s.m2pub.com pop up ads and redirects [Solved]

I started receiving pop up ads yesterday. When I hover over the ad the web link on most are from s.m2pub.com/… There are also deal ads and several redirects. I have run anti-malware and show that I am clean. I have also run adwcleaner and keep getting the same issue under the firefox tab which appears to be a profile javascript. Below are the results of the OTL scan.

OTL logfile created on: 5/1/2014 9:59:29 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Gary\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

6.00 Gb Total Physical Memory | 3.78 Gb Available Physical Memory | 63.08% Memory free
12.17 Gb Paging File | 9.84 Gb Available in Paging File | 80.87% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 687.32 Gb Total Space | 116.08 Gb Free Space | 16.89% Space Free | Partition Type: NTFS
Drive D: | 11.31 Gb Total Space | 1.10 Gb Free Space | 9.77% Space Free | Partition Type: NTFS

Computer Name: GARY-PC | User Name: Gary | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Gary\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\MSR\Privoxy\privoxy.exe (The Privoxy team - www.privoxy.org)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe (Adobe Systems, Inc.)
PRC - C:\WINDOWS\Microsoft\System Update kb70007\WindowsUpdater.exe ()
PRC - C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\ADBlockerSrv.exe ()
PRC - C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\ADBlockerTray.exe (Anvisoft)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\WINDOWS\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe ()
PRC - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe ()
PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
PRC - C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe (Citrix Systems, Inc.)
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - c:\hp\HPEZBTN\HPBtnSrv.exe ()
PRC - C:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
MOD - C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\sqlite3.dll ()
MOD - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()


========== Services (SafeList) ==========

SRV:64bit: - (LBTServ) – C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (XAudioService) – C:\Windows\SysNative\DRIVERS\xaudio64.exe (Conexant Systems, Inc.)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (System Update kb70007) – C:\WINDOWS\Microsoft\System Update kb70007\WindowsUpdater.exe ()
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (AdblockerSrv) – C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\ADBlockerSrv.exe ()
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (nvUpdatusService) – C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (PnkBstrA) – C:\WINDOWS\SysWOW64\PnkBstrA.exe ()
SRV - (npggsvc) – C:\WINDOWS\SysWOW64\GameMon.des (INCA Internet Co., Ltd.)
SRV - (N360) – C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\ccSvcHst.exe (Symantec Corporation)
SRV - (MotoHelper) – C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe ()
SRV - (clr_optimization_v2.0.50727_32) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (HPSLPSVC) – C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)
SRV - (IAANTMON) – C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (HPBtnSrv) – c:\hp\HPEZBTN\HPBtnSrv.exe ()


========== Driver Services (SafeList) ==========

DRV:64bit: - (hitmanpro37) – C:\Windows\SysNative\drivers\hitmanpro37.sys ()
DRV:64bit: - (asdnet) – C:\Windows\SysNative\DRIVERS\asdnet.sys ()
DRV:64bit: - (SaiNtBus) – C:\Windows\SysNative\drivers\SaiBus.sys (Saitek)
DRV:64bit: - (SaiMini) – C:\Windows\SysNative\DRIVERS\SaiMini.sys (Saitek)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (ccHP) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\ccHPx64.sys (Symantec Corporation)
DRV:64bit: - (SYMTDI) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\SYMTDI.SYS (Symantec Corporation)
DRV:64bit: - (SYMFW) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\SYMFW.SYS (Symantec Corporation)
DRV:64bit: - (SYMNDISV) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\SYMNDISV.SYS (Symantec Corporation)
DRV:64bit: - (LMouFilt) – C:\Windows\SysNative\DRIVERS\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LHidFilt) – C:\Windows\SysNative\DRIVERS\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (BVRPMPR5a64) – C:\Windows\SysNative\drivers\BVRPMPR5a64.SYS (Avanquest Software)
DRV:64bit: - (motmodem) – C:\Windows\SysNative\DRIVERS\motmodem.sys (Motorola)
DRV:64bit: - (motccgp) – C:\Windows\SysNative\DRIVERS\motccgp.sys (Motorola)
DRV:64bit: - (Motousbnet) – C:\Windows\SysNative\DRIVERS\Motousbnet.sys (Motorola)
DRV:64bit: - (SymEvent) – C:\Windows\SysNative\Drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\SRTSP64.SYS (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\N360x64\0308030.006\SYMEFA64.SYS (Symantec Corporation)
DRV:64bit: - (BHDrvx64) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\BHDrvx64.sys (Symantec Corporation)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (SRTSPX) – C:\Windows\SysNative\drivers\N360x64\0308030.006\SRTSPX64.SYS (Symantec Corporation)
DRV:64bit: - (SymIM) – C:\Windows\SysNative\DRIVERS\SymIMv.sys (Symantec Corporation)
DRV:64bit: - (motusbdevice) – C:\Windows\SysNative\DRIVERS\motusbdevice.sys (Motorola Inc)
DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation)
DRV:64bit: - (ctxusbm) – C:\Windows\SysNative\DRIVERS\ctxusbm.sys (Citrix Systems, Inc.)
DRV:64bit: - (motccgpfl) – C:\Windows\SysNative\DRIVERS\motccgpfl.sys (Motorola)
DRV:64bit: - (BTCFilterService) – C:\Windows\SysNative\DRIVERS\motfilt.sys (Motorola Inc)
DRV:64bit: - (RTL8169) – C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek Corporation )
DRV:64bit: - (netr28x) – C:\Windows\SysNative\DRIVERS\netr28x.sys (Ralink Technology, Corp.)
DRV:64bit: - (CAXHWBS2) – C:\Windows\SysNative\DRIVERS\CAXHWBS2.sys (Conexant Systems, Inc.)
DRV:64bit: - (winachsf) – C:\Windows\SysNative\DRIVERS\CAX_CNXT.sys (Conexant Systems, Inc.)
DRV:64bit: - (HSF_DP) – C:\Windows\SysNative\DRIVERS\CAX_DP.sys (Conexant Systems, Inc.)
DRV:64bit: - (HCW85BDA) – C:\Windows\SysNative\drivers\HCW85BDA.sys (Hauppauge Computer Works)
DRV:64bit: - (StillCam) – C:\Windows\SysNative\DRIVERS\serscan.sys (Microsoft Corporation)
DRV:64bit: - (WSDPrintDevice) – C:\Windows\SysNative\DRIVERS\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (MotoSwitchService) – C:\Windows\SysNative\DRIVERS\motswch.sys (Motorola)
DRV:64bit: - (XAudio) – C:\Windows\SysNative\DRIVERS\xaudio64.sys (Conexant Systems, Inc.)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iastor.sys (Intel Corporation)
DRV:64bit: - (SaiHFF0C) – C:\Windows\SysNative\DRIVERS\SaiHFF0C.sys (Saitek)
DRV:64bit: - (SaiUFF0C) – C:\Windows\SysNative\DRIVERS\SaiUFF0C.sys (Saitek)
DRV:64bit: - (mdmxsdk) – C:\Windows\SysNative\DRIVERS\mdmxsdk.sys (Conexant)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20140430.037\ex64.sys (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20140430.037\eng64.sys (Symantec Corporation)
DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20140430.002\IDSviA64.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NPPTNT2) – C:\WINDOWS\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.v9.com/web/?type=ds&ts;=1398878357&from;=irs&uid;=HitachiXHDS721075KLA330_GTF200P8GUN8GFGUN8GFX&i;=psd&t;=341cbe5db&q;={searchTerms}
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.v9.com/web/?type=ds&ts;=1398878357&from;=irs&uid;=HitachiXHDS721075KLA330_GTF200P8GUN8GFGUN8GFX&i;=psd&t;=341cbe5db&q;={searchTerms}
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE:64bit: - HKLM\..\SearchScopes\{DB4376FF-E866-4999-8C9A-FF552D841782}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=hp-pvdt
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKLM\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?&o;=101881&l;=dis&q;={SEARCHTERMS}
IE - HKLM\..\SearchScopes\{DB4376FF-E866-4999-8C9A-FF552D841782}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=hp-pvdt

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{DB4376FF-E866-4999-8C9A-FF552D841782}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=hp-pvdt
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8118;https=127.0.0.1:8118

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:29.0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2011/11/01 07:15:38 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2014/04/30 18:03:40 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014/04/30 20:10:03 | 000,000,000 | —D | M]

[2011/06/16 19:16:25 | 000,000,000 | —D | M] (No name found) – C:\Users\Gary\AppData\Roaming\Mozilla\Extensions
[2011/06/16 19:16:25 | 000,000,000 | —D | M] (No name found) – C:\Users\Gary\AppData\Roaming\Mozilla\Extensions\[removed]
[2014/05/01 09:44:14 | 000,000,000 | —D | M] (No name found) – C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\yeag246i.default-1398948955132\extensions
[2014/05/01 09:37:27 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2014/04/30 18:03:40 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2014/04/30 18:03:50 | 000,000,000 | —D | M] (Default) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/09/12 23:05:42 | 000,124,240 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\CCMSDK.dll
[2009/09/12 23:06:22 | 000,070,488 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\CgpCore.dll
[2009/09/12 23:06:32 | 000,091,480 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\confmgr.dll
[2009/09/12 23:06:28 | 000,022,360 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\ctxlogging.dll
[2009/09/12 23:08:36 | 000,406,864 | —- | M] () – C:\Program Files (x86)\mozilla firefox\plugins\npicaN.dll
[2006/08/09 06:16:08 | 000,030,408 | —- | M] ( ) – C:\Program Files (x86)\mozilla firefox\plugins\npWebLaunch.dll
[2009/09/12 23:06:24 | 000,023,896 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\TcpPServ.dll

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs;_ri={google:suggestRid}&xssi;=t&q;={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - plugin: Error reading preferences file
CHR - Extension: Google Docs = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Google Wallet = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
CHR - Extension: Gmail = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2014/05/01 09:02:43 | 000,039,317 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 08sr.combineads.info # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 08srvr.combineads.info # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 12srvr.combineads.info # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 2010-fr.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 2012-new.biz # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 212link.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 2319825.ourtoolbar.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 24h00business.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 a.adorika.net # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 a.ad-sys.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 a.daasafterdusk.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ad.adn360.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 adeartss.eu # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 adesoeasy.eu # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 adf.girldatesforfree.net # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 adm.soft365.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 adomicileavail.googlepages.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads7.complexadveising.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.adplxmd.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.aff.co # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.alpha00001.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.cloud4ads.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.egdating.net # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.eorezo.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.hooqy.com # hosts anti-adware / pups
O1 - Hosts: 647 more lines…
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\CoIEPlg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [Bluetooth Connection Assistant] LBTWIZ.EXE -silent File not found
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe File not found
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (X86)\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [ProfilerU] C:\Program Files\SmartTechnology\Software\ProfilerU.exe (Saitek)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [SaiMfd] C:\Program Files\SmartTechnology\Software\SaiMfd.exe (Saitek)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [4StoryPrePatch] C:\Program Files (x86)\Gameforge4D\GatesofAndaron\PrePatch.exe (Zamiinc)
O4 - HKLM..\Run: [ADBlocker] C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\ADBlockerTray.exe (Anvisoft)
O4 - HKLM..\Run: [Anvi AD Blocker] C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\ADBlockerTray.exe (Anvisoft)
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKLM..\Run: [ScrewDrivers RDP Plugin] C:\Program Files (x86)\triCerat\Simplify Printing\ScrewDrivers Client v4\install_rdp.exe ()
O4 - HKCU..\Run: [VirtualDub.org] C:\Windows\SysWow64\regsvr32.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre7\bin\jp2iexp.dll ()
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0017-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Java Plug-in 1.7.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Java Plug-in 10.17.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6DE92507-B466-474D-9E8F-F4A5EC774184}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7D8B5987-8491-4898-9A1B-88C11ECF028C}: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\symres - No CLSID value found
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\CoIEPlg.dll (Symantec Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\SysWOW64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Gary\Desktop\Photos\Cactus\Cactus Background-1.jpg
O24 - Desktop BackupWallPaper: C:\Users\Gary\Desktop\Photos\Cactus\Cactus Background-1.jpg
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)


Drivers32:64bit: msacm.ac3acm - AC3ACM.acm (fccHandler)
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.ac3filter - ac3filter.acm File not found
Drivers32: msacm.l3acm - C:\WINDOWS\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: vidc.tscc - C:\Windows\SysWow64\tsccvid.dll (TechSmith Corporation)
Drivers32: vidc.XVID - C:\Windows\SysWow64\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
System Restore Service not available.

========== Files/Folders - Created Within 30 Days ==========

[2014/05/01 09:54:35 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Gary\Desktop\OTL.exe
[2014/05/01 09:21:54 | 000,000,000 | —D | C] – C:\ProgramData\Anvisoft
[2014/05/01 09:21:45 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Anvisoft
[2014/05/01 09:21:40 | 000,000,000 | —D | C] – C:\Program Files (x86)\Anvisoft
[2014/05/01 09:10:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2014/05/01 08:57:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs
[2014/04/30 21:04:38 | 010,971,424 | —- | C] (SurfRight B.V.) – C:\Users\Gary\Desktop\HitmanPro_x64.exe
[2014/04/30 21:03:59 | 000,000,000 | —D | C] – C:\ProgramData\HitmanPro
[2014/04/30 20:22:52 | 000,000,000 | —D | C] – C:\Windows\ERUNT
[2014/04/30 20:22:07 | 001,016,261 | —- | C] (Thisisu) – C:\Users\Gary\Desktop\JRT_NEW.exe
[2014/04/30 20:06:33 | 000,000,000 | —D | C] – C:\AdwCleaner
[2014/04/30 18:03:40 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2014/04/30 13:19:52 | 000,000,000 | —D | C] – C:\Windows\Microsoft
[2014/04/30 13:19:40 | 000,000,000 | —D | C] – C:\Program Files (x86)\MSR
[2014/04/30 13:18:35 | 000,000,000 | —D | C] – C:\Users\Gary\AppData\Roaming\Wise
[2014/04/23 08:53:59 | 000,000,000 | —D | C] – C:\Users\Gary\Desktop\p90x3
[2014/04/09 08:57:58 | 000,763,904 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2014/04/09 08:57:58 | 000,480,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2014/04/09 08:57:56 | 000,623,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2014/04/09 08:57:56 | 000,485,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2014/04/09 08:57:56 | 000,422,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2014/04/09 08:57:56 | 000,389,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2014/04/09 08:57:56 | 000,249,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2014/04/09 08:57:56 | 000,224,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2014/04/09 08:57:56 | 000,193,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2014/04/09 08:57:56 | 000,180,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2014/04/09 08:57:56 | 000,108,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2014/04/09 08:57:56 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2014/04/09 08:57:56 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\corpol.dll
[2014/04/09 08:57:56 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\corpol.dll
[2014/04/09 08:57:55 | 000,380,928 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2014/04/09 08:57:52 | 001,212,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[2014/04/04 10:04:49 | 000,000,000 | —D | C] – C:\Users\Gary\Documents\HandHistory
[2014/04/04 10:00:16 | 000,000,000 | —D | C] – C:\Users\Gary\AppData\Local\cache
[2014/04/04 09:59:08 | 000,000,000 | —D | C] – C:\Users\Gary\AppData\Local\FullTiltPoker
[1 C:\Users\Gary\*.tmp files -> C:\Users\Gary\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2014/05/01 09:54:38 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Gary\Desktop\OTL.exe
[2014/05/01 09:37:43 | 000,000,890 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014/05/01 09:37:40 | 000,002,051 | —- | M] () – C:\Users\Gary\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2014/05/01 09:37:17 | 000,003,616 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2014/05/01 09:37:17 | 000,003,616 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2014/05/01 09:37:07 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2014/05/01 09:31:15 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2014/05/01 09:21:45 | 000,000,891 | —- | M] () – C:\Users\Public\Desktop\Anvi AD Blocker.lnk
[2014/05/01 09:19:14 | 006,369,640 | —- | M] () – C:\Users\Gary\Desktop\adblocker_setup.exe
[2014/05/01 09:12:44 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014/05/01 09:10:57 | 000,002,027 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2014/05/01 09:02:43 | 000,039,317 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2014/04/30 21:29:12 | 000,032,512 | —- | M] () – C:\Windows\SysNative\drivers\hitmanpro37.sys
[2014/04/30 21:27:02 | 000,003,866 | —- | M] () – C:\Windows\SysNative\.crusader
[2014/04/30 21:05:09 | 010,971,424 | —- | M] (SurfRight B.V.) – C:\Users\Gary\Desktop\HitmanPro_x64.exe
[2014/04/30 20:05:32 | 001,310,621 | —- | M] () – C:\Users\Gary\Desktop\adwcleaner.exe
[2014/04/30 13:28:19 | 000,000,258 | RHS- | M] () – C:\ProgramData\ntuser.pol
[2014/04/30 13:25:27 | 000,000,890 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2014/04/30 13:25:26 | 000,000,975 | —- | M] () – C:\Users\Gary\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2014/04/30 13:25:26 | 000,000,914 | —- | M] () – C:\Users\Gary\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2014/04/30 08:38:23 | 1502,076,584 | —- | M] () – C:\Users\Gary\Desktop\The_Lego_Movie_2014_Webrip_x264_AC3_TiTAN.mkv
[2014/04/29 16:58:02 | 000,000,450 | -H– | M] () – C:\Windows\tasks\Norton Security Scan for Gary.job
[2014/04/29 13:31:15 | 000,692,400 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2014/04/29 13:31:14 | 000,070,832 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2014/04/29 08:11:23 | 1467,971,725 | —- | M] () – C:\Users\Gary\Desktop\rbocpweb72-hbs.mp4
[2014/04/25 07:55:02 | 967,586,375 | —- | M] () – C:\Users\Gary\Desktop\300.roae.2014.hdrip.x264-hbs.mp4
[2014/04/20 19:20:42 | 006,195,323 | —- | M] () – C:\Users\Gary\Desktop\P90X3_Worksheets_Hres.rtf
[2014/04/20 11:03:13 | 003,000,315 | —- | M] () – C:\Users\Gary\Desktop\P90X3_Worksheets_Hres.pdf
[2014/04/16 10:52:03 | 000,000,330 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForGary.job
[2014/04/13 15:22:17 | 851,125,388 | —- | M] () – C:\Users\Gary\Desktop\Zulu.2013.720p.BluRay.x264.YIFY.mp4
[2014/04/13 08:14:39 | 000,222,166 | —- | M] () – C:\Users\Gary\Desktop\401k unenroll.xps
[2014/04/11 15:41:09 | 837,117,006 | —- | M] () – C:\Users\Gary\Desktop\joeweb72-G.mkv
[2014/04/10 12:18:06 | 002,290,165 | —- | M] () – C:\Users\Gary\Desktop\2.jpg
[2014/04/10 12:11:44 | 002,024,146 | —- | M] () – C:\Users\Gary\Desktop\1.jpg
[2014/04/10 10:23:21 | 000,000,957 | —- | M] () – C:\Users\Gary\Desktop\Dropbox.lnk
[2014/04/09 19:42:49 | 000,394,339 | —- | M] () – C:\Users\Gary\Desktop\OF306- 2011 version-1111.pdf
[2014/04/06 02:36:06 | 001,016,261 | —- | M] (Thisisu) – C:\Users\Gary\Desktop\JRT_NEW.exe
[1 C:\Users\Gary\*.tmp files -> C:\Users\Gary\*.tmp -> ]

========== Files Created - No Company Name ==========

[2014/05/01 09:21:45 | 000,000,891 | —- | C] () – C:\Users\Public\Desktop\Anvi AD Blocker.lnk
[2014/05/01 09:21:44 | 000,019,280 | —- | C] () – C:\Windows\SysNative\drivers\asdnet.sys
[2014/05/01 09:19:08 | 006,369,640 | —- | C] () – C:\Users\Gary\Desktop\adblocker_setup.exe
[2014/05/01 09:10:57 | 000,002,051 | —- | C] () – C:\Users\Gary\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2014/05/01 09:10:57 | 000,002,027 | —- | C] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2014/04/30 21:29:12 | 000,032,512 | —- | C] () – C:\Windows\SysNative\drivers\hitmanpro37.sys
[2014/04/30 21:27:02 | 000,003,866 | —- | C] () – C:\Windows\SysNative\.crusader
[2014/04/30 20:05:30 | 001,310,621 | —- | C] () – C:\Users\Gary\Desktop\adwcleaner.exe
[2014/04/30 13:19:20 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2014/04/30 08:27:39 | 1502,076,584 | —- | C] () – C:\Users\Gary\Desktop\The_Lego_Movie_2014_Webrip_x264_AC3_TiTAN.mkv
[2014/04/29 08:01:21 | 1467,971,725 | —- | C] () – C:\Users\Gary\Desktop\rbocpweb72-hbs.mp4
[2014/04/25 07:48:18 | 967,586,375 | —- | C] () – C:\Users\Gary\Desktop\300.roae.2014.hdrip.x264-hbs.mp4
[2014/04/20 19:20:41 | 006,195,323 | —- | C] () – C:\Users\Gary\Desktop\P90X3_Worksheets_Hres.rtf
[2014/04/20 11:03:10 | 003,000,315 | —- | C] () – C:\Users\Gary\Desktop\P90X3_Worksheets_Hres.pdf
[2014/04/13 14:20:20 | 851,125,388 | —- | C] () – C:\Users\Gary\Desktop\Zulu.2013.720p.BluRay.x264.YIFY.mp4
[2014/04/13 08:14:37 | 000,222,166 | —- | C] () – C:\Users\Gary\Desktop\401k unenroll.xps
[2014/04/11 15:33:54 | 837,117,006 | —- | C] () – C:\Users\Gary\Desktop\joeweb72-G.mkv
[2014/04/10 12:12:20 | 002,290,165 | —- | C] () – C:\Users\Gary\Desktop\2.jpg
[2014/04/10 12:11:42 | 002,024,146 | —- | C] () – C:\Users\Gary\Desktop\1.jpg
[2014/04/09 19:42:49 | 000,394,339 | —- | C] () – C:\Users\Gary\Desktop\OF306- 2011 version-1111.pdf
[2014/03/30 09:41:21 | 000,000,732 | —- | C] () – C:\Users\Gary\AppData\Local\d3d9caps64.dat
[2014/02/18 19:15:33 | 000,012,005 | —- | C] () – C:\Users\Gary\AppData\Roaming\alsoft.ini
[2012/07/15 09:49:45 | 000,000,680 | —- | C] () – C:\Users\Gary\AppData\Local\d3d9caps.dat
[2011/12/13 09:20:01 | 000,000,044 | —- | C] () – C:\Users\Gary\jagex_cl_runescape_LIVE3.dat
[2011/12/13 09:13:07 | 000,000,044 | —- | C] () – C:\Users\Gary\jagex_cl_runescape_LIVE2.dat
[2011/12/12 23:41:34 | 000,000,044 | —- | C] () – C:\Users\Gary\jagex_cl_runescape_LIVE1.dat
[2011/12/12 21:29:01 | 000,000,043 | —- | C] () – C:\Users\Gary\jagex_cl_runescape_LIVE.dat
[2011/12/12 21:29:01 | 000,000,024 | —- | C] () – C:\Users\Gary\random.dat
[2011/05/23 08:44:15 | 000,000,000 | —- | C] () – C:\Users\Gary\AppData\Roaming\wklnhst.dat
[2011/05/18 17:47:00 | 000,001,940 | —- | C] () – C:\Users\Gary\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/06/08 07:55:03 | 000,000,092 | —- | C] () – C:\Users\Gary\AppData\Local\fusioncache.dat
[2010/03/21 21:09:21 | 000,031,776 | —- | C] () – C:\ProgramData\nvModes.001
[2010/03/21 20:58:31 | 000,031,776 | —- | C] () – C:\ProgramData\nvModes.dat
[2010/03/18 17:07:28 | 000,036,352 | —- | C] () – C:\Users\Gary\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006/11/02 11:30:40 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"ThreadingModel" = Both
"" = C:\Windows\SysNative\shell32.dll – [2012/06/08 13:59:03 | 012,899,840 | —- | M] (Microsoft Corporation)

