

"{ECB2E743-BFBD-7C77-6C62-F54ACD0ECE6D}" = CCC Help Hungarian

"{EFBCA571-617D-484A-9ECA-E301BB6D0750}" = Windows Live Writer

"{F069C491-69E6-4D9B-9A0C-B7894A1FA97C}" = Setup

"{F072CA07-A781-45E4-9975-C033A73019CF}" = ICA

"{F0A06BEC-E4BA-DB4F-C3DF-37A3C77780EF}" = CCC Help Danish

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F0E58739-2B4C-498F-9B0D-FF0F2FD52B61}" = Windows Live UX Platform

"{F206FEC3-F5DD-43FD-A8CF-9C46B8A6A92C}" = VSPro

"{F4E9851F-765E-40B7-9859-237C2724E62C}" = DeviceIO

"{F6A76E9C-C299-4CFA-AD2A-57FE9DD68B70}" = Contents

"{F6F30C28-38AA-4DBA-AE0B-7E30238E61BB}" = Junk Mail filter update

"{F8423392-2296-4748-9B66-344432459632}" = PureHD

"{F909BD3C-8684-4ACF-B7C3-33F4F9F901B7}" = Share

"{F90DE865-1A3D-D6D6-0638-F1D2EFCB5C29}" = PX Profile Update

"{F95C8C1F-25BB-44EC-A7E6-5C17ABC6BC71}" = VIO

"{FB0B6DDD-DF3E-4CD6-927C-724AB854E322}" = VSClassic

"{FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}" = DVD Menu Pack for HP MediaSmart Video

"{FD67D9F3-FED6-4A2E-9D6C-8C8C44DEF8FF}" = IPM_VS_Pro

"{FD7DDB2A-445B-78D3-EAFB-6F7BE425285E}" = CCC Help Greek

"{FE661711-E392-4B3F-A4A7-02C747C09134}" = ISCOM

"Adobe AIR" = Adobe AIR

"Adobe Digital Editions 2.0" = Adobe Digital Editions 2.0

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Audacity_is1" = Audacity 2.0.3

"com.nyt.timesreader.78C54164786ADE80CB31E1C5D95607D0938C987A.1" = Times Reader

"Google Chrome" = Google Chrome

"HP DVB-T TV Tuner" = HP DVB-T TV Tuner 8.0.64.43

"HP Photo Creations" = HP Photo Creations

"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam 5

"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite

"InstallShield_{3023EBDA-BF1B-4831-B347-E5018555F26E}" = Movie Theme Pack for HP MediaSmart Video

"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go

"InstallShield_{6DAF8CDC-9B04-413B-A0F2-BCC13CF8A5BF}" = HP MediaSmart Photo

"InstallShield_{91A34181-9FAD-43AB-A35F-E7A8945B7E1C}" = HP MediaSmart Music

"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint

"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector

"InstallShield_{D12E3E7F-1B13-4933-A915-16C7DD37A095}" = HP MediaSmart Video

"InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow!

"InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD

"InstallShield_{FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}" = DVD Menu Pack for HP MediaSmart Video

"My HP Game Console" = HP Game Console

"WildTangent hp Master Uninstall" = HP Games

"Windows Media Encoder 9" = Windows Media Encoder 9 Series

"WinLiveSuite" = Windows Live Essentials

"WT087328" = Blackhawk Striker 2

"WT087335" = Build-a-lot 2

"WT087342" = Dora's Carnival Adventure

"WT087360" = Escape Rosecliff Island

"WT087361" = FATE

"WT087362" = Final Drive Nitro

"WT087372" = Heroes of Hellas 2 - Olympia

"WT087373" = Jewel Quest 3

"WT087379" = Jewel Quest Solitaire 2

"WT087394" = Penguins!

