Inactive [A] Warning: possible TDL3 rootkit infection !

Status
Not open for further replies.

Reginald Hirsch

Posts: 30   +0
As you can see infection started August 13 here are the logs requested and any help appreciated :
First detected problem:

2012/08/13 10:28:37 -0600REGINALD-PCReginaldIP-BLOCK109.163.227.72 (Type: incoming, Port: 3389)
2012/08/13 10:28:46 -0600REGINALD-PCReginaldIP-BLOCK109.163.227.72 (Type: incoming, Port: 3389)
2012/08/13 10:28:46 -0600REGINALD-PCReginaldIP-BLOCK109.163.227.72 (Type: incoming, Port: 3389)
2012/08/13 14:28:50 -0600REGINALD-PCReginaldMESSAGEStopping IP protection
2012/08/13 14:31:56 -0600REGINALD-PCReginaldMESSAGEIP Protection stopped
2012/08/13 17:47:08 -0600REGINALD-PCReginaldDETECTIONC:\Users\Reginald\AppData\Local\Temp\013922622cb0.exeRootKit.0AccessALLOW
2012/08/13 17:47:39 -0600REGINALD-PCReginaldDETECTIONC:\Windows\Installer\{f9ef26a6-5650-2172-7144-5aa984cc63b0}\U\800000cb.@Rootkit.0AccessALLOW
2012/08/13 17:47:43 -0600REGINALD-PCReginaldDETECTIONC:\Users\Reginald\AppData\Local\Temp\013922622CB0.EXERootKit.0AccessALLOW
2012/08/13 17:47:44 -0600REGINALD-PCReginaldDETECTIONC:\Windows\Installer\{f9ef26a6-5650-2172-7144-5aa984cc63b0}\U\800000cb.@Rootkit.0AccessALLOW
2012/08/13 22:38:27 -0600REGINALD-PCReginaldDETECTIONC:\Users\Reginald\AppData\Local\{f9ef26a6-5650-2172-7144-5aa984cc63b0}\nRootKit.0AccessALLOW
2012/08/13 22:39:07 -0600REGINALD-PCReginaldDETECTIONC:\Users\Reginald\AppData\Local\{f9ef26a6-5650-2172-7144-5aa984cc63b0}\nRootKit.0AccessALLOW
2012/08/13 23:00:37 -0600REGINALD-PCReginaldDETECTIONC:\Users\Reginald\AppData\Local\{f9ef26a6-5650-2172-7144-5aa984cc63b0}\nRootKit.0AccessALLOW

Then next log reported :
2012/08/14 13:09:52 -0600REGINALD-PCReginaldMESSAGEStarting protection
2012/08/14 13:09:55 -0600REGINALD-PCReginaldMESSAGEProtection started successfully
2012/08/14 13:09:58 -0600REGINALD-PCReginaldMESSAGEStarting IP protection
2012/08/14 13:09:58 -0600REGINALD-PCReginaldERRORIP protection failed: FwpmEngineOpen0 failed with error code 1753
2012/08/14 15:31:38 -0600REGINALD-PCReginaldDETECTIONC:\Users\Reginald\AppData\Local\{F9EF26A6-5650-2172-7144-5AA984CC63B0}\nRootKit.0AccessQUARANTINE
2012/08/14 15:31:38 -0600REGINALD-PCReginaldERRORQuarantine failed: DeleteFile failed with error code 5
2012/08/14 15:40:24 -0600REGINALD-PCReginaldMESSAGEStarting protection
2012/08/14 15:40:27 -0600REGINALD-PCReginaldMESSAGEProtection started successfully
2012/08/14 15:40:30 -0600REGINALD-PCReginaldMESSAGEStarting IP protection
2012/08/14 15:40:30 -0600REGINALD-PCReginaldERRORIP protection failed: FwpmEngineOpen0 failed with error code 1753
2012/08/14 15:43:08 -0600REGINALD-PCReginaldMESSAGEStarting database refresh
2012/08/14 15:43:10 -0600REGINALD-PCReginaldMESSAGEDatabase refreshed successfully
2012/08/14 16:34:15 -0600REGINALD-PCReginaldDETECTIONC:\Windows\Installer\{f9ef26a6-5650-2172-7144-5aa984cc63b0}\U\800000cb.@Rootkit.0AccessQUARANTINE
2012/08/14 19:06:59 -0600REGINALD-PCReginaldMESSAGEStarting protection
2012/08/14 19:07:08 -0600REGINALD-PCReginaldMESSAGEProtection started successfully
2012/08/14 19:07:11 -0600REGINALD-PCReginaldMESSAGEStarting IP protection
2012/08/14 19:07:11 -0600REGINALD-PCReginaldERRORIP protection failed: FwpmEngineOpen0 failed with error code 1753
2012/08/14 20:01:14 -0600REGINALD-PCReginaldMESSAGEStarting protection
2012/08/14 20:01:17 -0600REGINALD-PCReginaldMESSAGEProtection started successfully
2012/08/14 20:01:20 -0600REGINALD-PCReginaldMESSAGEStarting IP protection
2012/08/14 20:01:20 -0600REGINALD-PCReginaldERRORIP protection failed: FwpmEngineOpen0 failed with error code 1753
2012/08/14 21:03:29 -0600REGINALD-PCReginaldMESSAGEStarting protection
2012/08/14 21:03:32 -0600REGINALD-PCReginaldMESSAGEProtection started successfully
2012/08/14 21:03:35 -0600REGINALD-PCReginaldMESSAGEStarting IP protection
2012/08/14 21:03:35 -0600REGINALD-PCReginaldERRORIP protection failed: FwpmEngineOpen0 failed with error code 1753


Then next log reported :
2012/08/15 07:48:49 -0600REGINALD-PCReginaldMESSAGEStarting protection
2012/08/15 07:48:52 -0600REGINALD-PCReginaldMESSAGEProtection started successfully
2012/08/15 07:48:55 -0600REGINALD-PCReginaldMESSAGEStarting IP protection
2012/08/15 07:48:55 -0600REGINALD-PCReginaldERRORIP protection failed: FwpmEngineOpen0 failed with error code 1753
2012/08/15 21:27:20 -0600REGINALD-PCReginaldMESSAGEExecuting scheduled update: Weekly | Silent
2012/08/15 21:27:48 -0600REGINALD-PCReginaldMESSAGEScheduled update executed successfully: database updated from version v2012.08.14.07 to version v2012.08.16.02
2012/08/15 22:30:00 -0600REGINALD-PCReginaldMESSAGEExecuting scheduled scan: Quick Scan | Weekly | -reboot
2012/08/15 22:30:00 -0600REGINALD-PCReginaldMESSAGEScheduled scan executed successfully

Next Log:
012/08/16 07:53:54 -0600REGINALD-PCReginaldMESSAGEStarting protection
2012/08/16 07:54:05 -0600REGINALD-PCReginaldMESSAGEProtection started successfully
2012/08/16 07:54:08 -0600REGINALD-PCReginaldMESSAGEStarting IP protection
2012/08/16 07:54:09 -0600REGINALD-PCReginaldMESSAGEIP Protection started successfully

Last log:
2012/08/17 08:18:44 -0600REGINALD-PCReginaldMESSAGEStopping IP protection
2012/08/17 08:18:44 -0600REGINALD-PCReginaldMESSAGEIP Protection stopped
2012/08/17 13:01:51 -0600REGINALD-PCReginaldMESSAGEStarting database refresh
2012/08/17 13:02:01 -0600REGINALD-PCReginaldMESSAGEDatabase refreshed successfully
2012/08/17 13:02:21 -0600REGINALD-PCReginaldMESSAGEStarting IP protection
2012/08/17 13:02:23 -0600REGINALD-PCReginaldMESSAGEIP Protection started successfully

GMER:

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2012-08-18 15:13:30
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST332062 rev.3.AD
Running: cztdodz5.exe; Driver: C:\Users\Reginald\AppData\Local\Temp\pwlyikod.sys


---- Devices - GMER 1.0.15 ----

Device \Driver\iaStor \Device\Ide\iaStor0 [8B900580] \SystemRoot\system32\DRIVERS\iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\iaStor \Device\Ide\IAAStorageDevice-0 [8B900580] \SystemRoot\system32\DRIVERS\iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device iaStor.sys (Intel Matrix Storage Manager driver - ia32/Intel Corporation)
Device 85B891F8
Device Ntfs.sys (NT File System Driver/Microsoft Corporation)

AttachedDevice tdrpm273.sys (Acronis Try&Decide Volume Filter Driver/Acronis)

Device 878541F8
Device fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)

AttachedDevice \Driver\tdx \Device\Ip kmodurl.sys
AttachedDevice \Driver\tdx \Device\Tcp kmodurl.sys
AttachedDevice \Driver\tdx \Device\Udp kmodurl.sys
AttachedDevice \Driver\tdx \Device\RawIp kmodurl.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 VMkbd.sys

---- EOF - GMER 1.0.15 ----

DDS File:
DDS

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_17
Run by Reginald at 15:18:21 on 2012-08-18
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\system32\atieclxx.exe
C:\Program Files\Kingsoft\PcDoctor\KSafeSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Google\Update\1.3.21.115\GoogleCrashHandler.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Program Files\DebugDiag\DbgSvc.exe
C:\Program Files\DU Meter\DUMeterSvc.exe
C:\Program Files\Citrix\GoToMyPC\g2svc.exe
C:\Program Files\Citrix\GoToMyPC\g2comm.exe
C:\Program Files\Citrix\GoToMyPC\g2pre.exe
C:\Program Files\Citrix\GoToMyPC\g2tray.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Windows\vVX6000.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
C:\Program Files\SysMetrix\SysMetrix.exe
C:\Program Files\Acronis\OnlineBackupStandalone\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Kingsoft\PcDoctor\KSafeTray.exe
C:\Program Files\Garmin\Lifetime Updater\GarminLifetime.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\AirPort\APAgent.exe
C:\Program Files\AirVideoServer\AirVideoServer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\DU Meter\DUMeter.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
c:\Program Files\Microsoft SQL Server\MSSQL10.MICROSOFTSCM\MSSQL\Binn\sqlservr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\Xmarks\IE Extension\xmarkssync.exe
C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\TechSmith\Snagit 10\Snagit32.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Windows\system32\conhost.exe
C:\Program Files\TechSmith\Snagit 10\TSCHelp.exe
C:\Program Files\TechSmith\Snagit 10\SnagPriv.exe
C:\Program Files\Sling Media\SlingAgent\SlingAgentService.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
C:\Program Files\Active WebCam\WebCam.exe
C:\Users\Reginald\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\vws\vws.exe
C:\Program Files\WePrint\WePrint Server.exe
C:\Program Files\TechSmith\Snagit 10\snagiteditor.exe
C:\Program Files\APC\APC PowerChute Personal Edition\dataserv.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\TeamViewer\Version6\TeamViewer.exe
C:\Program Files\Active WebCam\CompParams.exe
C:\Program Files\Active WebCam\Watchdog.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\dllhost.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Windows\System32\msdtc.exe
C:\Program Files\Malwarebytes' Anti-Malware\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Users\Reginald\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Reginald\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Reginald\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Reginald\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Reginald\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Reginald\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Reginald\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Anvisoft\Anvi Smart Defender\ASDSrv.exe
C:\Windows\system32\taskhost.exe
C:\Users\Reginald\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Reginald\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Dell Support Center\pcdrcui.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Users\Reginald\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Reginald\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\Reginald\Desktop\rootkit\dds.com
C:\Windows\system32\conhost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\msfeedssync.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: FCToolbarURLSearchHook Class: {fa887e92-8f5f-4ec9-99ca-09be0e4120d6} - c:\program files\addthis toolbar\Helper.dll
BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 10\SnagitBHO.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: ThumbnailsBHO Class: {1bd0befe-f697-4eee-b7e1-76b849a5cb84} - c:\program files\xmarks\thumbnails for ie\xmarksthumbnails.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot - search & destroy\SDHelper.dll
BHO: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - No File
BHO: RoboForm Toolbar Helper: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\microsoft office\office14\GROOVEEX.DLL
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {9EBF8AAF-0A31-4786-909A-97A0EF101743} - No File
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\microsoft office\office14\URLREDIR.DLL
BHO: {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - No File
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: ChromeFrame BHO: {ecb3c477-1a0a-44bd-bb57-78f9efe34fa7} - c:\program files\google\chrome\application\21.0.1180.79\npchrome_frame.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: &RoboForm Toolbar: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
TB: Snagit: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 10\SnagitIEAddin.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [AirVideoServer] c:\program files\airvideoserver\AirVideoServer.exe
uRun: [AlcoholAutomount] "c:\program files\alcohol soft\alcohol 120\axcmd.exe" /automount
uRun: [DU Meter] c:\program files\du meter\DUMeter.exe
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [OfficeSyncProcess] "c:\program files\microsoft office\office14\MSOSYNC.EXE"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [MobileDocuments] c:\program files\common files\apple\internet services\ubd.exe
uRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe"
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [VX6000] c:\windows\vVX6000.exe
mRun: [Bluetooth HCI Monitor] RunDll32 HCIMNTR.DLL,RunCheckHCIMode
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe"
mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
mRun: [ECenter] c:\dell\e-center\EULALauncher.exe
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe"
mRun: [LifeCam] "c:\program files\microsoft lifecam\LifeExp.exe"
mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"
mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
mRun: [QuickFinder Scheduler] "c:\program files\corel\wordperfect office x4\programs\QFSCHD140.EXE"
mRun: [vmware-tray] "c:\program files\vmware\vmware workstation\vmware-tray.exe"
mRun: [ATICustomerCare] "c:\program files\ati\aticustomercare\ATICustomerCare.exe"
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
mRun: [SysMetrix] c:\program files\sysmetrix\SysMetrix.exe
mRun: [SAOB Monitor] c:\program files\acronis\onlinebackupstandalone\TrueImageMonitor.exe
mRun: [TrueImageMonitor.exe] "c:\program files\acronis\trueimagehome\TrueImageMonitor.exe"
mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe"
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
mRun: [KSafeTray] "c:\program files\kingsoft\pcdoctor\KSafeTray.exe" -autorun
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [AirPort Base Station Agent] "c:\program files\airport\APAgent.exe"
mRun: [Anvi Smart Defender] c:\program files\anvisoft\anvi smart defender\ASDTray.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
mPolicies-system: EnableLinkedConnections = 1 (0x1)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\microsoft office\office14\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: Open with WordPerfect - c:\program files\corel\wordperfect office x4\programs\WPLauncher.hta
IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: Se&nd to OneNote - c:\progra~1\microsoft office\office14\ONBttnIE.dll/105
IE: Send image to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: Show RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\roboform.dll
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\roboform.dll
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot - search & destroy\SDHelper.dll
Trusted Zone: garmin.com\connect
Trusted Zone: garmin.com\mygarmin
Trusted Zone: garmin.com\www
Trusted Zone: real.com\rhap-app-4-0
Trusted Zone: real.com\rhapreg
Trusted Zone: zoombak.com\locate
Trusted Zone: zoombak.com\shop
DPF: CaptureClient - hxxp://192.168.1.110/CaptureClient.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {22D82B43-FF26-455A-A96D-A6C61F056ED7} - hxxp://192.168.1.210/xplugxLiteTW.cab
DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} - hxxp://I.dell.com/images/global/js/scanner/SysProExe.cab
DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} - hxxp://support.dell.com/systemprofiler/SysProExe.CAB
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} - hxxps://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {B80CD4E6-5B02-4B6C-99BE-68F1511E9549} - hxxp://plugin.slingbox.com/downloads/pc/1.4.0.111/WebSlingPlayer.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/ractrl.cab?lmi=100
TCP: DhcpNameServer = 72.19.128.53 72.19.128.99
TCP: Interfaces\{297982DB-7F42-4718-8D4B-A71C72C5621A} : DhcpNameServer = 72.19.128.53 72.19.128.99
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - c:\program files\google\chrome\application\21.0.1180.79\npchrome_frame.dll
Handler: skyline - {3a4f9195-65a8-11d5-85c1-0001023952c1} - c:\program files\skyline\terraexplorer\TerraExplorerX.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\Skype4COM.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
AppInit_DLLs: acaptuser32.dll
STS: FencesShlExt Class: {1984dd45-52cf-49cd-ab77-18f378fea264} - c:\program files\stardock\fences\FencesMenu.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\microsoft office\office14\GROOVEEX.DLL
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\reginald\appdata\roaming\mozilla\firefox\profiles\0gixnud9.default\
FF - prefs.js: browser.startup.homepage - hxxp://watch.slingbox.com/watch/sling_player
.
============= SERVICES / DRIVERS ===============
.
R? ACTIVEWEBCAM;Active WebCam
R? ACTIVEWEBCAMWATCHDOG;Active WebCam Watchdog
R? AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service
R? b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0
R? BBSvc;Bing Bar Update Service
R? btusbflt;Bluetooth USB Filter
R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86
R? cpudrv;cpudrv
R? DUMeterDrv;Hagel Technologies DU Meter traffic accounting driver
R? epmntdrv;epmntdrv
R? EuGdiDrv;EuGdiDrv
R? GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335
R? gupdate;Google Update Service (gupdate)
R? gupdatem;Google Update Service (gupdatem)
R? libusb0;LibUsb-Win32 - Kernel Driver 06/04/2010,1.12.1.0
R? LMIRfsClientNP;LMIRfsClientNP
R? Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service
R? MSSQLServerADHelper100;SQL Active Directory Helper Service
R? NisDrv;Microsoft Network Inspection System
R? NisSrv;Microsoft Network Inspection
R? osppsvc;Office Software Protection Platform
R? PLCNDIS5;PLCNDIS5 NDIS Protocol Driver
R? RdpVideoMiniport;Remote Desktop Video Miniport Driver
R? RsFx0103;RsFx0103 Driver
R? SandraAgentSrv;SiSoftware Deployment Agent Service
R? SBSDWSCService;SBSD Security Center Service
R? SkypeUpdate;Skype Updater
R? SQLAgent$MICROSOFTSCM;SQL Server Agent (MICROSOFTSCM)
R? Synth3dVsc;Synth3dVsc
R? TsUsbFlt;TsUsbFlt
R? tsusbhub;tsusbhub
R? VGPU;VGPU
R? WatAdminSvc;Windows Activation Technologies Service
R? XE102Mp5;XE102Mp5 NDIS Protocol Driver
R? XE102Sp5;XE102Sp5 NDIS Protocol Driver
S? !SASCORE;SAS Core Service
S? afcdp;afcdp
S? afcdpsrv;Acronis Nonstop Backup service
S? AMD External Events Utility;AMD External Events Utility
S? amdkmdag;amdkmdag
S? amdkmdap;amdkmdap
S? APC Data Service;APC Data Service
S? asdrs;AntiMalware Host-based Intrusion Prevention System
S? asdsrv;Anvi Smart Defender Realtime Guard Service
S? asdws;AnviSmartDefender Web Guard
S? BBUpdate;BBUpdate
S? btwl2cap;Bluetooth L2CAP Service
S? DbgSvc;Debug Diagnostic Service
S? DUMeterSvc;DU Meter Service
S? kmodurl;kmodurl
S? KSafeSvc;KSafe service
S? LMIGuardianSvc;LMIGuardianSvc
S? LMIInfo;LogMeIn Kernel Information Provider
S? LMIRfsDriver;LogMeIn Remote File System Driver
S? MBAMProtector;MBAMProtector
S? MBAMService;MBAMService
S? MpFilter;Microsoft Malware Protection Driver
S? MpKsl7ad2c85a;MpKsl7ad2c85a
S? MSSQL$MICROSOFTSCM;SQL Server (MICROSOFTSCM)
S? PCDSRVC{E9D79540-57D5953E-06020101}_0;PCDSRVC{E9D79540-57D5953E-06020101}_0 - PCDR Kernel Mode Service Helper Driver
S? SASDIFSV;SASDIFSV
S? SASKUTIL;SASKUTIL
S? silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver
S? silabser;Silicon Labs CP210x USB to UART Bridge Driver
S? SlingAgentService;SlingAgentService
S? StarWindServiceAE;StarWind AE Service
S? tdrpman273;Acronis Try&Decide and Restore Points filter (build 273)
S? TeamViewer6;TeamViewer 6
S? VST_DPV;VST_DPV
S? VSTHWBS2;VSTHWBS2
S? VX6000;Microsoft LifeCam VX-6000
.
=============== Created Last 30 ================
.
2012-08-18 14:28:5856200----a-w-c:\programdata\microsoft\microsoft antimalware\definition updates\{d038ea17-3377-478b-b5ed-19b9e4cfa74b}\offreg.dll
2012-08-18 14:27:54--------d-----w-c:\users\reginald\appdata\roaming\Anvisoft
2012-08-18 14:27:4422864----a-w-c:\windows\system32\drivers\asdrs.sys
2012-08-18 14:27:4416208----a-w-c:\windows\system32\drivers\asdrm.sys
2012-08-18 14:27:4414160----a-w-c:\windows\system32\drivers\asdws.sys
2012-08-18 14:27:43--------d-----w-c:\programdata\Anvisoft
2012-08-18 14:27:36--------d-----w-c:\program files\Anvisoft
2012-08-18 13:39:5729904----a-w-c:\programdata\microsoft\microsoft antimalware\definition updates\{d038ea17-3377-478b-b5ed-19b9e4cfa74b}\MpKsl7ad2c85a.sys
2012-08-18 12:45:35--------d-----w-c:\programdata\Safe
2012-08-17 20:51:3622872----a-r-c:\windows\system32\AdobePDFUI.dll
2012-08-17 20:47:02103904----a-w-c:\program files\mozilla firefox\plugins\nppdf32.dll
2012-08-17 19:02:316891424----a-w-c:\programdata\microsoft\microsoft antimalware\definition updates\{d038ea17-3377-478b-b5ed-19b9e4cfa74b}\mpengine.dll
2012-08-17 16:23:48--------d-----w-c:\program files\ESET
2012-08-17 15:11:25--------d-sh--w-C:\$RECYCLE.BIN
2012-08-16 17:25:59--------d-----w-c:\users\reginald\appdata\roaming\ActiveWords 2.0
2012-08-16 17:25:49--------d-----w-c:\programdata\Licenses
2012-08-16 17:25:17232915----a-w-c:\windows\ActiveWords Uninstaller.exe
2012-08-16 17:25:16--------d-----w-c:\program files\common files\orangequava
2012-08-16 17:25:10--------d-----w-c:\program files\ActiveWords
2012-08-16 13:42:396891424----a-w-c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2012-08-16 13:13:20393728----a-w-c:\windows\system32\drivers\bthport.sys
2012-08-16 13:09:562345984----a-w-c:\windows\system32\win32k.sys
2012-08-16 13:09:54400896----a-w-c:\windows\system32\srcore.dll
2012-08-16 13:09:2741984----a-w-c:\windows\system32\browcli.dll
2012-08-16 13:09:27102912----a-w-c:\windows\system32\browser.dll
2012-08-16 13:09:25769024----a-w-c:\windows\system32\localspl.dll
2012-08-15 23:44:51--------d-----w-c:\program files\AirPort
2012-08-15 15:23:34--------d-----w-C:\Backreg
2012-08-15 14:56:0398816----a-w-c:\windows\sed.exe
2012-08-15 14:56:03518144----a-w-c:\windows\SWREG.exe
2012-08-15 14:56:03256000----a-w-c:\windows\PEV.exe
2012-08-15 14:56:03208896----a-w-c:\windows\MBR.exe
2012-08-15 12:10:46691696----a-w-c:\windows\system32\drivers\sptd.sys
2012-08-15 12:10:06--------d-----w-c:\program files\LSoft Technologies
2012-08-15 03:59:39--------d-----w-c:\windows\RestoreSafeDeleted
2012-08-15 03:52:59--------d-----w-c:\program files\UnHackMe
2012-08-15 03:28:262--shatr-c:\windows\winstart.bat
2012-08-15 03:28:16--------d-----w-c:\program files\Greatis
2012-08-15 03:23:05--------d-----w-c:\programdata\RegRun
2012-08-15 02:08:43--------d-----w-c:\programdata\HitmanPro
2012-08-15 01:14:14713784------w-c:\programdata\microsoft\microsoft antimalware\definition updates\{93354889-7ea1-40c7-ac78-80f571619cc8}\gapaengine.dll
2012-08-15 01:13:24100864----a-w-C:\pwlyikod.sys
2012-08-15 01:08:28--------d-----w-c:\program files\Microsoft Security Client
2012-08-15 00:41:12--------d-----w-c:\programdata\Sophos
2012-08-15 00:41:0473728----a-r-c:\users\reginald\appdata\roaming\microsoft\installer\{b829e117-d072-41ea-9606-9826a38d34c1}\SVRTgui.exe1_810EDD9E2F0A4E2BACF86673C38D9F48.exe
2012-08-15 00:41:0473728----a-r-c:\users\reginald\appdata\roaming\microsoft\installer\{b829e117-d072-41ea-9606-9826a38d34c1}\SVRTgui.exe_810EDD9E2F0A4E2BACF86673C38D9F48.exe
2012-08-15 00:41:0473728----a-r-c:\users\reginald\appdata\roaming\microsoft\installer\{b829e117-d072-41ea-9606-9826a38d34c1}\ARPPRODUCTICON.exe
2012-08-15 00:41:01--------d-----w-c:\program files\Sophos
2012-08-15 00:19:33--------d-----w-C:\TDSSKiller_Quarantine
2012-07-21 11:43:40--------d-----w-c:\users\reginald\appdata\roaming\SUPERAntiSpyware.com
2012-07-21 11:43:26--------d-----w-c:\programdata\SUPERAntiSpyware.com
2012-07-21 11:43:26--------d-----w-c:\program files\SUPERAntiSpyware
.
==================== Find3M ====================
.
2012-08-16 16:11:15848--sha-w-c:\programdata\KGyGaAvL.sys
2012-08-15 07:17:43426184----a-w-c:\windows\system32\FlashPlayerApp.exe
2012-08-15 07:17:4270344----a-w-c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-15 00:20:37259072----a-w-c:\windows\system32\services.exe
2012-07-12 09:36:3483392----a-w-c:\windows\system32\LMIRfsClientNP.dll
2012-07-12 09:36:3352128----a-w-c:\windows\system32\spool\prtprocs\w32x86\LMIproc.dll
2012-07-12 09:36:3330624----a-w-c:\windows\system32\LMIport.dll
2012-07-12 09:36:3287456----a-w-c:\windows\system32\LMIinit.dll
2012-07-03 19:46:4422344----a-w-c:\windows\system32\drivers\mbam.sys
2012-06-29 00:16:581800704----a-w-c:\windows\system32\jscript9.dll
2012-06-29 00:09:011129472----a-w-c:\windows\system32\wininet.dll
2012-06-29 00:08:591427968----a-w-c:\windows\system32\inetcpl.cpl
2012-06-29 00:04:43142848----a-w-c:\windows\system32\ieUnatt.exe
2012-06-29 00:00:452382848----a-w-c:\windows\system32\mshtml.tlb
2012-06-06 14:49:521070152----a-w-c:\windows\system32\MSCOMCTL.OCX
2012-06-06 05:05:521390080----a-w-c:\windows\system32\msxml6.dll
2012-06-06 05:05:521236992----a-w-c:\windows\system32\msxml3.dll
2012-06-06 05:03:06805376----a-w-c:\windows\system32\cdosys.dll
2012-06-02 22:12:322422272----a-w-c:\windows\system32\wucltux.dll
2012-06-02 22:12:1388576----a-w-c:\windows\system32\wudriver.dll
2012-06-02 21:19:42171904----a-w-c:\windows\system32\wuwebv.dll
2012-06-02 21:12:2033792----a-w-c:\windows\system32\wuapp.exe
2012-06-02 04:45:0467440----a-w-c:\windows\system32\drivers\ksecdd.sys
2012-06-02 04:45:03134000----a-w-c:\windows\system32\drivers\ksecpkg.sys
2012-06-02 04:40:59369336----a-w-c:\windows\system32\drivers\cng.sys
2012-06-02 04:40:39225280----a-w-c:\windows\system32\schannel.dll
2012-06-02 04:39:10219136----a-w-c:\windows\system32\ncrypt.dll
2012-05-22 19:16:2183360----a-w-c:\windows\system32\LMIRfsClientNP.dll.000.bak
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.1.7601 Disk: ST332062 rev.3.AD -> Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: >>UNKNOWN [0x83000000]<< >>UNKNOWN [0x8C188000]<< >>UNKNOWN [0x8C177000]<< >>UNKNOWN [0x8B8BB000]<< >>UNKNOWN [0x8B6AD000]<< >>UNKNOWN [0x83412000]<< >>UNKNOWN [0x85B5C938]<<
_asm { DEC EBP; POP EDX; NOP ; ADD [EBX], AL; ADD [EAX], AL; ADD [EAX+EAX], AL; ADD [EAX], AL; }
1 ntkrnlpa!IofCallDriver[0x8303755A] -> \Device\Harddisk0\DR0[0x874134B0]
\Driver\Disk[0x87412388] -> IRP_MJ_CREATE -> 0x8C18C39F
3 [0x8C18C59E] -> ntkrnlpa!IofCallDriver[0x8303755A] -> \Device\Ide\IAAStorageDevice-1[0x86ECB028]
\Driver\iaStor[0x868EC770] -> IRP_MJ_CREATE -> 0x8B900580
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; MOV CX, 0x4; MOV BP, 0x7be; CMP BYTE [BP+0x0], 0x0; }
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 15:23:00.94 ===============
Attach:

NLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
.
==== Installed Programs ======================
.
µTorrent
32 bit Windows Card Reader Driver
7-Zip 4.65
Acronis True Image Home 2011
Active@ ISO Burner
ActiveWords
AddThis Toolbar
Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
Adobe Acrobat 9.5.2 - CPSID_83708
Adobe After Effects CS4 Third Party Content
Adobe Anchor Service CS4
Adobe Creative Suite 4 Master Collection
Adobe CSI CS4
Adobe Dreamweaver CS4
Adobe Encore CS4 Codecs
Adobe ExtendScript Toolkit CS4
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Media Encoder CS4 Exporter
Adobe Media Encoder CS4 Importer
Adobe Photoshop Lightroom 3
Adobe Premiere Pro CS4 Third Party Content
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe Soundbooth CS4 Codecs
Adobe Update Manager CS4
Air Video Server 2.4.3
AirPort
AMD Drag and Drop Transcoding
Anvi Smart Defender 1.5
Any Video Converter Professional 2.7.6
APC PowerChute Personal Edition
APC PowerChute Personal Edition 3.0
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft Print Creations
ArcSoft Print Creations - Album Page
ArcSoft Print Creations - Funhouse
ArcSoft Print Creations - Greeting Card
ArcSoft Print Creations - Photo Book
ArcSoft Print Creations - Photo Calendar
ArcSoft Print Creations - Scrapbook
ArcSoft Print Creations - Slimline Card
ATI Catalyst Install Manager
ATI Catalyst Registration
Bing Bar
BlackBerry Desktop Software 6.0
BlackBerry® Media Sync
Bonjour
Browser Address Error Redirector
BS.Player PRO
Catalyst Control Center - Branding
CCleaner
CCScore
Choice Guard
Chromium
Compatibility Pack for the 2007 Office system
Connect
CopyTrans Suite Remove Only
Corel WordPerfect Office - iFilter
Cumulus 1.9.2
CuteFTP 8 Professional
Debug Diagnostics 1.2 32-bit
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Dell Driver Download Manager
Dell Getting Started Guide
Dell Support Center
Digital Line Detect
Dropbox
DU Meter
EASEUS Partition Master 9.0.0 Home Edition
ESET Online Scanner v3
ESSBrwr
ESSCDBK
ESScore
ESSgui
ESSini
ESSPCD
ESSPDock
ESSTOOLS
essvatgt
EVEREST Ultimate Edition v5.02
Fences Pro
fflink
Garmin Communicator Plugin
Garmin Lifetime Updater
Garmin USB Drivers
GoodSync
Google Chrome
Google Chrome Frame
Google Desktop
Google Earth
Google Earth Pro
Google Toolbar for Internet Explorer
Google Update Helper
GoToMyPC
HD Tune 2.55
HijackThis 2.0.2
HP Integrated Module with Bluetooth wireless technology
iCloud
InstallMgr
Intel(R) Matrix Storage Manager
Intel(R) Network Connections 15.2.89.0
Intel(R) Processor ID Utility
Ipswitch WS_FTP Pro
IPView Pro 2.0
iTunes
Java(TM) 6 Update 17
Jawbone Updater
kgcbaby
kgchday
kgchlwn
kgcinvt
kgckids
kgcmove
kgcvday
Kingsoft PC Doctor 3.3.1.9
Kodak EasyShare software
kuler
Licensing Service Install
LogMeIn
Loki ActiveX Control
MagicDisc 2.7.106
Malwarebytes Anti-Malware version 1.62.0.1300
Microsoft .NET Framework 4 Client Profile
Microsoft Corporation
Microsoft Default Manager
Microsoft IntelliPoint 8.2
Microsoft LifeCam
Microsoft Mathematics Add-in (32-bit)
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Groove MUI (English) 2010
Microsoft Office InfoPath MUI (English) 2010
Microsoft Office Live Add-in 1.5
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Professional Plus 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Word MUI (English) 2010
Microsoft Security Client
Microsoft Security Compliance Manager 1.0
Microsoft Security Essentials
Microsoft Silverlight
Microsoft SQL Server 2008
Microsoft SQL Server 2008 Browser
Microsoft SQL Server 2008 Common Files
Microsoft SQL Server 2008 Database Engine Services
Microsoft SQL Server 2008 Database Engine Shared
Microsoft SQL Server 2008 Native Client
Microsoft SQL Server 2008 RsFx Driver
Microsoft SQL Server 2008 Setup Support Files
Microsoft SQL Server VSS Writer
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Microsoft Works
MobileMe Control Panel
Mozilla Firefox 11.0 (x86 en-US)
MSN Toolbar
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Music, Photos & Videos Launcher
netbrdg
NETGEAR XE102 Powerline Encryption Utility
NETGEAR XE104 Powerline Encryption Utility
NetWaiting
NetworkView Version 3.60
Nuance OmniPage 17
Octoshape add-in for Adobe Flash Player
OfotoXMI
OGA Notifier 2.0.0048.0
OpenOffice.org 3.1
Picasa 3
Product Documentation Launcher
QuickTime
RegRun Reanimator
RoboForm 7-7-9-9 (All Users)
Roxio Creator Audio
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE
Roxio Creator Tools
Roxio Express Labeler 3
Roxio Media Manager
Roxio Update Manager
SABnzbd 0.6.10
Safari
Sanmaxi Outlook Password Recovery Trial Version 5.0.1
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft Excel 2010 (KB2597166) 32-Bit Edition
Security Update for Microsoft InfoPath 2010 (KB2553322) 32-Bit Edition
Security Update for Microsoft InfoPath 2010 (KB2553431) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553091)
Security Update for Microsoft Office 2010 (KB2553096)
Security Update for Microsoft Office 2010 (KB2553260) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589322) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2597986) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition
Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition
Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)
Security Update for Microsoft Visio Viewer 2010 (KB2598287) 32-Bit Edition
Service Pack 1 for SQL Server 2008 (KB968369)
Setup Wizard
SetupWizard
SFR
SHASTA
SigmaTel Audio
Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista
SiSoftware Sandra Professional Business 2009.SP3c
skin0001
SKINXSDK
Skype Toolbars
Skype™ 5.10
SlingPlayer
Snagit 10
Sophos Virus Removal Tool
Spybot - Search & Destroy
Sql Server Customer Experience Improvement Program
StarDot Tools 1.5.3
staticcr
Suite Shared Configuration CS4
SUPERAntiSpyware
SysMetrix 3.44
System Requirements Lab for Intel
TeamViewer 6
TerraExplorer
The Lord of the Rings FREE Trial
tooltips
Uniblue DriverScanner 2009
Uniblue PowerSuite 2009
Uniblue RegistryBooster 2009
Uniblue SpeedUpMyPC 2009
Unity Web Player
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553092)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553272) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2598289) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2589345) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
User's Guides
V CAST Music with Rhapsody
ViewSonic Monitor Drivers
Virtual Weather Station
VLC media player 1.0.0
VMware Workstation
VNC Enterprise Edition E4.4.2
VNC Mirror Driver 1.8.0
VPRINTOL
WeatherLink 5.8.3
WebSlingPlayer ActiveX
WePrint
Windows 7 Upgrade Advisor
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0)
Windows Live ID Sign-in Assistant
Windows Live Upload Tool
Windows XP Mode
WinRAR archiver
WinZip 12.1
WIRELESS
WordPerfect Office X4
WordPerfect Office X4 - Common
WordPerfect Office X4 - Content
WordPerfect Office X4 - EN
WordPerfect Office X4 - Filters
WordPerfect Office X4 - Graphics
WordPerfect Office X4 - ICA
WordPerfect Office X4 - IPM
WordPerfect Office X4 - IPM EN
WordPerfect Office X4 - MAIL
WordPerfect Office X4 - Migration Manager
WordPerfect Office X4 - PerfectExperts
WordPerfect Office X4 - PR
WordPerfect Office X4 - QP
WordPerfect Office X4 - Skins
WordPerfect Office X4 - System
WordPerfect Office X4 - WP
World of Warcraft FREE Trial
Xmarks for IE
Xmarks Thumbnails for IE
XPS MiniView Gadget
.
==== End Of File ===========================
 
Welcome aboard
yahooo.gif


Please, observe following rules:
  • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
  • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
  • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
  • Never run more than one scan at a time.
  • Keep updating me regarding your computer behavior, good, or bad.
  • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
  • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
  • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

======================================

I still need Malwarebytes log.

When done with posting that....

Download TDSSKiller and save it to your desktop.
  • Extract (unzip) its contents to your desktop.
  • Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  • If an infected file is detected, the default action will be Cure, click on Continue.
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
 
7:23:18.0608 7556 TDSS rootkit removing tool 2.8.6.0 Aug 13 2012 17:24:05
17:23:19.0113 7556 ============================================================
17:23:19.0113 7556 Current date / time: 2012/08/18 17:23:19.0113
17:23:19.0113 7556 SystemInfo:
17:23:19.0113 7556
17:23:19.0113 7556 OS Version: 6.1.7601 ServicePack: 1.0
17:23:19.0113 7556 Product type: Workstation
17:23:19.0114 7556 ComputerName: REGINALD-PC
17:23:19.0117 7556 UserName: Reginald
17:23:19.0117 7556 Windows directory: C:\Windows
17:23:19.0117 7556 System windows directory: C:\Windows
17:23:19.0117 7556 Processor architecture: Intel x86
17:23:19.0117 7556 Number of processors: 4
17:23:19.0117 7556 Page size: 0x1000
17:23:19.0117 7556 Boot type: Normal boot
17:23:19.0117 7556 ============================================================
17:23:19.0998 7556 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
17:23:20.0370 7556 Drive \Device\Harddisk3\DR3 - Size: 0x1D500000 (0.46 Gb), SectorSize: 0x200, Cylinders: 0x3B, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
17:23:20.0391 7556 Drive \Device\Harddisk5\DR5 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
17:23:20.0415 7556 ============================================================
17:23:20.0415 7556 \Device\Harddisk0\DR0:
17:23:20.0415 7556 MBR partitions:
17:23:20.0415 7556 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x18000, BlocksNum 0x1E00000
17:23:20.0415 7556 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1E18000, BlocksNum 0x23616000
17:23:20.0415 7556 \Device\Harddisk3\DR3:
17:23:20.0417 7556 MBR partitions:
17:23:20.0417 7556 \Device\Harddisk3\DR3\Partition1: MBR, Type 0x6, StartLBA 0x1E9, BlocksNum 0xEA217
17:23:20.0417 7556 \Device\Harddisk5\DR5:
17:23:20.0418 7556 MBR partitions:
17:23:20.0418 7556 \Device\Harddisk5\DR5\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x950A5C1
17:23:20.0418 7556 ============================================================
17:23:20.0449 7556 C: <-> \Device\Harddisk0\DR0\Partition2
17:23:20.0481 7556 D: <-> \Device\Harddisk0\DR0\Partition1
17:23:20.0496 7556 K: <-> \Device\Harddisk5\DR5\Partition1
17:23:20.0496 7556 ============================================================
17:23:20.0496 7556 Initialize success
17:23:20.0496 7556 ============================================================
17:28:17.0454 9480 ============================================================
17:28:17.0454 9480 Scan started
17:28:17.0454 9480 Mode: Manual;
17:28:17.0454 9480 ============================================================
17:28:19.0294 9480 ================ Scan services =============================
17:28:19.0400 9480 [ c0393eb99a6c72c6bef9bfc4a72b33a6 ] !SASCORE C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
17:28:19.0402 9480 !SASCORE - ok
17:28:19.0833 9480 [ 1b133875b8aa8ac48969bd3458afe9f5 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
17:28:19.0858 9480 1394ohci - ok
17:28:20.0007 9480 [ adc420616c501b45d26c0fd3ef1e54e4 ] ACDaemon C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
17:28:20.0019 9480 ACDaemon - ok
17:28:20.0083 9480 [ cea80c80bed809aa0da6febc04733349 ] ACPI C:\Windows\system32\drivers\ACPI.sys
17:28:20.0088 9480 ACPI - ok
17:28:20.0127 9480 [ 1efbc664abff416d1d07db115dcb264f ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
17:28:20.0128 9480 AcpiPmi - ok
17:28:20.0293 9480 [ 42cbe4c6a7af1d590cf4125918dfae62 ] AcrSch2Svc C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
17:28:20.0313 9480 AcrSch2Svc - ok
17:28:21.0208 9480 [ b62597678a02da3a05e586d744fcbc62 ] ACTIVEWEBCAM C:\Program Files\Active WebCam\WebCam.exe
17:28:21.0369 9480 ACTIVEWEBCAM - ok
17:28:21.0447 9480 [ 7fd05b030830eaa194dd62f24f4d1be8 ] ACTIVEWEBCAMWATCHDOG C:\Program Files\Active WebCam\Watchdog.exe
17:28:21.0457 9480 ACTIVEWEBCAMWATCHDOG - ok
17:28:21.0570 9480 [ a9d3b95e8466bd58eeb8a1154654e162 ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
17:28:21.0571 9480 AdobeFlashPlayerUpdateSvc - ok
17:28:21.0639 9480 [ 21e785ebd7dc90a06391141aac7892fb ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
17:28:21.0647 9480 adp94xx - ok
17:28:21.0676 9480 [ 0c676bc278d5b59ff5abd57bbe9123f2 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
17:28:21.0687 9480 adpahci - ok
17:28:21.0705 9480 [ 7c7b5ee4b7b822ec85321fe23a27db33 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
17:28:21.0708 9480 adpu320 - ok
17:28:21.0748 9480 [ 8b5eefeec1e6d1a72a06c526628ad161 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
17:28:21.0760 9480 AeLookupSvc - ok
17:28:21.0809 9480 [ a27deeebf1b17a053aea3e2f1d6f9295 ] afcdp C:\Windows\system32\DRIVERS\afcdp.sys
17:28:21.0813 9480 afcdp - ok
17:28:22.0014 9480 [ 149e8ca66ceade0d17ac4028a567499f ] afcdpsrv C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
17:28:22.0197 9480 afcdpsrv - ok
17:28:22.0252 9480 [ 9ebbba55060f786f0fcaa3893bfa2806 ] AFD C:\Windows\system32\drivers\afd.sys
17:28:22.0258 9480 AFD - ok
17:28:22.0301 9480 [ 507812c3054c21cef746b6ee3d04dd6e ] agp440 C:\Windows\system32\drivers\agp440.sys
17:28:22.0307 9480 agp440 - ok
17:28:22.0365 9480 [ 8b30250d573a8f6b4bd23195160d8707 ] aic78xx C:\Windows\system32\DRIVERS\djsvs.sys
17:28:22.0367 9480 aic78xx - ok
17:28:22.0420 9480 [ 18a54e132947cd98fea9accc57f98f13 ] ALG C:\Windows\System32\alg.exe
17:28:22.0422 9480 ALG - ok
17:28:22.0463 9480 [ 0d40bcf52ea90fc7df2aeab6503dea44 ] aliide C:\Windows\system32\drivers\aliide.sys
17:28:22.0465 9480 aliide - ok
17:28:22.0524 9480 [ 5320ff0fdec41faf9d5cb01318aefd6a ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
17:28:22.0527 9480 AMD External Events Utility - ok
17:28:22.0558 9480 [ 3c6600a0696e90a463771c7422e23ab5 ] amdagp C:\Windows\system32\drivers\amdagp.sys
17:28:22.0574 9480 amdagp - ok
17:28:22.0594 9480 [ cd5914170297126b6266860198d1d4f0 ] amdide C:\Windows\system32\drivers\amdide.sys
17:28:22.0596 9480 amdide - ok
17:28:22.0639 9480 [ 00dda200d71bac534bf56a9db5dfd666 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
17:28:22.0641 9480 AmdK8 - ok
17:28:22.0978 9480 [ 335ace2a8e97439733f0f6a1bbd818d5 ] amdkmdag C:\Windows\system32\DRIVERS\atikmdag.sys
17:28:23.0157 9480 amdkmdag - ok
17:28:23.0188 9480 [ 0b1b116d30f133dc918287fd8e212f1e ] amdkmdap C:\Windows\system32\DRIVERS\atikmpag.sys
17:28:23.0192 9480 amdkmdap - ok
17:28:23.0217 9480 [ 3cbf30f5370fda40dd3e87df38ea53b6 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
17:28:23.0220 9480 AmdPPM - ok
17:28:23.0276 9480 [ d320bf87125326f996d4904fe24300fc ] amdsata C:\Windows\system32\drivers\amdsata.sys
17:28:23.0278 9480 amdsata - ok
17:28:23.0318 9480 [ ea43af0c423ff267355f74e7a53bdaba ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
17:28:23.0322 9480 amdsbs - ok
17:28:23.0339 9480 [ 46387fb17b086d16dea267d5be23a2f2 ] amdxata C:\Windows\system32\drivers\amdxata.sys
17:28:23.0341 9480 amdxata - ok
17:28:23.0437 9480 [ 378a326ba649e01aac767355aab9e90c ] APC Data Service C:\Program Files\APC\APC PowerChute Personal Edition\dataserv.exe
17:28:23.0438 9480 APC Data Service - ok
17:28:23.0497 9480 [ 84a1a403d2dd63ef941674cc87ff503c ] APC UPS Service C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
17:28:23.0538 9480 APC UPS Service - ok
17:28:23.0596 9480 [ aea177f783e20150ace5383ee368da19 ] AppID C:\Windows\system32\drivers\appid.sys
17:28:23.0607 9480 AppID - ok
17:28:23.0636 9480 [ 62a9c86cb6085e20db4823e4e97826f5 ] AppIDSvc C:\Windows\System32\appidsvc.dll
17:28:23.0637 9480 AppIDSvc - ok
17:28:23.0695 9480 [ fb1959012294d6ad43e5304df65e3c26 ] Appinfo C:\Windows\System32\appinfo.dll
17:28:23.0706 9480 Appinfo - ok
17:28:23.0769 9480 [ 7ef47644b74ebe721cc32211d3c35e76 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
17:28:23.0771 9480 Apple Mobile Device - ok
17:28:23.0827 9480 [ a45d184df6a8803da13a0b329517a64a ] AppMgmt C:\Windows\System32\appmgmts.dll
17:28:23.0830 9480 AppMgmt - ok
17:28:23.0884 9480 [ 2932004f49677bd84dbc72edb754ffb3 ] arc C:\Windows\system32\DRIVERS\arc.sys
17:28:23.0886 9480 arc - ok
17:28:23.0905 9480 [ 5d6f36c46fd283ae1b57bd2e9feb0bc7 ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
17:28:23.0908 9480 arcsas - ok
17:28:24.0095 9480 [ 16cde6977cc88433bf3767c4d42b22d3 ] asdrm C:\Windows\system32\DRIVERS\asdrm.sys
17:28:24.0097 9480 asdrm - ok
17:28:24.0137 9480 [ 3e62e3122e534254dd314fa8a7b6bf48 ] asdrs C:\Windows\system32\DRIVERS\asdrs.sys
17:28:24.0139 9480 asdrs - ok
17:28:24.0309 9480 [ 197eb3cde17b18c78e1b5324d2e0a451 ] asdsrv C:\Program Files\Anvisoft\Anvi Smart Defender\ASDSrv.exe
17:28:24.0318 9480 asdsrv - ok
17:28:24.0349 9480 [ 9afcf85708576f3ef6fb868b6c604c01 ] asdws C:\Windows\system32\DRIVERS\asdws.sys
17:28:24.0350 9480 asdws - ok
17:28:24.0385 9480 [ add2ade1c2b285ab8378d2daaf991481 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
17:28:24.0387 9480 AsyncMac - ok
17:28:24.0456 9480 [ 338c86357871c167a96ab976519bf59e ] atapi C:\Windows\system32\drivers\atapi.sys
17:28:24.0458 9480 atapi - ok
17:28:24.0789 9480 [ 335ace2a8e97439733f0f6a1bbd818d5 ] atikmdag C:\Windows\system32\DRIVERS\atikmdag.sys
17:28:24.0837 9480 atikmdag - ok
17:28:24.0906 9480 [ ce3b4e731638d2ef62fcb419be0d39f0 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
17:28:24.0949 9480 AudioEndpointBuilder - ok
17:28:24.0962 9480 [ ce3b4e731638d2ef62fcb419be0d39f0 ] Audiosrv C:\Windows\System32\Audiosrv.dll
17:28:24.0964 9480 Audiosrv - ok
17:28:25.0015 9480 [ 6e30d02aac9cac84f421622e3a2f6178 ] AxInstSV C:\Windows\System32\AxInstSV.dll
17:28:25.0018 9480 AxInstSV - ok
17:28:25.0077 9480 [ 1a231abec60fd316ec54c66715543cec ] b06bdrv C:\Windows\system32\DRIVERS\bxvbdx.sys
17:28:25.0092 9480 b06bdrv - ok

Current MBAM log:
alwarebytes Anti-Malware (PRO) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.08.18.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Reginald :: REGINALD-PC [administrator]

Protection: Disabled

8/18/2012 5:33:48 PM
mbam-log-2012-08-18 (17-33-48).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 243583
Time elapsed: 17 minute(s), 27 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
 