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/08 13:59:03 | 012,899,840 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 13:47:00 | 011,586,048 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/04/11 03:11:14 | 000,891,392 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\SysWow64\wbem\fastprox.dll – [2009/04/11 02:28:19 | 000,614,912 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2008/01/20 22:50:58 | 000,513,024 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\SysWow64\wbem\wbemess.dll
"ThreadingModel" = Apartment

========== LOP Check ==========

[2010/03/18 17:19:20 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\acccore
[2011/06/08 17:16:38 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\Anvil Studio
[2010/10/22 14:02:51 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\avidemux
[2012/09/10 15:44:48 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\Carbon
[2010/06/19 09:34:42 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\CoffeeCup Software
[2014/04/23 15:33:04 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\Dropbox
[2014/02/22 16:39:29 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\FEZ
[2013/07/25 08:58:11 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\FileZilla
[2010/10/01 18:29:45 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\funkitron
[2013/07/28 12:44:36 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\GroundSchool FAA
[2011/03/14 17:50:49 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\ICAClient
[2011/03/14 20:06:31 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\Leadertech
[2011/06/18 09:44:29 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\LimeWire
[2011/04/16 13:04:43 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\muvee Technologies
[2014/03/29 17:40:17 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\Origin
[2012/03/01 19:52:17 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\RadarChaos
[2011/05/14 13:40:03 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\runic games
[2011/05/23 08:44:18 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\Template
[2010/08/31 11:34:41 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\thriXXX
[2013/02/23 18:38:16 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\Unified Remote
[2010/06/19 10:40:22 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\Web Page Maker
[2010/04/24 17:24:32 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\WinBatch
[2014/04/30 13:18:35 | 000,000,000 | —D | M] – C:\Users\Gary\AppData\Roaming\Wise

========== Purity Check ==========



========== Custom Scans ==========

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.EXE >
[2008/10/29 02:20:29 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE – C:\WINDOWS\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_b5f700fe698beb14\explorer.exe
[2008/10/29 02:29:41 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D – C:\WINDOWS\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_b7eb106e66a7ac19\explorer.exe
[2008/10/29 02:15:50 | 003,087,360 | —- | M] (Microsoft Corporation) MD5=50514057C28A74BAC2BD04B7B990D615 – C:\WINDOWS\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_aba256ac352b2919\explorer.exe
[2008/10/29 23:59:17 | 002,927,616 | —- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E – C:\WINDOWS\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_b8583e9d7fda0512\explorer.exe
[2009/04/11 03:10:17 | 003,079,168 | —- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 – C:\WINDOWS\erdnt\cache86\explorer.exe
[2009/04/11 03:10:17 | 003,079,168 | —- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 – C:\WINDOWS\explorer.exe
[2009/04/11 03:10:17 | 003,079,168 | —- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 – C:\WINDOWS\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_afbebba22f3bab41\explorer.exe
[2008/10/27 22:30:12 | 003,086,848 | —- | M] (Microsoft Corporation) MD5=72B9990E45C25AA3C75C4FB50A9D6CE0 – C:\WINDOWS\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_ac5266dd4e2b0a41\explorer.exe
[2008/10/29 02:49:22 | 003,080,704 | —- | M] (Microsoft Corporation) MD5=BBD8E74F23D7605CB0CDB57A1B25D826 – C:\WINDOWS\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_ad96661c3246ea1e\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\WINDOWS\SysWOW64\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\WINDOWS\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_ba1365f4639c6d3c\explorer.exe
[2008/10/30 01:30:07 | 003,081,216 | —- | M] (Microsoft Corporation) MD5=E404A65EF890140410E9F3D405841C95 – C:\WINDOWS\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_ae03944b4b794317\explorer.exe
[2008/10/27 22:15:02 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB – C:\WINDOWS\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_b6a7112f828bcc3c\explorer.exe
[2008/01/20 22:48:44 | 003,080,704 | —- | M] (Microsoft Corporation) MD5=F6D765FB6B457542D954682F50C26E4F – C:\WINDOWS\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_add342963219dff5\explorer.exe
[2008/01/20 22:49:23 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F – C:\WINDOWS\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_b827ece8667aa1f0\explorer.exe

< MD5 for: EXPLORER.EXE.MUI >
[2006/11/02 11:13:38 | 000,036,864 | —- | M] (Microsoft Corporation) MD5=192DD053B43250E264383CDC3D564A18 – C:\WINDOWS\SysWOW64\en-US\explorer.exe.mui
[2006/11/02 11:13:38 | 000,036,864 | —- | M] (Microsoft Corporation) MD5=192DD053B43250E264383CDC3D564A18 – C:\WINDOWS\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_6a2f0af76374ed51\explorer.exe.mui
[2006/11/02 11:13:32 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=872D519975CA4D7CC596FC93470D49E0 – C:\WINDOWS\en-US\explorer.exe.mui
[2006/11/02 11:13:32 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=872D519975CA4D7CC596FC93470D49E0 – C:\WINDOWS\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_5fda60a52f142b56\explorer.exe.mui

< MD5 for: EXPLORER.HTM >
[2006/01/11 02:04:38 | 000,006,995 | —- | M] () MD5=0CFD32939C792D5BB0FFB9590324B7ED – C:\Program Files (x86)\Evrsoft First Page 2006\Help\1stPage Guide\explorer.htm

< MD5 for: EXPLORER.ZIP >
[2006/03/06 22:48:08 | 000,020,394 | —- | M] () MD5=B469409C2B2A33C542190B720E11BD79 – C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Explorer.zip

< MD5 for: IEXPLORE.BAT >
[2014/04/06 01:13:18 | 000,031,401 | —- | M] () MD5=335DFF8F23E5EC02B5426362F0F8509B – C:\Users\Gary\AppData\Local\Temp\jrt\iexplore.bat

< MD5 for: IEXPLORE.EXE >
[2010/09/08 13:30:52 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=02FF22F3AF0108DA2A563ABC9867049F – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18527_none_95c6b18b06c68f00\iexplore.exe
[2010/09/08 12:49:16 | 000,711,448 | —- | M] (Microsoft Corporation) MD5=04AE9CFD3F53936223BED7F52C28E5D1 – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18527_none_8b720738d265cd05\iexplore.exe
[2010/05/04 15:05:56 | 000,711,448 | —- | M] (Microsoft Corporation) MD5=0F1D27BFB65CAC093563CD46E56EAC57 – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22685_none_8bb8c3e7ebb5e1c7\iexplore.exe
[2009/12/18 08:28:58 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=115076DAD84312F3A51698C15BC39D39 – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21184_none_942603a022f1326e\iexplore.exe
[2010/03/09 12:56:18 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=259E27152180B895DF395ED3E412B90E – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.17037_none_93d5774f09a852f4\iexplore.exe
[2010/05/04 14:56:53 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=29A7F81290165264010B784A7D217561 – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18470_none_95899e0306f56c2d\iexplore.exe
[2009/04/11 02:27:44 | 000,636,080 | —- | M] (Microsoft Corporation) MD5=2C5168C856455CC43C4B4E1CC1920001 – C:\Program Files (x86)\Internet Explorer\iexplore.exe
[2009/04/11 02:27:44 | 000,636,080 | —- | M] (Microsoft Corporation) MD5=2C5168C856455CC43C4B4E1CC1920001 – C:\WINDOWS\erdnt\cache86\iexplore.exe
[2009/04/11 02:27:44 | 000,636,080 | —- | M] (Microsoft Corporation) MD5=2C5168C856455CC43C4B4E1CC1920001 – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6002.18005_none_97c0beeb03de7f46\iexplore.exe
[2010/09/09 11:50:19 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=3EF3476EF687FE18856A6148C6082452 – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22760_none_961e0e86200aea54\iexplore.exe
[2010/05/04 14:31:09 | 000,634,656 | —- | M] (Microsoft Corporation) MD5=424CEA5CB5999B2A6A3ED643EA20C97F – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22685_none_960d6e3a2016a3c2\iexplore.exe
[2010/12/20 11:42:20 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=4319F2A5C725D9E0B9E01744E02D32BE – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18565_none_9599714706e8cc16\iexplore.exe
[2010/06/28 12:58:49 | 000,711,456 | —- | M] (Microsoft Corporation) MD5=451108714ABD6C6923BECBD61BC9B867 – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18498_none_8b275628d29daccc\iexplore.exe
[2010/10/20 14:34:04 | 000,711,448 | —- | M] (Microsoft Corporation) MD5=47045D1D8170F3121EBCB30442B434A7 – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18542_none_8b5765eed27a8634\iexplore.exe
[2009/04/11 03:11:08 | 000,712,864 | —- | M] (Microsoft Corporation) MD5=58136AB5A3DF2D44BBB483629188584A – C:\Program Files\Internet Explorer\iexplore.exe
[2009/04/11 03:11:08 | 000,712,864 | —- | M] (Microsoft Corporation) MD5=58136AB5A3DF2D44BBB483629188584A – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6002.18005_none_8d6c1498cf7dbd4b\iexplore.exe
[2008/01/20 22:48:06 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=5B92133D3E7FB2644677686305E29E81 – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18000_none_95d545df06bcb3fa\iexplore.exe
[2010/06/28 12:45:03 | 000,711,456 | —- | M] (Microsoft Corporation) MD5=6183CA49F334FD6B10A99AB2723AD55B – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22720_none_8bf4a3e3eb89b895\iexplore.exe
[2010/10/20 13:48:33 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=63E2F08404C9824C6CE6EE4A308B4083 – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18542_none_95ac104106db482f\iexplore.exe
[2010/10/21 15:11:56 | 000,711,448 | —- | M] (Microsoft Corporation) MD5=659654C25D55B7D0D4CCE8DCB65D581E – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22784_none_8bb7c583ebb6c597\iexplore.exe
[2010/03/11 12:40:22 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=67C769016A79E6FC65D1755E5D6ADAB3 – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22653_none_962bdd6a20001d41\iexplore.exe
[2010/03/11 13:12:09 | 000,711,456 | —- | M] (Microsoft Corporation) MD5=698D39FD901FA2EF5A9FF85D10B78FC5 – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22653_none_8bd73317eb9f5b46\iexplore.exe
[2009/12/18 11:42:45 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=6C8AC3469BBEFE194BB18B2D84D98252 – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18385_none_9583cda306f909aa\iexplore.exe
[2011/04/21 10:34:57 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=6C93AC7C0A8718E2A1543DB1B1B3B19F – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22905_none_9663f34c1fd5bbaf\iexplore.exe
[2010/03/09 12:30:03 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=74E60C93D1C9A40354D839776CCF53DF – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18444_none_95ae0eef06d97db6\iexplore.exe
[2011/04/21 11:02:30 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=77B9A891222FB46B13E414B99E1AF842 – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18639_none_95bde41906ccdac6\iexplore.exe
[2010/12/20 12:10:31 | 000,711,448 | —- | M] (Microsoft Corporation) MD5=7D15B77F30D15CC58F23CC3D3AA21BFB – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18565_none_8b44c6f4d2880a1b\iexplore.exe
[2011/04/21 11:31:40 | 000,711,448 | —- | M] (Microsoft Corporation) MD5=7DE6E0C4FD95FD20255E842FC78AC9EF – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18639_none_8b6939c6d26c18cb\iexplore.exe
[2009/12/18 09:02:44 | 000,711,448 | —- | M] (Microsoft Corporation) MD5=85EB45D31F684BD7071A00D42C382433 – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22585_none_8bb8c201ebb5e4a0\iexplore.exe
[2010/06/28 12:33:13 | 000,634,656 | —- | M] (Microsoft Corporation) MD5=867D06F3C473F65921F5EDF35866FF14 – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22720_none_96494e361fea7a90\iexplore.exe
[2010/03/09 13:09:55 | 000,711,448 | —- | M] (Microsoft Corporation) MD5=93D54DD14D9FE237DF830ED7522B35D4 – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.17037_none_8980ccfcd54790f9\iexplore.exe
[2010/03/09 12:32:31 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=97496AA4590CB101EF990060F7055F3D – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21242_none_944f44a222d28d23\iexplore.exe
[2008/01/20 22:50:37 | 000,701,952 | —- | M] (Microsoft Corporation) MD5=AC2C3BAFD177B60C3B5E4DDBCC2C2DB3 – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18000_none_8b809b8cd25bf1ff\iexplore.exe
[2009/12/18 09:20:04 | 000,711,432 | —- | M] (Microsoft Corporation) MD5=AE8E53D125AF9E62E7AC360AC61D036D – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21184_none_89d1594dee907073\iexplore.exe
[2010/05/04 15:50:33 | 000,711,456 | —- | M] (Microsoft Corporation) MD5=AEA20B66F0AACBFF8E7F554E616DF207 – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18470_none_8b34f3b0d294aa32\iexplore.exe
[2010/12/20 11:29:40 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=B021EBF2A5344FF71A641B2EFDAF813E – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22816_none_965a21c41fdcf3d0\iexplore.exe
[2013/04/04 14:50:32 | 000,218,184 | —- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2010/06/28 12:19:40 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=B6D7D54B736056991109F169737592C7 – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18498_none_957c007b06fe6ec7\iexplore.exe
[2011/04/21 11:18:01 | 000,711,448 | —- | M] (Microsoft Corporation) MD5=B884E379175705357D541DAE90A962A9 – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22905_none_8c0f48f9eb74f9b4\iexplore.exe
[2011/02/18 12:00:39 | 000,711,448 | —- | M] (Microsoft Corporation) MD5=BCD3DE5D8693BF4F2A1201900B9E5E71 – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18602_none_8b82a784d25a1397\iexplore.exe
[2011/02/18 11:23:49 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=BECD30E162ACFD7A04B1F87FBBAFF70E – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22857_none_962fe25e1ffc7ceb\iexplore.exe
[2009/12/18 08:56:05 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=C071905121F6DE5F399550FC70138FEC – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16982_none_939a8e1f09d52cb4\iexplore.exe
[2009/12/18 09:15:41 | 000,711,432 | —- | M] (Microsoft Corporation) MD5=C2736FB489245B698691DC2FBC08BA2C – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18385_none_8b2f2350d29847af\iexplore.exe
[2011/02/18 11:49:27 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=C84ABBF7D7AF2F7D004D800D10430FF5 – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18602_none_95d751d706bad592\iexplore.exe
[2010/03/09 12:56:10 | 000,711,448 | —- | M] (Microsoft Corporation) MD5=CDF4EDBA0498EF0FDEFDBB1C5E5B2CD6 – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.18444_none_8b59649cd278bbbb\iexplore.exe
[2009/12/18 09:17:05 | 000,711,432 | —- | M] (Microsoft Corporation) MD5=E3542162B46EFB2D6FA1C7DD2C3B810D – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.16982_none_8945e3ccd5746ab9\iexplore.exe
[2010/03/09 13:08:05 | 000,711,448 | —- | M] (Microsoft Corporation) MD5=E35AAC70094E88367FA984AD891D812C – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6000.21242_none_89fa9a4fee71cb28\iexplore.exe
[2010/10/21 14:50:10 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=ED748658B126A4617A4BA4A8F4F10DBE – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22784_none_960c6fd620178792\iexplore.exe
[2011/02/18 11:39:31 | 000,711,448 | —- | M] (Microsoft Corporation) MD5=F451E3E1709CCEABEAC734184ACA00E0 – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22857_none_8bdb380beb9bbaf0\iexplore.exe
[2010/12/20 11:47:18 | 000,711,448 | —- | M] (Microsoft Corporation) MD5=F474DFA13C957F1385ECC42A1096C976 – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22816_none_8c057771eb7c31d5\iexplore.exe
[2009/12/18 08:27:08 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=F47755101C622AF18EE669ECEB3A97AD – C:\WINDOWS\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22585_none_960d6c542016a69b\iexplore.exe
[2010/09/09 12:23:15 | 000,711,448 | —- | M] (Microsoft Corporation) MD5=F8C856A2A1C1550D95EE08DC57641C57 – C:\WINDOWS\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_6.0.6001.22760_none_8bc96433ebaa2859\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2006/11/02 11:13:34 | 000,016,384 | —- | M] (Microsoft Corporation) MD5=3CCDDDBC49DEACA370F39A9F0E146A1B – C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui
[2006/11/02 11:13:34 | 000,016,384 | —- | M] (Microsoft Corporation) MD5=3CCDDDBC49DEACA370F39A9F0E146A1B – C:\WINDOWS\winsxs\wow64_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_a1c8f6f0449888c1\iexplore.exe.mui
[2006/11/02 11:13:29 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=D421BD7B9646679254B0D855823C6F21 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2006/11/02 11:13:29 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=D421BD7B9646679254B0D855823C6F21 – C:\WINDOWS\winsxs\amd64_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_6.0.6000.16386_en-us_97744c9e1037c6c6\iexplore.exe.mui

< MD5 for: SERVICES >
[2006/09/18 17:37:24 | 000,017,244 | —- | M] () MD5=9F534244B7F8F55D5C0BB498D8D481E7 – C:\WINDOWS\winsxs\amd64_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.0.6001.18000_none_60a39df1afb86c9f\services

< MD5 for: SERVICES.CFG >
[2013/09/03 09:53:56 | 000,558,864 | —- | M] () MD5=4097D9DB7F5DB4533DDA8271136C9B7B – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Services\Services.cfg
[2011/06/06 13:55:30 | 000,584,045 | R— | M] () MD5=B82DD53FA8C260DDD7FDC42182DB816E – C:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\services.cfg

< MD5 for: SERVICES.CNF >
[2010/03/31 10:02:17 | 000,000,003 | —- | M] () MD5=864E46AD77EBE7A312EB11241A5114B6 – C:\Users\Gary\Documents\My Web Sites\_vti_pvt\services.cnf

< MD5 for: SERVICES.DAT >
[2014/04/06 00:32:27 | 000,004,173 | —- | M] () MD5=ED018DB6916ACAB46011A330B4B116AA – C:\Users\Gary\AppData\Local\Temp\jrt\services.dat

< MD5 for: SERVICES.EXE >
[2008/01/20 22:50:34 | 000,279,040 | —- | M] (Microsoft Corporation) MD5=2B336AB6286D6C81FA02CBAB914E3C6C – C:\WINDOWS\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.exe
[2009/04/11 03:10:50 | 000,384,512 | —- | M] (Microsoft Corporation) MD5=934E0B7D77FF78C18D9F8891221B6DE3 – C:\WINDOWS\erdnt\cache64\services.exe
[2009/04/11 03:10:50 | 000,384,512 | —- | M] (Microsoft Corporation) MD5=934E0B7D77FF78C18D9F8891221B6DE3 – C:\Windows\SysNative\services.exe
[2009/04/11 03:10:50 | 000,384,512 | —- | M] (Microsoft Corporation) MD5=934E0B7D77FF78C18D9F8891221B6DE3 – C:\WINDOWS\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_2d69d4f782c83d8c\services.exe
[2009/04/11 02:27:59 | 000,279,552 | —- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B – C:\WINDOWS\SysWOW64\services.exe
[2009/04/11 02:27:59 | 000,279,552 | —- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B – C:\WINDOWS\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe
[2008/01/20 22:49:44 | 000,384,512 | —- | M] (Microsoft Corporation) MD5=DFAC660F0F139276CC9299812DE42719 – C:\WINDOWS\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_2b7e5beb85a67240\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2006/11/02 11:13:31 | 000,017,920 | —- | M] (Microsoft Corporation) MD5=1626EACF0E7E59F85C59DDDD27C4169C – C:\WINDOWS\SysWOW64\en-US\services.exe.mui
[2006/11/02 11:13:31 | 000,017,920 | —- | M] (Microsoft Corporation) MD5=1626EACF0E7E59F85C59DDDD27C4169C – C:\WINDOWS\winsxs\x86_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.0.6000.16386_en-us_67c6851b290a1ced\services.exe.mui
[2006/11/02 11:13:56 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=F514B57C09E143F1E14415A9E9ADD695 – C:\Windows\SysNative\en-US\services.exe.mui
[2006/11/02 11:13:56 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=F514B57C09E143F1E14415A9E9ADD695 – C:\WINDOWS\winsxs\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.0.6000.16386_en-us_c3e5209ee1678e23\services.exe.mui

< MD5 for: SERVICES.HTM >
[2006/10/26 20:42:16 | 000,003,140 | —- | M] () MD5=065B93C99612C4DED50A5B82D1907D7A – C:\Program Files (x86)\Microsoft Expression\Templates\1033\WEBS12\smallbiz4.tem\SERVICES.HTM
[2009/06/09 09:59:08 | 000,003,662 | —- | M] () MD5=2D2B9857EE9194DE0D19180CE8BE3023 – C:\Program Files (x86)\Microsoft Expression\Web 3\en\WEBS\smallbiz2.tem\SERVICES.HTM
[2009/06/09 09:59:08 | 000,003,660 | —- | M] () MD5=385F319812E977BD0925828CB94E8B0D – C:\Program Files (x86)\Microsoft Expression\Web 3\en\WEBS\smallbiz3.tem\SERVICES.HTM
[2009/06/09 09:59:08 | 000,003,145 | —- | M] () MD5=4AF3252172928C3C2D801273F289FAC3 – C:\Program Files (x86)\Microsoft Expression\Web 3\en\WEBS\smallbiz4.tem\SERVICES.HTM
[2009/06/09 09:59:06 | 000,003,692 | —- | M] () MD5=7C0A432F0867E6E27067925774C6BB03 – C:\Program Files (x86)\Microsoft Expression\Web 3\en\WEBS\smallbiz1.tem\SERVICES.HTM
[2006/10/26 20:42:24 | 000,003,127 | —- | M] () MD5=8637B342EC124A00EC27DFCE45A3FCB7 – C:\Program Files (x86)\Microsoft Expression\Templates\1033\WEBS12\smallbiz5.tem\SERVICES.HTM
[2006/10/26 20:42:00 | 000,003,657 | —- | M] () MD5=9B68D7B32277521CB5240E7AFFD75ED3 – C:\Program Files (x86)\Microsoft Expression\Templates\1033\WEBS12\smallbiz2.tem\SERVICES.HTM
[2006/10/26 20:41:52 | 000,003,687 | —- | M] () MD5=A208808966BAB0309243FFB278B919EF – C:\Program Files (x86)\Microsoft Expression\Templates\1033\WEBS12\smallbiz1.tem\SERVICES.HTM
[2009/06/09 09:59:08 | 000,003,132 | —- | M] () MD5=BA10F0A870E107AD714B52D19F13556D – C:\Program Files (x86)\Microsoft Expression\Web 3\en\WEBS\smallbiz5.tem\SERVICES.HTM
[2009/06/09 09:59:08 | 000,003,119 | —- | M] () MD5=BF1F2DF30B367C20603E49284B55B5CD – C:\Program Files (x86)\Microsoft Expression\Web 3\en\WEBS\smallbiz6.tem\SERVICES.HTM
[2006/10/26 20:42:32 | 000,003,114 | —- | M] () MD5=C921BDE5D523A04DE3A7319B6C8E38A2 – C:\Program Files (x86)\Microsoft Expression\Templates\1033\WEBS12\smallbiz6.tem\SERVICES.HTM
[2006/10/26 20:42:08 | 000,003,655 | —- | M] () MD5=CF0DF3B55D7754DE445768728CF3EB66 – C:\Program Files (x86)\Microsoft Expression\Templates\1033\WEBS12\smallbiz3.tem\SERVICES.HTM