"WT087395" = Poker Superstars III

"WT087396" = Polar Bowler

"WT087397" = Polar Golfer

"WT087414" = Virtual Families

"WT087415" = Wheel of Fortune 2

"WT087428" = Bejeweled 2 Deluxe

"WT087453" = Chuzzle Deluxe

"WT087501" = Plants vs. Zombies

"WT087513" = Virtual Villagers - The Secret City

"WT087533" = Zuma Deluxe

"WT087536" = Diner Dash 2 Restaurant Rescue

 

========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"HuluDesktop" = Hulu Desktop

"Spotify" = Spotify

 

========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 12/19/2013 12:29:18 AM | Computer Name = SRELab-HP | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 12/19/2013 12:29:18 AM | Computer Name = SRELab-HP | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 8034

 

Error - 12/19/2013 12:29:18 AM | Computer Name = SRELab-HP | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 8034

 

Error - 12/19/2013 12:29:19 AM | Computer Name = SRELab-HP | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 12/19/2013 12:29:19 AM | Computer Name = SRELab-HP | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 9048

 

Error - 12/19/2013 12:29:19 AM | Computer Name = SRELab-HP | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 9048

 

Error - 12/19/2013 12:29:20 AM | Computer Name = SRELab-HP | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 12/19/2013 12:29:20 AM | Computer Name = SRELab-HP | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 10047

 

Error - 12/19/2013 12:29:20 AM | Computer Name = SRELab-HP | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 10047

 

Error - 12/19/2013 12:29:21 AM | Computer Name = SRELab-HP | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

[ HP Wireless Assistant Events ]

Error - 3/28/2012 12:37:37 PM | Computer Name = SRELab-HP | Source = HP WA Service | ID = 0

Description = System.Runtime.InteropServices.COMException The RPC server is unavailable.

 (Exception from HRESULT: 0x800706BA)    at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32

 errorCode, IntPtr errorInfo)     at System.Management.ManagementScope.InitializeGuts(Object

 o)     at System.Management.ManagementScope.Initialize()     at System.Management.ManagementObject.Initialize(Boolean

 getObject)     at System.Management.ManagementBaseObject.get_Properties()     at System.Management.ManagementBaseObject.GetPropertyValue(String

 propertyName)     at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

 

Error - 3/28/2012 12:37:42 PM | Computer Name = SRELab-HP | Source = HP WA Service | ID = 0

Description = System.Runtime.InteropServices.COMException The RPC server is unavailable.

 (Exception from HRESULT: 0x800706BA)    at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32

 errorCode, IntPtr errorInfo)     at System.Management.ManagementScope.InitializeGuts(Object

 o)     at System.Management.ManagementScope.Initialize()     at System.Management.ManagementObject.Initialize(Boolean

 getObject)     at System.Management.ManagementBaseObject.get_Properties()     at System.Management.ManagementBaseObject.GetPropertyValue(String

 propertyName)     at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

 

Error - 3/28/2012 12:37:47 PM | Computer Name = SRELab-HP | Source = HP WA Service | ID = 0

Description = System.Runtime.InteropServices.COMException The RPC server is unavailable.

 (Exception from HRESULT: 0x800706BA)    at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32

 errorCode, IntPtr errorInfo)     at System.Management.ManagementScope.InitializeGuts(Object

 o)     at System.Management.ManagementScope.Initialize()     at System.Management.ManagementObject.Initialize(Boolean

 getObject)     at System.Management.ManagementBaseObject.get_Properties()     at System.Management.ManagementBaseObject.GetPropertyValue(String

 propertyName)     at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

 

Error - 3/28/2012 12:38:47 PM | Computer Name = SRELab-HP | Source = HP WA Service | ID = 0

Description = System.Runtime.InteropServices.COMException The RPC server is unavailable.

 (Exception from HRESULT: 0x800706BA)    at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32

 errorCode, IntPtr errorInfo)     at System.Management.ManagementScope.InitializeGuts(Object

 o)     at System.Management.ManagementScope.Initialize()     at System.Management.ManagementObject.Initialize(Boolean

 getObject)     at System.Management.ManagementBaseObject.get_Properties()     at System.Management.ManagementBaseObject.GetPropertyValue(String

 propertyName)     at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

 

Error - 3/28/2012 12:39:48 PM | Computer Name = SRELab-HP | Source = HP WA Service | ID = 0

Description = System.Runtime.InteropServices.COMException The RPC server is unavailable.