[FONT=Courier New]18:46:28.0837 8236 TDSS rootkit removing tool 2.8.6.0 Aug 13 2012 17:24:05[/FONT]
[FONT=Courier New]18:46:29.0351 8236 ============================================================[/FONT]
[FONT=Courier New]18:46:29.0351 8236 Current date / time: 2012/08/18 18:46:29.0351[/FONT]
[FONT=Courier New]18:46:29.0351 8236 SystemInfo:[/FONT]
[FONT=Courier New]18:46:29.0351 8236 [/FONT]
[FONT=Courier New]18:46:29.0351 8236 OS Version: 6.1.7601 ServicePack: 1.0[/FONT]
[FONT=Courier New]18:46:29.0351 8236 Product type: Workstation[/FONT]
[FONT=Courier New]18:46:29.0351 8236 ComputerName: REGINALD-PC[/FONT]
[FONT=Courier New]18:46:29.0355 8236 UserName: Reginald[/FONT]
[FONT=Courier New]18:46:29.0355 8236 Windows directory: C:\Windows[/FONT]
[FONT=Courier New]18:46:29.0355 8236 System windows directory: C:\Windows[/FONT]
[FONT=Courier New]18:46:29.0355 8236 Processor architecture: Intel x86[/FONT]
[FONT=Courier New]18:46:29.0355 8236 Number of processors: 4[/FONT]
[FONT=Courier New]18:46:29.0355 8236 Page size: 0x1000[/FONT]
[FONT=Courier New]18:46:29.0355 8236 Boot type: Normal boot[/FONT]
[FONT=Courier New]18:46:29.0355 8236 ============================================================[/FONT]
[FONT=Courier New]18:46:30.0693 8236 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050[/FONT]
[FONT=Courier New]18:46:30.0982 8236 Drive \Device\Harddisk3\DR3 - Size: 0x1D500000 (0.46 Gb), SectorSize: 0x200, Cylinders: 0x3B, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'[/FONT]
[FONT=Courier New]18:46:31.0865 8236 Drive \Device\Harddisk5\DR5 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'[/FONT]
[FONT=Courier New]18:46:31.0890 8236 ============================================================[/FONT]
[FONT=Courier New]18:46:31.0890 8236 \Device\Harddisk0\DR0:[/FONT]
[FONT=Courier New]18:46:31.0909 8236 MBR partitions:[/FONT]
[FONT=Courier New]18:46:31.0909 8236 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x18000, BlocksNum 0x1E00000[/FONT]
[FONT=Courier New]18:46:31.0909 8236 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1E18000, BlocksNum 0x23616000[/FONT]
[FONT=Courier New]18:46:31.0909 8236 \Device\Harddisk3\DR3:[/FONT]
[FONT=Courier New]18:46:31.0911 8236 MBR partitions:[/FONT]
[FONT=Courier New]18:46:31.0911 8236 \Device\Harddisk3\DR3\Partition1: MBR, Type 0x6, StartLBA 0x1E9, BlocksNum 0xEA217[/FONT]
[FONT=Courier New]18:46:31.0911 8236 \Device\Harddisk5\DR5:[/FONT]
[FONT=Courier New]18:46:31.0912 8236 MBR partitions:[/FONT]
[FONT=Courier New]18:46:31.0912 8236 \Device\Harddisk5\DR5\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x950A5C1[/FONT]
[FONT=Courier New]18:46:31.0912 8236 ============================================================[/FONT]
[FONT=Courier New]18:46:31.0952 8236 C: <-> \Device\Harddisk0\DR0\Partition2[/FONT]
[FONT=Courier New]18:46:31.0984 8236 D: <-> \Device\Harddisk0\DR0\Partition1[/FONT]
[FONT=Courier New]18:46:31.0988 8236 K: <-> \Device\Harddisk5\DR5\Partition1[/FONT]
[FONT=Courier New]18:46:31.0988 8236 ============================================================[/FONT]
[FONT=Courier New]18:46:31.0988 8236 Initialize success[/FONT]
[FONT=Courier New]18:46:31.0988 8236 ============================================================[/FONT]
[FONT=Courier New]18:46:33.0768 7744 ============================================================[/FONT]
[FONT=Courier New]18:46:33.0768 7744 Scan started[/FONT]
[FONT=Courier New]18:46:33.0768 7744 Mode: Manual; [/FONT]
[FONT=Courier New]18:46:33.0768 7744 ============================================================[/FONT]
[FONT=Courier New]18:46:33.0978 7744 ================ Scan services =============================[/FONT]
[FONT=Courier New]18:46:34.0093 7744 [ c0393eb99a6c72c6bef9bfc4a72b33a6 ] !SASCORE C:\Program Files\SUPERAntiSpyware\SASCORE.EXE[/FONT]
[FONT=Courier New]18:46:34.0095 7744 !SASCORE - ok[/FONT]
[FONT=Courier New]18:46:34.0318 7744 [ 1b133875b8aa8ac48969bd3458afe9f5 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys[/FONT]
[FONT=Courier New]18:46:34.0320 7744 1394ohci - ok[/FONT]
[FONT=Courier New]18:46:34.0425 7744 [ adc420616c501b45d26c0fd3ef1e54e4 ] ACDaemon C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[/FONT]
[FONT=Courier New]18:46:34.0427 7744 ACDaemon - ok[/FONT]
[FONT=Courier New]18:46:34.0484 7744 [ cea80c80bed809aa0da6febc04733349 ] ACPI C:\Windows\system32\drivers\ACPI.sys[/FONT]
[FONT=Courier New]18:46:34.0489 7744 ACPI - ok[/FONT]
[FONT=Courier New]18:46:34.0529 7744 [ 1efbc664abff416d1d07db115dcb264f ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys[/FONT]
[FONT=Courier New]18:46:34.0530 7744 AcpiPmi - ok[/FONT]
[FONT=Courier New]18:46:34.0628 7744 [ 42cbe4c6a7af1d590cf4125918dfae62 ] AcrSch2Svc C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe[/FONT]
[FONT=Courier New]18:46:34.0633 7744 AcrSch2Svc - ok[/FONT]
[FONT=Courier New]18:46:34.0799 7744 [ b62597678a02da3a05e586d744fcbc62 ] ACTIVEWEBCAM C:\Program Files\Active WebCam\WebCam.exe[/FONT]
[FONT=Courier New]18:46:34.0891 7744 ACTIVEWEBCAM - ok[/FONT]
[FONT=Courier New]18:46:34.0958 7744 [ 7fd05b030830eaa194dd62f24f4d1be8 ] ACTIVEWEBCAMWATCHDOG C:\Program Files\Active WebCam\Watchdog.exe[/FONT]
[FONT=Courier New]18:46:34.0966 7744 ACTIVEWEBCAMWATCHDOG - ok[/FONT]
[FONT=Courier New]18:46:35.0038 7744 [ a9d3b95e8466bd58eeb8a1154654e162 ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe[/FONT]
[FONT=Courier New]18:46:35.0040 7744 AdobeFlashPlayerUpdateSvc - ok[/FONT]
[FONT=Courier New]18:46:35.0108 7744 [ 21e785ebd7dc90a06391141aac7892fb ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys[/FONT]
[FONT=Courier New]18:46:35.0113 7744 adp94xx - ok[/FONT]
[FONT=Courier New]18:46:35.0137 7744 [ 0c676bc278d5b59ff5abd57bbe9123f2 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys[/FONT]
[FONT=Courier New]18:46:35.0141 7744 adpahci - ok[/FONT]
[FONT=Courier New]18:46:35.0174 7744 [ 7c7b5ee4b7b822ec85321fe23a27db33 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys[/FONT]
[FONT=Courier New]18:46:35.0176 7744 adpu320 - ok[/FONT]
[FONT=Courier New]18:46:35.0225 7744 [ 8b5eefeec1e6d1a72a06c526628ad161 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll[/FONT]
[FONT=Courier New]18:46:35.0232 7744 AeLookupSvc - ok[/FONT]
[FONT=Courier New]18:46:35.0278 7744 [ a27deeebf1b17a053aea3e2f1d6f9295 ] afcdp C:\Windows\system32\DRIVERS\afcdp.sys[/FONT]
[FONT=Courier New]18:46:35.0281 7744 afcdp - ok[/FONT]
[FONT=Courier New]18:46:35.0430 7744 [ 149e8ca66ceade0d17ac4028a567499f ] afcdpsrv C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe[/FONT]
[FONT=Courier New]18:46:35.0588 7744 afcdpsrv - ok[/FONT]
[FONT=Courier New]18:46:35.0662 7744 [ 9ebbba55060f786f0fcaa3893bfa2806 ] AFD C:\Windows\system32\drivers\afd.sys[/FONT]
[FONT=Courier New]18:46:35.0667 7744 AFD - ok[/FONT]
[FONT=Courier New]18:46:35.0704 7744 [ 507812c3054c21cef746b6ee3d04dd6e ] agp440 C:\Windows\system32\drivers\agp440.sys[/FONT]
[FONT=Courier New]18:46:35.0706 7744 agp440 - ok[/FONT]
[FONT=Courier New]18:46:35.0759 7744 [ 8b30250d573a8f6b4bd23195160d8707 ] aic78xx C:\Windows\system32\DRIVERS\djsvs.sys[/FONT]
[FONT=Courier New]18:46:35.0761 7744 aic78xx - ok[/FONT]
[FONT=Courier New]18:46:35.0806 7744 [ 18a54e132947cd98fea9accc57f98f13 ] ALG C:\Windows\System32\alg.exe[/FONT]
[FONT=Courier New]18:46:35.0808 7744 ALG - ok[/FONT]
[FONT=Courier New]18:46:35.0849 7744 [ 0d40bcf52ea90fc7df2aeab6503dea44 ] aliide C:\Windows\system32\drivers\aliide.sys[/FONT]
[FONT=Courier New]18:46:35.0850 7744 aliide - ok[/FONT]
[FONT=Courier New]18:46:35.0909 7744 [ 5320ff0fdec41faf9d5cb01318aefd6a ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe[/FONT]
[FONT=Courier New]18:46:35.0912 7744 AMD External Events Utility - ok[/FONT]
[FONT=Courier New]18:46:35.0936 7744 [ 3c6600a0696e90a463771c7422e23ab5 ] amdagp C:\Windows\system32\drivers\amdagp.sys[/FONT]
[FONT=Courier New]18:46:35.0938 7744 amdagp - ok[/FONT]
[FONT=Courier New]18:46:35.0997 7744 [ cd5914170297126b6266860198d1d4f0 ] amdide C:\Windows\system32\drivers\amdide.sys[/FONT]
[FONT=Courier New]18:46:36.0011 7744 amdide - ok[/FONT]
[FONT=Courier New]18:46:36.0050 7744 [ 00dda200d71bac534bf56a9db5dfd666 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys[/FONT]
[FONT=Courier New]18:46:36.0052 7744 AmdK8 - ok[/FONT]
[FONT=Courier New]18:46:36.0319 7744 [ 335ace2a8e97439733f0f6a1bbd818d5 ] amdkmdag C:\Windows\system32\DRIVERS\atikmdag.sys[/FONT]
[FONT=Courier New]18:46:36.0486 7744 amdkmdag - ok[/FONT]
[FONT=Courier New]18:46:36.0540 7744 [ 0b1b116d30f133dc918287fd8e212f1e ] amdkmdap C:\Windows\system32\DRIVERS\atikmpag.sys[/FONT]
[FONT=Courier New]18:46:36.0551 7744 amdkmdap - ok[/FONT]
[FONT=Courier New]18:46:36.0586 7744 [ 3cbf30f5370fda40dd3e87df38ea53b6 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys[/FONT]
[FONT=Courier New]18:46:36.0598 7744 AmdPPM - ok[/FONT]
[FONT=Courier New]18:46:36.0678 7744 [ d320bf87125326f996d4904fe24300fc ] amdsata C:\Windows\system32\drivers\amdsata.sys[/FONT]
[FONT=Courier New]18:46:36.0680 7744 amdsata - ok[/FONT]
[FONT=Courier New]18:46:36.0738 7744 [ ea43af0c423ff267355f74e7a53bdaba ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys[/FONT]
[FONT=Courier New]18:46:36.0740 7744 amdsbs - ok[/FONT]
[FONT=Courier New]18:46:36.0767 7744 [ 46387fb17b086d16dea267d5be23a2f2 ] amdxata C:\Windows\system32\drivers\amdxata.sys[/FONT]
[FONT=Courier New]18:46:36.0770 7744 amdxata - ok[/FONT]
[FONT=Courier New]18:46:36.0940 7744 [ 378a326ba649e01aac767355aab9e90c ] APC Data Service C:\Program Files\APC\APC PowerChute Personal Edition\dataserv.exe[/FONT]
[FONT=Courier New]18:46:36.0949 7744 APC Data Service - ok[/FONT]
[FONT=Courier New]18:46:37.0091 7744 [ 84a1a403d2dd63ef941674cc87ff503c ] APC UPS Service C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe[/FONT]
[FONT=Courier New]18:46:37.0117 7744 APC UPS Service - ok[/FONT]
[FONT=Courier New]18:46:37.0216 7744 [ aea177f783e20150ace5383ee368da19 ] AppID C:\Windows\system32\drivers\appid.sys[/FONT]
[FONT=Courier New]18:46:37.0224 7744 AppID - ok[/FONT]
[FONT=Courier New]18:46:37.0331 7744 [ 62a9c86cb6085e20db4823e4e97826f5 ] AppIDSvc C:\Windows\System32\appidsvc.dll[/FONT]
[FONT=Courier New]18:46:37.0343 7744 AppIDSvc - ok[/FONT]
[FONT=Courier New]18:46:37.0481 7744 [ fb1959012294d6ad43e5304df65e3c26 ] Appinfo C:\Windows\System32\appinfo.dll[/FONT]
[FONT=Courier New]18:46:37.0493 7744 Appinfo - ok[/FONT]
[FONT=Courier New]18:46:37.0722 7744 [ 7ef47644b74ebe721cc32211d3c35e76 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[/FONT]
[FONT=Courier New]18:46:37.0732 7744 Apple Mobile Device - ok[/FONT]
[FONT=Courier New]18:46:38.0047 7744 [ a45d184df6a8803da13a0b329517a64a ] AppMgmt C:\Windows\System32\appmgmts.dll[/FONT]
[FONT=Courier New]18:46:38.0080 7744 AppMgmt - ok[/FONT]
[FONT=Courier New]18:46:38.0178 7744 [ 2932004f49677bd84dbc72edb754ffb3 ] arc C:\Windows\system32\DRIVERS\arc.sys[/FONT]
[FONT=Courier New]18:46:38.0189 7744 arc - ok[/FONT]
[FONT=Courier New]18:46:38.0225 7744 [ 5d6f36c46fd283ae1b57bd2e9feb0bc7 ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys[/FONT]
[FONT=Courier New]18:46:38.0237 7744 arcsas - ok[/FONT]
[FONT=Courier New]18:46:38.0323 7744 [ 16cde6977cc88433bf3767c4d42b22d3 ] asdrm C:\Windows\system32\DRIVERS\asdrm.sys[/FONT]
[FONT=Courier New]18:46:38.0332 7744 asdrm - ok[/FONT]
[FONT=Courier New]18:46:38.0381 7744 [ 3e62e3122e534254dd314fa8a7b6bf48 ] asdrs C:\Windows\system32\DRIVERS\asdrs.sys[/FONT]
[FONT=Courier New]18:46:38.0395 7744 asdrs - ok[/FONT]
[FONT=Courier New]18:46:38.0628 7744 [ 197eb3cde17b18c78e1b5324d2e0a451 ] asdsrv C:\Program Files\Anvisoft\Anvi Smart Defender\ASDSrv.exe[/FONT]
[FONT=Courier New]18:46:38.0677 7744 asdsrv - ok[/FONT]
[FONT=Courier New]18:46:38.0735 7744 [ 9afcf85708576f3ef6fb868b6c604c01 ] asdws C:\Windows\system32\DRIVERS\asdws.sys[/FONT]
[FONT=Courier New]18:46:38.0738 7744 asdws - ok[/FONT]
[FONT=Courier New]18:46:38.0780 7744 [ add2ade1c2b285ab8378d2daaf991481 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys[/FONT]
[FONT=Courier New]18:46:38.0785 7744 AsyncMac - ok[/FONT]
[FONT=Courier New]18:46:39.0125 7744 [ 338c86357871c167a96ab976519bf59e ] atapi C:\Windows\system32\drivers\atapi.sys[/FONT]
[FONT=Courier New]18:46:39.0138 7744 atapi - ok[/FONT]
[FONT=Courier New]18:46:39.0751 7744 [ 335ace2a8e97439733f0f6a1bbd818d5 ] atikmdag C:\Windows\system32\DRIVERS\atikmdag.sys[/FONT]
[FONT=Courier New]18:46:39.0796 7744 atikmdag - ok[/FONT]
[FONT=Courier New]18:46:39.0867 7744 [ ce3b4e731638d2ef62fcb419be0d39f0 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll[/FONT]
[FONT=Courier New]18:46:39.0873 7744 AudioEndpointBuilder - ok[/FONT]
[FONT=Courier New]18:46:39.0883 7744 [ ce3b4e731638d2ef62fcb419be0d39f0 ] Audiosrv C:\Windows\System32\Audiosrv.dll[/FONT]
[FONT=Courier New]18:46:39.0886 7744 Audiosrv - ok[/FONT]
[FONT=Courier New]18:46:39.0959 7744 [ 6e30d02aac9cac84f421622e3a2f6178 ] AxInstSV C:\Windows\System32\AxInstSV.dll[/FONT]
[FONT=Courier New]18:46:39.0961 7744 AxInstSV - ok[/FONT]
[FONT=Courier New]18:46:40.0045 7744 [ 1a231abec60fd316ec54c66715543cec ] b06bdrv C:\Windows\system32\DRIVERS\bxvbdx.sys[/FONT]
[FONT=Courier New]18:46:40.0064 7744 b06bdrv - ok[/FONT]
[FONT=Courier New]18:46:40.0085 7744 [ bd8869eb9cde6bbe4508d869929869ee ] b57nd60x C:\Windows\system32\DRIVERS\b57nd60x.sys[/FONT]
[FONT=Courier New]18:46:40.0089 7744 b57nd60x - ok[/FONT]
[FONT=Courier New]18:46:40.0209 7744 [ 2ed050291bc1d7f9e322e328db3aaecf ] BBSvc C:\Program Files\Microsoft\BingBar\BBSvc.EXE[/FONT]
[FONT=Courier New]18:46:40.0211 7744 BBSvc - ok[/FONT]
[FONT=Courier New]18:46:40.0238 7744 [ 785de7abda13309d6065305542829e76 ] BBUpdate C:\Program Files\Microsoft\BingBar\SeaPort.EXE[/FONT]
[FONT=Courier New]18:46:40.0241 7744 BBUpdate - ok[/FONT]
[FONT=Courier New]18:46:40.0278 7744 [ ee1e9c3bb8228ae423dd38db69128e71 ] BDESVC C:\Windows\System32\bdesvc.dll[/FONT]
[FONT=Courier New]18:46:40.0280 7744 BDESVC - ok[/FONT]
[FONT=Courier New]18:46:40.0321 7744 [ 505506526a9d467307b3c393dedaf858 ] Beep C:\Windows\system32\drivers\Beep.sys[/FONT]
[FONT=Courier New]18:46:40.0322 7744 Beep - ok[/FONT]
[FONT=Courier New]18:46:40.0409 7744 [ 1e2bac209d184bb851e1a187d8a29136 ] BFE C:\Windows\System32\bfe.dll[/FONT]
[FONT=Courier New]18:46:40.0416 7744 BFE - ok[/FONT]
[FONT=Courier New]18:46:40.0482 7744 [ e585445d5021971fae10393f0f1c3961 ] BITS C:\Windows\system32\qmgr.dll[/FONT]
[FONT=Courier New]18:46:40.0492 7744 BITS - ok[/FONT]
[FONT=Courier New]18:46:40.0528 7744 [ 2287078ed48fcfc477b05b20cf38f36f ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys[/FONT]
[FONT=Courier New]18:46:40.0529 7744 blbdrive - ok[/FONT]
[FONT=Courier New]18:46:40.0642 7744 [ db5bea73edaf19ac68b2c0fad0f92b1a ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe[/FONT]
[FONT=Courier New]18:46:40.0659 7744 Bonjour Service - ok[/FONT]
[FONT=Courier New]18:46:40.0717 7744 [ 8f2da3028d5fcbd1a060a3de64cd6506 ] bowser C:\Windows\system32\DRIVERS\bowser.sys[/FONT]
[FONT=Courier New]18:46:40.0719 7744 bowser - ok[/FONT]
[FONT=Courier New]18:46:40.0734 7744 [ 9f9acc7f7ccde8a15c282d3f88b43309 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys[/FONT]
[FONT=Courier New]18:46:40.0735 7744 BrFiltLo - ok[/FONT]
[FONT=Courier New]18:46:40.0752 7744 [ 56801ad62213a41f6497f96dee83755a ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys[/FONT]
[FONT=Courier New]18:46:40.0754 7744 BrFiltUp - ok[/FONT]
[FONT=Courier New]18:46:40.0805 7744 [ 77361d72a04f18809d0efb6cceb74d4b ] BridgeMP C:\Windows\system32\DRIVERS\bridge.sys[/FONT]
[FONT=Courier New]18:46:40.0807 7744 BridgeMP - ok[/FONT]
[FONT=Courier New]18:46:40.0856 7744 [ 3daa727b5b0a45039b0e1c9a211b8400 ] Browser C:\Windows\System32\browser.dll[/FONT]
[FONT=Courier New]18:46:40.0863 7744 Browser - ok[/FONT]
[FONT=Courier New]18:46:40.0882 7744 [ 845b8ce732e67f3b4133164868c666ea ] Brserid C:\Windows\System32\Drivers\Brserid.sys[/FONT]
[FONT=Courier New]18:46:40.0886 7744 Brserid - ok[/FONT]
[FONT=Courier New]18:46:40.0905 7744 [ 203f0b1e73adadbbb7b7b1fabd901f6b ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys[/FONT]
[FONT=Courier New]18:46:40.0907 7744 BrSerWdm - ok[/FONT]
[FONT=Courier New]18:46:40.0918 7744 [ bd456606156ba17e60a04e18016ae54b ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys[/FONT]
[FONT=Courier New]18:46:40.0919 7744 BrUsbMdm - ok[/FONT]
[FONT=Courier New]18:46:40.0932 7744 [ af72ed54503f717a43268b3cc5faec2e ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys[/FONT]
[FONT=Courier New]18:46:40.0934 7744 BrUsbSer - ok[/FONT]
[FONT=Courier New]18:46:40.0977 7744 [ 2865a5c8e98c70c605f417908cebb3a4 ] BthEnum C:\Windows\system32\drivers\BthEnum.sys[/FONT]
[FONT=Courier New]18:46:40.0978 7744 BthEnum - ok[/FONT]
[FONT=Courier New]18:46:40.0998 7744 [ ed3df7c56ce0084eb2034432fc56565a ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys[/FONT]
[FONT=Courier New]18:46:41.0000 7744 BTHMODEM - ok[/FONT]
[FONT=Courier New]18:46:41.0036 7744 [ ad1872e5829e8a2c3b5b4b641c3eab0e ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys[/FONT]
[FONT=Courier New]18:46:41.0038 7744 BthPan - ok[/FONT]
[FONT=Courier New]18:46:41.0129 7744 [ 1153de2e4f5941e10c399cb5592f78a1 ] BTHPORT C:\Windows\system32\Drivers\BTHport.sys[/FONT]
[FONT=Courier New]18:46:41.0146 7744 BTHPORT - ok[/FONT]
[FONT=Courier New]18:46:41.0199 7744 [ 1df19c96eef6c29d1c3e1a8678e07190 ] bthserv C:\Windows\system32\bthserv.dll[/FONT]
[FONT=Courier New]18:46:41.0201 7744 bthserv - ok[/FONT]
[FONT=Courier New]18:46:41.0216 7744 [ c81e9413a25a439f436b1d4b6a0cf9e9 ] BTHUSB C:\Windows\system32\Drivers\BTHUSB.sys[/FONT]
[FONT=Courier New]18:46:41.0218 7744 BTHUSB - ok[/FONT]
[FONT=Courier New]18:46:41.0268 7744 [ f549c3fb145a4928e40bb1518b2034dc ] btusbflt C:\Windows\system32\drivers\btusbflt.sys[/FONT]
[FONT=Courier New]18:46:41.0270 7744 btusbflt - ok[/FONT]
[FONT=Courier New]18:46:41.0316 7744 [ f97a9c093e79bf117d9f26f2d31dca5e ] btwaudio C:\Windows\system32\drivers\btwaudio.sys[/FONT]
[FONT=Courier New]18:46:41.0317 7744 btwaudio - ok[/FONT]
[FONT=Courier New]18:46:41.0373 7744 [ 143c4c1ee6d131eca8b4ab5f80b3f910 ] btwavdt C:\Windows\system32\DRIVERS\btwavdt.sys[/FONT]
[FONT=Courier New]18:46:41.0376 7744 btwavdt - ok[/FONT]
[FONT=Courier New]18:46:41.0453 7744 [ b6c870ee321aa8678198ea003dcfbb02 ] btwdins C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[/FONT]
[FONT=Courier New]18:46:41.0460 7744 btwdins - ok[/FONT]
[FONT=Courier New]18:46:41.0507 7744 [ aafd7cb76ba61fbb08e302da208c974a ] btwl2cap C:\Windows\system32\DRIVERS\btwl2cap.sys[/FONT]
[FONT=Courier New]18:46:41.0508 7744 btwl2cap - ok[/FONT]
[FONT=Courier New]18:46:41.0522 7744 [ 97cf6c5d3b443344497f1f53e5d0ed50 ] btwrchid C:\Windows\system32\DRIVERS\btwrchid.sys[/FONT]
[FONT=Courier New]18:46:41.0524 7744 btwrchid - ok[/FONT]
[FONT=Courier New]18:46:41.0698 7744 catchme - ok[/FONT]
[FONT=Courier New]18:46:41.0735 7744 [ 77ea11b065e0a8ab902d78145ca51e10 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys[/FONT]
[FONT=Courier New]18:46:41.0737 7744 cdfs - ok[/FONT]
[FONT=Courier New]18:46:41.0778 7744 [ be167ed0fdb9c1fa1133953c18d5a6c9 ] cdrom C:\Windows\system32\drivers\cdrom.sys[/FONT]
[FONT=Courier New]18:46:41.0780 7744 cdrom - ok[/FONT]
[FONT=Courier New]18:46:41.0830 7744 [ 319c6b309773d063541d01df8ac6f55f ] CertPropSvc C:\Windows\System32\certprop.dll[/FONT]
[FONT=Courier New]18:46:41.0832 7744 CertPropSvc - ok[/FONT]
[FONT=Courier New]18:46:41.0863 7744 [ 3fe3fe94a34df6fb06e6418d0f6a0060 ] circlass C:\Windows\system32\DRIVERS\circlass.sys[/FONT]
[FONT=Courier New]18:46:41.0864 7744 circlass - ok[/FONT]
[FONT=Courier New]18:46:41.0905 7744 [ 635181e0e9bbf16871bf5380d71db02d ] CLFS C:\Windows\system32\CLFS.sys[/FONT]
[FONT=Courier New]18:46:41.0909 7744 CLFS - ok[/FONT]
[FONT=Courier New]18:46:41.0978 7744 [ d88040f816fda31c3b466f0fa0918f29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe[/FONT]
[FONT=Courier New]18:46:41.0980 7744 clr_optimization_v2.0.50727_32 - ok[/FONT]
[FONT=Courier New]18:46:42.0068 7744 [ c5a75eb48e2344abdc162bda79e16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[/FONT]
[FONT=Courier New]18:46:42.0070 7744 clr_optimization_v4.0.30319_32 - ok[/FONT]
[FONT=Courier New]18:46:42.0083 7744 [ dea805815e587dad1dd2c502220b5616 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys[/FONT]
[FONT=Courier New]18:46:42.0084 7744 CmBatt - ok[/FONT]
[FONT=Courier New]18:46:42.0093 7744 [ c537b1db64d495b9b4717b4d6d9edbf2 ] cmdide C:\Windows\system32\drivers\cmdide.sys[/FONT]
[FONT=Courier New]18:46:42.0095 7744 cmdide - ok[/FONT]
[FONT=Courier New]18:46:42.0137 7744 [ 247b4ce2dab1160cd422d532d5241e1f ] CNG C:\Windows\system32\Drivers\cng.sys[/FONT]
[FONT=Courier New]18:46:42.0142 7744 CNG - ok[/FONT]
[FONT=Courier New]18:46:42.0151 7744 [ a6023d3823c37043986713f118a89bee ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys[/FONT]
[FONT=Courier New]18:46:42.0152 7744 Compbatt - ok[/FONT]
[FONT=Courier New]18:46:42.0202 7744 [ cbe8c58a8579cfe5fccf809e6f114e89 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys[/FONT]
[FONT=Courier New]18:46:42.0204 7744 CompositeBus - ok[/FONT]
[FONT=Courier New]18:46:42.0226 7744 COMSysApp - ok[/FONT]
[FONT=Courier New]18:46:42.0292 7744 [ d01f685f8b4598d144b0cce9ff95d8d5 ] cpudrv C:\Program Files\SystemRequirementsLab\cpudrv.sys[/FONT]
[FONT=Courier New]18:46:42.0293 7744 cpudrv - ok[/FONT]
[FONT=Courier New]18:46:42.0308 7744 [ 2c4ebcfc84a9b44f209dff6c6e6c61d1 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys[/FONT]
[FONT=Courier New]18:46:42.0310 7744 crcdisk - ok[/FONT]
[FONT=Courier New]18:46:42.0366 7744 [ 06e771aa596b8761107ab57e99f128d7 ] CryptSvc C:\Windows\system32\cryptsvc.dll[/FONT]
[FONT=Courier New]18:46:42.0368 7744 CryptSvc - ok[/FONT]
[FONT=Courier New]18:46:42.0443 7744 [ 3c2177a897b4ca2788c6fb0c3fd81d4b ] CSC C:\Windows\system32\drivers\csc.sys[/FONT]
[FONT=Courier New]18:46:42.0452 7744 CSC - ok[/FONT]
[FONT=Courier New]18:46:42.0478 7744 [ 15f93b37f6801943360d9eb42485d5d3 ] CscService C:\Windows\System32\cscsvc.dll[/FONT]
[FONT=Courier New]18:46:42.0485 7744 CscService - ok[/FONT]
[FONT=Courier New]18:46:42.0607 7744 [ 42709e252b5350aee260dbfa2b4532c2 ] DbgSvc C:\Program Files\DebugDiag\DbgSvc.exe[/FONT]
[FONT=Courier New]18:46:42.0612 7744 DbgSvc - ok[/FONT]
[FONT=Courier New]18:46:42.0664 7744 [ 7caaf4af453ef3582fef65dd72caa0aa ] dc3d C:\Windows\system32\DRIVERS\dc3d.sys[/FONT]
[FONT=Courier New]18:46:42.0666 7744 dc3d - ok[/FONT]
[FONT=Courier New]18:46:42.0717 7744 [ 7660f01d3b38aca1747e397d21d790af ] DcomLaunch C:\Windows\system32\rpcss.dll[/FONT]
[FONT=Courier New]18:46:42.0735 7744 DcomLaunch - ok[/FONT]
[FONT=Courier New]18:46:42.0784 7744 [ 8d6e10a2d9a5eed59562d9b82cf804e1 ] defragsvc C:\Windows\System32\defragsvc.dll[/FONT]
[FONT=Courier New]18:46:42.0788 7744 defragsvc - ok[/FONT]
[FONT=Courier New]18:46:42.0844 7744 [ f024449c97ec1e464aaffda18593db88 ] DfsC C:\Windows\system32\Drivers\dfsc.sys[/FONT]
[FONT=Courier New]18:46:42.0848 7744 DfsC - ok[/FONT]
[FONT=Courier New]18:46:42.0907 7744 [ e9e01eb683c132f7fa27cd607b8a2b63 ] Dhcp C:\Windows\system32\dhcpcore.dll[/FONT]
[FONT=Courier New]18:46:42.0911 7744 Dhcp - ok[/FONT]
[FONT=Courier New]18:46:42.0941 7744 [ 1a050b0274bfb3890703d490f330c0da ] discache C:\Windows\system32\drivers\discache.sys[/FONT]
[FONT=Courier New]18:46:42.0942 7744 discache - ok[/FONT]
[FONT=Courier New]18:46:43.0021 7744 [ 565003f326f99802e68ca78f2a68e9ff ] Disk C:\Windows\system32\DRIVERS\disk.sys[/FONT]
[FONT=Courier New]18:46:43.0022 7744 Disk - ok[/FONT]
[FONT=Courier New]18:46:43.0074 7744 [ 33ef4861f19a0736b11314aad9ae28d0 ] Dnscache C:\Windows\System32\dnsrslvr.dll[/FONT]
[FONT=Courier New]18:46:43.0077 7744 Dnscache - ok[/FONT]
[FONT=Courier New]18:46:43.0148 7744 [ 366ba8fb4b7bb7435e3b9eacb3843f67 ] dot3svc C:\Windows\System32\dot3svc.dll[/FONT]
[FONT=Courier New]18:46:43.0161 7744 dot3svc - ok[/FONT]
[FONT=Courier New]18:46:43.0171 7744 [ 8ec04ca86f1d68da9e11952eb85973d6 ] DPS C:\Windows\system32\dps.dll[/FONT]
[FONT=Courier New]18:46:43.0174 7744 DPS - ok[/FONT]
[FONT=Courier New]18:46:43.0225 7744 [ b918e7c5f9bf77202f89e1a9539f2eb4 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys[/FONT]
[FONT=Courier New]18:46:43.0226 7744 drmkaud - ok[/FONT]
[FONT=Courier New]18:46:43.0327 7744 [ a666127b9fc5b8c82a3afe4e4a5508f1 ] DUMeterDrv C:\Program Files\DU Meter\DUMETR32.SYS[/FONT]
[FONT=Courier New]18:46:43.0339 7744 DUMeterDrv - ok[/FONT]
[FONT=Courier New]18:46:43.0356 7744 DUMeterSvc - ok[/FONT]
[FONT=Courier New]18:46:43.0411 7744 [ 23f5d28378a160352ba8f817bd8c71cb ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys[/FONT]
[FONT=Courier New]18:46:43.0420 7744 DXGKrnl - ok[/FONT]
[FONT=Courier New]18:46:43.0478 7744 [ 0535bfbedb9378ddd15bdf9957d57d71 ] e1express C:\Windows\system32\DRIVERS\e1e6232.sys[/FONT]
[FONT=Courier New]18:46:43.0482 7744 e1express - ok[/FONT]
[FONT=Courier New]18:46:43.0521 7744 [ 8600142fa91c1b96367d3300ad0f3f3a ] EapHost C:\Windows\System32\eapsvc.dll[/FONT]
[FONT=Courier New]18:46:43.0523 7744 EapHost - ok[/FONT]
[FONT=Courier New]18:46:43.0734 7744 [ 024e1b5cac09731e4d868e64dbfb4ab0 ] ebdrv C:\Windows\system32\DRIVERS\evbdx.sys[/FONT]
[FONT=Courier New]18:46:43.0802 7744 ebdrv - ok[/FONT]
[FONT=Courier New]18:46:43.0864 7744 [ 47ce4e650d91dc095a2fddb15631a78a ] eeCtrl C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys[/FONT]
[FONT=Courier New]18:46:43.0869 7744 eeCtrl - ok[/FONT]
[FONT=Courier New]18:46:43.0921 7744 [ 81951f51e318aecc2d68559e47485cc4 ] EFS C:\Windows\System32\lsass.exe[/FONT]
[FONT=Courier New]18:46:43.0923 7744 EFS - ok[/FONT]
[FONT=Courier New]18:46:43.0992 7744 [ a8c362018efc87beb013ee28f29c0863 ] ehRecvr C:\Windows\ehome\ehRecvr.exe[/FONT]
[FONT=Courier New]18:46:44.0000 7744 ehRecvr - ok[/FONT]
[FONT=Courier New]18:46:44.0040 7744 [ d389bff34f80caede417bf9d1507996a ] ehSched C:\Windows\ehome\ehsched.exe[/FONT]
[FONT=Courier New]18:46:44.0043 7744 ehSched - ok[/FONT]
[FONT=Courier New]18:46:44.0081 7744 [ 0ed67910c8c326796faa00b2bf6d9d3c ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys[/FONT]
[FONT=Courier New]18:46:44.0087 7744 elxstor - ok[/FONT]
[FONT=Courier New]18:46:44.0158 7744 [ 539ca34fbc74ec366a0d751028c32a08 ] epmntdrv C:\Windows\system32\epmntdrv.sys[/FONT]
[FONT=Courier New]18:46:44.0160 7744 epmntdrv - ok[/FONT]
[FONT=Courier New]18:46:44.0182 7744 [ 8fc3208352dd3912c94367a206ab3f11 ] ErrDev C:\Windows\system32\drivers\errdev.sys[/FONT]
[FONT=Courier New]18:46:44.0183 7744 ErrDev - ok[/FONT]
[FONT=Courier New]18:46:44.0224 7744 [ 1f2f4ab15ce03ecc257feb2f6dc5a013 ] EuGdiDrv C:\Windows\system32\EuGdiDrv.sys[/FONT]
[FONT=Courier New]18:46:44.0226 7744 EuGdiDrv - ok[/FONT]
[FONT=Courier New]18:46:44.0270 7744 [ f6916efc29d9953d5d0df06882ae8e16 ] EventSystem C:\Windows\system32\es.dll[/FONT]
[FONT=Courier New]18:46:44.0274 7744 EventSystem - ok[/FONT]
[FONT=Courier New]18:46:44.0294 7744 [ 2dc9108d74081149cc8b651d3a26207f ] exfat C:\Windows\system32\drivers\exfat.sys[/FONT]
[FONT=Courier New]18:46:44.0297 7744 exfat - ok[/FONT]
[FONT=Courier New]18:46:44.0327 7744 [ 7e0ab74553476622fb6ae36f73d97d35 ] fastfat C:\Windows\system32\drivers\fastfat.sys[/FONT]
[FONT=Courier New]18:46:44.0330 7744 fastfat - ok[/FONT]
[FONT=Courier New]18:46:44.0391 7744 [ 967ea5b213e9984cbe270205df37755b ] Fax C:\Windows\system32\fxssvc.exe[/FONT]
[FONT=Courier New]18:46:44.0398 7744 Fax - ok[/FONT]
[FONT=Courier New]18:46:44.0435 7744 [ e817a017f82df2a1f8cfdbda29388b29 ] fdc C:\Windows\system32\DRIVERS\fdc.sys[/FONT]
[FONT=Courier New]18:46:44.0436 7744 fdc - ok[/FONT]
[FONT=Courier New]18:46:44.0444 7744 [ f3222c893bd2f5821a0179e5c71e88fb ] fdPHost C:\Windows\system32\fdPHost.dll[/FONT]
[FONT=Courier New]18:46:44.0446 7744 fdPHost - ok[/FONT]
[FONT=Courier New]18:46:44.0483 7744 [ 7dbe8cbfe79efbdeb98c9fb08d3a9a5b ] FDResPub C:\Windows\system32\fdrespub.dll[/FONT]
[FONT=Courier New]18:46:44.0485 7744 FDResPub - ok[/FONT]
[FONT=Courier New]18:46:44.0500 7744 [ 6cf00369c97f3cf563be99be983d13d8 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys[/FONT]
[FONT=Courier New]18:46:44.0502 7744 FileInfo - ok[/FONT]
[FONT=Courier New]18:46:44.0520 7744 [ 42c51dc94c91da21cb9196eb64c45db9 ] Filetrace C:\Windows\system32\drivers\filetrace.sys[/FONT]
[FONT=Courier New]18:46:44.0521 7744 Filetrace - ok[/FONT]
[FONT=Courier New]18:46:44.0577 7744 [ 1f63900e2eb00101b9aca2b7a870704e ] FLEXnet Licensing Service C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe[/FONT]
[FONT=Courier New]18:46:44.0593 7744 FLEXnet Licensing Service - ok[/FONT]
[FONT=Courier New]18:46:44.0619 7744 [ 87907aa70cb3c56600f1c2fb8841579b ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys[/FONT]
[FONT=Courier New]18:46:44.0621 7744 flpydisk - ok[/FONT]
[FONT=Courier New]18:46:44.0664 7744 [ 7520ec808e0c35e0ee6f841294316653 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys[/FONT]
[FONT=Courier New]18:46:44.0667 7744 FltMgr - ok[/FONT]
[FONT=Courier New]18:46:44.0709 7744 [ 9abce4fa55985cb4093c54d57c644cb6 ] FontCache C:\Windows\system32\FntCache.dll[/FONT]
[FONT=Courier New]18:46:44.0742 7744 FontCache - ok[/FONT]
[FONT=Courier New]18:46:44.0857 7744 [ e56f39f6b7fda0ac77a79b0fd3de1a2f ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[/FONT]
[FONT=Courier New]18:46:44.0858 7744 FontCache3.0.0.0 - ok[/FONT]
[FONT=Courier New]18:46:44.0868 7744 [ 1a16b57943853e598cff37fe2b8cbf1d ] FsDepends C:\Windows\system32\drivers\FsDepends.sys[/FONT]
[FONT=Courier New]18:46:44.0869 7744 FsDepends - ok[/FONT]
[FONT=Courier New]18:46:44.0907 7744 [ 7dae5ebcc80e45d3253f4923dc424d05 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys[/FONT]
[FONT=Courier New]18:46:44.0908 7744 Fs_Rec - ok[/FONT]
[FONT=Courier New]18:46:44.0958 7744 [ 8a73e79089b282100b9393b644cb853b ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys[/FONT]
[FONT=Courier New]18:46:44.0961 7744 fvevol - ok[/FONT]
[FONT=Courier New]18:46:45.0005 7744 [ 65ee0c7a58b65e74ae05637418153938 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys[/FONT]
[FONT=Courier New]18:46:45.0007 7744 gagp30kx - ok[/FONT]
[FONT=Courier New]18:46:45.0065 7744 [ 8182ff89c65e4d38b2de4bb0fb18564e ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys[/FONT]
[FONT=Courier New]18:46:45.0066 7744 GEARAspiWDM - ok[/FONT]
[FONT=Courier New]18:46:45.0147 7744 [ 9f5f2f0fb0a7f5aa9f16b9a7b6dad89f ] GoogleDesktopManager-051210-111108 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[/FONT]
[FONT=Courier New]18:46:45.0154 7744 GoogleDesktopManager-051210-111108 - ok[/FONT]
[FONT=Courier New]18:46:45.0299 7744 [ 0b53f4306e17025e7685d18c3a77127e ] GoToMyPC C:\Program Files\Citrix\GoToMyPC\g2svc.exe[/FONT]
[FONT=Courier New]18:46:45.0325 7744 GoToMyPC - ok[/FONT]
[FONT=Courier New]18:46:45.0381 7744 [ e897eaf5ed6ba41e081060c9b447a673 ] gpsvc C:\Windows\System32\gpsvc.dll[/FONT]
[FONT=Courier New]18:46:45.0389 7744 gpsvc - ok[/FONT]
[FONT=Courier New]18:46:45.0436 7744 [ 626a24ed1228580b9518c01930936df9 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe[/FONT]
[FONT=Courier New]18:46:45.0437 7744 gupdate - ok[/FONT]
[FONT=Courier New]18:46:45.0470 7744 [ 626a24ed1228580b9518c01930936df9 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe[/FONT]
[FONT=Courier New]18:46:45.0471 7744 gupdatem - ok[/FONT]
[FONT=Courier New]18:46:45.0509 7744 [ 5d4bc124faae6730ac002cdb67bf1a1c ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe[/FONT]
[FONT=Courier New]18:46:45.0512 7744 gusvc - ok[/FONT]
[FONT=Courier New]18:46:45.0543 7744 [ 2084888f800fb1c1e514fd6da168b5b3 ] hcmon C:\Windows\system32\drivers\hcmon.sys[/FONT]
[FONT=Courier New]18:46:45.0545 7744 hcmon - ok[/FONT]
[FONT=Courier New]18:46:45.0577 7744 [ c44e3c2bab6837db337ddee7544736db ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys[/FONT]
[FONT=Courier New]18:46:45.0578 7744 hcw85cir - ok[/FONT]
[FONT=Courier New]18:46:45.0631 7744 [ a5ef29d5315111c80a5c1abad14c8972 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys[/FONT]
[FONT=Courier New]18:46:45.0635 7744 HdAudAddService - ok[/FONT]
[FONT=Courier New]18:46:45.0684 7744 [ 9036377b8a6c15dc2eec53e489d159b5 ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys[/FONT]
[FONT=Courier New]18:46:45.0686 7744 HDAudBus - ok[/FONT]
[FONT=Courier New]18:46:45.0700 7744 [ 1d58a7f3e11a9731d0eaaaa8405acc36 ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys[/FONT]
[FONT=Courier New]18:46:45.0701 7744 HidBatt - ok[/FONT]
[FONT=Courier New]18:46:45.0718 7744 [ 89448f40e6df260c206a193a4683ba78 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys[/FONT]
[FONT=Courier New]18:46:45.0720 7744 HidBth - ok[/FONT]
[FONT=Courier New]18:46:45.0732 7744 [ cf50b4cf4a4f229b9f3c08351f99ca5e ] HidIr C:\Windows\system32\DRIVERS\hidir.sys[/FONT]
[FONT=Courier New]18:46:45.0734 7744 HidIr - ok[/FONT]
[FONT=Courier New]18:46:45.0766 7744 [ 2bc6f6a1992b3a77f5f41432ca6b3b6b ] hidserv C:\Windows\System32\hidserv.dll[/FONT]
 