< MD5 for: SERVICES.JPG >
[2005/08/26 10:38:58 | 000,009,430 | —- | M] () MD5=5B42FB058ED1B06EC596BDCF3253CBD5 – C:\Program Files (x86)\Microsoft Expression\Templates\1033\WEBS12\smallbiz1.tem\SERVICES.JPG
[2005/08/26 10:46:14 | 000,009,430 | —- | M] () MD5=5B42FB058ED1B06EC596BDCF3253CBD5 – C:\Program Files (x86)\Microsoft Expression\Templates\1033\WEBS12\smallbiz2.tem\SERVICES.JPG
[2005/08/26 10:46:42 | 000,009,430 | —- | M] () MD5=5B42FB058ED1B06EC596BDCF3253CBD5 – C:\Program Files (x86)\Microsoft Expression\Templates\1033\WEBS12\smallbiz3.tem\SERVICES.JPG
[2005/08/26 10:47:18 | 000,009,430 | —- | M] () MD5=5B42FB058ED1B06EC596BDCF3253CBD5 – C:\Program Files (x86)\Microsoft Expression\Templates\1033\WEBS12\smallbiz4.tem\SERVICES.JPG
[2005/08/26 10:52:10 | 000,009,430 | —- | M] () MD5=5B42FB058ED1B06EC596BDCF3253CBD5 – C:\Program Files (x86)\Microsoft Expression\Templates\1033\WEBS12\smallbiz5.tem\SERVICES.JPG
[2005/08/26 10:52:32 | 000,009,430 | —- | M] () MD5=5B42FB058ED1B06EC596BDCF3253CBD5 – C:\Program Files (x86)\Microsoft Expression\Templates\1033\WEBS12\smallbiz6.tem\SERVICES.JPG
[2009/06/09 09:59:06 | 000,009,430 | —- | M] () MD5=5B42FB058ED1B06EC596BDCF3253CBD5 – C:\Program Files (x86)\Microsoft Expression\Web 3\en\WEBS\smallbiz1.tem\SERVICES.JPG
[2009/06/09 09:59:06 | 000,009,430 | —- | M] () MD5=5B42FB058ED1B06EC596BDCF3253CBD5 – C:\Program Files (x86)\Microsoft Expression\Web 3\en\WEBS\smallbiz2.tem\SERVICES.JPG
[2009/06/09 09:59:08 | 000,009,430 | —- | M] () MD5=5B42FB058ED1B06EC596BDCF3253CBD5 – C:\Program Files (x86)\Microsoft Expression\Web 3\en\WEBS\smallbiz3.tem\SERVICES.JPG
[2009/06/09 09:59:08 | 000,009,430 | —- | M] () MD5=5B42FB058ED1B06EC596BDCF3253CBD5 – C:\Program Files (x86)\Microsoft Expression\Web 3\en\WEBS\smallbiz4.tem\SERVICES.JPG
[2009/06/09 09:59:08 | 000,009,430 | —- | M] () MD5=5B42FB058ED1B06EC596BDCF3253CBD5 – C:\Program Files (x86)\Microsoft Expression\Web 3\en\WEBS\smallbiz5.tem\SERVICES.JPG
[2009/06/09 09:59:08 | 000,009,430 | —- | M] () MD5=5B42FB058ED1B06EC596BDCF3253CBD5 – C:\Program Files (x86)\Microsoft Expression\Web 3\en\WEBS\smallbiz6.tem\SERVICES.JPG

< MD5 for: SERVICES.LNK >
[2008/01/20 23:20:59 | 000,001,688 | —- | M] () MD5=EFDD08F4E5E26430885F26F0C35B8C62 – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2008/01/20 23:20:59 | 000,001,688 | —- | M] () MD5=EFDD08F4E5E26430885F26F0C35B8C62 – C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk

< MD5 for: SERVICES.MOF >
[2006/09/18 17:44:54 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\SysNative\wbem\services.mof
[2006/09/18 17:46:11 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\WINDOWS\SysWOW64\wbem\services.mof
[2006/09/18 17:44:54 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\WINDOWS\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_2b7e5beb85a67240\services.mof
[2006/09/18 17:44:54 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\WINDOWS\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_2d69d4f782c83d8c\services.mof
[2006/09/18 17:46:11 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\WINDOWS\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.mof
[2006/09/18 17:46:11 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\WINDOWS\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.mof

< MD5 for: SERVICES.MSC >
[2006/11/02 11:13:51 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysNative\en-US\services.msc
[2006/09/18 17:29:41 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysNative\services.msc
[2006/11/02 11:14:00 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\WINDOWS\SysWOW64\en-US\services.msc
[2006/09/18 17:29:40 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\WINDOWS\SysWOW64\services.msc
[2006/11/02 11:13:51 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\WINDOWS\winsxs\amd64_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.0.6000.16386_en-us_fe26f08ab7d12816\services.msc
[2006/09/18 17:29:41 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\WINDOWS\winsxs\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.0.6001.18000_none_2b827e27fe185619\services.msc
[2006/11/02 11:14:00 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\WINDOWS\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.0.6000.16386_en-us_a2085506ff73b6e0\services.msc
[2006/09/18 17:29:40 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\WINDOWS\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.0.6001.18000_none_cf63e2a445bae4e3\services.msc

< MD5 for: SERVICES.PNG >
[2008/03/26 14:02:52 | 000,000,875 | —- | M] () MD5=3382D191625A7528ED791FEDCCE3F212 – C:\Program Files (x86)\PC-Doctor 5 for Windows\Images\img16_16\services.png
[2008/03/27 05:57:28 | 000,003,334 | —- | M] () MD5=5FF3A00670DE8D80ADA4BD034B55D154 – C:\Program Files (x86)\CoffeeCup Software\CoffeeCup Free HTML Editor\Graphics\CoffeeCup Graphics Pack Samples\Red\services.png
[2008/03/26 14:03:00 | 000,002,244 | —- | M] () MD5=8C5F2C34A5FB317B868565F9451BF74C – C:\Program Files (x86)\PC-Doctor 5 for Windows\Images\img32_32\services.png
[2008/03/26 14:03:08 | 000,006,479 | —- | M] () MD5=AFCA60ED198BE9309943722FE8758392 – C:\Program Files (x86)\PC-Doctor 5 for Windows\Images\img64_64\services.png
[2008/03/27 05:38:18 | 000,003,827 | —- | M] () MD5=BFC0958B73C61EE6C5EEA8D8C6073D26 – C:\Program Files (x86)\CoffeeCup Software\CoffeeCup Free HTML Editor\Graphics\CoffeeCup Graphics Pack Samples\Blue\services.png
[2008/03/26 14:03:04 | 000,004,193 | —- | M] () MD5=E1C3A20056206C394E65B37CE1D43851 – C:\Program Files (x86)\PC-Doctor 5 for Windows\Images\img48_48\services.png
[2008/03/26 14:02:56 | 000,001,509 | —- | M] () MD5=F4EC3ABEAE15FA9BB42D721E9D543F44 – C:\Program Files (x86)\PC-Doctor 5 for Windows\Images\img24_24\services.png

< MD5 for: WINLOGON.EXE >
[2009/04/11 03:11:08 | 000,405,504 | —- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A – C:\WINDOWS\erdnt\cache64\winlogon.exe
[2009/04/11 03:11:08 | 000,405,504 | —- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A – C:\Windows\SysNative\winlogon.exe
[2009/04/11 03:11:08 | 000,405,504 | —- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A – C:\WINDOWS\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_cdcd15a68a70b877\winlogon.exe
[2008/01/20 22:49:47 | 000,406,016 | —- | M] (Microsoft Corporation) MD5=856491FCED98093D824B9EB2892F564A – C:\WINDOWS\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_cbe19c9a8d4eed2b\winlogon.exe
[2009/04/11 02:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\WINDOWS\SysWOW64\winlogon.exe
[2009/04/11 02:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\WINDOWS\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2013/04/04 14:50:32 | 000,218,184 | —- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/01/20 22:50:38 | 000,314,880 | —- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 – C:\WINDOWS\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2008/01/20 22:52:39 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=1DB95B0920FA9783476AC46F187C06F6 – C:\Windows\SysNative\en-US\winlogon.exe.mui
[2008/01/20 22:52:39 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=1DB95B0920FA9783476AC46F187C06F6 – C:\WINDOWS\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.0.6001.18000_en-us_27172d0ebc73e370\winlogon.exe.mui
[2008/01/20 22:52:28 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=26AC28BF50DC112BAA794A83E08588F0 – C:\WINDOWS\SysWOW64\en-US\winlogon.exe.mui
[2008/01/20 22:52:28 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=26AC28BF50DC112BAA794A83E08588F0 – C:\WINDOWS\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.0.6001.18000_en-us_caf8918b0416723a\winlogon.exe.mui
[2006/11/02 11:13:52 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=2D30AB05DBA78517B34C0AAC71DF5299 – C:\WINDOWS\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.0.6000.16386_en-us_24e06b12bf88d29c\winlogon.exe.mui
[2006/11/02 11:13:03 | 000,028,672 | —- | M] (Microsoft Corporation) MD5=A1D2856F3EC3C86EBBF1442B0245A8B3 – C:\WINDOWS\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.0.6000.16386_en-us_c8c1cf8f072b6166\winlogon.exe.mui

< MD5 for: WINLOGON.MOF >
[2006/09/18 17:38:40 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\Windows\SysNative\wbem\winlogon.mof
[2006/09/18 17:41:56 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\WINDOWS\SysWOW64\wbem\winlogon.mof
[2006/09/18 17:38:40 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\WINDOWS\winsxs\amd64_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.0.6000.16386_none_da20a358315a3dca\winlogon.mof
[2006/09/18 17:41:56 | 000,002,794 | —- | M] () MD5=545C578F290B9CDD280966939935B9EA – C:\WINDOWS\winsxs\x86_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.0.6000.16386_none_7e0207d478fccc94\winlogon.mof

< %SYSTEMDRIVE%\*.* >
[2009/04/11 02:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2008/05/17 00:03:10 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.1028.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.1031.txt
[2007/11/07 09:00:40 | 000,010,134 | —- | M] () – C:\eula.1033.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.1036.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.1040.txt
[2007/11/07 09:00:40 | 000,000,118 | —- | M] () – C:\eula.1041.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.1042.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.2052.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.3082.txt
[2007/11/07 09:00:40 | 000,001,110 | —- | M] () – C:\globdata.ini
[2007/11/06 22:13:41 | 000,359,256 | —- | M] (Hewlett-Packard) – C:\hpzids40.dll
[2007/11/07 09:00:40 | 000,000,843 | —- | M] () – C:\install.ini
[2007/11/07 09:03:18 | 000,076,304 | —- | M] (Microsoft Corporation) – C:\install.res.1028.dll
[2007/11/07 09:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.1031.dll
[2007/11/07 09:03:18 | 000,091,152 | —- | M] (Microsoft Corporation) – C:\install.res.1033.dll
[2007/11/07 09:03:18 | 000,097,296 | —- | M] (Microsoft Corporation) – C:\install.res.1036.dll
[2007/11/07 09:03:18 | 000,095,248 | —- | M] (Microsoft Corporation) – C:\install.res.1040.dll
[2007/11/07 09:03:18 | 000,081,424 | —- | M] (Microsoft Corporation) – C:\install.res.1041.dll
[2007/11/07 09:03:18 | 000,079,888 | —- | M] (Microsoft Corporation) – C:\install.res.1042.dll
[2007/11/07 09:03:18 | 000,075,792 | —- | M] (Microsoft Corporation) – C:\install.res.2052.dll
[2007/11/07 09:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.3082.dll
[2011/02/12 19:30:02 | 000,000,730 | -H– | M] () – C:\IPH.PH
[2006/12/02 02:37:14 | 000,904,704 | —- | M] (Microsoft Corporation) – C:\msdia80.dll
[2014/05/01 09:36:41 | 2460,303,359 | -HS- | M] () – C:\pagefile.sys
[2007/11/07 09:00:40 | 000,005,686 | —- | M] () – C:\vcredist.bmp
[2007/11/07 09:09:22 | 001,442,522 | —- | M] () – C:\VC_RED.cab
[2007/11/07 09:12:28 | 000,232,960 | —- | M] () – C:\VC_RED.MSI

< %systemroot%\Fonts\*.com >
[2006/11/02 11:06:41 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 11:06:41 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 11:06:41 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2010/03/23 08:50:24 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 17:35:48 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2010/05/16 10:57:33 | 000,001,642 | -H– | M] () – C:\Users\Gary\AppData\Roaming\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >
[2008/01/20 23:21:59 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< dir "%systemdrive%\*" /S /A:L /C >
Volume in drive C is HP
Volume Serial Number is E0C7-814C
Directory of C:\
03/18/2010 04:39 PM Documents and Settings [C:\Users]
0 File(s) 0 bytes
Directory of C:\ProgramData
03/18/2010 04:39 PM Application Data [C:\ProgramData]
03/18/2010 04:39 PM Desktop [C:\Users\Public\Desktop]
03/18/2010 04:39 PM Documents [C:\Users\Public\Documents]
03/18/2010 04:39 PM Favorites [C:\Users\Public\Favorites]
03/18/2010 04:39 PM Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
03/18/2010 04:39 PM Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users
03/18/2010 04:39 PM All Users [C:\ProgramData]
03/18/2010 04:39 PM Default User [C:\Users\Default]
0 File(s) 0 bytes
Directory of C:\Users\All Users
03/18/2010 04:39 PM Application Data [C:\ProgramData]
03/18/2010 04:39 PM Desktop [C:\Users\Public\Desktop]
03/18/2010 04:39 PM Documents [C:\Users\Public\Documents]
03/18/2010 04:39 PM Favorites [C:\Users\Public\Favorites]
03/18/2010 04:39 PM Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
03/18/2010 04:39 PM Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Default
03/18/2010 04:39 PM Application Data [C:\Users\Default\AppData\Roaming]
03/18/2010 04:39 PM Local Settings [C:\Users\Default\AppData\Local]
03/18/2010 04:39 PM My Documents [C:\Users\Default\Documents]
03/18/2010 04:39 PM NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
03/18/2010 04:39 PM PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
03/18/2010 04:39 PM Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]
03/18/2010 04:39 PM SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]
03/18/2010 04:39 PM Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]
03/18/2010 04:39 PM Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Default\AppData\Local
03/18/2010 04:39 PM Application Data [C:\Users\Default\AppData\Local]
03/18/2010 04:39 PM History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]
03/18/2010 04:39 PM Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Default\Documents
03/18/2010 04:39 PM My Music [C:\Users\Default\Music]
03/18/2010 04:39 PM My Pictures [C:\Users\Default\Pictures]
03/18/2010 04:39 PM My Videos [C:\Users\Default\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Gary
03/18/2010 04:43 PM Application Data [C:\Users\Gary\AppData\Roaming]
03/18/2010 04:43 PM Cookies [C:\Users\Gary\AppData\Roaming\Microsoft\Windows\Cookies]
03/18/2010 04:43 PM Local Settings [C:\Users\Gary\AppData\Local]
03/18/2010 04:43 PM My Documents [C:\Users\Gary\Documents]
03/18/2010 04:43 PM NetHood [C:\Users\Gary\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
03/18/2010 04:43 PM PrintHood [C:\Users\Gary\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
03/18/2010 04:43 PM Recent [C:\Users\Gary\AppData\Roaming\Microsoft\Windows\Recent]
03/18/2010 04:43 PM SendTo [C:\Users\Gary\AppData\Roaming\Microsoft\Windows\SendTo]
03/18/2010 04:43 PM Start Menu [C:\Users\Gary\AppData\Roaming\Microsoft\Windows\Start Menu]
03/18/2010 04:43 PM Templates [C:\Users\Gary\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Gary\AppData\Local
03/18/2010 04:43 PM Application Data [C:\Users\Gary\AppData\Local]
03/18/2010 04:43 PM History [C:\Users\Gary\AppData\Local\Microsoft\Windows\History]
03/18/2010 04:43 PM Temporary Internet Files [C:\Users\Gary\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Gary\Documents
03/18/2010 04:43 PM My Music [C:\Users\Gary\Music]
03/18/2010 04:43 PM My Pictures [C:\Users\Gary\Pictures]
03/18/2010 04:43 PM My Videos [C:\Users\Gary\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Public\Documents
03/18/2010 04:39 PM My Music [C:\Users\Public\Music]
03/18/2010 04:39 PM My Pictures [C:\Users\Public\Pictures]
03/18/2010 04:39 PM My Videos [C:\Users\Public\Videos]
0 File(s) 0 bytes
Directory of C:\Users\UpdatusUser
05/15/2012 08:02 AM Application Data [C:\Users\UpdatusUser\AppData\Roaming]
05/15/2012 08:02 AM Cookies [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Cookies]
05/15/2012 08:02 AM Local Settings [C:\Users\UpdatusUser\AppData\Local]
05/15/2012 08:02 AM My Documents [C:\Users\UpdatusUser\Documents]
05/15/2012 08:02 AM NetHood [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
05/15/2012 08:02 AM PrintHood [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
05/15/2012 08:02 AM Recent [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Recent]
05/15/2012 08:02 AM SendTo [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\SendTo]
05/15/2012 08:02 AM Start Menu [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu]
05/15/2012 08:02 AM Templates [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\UpdatusUser\AppData\Local
05/15/2012 08:02 AM Application Data [C:\Users\UpdatusUser\AppData\Local]
05/15/2012 08:02 AM History [C:\Users\UpdatusUser\AppData\Local\Microsoft\Windows\History]
05/15/2012 08:02 AM Temporary Internet Files [C:\Users\UpdatusUser\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\UpdatusUser\Documents
05/15/2012 08:02 AM My Music [C:\Users\UpdatusUser\Music]
05/15/2012 08:02 AM My Pictures [C:\Users\UpdatusUser\Pictures]
05/15/2012 08:02 AM My Videos [C:\Users\UpdatusUser\Videos]
0 File(s) 0 bytes
Directory of C:\WINDOWS\System32\config\systemprofile
03/25/2010 08:18 PM Application Data [C:\Windows\system32\config\systemprofile\AppData\Roaming]
03/25/2010 08:18 PM Local Settings [C:\Windows\system32\config\systemprofile\AppData\Local]
03/25/2010 08:18 PM My Documents [C:\Windows\system32\config\systemprofile\Documents]
03/25/2010 08:18 PM NetHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
03/25/2010 08:18 PM PrintHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
03/25/2010 08:18 PM Recent [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent]
03/25/2010 08:18 PM SendTo [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo]
03/25/2010 08:18 PM Start Menu [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu]
03/25/2010 08:18 PM Templates [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\WINDOWS\System32\config\systemprofile\AppData\Local
03/25/2010 08:18 PM Application Data [C:\Windows\system32\config\systemprofile\AppData\Local]
03/25/2010 08:18 PM History [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History]
03/25/2010 08:18 PM Temporary Internet Files [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\WINDOWS\System32\config\systemprofile\Documents
03/25/2010 08:18 PM My Music [C:\Windows\system32\config\systemprofile\Music]
03/25/2010 08:18 PM My Pictures [C:\Windows\system32\config\systemprofile\Pictures]
03/25/2010 08:18 PM My Videos [C:\Windows\system32\config\systemprofile\Videos]
0 File(s) 0 bytes
Directory of C:\WINDOWS\SysWOW64\config\systemprofile
03/25/2010 08:18 PM Application Data [C:\Windows\system32\config\systemprofile\AppData\Roaming]
03/25/2010 08:18 PM Local Settings [C:\Windows\system32\config\systemprofile\AppData\Local]
03/25/2010 08:18 PM My Documents [C:\Windows\system32\config\systemprofile\Documents]
03/25/2010 08:18 PM NetHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
03/25/2010 08:18 PM PrintHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
03/25/2010 08:18 PM Recent [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent]
03/25/2010 08:18 PM SendTo [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo]
03/25/2010 08:18 PM Start Menu [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu]
03/25/2010 08:18 PM Templates [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Local
03/25/2010 08:18 PM Application Data [C:\Windows\system32\config\systemprofile\AppData\Local]
03/25/2010 08:18 PM History [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History]
03/25/2010 08:18 PM Temporary Internet Files [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\WINDOWS\SysWOW64\config\systemprofile\Documents
03/25/2010 08:18 PM My Music [C:\Windows\system32\config\systemprofile\Music]
03/25/2010 08:18 PM My Pictures [C:\Windows\system32\config\systemprofile\Pictures]
03/25/2010 08:18 PM My Videos [C:\Windows\system32\config\systemprofile\Videos]
0 File(s) 0 bytes
Total Files Listed:
0 File(s) 0 bytes
95 Dir(s) 124,629,340,160 bytes free

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/03/23 09:06:34 | 000,000,286 | -HS- | M] () – C:\Users\Gary\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2014/05/01 09:19:14 | 006,369,640 | —- | M] () – C:\Users\Gary\Desktop\adblocker_setup.exe
[2014/04/30 20:05:32 | 001,310,621 | —- | M] () – C:\Users\Gary\Desktop\adwcleaner.exe
[2014/04/30 21:05:09 | 010,971,424 | —- | M] (SurfRight B.V.) – C:\Users\Gary\Desktop\HitmanPro_x64.exe
[2014/04/06 02:36:06 | 001,016,261 | —- | M] (Thisisu) – C:\Users\Gary\Desktop\JRT_NEW.exe
[2014/05/01 09:54:38 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Gary\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 64 bytes -> C:\Users\Gary\Desktop\tehhobtextd72.mkv:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Gary\Desktop\escpepln72-G.mkv:TOC.WMV
@Alternate Data Stream - 453 bytes -> C:\Users\Gary\Desktop\2-5.jpg:com.dropbox.attributes
@Alternate Data Stream - 449 bytes -> C:\Users\Gary\Desktop\2-4.jpg:com.dropbox.attributes
@Alternate Data Stream - 449 bytes -> C:\Users\Gary\Desktop\2-1.jpg:com.dropbox.attributes
@Alternate Data Stream - 448 bytes -> C:\Users\Gary\Desktop\2-2.jpg:com.dropbox.attributes
@Alternate Data Stream - 446 bytes -> C:\Users\Gary\Desktop\2-3.jpg:com.dropbox.attributes
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:B2AA1B61

< End of report >


OTL Extras logfile created on: 5/1/2014 9:59:29 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Gary\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

6.00 Gb Total Physical Memory | 3.78 Gb Available Physical Memory | 63.08% Memory free
12.17 Gb Paging File | 9.84 Gb Available in Paging File | 80.87% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 687.32 Gb Total Space | 116.08 Gb Free Space | 16.89% Space Free | Partition Type: NTFS
Drive D: | 11.31 Gb Total Space | 1.10 Gb Free Space | 9.77% Space Free | Partition Type: NTFS