 (Exception from HRESULT: 0x800706BA)    at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32

 errorCode, IntPtr errorInfo)     at System.Management.ManagementScope.InitializeGuts(Object

 o)     at System.Management.ManagementScope.Initialize()     at System.Management.ManagementObject.Initialize(Boolean

 getObject)     at System.Management.ManagementBaseObject.get_Properties()     at System.Management.ManagementBaseObject.GetPropertyValue(String

 propertyName)     at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

 

Error - 8/24/2013 1:31:10 PM | Computer Name = SRELab-HP | Source = HP WA Service | ID = 0

Description = System.Runtime.InteropServices.COMException Call was canceled by the

 message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED))    at

 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,

 IntPtr errorInfo)     at System.Management.ManagementScope.InitializeGuts(Object 

o)     at System.Management.ManagementScope.Initialize()     at System.Management.ManagementObject.Initialize(Boolean

 getObject)     at System.Management.ManagementBaseObject.get_Properties()     at System.Management.ManagementBaseObject.GetPropertyValue(String

 propertyName)     at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

 

Error - 8/24/2013 1:56:11 PM | Computer Name = SRELab-HP | Source = HP WA Service | ID = 0

Description = System.Runtime.InteropServices.COMException Call was canceled by the

 message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED))    at

 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,

 IntPtr errorInfo)     at System.Management.ManagementScope.InitializeGuts(Object 

o)     at System.Management.ManagementScope.Initialize()     at System.Management.ManagementObject.Initialize(Boolean

 getObject)     at System.Management.ManagementBaseObject.get_Properties()     at System.Management.ManagementBaseObject.GetPropertyValue(String

 propertyName)     at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

 

Error - 8/24/2013 1:58:11 PM | Computer Name = SRELab-HP | Source = HP WA Service | ID = 0

Description = System.Runtime.InteropServices.COMException Call was canceled by the

 message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED))    at

 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,

 IntPtr errorInfo)     at System.Management.ManagementScope.InitializeGuts(Object 

o)     at System.Management.ManagementScope.Initialize()     at System.Management.ManagementObject.Initialize(Boolean

 getObject)     at System.Management.ManagementBaseObject.get_Properties()     at System.Management.ManagementBaseObject.GetPropertyValue(String

 propertyName)     at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

 

Error - 8/24/2013 2:00:11 PM | Computer Name = SRELab-HP | Source = HP WA Service | ID = 0

Description = System.Runtime.InteropServices.COMException Call was canceled by the

 message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED))    at

 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,

 IntPtr errorInfo)     at System.Management.ManagementScope.InitializeGuts(Object 

o)     at System.Management.ManagementScope.Initialize()     at System.Management.ManagementObject.Initialize(Boolean

 getObject)     at System.Management.ManagementBaseObject.get_Properties()     at System.Management.ManagementBaseObject.GetPropertyValue(String

 propertyName)     at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

 

Error - 8/24/2013 2:02:11 PM | Computer Name = SRELab-HP | Source = HP WA Service | ID = 0

Description = System.Runtime.InteropServices.COMException Call was canceled by the

 message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED))    at

 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,

 IntPtr errorInfo)     at System.Management.ManagementScope.InitializeGuts(Object 

o)     at System.Management.ManagementScope.Initialize()     at System.Management.ManagementObject.Initialize(Boolean

 getObject)     at System.Management.ManagementBaseObject.get_Properties()     at System.Management.ManagementBaseObject.GetPropertyValue(String

 propertyName)     at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

 

[ Media Center Events ]

Error - 11/15/2013 6:28:43 AM | Computer Name = SRELab-HP | Source = MCUpdate | ID = 0

Description = 4:28:43 AM - Error connecting to the internet.  4:28:43 AM -     Unable

 to contact server..  

 

Error - 11/15/2013 6:28:48 AM | Computer Name = SRELab-HP | Source = MCUpdate | ID = 0

Description = 4:28:48 AM - Error connecting to the internet.  4:28:48 AM -     Unable

 to contact server..  