[FONT=Courier New]18:46:45.0768 7744 hidserv - ok[/FONT]
[FONT=Courier New]18:46:45.0828 7744 [ 10c19f8290891af023eaec0832e1eb4d ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys[/FONT]
[FONT=Courier New]18:46:45.0829 7744 HidUsb - ok[/FONT]
[FONT=Courier New]18:46:45.0872 7744 [ 196b4e3f4cccc24af836ce58facbb699 ] hkmsvc C:\Windows\system32\kmsvc.dll[/FONT]
[FONT=Courier New]18:46:45.0882 7744 hkmsvc - ok[/FONT]
[FONT=Courier New]18:46:45.0924 7744 [ 6658f4404de03d75fe3ba09f7aba6a30 ] HomeGroupListener C:\Windows\system32\ListSvc.dll[/FONT]
[FONT=Courier New]18:46:45.0928 7744 HomeGroupListener - ok[/FONT]
[FONT=Courier New]18:46:45.0970 7744 [ dbc02d918fff1cad628acbe0c0eaa8e8 ] HomeGroupProvider C:\Windows\system32\provsvc.dll[/FONT]
[FONT=Courier New]18:46:45.0975 7744 HomeGroupProvider - ok[/FONT]
[FONT=Courier New]18:46:46.0022 7744 [ 295fdc419039090eb8b49ffdbb374549 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys[/FONT]
[FONT=Courier New]18:46:46.0024 7744 HpSAMD - ok[/FONT]
[FONT=Courier New]18:46:46.0079 7744 [ 871917b07a141bff43d76d8844d48106 ] HTTP C:\Windows\system32\drivers\HTTP.sys[/FONT]
[FONT=Courier New]18:46:46.0086 7744 HTTP - ok[/FONT]
[FONT=Courier New]18:46:46.0134 7744 [ 0c4e035c7f105f1299258c90886c64c5 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys[/FONT]
[FONT=Courier New]18:46:46.0135 7744 hwpolicy - ok[/FONT]
[FONT=Courier New]18:46:46.0183 7744 [ f151f0bdc47f4a28b1b20a0818ea36d6 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys[/FONT]
[FONT=Courier New]18:46:46.0185 7744 i8042prt - ok[/FONT]
[FONT=Courier New]18:46:46.0274 7744 [ 72b53e9c8924949dec8f3799bcba2251 ] IAANTMON C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[/FONT]
[FONT=Courier New]18:46:46.0291 7744 IAANTMON - ok[/FONT]
[FONT=Courier New]18:46:46.0362 7744 [ e5a0034847537eaee3c00349d5c34c5f ] iaStor C:\Windows\system32\DRIVERS\iaStor.sys[/FONT]
[FONT=Courier New]18:46:46.0364 7744 iaStor - ok[/FONT]
[FONT=Courier New]18:46:46.0424 7744 [ 5cd5f9a5444e6cdcb0ac89bd62d8b76e ] iaStorV C:\Windows\system32\drivers\iaStorV.sys[/FONT]
[FONT=Courier New]18:46:46.0428 7744 iaStorV - ok[/FONT]
[FONT=Courier New]18:46:46.0492 7744 [ 6f95324909b502e2651442c1548ab12f ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe[/FONT]
[FONT=Courier New]18:46:46.0495 7744 IDriverT - ok[/FONT]
[FONT=Courier New]18:46:46.0566 7744 [ c521d7eb6497bb1af6afa89e322fb43c ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe[/FONT]
[FONT=Courier New]18:46:46.0577 7744 idsvc - ok[/FONT]
[FONT=Courier New]18:46:46.0632 7744 [ 4173ff5708f3236cf25195fecd742915 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys[/FONT]
[FONT=Courier New]18:46:46.0634 7744 iirsp - ok[/FONT]
[FONT=Courier New]18:46:46.0696 7744 [ f95622f161474511b8d80d6b093aa610 ] IKEEXT C:\Windows\System32\ikeext.dll[/FONT]
[FONT=Courier New]18:46:46.0705 7744 IKEEXT - ok[/FONT]
[FONT=Courier New]18:46:46.0757 7744 [ a0f12f2c9ba6c72f3987ce780e77c130 ] intelide C:\Windows\system32\drivers\intelide.sys[/FONT]
[FONT=Courier New]18:46:46.0759 7744 intelide - ok[/FONT]
[FONT=Courier New]18:46:46.0776 7744 [ 3b514d27bfc4accb4037bc6685f766e0 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys[/FONT]
[FONT=Courier New]18:46:46.0778 7744 intelppm - ok[/FONT]
[FONT=Courier New]18:46:46.0805 7744 IogearUDSMBus - ok[/FONT]
[FONT=Courier New]18:46:46.0878 7744 [ acb364b9075a45c0736e5c47be5cae19 ] IPBusEnum C:\Windows\system32\ipbusenum.dll[/FONT]
[FONT=Courier New]18:46:46.0881 7744 IPBusEnum - ok[/FONT]
[FONT=Courier New]18:46:46.0930 7744 [ 709d1761d3b19a932ff0238ea6d50200 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys[/FONT]
[FONT=Courier New]18:46:46.0932 7744 IpFilterDriver - ok[/FONT]
[FONT=Courier New]18:46:46.0994 7744 [ 4d65a07b795d6674312f879d09aa7663 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll[/FONT]
[FONT=Courier New]18:46:47.0005 7744 iphlpsvc - ok[/FONT]
[FONT=Courier New]18:46:47.0014 7744 [ 4bd7134618c1d2a27466a099062547bf ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys[/FONT]
[FONT=Courier New]18:46:47.0016 7744 IPMIDRV - ok[/FONT]
[FONT=Courier New]18:46:47.0029 7744 [ a5fa468d67abcdaa36264e463a7bb0cd ] IPNAT C:\Windows\system32\drivers\ipnat.sys[/FONT]
[FONT=Courier New]18:46:47.0031 7744 IPNAT - ok[/FONT]
[FONT=Courier New]18:46:47.0101 7744 [ 57edb35ea2feca88f8b17c0c095c9a56 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe[/FONT]
[FONT=Courier New]18:46:47.0126 7744 iPod Service - ok[/FONT]
[FONT=Courier New]18:46:47.0165 7744 [ 42996cff20a3084a56017b7902307e9f ] IRENUM C:\Windows\system32\drivers\irenum.sys[/FONT]
[FONT=Courier New]18:46:47.0167 7744 IRENUM - ok[/FONT]
[FONT=Courier New]18:46:47.0182 7744 [ 1f32bb6b38f62f7df1a7ab7292638a35 ] isapnp C:\Windows\system32\drivers\isapnp.sys[/FONT]
[FONT=Courier New]18:46:47.0184 7744 isapnp - ok[/FONT]
[FONT=Courier New]18:46:47.0208 7744 [ cb7a9abb12b8415bce5d74994c7ba3ae ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys[/FONT]
[FONT=Courier New]18:46:47.0212 7744 iScsiPrt - ok[/FONT]
[FONT=Courier New]18:46:47.0248 7744 [ adef52ca1aeae82b50df86b56413107e ] kbdclass C:\Windows\system32\drivers\kbdclass.sys[/FONT]
[FONT=Courier New]18:46:47.0250 7744 kbdclass - ok[/FONT]
[FONT=Courier New]18:46:47.0297 7744 [ 9e3ced91863e6ee98c24794d05e27a71 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys[/FONT]
[FONT=Courier New]18:46:47.0298 7744 kbdhid - ok[/FONT]
[FONT=Courier New]18:46:47.0311 7744 [ 81951f51e318aecc2d68559e47485cc4 ] KeyIso C:\Windows\system32\lsass.exe[/FONT]
[FONT=Courier New]18:46:47.0313 7744 KeyIso - ok[/FONT]
[FONT=Courier New]18:46:47.0426 7744 [ 51527a0a1ff0660489843b069f923dae ] kmodurl C:\Program Files\Kingsoft\PcDoctor\kmodurl.sys[/FONT]
[FONT=Courier New]18:46:47.0428 7744 kmodurl - ok[/FONT]
[FONT=Courier New]18:46:47.0490 7744 [ 641ea07d25c8a39a7868bc7f769d4b9a ] KSafeSvc C:\Program Files\Kingsoft\PcDoctor\KSafeSvc.exe[/FONT]
[FONT=Courier New]18:46:47.0492 7744 KSafeSvc - ok[/FONT]
[FONT=Courier New]18:46:47.0524 7744 [ b7895b4182c0d16f6efadeb8081e8d36 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys[/FONT]
[FONT=Courier New]18:46:47.0526 7744 KSecDD - ok[/FONT]
[FONT=Courier New]18:46:47.0563 7744 [ d30159ac9237519fbc62c6ec247d2d46 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys[/FONT]
[FONT=Courier New]18:46:47.0565 7744 KSecPkg - ok[/FONT]
[FONT=Courier New]18:46:47.0607 7744 [ 89a7b9cc98d0d80c6f31b91c0a310fcd ] KtmRm C:\Windows\system32\msdtckrm.dll[/FONT]
[FONT=Courier New]18:46:47.0613 7744 KtmRm - ok[/FONT]
[FONT=Courier New]18:46:47.0676 7744 [ d64af876d53eca3668bb97b51b4e70ab ] LanmanServer C:\Windows\System32\srvsvc.dll[/FONT]
[FONT=Courier New]18:46:47.0681 7744 LanmanServer - ok[/FONT]
[FONT=Courier New]18:46:47.0693 7744 [ 58405e4f68ba8e4057c6e914f326aba2 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll[/FONT]
[FONT=Courier New]18:46:47.0697 7744 LanmanWorkstation - ok[/FONT]
[FONT=Courier New]18:46:47.0761 7744 [ bae60e7df29313470d6f18fe2550f53e ] libusb0 C:\Windows\system32\DRIVERS\libusb0.sys[/FONT]
[FONT=Courier New]18:46:47.0763 7744 libusb0 - ok[/FONT]
[FONT=Courier New]18:46:47.0822 7744 [ f7611ec07349979da9b0ae1f18ccc7a6 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys[/FONT]
[FONT=Courier New]18:46:47.0823 7744 lltdio - ok[/FONT]
[FONT=Courier New]18:46:47.0892 7744 [ 5700673e13a2117fa3b9020c852c01e2 ] lltdsvc C:\Windows\System32\lltdsvc.dll[/FONT]
[FONT=Courier New]18:46:47.0926 7744 lltdsvc - ok[/FONT]
[FONT=Courier New]18:46:47.0946 7744 [ 55ca01ba19d0006c8f2639b6c045e08b ] lmhosts C:\Windows\System32\lmhsvc.dll[/FONT]
[FONT=Courier New]18:46:47.0948 7744 lmhosts - ok[/FONT]
[FONT=Courier New]18:46:48.0065 7744 [ 63daf163d1617dd611bd0ab8e41a43e8 ] LMIGuardianSvc C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe[/FONT]
[FONT=Courier New]18:46:48.0068 7744 LMIGuardianSvc - ok[/FONT]
[FONT=Courier New]18:46:48.0113 7744 [ 4f69faaabb7db0d43e327c0b6aab40fc ] LMIInfo C:\Program Files\LogMeIn\x86\RaInfo.sys[/FONT]
[FONT=Courier New]18:46:48.0114 7744 LMIInfo - ok[/FONT]
[FONT=Courier New]18:46:48.0154 7744 [ 175f50f37eeaa1d4d744bcccbb7cf68c ] LMIMaint C:\Program Files\LogMeIn\x86\RaMaint.exe[/FONT]
[FONT=Courier New]18:46:48.0156 7744 LMIMaint - ok[/FONT]
[FONT=Courier New]18:46:48.0191 7744 [ 4477689e2d8ae6b78ba34c9af4cc1ed1 ] lmimirr C:\Windows\system32\DRIVERS\lmimirr.sys[/FONT]
[FONT=Courier New]18:46:48.0192 7744 lmimirr - ok[/FONT]
[FONT=Courier New]18:46:48.0216 7744 LMIRfsClientNP - ok[/FONT]
[FONT=Courier New]18:46:48.0238 7744 [ 3faa563ddf853320f90259d455a01d79 ] LMIRfsDriver C:\Windows\system32\drivers\LMIRfsDriver.sys[/FONT]
[FONT=Courier New]18:46:48.0240 7744 LMIRfsDriver - ok[/FONT]
[FONT=Courier New]18:46:48.0277 7744 [ 432618fa75b61059d2c57d6a7e55147a ] LogMeIn C:\Program Files\LogMeIn\x86\LogMeIn.exe[/FONT]
[FONT=Courier New]18:46:48.0280 7744 LogMeIn - ok[/FONT]
[FONT=Courier New]18:46:48.0348 7744 [ eb119a53ccf2acc000ac71b065b78fef ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys[/FONT]
[FONT=Courier New]18:46:48.0363 7744 LSI_FC - ok[/FONT]
[FONT=Courier New]18:46:48.0380 7744 [ 8ade1c877256a22e49b75d1cc9161f9c ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys[/FONT]
[FONT=Courier New]18:46:48.0382 7744 LSI_SAS - ok[/FONT]
[FONT=Courier New]18:46:48.0410 7744 [ dc9dc3d3daa0e276fd2ec262e38b11e9 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys[/FONT]
[FONT=Courier New]18:46:48.0412 7744 LSI_SAS2 - ok[/FONT]
[FONT=Courier New]18:46:48.0429 7744 [ 0a036c7d7cab643a7f07135ac47e0524 ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys[/FONT]
[FONT=Courier New]18:46:48.0431 7744 LSI_SCSI - ok[/FONT]
[FONT=Courier New]18:46:48.0476 7744 [ 6703e366cc18d3b6e534f5cf7df39cee ] luafv C:\Windows\system32\drivers\luafv.sys[/FONT]
[FONT=Courier New]18:46:48.0479 7744 luafv - ok[/FONT]
[FONT=Courier New]18:46:48.0536 7744 [ 6dfe7f2e8e8a337263aa5c92a215f161 ] MBAMProtector C:\Windows\system32\drivers\mbam.sys[/FONT]
[FONT=Courier New]18:46:48.0538 7744 MBAMProtector - ok[/FONT]
[FONT=Courier New]18:46:48.0661 7744 [ 43683e970f008c93c9429ef428147a54 ] MBAMService C:\Program Files\Malwarebytes' Anti-Malware\Malwarebytes' Anti-Malware\mbamservice.exe[/FONT]
[FONT=Courier New]18:46:48.0671 7744 MBAMService - ok[/FONT]
[FONT=Courier New]18:46:48.0714 7744 [ 8fd868e32459ece2a1bb0169f513d31e ] mcdbus C:\Windows\system32\DRIVERS\mcdbus.sys[/FONT]
[FONT=Courier New]18:46:48.0717 7744 mcdbus - ok[/FONT]
[FONT=Courier New]18:46:48.0756 7744 [ bfb9ee8ee977efe85d1a3105abef6dd1 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll[/FONT]
[FONT=Courier New]18:46:48.0759 7744 Mcx2Svc - ok[/FONT]
[FONT=Courier New]18:46:48.0874 7744 [ 11f714f85530a2bd134074dc30e99fca ] MDM C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[/FONT]
[FONT=Courier New]18:46:48.0880 7744 MDM - ok[/FONT]
[FONT=Courier New]18:46:48.0922 7744 [ 0fff5b045293002ab38eb1fd1fc2fb74 ] megasas C:\Windows\system32\DRIVERS\megasas.sys[/FONT]
[FONT=Courier New]18:46:48.0923 7744 megasas - ok[/FONT]
[FONT=Courier New]18:46:48.0966 7744 [ dcbab2920c75f390caf1d29f675d03d6 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys[/FONT]
[FONT=Courier New]18:46:48.0969 7744 MegaSR - ok[/FONT]
[FONT=Courier New]18:46:49.0057 7744 Microsoft SharePoint Workspace Audit Service - ok[/FONT]
[FONT=Courier New]18:46:49.0091 7744 [ 146b6f43a673379a3c670e86d89be5ea ] MMCSS C:\Windows\system32\mmcss.dll[/FONT]
[FONT=Courier New]18:46:49.0094 7744 MMCSS - ok[/FONT]
[FONT=Courier New]18:46:49.0134 7744 [ c6a81f138f297cc7e653efc059cca033 ] Modem C:\Windows\system32\drivers\modem.sys[/FONT]
[FONT=Courier New]18:46:49.0135 7744 Modem - ok[/FONT]
[FONT=Courier New]18:46:49.0171 7744 [ 79d10964de86b292320e9dfe02282a23 ] monitor C:\Windows\system32\DRIVERS\monitor.sys[/FONT]
[FONT=Courier New]18:46:49.0180 7744 monitor - ok[/FONT]
[FONT=Courier New]18:46:49.0215 7744 [ fb18cc1d4c2e716b6b903b0ac0cc0609 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys[/FONT]
[FONT=Courier New]18:46:49.0217 7744 mouclass - ok[/FONT]
[FONT=Courier New]18:46:49.0260 7744 [ 2c388d2cd01c9042596cf3c8f3c7b24d ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys[/FONT]
[FONT=Courier New]18:46:49.0261 7744 mouhid - ok[/FONT]
[FONT=Courier New]18:46:49.0309 7744 [ fc8771f45ecccfd89684e38842539b9b ] mountmgr C:\Windows\system32\drivers\mountmgr.sys[/FONT]
[FONT=Courier New]18:46:49.0313 7744 mountmgr - ok[/FONT]
[FONT=Courier New]18:46:49.0386 7744 [ d993bea500e7382dc4e760bf4f35efcb ] MpFilter C:\Windows\system32\DRIVERS\MpFilter.sys[/FONT]
[FONT=Courier New]18:46:49.0395 7744 MpFilter - ok[/FONT]
[FONT=Courier New]18:46:49.0414 7744 [ 2d699fb6e89ce0d8da14ecc03b3edfe0 ] mpio C:\Windows\system32\drivers\mpio.sys[/FONT]
[FONT=Courier New]18:46:49.0416 7744 mpio - ok[/FONT]
[FONT=Courier New]18:46:49.0613 7744 [ a69630d039c38018689190234f866d77 ] MpKsl7ad2c85a c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D038EA17-3377-478B-B5ED-19B9E4CFA74B}\MpKsl7ad2c85a.sys[/FONT]
[FONT=Courier New]18:46:49.0614 7744 MpKsl7ad2c85a - ok[/FONT]
[FONT=Courier New]18:46:49.0646 7744 [ ad2723a7b53dd1aacae6ad8c0bfbf4d0 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys[/FONT]
[FONT=Courier New]18:46:49.0648 7744 mpsdrv - ok[/FONT]
[FONT=Courier New]18:46:49.0726 7744 [ 9835584e999d25004e1ee8e5f3e3b881 ] MpsSvc C:\Windows\system32\mpssvc.dll[/FONT]
[FONT=Courier New]18:46:49.0740 7744 MpsSvc - ok[/FONT]
[FONT=Courier New]18:46:49.0780 7744 [ ceb46ab7c01c9f825f8cc6babc18166a ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys[/FONT]
[FONT=Courier New]18:46:49.0782 7744 MRxDAV - ok[/FONT]
[FONT=Courier New]18:46:49.0826 7744 [ 5d16c921e3671636c0eba3bbaac5fd25 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys[/FONT]
[FONT=Courier New]18:46:49.0828 7744 mrxsmb - ok[/FONT]
[FONT=Courier New]18:46:49.0871 7744 [ 6d17a4791aca19328c685d256349fefc ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys[/FONT]
[FONT=Courier New]18:46:49.0875 7744 mrxsmb10 - ok[/FONT]
[FONT=Courier New]18:46:49.0890 7744 [ b81f204d146000be76651a50670a5e9e ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys[/FONT]
[FONT=Courier New]18:46:49.0893 7744 mrxsmb20 - ok[/FONT]
[FONT=Courier New]18:46:49.0941 7744 [ 012c5f4e9349e711e11e0f19a8589f0a ] msahci C:\Windows\system32\drivers\msahci.sys[/FONT]
[FONT=Courier New]18:46:49.0943 7744 msahci - ok[/FONT]
[FONT=Courier New]18:46:50.0017 7744 [ 31e023681015c35ebfe1498b07813b87 ] MSCamSvc C:\Program Files\Microsoft LifeCam\MSCamS32.exe[/FONT]
[FONT=Courier New]18:46:50.0020 7744 MSCamSvc - ok[/FONT]
[FONT=Courier New]18:46:50.0044 7744 [ 55055f8ad8be27a64c831322a780a228 ] msdsm C:\Windows\system32\drivers\msdsm.sys[/FONT]
[FONT=Courier New]18:46:50.0046 7744 msdsm - ok[/FONT]
[FONT=Courier New]18:46:50.0064 7744 [ e1bce74a3bd9902b72599c0192a07e27 ] MSDTC C:\Windows\System32\msdtc.exe[/FONT]
[FONT=Courier New]18:46:50.0067 7744 MSDTC - ok[/FONT]
[FONT=Courier New]18:46:50.0112 7744 [ daefb28e3af5a76abcc2c3078c07327f ] Msfs C:\Windows\system32\drivers\Msfs.sys[/FONT]
[FONT=Courier New]18:46:50.0121 7744 Msfs - ok[/FONT]
[FONT=Courier New]18:46:50.0133 7744 [ 3e1e5767043c5af9367f0056295e9f84 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys[/FONT]
[FONT=Courier New]18:46:50.0135 7744 mshidkmdf - ok[/FONT]
[FONT=Courier New]18:46:50.0170 7744 [ 0a4e5757ae09fa9622e3158cc1aef114 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys[/FONT]
[FONT=Courier New]18:46:50.0171 7744 msisadrv - ok[/FONT]
[FONT=Courier New]18:46:50.0212 7744 [ 90f7d9e6b6f27e1a707d4a297f077828 ] MSiSCSI C:\Windows\system32\iscsiexe.dll[/FONT]
[FONT=Courier New]18:46:50.0215 7744 MSiSCSI - ok[/FONT]
[FONT=Courier New]18:46:50.0220 7744 msiserver - ok[/FONT]
[FONT=Courier New]18:46:50.0269 7744 [ 8c0860d6366aaffb6c5bb9df9448e631 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys[/FONT]
[FONT=Courier New]18:46:50.0271 7744 MSKSSRV - ok[/FONT]
[FONT=Courier New]18:46:50.0357 7744 [ 24516bf4e12a46cb67302e2cdcb8cddf ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe[/FONT]
[FONT=Courier New]18:46:50.0357 7744 MsMpSvc - ok[/FONT]
[FONT=Courier New]18:46:50.0375 7744 [ 3ea8b949f963562cedbb549eac0c11ce ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys[/FONT]
[FONT=Courier New]18:46:50.0376 7744 MSPCLOCK - ok[/FONT]
[FONT=Courier New]18:46:50.0402 7744 [ f456e973590d663b1073e9c463b40932 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys[/FONT]
[FONT=Courier New]18:46:50.0403 7744 MSPQM - ok[/FONT]
[FONT=Courier New]18:46:50.0421 7744 [ 0e008fc4819d238c51d7c93e7b41e560 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys[/FONT]
[FONT=Courier New]18:46:50.0424 7744 MsRPC - ok[/FONT]