Computer Name: GARY-PC | User Name: Gary | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html[@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
InternetShortcut [print] – rundll32.exe C:\Windows\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data]
"VistaSp2" = A5 BF CE 35 89 CA CA 01 [binary data]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0294BB2F-6178-459D-8C46-8D1C40D6AD6B}" = rport=445 | protocol=6 | dir=out | app=system |
"{057550CC-1C7E-4C7B-A2F8-3A8DDC978C8C}" = lport=138 | protocol=17 | dir=in | app=system |
"{08E024BB-596A-4DFF-A430-159062EB67CE}" = lport=10243 | protocol=6 | dir=in | app=system |
"{0979CC93-4C42-4F33-B8FC-289C7E508369}" = rport=445 | protocol=6 | dir=out | app=system |
"{19A5737B-0BEE-43C8-BCD3-3CC714AA4FD3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1D66DAF0-173D-464D-9FDD-97B32587D1F2}" = rport=138 | protocol=17 | dir=out | app=system |
"{23585E9C-2B2C-4776-BD18-2A4348D0DBCD}" = rport=139 | protocol=6 | dir=out | app=system |
"{25B9D31D-64EC-44F5-900B-17177C3E5D3C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{295EF879-34FC-4A05-A484-51AA1443280E}" = lport=445 | protocol=6 | dir=in | app=system |
"{2FA65B31-3A9D-4C20-AFC6-469495F0EF44}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{30549F92-B78C-4CB2-81B8-8371ED2066B4}" = rport=137 | protocol=17 | dir=out | app=system |
"{4084E937-EAAA-47EE-9520-7BE7CE434C09}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4A47D9DD-8FE4-4F4E-8583-B5B25732EF6C}" = lport=137 | protocol=17 | dir=in | app=system |
"{4BF5EB07-06A2-40E2-B5B6-244EF5C49A0F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{5456EA1E-AF45-48BD-9C96-AB99A6CCF1D9}" = lport=139 | protocol=6 | dir=in | app=system |
"{6364B77A-8796-4078-B3CC-5963A3E70B4F}" = rport=139 | protocol=6 | dir=out | app=system |
"{6EFD3216-D4DB-448C-81DA-E8838C66FFD2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{774D286A-4B07-48D0-83BF-46CD4E949D2E}" = lport=138 | protocol=17 | dir=in | app=system |
"{7C7BD74E-D59D-40F9-8481-A74C4729E9DD}" = rport=138 | protocol=17 | dir=out | app=system |
"{817AE5A9-4F49-486E-93D4-DB3BB352A5BE}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{83CA6307-4E92-490D-84B1-706180AAAEB7}" = lport=139 | protocol=6 | dir=in | app=system |
"{86444BB3-291D-4D31-A046-BB4AA3243C28}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A6740674-D439-4731-904D-7A2358CEE775}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{AF8150A9-8B4A-4262-900E-D368942052B3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BE10AB93-C4A6-464B-BE93-069E778BFF99}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C232D951-55E7-4D04-9346-F88A07FC0B22}" = lport=137 | protocol=17 | dir=in | app=system |
"{C428A183-FD79-40B5-990D-895328F43AC8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{C7F059AA-3E6D-419B-ABA7-63FE852D4F23}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{CF0676E6-E2EC-438A-9741-7029DEBD00CE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D5C81FCA-D318-4E7D-9CF8-0E0BAE42C2B8}" = lport=445 | protocol=6 | dir=in | app=system |
"{DFFEFBE6-89BD-4BEE-9798-A6B7EB7BBAAC}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{F534D21D-02A4-4E48-A237-A3745ED5E6D3}" = rport=137 | protocol=17 | dir=out | app=system |
"{F9C1EEE5-72B7-40C6-BC7C-64E9DF7DEB39}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{003C7A18-60D9-4C89-94D8-DE42C1AA1D76}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{006BA28B-2F62-4542-B0D6-A4A02EF28660}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mrrobot\mrrobot.exe |
"{00E8629C-F9A2-48B5-A509-176CCF5E4285}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\bastion\bastion.exe |
"{01368529-B554-4AD2-A32B-972BFE06C5BB}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\torchlight ii\modlauncher.exe |
"{02A4D600-582A-4C14-ADFE-C125CF0CB18F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{0684A7E0-2296-42D0-908A-784E4744CC5F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dark souls prepare to die edition\data\darksouls.exe |
"{1473D86F-6F04-46A3-9153-CD04272511DC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{16B1069A-CEE7-4576-89B3-B8ECC53F62EC}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\fez\fez_launchoptions.exe |
"{268AE666-0AAF-46B0-A9B8-60BD1EDF7580}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\half-life\hl.exe |
"{2F413380-2C92-4597-9E73-9DD6D35DBB38}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\torchlight ii\modlauncher.exe |
"{36F88136-2142-48A0-87B3-60C52BA2A293}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dark souls prepare to die edition\data\darksouls.exe |
"{37C974AC-B1CF-4D88-AD5D-08D137A3F2FF}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{3E4F2B0C-3A81-48AC-9F49-3157BC75FF81}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\torchlight ii\torchlight2demo.exe |
"{4849799C-D8E9-4360-8F9A-6B5F2BCC7EA4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{5075E18A-715A-4A9E-89E0-178BB000C826}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{50C9EFA5-FD28-4275-A080-3099F7708DBD}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mrrobot\mrrobot.exe |
"{56E808A1-BFD0-4B79-B567-B9FA848D697F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{594B3451-B0EB-40A4-8AFE-148B28B51D73}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{61FB8AD2-C831-45AB-9DFB-D685C3A8300D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{62F27534-2769-4D2F-B42F-E96E62F64F44}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{65901CFC-D156-4C8F-90EA-C26D256CA195}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{68F6992D-6E9D-4F14-88EC-3E0B8BEC7EFF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{79A2573B-3584-4CA4-B575-4A2574B2483B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\torchlight ii\torchlight2demo.exe |
"{7C7B4AEC-6750-4E41-B27B-BA1D10E59EFA}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{81F286C5-C47F-457A-9E45-01FAB9FD86FB}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\bastion\bastion.exe |
"{8642AF85-31DC-4BB3-8E9D-1E478C224084}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8FD9CA62-80EC-446C-990C-9403A57980D7}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{951616CE-E1A8-4C32-A53E-194ED7B459CF}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{970905B8-92AD-4342-99F5-1F9E8D5A2FA7}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{980E8C34-737C-4D5C-9A5C-FF6B035F4930}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\fez\fez_launchoptions.exe |
"{9CFC408F-4532-43A0-841A-A96FDFE71313}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{A3BF6180-276A-490A-8186-8D0E91DC1051}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{A5589677-56C4-46C1-A86B-1F0B5425786F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A8831BB2-6293-49BE-942F-6686326AAEDE}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{AB3FBA72-52C3-4476-9A38-230DBE05659B}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BB5DFAEA-A405-472B-BE59-8DF2E1302003}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\fez\fez.exe |
"{BC7833D1-AE4B-4CAB-BDD5-6EA587E5C763}" = protocol=6 | dir=out | app=system |
"{C9DC80E4-5978-4633-A713-F5C9F254ED29}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\fez\fez.exe |
"{CE504808-152F-4073-8BB9-0F8E7C4D30C6}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D3648D1D-2BA3-4973-9B7E-EDC907B6E342}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DF45B6FB-1A47-4012-AA1F-A8595CDD01CB}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{E8715BB0-E132-4617-B344-62E03BFE2C1C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E926E57D-011D-4F63-BCC5-FFCFDC28D091}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{EABC12E0-1EF2-40CE-A13A-CF32692D4829}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{EFA98652-B437-42AA-B7D3-EFFD71ED4ECD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F7DCF881-DB9D-4779-8D1C-CCCBAC7C73FF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{FA8B2989-954D-480F-A90C-B2FDFFCEAFEE}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\half-life\hl.exe |
"TCP Query User{51C10A2E-8794-4A98-A0C9-95E583752C20}C:\program files (x86)\pando networks\media booster\pmb.exe" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"TCP Query User{5E8A0959-568D-42C8-A967-9FFEBD6F855A}C:\users\gary\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\gary\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{68C80243-4F95-4B5E-A22C-1597F434C29C}C:\program files (x86)\steam\steamapps\common\q.u.b.e. demo\binaries\win32\qube_demo.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\q.u.b.e. demo\binaries\win32\qube_demo.exe |
"TCP Query User{855D6E5C-8B4C-4C8B-9A1D-D4BD3DD13E3B}C:\program files (x86)\steam\steamapps\common\dark souls prepare to die edition\data\data.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dark souls prepare to die edition\data\data.exe |
"TCP Query User{E00A1DB0-E4E8-4B0E-BFE7-2526710C814E}C:\program files (x86)\origin games\mass effect 3\binaries\win32\masseffect3.exe" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\mass effect 3\binaries\win32\masseffect3.exe |
"UDP Query User{48049B9E-0A0F-4677-9A7C-A3F92A09E2BB}C:\program files (x86)\steam\steamapps\common\dark souls prepare to die edition\data\data.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dark souls prepare to die edition\data\data.exe |
"UDP Query User{5DDA0368-A19A-4D9B-BBC0-BC63DDB55100}C:\program files (x86)\steam\steamapps\common\q.u.b.e. demo\binaries\win32\qube_demo.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\q.u.b.e. demo\binaries\win32\qube_demo.exe |
"UDP Query User{64260284-B835-4A6A-9D22-3B4915D14F58}C:\program files (x86)\origin games\mass effect 3\binaries\win32\masseffect3.exe" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\mass effect 3\binaries\win32\masseffect3.exe |
"UDP Query User{D69F9FC2-6B62-43ED-90D7-829B0CAC0928}C:\users\gary\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\gary\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{E80B13F4-C940-43E8-945A-6C815957C13E}C:\program files (x86)\pando networks\media booster\pmb.exe" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{15262012-213A-4f65-9019-C8A409EC0156}" = HP Officejet J6400 Series
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{240FCE0B-F553-4ab3-9C7B-3CD082FCA117}" = NetDeviceManager64
"{26A24AE4-039D-4CA4-87B4-2F86417025FF}" = Java 7 Update 25 (64-bit)
"{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{7DEBE4EB-6B40-3766-BB35-5CBBC385DA37}" = Microsoft .NET Framework 4.5.1
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{82ED9FB2-55AF-4A61-A6F3-506CEE112779}" = Motorola Mobile Drivers Installation 4.7.1
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8F473675-D702-45F9-8EBC-342B40C17BF5}" = Apple Mobile Device Support
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.1
"{9545E9DB-6F4C-4404-BF25-E221BE8B44C5}" = iTunes
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 335.23
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 335.23
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.13.1220
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.11.3
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{BD90BC1C-115D-47E1-B85C-07AE182C3AB8}" = Smart Technology Programming Software [removed]
"{C5856970-6B43-41AC-B4A6-BB0B3E80F52B}_is1" = HP Demo
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E4F5E48E-7155-4CF9-88CD-7F377EC9AC54}" = Bonjour
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{FF21C3E6-97FD-474F-9518-8DCBE94C2854}" = 64 Bit HP CIO Components Installer
"AC3ACM" = AC-3 ACM Codec
"CNXT_MODEM_PCI_VEN_14F1&DEV;_2F20&SUBSYS;_200C14F1" = Soft Data Fax Modem with SmartCP
"HP Document Manager" = HP Document Manager 1.0
"HP Imaging Device Functions" = HP Imaging Device Functions 10.0
"HP Photosmart Essential" = HP Photosmart Essential 2.5
"HP Smart Web Printing" = HP Smart Web Printing
"HP Solution Center & Imaging Support Tools" = HP Solution Center 10.0
"HPExtendedCapabilities" = HP Customer Participation Program 10.0
"HPOCR" = OCR Software by I.R.I.S. 10.0
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"OfficeTrial" = Microsoft Office Home and Student 60 day trial
"Shop for HP Supplies" = Shop for HP Supplies
"sp6" = Logitech SetPoint 6.20
"UDK-20cb887a-3656-4f82-9238-fc15b5fecad2" = My Game Long Name

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis(R)
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{034B8288-5C7B-E367-9E50-DFC71D599675}" = Acukwik
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{06B7DE4D-9098-41AF-B0C0-D3129C72E483}" = Roads of Rome 2
"{0A2C5854-557E-48C8-835A-3B9F074BDCAA}" = Python 2.5
"{0BCA9EFD-F2D6-4638-B053-8693BA0404BE}" = Citrix online plug-in (Web)
"{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox
"{13086F8B-2AA9-4488-BC9C-BB6B912A5524}" = muvee autoProducer 6.1
"{14DC0059-00F1-4F62-BD1A-AB23CD51A95E}" = Adobe AIR
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{18669FF9-C8FE-407a-9F70-E674896B1DB4}" = GPBaseService
"{188C0E25-3D65-4DAC-9C00-7483FBA4C7EB}" = Status
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1ADE23D7-7A1E-4AEC-BA5D-EB8A21BED943}" = Video DVD Maker v3.10.0.28
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check for Health Check
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17
"{279D3818-7287-4ab4-A927-542EBEA9E365}" = ProductContext
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{305D4B08-5807-4475-B1C8-D54685534864}" = LightScribeTemplateLabeler
"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE
"{36FDBE6E-6684-462b-AE98-9A39A1B200CC}" = HPProductAssistant
"{37D4AB78-5281-44EE-91D8-B65CFE509851}" = Unified Remote
"{380CC749-8C28-4C74-BE01-45921D062302}" = BPDSoftware_Ini
"{3A9E0E2F-B0D1-452B-B833-7A7300EA1231}" = Saitek NT Controller Drivers
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{41853D20-40CC-4266-978D-F128BB97CA96}" = 6400_Help
"{44F2B651-A86A-4B6C-8563-07B66F00F8F8}_is1" = Hawke BRC 1.1.0
"{46BA053F-57B3-4153-BDB6-D37EEC8B12D7}" = LightScribe System Software
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4D87DC92-C328-46EC-A7B4-9C88129DC696}" = Dead Space
"{4F94119D-1B71-400e-9F04-B4E5CEAE71F8}_is1" = Sothink Movie DVD Maker
"{5109C064-813E-4e87-B0DE-C8AF7B5BC02B}" = SmartWebPrintingOC
"{52A69E11-7CEB-4a7d-9607-68BA4F39A89B}" = DeviceDiscovery
"{55392E52-1AAD-44C4-BE49-258FFE72434F}" = Citrix online plug-in (USB)
"{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}" = HP Picasso Media Center Add-In
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5ACE69F0-A3E8-44eb-88C1-0A841E700180}" = TrayApp
"{5BB4D7C1-52F2-4BFD-9E40-0D419E2E3021}" = bpd_scan
"{5D934326-165A-413b-B056-26BE1EC082AF}" = J6400
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F4C776F-8CBD-4C4F-892F-B568ABDD70C8}" = GameSpy Comrade
"{5F8E2CBB-949D-4175-AC98-5ADE7F6C9697}" = NCsoft Launcher
"{6033673D-2530-4587-8AD0-EB059FC263F9}" = Crysis® 2
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{65BCF909-6AF7-4B01-8EB3-713CE2873DC8}" = Microsoft Expression Web 3
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{676981B7-A2D9-49D0-9F4C-03018F131DA9}" = DocProc
"{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6F3D2F66-F050-45E3-BEB1-6523FE6D6690}" = MotoHelper MergeModules
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71C4C379-3E31-48E6-95EF-9C6EBCF94981}" = Flight Explorer Premier Edition 12.1.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{744F6CCF-9F56-40A0-A33D-2A45D53B6046}" = Hoyle Card Games 2004
"{752E90AC-3F11-4EA3-88EA-96441047EC31}" = Microsoft Expression Web 3 SP1
"{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}" = Mass Effect 2
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{79896C28-C277-42d5-990A-D98E10682654}" = Titan Quest
"{80407BA7-7763-4395-AB98-5233F1B34E65}" = NVIDIA PhysX
"{80533B67-C407-485D-8B5D-63BB8ED9D878}" = Scan
"{812424AC-A8B5-44E6-8D48-07E939D1AD9A}" = Citrix online plug-in (HDX)
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{85C8D391-0EAE-4492-8A0A-2EE8B0B6DA03}" = BPDSoftware
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A85DEAD-7C1F-4368-881C-72AC74CB2E91}" = UnloadSupport
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ULTIMATER_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_WebDesigner_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ULTIMATER_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}_WebDesigner_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ULTIMATER_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}_WebDesigner_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-0026-0000-0000-0000000FF1CE}" = Microsoft Expression Web
"{90120000-0026-0000-0000-0000000FF1CE}_WebDesigner_{9037FDA8-8383-4B6F-859D-D49C3C625225}" = Microsoft Expression Web Service Pack 1 (SP1)
"{90120000-0026-0409-0000-0000000FF1CE}" = Microsoft Expression Web MUI (English)
"{90120000-0026-0409-0000-0000000FF1CE}_WebDesigner_{C00A9857-850C-4C68-A583-2EF4F24706F5}" = Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ULTIMATER_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_WebDesigner_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_ULTIMATER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_WebDesigner_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ULTIMATER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}_WebDesigner_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ULTIMATER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}_WebDesigner_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_ULTIMATER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_WebDesigner_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ULTIMATER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90A4562F-D4A1-4B65-906D-41F236CF6902}" = Path of Exile
"{91120000-002E-0000-0000-0000000FF1CE}" = Microsoft Office Ultimate 2007
"{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{92BCABD5-D3E4-4983-AA10-315813E2A373}" = ScrewDrivers Client v4 with Citrix Web Client 11.2
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback
"{A407FC22-36BF-4C82-A516-59D94BC505A9}" = System Requirements Lab Detection
"{A5AB9D5E-52E2-440e-A3ED-9512E253C81A}" = SolutionCenter
"{A864E257-3554-1299-FB1B-E5D82C2F1077}" = RadarChaos
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A979B2D8-E3EE-4523-A26C-4AF0A6809280}" = Sniper Elite Demo
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{ABA00898-9467-4689-9F40-DE7F58C8429C}" = Fax
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.8)
"{AEB719FD-EDB0-43E9-B524-90F97C1E6499}" = System Update kb70007
"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply
"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5
"{C27C82E4-9C53-4D76-9ED3-A01A3D5EE679}" = HP Customer Experience Enhancements
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BD}" = WinZip 14.5
"{CF53CF7C-D996-43EB-9904-DBED57C25625}" = Citrix online plug-in (DV)
"{D142FE39-3386-4d82-9AD3-36D4A92AC3C2}" = DocMgr
"{D2E0F0CC-6BE0-490b-B08B-9267083E34C9}" = MarketResearch
"{D99A8E3A-AE5A-4692-8B19-6F16D454E240}" = Destination Component
"{E0810CC2-4B5B-4439-B1D0-452306AF2D64}" = HP Active Support Library
"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01
"{EA2DB6E0-72C5-4ef9-A3A0-E6705F4A6A9E}" = Nexon Game Manager
"{EF7E931D-DC84-471B-8DB6-A83358095474}" = EA Download Manager
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{f32502b5-5b64-4882-bf61-77f23edcac4f}" = HP Total Care Advisor
"{F3FCB08B-E752-444D-86A0-0634A4F3B23D}" = System Requirements Lab CYRI
"{FA3B34BE-4246-4062-90A3-34CBBEA12B72}" = HPTCSSetup
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"AC3Filter" = AC3Filter (remove only)
"AC3Filter_is1" = AC3Filter 1.63b
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 13 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 13 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"AIM_7" = AIM 7
"Anvi AD Blocker" = Anvi AD Blocker 2.2
"AnvSoft Movie DVD Maker_is1" = Movie DVD Maker 3.01
"AsUninst.exe" = Anvil Studio
"ATC Career Prep Software Suite" = ATC Career Prep Software Suite
"Avidemux 2.5" = Avidemux 2.5
"AviSynth" = AviSynth 2.5
"CarbonPoker Odds Calculator_is1" = CarbonPoker Odds Calculator 1.0.3
"CitrixOnlinePluginPackWeb" = Citrix online plug-in - web
"CoffeeCup Free HTML Editor" = CoffeeCup Free HTML Editor
"com.penton.acukwik" = Acukwik
"Crimsonland_is1" = Crimsonland
"Diablo II" = Diablo II
"Diablo III" = Diablo III
"Diablo III Beta" = Diablo III Beta
"DivX Setup.divx.com" = DivX Setup
"ESET Online Scanner" = ESET Online Scanner v3
"Evrsoft First Page 2006_is1" = Evrsoft First Page 2006
"ffdshow_is1" = ffdshow [rev 2583] [2009-01-05]
"FreeMacroPlayer" = FreeMacroPlayer
"GameSpy Arcade" = GameSpy Arcade
"gatesofandaron_is1" = Gates of Andaron
"Google Chrome" = Google Chrome
"GroundSchool - Airline Transport Pilot (ATP)_is1" = GroundSchool - Airline Transport Pilot (ATP)
"HaaliMkx" = Haali Media Splitter
"Heroes In the Sky" = Heroes In the Sky
"Heroes of Might and Magic® III" = Heroes of Might and Magic® III
"InstallShield_{744F6CCF-9F56-40A0-A33D-2A45D53B6046}" = Hoyle Card Games 2004
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"MapleStory" = MapleStory
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"MotoHelper" = MotoHelper 2.0.24 Driver 4.7.1
"Movie DVD Maker_is1" = Movie DVD Maker 2.7.1021
"Mozilla Firefox 29.0 (x86 en-US)" = Mozilla Firefox 29.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Mystery Case Files - Prime Suspects" = Mystery Case Files - Prime Suspects (remove only)
"N360" = Norton Security Suite
"NoteWorthy Composer 2" = NoteWorthy Composer 2
"NSS" = Norton Security Scan
"OpenAL" = OpenAL
"Origin" = Origin
"PC-Doctor 5 for Windows" = Hardware Diagnostic Tools
"PokerStars.net" = PokerStars.net
"PunkBusterSvc" = PunkBuster Services
"RadarChaos" = RadarChaos
"Runic Games Torchlight" = Torchlight
"Shot Online" = Shot Online
"ShotOnline" = ShotOnline
"ShotOnline International" = ShotOnline International- remove only
"sp43111" = sp43111
"sp44626" = sp44626
"Steam App 10" = Counter-Strike
"Steam App 100" = Counter-Strike: Condition Zero Deleted Scenes
"Steam App 105430" = Age of Empires Online
"Steam App 107100" = Bastion
"Steam App 130" = Half-Life: Blue Shift
"Steam App 18400" = Crazy Machines 2
"Steam App 18420" = Crazy Machines
"Steam App 18450" = Crazy Machines 1.5 New from the Lab
"Steam App 18460" = Crazy Machines 1.5 Inventors Training Camp
"Steam App 20" = Team Fortress Classic
"Steam App 200710" = Torchlight II
"Steam App 204610" = Q.U.B.E. Demo
"Steam App 20730" = Mr. Robot Demo
"Steam App 211420" = Dark Souls: Prepare to Die Edition
"Steam App 219850" = Torchlight II Demo
"Steam App 220" = Half-Life 2
"Steam App 224760" = FEZ
"Steam App 240" = Counter-Strike: Source
"Steam App 260" = Counter-Strike: Source Beta
"Steam App 280" = Half-Life: Source
"Steam App 30" = Day of Defeat
"Steam App 300" = Day of Defeat: Source
"Steam App 320" = Half-Life 2: Deathmatch
"Steam App 340" = Half-Life 2: Lost Coast
"Steam App 360" = Half-Life Deathmatch: Source
"Steam App 380" = Half-Life 2: Episode One
"Steam App 40" = Deathmatch Classic
"Steam App 400" = Portal
"Steam App 420" = Half-Life 2: Episode Two
"Steam App 440" = Team Fortress 2
"Steam App 4540" = Titan Quest
"Steam App 4550" = Titan Quest: Immortal Throne
"Steam App 50" = Half-Life: Opposing Force
"Steam App 500" = Left 4 Dead
"Steam App 520" = Team Fortress 2 Beta
"Steam App 550" = Left 4 Dead 2
"Steam App 60" = Ricochet
"Steam App 620" = Portal 2
"Steam App 70" = Half-Life
"Steam App 80" = Counter-Strike: Condition Zero
"ULTIMATER" = Microsoft Office Ultimate 2007
"Verizon V CAST Media Manager" = Verizon V CAST Media Manager
"VLC media player" = VLC media player 1.1.11
"Web_3.0.3813.0" = Microsoft Expression Web 3
"WebDesigner" = Microsoft Expression Web Trial
"WildTangent hp Master Uninstall" = My HP Games
"Xvid_is1" = Xvid 1.2.2 final uninstall

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"CarbonPoker" = CarbonPoker
"DirectDownloader" = DirectDownloader
"Dropbox" = Dropbox
"FileZilla Client" = FileZilla Client 3.3.2.1
"NCsoft-Aion" = Aion

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 5/1/2014 8:04:09 AM | Computer Name = Gary-PC | Source = System Restore | ID = 8199
Description =

Error - 5/1/2014 8:09:46 AM | Computer Name = Gary-PC | Source = System Restore | ID = 8199
Description =

Error - 5/1/2014 8:21:46 AM | Computer Name = Gary-PC | Source = WinMgmt | ID = 28
Description =

Error - 5/1/2014 8:26:40 AM | Computer Name = Gary-PC | Source = SecurityCenter | ID = 3
Description = The Windows Security Center Service was unable to establish event
queries with WMI to monitor third party AntiVirus, AntiSpyware and Firewall.

Error - 5/1/2014 9:03:09 AM | Computer Name = Gary-PC | Source = WinMgmt | ID = 28
Description =

Error - 5/1/2014 9:07:07 AM | Computer Name = Gary-PC | Source = SecurityCenter | ID = 3
Description = The Windows Security Center Service was unable to establish event
queries with WMI to monitor third party AntiVirus, AntiSpyware and Firewall.

Error - 5/1/2014 9:21:12 AM | Computer Name = Gary-PC | Source = Application Hang | ID = 1002
Description = The program firefox.exe version 29.0.0.5224 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 15e8 Start Time: 01cf653ea9c53d2f Termination Time: 60000

Error - 5/1/2014 9:37:32 AM | Computer Name = Gary-PC | Source = WinMgmt | ID = 28
Description =

Error - 5/1/2014 9:42:00 AM | Computer Name = Gary-PC | Source = SecurityCenter | ID = 3
Description = The Windows Security Center Service was unable to establish event
queries with WMI to monitor third party AntiVirus, AntiSpyware and Firewall.

Error - 5/1/2014 9:42:03 AM | Computer Name = Gary-PC | Source = MsiInstaller | ID = 11706
Description =

[ OSession Events ]
Error - 11/19/2010 8:53:22 AM | Computer Name = Gary-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 471
seconds with 120 seconds of active time. This session ended with a crash.