 

Error - 11/15/2013 7:28:53 AM | Computer Name = SRELab-HP | Source = MCUpdate | ID = 0

Description = 5:28:53 AM - Error connecting to the internet.  5:28:53 AM -     Unable

 to contact server..  

 

Error - 11/15/2013 7:28:58 AM | Computer Name = SRELab-HP | Source = MCUpdate | ID = 0

Description = 5:28:58 AM - Error connecting to the internet.  5:28:58 AM -     Unable

 to contact server..  

 

Error - 11/15/2013 8:29:03 AM | Computer Name = SRELab-HP | Source = MCUpdate | ID = 0

Description = 6:29:03 AM - Error connecting to the internet.  6:29:03 AM -     Unable

 to contact server..  

 

Error - 11/15/2013 8:29:09 AM | Computer Name = SRELab-HP | Source = MCUpdate | ID = 0

Description = 6:29:08 AM - Error connecting to the internet.  6:29:08 AM -     Unable

 to contact server..  

 

Error - 11/18/2013 12:40:55 PM | Computer Name = SRELab-HP | Source = MCUpdate | ID = 0

Description = 10:40:53 AM - Error connecting to the internet.  10:40:53 AM -     Unable

 to contact server..  

 

Error - 11/30/2013 4:50:11 PM | Computer Name = SRELab-HP | Source = MCUpdate | ID = 0

Description = 2:50:04 PM - Error connecting to the internet.  2:50:04 PM -     Unable

 to contact server..  

 

Error - 12/5/2013 4:07:26 PM | Computer Name = SRELab-HP | Source = MCUpdate | ID = 0

Description = 2:07:26 PM - Error connecting to the internet.  2:07:26 PM -     Unable

 to contact server..  

 

Error - 12/5/2013 4:07:36 PM | Computer Name = SRELab-HP | Source = MCUpdate | ID = 0

Description = 2:07:31 PM - Error connecting to the internet.  2:07:31 PM -     Unable

 to contact server..  

 

[ System Events ]

Error - 1/18/2014 2:10:23 AM | Computer Name = SRELab-HP | Source = DCOM | ID = 10010

Description = 

 

Error - 1/18/2014 7:46:38 PM | Computer Name = SRELab-HP | Source = volsnap | ID = 393230

Description = The shadow copies of volume C: were aborted because of an IO failure

 on volume C:.

 

Error - 1/18/2014 8:00:14 PM | Computer Name = SRELab-HP | Source = volsnap | ID = 393230

Description = The shadow copies of volume C: were aborted because of an IO failure

 on volume C:.

 

Error - 1/19/2014 2:34:10 AM | Computer Name = SRELab-HP | Source = DCOM | ID = 10010

Description = 

 

Error - 1/19/2014 2:38:43 AM | Computer Name = SRELab-HP | Source = DCOM | ID = 10010

Description = 

 

Error - 1/20/2014 1:50:53 PM | Computer Name = SRELab-HP | Source = DCOM | ID = 10010

Description = 

 

Error - 1/20/2014 1:53:28 PM | Computer Name = SRELab-HP | Source = DCOM | ID = 10010

Description = 

 

Error - 1/21/2014 1:00:40 PM | Computer Name = SRELab-HP | Source = Service Control Manager | ID = 7003

Description = The McAfee Anti-Malware Core service depends the following service:

 mfevtp. This service might not be installed.

 

Error - 1/21/2014 1:00:43 PM | Computer Name = SRELab-HP | Source = Service Control Manager | ID = 7000

Description = The vToolbarUpdater17.1.3 service failed to start due to the following

 error:   %%2

 

Error - 1/21/2014 1:01:17 PM | Computer Name = SRELab-HP | Source = Service Control Manager | ID = 7026

Description = The following boot-start or system-start driver(s) failed to load:

   avgtp

 

 

< End of report >

[jeffce]

What do you mean that is the only way to access the system???  Are you able to boot normally to your system?

[EricWoods]

I don't have the system in front of me. It's halfway across the country, hence my need to use LMI for access.

 

System boots normally. Just can't get McAfee to behave. Also get Windows warning from system tray that it isn't performing well.

[jeffce]

Download the tool found here and then try to reinstall McAfee.  Let me know if that works for you.