[FONT=Courier New]18:46:50.0468 7744 [ fc6b9ff600cc585ea38b12589bd4e246 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys[/FONT]
[FONT=Courier New]18:46:50.0477 7744 mssmbios - ok[/FONT]
[FONT=Courier New]18:46:50.0561 7744 MSSQL$MICROSOFTSCM - ok[/FONT]
[FONT=Courier New]18:46:50.0690 7744 [ f1761c8fb2b25a32c6d63e36bb88c3ae ] MSSQLServerADHelper100 c:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE[/FONT]
[FONT=Courier New]18:46:50.0692 7744 MSSQLServerADHelper100 - ok[/FONT]
[FONT=Courier New]18:46:50.0738 7744 [ b42c6b921f61a6e55159b8be6cd54a36 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys[/FONT]
[FONT=Courier New]18:46:50.0739 7744 MSTEE - ok[/FONT]
[FONT=Courier New]18:46:50.0754 7744 [ 33599130f44e1f34631cea241de8ac84 ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys[/FONT]
[FONT=Courier New]18:46:50.0755 7744 MTConfig - ok[/FONT]
[FONT=Courier New]18:46:50.0770 7744 [ 159fad02f64e6381758c990f753bcc80 ] Mup C:\Windows\system32\Drivers\mup.sys[/FONT]
[FONT=Courier New]18:46:50.0771 7744 Mup - ok[/FONT]
[FONT=Courier New]18:46:50.0827 7744 [ 428c611928df3e96538a482117e659f7 ] NAL C:\Windows\system32\Drivers\iqvw32.sys[/FONT]
[FONT=Courier New]18:46:50.0829 7744 NAL - ok[/FONT]
[FONT=Courier New]18:46:50.0884 7744 [ 61d57a5d7c6d9afe10e77dae6e1b445e ] napagent C:\Windows\system32\qagentRT.dll[/FONT]
[FONT=Courier New]18:46:50.0890 7744 napagent - ok[/FONT]
[FONT=Courier New]18:46:50.0952 7744 [ 26384429fcd85d83746f63e798ab1480 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys[/FONT]
[FONT=Courier New]18:46:50.0956 7744 NativeWifiP - ok[/FONT]
[FONT=Courier New]18:46:51.0042 7744 [ c339d6bde0fa22ba79398ff743866db2 ] NDIS C:\Windows\system32\drivers\ndis.sys[/FONT]
[FONT=Courier New]18:46:51.0068 7744 NDIS - ok[/FONT]
[FONT=Courier New]18:46:51.0089 7744 [ 0e1787aa6c9191d3d319e8bafe86f80c ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys[/FONT]
[FONT=Courier New]18:46:51.0091 7744 NdisCap - ok[/FONT]
[FONT=Courier New]18:46:51.0134 7744 [ e4a8aec125a2e43a9e32afeea7c9c888 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys[/FONT]
[FONT=Courier New]18:46:51.0136 7744 NdisTapi - ok[/FONT]
[FONT=Courier New]18:46:51.0167 7744 [ d8a65dafb3eb41cbb622745676fcd072 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys[/FONT]
[FONT=Courier New]18:46:51.0168 7744 Ndisuio - ok[/FONT]
[FONT=Courier New]18:46:51.0212 7744 [ 38fbe267e7e6983311179230facb1017 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys[/FONT]
[FONT=Courier New]18:46:51.0214 7744 NdisWan - ok[/FONT]
[FONT=Courier New]18:46:51.0265 7744 [ a4bdc541e69674fbff1a8ff00be913f2 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys[/FONT]
[FONT=Courier New]18:46:51.0267 7744 NDProxy - ok[/FONT]
[FONT=Courier New]18:46:51.0293 7744 [ 80b275b1ce3b0e79909db7b39af74d51 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys[/FONT]
[FONT=Courier New]18:46:51.0294 7744 NetBIOS - ok[/FONT]
[FONT=Courier New]18:46:51.0345 7744 [ 280122ddcf04b378edd1ad54d71c1e54 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys[/FONT]
[FONT=Courier New]18:46:51.0348 7744 NetBT - ok[/FONT]
[FONT=Courier New]18:46:51.0359 7744 [ 81951f51e318aecc2d68559e47485cc4 ] Netlogon C:\Windows\system32\lsass.exe[/FONT]
[FONT=Courier New]18:46:51.0361 7744 Netlogon - ok[/FONT]
[FONT=Courier New]18:46:51.0418 7744 [ 7cccfca7510684768da22092d1fa4db2 ] Netman C:\Windows\System32\netman.dll[/FONT]
[FONT=Courier New]18:46:51.0424 7744 Netman - ok[/FONT]
[FONT=Courier New]18:46:51.0453 7744 [ 8c338238c16777a802d6a9211eb2ba50 ] netprofm C:\Windows\System32\netprofm.dll[/FONT]
[FONT=Courier New]18:46:51.0459 7744 netprofm - ok[/FONT]
[FONT=Courier New]18:46:51.0481 7744 [ f476ec40033cdb91efbe73eb99b8362d ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe[/FONT]
[FONT=Courier New]18:46:51.0484 7744 NetTcpPortSharing - ok[/FONT]
[FONT=Courier New]18:46:51.0524 7744 [ 1d85c4b390b0ee09c7a46b91efb2c097 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys[/FONT]
[FONT=Courier New]18:46:51.0525 7744 nfrd960 - ok[/FONT]
[FONT=Courier New]18:46:51.0598 7744 [ b52f26bade7d7e4a79706e3fd91834cd ] NisDrv C:\Windows\system32\DRIVERS\NisDrvWFP.sys[/FONT]
[FONT=Courier New]18:46:51.0599 7744 NisDrv - ok[/FONT]
[FONT=Courier New]18:46:51.0627 7744 [ 290c0d4c4889398797f8df3be00b9698 ] NisSrv c:\Program Files\Microsoft Security Client\NisSrv.exe[/FONT]
[FONT=Courier New]18:46:51.0630 7744 NisSrv - ok[/FONT]
[FONT=Courier New]18:46:51.0670 7744 [ 912084381d30d8b89ec4e293053f4710 ] NlaSvc C:\Windows\System32\nlasvc.dll[/FONT]
[FONT=Courier New]18:46:51.0675 7744 NlaSvc - ok[/FONT]
[FONT=Courier New]18:46:51.0688 7744 [ 1db262a9f8c087e8153d89bef3d2235f ] Npfs C:\Windows\system32\drivers\Npfs.sys[/FONT]
[FONT=Courier New]18:46:51.0690 7744 Npfs - ok[/FONT]
[FONT=Courier New]18:46:51.0730 7744 [ ba387e955e890c8a88306d9b8d06bf17 ] nsi C:\Windows\system32\nsisvc.dll[/FONT]
[FONT=Courier New]18:46:51.0739 7744 nsi - ok[/FONT]
[FONT=Courier New]18:46:51.0756 7744 [ e9a0a4d07e53d8fea2bb8387a3293c58 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys[/FONT]
[FONT=Courier New]18:46:51.0757 7744 nsiproxy - ok[/FONT]
[FONT=Courier New]18:46:51.0819 7744 [ 81189c3d7763838e55c397759d49007a ] Ntfs C:\Windows\system32\drivers\Ntfs.sys[/FONT]
[FONT=Courier New]18:46:51.0854 7744 Ntfs - ok[/FONT]
[FONT=Courier New]18:46:51.0890 7744 [ f9756a98d69098dca8945d62858a812c ] Null C:\Windows\system32\drivers\Null.sys[/FONT]
[FONT=Courier New]18:46:51.0891 7744 Null - ok[/FONT]
[FONT=Courier New]18:46:51.0929 7744 [ b3e25ee28883877076e0e1ff877d02e0 ] nvraid C:\Windows\system32\drivers\nvraid.sys[/FONT]
[FONT=Courier New]18:46:51.0931 7744 nvraid - ok[/FONT]
[FONT=Courier New]18:46:51.0974 7744 [ 4380e59a170d88c4f1022eff6719a8a4 ] nvstor C:\Windows\system32\drivers\nvstor.sys[/FONT]
[FONT=Courier New]18:46:51.0976 7744 nvstor - ok[/FONT]
[FONT=Courier New]18:46:52.0010 7744 [ 5a0983915f02bae73267cc2a041f717d ] nv_agp C:\Windows\system32\drivers\nv_agp.sys[/FONT]
[FONT=Courier New]18:46:52.0013 7744 nv_agp - ok[/FONT]
[FONT=Courier New]18:46:52.0057 7744 [ 08a70a1f2cdde9bb49b885cb817a66eb ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys[/FONT]
[FONT=Courier New]18:46:52.0063 7744 ohci1394 - ok[/FONT]
[FONT=Courier New]18:46:52.0100 7744 [ 9d10f99a6712e28f8acd5641e3a7ea6b ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE[/FONT]
[FONT=Courier New]18:46:52.0103 7744 ose - ok[/FONT]
[FONT=Courier New]18:46:52.0278 7744 [ 358a9cca612c68eb2f07ddad4ce1d8d7 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[/FONT]
[FONT=Courier New]18:46:52.0396 7744 osppsvc - ok[/FONT]
[FONT=Courier New]18:46:52.0451 7744 [ 82a8521ddc60710c3d3d3e7325209bec ] p2pimsvc C:\Windows\system32\pnrpsvc.dll[/FONT]
[FONT=Courier New]18:46:52.0456 7744 p2pimsvc - ok[/FONT]
[FONT=Courier New]18:46:52.0509 7744 [ 59c3ddd501e39e006dac31bf55150d91 ] p2psvc C:\Windows\system32\p2psvc.dll[/FONT]
[FONT=Courier New]18:46:52.0524 7744 p2psvc - ok[/FONT]
[FONT=Courier New]18:46:52.0566 7744 [ 2ea877ed5dd9713c5ac74e8ea7348d14 ] Parport C:\Windows\system32\DRIVERS\parport.sys[/FONT]
[FONT=Courier New]18:46:52.0568 7744 Parport - ok[/FONT]
[FONT=Courier New]18:46:52.0590 7744 Partizan - ok[/FONT]
[FONT=Courier New]18:46:52.0621 7744 [ 3f34a1b4c5f6475f320c275e63afce9b ] partmgr C:\Windows\system32\drivers\partmgr.sys[/FONT]
[FONT=Courier New]18:46:52.0623 7744 partmgr - ok[/FONT]
[FONT=Courier New]18:46:52.0639 7744 [ eb0a59f29c19b86479d36b35983daadc ] Parvdm C:\Windows\system32\DRIVERS\parvdm.sys[/FONT]
[FONT=Courier New]18:46:52.0640 7744 Parvdm - ok[/FONT]
[FONT=Courier New]18:46:52.0659 7744 [ 358ab7956d3160000726574083dfc8a6 ] PcaSvc C:\Windows\System32\pcasvc.dll[/FONT]
[FONT=Courier New]18:46:52.0664 7744 PcaSvc - ok[/FONT]
[FONT=Courier New]18:46:52.0733 7744 [ 92fddbed716bf5c3cb766101563cfce5 ] PCDSRVC{E9D79540-57D5953E-06020101}_0 c:\program files\dell support center\pcdsrvc.pkms[/FONT]
[FONT=Courier New]18:46:52.0738 7744 PCDSRVC{E9D79540-57D5953E-06020101}_0 - ok[/FONT]
[FONT=Courier New]18:46:52.0776 7744 [ 673e55c3498eb970088e812ea820aa8f ] pci C:\Windows\system32\drivers\pci.sys[/FONT]
[FONT=Courier New]18:46:52.0778 7744 pci - ok[/FONT]
[FONT=Courier New]18:46:52.0811 7744 [ afe86f419014db4e5593f69ffe26ce0a ] pciide C:\Windows\system32\drivers\pciide.sys[/FONT]
[FONT=Courier New]18:46:52.0812 7744 pciide - ok[/FONT]
[FONT=Courier New]18:46:52.0832 7744 [ f396431b31693e71e8a80687ef523506 ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys[/FONT]
[FONT=Courier New]18:46:52.0835 7744 pcmcia - ok[/FONT]
[FONT=Courier New]18:46:52.0849 7744 [ 250f6b43d2b613172035c6747aeeb19f ] pcw C:\Windows\system32\drivers\pcw.sys[/FONT]
[FONT=Courier New]18:46:52.0850 7744 pcw - ok[/FONT]
[FONT=Courier New]18:46:52.0877 7744 [ 9e0104ba49f4e6973749a02bf41344ed ] PEAUTH C:\Windows\system32\drivers\peauth.sys[/FONT]
[FONT=Courier New]18:46:52.0894 7744 PEAUTH - ok[/FONT]
[FONT=Courier New]18:46:52.0972 7744 [ af4d64d2a57b9772cf3801950b8058a6 ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll[/FONT]
[FONT=Courier New]18:46:53.0006 7744 PeerDistSvc - ok[/FONT]
[FONT=Courier New]18:46:53.0121 7744 [ 414bba67a3ded1d28437eb66aeb8a720 ] pla C:\Windows\system32\pla.dll[/FONT]
[FONT=Courier New]18:46:53.0163 7744 pla - ok[/FONT]
[FONT=Courier New]18:46:53.0200 7744 [ 2aba2f545b35f9c6cc2cfc4e1d539a80 ] PLCNDIS5 C:\Windows\system32\PLCNDIS5.SYS[/FONT]
[FONT=Courier New]18:46:53.0212 7744 PLCNDIS5 - ok[/FONT]
[FONT=Courier New]18:46:53.0265 7744 [ ec7bc28d207da09e79b3e9faf8b232ca ] PlugPlay C:\Windows\system32\umpnpmgr.dll[/FONT]
[FONT=Courier New]18:46:53.0275 7744 PlugPlay - ok[/FONT]
[FONT=Courier New]18:46:53.0285 7744 [ 63ff8572611249931eb16bb8eed6afc8 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll[/FONT]
[FONT=Courier New]18:46:53.0288 7744 PNRPAutoReg - ok[/FONT]
[FONT=Courier New]18:46:53.0309 7744 [ 82a8521ddc60710c3d3d3e7325209bec ] PNRPsvc C:\Windows\system32\pnrpsvc.dll[/FONT]
[FONT=Courier New]18:46:53.0312 7744 PNRPsvc - ok[/FONT]
[FONT=Courier New]18:46:53.0373 7744 [ 896d916de06f5502d301e8c4dc442ae8 ] Point32 C:\Windows\system32\DRIVERS\point32.sys[/FONT]
[FONT=Courier New]18:46:53.0375 7744 Point32 - ok[/FONT]
[FONT=Courier New]18:46:53.0392 7744 [ 53946b69ba0836bd95b03759530c81ec ] PolicyAgent C:\Windows\System32\ipsecsvc.dll[/FONT]
[FONT=Courier New]18:46:53.0397 7744 PolicyAgent - ok[/FONT]
[FONT=Courier New]18:46:53.0445 7744 [ f87d30e72e03d579a5199ccb3831d6ea ] Power C:\Windows\system32\umpo.dll[/FONT]
[FONT=Courier New]18:46:53.0449 7744 Power - ok[/FONT]
[FONT=Courier New]18:46:53.0491 7744 [ 631e3e205ad6d86f2aed6a4a8e69f2db ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys[/FONT]
[FONT=Courier New]18:46:53.0493 7744 PptpMiniport - ok[/FONT]
[FONT=Courier New]18:46:53.0506 7744 [ 85b1e3a0c7585bc4aae6899ec6fcf011 ] Processor C:\Windows\system32\DRIVERS\processr.sys[/FONT]
[FONT=Courier New]18:46:53.0508 7744 Processor - ok[/FONT]
[FONT=Courier New]18:46:53.0585 7744 [ cadefac453040e370a1bdff3973be00d ] ProfSvc C:\Windows\system32\profsvc.dll[/FONT]
[FONT=Courier New]18:46:53.0589 7744 ProfSvc - ok[/FONT]
[FONT=Courier New]18:46:53.0599 7744 [ 81951f51e318aecc2d68559e47485cc4 ] ProtectedStorage C:\Windows\system32\lsass.exe[/FONT]
[FONT=Courier New]18:46:53.0601 7744 ProtectedStorage - ok[/FONT]
[FONT=Courier New]18:46:53.0644 7744 [ 6270ccae2a86de6d146529fe55b3246a ] Psched C:\Windows\system32\DRIVERS\pacer.sys[/FONT]
[FONT=Courier New]18:46:53.0647 7744 Psched - ok[/FONT]
[FONT=Courier New]18:46:53.0694 7744 [ e7483be1e7a6fb16fc9ad6b54f99dee4 ] PSI_SVC_2 c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[/FONT]
[FONT=Courier New]18:46:53.0697 7744 PSI_SVC_2 - ok[/FONT]
[FONT=Courier New]18:46:53.0734 7744 [ 153d02480a0a2f45785522e814c634b6 ] PxHelp20 C:\Windows\system32\Drivers\PxHelp20.sys[/FONT]
[FONT=Courier New]18:46:53.0736 7744 PxHelp20 - ok[/FONT]
[FONT=Courier New]18:46:53.0774 7744 [ ab95ecf1f6659a60ddc166d8315b0751 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys[/FONT]
[FONT=Courier New]18:46:53.0809 7744 ql2300 - ok[/FONT]
[FONT=Courier New]18:46:53.0841 7744 [ b4dd51dd25182244b86737dc51af2270 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys[/FONT]
[FONT=Courier New]18:46:53.0843 7744 ql40xx - ok[/FONT]
[FONT=Courier New]18:46:53.0902 7744 [ 31ac809e7707eb580b2bdb760390765a ] QWAVE C:\Windows\system32\qwave.dll[/FONT]
[FONT=Courier New]18:46:53.0907 7744 QWAVE - ok[/FONT]
[FONT=Courier New]18:46:53.0918 7744 [ 584078ca1b95ca72df2a27c336f9719d ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys[/FONT]
[FONT=Courier New]18:46:53.0919 7744 QWAVEdrv - ok[/FONT]
[FONT=Courier New]18:46:53.0936 7744 [ 30a81b53c766d0133bb86d234e5556ab ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys[/FONT]
[FONT=Courier New]18:46:53.0938 7744 RasAcd - ok[/FONT]
[FONT=Courier New]18:46:53.0979 7744 [ 57ec4aef73660166074d8f7f31c0d4fd ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys[/FONT]
[FONT=Courier New]18:46:53.0981 7744 RasAgileVpn - ok[/FONT]
[FONT=Courier New]18:46:54.0024 7744 [ a60f1839849c0c00739787fd5ec03f13 ] RasAuto C:\Windows\System32\rasauto.dll[/FONT]
[FONT=Courier New]18:46:54.0027 7744 RasAuto - ok[/FONT]
[FONT=Courier New]18:46:54.0052 7744 [ d9f91eafec2815365cbe6d167e4e332a ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys[/FONT]
[FONT=Courier New]18:46:54.0054 7744 Rasl2tp - ok[/FONT]
[FONT=Courier New]18:46:54.0106 7744 [ cb9e04dc05eacf5b9a36ca276d475006 ] RasMan C:\Windows\System32\rasmans.dll[/FONT]
[FONT=Courier New]18:46:54.0116 7744 RasMan - ok[/FONT]
[FONT=Courier New]18:46:54.0133 7744 [ 0fe8b15916307a6ac12bfb6a63e45507 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys[/FONT]
[FONT=Courier New]18:46:54.0135 7744 RasPppoe - ok[/FONT]
[FONT=Courier New]18:46:54.0151 7744 [ 44101f495a83ea6401d886e7fd70096b ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys[/FONT]
[FONT=Courier New]18:46:54.0153 7744 RasSstp - ok[/FONT]
[FONT=Courier New]18:46:54.0190 7744 [ d528bc58a489409ba40334ebf96a311b ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys[/FONT]
[FONT=Courier New]18:46:54.0194 7744 rdbss - ok[/FONT]
[FONT=Courier New]18:46:54.0205 7744 [ 0d8f05481cb76e70e1da06ee9f0da9df ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys[/FONT]
[FONT=Courier New]18:46:54.0206 7744 rdpbus - ok[/FONT]
[FONT=Courier New]18:46:54.0244 7744 [ 23dae03f29d253ae74c44f99e515f9a1 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys[/FONT]
[FONT=Courier New]18:46:54.0254 7744 RDPCDD - ok[/FONT]
[FONT=Courier New]18:46:54.0296 7744 [ b973fcfc50dc1434e1970a146f7e3885 ] RDPDR C:\Windows\system32\drivers\rdpdr.sys[/FONT]
[FONT=Courier New]18:46:54.0299 7744 RDPDR - ok[/FONT]
[FONT=Courier New]18:46:54.0341 7744 [ 5a53ca1598dd4156d44196d200c94b8a ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys[/FONT]
[FONT=Courier New]18:46:54.0343 7744 RDPENCDD - ok[/FONT]
[FONT=Courier New]18:46:54.0376 7744 [ 44b0a53cd4f27d50ed461dae0c0b4e1f ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys[/FONT]
[FONT=Courier New]18:46:54.0378 7744 RDPREFMP - ok[/FONT]
[FONT=Courier New]18:46:54.0430 7744 [ 68a0387f58e226deee23d9715955572a ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys[/FONT]
[FONT=Courier New]18:46:54.0432 7744 RdpVideoMiniport - ok[/FONT]
[FONT=Courier New]18:46:54.0473 7744 [ f031683e6d1fea157abb2ff260b51e61 ] RDPWD C:\Windows\system32\drivers\RDPWD.sys[/FONT]
[FONT=Courier New]18:46:54.0476 7744 RDPWD - ok[/FONT]
[FONT=Courier New]18:46:54.0530 7744 [ 518395321dc96fe2c9f0e96ac743b656 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys[/FONT]
[FONT=Courier New]18:46:54.0533 7744 rdyboost - ok[/FONT]
[FONT=Courier New]18:46:54.0572 7744 [ 7b5e1419717fac363a31cc302895217a ] RemoteAccess C:\Windows\System32\mprdim.dll[/FONT]
[FONT=Courier New]18:46:54.0575 7744 RemoteAccess - ok[/FONT]
[FONT=Courier New]18:46:54.0620 7744 [ cb9a8683f4ef2bf99e123d79950d7935 ] RemoteRegistry C:\Windows\system32\regsvc.dll[/FONT]
[FONT=Courier New]18:46:54.0624 7744 RemoteRegistry - ok[/FONT]
[FONT=Courier New]18:46:54.0685 7744 [ cb928d9e6daf51879dd6ba8d02f01321 ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys[/FONT]
[FONT=Courier New]18:46:54.0694 7744 RFCOMM - ok[/FONT]
[FONT=Courier New]18:46:54.0741 7744 [ f17713d108aca124a139fde877eef68a ] RimUsb C:\Windows\system32\Drivers\RimUsb.sys[/FONT]
[FONT=Courier New]18:46:54.0743 7744 RimUsb - ok[/FONT]
[FONT=Courier New]18:46:54.0758 7744 [ 2c4fb2e9f039287767c384e46ee91030 ] RimVSerPort C:\Windows\system32\DRIVERS\RimSerial.sys[/FONT]
[FONT=Courier New]18:46:54.0759 7744 RimVSerPort - ok[/FONT]
 