Error - 11/19/2010 8:53:34 AM | Computer Name = Gary-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3
seconds with 0 seconds of active time. This session ended with a crash.

Error - 11/19/2010 8:54:15 AM | Computer Name = Gary-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 35
seconds with 0 seconds of active time. This session ended with a crash.

Error - 8/21/2011 10:12:47 AM | Computer Name = Gary-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6557.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 164
seconds with 120 seconds of active time. This session ended with a crash.

Error - 2/7/2013 9:36:21 AM | Computer Name = Gary-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 87
seconds with 60 seconds of active time. This session ended with a crash.

Error - 2/7/2013 9:44:36 AM | Computer Name = Gary-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 419
seconds with 120 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 4/30/2014 8:48:30 PM | Computer Name = Gary-PC | Source = DCOM | ID = 10016
Description =

Error - 4/30/2014 9:30:14 PM | Computer Name = Gary-PC | Source = DCOM | ID = 10016
Description =

Error - 5/1/2014 7:33:05 AM | Computer Name = Gary-PC | Source = DCOM | ID = 10016
Description =

Error - 5/1/2014 7:40:51 AM | Computer Name = Gary-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description =

Error - 5/1/2014 7:50:10 AM | Computer Name = Gary-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description =

Error - 5/1/2014 7:52:34 AM | Computer Name = Gary-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description =

Error - 5/1/2014 8:22:20 AM | Computer Name = Gary-PC | Source = DCOM | ID = 10016
Description =

Error - 5/1/2014 9:03:32 AM | Computer Name = Gary-PC | Source = DCOM | ID = 10016
Description =

Error - 5/1/2014 9:38:20 AM | Computer Name = Gary-PC | Source = DCOM | ID = 10016
Description =


< End of report >

Below are all the text docs. Everything appears to be running smoothly. I am not noticing as many pop up ads however I did see one and got a redirect page. All processes killed ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}\ not found. HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully! Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully. ========== FILES ========== < ipconfig /flushdns /c > Windows IP Configuration Successfully flushed the DNS Resolver Cache. C:\Users\Gary\Desktop\cmd.bat deleted successfully. C:\Users\Gary\Desktop\cmd.txt deleted successfully. ========== COMMANDS ========== System Restore Service not available. [EMPTYJAVA] User: All Users User: Default User: Default User User: Gary ->Java cache emptied: 25053201 bytes User: Public User: UpdatusUser Total Java Files Cleaned = 24.00 mb [EMPTYFLASH] User: All Users User: Default ->Flash cache emptied: 0 bytes User: Default User ->Flash cache emptied: 0 bytes User: Gary ->Flash cache emptied: 6506 bytes User: Public User: UpdatusUser ->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0.00 mb [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Gary ->Temp folder emptied: 142424327 bytes ->Temporary Internet Files folder emptied: 2297482 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 376992064 bytes ->Google Chrome cache emptied: 14392472 bytes ->Flash cache emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes User: UpdatusUser ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 282034 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 32902 bytes RecycleBin emptied: 2780 bytes Total Files Cleaned = 512.00 mb OTL by OldTimer - Version 3.2.69.0 log created on 05072014_081945 Files\Folders moved on Reboot… File\Folder C:\Windows\temp\JET50AE.tmp not found! PendingFileRenameOperations files… Registry entries deleted on Reboot… # AdwCleaner v3.205 - Report created 07/05/2014 at 09:16:24 # Updated 28/04/2014 by Xplode # Operating System : Windows (TM) Vista Home Premium Service Pack 2 (64 bits) # Username : Gary - GARY-PC # Running from : C:\Users\Gary\Desktop\adwcleaner.exe # Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** ***** [ Shortcuts ] ***** ***** [ Registry ] ***** ***** [ Browsers ] ***** -\\ Internet Explorer v7.0.6002.18005 -\\ Mozilla Firefox v29.0 (en-US) [ File : C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\yeag246i.default-1398948955132\prefs.js ] -\\ Google Chrome v34.0.1847.131 [ File : C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\preferences ] Deleted [Search Provider] : hxxp://search.aol.com/aol/search?query={searchTerms} Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms} ************************* AdwCleaner[R0].txt - [7430 octets] - [30/04/2014 20:06:40] AdwCleaner[R1].txt - [7490 octets] - [30/04/2014 20:07:30] AdwCleaner[R2].txt - [969 octets] - [30/04/2014 20:42:04] AdwCleaner[R3].txt - [1196 octets] - [30/04/2014 20:53:05] AdwCleaner[R4].txt - [1256 octets] - [30/04/2014 21:35:49] AdwCleaner[R5].txt - [1317 octets] - [30/04/2014 21:42:29] AdwCleaner[R6].txt - [1377 octets] - [01/05/2014 08:10:01] AdwCleaner[R7].txt - [1717 octets] - [01/05/2014 08:56:49] AdwCleaner[R8].txt - [2107 octets] - [07/05/2014 09:07:03] AdwCleaner[R9].txt - [1840 octets] - [07/05/2014 09:15:46] AdwCleaner[S0].txt - [5675 octets] - [30/04/2014 20:10:01] AdwCleaner[S1].txt - [1029 octets] - [30/04/2014 20:45:30] AdwCleaner[S2].txt - [1440 octets] - [01/05/2014 08:10:31] AdwCleaner[S3].txt - [1669 octets] - [01/05/2014 09:00:42] AdwCleaner[S4].txt - [1765 octets] - [07/05/2014 09:16:24] ########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [1825 octets] ########## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.4 (04.06.2014:1) OS: Windows (TM) Vista Home Premium x64 Ran by [removed] on Wed 05/07/2014 at 9:08:39.64 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} ~~~ Files ~~~ Folders ~~~ FireFox Emptied folder: C:\Users\Gary\AppData\Roaming\mozilla\firefox\profiles\yeag246i.default-1398948955132\minidumps [1 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Wed 05/07/2014 at 9:14:12.33 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ OTL logfile created on: 5/7/2014 9:24:53 AM - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Gary\Desktop 64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 7.0.6002.18005) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 6.00 Gb Total Physical Memory | 3.77 Gb Available Physical Memory | 62.88% Memory free 12.11 Gb Paging File | 9.91 Gb Available in Paging File | 81.83% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 687.32 Gb Total Space | 124.88 Gb Free Space | 18.17% Space Free | Partition Type: NTFS Drive D: | 11.31 Gb Total Space | 1.10 Gb Free Space | 9.77% Space Free | Partition Type: NTFS Computer Name: GARY-PC | User Name: Gary | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Program Files (x86)\MSR\Privoxy\privoxy.exe (The Privoxy team - www.privoxy.org) PRC - C:\Users\Gary\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\WINDOWS\Microsoft\System Update kb70007\WindowsUpdater.exe () PRC - C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\ADBlockerSrv.exe () PRC - C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\ADBlockerTray.exe (Anvisoft) PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\WINDOWS\SysWOW64\PnkBstrA.exe () PRC - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\ccSvcHst.exe (Symantec Corporation) PRC - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe () PRC - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe () PRC - C:\Program Files (x86)\WinZip\WZQKPICK.EXE (WinZip Computing, S.L.) PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () PRC - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.) PRC - C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe (Citrix Systems, Inc.) PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) PRC - c:\hp\HPEZBTN\HPBtnSrv.exe () PRC - C:\hp\support\hpsysdrv.exe (Hewlett-Packard Company) ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll () MOD - C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\sqlite3.dll () MOD - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe () MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll () MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll () MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () ========== Services (SafeList) ========== SRV:64bit: - (LBTServ) – C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe (Logitech, Inc.) SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV:64bit: - (XAudioService) – C:\Windows\SysNative\DRIVERS\xaudio64.exe (Conexant Systems, Inc.) SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (System Update kb70007) – C:\WINDOWS\Microsoft\System Update kb70007\WindowsUpdater.exe () SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (clr_optimization_v4.0.30319_32) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (AdblockerSrv) – C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\ADBlockerSrv.exe () SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (nvUpdatusService) – C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) SRV - (PnkBstrA) – C:\WINDOWS\SysWOW64\PnkBstrA.exe () SRV - (npggsvc) – C:\WINDOWS\SysWOW64\GameMon.des (INCA Internet Co., Ltd.) SRV - (N360) – C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\ccSvcHst.exe (Symantec Corporation) SRV - (MotoHelper) – C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe () SRV - (clr_optimization_v2.0.50727_32) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (HPSLPSVC) – C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.) SRV - (IAANTMON) – C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) SRV - (HPBtnSrv) – c:\hp\HPEZBTN\HPBtnSrv.exe () ========== Driver Services (SafeList) ========== DRV:64bit: - (hitmanpro37) – C:\Windows\SysNative\drivers\hitmanpro37.sys () DRV:64bit: - (asdnet) – C:\Windows\SysNative\DRIVERS\asdnet.sys () DRV:64bit: - (SaiNtBus) – C:\Windows\SysNative\drivers\SaiBus.sys (Saitek) DRV:64bit: - (SaiMini) – C:\Windows\SysNative\DRIVERS\SaiMini.sys (Saitek) DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (ccHP) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\ccHPx64.sys (Symantec Corporation) DRV:64bit: - (SYMTDI) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\SYMTDI.SYS (Symantec Corporation) DRV:64bit: - (SYMFW) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\SYMFW.SYS (Symantec Corporation) DRV:64bit: - (SYMNDISV) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\SYMNDISV.SYS (Symantec Corporation) DRV:64bit: - (LMouFilt) – C:\Windows\SysNative\DRIVERS\LMouFilt.Sys (Logitech, Inc.) DRV:64bit: - (LHidFilt) – C:\Windows\SysNative\DRIVERS\LHidFilt.Sys (Logitech, Inc.) DRV:64bit: - (BVRPMPR5a64) – C:\Windows\SysNative\drivers\BVRPMPR5a64.SYS (Avanquest Software) DRV:64bit: - (motmodem) – C:\Windows\SysNative\DRIVERS\motmodem.sys (Motorola) DRV:64bit: - (motccgp) – C:\Windows\SysNative\DRIVERS\motccgp.sys (Motorola) DRV:64bit: - (Motousbnet) – C:\Windows\SysNative\DRIVERS\Motousbnet.sys (Motorola) DRV:64bit: - (SymEvent) – C:\Windows\SysNative\Drivers\SYMEVENT64x86.SYS (Symantec Corporation) DRV:64bit: - (SRTSP) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\SRTSP64.SYS (Symantec Corporation) DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\N360x64\0308030.006\SYMEFA64.SYS (Symantec Corporation) DRV:64bit: - (BHDrvx64) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\BHDrvx64.sys (Symantec Corporation) DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (SRTSPX) – C:\Windows\SysNative\drivers\N360x64\0308030.006\SRTSPX64.SYS (Symantec Corporation) DRV:64bit: - (SymIM) – C:\Windows\SysNative\DRIVERS\SymIMv.sys (Symantec Corporation) DRV:64bit: - (motusbdevice) – C:\Windows\SysNative\DRIVERS\motusbdevice.sys (Motorola Inc) DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation) DRV:64bit: - (ctxusbm) – C:\Windows\SysNative\DRIVERS\ctxusbm.sys (Citrix Systems, Inc.) DRV:64bit: - (motccgpfl) – C:\Windows\SysNative\DRIVERS\motccgpfl.sys (Motorola) DRV:64bit: - (BTCFilterService) – C:\Windows\SysNative\DRIVERS\motfilt.sys (Motorola Inc) DRV:64bit: - (RTL8169) – C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek Corporation ) DRV:64bit: - (netr28x) – C:\Windows\SysNative\DRIVERS\netr28x.sys (Ralink Technology, Corp.) DRV:64bit: - (CAXHWBS2) – C:\Windows\SysNative\DRIVERS\CAXHWBS2.sys (Conexant Systems, Inc.) DRV:64bit: - (winachsf) – C:\Windows\SysNative\DRIVERS\CAX_CNXT.sys (Conexant Systems, Inc.) DRV:64bit: - (HSF_DP) – C:\Windows\SysNative\DRIVERS\CAX_DP.sys (Conexant Systems, Inc.) DRV:64bit: - (HCW85BDA) – C:\Windows\SysNative\drivers\HCW85BDA.sys (Hauppauge Computer Works) DRV:64bit: - (StillCam) – C:\Windows\SysNative\DRIVERS\serscan.sys (Microsoft Corporation) DRV:64bit: - (WSDPrintDevice) – C:\Windows\SysNative\DRIVERS\WSDPrint.sys (Microsoft Corporation) DRV:64bit: - (MotoSwitchService) – C:\Windows\SysNative\DRIVERS\motswch.sys (Motorola) DRV:64bit: - (XAudio) – C:\Windows\SysNative\DRIVERS\xaudio64.sys (Conexant Systems, Inc.) DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iastor.sys (Intel Corporation) DRV:64bit: - (SaiHFF0C) – C:\Windows\SysNative\DRIVERS\SaiHFF0C.sys (Saitek) DRV:64bit: - (SaiUFF0C) – C:\Windows\SysNative\DRIVERS\SaiUFF0C.sys (Saitek) DRV:64bit: - (mdmxsdk) – C:\Windows\SysNative\DRIVERS\mdmxsdk.sys (Conexant) DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20140505.035\ex64.sys (Symantec Corporation) DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation) DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20140505.035\eng64.sys (Symantec Corporation) DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20140506.001\IDSviA64.sys (Symantec Corporation) DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation) DRV - (NPPTNT2) – C:\WINDOWS\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.v9.com/web/?type=ds&ts;=1398878357&from;=irs&uid;=HitachiXHDS721075KLA330_GTF200P8GUN8GFGUN8GFX&i;=psd&t;=341cbe5db&q;={searchTerms} IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.v9.com/web/?type=ds&ts;=1398878357&from;=irs&uid;=HitachiXHDS721075KLA330_GTF200P8GUN8GFGUN8GFX&i;=psd&t;=341cbe5db&q;={searchTerms} IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86} IE:64bit: - HKLM\..\SearchScopes\{DB4376FF-E866-4999-8C9A-FF552D841782}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=hp-pvdt IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC IE - HKLM\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?&o;=101881&l;=dis&q;={SEARCHTERMS} IE - HKLM\..\SearchScopes\{DB4376FF-E866-4999-8C9A-FF552D841782}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=hp-pvdt IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2 IE - HKCU\..\SearchScopes,DefaultScope = IE - HKCU\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?&o;=101881&l;=dis&q;={SEARCHTERMS} IE - HKCU\..\SearchScopes\{DB4376FF-E866-4999-8C9A-FF552D841782}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=hp-pvdt IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8118;https=127.0.0.1:8118 ========== FireFox ========== FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:29.0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2011/11/01 07:15:38 | 000,000,000 | —D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2014/04/30 18:03:40 | 000,000,000 | —D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014/04/30 20:10:03 | 000,000,000 | —D | M] [2011/06/16 19:16:25 | 000,000,000 | —D | M] (No name found) – C:\Users\Gary\AppData\Roaming\Mozilla\Extensions [2011/06/16 19:16:25 | 000,000,000 | —D | M] (No name found) – C:\Users\Gary\AppData\Roaming\Mozilla\Extensions\[removed] [2014/05/01 09:44:14 | 000,000,000 | —D | M] (No name found) – C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\yeag246i.default-1398948955132\extensions [2014/05/07 09:18:35 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions [2014/04/30 18:03:40 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions [2014/04/30 18:03:50 | 000,000,000 | —D | M] (Default) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/09/12 23:05:42 | 000,124,240 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\CCMSDK.dll [2009/09/12 23:06:22 | 000,070,488 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\CgpCore.dll [2009/09/12 23:06:32 | 000,091,480 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\confmgr.dll [2009/09/12 23:06:28 | 000,022,360 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\ctxlogging.dll [2009/09/12 23:08:36 | 000,406,864 | —- | M] () – C:\Program Files (x86)\mozilla firefox\plugins\npicaN.dll [2006/08/09 06:16:08 | 000,030,408 | —- | M] ( ) – C:\Program Files (x86)\mozilla firefox\plugins\npWebLaunch.dll [2009/09/12 23:06:24 | 000,023,896 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\TcpPServ.dll ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs;_ri={google:suggestRid}&xssi;=t&q;={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter}, CHR - plugin: Error reading preferences file CHR - Extension: Google Docs = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\ CHR - Extension: Google Drive = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\ CHR - Extension: YouTube = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\ CHR - Extension: Google Search = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\ CHR - Extension: Google Wallet = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\ CHR - Extension: Gmail = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\ O1 HOSTS File: ([2014/05/01 09:02:43 | 000,039,317 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 08sr.combineads.info # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 08srvr.combineads.info # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 12srvr.combineads.info # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 2010-fr.com # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 2012-new.biz # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 212link.com # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 2319825.ourtoolbar.com # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 24h00business.com # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 a.adorika.net # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 a.ad-sys.com # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 a.daasafterdusk.com # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 ad.adn360.com # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 adeartss.eu # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 adesoeasy.eu # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 adf.girldatesforfree.net # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 adm.soft365.com # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 adomicileavail.googlepages.com # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 ads7.complexadveising.com # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 ads.adplxmd.com # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 ads.aff.co # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 ads.alpha00001.com # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 ads.cloud4ads.com # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 ads.egdating.net # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 ads.eorezo.com # hosts anti-adware / pups O1 - Hosts: 127.0.0.1 ads.hooqy.com # hosts anti-adware / pups O1 - Hosts: 647 more lines… O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\CoIEPlg.dll (Symantec Corporation) O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\IPSBHO.dll (Symantec Corporation) O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\CoIEPlg.dll (Symantec Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\CoIEPlg.dll (Symantec Corporation) O4:64bit: - HKLM..\Run: [Bluetooth Connection Assistant] LBTWIZ.EXE -silent File not found O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.) O4:64bit: - HKLM..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe File not found O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (X86)\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [ProfilerU] C:\Program Files\SmartTechnology\Software\ProfilerU.exe (Saitek) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [SaiMfd] C:\Program Files\SmartTechnology\Software\SaiMfd.exe (Saitek) O4 - HKLM..\Run: [4StoryPrePatch] C:\Program Files (x86)\Gameforge4D\GatesofAndaron\PrePatch.exe (Zamiinc) O4 - HKLM..\Run: [ADBlocker] C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\ADBlockerTray.exe (Anvisoft) O4 - HKLM..\Run: [Anvi AD Blocker] C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\ADBlockerTray.exe (Anvisoft) O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe () O4 - HKLM..\Run: [ScrewDrivers RDP Plugin] C:\Program Files (x86)\triCerat\Simplify Printing\ScrewDrivers Client v4\install_rdp.exe () O4 - HKCU..\Run: [VirtualDub.org] C:\Windows\SysWow64\regsvr32.exe (Microsoft Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre7\bin\jp2iexp.dll () O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe (PokerStars) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {CAFEEFAC-0017-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Java Plug-in 1.7.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Java Plug-in 10.17.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6DE92507-B466-474D-9E8F-F4A5EC774184}: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7D8B5987-8491-4898-9A1B-88C11ECF028C}: DhcpNameServer = 192.168.1.254 O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found O18:64bit: - Protocol\Handler\symres - No CLSID value found O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\CoIEPlg.dll (Symantec Corporation) O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\SysWOW64\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Gary\Desktop\Photos\Cactus\Cactus Background-1.jpg O24 - Desktop BackupWallPaper: C:\Users\Gary\Desktop\Photos\Cactus\Cactus Background-1.jpg O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] – "%1" %* O35:64bit: - HKLM\..exefile [open] – "%1" %* O35 - HKLM\..comfile [open] – "%1" %* O35 - HKLM\..exefile [open] – "%1" %* O37:64bit: - HKLM\…com [@ = comfile] – "%1" %* O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %* O37 - HKLM\…com [@ = comfile] – "%1" %* O37 - HKLM\…exe [@ = exefile] – "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2014/05/07 09:07:30 | 000,536,576 | —- | C] (SQLite Development Team) – C:\Windows\SysWow64\sqlite3.dll [2014/05/07 08:19:45 | 000,000,000 | —D | C] – C:\_OTL [2014/05/06 10:19:07 | 000,000,000 | —D | C] – C:\Users\Gary\AppData\Roaming\DropboxMaster [2014/05/05 11:36:38 | 004,745,728 | —- | C] (AVAST Software) – C:\Users\Gary\Desktop\aswMBR.exe [2014/05/01 09:54:35 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Gary\Desktop\OTL.exe [2014/05/01 09:21:54 | 000,000,000 | —D | C] – C:\ProgramData\Anvisoft [2014/05/01 09:21:45 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Anvisoft [2014/05/01 09:21:40 | 000,000,000 | —D | C] – C:\Program Files (x86)\Anvisoft [2014/05/01 09:10:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome [2014/05/01 08:57:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs [2014/04/30 21:04:38 | 010,971,424 | —- | C] (SurfRight B.V.) – C:\Users\Gary\Desktop\HitmanPro_x64.exe [2014/04/30 21:03:59 | 000,000,000 | —D | C] – C:\ProgramData\HitmanPro [2014/04/30 20:22:52 | 000,000,000 | —D | C] – C:\Windows\ERUNT [2014/04/30 20:22:07 | 001,016,261 | —- | C] (Thisisu) – C:\Users\Gary\Desktop\JRT_NEW.exe [2014/04/30 20:06:33 | 000,000,000 | —D | C] – C:\AdwCleaner [2014/04/30 18:03:40 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox [2014/04/30 13:19:52 | 000,000,000 | —D | C] – C:\Windows\Microsoft [2014/04/30 13:19:40 | 000,000,000 | —D | C] – C:\Program Files (x86)\MSR [2014/04/30 13:18:35 | 000,000,000 | —D | C] – C:\Users\Gary\AppData\Roaming\Wise [2014/04/23 08:53:59 | 000,000,000 | —D | C] – C:\Users\Gary\Desktop\p90x3 [2014/04/09 08:57:58 | 000,763,904 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll [2014/04/09 08:57:58 | 000,480,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll [2014/04/09 08:57:56 | 000,623,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll [2014/04/09 08:57:56 | 000,485,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec [2014/04/09 08:57:56 | 000,422,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll [2014/04/09 08:57:56 | 000,389,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec [2014/04/09 08:57:56 | 000,249,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll [2014/04/09 08:57:56 | 000,224,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll [2014/04/09 08:57:56 | 000,193,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll [2014/04/09 08:57:56 | 000,180,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll [2014/04/09 08:57:56 | 000,108,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll [2014/04/09 08:57:56 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll [2014/04/09 08:57:56 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\corpol.dll [2014/04/09 08:57:56 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\corpol.dll [2014/04/09 08:57:55 | 000,380,928 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll [2014/04/09 08:57:52 | 001,212,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll [1 C:\Users\Gary\*.tmp files -> C:\Users\Gary\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2014/05/07 09:31:37 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job [2014/05/07 09:23:26 | 000,000,890 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2014/05/07 09:18:23 | 000,003,616 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2014/05/07 09:18:23 | 000,003,616 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2014/05/07 09:18:14 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat [2014/05/07 09:12:00 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2014/05/07 09:06:35 | 001,310,621 | —- | M] () – C:\Users\Gary\Desktop\adwcleaner.exe [2014/05/06 10:31:13 | 000,105,199 | —- | M] () – C:\Users\Gary\Desktop\SF-87A.pdf [2014/05/06 10:28:57 | 000,021,297 | —- | M] () – C:\Users\Gary\Desktop\DOT 1631.pdf [2014/05/06 10:27:16 | 000,071,458 | —- | M] () – C:\Users\Gary\Desktop\eQip Brochure.pdf [2014/05/06 10:19:03 | 000,000,957 | —- | M] () – C:\Users\Gary\Desktop\Dropbox.lnk [2014/05/06 09:24:55 | 000,000,570 | —- | M] () – C:\Users\Gary\Desktop\MBR.zip [2014/05/06 09:21:36 | 000,000,512 | —- | M] () – C:\Users\Gary\Desktop\MBR.dat [2014/05/05 11:36:52 | 004,745,728 | —- | M] (AVAST Software) – C:\Users\Gary\Desktop\aswMBR.exe [2014/05/05 11:36:15 | 000,854,355 | —- | M] () – C:\Users\Gary\Desktop\SecurityCheck.exe [2014/05/03 09:19:07 | 837,171,865 | —- | M] () – C:\Users\Gary\Desktop\pmpeiibd72.mkv [2014/05/02 08:24:17 | 733,867,381 | —- | M] () – C:\Users\Gary\Desktop\The Lego Movie 2014 WEBRip Upscaled 720p x264 AAC-HeartAttack.mp4 [2014/05/01 19:31:48 | 1479,689,302 | —- | M] () – C:\Users\Gary\Desktop\monmen72-hbs.mp4 [2014/05/01 15:59:06 | 000,239,107 | —- | M] () – C:\Users\Gary\Desktop\print.xps [2014/05/01 15:30:36 | 001,611,202 | —- | M] () – C:\Users\Gary\Desktop\PrincipalDownload.pdf [2014/05/01 09:54:38 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Gary\Desktop\OTL.exe [2014/05/01 09:37:40 | 000,002,051 | —- | M] () – C:\Users\Gary\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk [2014/05/01 09:21:45 | 000,000,891 | —- | M] () – C:\Users\Public\Desktop\Anvi AD Blocker.lnk [2014/05/01 09:19:14 | 006,369,640 | —- | M] () – C:\Users\Gary\Desktop\adblocker_setup.exe [2014/05/01 09:10:57 | 000,002,027 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk [2014/05/01 09:02:43 | 000,039,317 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts [2014/04/30 21:29:12 | 000,032,512 | —- | M] () – C:\Windows\SysNative\drivers\hitmanpro37.sys [2014/04/30 21:27:02 | 000,003,866 | —- | M] () – C:\Windows\SysNative\.crusader [2014/04/30 21:05:09 | 010,971,424 | —- | M] (SurfRight B.V.) – C:\Users\Gary\Desktop\HitmanPro_x64.exe [2014/04/30 13:28:19 | 000,000,258 | RHS- | M] () – C:\ProgramData\ntuser.pol [2014/04/30 13:25:27 | 000,000,890 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk [2014/04/30 13:25:26 | 000,000,975 | —- | M] () – C:\Users\Gary\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk [2014/04/30 13:25:26 | 000,000,914 | —- | M] () – C:\Users\Gary\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk [2014/04/30 08:38:23 | 1502,076,584 | —- | M] () – C:\Users\Gary\Desktop\The_Lego_Movie_2014_Webrip_x264_AC3_TiTAN.mkv [2014/04/29 16:58:02 | 000,000,450 | -H– | M] () – C:\Windows\tasks\Norton Security Scan for Gary.job [2014/04/29 13:31:15 | 000,692,400 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe [2014/04/29 13:31:14 | 000,070,832 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2014/04/29 08:11:23 | 1467,971,725 | —- | M] () – C:\Users\Gary\Desktop\rbocpweb72-hbs.mp4 [2014/04/25 07:55:02 | 967,586,375 | —- | M] () – C:\Users\Gary\Desktop\300.roae.2014.hdrip.x264-hbs.mp4 [2014/04/20 19:20:42 | 006,195,323 | —- | M] () – C:\Users\Gary\Desktop\P90X3_Worksheets_Hres.rtf [2014/04/20 11:03:13 | 003,000,315 | —- | M] () – C:\Users\Gary\Desktop\P90X3_Worksheets_Hres.pdf [2014/04/16 10:52:03 | 000,000,330 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForGary.job [2014/04/13 15:22:17 | 851,125,388 | —- | M] () – C:\Users\Gary\Desktop\Zulu.2013.720p.BluRay.x264.YIFY.mp4 [2014/04/13 08:14:39 | 000,222,166 | —- | M] () – C:\Users\Gary\Desktop\401k unenroll.xps [2014/04/11 15:41:09 | 837,117,006 | —- | M] () – C:\Users\Gary\Desktop\joeweb72-G.mkv [2014/04/10 12:18:06 | 002,290,165 | —- | M] () – C:\Users\Gary\Desktop\2.jpg [2014/04/10 12:11:44 | 002,024,146 | —- | M] () – C:\Users\Gary\Desktop\1.jpg [2014/04/09 19:42:49 | 000,394,339 | —- | M] () – C:\Users\Gary\Desktop\OF306- 2011 version-1111.pdf [1 C:\Users\Gary\*.tmp files -> C:\Users\Gary\*.tmp -> ] ========== Files Created - No Company Name ========== [2014/05/07 09:06:32 | 001,310,621 | —- | C] () – C:\Users\Gary\Desktop\adwcleaner.exe [2014/05/06 10:31:11 | 000,105,199 | —- | C] () – C:\Users\Gary\Desktop\SF-87A.pdf [2014/05/06 10:28:56 | 000,021,297 | —- | C] () – C:\Users\Gary\Desktop\DOT 1631.pdf [2014/05/06 10:27:14 | 000,071,458 | —- | C] () – C:\Users\Gary\Desktop\eQip Brochure.pdf [2014/05/06 09:24:55 | 000,000,570 | —- | C] () – C:\Users\Gary\Desktop\MBR.zip [2014/05/06 09:21:36 | 000,000,512 | —- | C] () – C:\Users\Gary\Desktop\MBR.dat [2014/05/05 11:36:12 | 000,854,355 | —- | C] () – C:\Users\Gary\Desktop\SecurityCheck.exe [2014/05/03 09:03:53 | 837,171,865 | —- | C] () – C:\Users\Gary\Desktop\pmpeiibd72.mkv [2014/05/02 08:11:27 | 733,867,381 | —- | C] () – C:\Users\Gary\Desktop\The Lego Movie 2014 WEBRip Upscaled 720p x264 AAC-HeartAttack.mp4 [2014/05/01 19:01:58 | 1479,689,302 | —- | C] () – C:\Users\Gary\Desktop\monmen72-hbs.mp4 [2014/05/01 15:59:05 | 000,239,107 | —- | C] () – C:\Users\Gary\Desktop\print.xps [2014/05/01 15:30:33 | 001,611,202 | —- | C] () – C:\Users\Gary\Desktop\PrincipalDownload.pdf [2014/05/01 09:21:45 | 000,000,891 | —- | C] () – C:\Users\Public\Desktop\Anvi AD Blocker.lnk [2014/05/01 09:21:44 | 000,019,280 | —- | C] () – C:\Windows\SysNative\drivers\asdnet.sys [2014/05/01 09:19:08 | 006,369,640 | —- | C] () – C:\Users\Gary\Desktop\adblocker_setup.exe [2014/05/01 09:10:57 | 000,002,051 | —- | C] () – C:\Users\Gary\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk [2014/05/01 09:10:57 | 000,002,027 | —- | C] () – C:\Users\Public\Desktop\Google Chrome.lnk [2014/04/30 21:29:12 | 000,032,512 | —- | C] () – C:\Windows\SysNative\drivers\hitmanpro37.sys [2014/04/30 21:27:02 | 000,003,866 | —- | C] () – C:\Windows\SysNative\.crusader [2014/04/30 13:19:20 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol [2014/04/30 08:27:39 | 1502,076,584 | —- | C] () – C:\Users\Gary\Desktop\The_Lego_Movie_2014_Webrip_x264_AC3_TiTAN.mkv [2014/04/29 08:01:21 | 1467,971,725 | —- | C] () – C:\Users\Gary\Desktop\rbocpweb72-hbs.mp4 [2014/04/25 07:48:18 | 967,586,375 | —- | C] () – C:\Users\Gary\Desktop\300.roae.2014.hdrip.x264-hbs.mp4 [2014/04/20 19:20:41 | 006,195,323 | —- | C] () – C:\Users\Gary\Desktop\P90X3_Worksheets_Hres.rtf [2014/04/20 11:03:10 | 003,000,315 | —- | C] () – C:\Users\Gary\Desktop\P90X3_Worksheets_Hres.pdf [2014/04/13 14:20:20 | 851,125,388 | —- | C] () – C:\Users\Gary\Desktop\Zulu.2013.720p.BluRay.x264.YIFY.mp4 [2014/04/13 08:14:37 | 000,222,166 | —- | C] () – C:\Users\Gary\Desktop\401k unenroll.xps [2014/04/11 15:33:54 | 837,117,006 | —- | C] () – C:\Users\Gary\Desktop\joeweb72-G.mkv [2014/04/10 12:12:20 | 002,290,165 | —- | C] () – C:\Users\Gary\Desktop\2.jpg [2014/04/10 12:11:42 | 002,024,146 | —- | C] () – C:\Users\Gary\Desktop\1.jpg [2014/04/09 19:42:49 | 000,394,339 | —- | C] () – C:\Users\Gary\Desktop\OF306- 2011 version-1111.pdf [2014/03/30 09:41:21 | 000,000,732 | —- | C] () – C:\Users\Gary\AppData\Local\d3d9caps64.dat [2014/02/18 19:15:33 | 000,012,005 | —- | C] () – C:\Users\Gary\AppData\Roaming\alsoft.ini [2012/07/15 09:49:45 | 000,000,680 | —- | C] () – C:\Users\Gary\AppData\Local\d3d9caps.dat [2011/12/13 09:20:01 | 000,000,044 | —- | C] () – C:\Users\Gary\jagex_cl_runescape_LIVE3.dat [2011/12/13 09:13:07 | 000,000,044 | —- | C] () – C:\Users\Gary\jagex_cl_runescape_LIVE2.dat [2011/12/12 23:41:34 | 000,000,044 | —- | C] () – C:\Users\Gary\jagex_cl_runescape_LIVE1.dat [2011/12/12 21:29:01 | 000,000,043 | —- | C] () – C:\Users\Gary\jagex_cl_runescape_LIVE.dat [2011/12/12 21:29:01 | 000,000,024 | —- | C] () – C:\Users\Gary\random.dat [2011/05/23 08:44:15 | 000,000,000 | —- | C] () – C:\Users\Gary\AppData\Roaming\wklnhst.dat [2011/05/18 17:47:00 | 000,001,940 | —- | C] () – C:\Users\Gary\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini [2010/06/08 07:55:03 | 000,000,092 | —- | C] () – C:\Users\Gary\AppData\Local\fusioncache.dat [2010/03/21 21:09:21 | 000,031,776 | —- | C] () – C:\ProgramData\nvModes.001 [2010/03/21 20:58:31 | 000,031,776 | —- | C] () – C:\ProgramData\nvModes.dat [2010/03/18 17:07:28 | 000,036,352 | —- | C] () – C:\Users\Gary\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini ========== ZeroAccess Check ========== [2006/11/02 11:30:40 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "ThreadingModel" = Both "" = C:\Windows\SysNative\shell32.dll – [2012/06/08 13:59:03 | 012,899,840 | —- | M] (Microsoft Corporation) [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll – [2012/06/08 13:59:03 | 012,899,840 | —- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll – [2012/06/08 13:47:00 | 011,586,048 | —- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/04/11 03:11:14 | 000,891,392 | —- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\SysWow64\wbem\fastprox.dll – [2009/04/11 02:28:19 | 000,614,912 | —- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll – [2008/01/20 22:50:58 | 000,513,024 | —- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\SysWow64\wbem\wbemess.dll "ThreadingModel" = Apartment ========== Alternate Data Streams ========== @Alternate Data Stream - 64 bytes -> C:\Users\Gary\Desktop\tehhobtextd72.mkv:TOC.WMV @Alternate Data Stream - 64 bytes -> C:\Users\Gary\Desktop\escpepln72-G.mkv:TOC.WMV @Alternate Data Stream - 453 bytes -> C:\Users\Gary\Desktop\2-5.jpg:com.dropbox.attributes @Alternate Data Stream - 449 bytes -> C:\Users\Gary\Desktop\2-4.jpg:com.dropbox.attributes @Alternate Data Stream - 449 bytes -> C:\Users\Gary\Desktop\2-1.jpg:com.dropbox.attributes @Alternate Data Stream - 448 bytes -> C:\Users\Gary\Desktop\2-2.jpg:com.dropbox.attributes @Alternate Data Stream - 446 bytes -> C:\Users\Gary\Desktop\2-3.jpg:com.dropbox.attributes @Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:B2AA1B61 < End of report >