[EricWoods]

Ran cleanup tool. Same problem and error screens.

[EricWoods]

Cleanup not successful. Log attached.

 

Attached Files

•  mccleanup.zip   172.48KB   163 downloads

[jeffce]

Let's do this and then come back to the McAfee issue...
 
Please download Malwarebytes Anti-Malware to your desktop.

• Right-click and Run as Administrator mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan as shown below.
   
       
     
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

The log can also be found here:
 
Windows 2000 & Windows XP:
C:\Documents and Settings\<USERNAME>\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs
 
Windows Vista & Win7:
C:\Users\<USERNAME>\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs
----------
 

ESET Online Scanner
 
Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator

• Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
• Click Scan
• Wait for the scan to finish
• When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file..."
• Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
• Close the ESET online scan, and let me know how things are now.

----------

[EricWoods]

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

 

Database version: v2014.01.24.02

 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16428

SRE Lab :: SRELAB-HP [administrator]

 

1/24/2014 12:59:40 AM

mbam-log-2014-01-24 (00-59-40).txt

 

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 215024

Time elapsed: 5 minute(s), 44 second(s)

 

Memory Processes Detected: 0

(No malicious items detected)

 

Memory Modules Detected: 0

(No malicious items detected)

 

Registry Keys Detected: 0

(No malicious items detected)

 

Registry Values Detected: 0

(No malicious items detected)

 

Registry Data Items Detected: 0

(No malicious items detected)

 

Folders Detected: 0

(No malicious items detected)

 

Files Detected: 4

C:\Users\SRE Lab\Downloads\cyberlink youcam setup (1).exe (PUP.Optional.Soft32.A) -> Quarantined and deleted successfully.

C:\Users\SRE Lab\Downloads\cyberlink youcam setup (2).exe (PUP.Optional.Soft32.A) -> Quarantined and deleted successfully.

C:\Users\SRE Lab\Downloads\cyberlink youcam setup.exe (PUP.Optional.Soft32.A) -> Quarantined and deleted successfully.

C:\Users\SRE Lab\Downloads\Setup.exe (PUP.Optional.IBryte) -> Quarantined and deleted successfully.

 

(end)

 

C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movdap\WBDesktop.Updater.exe.vir MSIL/WebCake.A application

C:\AdwCleaner\Quarantine\C\Users\SRE Lab\AppData\Roaming\Movdap\dat\Desktop.OS.dll.vir a variant of MSIL/WebCake.A application

C:\AdwCleaner\Quarantine\C\Users\SRE Lab\AppData\Roaming\Movdap\dat\Dora.dat.vir a variant of MSIL/WebCake.A application

C:\AdwCleaner\Quarantine\C\Users\SRE Lab\AppData\Roaming\Movdap\dat\Maintain.dat.vir a variant of MSIL/WebCake.A application

C:\AdwCleaner\Quarantine\C\Users\SRE Lab\AppData\Roaming\Movdap\dat\Paladin.dat.vir a variant of MSIL/WebCake.A application

C:\AdwCleaner\Quarantine\C\Users\SRE Lab\AppData\Roaming\Movdap\dat\Phoenix.dat.vir a variant of MSIL/WebCake.A application

C:\_OTL\MovedFiles\08232013_220551\C_Program Files (x86)\Movdap\WebCakeIEClient.dll probably a variant of Win32/Adware.Yontoo.A application

C:\_OTL\MovedFiles\08232013_220551\C_Users\SRE Lab\AppData\Local\Temp\6E781783-BAB0-7891-8834-37DD342B5F02\Setup.exe a variant of Win32/Toolbar.Babylon.H application

 

[jeffce]

Still having problems with McAfee??  

 

What other malware problems are you still having?

[EricWoods]

Will try the McAfee installation again. Did ESET find anything worth fixing?

[jeffce]

Hi,

 

ESET found some files but they were already quarantined so they are safe.  

[EricWoods]

Great. Still struggling with installing McAfee. I'll be working with tech support tomorrow to figure that out. Am I all clear, as far as you can tell?

[jeffce]

Yes....outside of the McAfee problem, everything seems clear.