[FONT=Courier New]18:46:54.0809 7744 [ 564297827d213f52c7a3a2ff749568ca ] ROOTMODEM C:\Windows\system32\Drivers\RootMdm.sys[/FONT]
[FONT=Courier New]18:46:54.0823 7744 ROOTMODEM - ok[/FONT]
[FONT=Courier New]18:46:54.0940 7744 [ afd61a7c48a3e15c86a6fadf0b69a2e4 ] Roxio UPnP Renderer 9 C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe[/FONT]
[FONT=Courier New]18:46:54.0951 7744 Roxio UPnP Renderer 9 - ok[/FONT]
[FONT=Courier New]18:46:54.0965 7744 [ efbb36e2bb02169d26e9980778fc20d3 ] Roxio Upnp Server 9 C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe[/FONT]
[FONT=Courier New]18:46:54.0970 7744 Roxio Upnp Server 9 - ok[/FONT]
[FONT=Courier New]18:46:55.0110 7744 [ 78e680a105f47b6aa0003bd23ed9fa51 ] RoxLiveShare9 C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe[/FONT]
[FONT=Courier New]18:46:55.0115 7744 RoxLiveShare9 - ok[/FONT]
[FONT=Courier New]18:46:55.0169 7744 [ 9d5c024170c376d7cc66ed853fda9068 ] RoxMediaDB9 C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe[/FONT]
[FONT=Courier New]18:46:55.0203 7744 RoxMediaDB9 - ok[/FONT]
[FONT=Courier New]18:46:55.0267 7744 [ 87f175539dbba297018aa7fcdd563ff7 ] RoxWatch9 C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe[/FONT]
[FONT=Courier New]18:46:55.0275 7744 RoxWatch9 - ok[/FONT]
[FONT=Courier New]18:46:55.0330 7744 [ 78d072f35bc45d9e4e1b61895c152234 ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll[/FONT]
[FONT=Courier New]18:46:55.0334 7744 RpcEptMapper - ok[/FONT]
[FONT=Courier New]18:46:55.0371 7744 [ 94d36c0e44677dd26981d2bfeef2a29d ] RpcLocator C:\Windows\system32\locator.exe[/FONT]
[FONT=Courier New]18:46:55.0374 7744 RpcLocator - ok[/FONT]
[FONT=Courier New]18:46:55.0412 7744 [ 7660f01d3b38aca1747e397d21d790af ] RpcSs C:\Windows\system32\rpcss.dll[/FONT]
[FONT=Courier New]18:46:55.0417 7744 RpcSs - ok[/FONT]
[FONT=Courier New]18:46:55.0473 7744 [ fd692c6ffade58f7c4c3c3c9a0ec35bd ] RsFx0103 C:\Windows\system32\DRIVERS\RsFx0103.sys[/FONT]
[FONT=Courier New]18:46:55.0476 7744 RsFx0103 - ok[/FONT]
[FONT=Courier New]18:46:55.0527 7744 [ 032b0d36ad92b582d869879f5af5b928 ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys[/FONT]
[FONT=Courier New]18:46:55.0529 7744 rspndr - ok[/FONT]
[FONT=Courier New]18:46:55.0565 7744 [ 7fa7f2e249a5dcbb7970630e15e1f482 ] s3cap C:\Windows\system32\drivers\vms3cap.sys[/FONT]
[FONT=Courier New]18:46:55.0567 7744 s3cap - ok[/FONT]
[FONT=Courier New]18:46:55.0583 7744 [ 81951f51e318aecc2d68559e47485cc4 ] SamSs C:\Windows\system32\lsass.exe[/FONT]
[FONT=Courier New]18:46:55.0585 7744 SamSs - ok[/FONT]
[FONT=Courier New]18:46:55.0666 7744 [ 361094945053c2c04312ef2e5f14eeaf ] SANDRA C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2009.SP3c\WNt500x86\Sandra.sys[/FONT]
[FONT=Courier New]18:46:55.0668 7744 SANDRA - ok[/FONT]
[FONT=Courier New]18:46:55.0684 7744 [ 201c4ca2beb6152b0238dea13f9ee85d ] SandraAgentSrv C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2009.SP3c\RpcAgentSrv.exe[/FONT]
[FONT=Courier New]18:46:55.0686 7744 SandraAgentSrv - ok[/FONT]
[FONT=Courier New]18:46:55.0727 7744 [ 39763504067962108505bff25f024345 ] SASDIFSV C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS[/FONT]
[FONT=Courier New]18:46:55.0729 7744 SASDIFSV - ok[/FONT]
[FONT=Courier New]18:46:55.0774 7744 [ 77b9fc20084b48408ad3e87570eb4a85 ] SASKUTIL C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS[/FONT]
[FONT=Courier New]18:46:55.0775 7744 SASKUTIL - ok[/FONT]
[FONT=Courier New]18:46:55.0818 7744 [ 05d860da1040f111503ac416ccef2bca ] sbp2port C:\Windows\system32\drivers\sbp2port.sys[/FONT]
[FONT=Courier New]18:46:55.0820 7744 sbp2port - ok[/FONT]
[FONT=Courier New]18:46:55.0917 7744 [ 794d4b48dfb6e999537c7c3947863463 ] SBSDWSCService C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe[/FONT]
[FONT=Courier New]18:46:55.0931 7744 SBSDWSCService - ok[/FONT]
[FONT=Courier New]18:46:55.0976 7744 [ 8fc518ffe9519c2631d37515a68009c4 ] SCardSvr C:\Windows\System32\SCardSvr.dll[/FONT]
[FONT=Courier New]18:46:55.0981 7744 SCardSvr - ok[/FONT]
[FONT=Courier New]18:46:56.0022 7744 [ 0693b5ec673e34dc147e195779a4dcf6 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys[/FONT]
[FONT=Courier New]18:46:56.0023 7744 scfilter - ok[/FONT]
[FONT=Courier New]18:46:56.0070 7744 [ a04bb13f8a72f8b6e8b4071723e4e336 ] Schedule C:\Windows\system32\schedsvc.dll[/FONT]
[FONT=Courier New]18:46:56.0113 7744 Schedule - ok[/FONT]
[FONT=Courier New]18:46:56.0149 7744 [ 319c6b309773d063541d01df8ac6f55f ] SCPolicySvc C:\Windows\System32\certprop.dll[/FONT]
[FONT=Courier New]18:46:56.0150 7744 SCPolicySvc - ok[/FONT]
[FONT=Courier New]18:46:56.0192 7744 [ 08236c4bce5edd0a0318a438af28e0f7 ] SDRSVC C:\Windows\System32\SDRSVC.dll[/FONT]
[FONT=Courier New]18:46:56.0196 7744 SDRSVC - ok[/FONT]
[FONT=Courier New]18:46:56.0249 7744 [ 90a3935d05b494a5a39d37e71f09a677 ] secdrv C:\Windows\system32\drivers\secdrv.sys[/FONT]
[FONT=Courier New]18:46:56.0251 7744 secdrv - ok[/FONT]
[FONT=Courier New]18:46:56.0266 7744 [ a59b3a4442c52060cc7a85293aa3546f ] seclogon C:\Windows\system32\seclogon.dll[/FONT]
[FONT=Courier New]18:46:56.0269 7744 seclogon - ok[/FONT]
[FONT=Courier New]18:46:56.0327 7744 [ dcb7fcdcc97f87360f75d77425b81737 ] SENS C:\Windows\system32\sens.dll[/FONT]
[FONT=Courier New]18:46:56.0330 7744 SENS - ok[/FONT]
[FONT=Courier New]18:46:56.0364 7744 [ 50087fe1ee447009c9cc2997b90de53f ] SensrSvc C:\Windows\system32\sensrsvc.dll[/FONT]
[FONT=Courier New]18:46:56.0367 7744 SensrSvc - ok[/FONT]
[FONT=Courier New]18:46:56.0381 7744 [ 9ad8b8b515e3df6acd4212ef465de2d1 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys[/FONT]
[FONT=Courier New]18:46:56.0383 7744 Serenum - ok[/FONT]
[FONT=Courier New]18:46:56.0397 7744 [ 5fb7fcea0490d821f26f39cc5ea3d1e2 ] Serial C:\Windows\system32\DRIVERS\serial.sys[/FONT]
[FONT=Courier New]18:46:56.0399 7744 Serial - ok[/FONT]
[FONT=Courier New]18:46:56.0439 7744 [ 79bffb520327ff916a582dfea17aa813 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys[/FONT]
[FONT=Courier New]18:46:56.0452 7744 sermouse - ok[/FONT]
[FONT=Courier New]18:46:56.0505 7744 [ 4ae380f39a0032eab7dd953030b26d28 ] SessionEnv C:\Windows\system32\sessenv.dll[/FONT]
[FONT=Courier New]18:46:56.0509 7744 SessionEnv - ok[/FONT]
[FONT=Courier New]18:46:56.0545 7744 [ 9f976e1eb233df46fce808d9dea3eb9c ] sffdisk C:\Windows\system32\drivers\sffdisk.sys[/FONT]
[FONT=Courier New]18:46:56.0546 7744 sffdisk - ok[/FONT]
[FONT=Courier New]18:46:56.0561 7744 [ 932a68ee27833cfd57c1639d375f2731 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys[/FONT]
[FONT=Courier New]18:46:56.0563 7744 sffp_mmc - ok[/FONT]
[FONT=Courier New]18:46:56.0575 7744 [ 6d4ccaedc018f1cf52866bbbaa235982 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys[/FONT]
[FONT=Courier New]18:46:56.0576 7744 sffp_sd - ok[/FONT]
[FONT=Courier New]18:46:56.0595 7744 [ db96666cc8312ebc45032f30b007a547 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys[/FONT]
[FONT=Courier New]18:46:56.0596 7744 sfloppy - ok[/FONT]
[FONT=Courier New]18:46:56.0658 7744 [ d1a079a0de2ea524513b6930c24527a2 ] SharedAccess C:\Windows\System32\ipnathlp.dll[/FONT]
[FONT=Courier New]18:46:56.0663 7744 SharedAccess - ok[/FONT]
[FONT=Courier New]18:46:56.0718 7744 [ 414da952a35bf5d50192e28263b40577 ] ShellHWDetection C:\Windows\System32\shsvcs.dll[/FONT]
[FONT=Courier New]18:46:56.0736 7744 ShellHWDetection - ok[/FONT]
[FONT=Courier New]18:46:56.0781 7744 [ 3ead8e1668ce42a0afe41d56e7157bcf ] silabenm C:\Windows\system32\DRIVERS\silabenm.sys[/FONT]
[FONT=Courier New]18:46:56.0782 7744 silabenm - ok[/FONT]
[FONT=Courier New]18:46:56.0822 7744 [ 177d3ebf3e236a272d769c14f73ecc3e ] silabser C:\Windows\system32\DRIVERS\silabser.sys[/FONT]
[FONT=Courier New]18:46:56.0824 7744 silabser - ok[/FONT]
[FONT=Courier New]18:46:56.0857 7744 [ 2565cac0dc9fe0371bdce60832582b2e ] sisagp C:\Windows\system32\drivers\sisagp.sys[/FONT]
[FONT=Courier New]18:46:56.0859 7744 sisagp - ok[/FONT]
[FONT=Courier New]18:46:56.0902 7744 [ a9f0486851becb6dda1d89d381e71055 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys[/FONT]
[FONT=Courier New]18:46:56.0903 7744 SiSRaid2 - ok[/FONT]
[FONT=Courier New]18:46:56.0917 7744 [ 3727097b55738e2f554972c3be5bc1aa ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys[/FONT]
[FONT=Courier New]18:46:56.0919 7744 SiSRaid4 - ok[/FONT]
[FONT=Courier New]18:46:57.0005 7744 [ f07af60b152221472fbdb2fecec4896d ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe[/FONT]
[FONT=Courier New]18:46:57.0008 7744 SkypeUpdate - ok[/FONT]
[FONT=Courier New]18:46:57.0087 7744 [ 0973bd0931bf4d0dfb1885bd464e9766 ] SlingAgentService C:\Program Files\Sling Media\SlingAgent\SlingAgentService.exe[/FONT]
[FONT=Courier New]18:46:57.0089 7744 SlingAgentService - ok[/FONT]
[FONT=Courier New]18:46:57.0132 7744 [ 3e21c083b8a01cb70ba1f09303010fce ] Smb C:\Windows\system32\DRIVERS\smb.sys[/FONT]
[FONT=Courier New]18:46:57.0134 7744 Smb - ok[/FONT]
[FONT=Courier New]18:46:57.0189 7744 [ 85bada660d57bc5aef52b11cabd6d8f9 ] snapman C:\Windows\system32\DRIVERS\snapman.sys[/FONT]
[FONT=Courier New]18:46:57.0192 7744 snapman - ok[/FONT]
[FONT=Courier New]18:46:57.0238 7744 [ 6a984831644eca1a33ffeae4126f4f37 ] SNMPTRAP C:\Windows\System32\snmptrap.exe[/FONT]
[FONT=Courier New]18:46:57.0241 7744 SNMPTRAP - ok[/FONT]
[FONT=Courier New]18:46:57.0280 7744 [ 95cf1ae7527fb70f7816563cbc09d942 ] spldr C:\Windows\system32\drivers\spldr.sys[/FONT]
[FONT=Courier New]18:46:57.0288 7744 spldr - ok[/FONT]
[FONT=Courier New]18:46:57.0340 7744 [ 9aea093b8f9c37cf45538382caba2475 ] Spooler C:\Windows\System32\spoolsv.exe[/FONT]
[FONT=Courier New]18:46:57.0346 7744 Spooler - ok[/FONT]
[FONT=Courier New]18:46:57.0436 7744 [ cf87a1de791347e75b98885214ced2b8 ] sppsvc C:\Windows\system32\sppsvc.exe[/FONT]
[FONT=Courier New]18:46:57.0506 7744 sppsvc - ok[/FONT]
[FONT=Courier New]18:46:57.0544 7744 [ b0180b20b065d89232a78a40fe56eaa6 ] sppuinotify C:\Windows\system32\sppuinotify.dll[/FONT]
[FONT=Courier New]18:46:57.0547 7744 sppuinotify - ok[/FONT]
[FONT=Courier New]18:46:57.0628 7744 [ cdddec541bc3c96f91ecb48759673505 ] sptd C:\Windows\system32\Drivers\sptd.sys[/FONT]
[FONT=Courier New]18:46:57.0628 7744 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505[/FONT]
[FONT=Courier New]18:46:57.0630 7744 sptd ( LockedFile.Multi.Generic ) - warning[/FONT]
[FONT=Courier New]18:46:57.0630 7744 sptd - detected LockedFile.Multi.Generic (1)[/FONT]
[FONT=Courier New]18:46:57.0693 7744 [ a687b5b326afcfcf182c4931d1ff9771 ] SQLAgent$MICROSOFTSCM c:\Program Files\Microsoft SQL Server\MSSQL10.MICROSOFTSCM\MSSQL\Binn\SQLAGENT.EXE[/FONT]
[FONT=Courier New]18:46:57.0698 7744 SQLAgent$MICROSOFTSCM - ok[/FONT]
[FONT=Courier New]18:46:57.0774 7744 [ b54b48f6d92423440c264e91225c5ff1 ] SQLBrowser c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[/FONT]
[FONT=Courier New]18:46:57.0778 7744 SQLBrowser - ok[/FONT]
[FONT=Courier New]18:46:57.0822 7744 [ 637a0f23f9012358e92e6f99835494d1 ] SQLWriter c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[/FONT]
[FONT=Courier New]18:46:57.0824 7744 SQLWriter - ok[/FONT]
[FONT=Courier New]18:46:57.0871 7744 [ e4c2764065d66ea1d2d3ebc28fe99c46 ] srv C:\Windows\system32\DRIVERS\srv.sys[/FONT]
[FONT=Courier New]18:46:57.0884 7744 srv - ok[/FONT]
[FONT=Courier New]18:46:57.0928 7744 [ 03f0545bd8d4c77fa0ae1ceedfcc71ab ] srv2 C:\Windows\system32\DRIVERS\srv2.sys[/FONT]
[FONT=Courier New]18:46:57.0934 7744 srv2 - ok[/FONT]
[FONT=Courier New]18:46:57.0972 7744 [ be6bd660caa6f291ae06a718a4fa8abc ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys[/FONT]
[FONT=Courier New]18:46:57.0975 7744 srvnet - ok[/FONT]
[FONT=Courier New]18:46:58.0020 7744 [ d887c9fd02ac9fa880f6e5027a43e118 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll[/FONT]
[FONT=Courier New]18:46:58.0024 7744 SSDPSRV - ok[/FONT]
[FONT=Courier New]18:46:58.0038 7744 [ d318f23be45d5e3a107469eb64815b50 ] SstpSvc C:\Windows\system32\sstpsvc.dll[/FONT]
[FONT=Courier New]18:46:58.0042 7744 SstpSvc - ok[/FONT]
[FONT=Courier New]18:46:58.0134 7744 [ b1691af4a072cb674d600db16dd7308e ] StarWindServiceAE C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe[/FONT]
[FONT=Courier New]18:46:58.0138 7744 StarWindServiceAE - ok[/FONT]
[FONT=Courier New]18:46:58.0182 7744 [ db32d325c192b801df274bfd12a7e72b ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys[/FONT]
[FONT=Courier New]18:46:58.0183 7744 stexstor - ok[/FONT]
[FONT=Courier New]18:46:58.0227 7744 [ 167909a1c36aa3e8f2582962f0ccc748 ] STHDA C:\Windows\system32\drivers\stwrt.sys[/FONT]
[FONT=Courier New]18:46:58.0231 7744 STHDA - ok[/FONT]
[FONT=Courier New]18:46:58.0275 7744 [ e1fb3706030fb4578a0d72c2fc3689e4 ] StiSvc C:\Windows\System32\wiaservc.dll[/FONT]
[FONT=Courier New]18:46:58.0317 7744 StiSvc - ok[/FONT]
[FONT=Courier New]18:46:58.0394 7744 [ 7489520e98a119b5a9a00857f4f87d16 ] stllssvr C:\Program Files\Common Files\SureThing Shared\stllssvr.exe[/FONT]
[FONT=Courier New]18:46:58.0396 7744 stllssvr - ok[/FONT]
[FONT=Courier New]18:46:58.0430 7744 [ 472af0311073dceceaa8fa18ba2bdf89 ] storflt C:\Windows\system32\drivers\vmstorfl.sys[/FONT]
[FONT=Courier New]18:46:58.0432 7744 storflt - ok[/FONT]
[FONT=Courier New]18:46:58.0471 7744 [ dcaffd62259e0bdb433dd67b5bb37619 ] storvsc C:\Windows\system32\drivers\storvsc.sys[/FONT]
[FONT=Courier New]18:46:58.0473 7744 storvsc - ok[/FONT]
[FONT=Courier New]18:46:58.0508 7744 [ e58c78a848add9610a4db6d214af5224 ] swenum C:\Windows\system32\drivers\swenum.sys[/FONT]
[FONT=Courier New]18:46:58.0512 7744 swenum - ok[/FONT]
[FONT=Courier New]18:46:58.0557 7744 [ a28bd92df340e57b024ba433165d34d7 ] swprv C:\Windows\System32\swprv.dll[/FONT]
[FONT=Courier New]18:46:58.0563 7744 swprv - ok[/FONT]
[FONT=Courier New]18:46:58.0582 7744 Synth3dVsc - ok[/FONT]
[FONT=Courier New]18:46:58.0640 7744 [ 36650d618ca34c9d357dfd3d89b2c56f ] SysMain C:\Windows\system32\sysmain.dll[/FONT]
[FONT=Courier New]18:46:58.0683 7744 SysMain - ok[/FONT]
[FONT=Courier New]18:46:58.0708 7744 [ 763fecdc3d30c815fe72dd57936c6cd1 ] TabletInputService C:\Windows\System32\TabSvc.dll[/FONT]
[FONT=Courier New]18:46:58.0712 7744 TabletInputService - ok[/FONT]
[FONT=Courier New]18:46:58.0782 7744 [ 613bf4820361543956909043a265c6ac ] TapiSrv C:\Windows\System32\tapisrv.dll[/FONT]
[FONT=Courier New]18:46:58.0789 7744 TapiSrv - ok[/FONT]
[FONT=Courier New]18:46:58.0802 7744 [ b799d9fdb26111737f58288d8dc172d9 ] TBS C:\Windows\System32\tbssvc.dll[/FONT]
[FONT=Courier New]18:46:58.0806 7744 TBS - ok[/FONT]
[FONT=Courier New]18:46:58.0899 7744 [ 7fa2e0f8b072bd04b77b421480b6cc22 ] Tcpip C:\Windows\system32\drivers\tcpip.sys[/FONT]
[FONT=Courier New]18:46:58.0926 7744 Tcpip - ok[/FONT]
[FONT=Courier New]18:46:58.0990 7744 [ 7fa2e0f8b072bd04b77b421480b6cc22 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys[/FONT]
[FONT=Courier New]18:46:58.0998 7744 TCPIP6 - ok[/FONT]
[FONT=Courier New]18:46:59.0053 7744 [ cca24162e055c3714ce5a88b100c64ed ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys[/FONT]
[FONT=Courier New]18:46:59.0055 7744 tcpipreg - ok[/FONT]
[FONT=Courier New]18:46:59.0094 7744 [ 1cb91b2bd8f6dd367dfc2ef26fd751b2 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys[/FONT]
[FONT=Courier New]18:46:59.0095 7744 TDPIPE - ok[/FONT]
[FONT=Courier New]18:46:59.0165 7744 [ 431801fcc97034e04a6eff81136578d7 ] tdrpman273 C:\Windows\system32\DRIVERS\tdrpm273.sys[/FONT]
[FONT=Courier New]18:46:59.0183 7744 tdrpman273 - ok[/FONT]
[FONT=Courier New]18:46:59.0219 7744 [ 2c2c5afe7ee4f620d69c23c0617651a8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys[/FONT]
[FONT=Courier New]18:46:59.0221 7744 TDTCP - ok[/FONT]
[FONT=Courier New]18:46:59.0273 7744 [ b459575348c20e8121d6039da063c704 ] tdx C:\Windows\system32\DRIVERS\tdx.sys[/FONT]
[FONT=Courier New]18:46:59.0281 7744 tdx - ok[/FONT]
[FONT=Courier New]18:46:59.0419 7744 [ 8a9828975a857e477efef5a61ba45ac0 ] TeamViewer6 C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe[/FONT]
[FONT=Courier New]18:46:59.0471 7744 TeamViewer6 - ok[/FONT]
[FONT=Courier New]18:46:59.0486 7744 [ 04dbf4b01ea4bf25a9a3e84affac9b20 ] TermDD C:\Windows\system32\drivers\termdd.sys[/FONT]
[FONT=Courier New]18:46:59.0488 7744 TermDD - ok[/FONT]
[FONT=Courier New]18:46:59.0530 7744 [ 382c804c92811be57829d8e550a900e2 ] TermService C:\Windows\System32\termsrv.dll[/FONT]
[FONT=Courier New]18:46:59.0539 7744 TermService - ok[/FONT]
[FONT=Courier New]18:46:59.0573 7744 [ 42fb6afd6b79d9fe07381609172e7ca4 ] Themes C:\Windows\system32\themeservice.dll[/FONT]
[FONT=Courier New]18:46:59.0577 7744 Themes - ok[/FONT]
[FONT=Courier New]18:46:59.0587 7744 [ 146b6f43a673379a3c670e86d89be5ea ] THREADORDER C:\Windows\system32\mmcss.dll[/FONT]
[FONT=Courier New]18:46:59.0589 7744 THREADORDER - ok[/FONT]
[FONT=Courier New]18:46:59.0654 7744 [ a34d7024bb7140ec785c86bc065d4f60 ] timounter C:\Windows\system32\DRIVERS\timntr.sys[/FONT]
[FONT=Courier New]18:46:59.0671 7744 timounter - ok[/FONT]
[FONT=Courier New]18:46:59.0719 7744 [ 4792c0378db99a9bc2ae2de6cfff0c3a ] TrkWks C:\Windows\System32\trkwks.dll[/FONT]
[FONT=Courier New]18:46:59.0723 7744 TrkWks - ok[/FONT]
[FONT=Courier New]18:46:59.0781 7744 [ 2c49b175aee1d4364b91b531417fe583 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe[/FONT]
[FONT=Courier New]18:46:59.0785 7744 TrustedInstaller - ok[/FONT]
[FONT=Courier New]18:46:59.0828 7744 [ 254bb140eee3c59d6114c1a86b636877 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys[/FONT]
[FONT=Courier New]18:46:59.0829 7744 tssecsrv - ok[/FONT]
[FONT=Courier New]18:46:59.0882 7744 [ fd1d6c73e6333be727cbcc6054247654 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys[/FONT]
[FONT=Courier New]18:46:59.0884 7744 TsUsbFlt - ok[/FONT]
[FONT=Courier New]18:46:59.0889 7744 tsusbhub - ok[/FONT]
[FONT=Courier New]18:46:59.0955 7744 [ b2fa25d9b17a68bb93d58b0556e8c90d ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys[/FONT]
[FONT=Courier New]18:46:59.0957 7744 tunnel - ok[/FONT]
[FONT=Courier New]18:46:59.0987 7744 [ 750fbcb269f4d7dd2e420c56b795db6d ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys[/FONT]
[FONT=Courier New]18:46:59.0997 7744 uagp35 - ok[/FONT]
[FONT=Courier New]18:47:00.0021 7744 [ ee43346c7e4b5e63e54f927babbb32ff ] udfs C:\Windows\system32\DRIVERS\udfs.sys[/FONT]
[FONT=Courier New]18:47:00.0025 7744 udfs - ok[/FONT]
[FONT=Courier New]18:47:00.0130 7744 [ 60217ba49d2796ea149ded4d030af728 ] ufad-ws60 C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe[/FONT]
[FONT=Courier New]18:47:00.0141 7744 ufad-ws60 - ok[/FONT]
[FONT=Courier New]18:47:00.0188 7744 [ 8344fd4fce927880aa1aa7681d4927e5 ] UI0Detect C:\Windows\system32\UI0Detect.exe[/FONT]
[FONT=Courier New]18:47:00.0191 7744 UI0Detect - ok[/FONT]
[FONT=Courier New]18:47:00.0232 7744 [ 44e8048ace47befbfdc2e9be4cbc8880 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys[/FONT]
[FONT=Courier New]18:47:00.0234 7744 uliagpkx - ok[/FONT]
[FONT=Courier New]18:47:00.0304 7744 [ d295bed4b898f0fd999fcfa9b32b071b ] umbus C:\Windows\system32\DRIVERS\umbus.sys[/FONT]
[FONT=Courier New]18:47:00.0305 7744 umbus - ok[/FONT]
[FONT=Courier New]18:47:00.0323 7744 [ 7550ad0c6998ba1cb4843e920ee0feac ] UmPass C:\Windows\system32\DRIVERS\umpass.sys[/FONT]
[FONT=Courier New]18:47:00.0324 7744 UmPass - ok[/FONT]
[FONT=Courier New]18:47:00.0393 7744 [ 409994a8eaceee4e328749c0353527a0 ] UmRdpService C:\Windows\System32\umrdp.dll[/FONT]
[FONT=Courier New]18:47:00.0398 7744 UmRdpService - ok[/FONT]
[FONT=Courier New]18:47:00.0415 7744 [ 833fbb672460efce8011d262175fad33 ] upnphost C:\Windows\System32\upnphost.dll[/FONT]
[FONT=Courier New]18:47:00.0422 7744 upnphost - ok[/FONT]
[FONT=Courier New]18:47:00.0476 7744 [ eafe1e00739afe6c51487a050e772e17 ] USBAAPL C:\Windows\system32\Drivers\usbaapl.sys[/FONT]
[FONT=Courier New]18:47:00.0478 7744 USBAAPL - ok[/FONT]
[FONT=Courier New]18:47:00.0532 7744 [ 1d9f2bd026e8e2d45033a4df3f16b78c ] usbaudio C:\Windows\system32\drivers\usbaudio.sys[/FONT]
[FONT=Courier New]18:47:00.0534 7744 usbaudio - ok[/FONT]
[FONT=Courier New]18:47:00.0561 7744 [ bd9c55d7023c5de374507acc7a14e2ac ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys[/FONT]
 