Hi biggary1689,

Your version of Internet Explorer is out dated. Update IE and get the latest version that will run on Windows Vista.
http://windows.microsoft.com/en-us/internet-explorer/download-ie

=========================

[external image: bullseye_zpse9eaf36e.gif] Flush the Internet Explorer Cache

• In Internet Explorer, click Tools
• Select Internet Options
• Now on the General tab and click Delete Files and select Delete all Offline content too
• Click OK.
• When it finishes Click OK.

=========================

[external image: bullseye_zpse9eaf36e.gif] Uninstall via Programs and Features

Click Start > Control Panel > Programs and Features. Locate and select the following that are present on the list and click the Remove button:

• Java 7 Update 17
• Adobe Reader 10.1.8

=========================

[external image: bullseye_zpse9eaf36e.gif] Reboot

=========================

[external image: bullseye_zpse9eaf36e.gif] Update Java

• Get the current version of Java (Version 7 Update 55) by going to http://java.com/en/download/installed.jsp
• Select the Verify Java Version button and follow the onscreen instructions to update if necessary.

=========================

[external image: bullseye_zpse9eaf36e.gif] Adobe Reader:

Go to http://get.adobe.com/reader/otherversions/

• Use the drop down menu's to select your operating system
• Select your language > Select The current version of Adobe Reader for your language
• Remove the check mark from the box "Free! McAfee Security Scan Plus"
• Click the Download button, and follow the onscreen directions to complete the installation.

Please note, depending on your settings, you may have to temporarily disable your antivirus software for the Adobe Reader update.

=========================

[external image: bullseye_zpse9eaf36e.gif] Reboot

=========================

[external image: bullseye_zpse9eaf36e.gif] TDSSKiller

Please download TDSSKiller.zip - Extract it to your desktop

• TDSSKiller.exe
  • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
• Press Start Scan
  • Only if Malicious objects are found then ensure Cure is selected
  • Then click Continue > Reboot now
• Copy and paste the log in your next reply
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

=========================

In your next post please provide the following:

• TDSSKiller log

Hi biggary1689,

I am unable to read your log as it is currently formatted. You need to make an adjustment to your notepad settings.

[external image: bullseye_zpse9eaf36e.gif] Remove Word Wrap in Notepad

• Click the Windows Start button.
• Enter Notepad into the search box and double-click the application from the list of search results that appears. The Notepad application opens.
• Click Format from the main menu in Notepad to display the formatting drop-down menu. You will see a check mark next to the words Word Wrap, which indicates that the Word Wrap feature is currently inserting line endings into your Notepad files.
• Click Word Wrap to remove line endings. The check mark that used to appear next to Word Wrap disappears, indicating that you have successfully disabled this feature and removed all line endings from your document.

=========================

Re-post the TDSSKiller log after making the notepad adjustment.

Everything appears to be running smoothly. I am not seeing any popup ads or redirects



OTL logfile created on: 5/8/2014 11:01:38 AM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Gary\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

6.00 Gb Total Physical Memory | 4.29 Gb Available Physical Memory | 71.49% Memory free
12.11 Gb Paging File | 10.48 Gb Available in Paging File | 86.53% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 687.32 Gb Total Space | 109.86 Gb Free Space | 15.98% Space Free | Partition Type: NTFS
Drive D: | 11.31 Gb Total Space | 1.10 Gb Free Space | 9.77% Space Free | Partition Type: NTFS

Computer Name: GARY-PC | User Name: Gary | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files (x86)\MSR\Privoxy\privoxy.exe (The Privoxy team - www.privoxy.org)
PRC - C:\Users\Gary\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\Microsoft\System Update kb70007\WindowsUpdater.exe ()
PRC - C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\ADBlockerSrv.exe ()
PRC - C:\WINDOWS\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe ()
PRC - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe ()
PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
PRC - C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe (Citrix Systems, Inc.)
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - c:\hp\HPEZBTN\HPBtnSrv.exe ()
PRC - C:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()


========== Services (SafeList) ==========

SRV:64bit: - (LBTServ) – C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (XAudioService) – C:\Windows\SysNative\DRIVERS\xaudio64.exe (Conexant Systems, Inc.)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (System Update kb70007) – C:\WINDOWS\Microsoft\System Update kb70007\WindowsUpdater.exe ()
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (AdblockerSrv) – C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\ADBlockerSrv.exe ()
SRV - (nvUpdatusService) – C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (PnkBstrA) – C:\WINDOWS\SysWOW64\PnkBstrA.exe ()
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (npggsvc) – C:\WINDOWS\SysWOW64\GameMon.des (INCA Internet Co., Ltd.)
SRV - (N360) – C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\ccSvcHst.exe (Symantec Corporation)
SRV - (MotoHelper) – C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe ()
SRV - (clr_optimization_v2.0.50727_32) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (HPSLPSVC) – C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)
SRV - (IAANTMON) – C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (HPBtnSrv) – c:\hp\HPEZBTN\HPBtnSrv.exe ()


========== Driver Services (SafeList) ==========

DRV:64bit: - (hitmanpro37) – C:\Windows\SysNative\drivers\hitmanpro37.sys ()
DRV:64bit: - (asdnet) – C:\Windows\SysNative\DRIVERS\asdnet.sys ()
DRV:64bit: - (SaiNtBus) – C:\Windows\SysNative\drivers\SaiBus.sys (Saitek)
DRV:64bit: - (SaiMini) – C:\Windows\SysNative\DRIVERS\SaiMini.sys (Saitek)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (ccHP) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\ccHPx64.sys (Symantec Corporation)
DRV:64bit: - (SYMTDI) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\SYMTDI.SYS (Symantec Corporation)
DRV:64bit: - (SYMFW) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\SYMFW.SYS (Symantec Corporation)
DRV:64bit: - (SYMNDISV) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\SYMNDISV.SYS (Symantec Corporation)
DRV:64bit: - (LMouFilt) – C:\Windows\SysNative\DRIVERS\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LHidFilt) – C:\Windows\SysNative\DRIVERS\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (BVRPMPR5a64) – C:\Windows\SysNative\drivers\BVRPMPR5a64.SYS (Avanquest Software)
DRV:64bit: - (motmodem) – C:\Windows\SysNative\DRIVERS\motmodem.sys (Motorola)
DRV:64bit: - (motccgp) – C:\Windows\SysNative\DRIVERS\motccgp.sys (Motorola)
DRV:64bit: - (Motousbnet) – C:\Windows\SysNative\DRIVERS\Motousbnet.sys (Motorola)
DRV:64bit: - (SymEvent) – C:\Windows\SysNative\Drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\SRTSP64.SYS (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\N360x64\0308030.006\SYMEFA64.SYS (Symantec Corporation)
DRV:64bit: - (BHDrvx64) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\BHDrvx64.sys (Symantec Corporation)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (SRTSPX) – C:\Windows\SysNative\drivers\N360x64\0308030.006\SRTSPX64.SYS (Symantec Corporation)
DRV:64bit: - (SymIM) – C:\Windows\SysNative\DRIVERS\SymIMv.sys (Symantec Corporation)
DRV:64bit: - (motusbdevice) – C:\Windows\SysNative\DRIVERS\motusbdevice.sys (Motorola Inc)
DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation)
DRV:64bit: - (ctxusbm) – C:\Windows\SysNative\DRIVERS\ctxusbm.sys (Citrix Systems, Inc.)
DRV:64bit: - (motccgpfl) – C:\Windows\SysNative\DRIVERS\motccgpfl.sys (Motorola)
DRV:64bit: - (BTCFilterService) – C:\Windows\SysNative\DRIVERS\motfilt.sys (Motorola Inc)
DRV:64bit: - (RTL8169) – C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek Corporation )
DRV:64bit: - (netr28x) – C:\Windows\SysNative\DRIVERS\netr28x.sys (Ralink Technology, Corp.)
DRV:64bit: - (CAXHWBS2) – C:\Windows\SysNative\DRIVERS\CAXHWBS2.sys (Conexant Systems, Inc.)
DRV:64bit: - (winachsf) – C:\Windows\SysNative\DRIVERS\CAX_CNXT.sys (Conexant Systems, Inc.)
DRV:64bit: - (HSF_DP) – C:\Windows\SysNative\DRIVERS\CAX_DP.sys (Conexant Systems, Inc.)
DRV:64bit: - (HCW85BDA) – C:\Windows\SysNative\drivers\HCW85BDA.sys (Hauppauge Computer Works)
DRV:64bit: - (StillCam) – C:\Windows\SysNative\DRIVERS\serscan.sys (Microsoft Corporation)
DRV:64bit: - (WSDPrintDevice) – C:\Windows\SysNative\DRIVERS\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (MotoSwitchService) – C:\Windows\SysNative\DRIVERS\motswch.sys (Motorola)
DRV:64bit: - (XAudio) – C:\Windows\SysNative\DRIVERS\xaudio64.sys (Conexant Systems, Inc.)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iastor.sys (Intel Corporation)
DRV:64bit: - (SaiHFF0C) – C:\Windows\SysNative\DRIVERS\SaiHFF0C.sys (Saitek)
DRV:64bit: - (SaiUFF0C) – C:\Windows\SysNative\DRIVERS\SaiUFF0C.sys (Saitek)
DRV:64bit: - (mdmxsdk) – C:\Windows\SysNative\DRIVERS\mdmxsdk.sys (Conexant)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20140507.022\ex64.sys (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20140507.022\eng64.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20140507.001\IDSviA64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NPPTNT2) – C:\WINDOWS\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.v9.com/web/?type=ds&ts;=1398878357&from;=irs&uid;=HitachiXHDS721075KLA330_GTF200P8GUN8GFGUN8GFX&i;=psd&t;=341cbe5db&q;={searchTerms}
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.v9.com/web/?type=ds&ts;=1398878357&from;=irs&uid;=HitachiXHDS721075KLA330_GTF200P8GUN8GFGUN8GFX&i;=psd&t;=341cbe5db&q;={searchTerms}
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE:64bit: - HKLM\..\SearchScopes\{DB4376FF-E866-4999-8C9A-FF552D841782}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=hp-pvdt
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src;={referrer:source?}
IE - HKLM\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?&o;=101881&l;=dis&q;={SEARCHTERMS}
IE - HKLM\..\SearchScopes\{DB4376FF-E866-4999-8C9A-FF552D841782}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=hp-pvdt

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=en_us&c;=83&bd;=Pavilion&pf;=cndt
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=en_us&c;=83&bd;=Pavilion&pf;=cndt
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src;={referrer:source?}
IE - HKCU\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?&o;=101881&l;=dis&q;={SEARCHTERMS}
IE - HKCU\..\SearchScopes\{DB4376FF-E866-4999-8C9A-FF552D841782}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=hp-pvdt
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8118;https=127.0.0.1:8118

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:29.0
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\system32\npDeployJava1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.55.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.55.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2011/11/01 07:15:38 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2014/04/30 18:03:40 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014/05/07 15:47:55 | 000,000,000 | —D | M]

[2011/06/16 19:16:25 | 000,000,000 | —D | M] (No name found) – C:\Users\Gary\AppData\Roaming\Mozilla\Extensions
[2011/06/16 19:16:25 | 000,000,000 | —D | M] (No name found) – C:\Users\Gary\AppData\Roaming\Mozilla\Extensions\[removed]
[2014/05/01 09:44:14 | 000,000,000 | —D | M] (No name found) – C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\yeag246i.default-1398948955132\extensions
[2014/05/07 15:51:06 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2014/04/30 18:03:40 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2014/04/30 18:03:50 | 000,000,000 | —D | M] (Default) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/09/12 23:05:42 | 000,124,240 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\CCMSDK.dll
[2009/09/12 23:06:22 | 000,070,488 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\CgpCore.dll
[2009/09/12 23:06:32 | 000,091,480 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\confmgr.dll
[2009/09/12 23:06:28 | 000,022,360 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\ctxlogging.dll
[2009/09/12 23:08:36 | 000,406,864 | —- | M] () – C:\Program Files (x86)\mozilla firefox\plugins\npicaN.dll
[2006/08/09 06:16:08 | 000,030,408 | —- | M] ( ) – C:\Program Files (x86)\mozilla firefox\plugins\npWebLaunch.dll
[2009/09/12 23:06:24 | 000,023,896 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\TcpPServ.dll