[FONT=Courier New]18:47:00.0563 7744 usbccgp - ok[/FONT]
[FONT=Courier New]18:47:00.0580 7744 [ 04ec7cec62ec3b6d9354eee93327fc82 ] usbcir C:\Windows\system32\drivers\usbcir.sys[/FONT]
[FONT=Courier New]18:47:00.0582 7744 usbcir - ok[/FONT]
[FONT=Courier New]18:47:00.0601 7744 [ f92de757e4b7ce9c07c5e65423f3ae3b ] usbehci C:\Windows\system32\drivers\usbehci.sys[/FONT]
[FONT=Courier New]18:47:00.0603 7744 usbehci - ok[/FONT]
[FONT=Courier New]18:47:00.0618 7744 [ 8dc94aec6a7e644a06135ae7506dc2e9 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys[/FONT]
[FONT=Courier New]18:47:00.0623 7744 usbhub - ok[/FONT]
[FONT=Courier New]18:47:00.0662 7744 [ e185d44fac515a18d9deddc23c2cdf44 ] usbohci C:\Windows\system32\drivers\usbohci.sys[/FONT]
[FONT=Courier New]18:47:00.0678 7744 usbohci - ok[/FONT]
[FONT=Courier New]18:47:00.0734 7744 [ 797d862fe0875e75c7cc4c1ad7b30252 ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys[/FONT]
[FONT=Courier New]18:47:00.0752 7744 usbprint - ok[/FONT]
[FONT=Courier New]18:47:00.0804 7744 [ 576096ccbc07e7c4ea4f5e6686d6888f ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys[/FONT]
[FONT=Courier New]18:47:00.0806 7744 usbscan - ok[/FONT]
[FONT=Courier New]18:47:00.0843 7744 [ f991ab9cc6b908db552166768176896a ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS[/FONT]
[FONT=Courier New]18:47:00.0852 7744 USBSTOR - ok[/FONT]
[FONT=Courier New]18:47:00.0871 7744 [ 68df884cf41cdada664beb01daf67e3d ] usbuhci C:\Windows\system32\drivers\usbuhci.sys[/FONT]
[FONT=Courier New]18:47:00.0872 7744 usbuhci - ok[/FONT]
[FONT=Courier New]18:47:00.0912 7744 [ 081e6e1c91aec36758902a9f727cd23c ] UxSms C:\Windows\System32\uxsms.dll[/FONT]
[FONT=Courier New]18:47:00.0922 7744 UxSms - ok[/FONT]
[FONT=Courier New]18:47:00.0938 7744 [ 81951f51e318aecc2d68559e47485cc4 ] VaultSvc C:\Windows\system32\lsass.exe[/FONT]
[FONT=Courier New]18:47:00.0940 7744 VaultSvc - ok[/FONT]
[FONT=Courier New]18:47:00.0991 7744 [ a059c4c3edb09e07d21a8e5c0aabd3cb ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys[/FONT]
[FONT=Courier New]18:47:00.0993 7744 vdrvroot - ok[/FONT]
[FONT=Courier New]18:47:01.0056 7744 [ c3cd30495687c2a2f66a65ca6fd89be9 ] vds C:\Windows\System32\vds.exe[/FONT]
[FONT=Courier New]18:47:01.0073 7744 vds - ok[/FONT]
[FONT=Courier New]18:47:01.0113 7744 [ 17c408214ea61696cec9c66e388b14f3 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys[/FONT]
[FONT=Courier New]18:47:01.0114 7744 vga - ok[/FONT]
[FONT=Courier New]18:47:01.0130 7744 [ 8e38096ad5c8570a6f1570a61e251561 ] VgaSave C:\Windows\System32\drivers\vga.sys[/FONT]
[FONT=Courier New]18:47:01.0131 7744 VgaSave - ok[/FONT]
[FONT=Courier New]18:47:01.0136 7744 VGPU - ok[/FONT]
[FONT=Courier New]18:47:01.0153 7744 [ 5461686cca2fda57b024547733ab42e3 ] vhdmp C:\Windows\system32\drivers\vhdmp.sys[/FONT]
[FONT=Courier New]18:47:01.0156 7744 vhdmp - ok[/FONT]
[FONT=Courier New]18:47:01.0197 7744 [ c829317a37b4bea8f39735d4b076e923 ] viaagp C:\Windows\system32\drivers\viaagp.sys[/FONT]
[FONT=Courier New]18:47:01.0199 7744 viaagp - ok[/FONT]
[FONT=Courier New]18:47:01.0229 7744 [ e02f079a6aa107f06b16549c6e5c7b74 ] ViaC7 C:\Windows\system32\DRIVERS\viac7.sys[/FONT]
[FONT=Courier New]18:47:01.0230 7744 ViaC7 - ok[/FONT]
[FONT=Courier New]18:47:01.0268 7744 [ e43574f6a56a0ee11809b48c09e4fd3c ] viaide C:\Windows\system32\drivers\viaide.sys[/FONT]
[FONT=Courier New]18:47:01.0269 7744 viaide - ok[/FONT]
[FONT=Courier New]18:47:01.0311 7744 [ 54405be685c69db2f105dacd0979f02c ] VMAuthdService C:\Program Files\VMware\VMware Workstation\vmware-authd.exe[/FONT]
[FONT=Courier New]18:47:01.0313 7744 VMAuthdService - ok[/FONT]
[FONT=Courier New]18:47:01.0331 7744 [ c2f2911156fdc7817c52829c86da494e ] vmbus C:\Windows\system32\drivers\vmbus.sys[/FONT]
[FONT=Courier New]18:47:01.0334 7744 vmbus - ok[/FONT]
[FONT=Courier New]18:47:01.0345 7744 [ d4d77455211e204f370d08f4963063ce ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys[/FONT]
[FONT=Courier New]18:47:01.0346 7744 VMBusHID - ok[/FONT]
[FONT=Courier New]18:47:01.0378 7744 [ bf327b6ae50c0d5d1cc7aa49cf56c9f3 ] vmci C:\Windows\system32\Drivers\vmci.sys[/FONT]
[FONT=Courier New]18:47:01.0380 7744 vmci - ok[/FONT]
[FONT=Courier New]18:47:01.0412 7744 [ 47755d44592212c8e609b0bb36227a4b ] vmkbd C:\Windows\system32\drivers\VMkbd.sys[/FONT]
[FONT=Courier New]18:47:01.0416 7744 vmkbd - ok[/FONT]
[FONT=Courier New]18:47:01.0457 7744 [ 5692cbd2a25e04c62707bfc311884b65 ] VMnetBridge C:\Windows\system32\DRIVERS\vmnetbridge.sys[/FONT]
[FONT=Courier New]18:47:01.0458 7744 VMnetBridge - ok[/FONT]
[FONT=Courier New]18:47:01.0492 7744 [ 94b88227432c3b8c7e2bc1c9199adfd2 ] VMnetDHCP C:\Windows\system32\vmnetdhcp.exe[/FONT]
[FONT=Courier New]18:47:01.0498 7744 VMnetDHCP - ok[/FONT]
[FONT=Courier New]18:47:01.0512 7744 [ 6a1b3f7d9e25929fd42712ab80aebf62 ] VMnetuserif C:\Windows\system32\drivers\vmnetuserif.sys[/FONT]
[FONT=Courier New]18:47:01.0513 7744 VMnetuserif - ok[/FONT]
[FONT=Courier New]18:47:01.0576 7744 [ a50ba461a8b81ab21fb206b8b0c6fb0e ] VMware NAT Service C:\Windows\system32\vmnat.exe[/FONT]
[FONT=Courier New]18:47:01.0593 7744 VMware NAT Service - ok[/FONT]
[FONT=Courier New]18:47:01.0621 7744 [ 925faad003f782057f1e0eea0797900e ] vmx86 C:\Windows\system32\Drivers\vmx86.sys[/FONT]
[FONT=Courier New]18:47:01.0632 7744 vmx86 - ok[/FONT]
[FONT=Courier New]18:47:01.0649 7744 [ 4c63e00f2f4b5f86ab48a58cd990f212 ] volmgr C:\Windows\system32\drivers\volmgr.sys[/FONT]
[FONT=Courier New]18:47:01.0651 7744 volmgr - ok[/FONT]
[FONT=Courier New]18:47:01.0688 7744 [ b5bb72067ddddbbfb04b2f89ff8c3c87 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys[/FONT]
[FONT=Courier New]18:47:01.0692 7744 volmgrx - ok[/FONT]
[FONT=Courier New]18:47:01.0707 7744 [ f497f67932c6fa693d7de2780631cfe7 ] volsnap C:\Windows\system32\drivers\volsnap.sys[/FONT]
[FONT=Courier New]18:47:01.0711 7744 volsnap - ok[/FONT]
[FONT=Courier New]18:47:01.0761 7744 [ b26536add1d748cda104d856c979ae79 ] vpcbus C:\Windows\system32\DRIVERS\vpchbus.sys[/FONT]
[FONT=Courier New]18:47:01.0764 7744 vpcbus - ok[/FONT]
[FONT=Courier New]18:47:01.0810 7744 [ a0f7e923a6261760130f22b85df9040e ] vpcnfltr C:\Windows\system32\DRIVERS\vpcnfltr.sys[/FONT]
[FONT=Courier New]18:47:01.0812 7744 vpcnfltr - ok[/FONT]
[FONT=Courier New]18:47:01.0827 7744 [ 5f4b55e91ce7e2523c9e1e0ece858869 ] vpcusb C:\Windows\system32\DRIVERS\vpcusb.sys[/FONT]
[FONT=Courier New]18:47:01.0829 7744 vpcusb - ok[/FONT]
[FONT=Courier New]18:47:01.0926 7744 [ b487191fe18d6863381a1ac55482469a ] vpcvmm C:\Windows\system32\drivers\vpcvmm.sys[/FONT]
[FONT=Courier New]18:47:01.0931 7744 vpcvmm - ok[/FONT]
[FONT=Courier New]18:47:01.0976 7744 [ 9dfa0cc2f8855a04816729651175b631 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys[/FONT]
[FONT=Courier New]18:47:01.0979 7744 vsmraid - ok[/FONT]
[FONT=Courier New]18:47:02.0056 7744 [ 209a3b1901b83aeb8527ed211cce9e4c ] VSS C:\Windows\system32\vssvc.exe[/FONT]
[FONT=Courier New]18:47:02.0089 7744 VSS - ok[/FONT]
[FONT=Courier New]18:47:02.0202 7744 [ 682fcf7d2eb5158cd30408e976562408 ] VSTHWBS2 C:\Windows\system32\DRIVERS\VSTBS23.SYS[/FONT]
[FONT=Courier New]18:47:02.0217 7744 VSTHWBS2 - ok[/FONT]
[FONT=Courier New]18:47:02.0266 7744 [ e4fa7aff5046fc49de22e903b7e35add ] vstor2-ws60 C:\Program Files\VMware\VMware Workstation\vstor2-ws60.sys[/FONT]
[FONT=Courier New]18:47:02.0285 7744 vstor2-ws60 - ok[/FONT]
[FONT=Courier New]18:47:02.0328 7744 [ ceb4e3b6890e1e42dca6694d9e59e1a0 ] VST_DPV C:\Windows\system32\DRIVERS\VSTDPV3.SYS[/FONT]
[FONT=Courier New]18:47:02.0379 7744 VST_DPV - ok[/FONT]
[FONT=Courier New]18:47:02.0401 7744 [ 90567b1e658001e79d7c8bbd3dde5aa6 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys[/FONT]
[FONT=Courier New]18:47:02.0402 7744 vwifibus - ok[/FONT]
[FONT=Courier New]18:47:02.0499 7744 [ ca8e534392bc862b4f882718a4493c4b ] VX6000 C:\Windows\system32\DRIVERS\VX6000Xp.sys[/FONT]
[FONT=Courier New]18:47:02.0560 7744 VX6000 - ok[/FONT]
[FONT=Courier New]18:47:02.0605 7744 [ 55187fd710e27d5095d10a472c8baf1c ] W32Time C:\Windows\system32\w32time.dll[/FONT]
[FONT=Courier New]18:47:02.0625 7744 W32Time - ok[/FONT]
[FONT=Courier New]18:47:02.0647 7744 [ de3721e89c653aa281428c8a69745d90 ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys[/FONT]
[FONT=Courier New]18:47:02.0649 7744 WacomPen - ok[/FONT]
[FONT=Courier New]18:47:02.0703 7744 [ 3c3c78515f5ab448b022bdf5b8ffdd2e ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys[/FONT]
[FONT=Courier New]18:47:02.0705 7744 WANARP - ok[/FONT]
[FONT=Courier New]18:47:02.0709 7744 [ 3c3c78515f5ab448b022bdf5b8ffdd2e ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys[/FONT]
[FONT=Courier New]18:47:02.0710 7744 Wanarpv6 - ok[/FONT]
[FONT=Courier New]18:47:02.0791 7744 [ 353a04c273ec58475d8633e75ccd5604 ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe[/FONT]
[FONT=Courier New]18:47:02.0817 7744 WatAdminSvc - ok[/FONT]
[FONT=Courier New]18:47:02.0878 7744 [ 691e3285e53dca558e1a84667f13e15a ] wbengine C:\Windows\system32\wbengine.exe[/FONT]
[FONT=Courier New]18:47:02.0913 7744 wbengine - ok[/FONT]
[FONT=Courier New]18:47:02.0933 7744 [ 9614b5d29dc76ac3c29f6d2d3aa70e67 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll[/FONT]
[FONT=Courier New]18:47:02.0939 7744 WbioSrvc - ok[/FONT]
[FONT=Courier New]18:47:02.0974 7744 [ 34eee0dfaadb4f691d6d5308a51315dc ] wcncsvc C:\Windows\System32\wcncsvc.dll[/FONT]
[FONT=Courier New]18:47:02.0980 7744 wcncsvc - ok[/FONT]
[FONT=Courier New]18:47:02.0996 7744 [ 5d930b6357a6d2af4d7653bdabbf352f ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll[/FONT]
[FONT=Courier New]18:47:03.0000 7744 WcsPlugInService - ok[/FONT]
[FONT=Courier New]18:47:03.0020 7744 [ 1112a9badacb47b7c0bb0392e3158dff ] Wd C:\Windows\system32\DRIVERS\wd.sys[/FONT]
[FONT=Courier New]18:47:03.0022 7744 Wd - ok[/FONT]
[FONT=Courier New]18:47:03.0045 7744 [ 9950e3d0f08141c7e89e64456ae7dc73 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys[/FONT]
[FONT=Courier New]18:47:03.0052 7744 Wdf01000 - ok[/FONT]
[FONT=Courier New]18:47:03.0067 7744 [ 46ef9dc96265fd0b423db72e7c38c2a5 ] WdiServiceHost C:\Windows\system32\wdi.dll[/FONT]
[FONT=Courier New]18:47:03.0071 7744 WdiServiceHost - ok[/FONT]
[FONT=Courier New]18:47:03.0084 7744 [ 46ef9dc96265fd0b423db72e7c38c2a5 ] WdiSystemHost C:\Windows\system32\wdi.dll[/FONT]
[FONT=Courier New]18:47:03.0087 7744 WdiSystemHost - ok[/FONT]
[FONT=Courier New]18:47:03.0125 7744 [ a9d880f97530d5b8fee278923349929d ] WebClient C:\Windows\System32\webclnt.dll[/FONT]
[FONT=Courier New]18:47:03.0134 7744 WebClient - ok[/FONT]
[FONT=Courier New]18:47:03.0155 7744 [ 760f0afe937a77cff27153206534f275 ] Wecsvc C:\Windows\system32\wecsvc.dll[/FONT]
[FONT=Courier New]18:47:03.0160 7744 Wecsvc - ok[/FONT]
[FONT=Courier New]18:47:03.0170 7744 [ ac804569bb2364fb6017370258a4091b ] wercplsupport C:\Windows\System32\wercplsupport.dll[/FONT]
[FONT=Courier New]18:47:03.0174 7744 wercplsupport - ok[/FONT]
[FONT=Courier New]18:47:03.0223 7744 [ 08e420d873e4fd85241ee2421b02c4a4 ] WerSvc C:\Windows\System32\WerSvc.dll[/FONT]
[FONT=Courier New]18:47:03.0227 7744 WerSvc - ok[/FONT]
[FONT=Courier New]18:47:03.0275 7744 [ 8b9a943f3b53861f2bfaf6c186168f79 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys[/FONT]
[FONT=Courier New]18:47:03.0277 7744 WfpLwf - ok[/FONT]
[FONT=Courier New]18:47:03.0291 7744 [ 5cf95b35e59e2a38023836fff31be64c ] WIMMount C:\Windows\system32\drivers\wimmount.sys[/FONT]
[FONT=Courier New]18:47:03.0293 7744 WIMMount - ok[/FONT]
[FONT=Courier New]18:47:03.0318 7744 [ bc0c7ea89194c299f051c24119000e17 ] winachsf C:\Windows\system32\DRIVERS\VSTCNXT3.SYS[/FONT]
[FONT=Courier New]18:47:03.0327 7744 winachsf - ok[/FONT]
[FONT=Courier New]18:47:03.0406 7744 [ 3fae8f94296001c32eab62cd7d82e0fd ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll[/FONT]
[FONT=Courier New]18:47:03.0424 7744 WinDefend - ok[/FONT]
[FONT=Courier New]18:47:03.0430 7744 WinHttpAutoProxySvc - ok[/FONT]
[FONT=Courier New]18:47:03.0509 7744 [ f62e510b6ad4c21eb9fe8668ed251826 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll[/FONT]
[FONT=Courier New]18:47:03.0511 7744 Winmgmt - ok[/FONT]
[FONT=Courier New]18:47:03.0574 7744 [ 1b91cd34ea3a90ab6a4ef0550174f4cc ] WinRM C:\Windows\system32\WsmSvc.dll[/FONT]
[FONT=Courier New]18:47:03.0609 7744 WinRM - ok[/FONT]
[FONT=Courier New]18:47:03.0678 7744 [ a67e5f9a400f3bd1be3d80613b45f708 ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys[/FONT]
[FONT=Courier New]18:47:03.0680 7744 WinUsb - ok[/FONT]
[FONT=Courier New]18:47:03.0793 7744 [ a5c691ae2899a31c03aa9ec7dd07d7a0 ] WinVNC4 C:\Program Files\RealVNC\VNC4\WinVNC4.exe[/FONT]
[FONT=Courier New]18:47:03.0845 7744 WinVNC4 - ok[/FONT]
[FONT=Courier New]18:47:03.0895 7744 [ 16935c98ff639d185086a3529b1f2067 ] Wlansvc C:\Windows\System32\wlansvc.dll[/FONT]
[FONT=Courier New]18:47:03.0945 7744 Wlansvc - ok[/FONT]
[FONT=Courier New]18:47:04.0055 7744 [ 5144ae67d60ec653f97ddf3feed29e77 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[/FONT]
[FONT=Courier New]18:47:04.0098 7744 wlidsvc - ok[/FONT]
[FONT=Courier New]18:47:04.0134 7744 [ 0217679b8fca58714c3bf2726d2ca84e ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys[/FONT]
[FONT=Courier New]18:47:04.0151 7744 WmiAcpi - ok[/FONT]
[FONT=Courier New]18:47:04.0200 7744 [ 6eb6b66517b048d87dc1856ddf1f4c3f ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe[/FONT]
[FONT=Courier New]18:47:04.0203 7744 wmiApSrv - ok[/FONT]
[FONT=Courier New]18:47:04.0309 7744 [ 3b40d3a61aa8c21b88ae57c58ab3122e ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe[/FONT]
[FONT=Courier New]18:47:04.0335 7744 WMPNetworkSvc - ok[/FONT]
[FONT=Courier New]18:47:04.0373 7744 [ a2f0ec770a92f2b3f9de6d518e11409c ] WPCSvc C:\Windows\System32\wpcsvc.dll[/FONT]
[FONT=Courier New]18:47:04.0376 7744 WPCSvc - ok[/FONT]
[FONT=Courier New]18:47:04.0418 7744 [ aa53356d60af47eacc85bc617a4f3f66 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll[/FONT]
[FONT=Courier New]18:47:04.0423 7744 WPDBusEnum - ok[/FONT]
[FONT=Courier New]18:47:04.0459 7744 [ 6db3276587b853bf886b69528fdb048c ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys[/FONT]
[FONT=Courier New]18:47:04.0460 7744 ws2ifsl - ok[/FONT]
[FONT=Courier New]18:47:04.0521 7744 [ 6f5d49efe0e7164e03ae773a3fe25340 ] wscsvc C:\Windows\system32\wscsvc.dll[/FONT]
[FONT=Courier New]18:47:04.0525 7744 wscsvc - ok[/FONT]
[FONT=Courier New]18:47:04.0530 7744 WSearch - ok[/FONT]
[FONT=Courier New]18:47:04.0689 7744 [ fc3ec24fce372c89423e015a2ac1a31e ] wuauserv C:\Windows\system32\wuaueng.dll[/FONT]
[FONT=Courier New]18:47:04.0739 7744 wuauserv - ok[/FONT]
[FONT=Courier New]18:47:04.0753 7744 [ e714a1c0354636837e20ccbf00888ee7 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys[/FONT]
[FONT=Courier New]18:47:04.0755 7744 WudfPf - ok[/FONT]
[FONT=Courier New]18:47:04.0812 7744 [ 1023ee888c9b47178c5293ed5336ab69 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys[/FONT]
[FONT=Courier New]18:47:04.0815 7744 WUDFRd - ok[/FONT]
[FONT=Courier New]18:47:04.0870 7744 [ 8d1e1e529a2c9e9b6a85b55a345f7629 ] wudfsvc C:\Windows\System32\WUDFSvc.dll[/FONT]
[FONT=Courier New]18:47:04.0874 7744 wudfsvc - ok[/FONT]
[FONT=Courier New]18:47:04.0915 7744 [ ff2d745b560f7c71b31f30f4d49f73d2 ] WwanSvc C:\Windows\System32\wwansvc.dll[/FONT]
[FONT=Courier New]18:47:04.0920 7744 WwanSvc - ok[/FONT]
[FONT=Courier New]18:47:04.0954 7744 [ 6d87c2dad885a8a98b9d2ad680a4086e ] XE102Mp5 C:\Windows\system32\Drivers\XE102Mp5.sys[/FONT]
[FONT=Courier New]18:47:04.0969 7744 XE102Mp5 - ok[/FONT]
[FONT=Courier New]18:47:04.0991 7744 [ 8368bd6dee11a749b7db2b64648dd0d4 ] XE102Sp5 C:\Windows\system32\Drivers\XE102Sp5.sys[/FONT]
[FONT=Courier New]18:47:04.0992 7744 XE102Sp5 - ok[/FONT]
[FONT=Courier New]18:47:05.0003 7744 ================ Scan global ===============================[/FONT]
[FONT=Courier New]18:47:05.0058 7744 (dab748ae0439955ed2fa22357533dddb) C:\Windows\system32\basesrv.dll[/FONT]
[FONT=Courier New]18:47:05.0093 7744 (183b4188d5d91b271613ec3efd1b3cef) C:\Windows\system32\winsrv.dll[/FONT]
[FONT=Courier New]18:47:05.0108 7744 (183b4188d5d91b271613ec3efd1b3cef) C:\Windows\system32\winsrv.dll[/FONT]
[FONT=Courier New]18:47:05.0147 7744 (364455805e64882844ee9acb72522830) C:\Windows\system32\sxssrv.dll[/FONT]
[FONT=Courier New]18:47:05.0185 7744 (5f1b6a9c35d3d5ca72d6d6fdef9747d6) C:\Windows\system32\services.exe[/FONT]
[FONT=Courier New]18:47:05.0190 7744 [Global] - ok[/FONT]
[FONT=Courier New]18:47:05.0191 7744 ================ Scan MBR ==================================[/FONT]
[FONT=Courier New]18:47:05.0203 7744 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0[/FONT]
[FONT=Courier New]18:47:05.0744 7744 \Device\Harddisk0\DR0 - ok[/FONT]
[FONT=Courier New]18:47:05.0752 7744 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk3\DR3[/FONT]
[FONT=Courier New]18:47:05.0790 7744 \Device\Harddisk3\DR3 - ok[/FONT]
[FONT=Courier New]18:47:05.0794 7744 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk5\DR5[/FONT]
[FONT=Courier New]18:47:05.0799 7744 \Device\Harddisk5\DR5 - ok[/FONT]
[FONT=Courier New]18:47:05.0800 7744 ================ Scan VBR ==================================[/FONT]
[FONT=Courier New]18:47:05.0825 7744 Boot (0x1200) (173dbb5fc803f4bb3b92ded59212312c) \Device\Harddisk0\DR0\Partition1[/FONT]
[FONT=Courier New]18:47:05.0842 7744 \Device\Harddisk0\DR0\Partition1 - ok[/FONT]
[FONT=Courier New]18:47:05.0865 7744 Boot (0x1200) (827794e2647edcb93718b3d8f7447a0e) \Device\Harddisk0\DR0\Partition2[/FONT]
[FONT=Courier New]18:47:05.0867 7744 \Device\Harddisk0\DR0\Partition2 - ok[/FONT]
[FONT=Courier New]18:47:05.0872 7744 Boot (0x1200) (cbbd46975ba897d6f25049bf9ea2206a) \Device\Harddisk3\DR3\Partition1[/FONT]
[FONT=Courier New]18:47:05.0874 7744 \Device\Harddisk3\DR3\Partition1 - ok[/FONT]
[FONT=Courier New]18:47:05.0877 7744 Boot (0x1200) (6b61feff5c335ea1239eb52fc6ccdf96) \Device\Harddisk5\DR5\Partition1[/FONT]
[FONT=Courier New]18:47:05.0880 7744 \Device\Harddisk5\DR5\Partition1 - ok[/FONT]
[FONT=Courier New]18:47:05.0880 7744 ============================================================[/FONT]
[FONT=Courier New]18:47:05.0880 7744 Scan finished[/FONT]
[FONT=Courier New]18:47:05.0880 7744 ============================================================[/FONT]
[FONT=Courier New]18:47:05.0898 9136 Detected object count: 1[/FONT]
[FONT=Courier New]18:47:05.0898 9136 Actual detected object count: 1[/FONT]
[FONT=Courier New]18:47:09.0040 9136 sptd ( LockedFile.Multi.Generic ) - skipped by user[/FONT]
[FONT=Courier New]18:47:09.0040 9136 sptd ( LockedFile.Multi.Generic ) - User select action: Skip [/FONT]
 