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs;_ri={google:suggestRid}&xssi;=t&q;={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - plugin: Error reading preferences file
CHR - Extension: Google Docs = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Google Wallet = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
CHR - Extension: Gmail = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2014/05/01 09:02:43 | 000,039,317 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 08sr.combineads.info # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 08srvr.combineads.info # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 12srvr.combineads.info # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 2010-fr.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 2012-new.biz # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 212link.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 2319825.ourtoolbar.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 24h00business.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 a.adorika.net # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 a.ad-sys.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 a.daasafterdusk.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ad.adn360.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 adeartss.eu # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 adesoeasy.eu # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 adf.girldatesforfree.net # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 adm.soft365.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 adomicileavail.googlepages.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads7.complexadveising.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.adplxmd.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.aff.co # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.alpha00001.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.cloud4ads.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.egdating.net # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.eorezo.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.hooqy.com # hosts anti-adware / pups
O1 - Hosts: 647 more lines…
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\CoIEPlg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [Bluetooth Connection Assistant] LBTWIZ.EXE -silent File not found
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe File not found
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (X86)\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [ProfilerU] C:\Program Files\SmartTechnology\Software\ProfilerU.exe (Saitek)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [SaiMfd] C:\Program Files\SmartTechnology\Software\SaiMfd.exe (Saitek)
O4 - HKLM..\Run: [4StoryPrePatch] C:\Program Files (x86)\Gameforge4D\GatesofAndaron\PrePatch.exe (Zamiinc)
O4 - HKLM..\Run: [ADBlocker] C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\ADBlockerTray.exe (Anvisoft)
O4 - HKLM..\Run: [Anvi AD Blocker] C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\ADBlockerTray.exe (Anvisoft)
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKLM..\Run: [ScrewDrivers RDP Plugin] C:\Program Files (x86)\triCerat\Simplify Printing\ScrewDrivers Client v4\install_rdp.exe ()
O4 - HKCU..\Run: [VirtualDub.org] C:\Windows\SysWow64\regsvr32.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre7\bin\jp2iexp.dll ()
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Java Plug-in 10.55.2)
O16 - DPF: {CAFEEFAC-0017-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Java Plug-in 1.7.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Java Plug-in 10.55.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6DE92507-B466-474D-9E8F-F4A5EC774184}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7D8B5987-8491-4898-9A1B-88C11ECF028C}: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\symres - No CLSID value found
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\CoIEPlg.dll (Symantec Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\SysWOW64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Gary\Desktop\Photos\Cactus\Cactus Background-1.jpg
O24 - Desktop BackupWallPaper: C:\Users\Gary\Desktop\Photos\Cactus\Cactus Background-1.jpg
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2014/05/07 15:45:22 | 000,000,000 | —D | C] – C:\ProgramData\Oracle
[2014/05/07 15:44:50 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2014/05/07 15:44:36 | 000,264,616 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2014/05/07 15:44:03 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
[2014/05/07 15:43:57 | 000,175,528 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2014/05/07 15:43:57 | 000,096,168 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2014/05/07 15:43:37 | 000,175,016 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2014/05/07 15:19:35 | 000,921,512 | —- | C] (Oracle Corporation) – C:\Users\Gary\Desktop\jxpiinstall.exe
[2014/05/07 09:07:30 | 000,536,576 | —- | C] (SQLite Development Team) – C:\Windows\SysWow64\sqlite3.dll
[2014/05/07 08:19:45 | 000,000,000 | —D | C] – C:\_OTL
[2014/05/06 10:19:07 | 000,000,000 | —D | C] – C:\Users\Gary\AppData\Roaming\DropboxMaster
[2014/05/05 11:36:38 | 004,745,728 | —- | C] (AVAST Software) – C:\Users\Gary\Desktop\aswMBR.exe
[2014/05/01 09:54:35 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Gary\Desktop\OTL.exe
[2014/05/01 09:21:54 | 000,000,000 | —D | C] – C:\ProgramData\Anvisoft
[2014/05/01 09:21:45 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Anvisoft
[2014/05/01 09:21:40 | 000,000,000 | —D | C] – C:\Program Files (x86)\Anvisoft
[2014/05/01 09:10:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2014/05/01 08:57:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs
[2014/04/30 21:04:38 | 010,971,424 | —- | C] (SurfRight B.V.) – C:\Users\Gary\Desktop\HitmanPro_x64.exe
[2014/04/30 21:03:59 | 000,000,000 | —D | C] – C:\ProgramData\HitmanPro
[2014/04/30 20:22:52 | 000,000,000 | —D | C] – C:\Windows\ERUNT
[2014/04/30 20:22:07 | 001,016,261 | —- | C] (Thisisu) – C:\Users\Gary\Desktop\JRT_NEW.exe
[2014/04/30 20:06:33 | 000,000,000 | —D | C] – C:\AdwCleaner
[2014/04/30 18:03:40 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2014/04/30 13:19:52 | 000,000,000 | —D | C] – C:\Windows\Microsoft
[2014/04/30 13:19:40 | 000,000,000 | —D | C] – C:\Program Files (x86)\MSR
[2014/04/30 13:18:35 | 000,000,000 | —D | C] – C:\Users\Gary\AppData\Roaming\Wise
[2014/04/23 08:53:59 | 000,000,000 | —D | C] – C:\Users\Gary\Desktop\p90x3
[2014/04/09 08:57:58 | 000,763,904 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2014/04/09 08:57:58 | 000,480,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2014/04/09 08:57:56 | 000,623,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2014/04/09 08:57:56 | 000,485,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2014/04/09 08:57:56 | 000,422,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2014/04/09 08:57:56 | 000,389,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2014/04/09 08:57:56 | 000,249,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2014/04/09 08:57:56 | 000,224,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2014/04/09 08:57:56 | 000,193,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2014/04/09 08:57:56 | 000,180,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2014/04/09 08:57:56 | 000,108,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2014/04/09 08:57:56 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2014/04/09 08:57:56 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\corpol.dll
[2014/04/09 08:57:56 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\corpol.dll
[2014/04/09 08:57:55 | 000,380,928 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2014/04/09 08:57:52 | 001,212,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[1 C:\Users\Gary\*.tmp files -> C:\Users\Gary\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2014/05/08 10:59:24 | 000,000,890 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014/05/08 10:54:34 | 000,003,616 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2014/05/08 10:54:34 | 000,003,616 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2014/05/08 10:54:27 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2014/05/08 10:31:01 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2014/05/08 10:18:00 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014/05/07 16:03:10 | 004,143,997 | —- | M] () – C:\Users\Gary\Desktop\tdsskiller.zip
[2014/05/07 15:47:56 | 000,001,924 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader X.lnk
[2014/05/07 15:43:18 | 000,096,168 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2014/05/07 15:43:10 | 000,264,616 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2014/05/07 15:43:10 | 000,175,528 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2014/05/07 15:43:10 | 000,175,016 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2014/05/07 15:25:38 | 000,000,975 | —- | M] () – C:\Users\Gary\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2014/05/07 15:19:36 | 000,921,512 | —- | M] (Oracle Corporation) – C:\Users\Gary\Desktop\jxpiinstall.exe
[2014/05/07 12:03:50 | 000,000,258 | RHS- | M] () – C:\ProgramData\ntuser.pol
[2014/05/07 09:06:35 | 001,310,621 | —- | M] () – C:\Users\Gary\Desktop\adwcleaner.exe
[2014/05/06 10:19:03 | 000,000,957 | —- | M] () – C:\Users\Gary\Desktop\Dropbox.lnk
[2014/05/06 09:24:55 | 000,000,570 | —- | M] () – C:\Users\Gary\Desktop\MBR.zip
[2014/05/06 09:21:36 | 000,000,512 | —- | M] () – C:\Users\Gary\Desktop\MBR.dat
[2014/05/05 11:36:52 | 004,745,728 | —- | M] (AVAST Software) – C:\Users\Gary\Desktop\aswMBR.exe
[2014/05/05 11:36:15 | 000,854,355 | —- | M] () – C:\Users\Gary\Desktop\SecurityCheck.exe
[2014/05/03 09:19:07 | 837,171,865 | —- | M] () – C:\Users\Gary\Desktop\pmpeiibd72.mkv
[2014/05/02 08:24:17 | 733,867,381 | —- | M] () – C:\Users\Gary\Desktop\The Lego Movie 2014 WEBRip Upscaled 720p x264 AAC-HeartAttack.mp4
[2014/05/01 19:31:48 | 1479,689,302 | —- | M] () – C:\Users\Gary\Desktop\monmen72-hbs.mp4
[2014/05/01 15:59:06 | 000,239,107 | —- | M] () – C:\Users\Gary\Desktop\print.xps
[2014/05/01 15:30:36 | 001,611,202 | —- | M] () – C:\Users\Gary\Desktop\PrincipalDownload.pdf
[2014/05/01 09:54:38 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Gary\Desktop\OTL.exe
[2014/05/01 09:37:40 | 000,002,051 | —- | M] () – C:\Users\Gary\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2014/05/01 09:21:45 | 000,000,891 | —- | M] () – C:\Users\Public\Desktop\Anvi AD Blocker.lnk
[2014/05/01 09:19:14 | 006,369,640 | —- | M] () – C:\Users\Gary\Desktop\adblocker_setup.exe
[2014/05/01 09:10:57 | 000,002,027 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2014/05/01 09:02:43 | 000,039,317 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2014/04/30 21:29:12 | 000,032,512 | —- | M] () – C:\Windows\SysNative\drivers\hitmanpro37.sys
[2014/04/30 21:27:02 | 000,003,866 | —- | M] () – C:\Windows\SysNative\.crusader
[2014/04/30 21:05:09 | 010,971,424 | —- | M] (SurfRight B.V.) – C:\Users\Gary\Desktop\HitmanPro_x64.exe
[2014/04/30 13:25:27 | 000,000,890 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2014/04/30 13:25:26 | 000,000,914 | —- | M] () – C:\Users\Gary\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2014/04/30 08:38:23 | 1502,076,584 | —- | M] () – C:\Users\Gary\Desktop\The_Lego_Movie_2014_Webrip_x264_AC3_TiTAN.mkv
[2014/04/29 16:58:02 | 000,000,450 | -H– | M] () – C:\Windows\tasks\Norton Security Scan for Gary.job
[2014/04/29 13:31:15 | 000,692,400 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2014/04/29 13:31:14 | 000,070,832 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2014/04/29 08:11:23 | 1467,971,725 | —- | M] () – C:\Users\Gary\Desktop\rbocpweb72-hbs.mp4
[2014/04/25 07:55:02 | 967,586,375 | —- | M] () – C:\Users\Gary\Desktop\300.roae.2014.hdrip.x264-hbs.mp4
[2014/04/20 19:20:42 | 006,195,323 | —- | M] () – C:\Users\Gary\Desktop\P90X3_Worksheets_Hres.rtf
[2014/04/20 11:03:13 | 003,000,315 | —- | M] () – C:\Users\Gary\Desktop\P90X3_Worksheets_Hres.pdf
[2014/04/16 10:52:03 | 000,000,330 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForGary.job
[2014/04/13 15:22:17 | 851,125,388 | —- | M] () – C:\Users\Gary\Desktop\Zulu.2013.720p.BluRay.x264.YIFY.mp4
[2014/04/13 08:14:39 | 000,222,166 | —- | M] () – C:\Users\Gary\Desktop\401k unenroll.xps
[2014/04/11 15:41:09 | 837,117,006 | —- | M] () – C:\Users\Gary\Desktop\joeweb72-G.mkv
[2014/04/10 12:18:06 | 002,290,165 | —- | M] () – C:\Users\Gary\Desktop\2.jpg
[2014/04/10 12:11:44 | 002,024,146 | —- | M] () – C:\Users\Gary\Desktop\1.jpg
[2014/04/09 19:42:49 | 000,394,339 | —- | M] () – C:\Users\Gary\Desktop\OF306- 2011 version-1111.pdf
[1 C:\Users\Gary\*.tmp files -> C:\Users\Gary\*.tmp -> ]

========== Files Created - No Company Name ==========

[2014/05/07 15:57:39 | 004,143,997 | —- | C] () – C:\Users\Gary\Desktop\tdsskiller.zip
[2014/05/07 15:47:56 | 000,001,924 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader X.lnk
[2014/05/07 15:47:55 | 000,001,804 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2014/05/07 09:06:32 | 001,310,621 | —- | C] () – C:\Users\Gary\Desktop\adwcleaner.exe
[2014/05/06 09:24:55 | 000,000,570 | —- | C] () – C:\Users\Gary\Desktop\MBR.zip
[2014/05/06 09:21:36 | 000,000,512 | —- | C] () – C:\Users\Gary\Desktop\MBR.dat
[2014/05/05 11:36:12 | 000,854,355 | —- | C] () – C:\Users\Gary\Desktop\SecurityCheck.exe
[2014/05/03 09:03:53 | 837,171,865 | —- | C] () – C:\Users\Gary\Desktop\pmpeiibd72.mkv
[2014/05/02 08:11:27 | 733,867,381 | —- | C] () – C:\Users\Gary\Desktop\The Lego Movie 2014 WEBRip Upscaled 720p x264 AAC-HeartAttack.mp4
[2014/05/01 19:01:58 | 1479,689,302 | —- | C] () – C:\Users\Gary\Desktop\monmen72-hbs.mp4
[2014/05/01 15:59:05 | 000,239,107 | —- | C] () – C:\Users\Gary\Desktop\print.xps
[2014/05/01 15:30:33 | 001,611,202 | —- | C] () – C:\Users\Gary\Desktop\PrincipalDownload.pdf
[2014/05/01 09:21:45 | 000,000,891 | —- | C] () – C:\Users\Public\Desktop\Anvi AD Blocker.lnk
[2014/05/01 09:21:44 | 000,019,280 | —- | C] () – C:\Windows\SysNative\drivers\asdnet.sys
[2014/05/01 09:19:08 | 006,369,640 | —- | C] () – C:\Users\Gary\Desktop\adblocker_setup.exe
[2014/05/01 09:10:57 | 000,002,051 | —- | C] () – C:\Users\Gary\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2014/05/01 09:10:57 | 000,002,027 | —- | C] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2014/04/30 21:29:12 | 000,032,512 | —- | C] () – C:\Windows\SysNative\drivers\hitmanpro37.sys
[2014/04/30 21:27:02 | 000,003,866 | —- | C] () – C:\Windows\SysNative\.crusader
[2014/04/30 13:19:20 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2014/04/30 08:27:39 | 1502,076,584 | —- | C] () – C:\Users\Gary\Desktop\The_Lego_Movie_2014_Webrip_x264_AC3_TiTAN.mkv
[2014/04/29 08:01:21 | 1467,971,725 | —- | C] () – C:\Users\Gary\Desktop\rbocpweb72-hbs.mp4
[2014/04/25 07:48:18 | 967,586,375 | —- | C] () – C:\Users\Gary\Desktop\300.roae.2014.hdrip.x264-hbs.mp4
[2014/04/20 19:20:41 | 006,195,323 | —- | C] () – C:\Users\Gary\Desktop\P90X3_Worksheets_Hres.rtf
[2014/04/20 11:03:10 | 003,000,315 | —- | C] () – C:\Users\Gary\Desktop\P90X3_Worksheets_Hres.pdf
[2014/04/13 14:20:20 | 851,125,388 | —- | C] () – C:\Users\Gary\Desktop\Zulu.2013.720p.BluRay.x264.YIFY.mp4
[2014/04/13 08:14:37 | 000,222,166 | —- | C] () – C:\Users\Gary\Desktop\401k unenroll.xps
[2014/04/11 15:33:54 | 837,117,006 | —- | C] () – C:\Users\Gary\Desktop\joeweb72-G.mkv
[2014/04/10 12:12:20 | 002,290,165 | —- | C] () – C:\Users\Gary\Desktop\2.jpg
[2014/04/10 12:11:42 | 002,024,146 | —- | C] () – C:\Users\Gary\Desktop\1.jpg
[2014/04/09 19:42:49 | 000,394,339 | —- | C] () – C:\Users\Gary\Desktop\OF306- 2011 version-1111.pdf
[2014/03/30 09:41:21 | 000,000,732 | —- | C] () – C:\Users\Gary\AppData\Local\d3d9caps64.dat
[2014/02/18 19:15:33 | 000,012,005 | —- | C] () – C:\Users\Gary\AppData\Roaming\alsoft.ini
[2012/07/15 09:49:45 | 000,000,680 | —- | C] () – C:\Users\Gary\AppData\Local\d3d9caps.dat
[2011/12/13 09:20:01 | 000,000,044 | —- | C] () – C:\Users\Gary\jagex_cl_runescape_LIVE3.dat
[2011/12/13 09:13:07 | 000,000,044 | —- | C] () – C:\Users\Gary\jagex_cl_runescape_LIVE2.dat
[2011/12/12 23:41:34 | 000,000,044 | —- | C] () – C:\Users\Gary\jagex_cl_runescape_LIVE1.dat
[2011/12/12 21:29:01 | 000,000,043 | —- | C] () – C:\Users\Gary\jagex_cl_runescape_LIVE.dat
[2011/12/12 21:29:01 | 000,000,024 | —- | C] () – C:\Users\Gary\random.dat
[2011/05/23 08:44:15 | 000,000,000 | —- | C] () – C:\Users\Gary\AppData\Roaming\wklnhst.dat
[2011/05/18 17:47:00 | 000,001,940 | —- | C] () – C:\Users\Gary\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/06/08 07:55:03 | 000,000,092 | —- | C] () – C:\Users\Gary\AppData\Local\fusioncache.dat
[2010/03/21 21:09:21 | 000,031,776 | —- | C] () – C:\ProgramData\nvModes.001
[2010/03/21 20:58:31 | 000,031,776 | —- | C] () – C:\ProgramData\nvModes.dat
[2010/03/18 17:07:28 | 000,036,352 | —- | C] () – C:\Users\Gary\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006/11/02 11:30:40 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"ThreadingModel" = Both
"" = C:\Windows\SysNative\shell32.dll – [2012/06/08 13:59:03 | 012,899,840 | —- | M] (Microsoft Corporation)

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/08 13:59:03 | 012,899,840 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 13:47:00 | 011,586,048 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/04/11 03:11:14 | 000,891,392 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\SysWow64\wbem\fastprox.dll – [2009/04/11 02:28:19 | 000,614,912 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2008/01/20 22:50:58 | 000,513,024 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\SysWow64\wbem\wbemess.dll
"ThreadingModel" = Apartment

========== Alternate Data Streams ==========

@Alternate Data Stream - 64 bytes -> C:\Users\Gary\Desktop\tehhobtextd72.mkv:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Gary\Desktop\escpepln72-G.mkv:TOC.WMV
@Alternate Data Stream - 453 bytes -> C:\Users\Gary\Desktop\2-5.jpg:com.dropbox.attributes
@Alternate Data Stream - 449 bytes -> C:\Users\Gary\Desktop\2-4.jpg:com.dropbox.attributes
@Alternate Data Stream - 449 bytes -> C:\Users\Gary\Desktop\2-1.jpg:com.dropbox.attributes
@Alternate Data Stream - 448 bytes -> C:\Users\Gary\Desktop\2-2.jpg:com.dropbox.attributes
@Alternate Data Stream - 446 bytes -> C:\Users\Gary\Desktop\2-3.jpg:com.dropbox.attributes
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:B2AA1B61

< End of report >

I was unable to get the newer version of IE installed. It went to step 3 of 3 at 100% and said that the install was unsucessful.  Below are the two logs.

 

Files\Folders moved on Reboot…

PendingFileRenameOperations files…

Registry entries deleted on Reboot…
 

 

 

OTL logfile created on: 5/9/2014 8:41:46 AM - Run 4
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Gary\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
6.00 Gb Total Physical Memory | 4.02 Gb Available Physical Memory | 67.05% Memory free
12.11 Gb Paging File | 10.24 Gb Available in Paging File | 84.58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 687.32 Gb Total Space | 111.81 Gb Free Space | 16.27% Space Free | Partition Type: NTFS
Drive D: | 11.31 Gb Total Space | 1.10 Gb Free Space | 9.77% Space Free | Partition Type: NTFS
 
Computer Name: GARY-PC | User Name: Gary | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Program Files (x86)\MSR\Privoxy\privoxy.exe (The Privoxy team - www.privoxy.org)
PRC - C:\Users\Gary\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\Microsoft\System Update kb70007\WindowsUpdater.exe ()
PRC - C:\WINDOWS\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe ()
PRC - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe ()
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - c:\hp\HPEZBTN\HPBtnSrv.exe ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (LBTServ) – C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (XAudioService) – C:\Windows\SysNative\DRIVERS\xaudio64.exe (Conexant Systems, Inc.)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (System Update kb70007) – C:\WINDOWS\Microsoft\System Update kb70007\WindowsUpdater.exe ()
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (AdblockerSrv) – C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\ADBlockerSrv.exe ()
SRV - (nvUpdatusService) – C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (PnkBstrA) – C:\WINDOWS\SysWOW64\PnkBstrA.exe ()
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (npggsvc) – C:\WINDOWS\SysWOW64\GameMon.des (INCA Internet Co., Ltd.)
SRV - (N360) – C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\ccSvcHst.exe (Symantec Corporation)
SRV - (MotoHelper) – C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe ()
SRV - (clr_optimization_v2.0.50727_32) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (HPSLPSVC) – C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)
SRV - (IAANTMON) – C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (HPBtnSrv) – c:\hp\HPEZBTN\HPBtnSrv.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (hitmanpro37) – C:\Windows\SysNative\drivers\hitmanpro37.sys ()
DRV:64bit: - (asdnet) – C:\Windows\SysNative\DRIVERS\asdnet.sys ()
DRV:64bit: - (SaiNtBus) – C:\Windows\SysNative\drivers\SaiBus.sys (Saitek)
DRV:64bit: - (SaiMini) – C:\Windows\SysNative\DRIVERS\SaiMini.sys (Saitek)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (ccHP) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\ccHPx64.sys (Symantec Corporation)
DRV:64bit: - (SYMTDI) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\SYMTDI.SYS (Symantec Corporation)
DRV:64bit: - (SYMFW) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\SYMFW.SYS (Symantec Corporation)
DRV:64bit: - (SYMNDISV) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\SYMNDISV.SYS (Symantec Corporation)
DRV:64bit: - (LMouFilt) – C:\Windows\SysNative\DRIVERS\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LHidFilt) – C:\Windows\SysNative\DRIVERS\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (BVRPMPR5a64) – C:\Windows\SysNative\drivers\BVRPMPR5a64.SYS (Avanquest Software)
DRV:64bit: - (motmodem) – C:\Windows\SysNative\DRIVERS\motmodem.sys (Motorola)
DRV:64bit: - (motccgp) – C:\Windows\SysNative\DRIVERS\motccgp.sys (Motorola)
DRV:64bit: - (Motousbnet) – C:\Windows\SysNative\DRIVERS\Motousbnet.sys (Motorola)
DRV:64bit: - (SymEvent) – C:\Windows\SysNative\Drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\SRTSP64.SYS (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\N360x64\0308030.006\SYMEFA64.SYS (Symantec Corporation)
DRV:64bit: - (BHDrvx64) – C:\Windows\SysNative\Drivers\N360x64\0308030.006\BHDrvx64.sys (Symantec Corporation)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (SRTSPX) – C:\Windows\SysNative\drivers\N360x64\0308030.006\SRTSPX64.SYS (Symantec Corporation)
DRV:64bit: - (SymIM) – C:\Windows\SysNative\DRIVERS\SymIMv.sys (Symantec Corporation)
DRV:64bit: - (motusbdevice) – C:\Windows\SysNative\DRIVERS\motusbdevice.sys (Motorola Inc)
DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation)
DRV:64bit: - (ctxusbm) – C:\Windows\SysNative\DRIVERS\ctxusbm.sys (Citrix Systems, Inc.)
DRV:64bit: - (motccgpfl) – C:\Windows\SysNative\DRIVERS\motccgpfl.sys (Motorola)
DRV:64bit: - (BTCFilterService) – C:\Windows\SysNative\DRIVERS\motfilt.sys (Motorola Inc)
DRV:64bit: - (RTL8169) – C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek Corporation                                            )
DRV:64bit: - (netr28x) – C:\Windows\SysNative\DRIVERS\netr28x.sys (Ralink Technology, Corp.)
DRV:64bit: - (CAXHWBS2) – C:\Windows\SysNative\DRIVERS\CAXHWBS2.sys (Conexant Systems, Inc.)
DRV:64bit: - (winachsf) – C:\Windows\SysNative\DRIVERS\CAX_CNXT.sys (Conexant Systems, Inc.)
DRV:64bit: - (HSF_DP) – C:\Windows\SysNative\DRIVERS\CAX_DP.sys (Conexant Systems, Inc.)
DRV:64bit: - (HCW85BDA) – C:\Windows\SysNative\drivers\HCW85BDA.sys (Hauppauge Computer Works)
DRV:64bit: - (StillCam) – C:\Windows\SysNative\DRIVERS\serscan.sys (Microsoft Corporation)
DRV:64bit: - (WSDPrintDevice) – C:\Windows\SysNative\DRIVERS\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (MotoSwitchService) – C:\Windows\SysNative\DRIVERS\motswch.sys (Motorola)
DRV:64bit: - (XAudio) – C:\Windows\SysNative\DRIVERS\xaudio64.sys (Conexant Systems, Inc.)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iastor.sys (Intel Corporation)
DRV:64bit: - (SaiHFF0C) – C:\Windows\SysNative\DRIVERS\SaiHFF0C.sys (Saitek)
DRV:64bit: - (SaiUFF0C) – C:\Windows\SysNative\DRIVERS\SaiUFF0C.sys (Saitek)
DRV:64bit: - (mdmxsdk) – C:\Windows\SysNative\DRIVERS\mdmxsdk.sys (Conexant)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20140508.034\ex64.sys (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20140508.034\eng64.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20140507.001\IDSviA64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NPPTNT2) – C:\WINDOWS\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.v9.com/web/?type=ds&ts;=1398878357&from;=irs&uid;=HitachiXHDS721075KLA330_GTF200P8GUN8GFGUN8GFX&i;=psd&t;=341cbe5db&q;={searchTerms}
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.v9.com/web/?type=ds&ts;=1398878357&from;=irs&uid;=HitachiXHDS721075KLA330_GTF200P8GUN8GFGUN8GFX&i;=psd&t;=341cbe5db&q;={searchTerms}
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE:64bit: - HKLM\..\SearchScopes\{DB4376FF-E866-4999-8C9A-FF552D841782}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=hp-pvdt
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src;={referrer:source?}
IE - HKLM\..\SearchScopes\{DB4376FF-E866-4999-8C9A-FF552D841782}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=hp-pvdt
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=en_us&c;=83&bd;=Pavilion&pf;=cndt
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=en_us&c;=83&bd;=Pavilion&pf;=cndt
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src;={referrer:source?}
IE - HKCU\..\SearchScopes\{DB4376FF-E866-4999-8C9A-FF552D841782}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=hp-pvdt
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8118;https=127.0.0.1:8118
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:29.0
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\system32\npDeployJava1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.55.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.55.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2011/11/01 07:15:38 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2014/04/30 18:03:40 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014/05/07 15:47:55 | 000,000,000 | —D | M]
 
[2011/06/16 19:16:25 | 000,000,000 | —D | M] (No name found) – C:\Users\Gary\AppData\Roaming\Mozilla\Extensions
[2011/06/16 19:16:25 | 000,000,000 | —D | M] (No name found) – C:\Users\Gary\AppData\Roaming\Mozilla\Extensions\[removed]
[2014/05/01 09:44:14 | 000,000,000 | —D | M] (No name found) – C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\yeag246i.default-1398948955132\extensions
[2014/05/09 08:21:54 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2014/04/30 18:03:40 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2014/04/30 18:03:50 | 000,000,000 | —D | M] (Default) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/09/12 23:05:42 | 000,124,240 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\CCMSDK.dll
[2009/09/12 23:06:22 | 000,070,488 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\CgpCore.dll
[2009/09/12 23:06:32 | 000,091,480 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\confmgr.dll
[2009/09/12 23:06:28 | 000,022,360 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\ctxlogging.dll
[2009/09/12 23:08:36 | 000,406,864 | —- | M] () – C:\Program Files (x86)\mozilla firefox\plugins\npicaN.dll
[2006/08/09 06:16:08 | 000,030,408 | —- | M] ( ) – C:\Program Files (x86)\mozilla firefox\plugins\npWebLaunch.dll
[2009/09/12 23:06:24 | 000,023,896 | —- | M] (Citrix Systems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\TcpPServ.dll
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs;_ri={google:suggestRid}&xssi;=t&q;={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - plugin: Error reading preferences file
CHR - Extension: Google Docs = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Google Wallet = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
CHR - Extension: Gmail = C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
 
O1 HOSTS File: ([2014/05/01 09:02:43 | 000,039,317 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 08sr.combineads.info # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 08srvr.combineads.info # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 12srvr.combineads.info # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 2010-fr.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 2012-new.biz # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 212link.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 2319825.ourtoolbar.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 24h00business.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 a.adorika.net # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 a.ad-sys.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 a.daasafterdusk.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ad.adn360.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 adeartss.eu # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 adesoeasy.eu # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 adf.girldatesforfree.net # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 adm.soft365.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 adomicileavail.googlepages.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads7.complexadveising.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.adplxmd.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.aff.co # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.alpha00001.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.cloud4ads.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.egdating.net # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.eorezo.com # hosts anti-adware / pups
O1 - Hosts: 127.0.0.1 ads.hooqy.com # hosts anti-adware / pups
O1 - Hosts: 647 more lines…
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\CoIEPlg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [Bluetooth Connection Assistant] LBTWIZ.EXE -silent File not found
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe File not found
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (X86)\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [ProfilerU] C:\Program Files\SmartTechnology\Software\ProfilerU.exe (Saitek)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [SaiMfd] C:\Program Files\SmartTechnology\Software\SaiMfd.exe (Saitek)
O4 - HKLM..\Run: [4StoryPrePatch] C:\Program Files (x86)\Gameforge4D\GatesofAndaron\PrePatch.exe (Zamiinc)
O4 - HKLM..\Run: [ADBlocker] C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\ADBlockerTray.exe (Anvisoft)
O4 - HKLM..\Run: [Anvi AD Blocker] C:\Program Files (x86)\Anvisoft\Anvi AD Blocker\ADBlockerTray.exe (Anvisoft)
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKLM..\Run: [ScrewDrivers RDP Plugin] C:\Program Files (x86)\triCerat\Simplify Printing\ScrewDrivers Client v4\install_rdp.exe ()
O4 - HKCU..\Run: [VirtualDub.org] C:\Windows\SysWow64\regsvr32.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre7\bin\jp2iexp.dll ()
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Java Plug-in 10.55.2)
O16 - DPF: {CAFEEFAC-0017-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Java Plug-in 1.7.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Java Plug-in 10.55.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6DE92507-B466-474D-9E8F-F4A5EC774184}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7D8B5987-8491-4898-9A1B-88C11ECF028C}: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\symres - No CLSID value found
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Security Suite\Engine\3.8.3.6\CoIEPlg.dll (Symantec Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\SysWOW64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Gary\Desktop\Photos\Cactus\Cactus Background-1.jpg
O24 - Desktop BackupWallPaper: C:\Users\Gary\Desktop\Photos\Cactus\Cactus Background-1.jpg
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2014/05/07 15:45:22 | 000,000,000 | —D | C] – C:\ProgramData\Oracle
[2014/05/07 15:44:50 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2014/05/07 15:44:36 | 000,264,616 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2014/05/07 15:44:03 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
[2014/05/07 15:43:57 | 000,175,528 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2014/05/07 15:43:57 | 000,096,168 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2014/05/07 15:43:37 | 000,175,016 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2014/05/07 15:19:35 | 000,921,512 | —- | C] (Oracle Corporation) – C:\Users\Gary\Desktop\jxpiinstall.exe
[2014/05/07 09:07:30 | 000,536,576 | —- | C] (SQLite Development Team) – C:\Windows\SysWow64\sqlite3.dll
[2014/05/07 08:19:45 | 000,000,000 | —D | C] – C:\_OTL
[2014/05/06 10:19:07 | 000,000,000 | —D | C] – C:\Users\Gary\AppData\Roaming\DropboxMaster
[2014/05/05 11:36:38 | 004,745,728 | —- | C] (AVAST Software) – C:\Users\Gary\Desktop\aswMBR.exe
[2014/05/01 09:54:35 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Gary\Desktop\OTL.exe
[2014/05/01 09:21:54 | 000,000,000 | —D | C] – C:\ProgramData\Anvisoft
[2014/05/01 09:21:45 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Anvisoft
[2014/05/01 09:21:40 | 000,000,000 | —D | C] – C:\Program Files (x86)\Anvisoft
[2014/05/01 09:10:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2014/05/01 08:57:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs
[2014/04/30 21:04:38 | 010,971,424 | —- | C] (SurfRight B.V.) – C:\Users\Gary\Desktop\HitmanPro_x64.exe
[2014/04/30 21:03:59 | 000,000,000 | —D | C] – C:\ProgramData\HitmanPro
[2014/04/30 20:22:52 | 000,000,000 | —D | C] – C:\Windows\ERUNT
[2014/04/30 20:22:07 | 001,016,261 | —- | C] (Thisisu) – C:\Users\Gary\Desktop\JRT_NEW.exe
[2014/04/30 20:06:33 | 000,000,000 | —D | C] – C:\AdwCleaner
[2014/04/30 18:03:40 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2014/04/30 13:19:52 | 000,000,000 | —D | C] – C:\Windows\Microsoft
[2014/04/30 13:19:40 | 000,000,000 | —D | C] – C:\Program Files (x86)\MSR
[2014/04/30 13:18:35 | 000,000,000 | —D | C] – C:\Users\Gary\AppData\Roaming\Wise
[2014/04/23 08:53:59 | 000,000,000 | —D | C] – C:\Users\Gary\Desktop\p90x3
[2014/04/09 08:57:58 | 000,763,904 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2014/04/09 08:57:58 | 000,480,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2014/04/09 08:57:56 | 000,623,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2014/04/09 08:57:56 | 000,485,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2014/04/09 08:57:56 | 000,422,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2014/04/09 08:57:56 | 000,389,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2014/04/09 08:57:56 | 000,249,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2014/04/09 08:57:56 | 000,224,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2014/04/09 08:57:56 | 000,193,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2014/04/09 08:57:56 | 000,180,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2014/04/09 08:57:56 | 000,108,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2014/04/09 08:57:56 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2014/04/09 08:57:56 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\corpol.dll
[2014/04/09 08:57:56 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\corpol.dll
[2014/04/09 08:57:55 | 000,380,928 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2014/04/09 08:57:52 | 001,212,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[1 C:\Users\Gary\*.tmp files -> C:\Users\Gary\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2014/05/09 08:31:15 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2014/05/09 08:24:45 | 000,000,890 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014/05/09 08:21:36 | 000,003,616 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2014/05/09 08:21:36 | 000,003,616 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2014/05/09 08:21:19 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2014/05/08 18:18:00 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014/05/08 15:49:30 | 000,036,352 | —- | M] () – C:\Users\Gary\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2014/05/08 15:49:28 | 1685,016,590 | —- | M] () – C:\Users\Gary\Desktop\Riddick.2013.DVDRip.x264.AC3-EVO.avi
[2014/05/08 11:45:51 | 000,117,127 | —- | M] () – C:\Users\Gary\Desktop\Request_12043555_Archival.pdf
[2014/05/07 16:03:10 | 004,143,997 | —- | M] () – C:\Users\Gary\Desktop\tdsskiller.zip
[2014/05/07 15:47:56 | 000,001,924 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader X.lnk
[2014/05/07 15:43:18 | 000,096,168 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2014/05/07 15:43:10 | 000,264,616 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2014/05/07 15:43:10 | 000,175,528 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2014/05/07 15:43:10 | 000,175,016 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2014/05/07 15:25:38 | 000,000,975 | —- | M] () – C:\Users\Gary\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2014/05/07 15:19:36 | 000,921,512 | —- | M] (Oracle Corporation) – C:\Users\Gary\Desktop\jxpiinstall.exe
[2014/05/07 12:03:50 | 000,000,258 | RHS- | M] () – C:\ProgramData\ntuser.pol
[2014/05/07 09:06:35 | 001,310,621 | —- | M] () – C:\Users\Gary\Desktop\adwcleaner.exe
[2014/05/06 10:19:03 | 000,000,957 | —- | M] () – C:\Users\Gary\Desktop\Dropbox.lnk
[2014/05/06 09:24:55 | 000,000,570 | —- | M] () – C:\Users\Gary\Desktop\MBR.zip
[2014/05/06 09:21:36 | 000,000,512 | —- | M] () – C:\Users\Gary\Desktop\MBR.dat
[2014/05/05 11:36:52 | 004,745,728 | —- | M] (AVAST Software) – C:\Users\Gary\Desktop\aswMBR.exe
[2014/05/05 11:36:15 | 000,854,355 | —- | M] () – C:\Users\Gary\Desktop\SecurityCheck.exe
[2014/05/03 09:19:07 | 837,171,865 | —- | M] () – C:\Users\Gary\Desktop\pmpeiibd72.mkv
[2014/05/02 08:24:17 | 733,867,381 | —- | M] () – C:\Users\Gary\Desktop\The Lego Movie 2014 WEBRip Upscaled 720p x264 AAC-HeartAttack.mp4
[2014/05/01 19:31:48 | 1479,689,302 | —- | M] () – C:\Users\Gary\Desktop\monmen72-hbs.mp4
[2014/05/01 15:59:06 | 000,239,107 | —- | M] () – C:\Users\Gary\Desktop\print.xps
[2014/05/01 15:30:36 | 001,611,202 | —- | M] () – C:\Users\Gary\Desktop\PrincipalDownload.pdf
[2014/05/01 09:54:38 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Gary\Desktop\OTL.exe
[2014/05/01 09:37:40 | 000,002,051 | —- | M] () – C:\Users\Gary\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2014/05/01 09:21:45 | 000,000,891 | —- | M] () – C:\Users\Public\Desktop\Anvi AD Blocker.lnk
[2014/05/01 09:19:14 | 006,369,640 | —- | M] () – C:\Users\Gary\Desktop\adblocker_setup.exe
[2014/05/01 09:10:57 | 000,002,027 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2014/05/01 09:02:43 | 000,039,317 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2014/04/30 21:29:12 | 000,032,512 | —- | M] () – C:\Windows\SysNative\drivers\hitmanpro37.sys
[2014/04/30 21:27:02 | 000,003,866 | —- | M] () – C:\Windows\SysNative\.crusader
[2014/04/30 21:05:09 | 010,971,424 | —- | M] (SurfRight B.V.) – C:\Users\Gary\Desktop\HitmanPro_x64.exe
[2014/04/30 13:25:27 | 000,000,890 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2014/04/30 13:25:26 | 000,000,914 | —- | M] () – C:\Users\Gary\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2014/04/30 08:38:23 | 1502,076,584 | —- | M] () – C:\Users\Gary\Desktop\The_Lego_Movie_2014_Webrip_x264_AC3_TiTAN.mkv
[2014/04/29 16:58:02 | 000,000,450 | -H– | M] () – C:\Windows\tasks\Norton Security Scan for Gary.job
[2014/04/29 13:31:15 | 000,692,400 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2014/04/29 13:31:14 | 000,070,832 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2014/04/29 08:11:23 | 1467,971,725 | —- | M] () – C:\Users\Gary\Desktop\rbocpweb72-hbs.mp4
[2014/04/25 07:55:02 | 967,586,375 | —- | M] () – C:\Users\Gary\Desktop\300.roae.2014.hdrip.x264-hbs.mp4
[2014/04/20 19:20:42 | 006,195,323 | —- | M] () – C:\Users\Gary\Desktop\P90X3_Worksheets_Hres.rtf
[2014/04/20 11:03:13 | 003,000,315 | —- | M] () – C:\Users\Gary\Desktop\P90X3_Worksheets_Hres.pdf
[2014/04/16 10:52:03 | 000,000,330 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForGary.job
[2014/04/13 15:22:17 | 851,125,388 | —- | M] () – C:\Users\Gary\Desktop\Zulu.2013.720p.BluRay.x264.YIFY.mp4
[2014/04/13 08:14:39 | 000,222,166 | —- | M] () – C:\Users\Gary\Desktop\401k unenroll.xps
[2014/04/11 15:41:09 | 837,117,006 | —- | M] () – C:\Users\Gary\Desktop\joeweb72-G.mkv
[2014/04/10 12:18:06 | 002,290,165 | —- | M] () – C:\Users\Gary\Desktop\2.jpg
[2014/04/10 12:11:44 | 002,024,146 | —- | M] () – C:\Users\Gary\Desktop\1.jpg
[2014/04/09 19:42:49 | 000,394,339 | —- | M] () – C:\Users\Gary\Desktop\OF306- 2011 version-1111.pdf
[1 C:\Users\Gary\*.tmp files -> C:\Users\Gary\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2014/05/08 11:45:51 | 000,117,127 | —- | C] () – C:\Users\Gary\Desktop\Request_12043555_Archival.pdf
[2014/05/07 15:57:39 | 004,143,997 | —- | C] () – C:\Users\Gary\Desktop\tdsskiller.zip
[2014/05/07 15:47:56 | 000,001,924 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader X.lnk
[2014/05/07 15:47:55 | 000,001,804 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2014/05/07 09:06:32 | 001,310,621 | —- | C] () – C:\Users\Gary\Desktop\adwcleaner.exe
[2014/05/06 09:24:55 | 000,000,570 | —- | C] () – C:\Users\Gary\Desktop\MBR.zip
[2014/05/06 09:21:36 | 000,000,512 | —- | C] () – C:\Users\Gary\Desktop\MBR.dat
[2014/05/05 11:36:12 | 000,854,355 | —- | C] () – C:\Users\Gary\Desktop\SecurityCheck.exe
[2014/05/03 09:03:53 | 837,171,865 | —- | C] () – C:\Users\Gary\Desktop\pmpeiibd72.mkv
[2014/05/02 08:11:27 | 733,867,381 | —- | C] () – C:\Users\Gary\Desktop\The Lego Movie 2014 WEBRip Upscaled 720p x264 AAC-HeartAttack.mp4
[2014/05/01 19:01:58 | 1479,689,302 | —- | C] () – C:\Users\Gary\Desktop\monmen72-hbs.mp4
[2014/05/01 15:59:05 | 000,239,107 | —- | C] () – C:\Users\Gary\Desktop\print.xps
[2014/05/01 15:30:33 | 001,611,202 | —- | C] () – C:\Users\Gary\Desktop\PrincipalDownload.pdf
[2014/05/01 09:21:45 | 000,000,891 | —- | C] () – C:\Users\Public\Desktop\Anvi AD Blocker.lnk
[2014/05/01 09:21:44 | 000,019,280 | —- | C] () – C:\Windows\SysNative\drivers\asdnet.sys
[2014/05/01 09:19:08 | 006,369,640 | —- | C] () – C:\Users\Gary\Desktop\adblocker_setup.exe
[2014/05/01 09:10:57 | 000,002,051 | —- | C] () – C:\Users\Gary\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2014/05/01 09:10:57 | 000,002,027 | —- | C] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2014/04/30 21:29:12 | 000,032,512 | —- | C] () – C:\Windows\SysNative\drivers\hitmanpro37.sys
[2014/04/30 21:27:02 | 000,003,866 | —- | C] () – C:\Windows\SysNative\.crusader
[2014/04/30 13:19:20 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2014/04/30 08:27:39 | 1502,076,584 | —- | C] () – C:\Users\Gary\Desktop\The_Lego_Movie_2014_Webrip_x264_AC3_TiTAN.mkv
[2014/04/29 08:01:21 | 1467,971,725 | —- | C] () – C:\Users\Gary\Desktop\rbocpweb72-hbs.mp4
[2014/04/25 07:48:18 | 967,586,375 | —- | C] () – C:\Users\Gary\Desktop\300.roae.2014.hdrip.x264-hbs.mp4
[2014/04/20 19:20:41 | 006,195,323 | —- | C] () – C:\Users\Gary\Desktop\P90X3_Worksheets_Hres.rtf
[2014/04/20 11:03:10 | 003,000,315 | —- | C] () – C:\Users\Gary\Desktop\P90X3_Worksheets_Hres.pdf
[2014/04/13 14:20:20 | 851,125,388 | —- | C] () – C:\Users\Gary\Desktop\Zulu.2013.720p.BluRay.x264.YIFY.mp4
[2014/04/13 08:14:37 | 000,222,166 | —- | C] () – C:\Users\Gary\Desktop\401k unenroll.xps
[2014/04/11 15:33:54 | 837,117,006 | —- | C] () – C:\Users\Gary\Desktop\joeweb72-G.mkv
[2014/04/10 12:12:20 | 002,290,165 | —- | C] () – C:\Users\Gary\Desktop\2.jpg
[2014/04/10 12:11:42 | 002,024,146 | —- | C] () – C:\Users\Gary\Desktop\1.jpg
[2014/04/09 19:42:49 | 000,394,339 | —- | C] () – C:\Users\Gary\Desktop\OF306- 2011 version-1111.pdf
[2014/03/30 09:41:21 | 000,000,732 | —- | C] () – C:\Users\Gary\AppData\Local\d3d9caps64.dat
[2014/02/18 19:15:33 | 000,012,005 | —- | C] () – C:\Users\Gary\AppData\Roaming\alsoft.ini
[2012/07/15 09:49:45 | 000,000,680 | —- | C] () – C:\Users\Gary\AppData\Local\d3d9caps.dat
[2011/12/13 09:20:01 | 000,000,044 | —- | C] () – C:\Users\Gary\jagex_cl_runescape_LIVE3.dat
[2011/12/13 09:13:07 | 000,000,044 | —- | C] () – C:\Users\Gary\jagex_cl_runescape_LIVE2.dat
[2011/12/12 23:41:34 | 000,000,044 | —- | C] () – C:\Users\Gary\jagex_cl_runescape_LIVE1.dat
[2011/12/12 21:29:01 | 000,000,043 | —- | C] () – C:\Users\Gary\jagex_cl_runescape_LIVE.dat
[2011/12/12 21:29:01 | 000,000,024 | —- | C] () – C:\Users\Gary\random.dat
[2011/05/23 08:44:15 | 000,000,000 | —- | C] () – C:\Users\Gary\AppData\Roaming\wklnhst.dat
[2011/05/18 17:47:00 | 000,001,940 | —- | C] () – C:\Users\Gary\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/06/08 07:55:03 | 000,000,092 | —- | C] () – C:\Users\Gary\AppData\Local\fusioncache.dat
[2010/03/21 21:09:21 | 000,031,776 | —- | C] () – C:\ProgramData\nvModes.001
[2010/03/21 20:58:31 | 000,031,776 | —- | C] () – C:\ProgramData\nvModes.dat
[2010/03/18 17:07:28 | 000,036,352 | —- | C] () – C:\Users\Gary\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2006/11/02 11:30:40 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"ThreadingModel" = Both
"" = C:\Windows\SysNative\shell32.dll – [2012/06/08 13:59:03 | 012,899,840 | —- | M] (Microsoft Corporation)
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/08 13:59:03 | 012,899,840 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 13:47:00 | 011,586,048 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/04/11 03:11:14 | 000,891,392 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\SysWow64\wbem\fastprox.dll – [2009/04/11 02:28:19 | 000,614,912 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2008/01/20 22:50:58 | 000,513,024 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\SysWow64\wbem\wbemess.dll
"ThreadingModel" = Apartment
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\Gary\Desktop\tehhobtextd72.mkv:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Gary\Desktop\Riddick.2013.DVDRip.x264.AC3-EVO.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Gary\Desktop\escpepln72-G.mkv:TOC.WMV
@Alternate Data Stream - 453 bytes -> C:\Users\Gary\Desktop\2-5.jpg:com.dropbox.attributes
@Alternate Data Stream - 449 bytes -> C:\Users\Gary\Desktop\2-4.jpg:com.dropbox.attributes
@Alternate Data Stream - 449 bytes -> C:\Users\Gary\Desktop\2-1.jpg:com.dropbox.attributes
@Alternate Data Stream - 448 bytes -> C:\Users\Gary\Desktop\2-2.jpg:com.dropbox.attributes
@Alternate Data Stream - 446 bytes -> C:\Users\Gary\Desktop\2-3.jpg:com.dropbox.attributes
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:B2AA1B61

< End of report >