Good :)

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  • Never rename Combofix unless instructed.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  • Double click on combofix.exe & follow the prompts.

  • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
    NOTE 2. If Combofix asks you to update the program, always do so.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt"
**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try the following...

Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Restart computer in safe mode

  • Double-click on the Rkill desktop icon to run the tool.
  • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • Do not reboot until instructed.
  • If the tool does not run from any of the links provided, please let me know.

When the scan is done Notepad will open with rKill.txt log.
NOTE. rKill.txt log will also be present on your desktop.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
 
[FONT=Courier New]ComboFix 12-08-18.03 - Reginald 08/18/2012 21:29:12.3.4 - x86[/FONT]
[FONT=Courier New]Running from: c:\users\Reginald\Desktop\ComboFix.exe[/FONT]
[FONT=Courier New]AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}[/FONT]
[FONT=Courier New]SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}[/FONT]
[FONT=Courier New]SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]c:\programdata\PCDr\5907\Downloads\f0fc9c9c-10ba-435b-8365-dadb523644ff.dll[/FONT]
[FONT=Courier New]c:\programdata\Safe[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]((((((((((((((((((((((((( Files Created from 2012-07-19 to 2012-08-19 )))))))))))))))))))))))))))))))[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]2012-08-19 03:43 . 2012-08-19 03:43 -------- d-----w- c:\users\Default\AppData\Local\temp[/FONT]
[FONT=Courier New]2012-08-18 14:28 . 2012-08-18 14:28 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D038EA17-3377-478B-B5ED-19B9E4CFA74B}\offreg.dll[/FONT]
[FONT=Courier New]2012-08-18 14:27 . 2012-08-18 14:27 -------- d-----w- c:\users\Reginald\AppData\Roaming\Anvisoft[/FONT]
[FONT=Courier New]2012-08-18 14:27 . 2012-07-13 05:49 14160 ----a-w- c:\windows\system32\drivers\asdws.sys[/FONT]
[FONT=Courier New]2012-08-18 14:27 . 2012-07-13 05:49 22864 ----a-w- c:\windows\system32\drivers\asdrs.sys[/FONT]
[FONT=Courier New]2012-08-18 14:27 . 2012-07-13 05:49 16208 ----a-w- c:\windows\system32\drivers\asdrm.sys[/FONT]
[FONT=Courier New]2012-08-18 14:27 . 2012-08-18 14:27 -------- d-----w- c:\programdata\Anvisoft[/FONT]
[FONT=Courier New]2012-08-18 14:27 . 2012-08-18 14:27 -------- d-----w- c:\program files\Anvisoft[/FONT]
[FONT=Courier New]2012-08-18 13:39 . 2012-08-18 13:39 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D038EA17-3377-478B-B5ED-19B9E4CFA74B}\MpKsl7ad2c85a.sys[/FONT]
[FONT=Courier New]2012-08-17 20:51 . 2009-08-20 05:50 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll[/FONT]
[FONT=Courier New]2012-08-17 20:47 . 2012-07-30 20:52 103904 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll[/FONT]
[FONT=Courier New]2012-08-17 19:02 . 2012-07-16 08:41 6891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D038EA17-3377-478B-B5ED-19B9E4CFA74B}\mpengine.dll[/FONT]
[FONT=Courier New]2012-08-17 16:23 . 2012-08-17 16:23 -------- d-----w- c:\program files\ESET[/FONT]
[FONT=Courier New]2012-08-16 17:25 . 2012-08-17 14:20 -------- d-----w- c:\users\Reginald\AppData\Roaming\ActiveWords 2.0[/FONT]
[FONT=Courier New]2012-08-16 17:25 . 2012-08-16 17:25 -------- d-----w- c:\programdata\Licenses[/FONT]
[FONT=Courier New]2012-08-16 17:25 . 2012-08-16 17:25 232915 ----a-w- c:\windows\ActiveWords Uninstaller.exe[/FONT]
[FONT=Courier New]2012-08-16 17:25 . 2012-08-16 17:25 -------- d-----w- c:\program files\Common Files\orangequava[/FONT]
[FONT=Courier New]2012-08-16 17:25 . 2012-08-16 17:25 -------- d-----w- c:\program files\ActiveWords[/FONT]
[FONT=Courier New]2012-08-16 13:42 . 2012-07-16 08:41 6891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll[/FONT]
[FONT=Courier New]2012-08-16 13:13 . 2012-07-06 19:23 393728 ----a-w- c:\windows\system32\drivers\bthport.sys[/FONT]
[FONT=Courier New]2012-08-16 13:09 . 2012-07-18 17:47 2345984 ----a-w- c:\windows\system32\win32k.sys[/FONT]
[FONT=Courier New]2012-08-16 13:09 . 2012-05-05 07:46 400896 ----a-w- c:\windows\system32\srcore.dll[/FONT]
[FONT=Courier New]2012-08-16 13:09 . 2012-07-04 21:14 41984 ----a-w- c:\windows\system32\browcli.dll[/FONT]
[FONT=Courier New]2012-08-16 13:09 . 2012-07-04 21:14 102912 ----a-w- c:\windows\system32\browser.dll[/FONT]
[FONT=Courier New]2012-08-16 13:09 . 2012-05-14 04:33 769024 ----a-w- c:\windows\system32\localspl.dll[/FONT]
[FONT=Courier New]2012-08-15 23:44 . 2012-08-15 23:44 -------- d-----w- c:\program files\AirPort[/FONT]
[FONT=Courier New]2012-08-15 15:23 . 2012-08-15 15:23 -------- d-----w- C:\Backreg[/FONT]
[FONT=Courier New]2012-08-15 12:10 . 2012-08-15 12:10 691696 ----a-w- c:\windows\system32\drivers\sptd.sys[/FONT]
[FONT=Courier New]2012-08-15 12:10 . 2012-08-15 12:10 -------- d-----w- c:\program files\LSoft Technologies[/FONT]
[FONT=Courier New]2012-08-15 03:59 . 2012-08-15 03:59 -------- d-----w- c:\windows\RestoreSafeDeleted[/FONT]
[FONT=Courier New]2012-08-15 03:52 . 2012-08-15 15:17 -------- d-----w- c:\program files\UnHackMe[/FONT]
[FONT=Courier New]2012-08-15 03:28 . 2012-08-15 03:28 2 --shatr- c:\windows\winstart.bat[/FONT]
[FONT=Courier New]2012-08-15 03:28 . 2012-08-15 03:28 -------- d-----w- c:\program files\Greatis[/FONT]
[FONT=Courier New]2012-08-15 03:23 . 2012-08-15 15:10 -------- d-----w- c:\programdata\RegRun[/FONT]
[FONT=Courier New]2012-08-15 02:08 . 2012-08-15 02:10 -------- d-----w- c:\programdata\HitmanPro[/FONT]
[FONT=Courier New]2012-08-15 01:14 . 2012-02-09 20:17 713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{93354889-7EA1-40C7-AC78-80F571619CC8}\gapaengine.dll[/FONT]
[FONT=Courier New]2012-08-15 01:13 . 2012-08-15 01:13 100864 ----a-w- C:\pwlyikod.sys[/FONT]
[FONT=Courier New]2012-08-15 01:08 . 2012-08-15 01:08 -------- d-----w- c:\program files\Microsoft Security Client[/FONT]
[FONT=Courier New]2012-08-15 00:41 . 2012-08-15 00:41 -------- d-----w- c:\programdata\Sophos[/FONT]
[FONT=Courier New]2012-08-15 00:41 . 2012-08-15 00:41 73728 ----a-r- c:\users\Reginald\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\SVRTgui.exe1_810EDD9E2F0A4E2BACF86673C38D9F48.exe[/FONT]
[FONT=Courier New]2012-08-15 00:41 . 2012-08-15 00:41 73728 ----a-r- c:\users\Reginald\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\SVRTgui.exe_810EDD9E2F0A4E2BACF86673C38D9F48.exe[/FONT]
[FONT=Courier New]2012-08-15 00:41 . 2012-08-15 00:41 73728 ----a-r- c:\users\Reginald\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\ARPPRODUCTICON.exe[/FONT]
[FONT=Courier New]2012-08-15 00:41 . 2012-08-15 00:41 -------- d-----w- c:\program files\Sophos[/FONT]
[FONT=Courier New]2012-08-15 00:19 . 2012-08-15 02:50 -------- d-----w- C:\TDSSKiller_Quarantine[/FONT]
[FONT=Courier New]2012-07-21 11:43 . 2012-07-21 11:43 -------- d-----w- c:\users\Reginald\AppData\Roaming\SUPERAntiSpyware.com[/FONT]
[FONT=Courier New]2012-07-21 11:43 . 2012-07-21 11:43 -------- d-----w- c:\program files\SUPERAntiSpyware[/FONT]
[FONT=Courier New]2012-07-21 11:43 . 2012-07-21 11:43 -------- d-----w- c:\programdata\SUPERAntiSpyware.com[/FONT]
[FONT=Courier New]2012-07-20 19:18 . 2012-07-20 19:18 -------- d-----w- c:\program files\Common Files\Skype[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New](((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]2012-08-16 16:11 . 2010-06-10 14:52 848 --sha-w- c:\programdata\KGyGaAvL.sys[/FONT]
[FONT=Courier New]2012-08-15 07:17 . 2012-04-15 11:37 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe[/FONT]
[FONT=Courier New]2012-08-15 07:17 . 2011-06-03 22:49 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl[/FONT]
[FONT=Courier New]2012-08-15 00:20 . 2009-07-13 23:11 259072 ----a-w- c:\windows\system32\services.exe[/FONT]
[FONT=Courier New]2012-07-12 09:36 . 2010-04-05 15:54 83392 ----a-w- c:\windows\system32\LMIRfsClientNP.dll[/FONT]
[FONT=Courier New]2012-07-12 09:36 . 2010-04-05 15:54 52128 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll[/FONT]
[FONT=Courier New]2012-07-12 09:36 . 2010-04-05 15:54 30624 ----a-w- c:\windows\system32\LMIport.dll[/FONT]
[FONT=Courier New]2012-07-12 09:36 . 2010-04-05 15:54 87456 ----a-w- c:\windows\system32\LMIinit.dll[/FONT]
[FONT=Courier New]2012-07-03 19:46 . 2012-04-17 22:16 22344 ----a-w- c:\windows\system32\drivers\mbam.sys[/FONT]
[FONT=Courier New]2012-06-06 14:49 . 2012-06-06 14:49 1070152 ----a-w- c:\windows\system32\MSCOMCTL.OCX[/FONT]
[FONT=Courier New]2012-06-06 05:05 . 2012-07-11 07:53 1390080 ----a-w- c:\windows\system32\msxml6.dll[/FONT]
[FONT=Courier New]2012-06-06 05:05 . 2012-07-11 07:53 1236992 ----a-w- c:\windows\system32\msxml3.dll[/FONT]
[FONT=Courier New]2012-06-06 05:03 . 2012-07-11 07:53 805376 ----a-w- c:\windows\system32\cdosys.dll[/FONT]
[FONT=Courier New]2012-06-02 22:19 . 2012-06-21 16:54 53784 ----a-w- c:\windows\system32\wuauclt.exe[/FONT]
[FONT=Courier New]2012-06-02 22:19 . 2012-06-21 16:54 45080 ----a-w- c:\windows\system32\wups2.dll[/FONT]
[FONT=Courier New]2012-06-02 22:19 . 2012-06-21 16:54 35864 ----a-w- c:\windows\system32\wups.dll[/FONT]
[FONT=Courier New]2012-06-02 22:19 . 2012-06-21 16:54 577048 ----a-w- c:\windows\system32\wuapi.dll[/FONT]
[FONT=Courier New]2012-06-02 22:19 . 2012-06-21 16:54 1933848 ----a-w- c:\windows\system32\wuaueng.dll[/FONT]
[FONT=Courier New]2012-06-02 22:12 . 2012-06-21 16:54 2422272 ----a-w- c:\windows\system32\wucltux.dll[/FONT]
[FONT=Courier New]2012-06-02 22:12 . 2012-06-21 16:54 88576 ----a-w- c:\windows\system32\wudriver.dll[/FONT]
[FONT=Courier New]2012-06-02 21:19 . 2012-06-21 16:54 171904 ----a-w- c:\windows\system32\wuwebv.dll[/FONT]
[FONT=Courier New]2012-06-02 21:12 . 2012-06-21 16:54 33792 ----a-w- c:\windows\system32\wuapp.exe[/FONT]
[FONT=Courier New]2012-06-02 04:45 . 2012-07-11 07:53 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys[/FONT]
[FONT=Courier New]2012-06-02 04:45 . 2012-07-11 07:53 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys[/FONT]
[FONT=Courier New]2012-06-02 04:40 . 2012-07-11 07:53 369336 ----a-w- c:\windows\system32\drivers\cng.sys[/FONT]
[FONT=Courier New]2012-06-02 04:40 . 2012-07-11 07:53 225280 ----a-w- c:\windows\system32\schannel.dll[/FONT]
[FONT=Courier New]2012-06-02 04:39 . 2012-07-11 07:53 219136 ----a-w- c:\windows\system32\ncrypt.dll[/FONT]
[FONT=Courier New]2012-05-22 19:16 . 2010-04-05 15:54 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll.000.bak[/FONT]
[FONT=Courier New]2012-04-17 02:14 . 2011-08-07 19:20 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll[/FONT]
[FONT=Courier New]2010-08-14 12:06 . 2010-08-14 12:06 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]*Note* empty entries & legit default entries are not shown [/FONT]
[FONT=Courier New]REGEDIT4[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks][/FONT]
[FONT=Courier New]"{fa887e92-8f5f-4ec9-99ca-09be0e4120d6}"= "c:\program files\AddThis Toolbar\Helper.dll" [2010-06-08 243200][/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_CLASSES_ROOT\clsid\{fa887e92-8f5f-4ec9-99ca-09be0e4120d6}][/FONT]
[FONT=Courier New][HKEY_CLASSES_ROOT\FreeCauseURLSearchHook.FCToolbarURLSearchHook.1][/FONT]
[FONT=Courier New][HKEY_CLASSES_ROOT\TypeLib\{4ACB7285-8557-43C3-80DA-22D40B15DC77}][/FONT]
[FONT=Courier New][HKEY_CLASSES_ROOT\FreeCauseURLSearchHook.FCToolbarURLSearchHook][/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1][/FONT]
[FONT=Courier New]@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"[/FONT]
[FONT=Courier New][HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}][/FONT]
[FONT=Courier New]2011-02-18 05:12 94208 ----a-w- c:\users\Reginald\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2][/FONT]
[FONT=Courier New]@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"[/FONT]
[FONT=Courier New][HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}][/FONT]
[FONT=Courier New]2011-02-18 05:12 94208 ----a-w- c:\users\Reginald\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3][/FONT]
[FONT=Courier New]@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"[/FONT]
[FONT=Courier New][HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}][/FONT]
[FONT=Courier New]2011-02-18 05:12 94208 ----a-w- c:\users\Reginald\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4][/FONT]
[FONT=Courier New]@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"[/FONT]
[FONT=Courier New][HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}][/FONT]
[FONT=Courier New]2011-02-18 05:12 94208 ----a-w- c:\users\Reginald\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run][/FONT]
[FONT=Courier New]"AirVideoServer"="c:\program files\AirVideoServer\AirVideoServer.exe" [2010-09-22 4923784][/FONT]
[FONT=Courier New]"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-08-23 4608][/FONT]
[FONT=Courier New]"DU Meter"="c:\program files\DU Meter\DUMeter.exe" [2010-09-29 2942856][/FONT]
[FONT=Courier New]"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2010-11-20 144384][/FONT]
[FONT=Courier New]"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112][/FONT]
[FONT=Courier New]"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-08-14 39408][/FONT]
[FONT=Courier New]"OfficeSyncProcess"="c:\program files\Microsoft Office\Office14\MSOSYNC.EXE" [2012-01-21 719672][/FONT]
[FONT=Courier New]"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480][/FONT]
[FONT=Courier New]"MobileDocuments"="c:\program files\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240][/FONT]
[FONT=Courier New]"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2012-07-19 109336][/FONT]
[FONT=Courier New]"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-07-09 4777856][/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run][/FONT]
[FONT=Courier New]"VX6000"="c:\windows\vVX6000.exe" [2009-06-26 759296][/FONT]
[FONT=Courier New]"Bluetooth HCI Monitor"="HCIMNTR.DLL" [2006-12-07 9728][/FONT]
[FONT=Courier New]"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2012-07-30 640480][/FONT]
[FONT=Courier New]"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2012-07-31 41944][/FONT]
[FONT=Courier New]"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2009-03-11 611712][/FONT]
[FONT=Courier New]"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240][/FONT]
[FONT=Courier New]"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424][/FONT]
[FONT=Courier New]"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920][/FONT]
[FONT=Courier New]"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-14 30192][/FONT]
[FONT=Courier New]"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712][/FONT]
[FONT=Courier New]"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2009-07-24 118640][/FONT]
[FONT=Courier New]"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048][/FONT]
[FONT=Courier New]"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304][/FONT]
[FONT=Courier New]"QuickFinder Scheduler"="c:\program files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE" [2009-06-22 83232][/FONT]
[FONT=Courier New]"vmware-tray"="c:\program files\VMware\VMware Workstation\vmware-tray.exe" [2009-03-27 96816][/FONT]
[FONT=Courier New]"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296][/FONT]
[FONT=Courier New]"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2009-07-08 236016][/FONT]
[FONT=Courier New]"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520][/FONT]
[FONT=Courier New]"SysMetrix"="c:\program files\SysMetrix\SysMetrix.exe" [2010-02-17 2621440][/FONT]
[FONT=Courier New]"SAOB Monitor"="c:\program files\Acronis\OnlineBackupStandalone\TrueImageMonitor.exe" [2010-08-20 2536448][/FONT]
[FONT=Courier New]"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2010-08-21 5458848][/FONT]
[FONT=Courier New]"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2010-08-21 390736][/FONT]
[FONT=Courier New]"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 1821576][/FONT]
[FONT=Courier New]"KSafeTray"="c:\program files\Kingsoft\PcDoctor\KSafeTray.exe" [2012-04-11 1308064][/FONT]
[FONT=Courier New]"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240][/FONT]
[FONT=Courier New]"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920][/FONT]
[FONT=Courier New]"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200][/FONT]
[FONT=Courier New]"AirPort Base Station Agent"="c:\program files\AirPort\APAgent.exe" [2009-11-11 771360][/FONT]
[FONT=Courier New]"Anvi Smart Defender"="c:\program files\Anvisoft\Anvi Smart Defender\ASDTray.exe" [2012-07-20 1217864][/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]c:\users\Reginald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\[/FONT]
[FONT=Courier New]Active WebCam.LNK - c:\program files\Active WebCam\WebCam.exe [2009-8-18 4899136][/FONT]
[FONT=Courier New]ActiveWords.lnk - c:\program files\ActiveWords\AWMonitor.exe [2012-3-3 3506176][/FONT]
[FONT=Courier New]Dropbox.lnk - c:\users\Reginald\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840][/FONT]
[FONT=Courier New]Virtual Weather Station.lnk - c:\vws\vws.exe [2011-10-19 21328896][/FONT]
[FONT=Courier New]WePrint Server.lnk - c:\program files\WePrint\WePrint Server.exe [2011-8-26 2542080][/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\[/FONT]
[FONT=Courier New]APC UPS Status.lnk - c:\program files\APC\APC PowerChute Personal Edition\Display.exe [2010-9-14 271736][/FONT]
[FONT=Courier New]Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-4-13 791840][/FONT]
[FONT=Courier New]Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-4-26 50688][/FONT]
[FONT=Courier New]Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-10-30 282624][/FONT]
[FONT=Courier New]Snagit 10.lnk - c:\program files\TechSmith\Snagit 10\Snagit32.exe [2010-4-13 7046984][/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system][/FONT]
[FONT=Courier New]"ConsentPromptBehaviorAdmin"= 0 (0x0)[/FONT]
[FONT=Courier New]"ConsentPromptBehaviorUser"= 3 (0x3)[/FONT]
[FONT=Courier New]"EnableLUA"= 0 (0x0)[/FONT]
[FONT=Courier New]"EnableUIADesktopToggle"= 0 (0x0)[/FONT]
[FONT=Courier New]"PromptOnSecureDesktop"= 0 (0x0)[/FONT]
[FONT=Courier New]"EnableLinkedConnections"= 1 (0x1)[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler][/FONT]
[FONT=Courier New]"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences\FencesMenu.dll" [2010-11-30 279912][/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks][/FONT]
[FONT=Courier New]"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024][/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon][/FONT]
[FONT=Courier New]2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE][/FONT]
[FONT=Courier New]@=""[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36][/FONT]
[FONT=Courier New]@=""[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36.sys][/FONT]
[FONT=Courier New]@=""[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc][/FONT]
[FONT=Courier New]@="Service"[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys][/FONT]
[FONT=Courier New]"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x][/FONT]
[FONT=Courier New]R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [x][/FONT]
[FONT=Courier New]R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x][/FONT]
[FONT=Courier New]R3 ACTIVEWEBCAMWATCHDOG;Active WebCam Watchdog;c:\program files\Active WebCam\Watchdog.exe [x][/FONT]
[FONT=Courier New]R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x][/FONT]
[FONT=Courier New]R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [x][/FONT]
[FONT=Courier New]R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x][/FONT]
[FONT=Courier New]R3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [x][/FONT]
[FONT=Courier New]R3 DUMeterDrv;Hagel Technologies DU Meter traffic accounting driver;c:\program files\DU Meter\DUMETR32.SYS [x][/FONT]
[FONT=Courier New]R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [x][/FONT]
[FONT=Courier New]R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [x][/FONT]
[FONT=Courier New]R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [x][/FONT]
[FONT=Courier New]R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x][/FONT]
[FONT=Courier New]R3 libusb0;LibUsb-Win32 - Kernel Driver 06/04/2010,1.12.1.0;c:\windows\system32\DRIVERS\libusb0.sys [x][/FONT]
[FONT=Courier New]R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x][/FONT]
[FONT=Courier New]R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x][/FONT]
[FONT=Courier New]R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x][/FONT]
[FONT=Courier New]R3 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;c:\windows\system32\PLCNDIS5.SYS [x][/FONT]
[FONT=Courier New]R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x][/FONT]
[FONT=Courier New]R3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Professional Business 2009.SP3c\RpcAgentSrv.exe [x][/FONT]
[FONT=Courier New]R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x][/FONT]
[FONT=Courier New]R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x][/FONT]
[FONT=Courier New]R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x][/FONT]
[FONT=Courier New]R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x][/FONT]
[FONT=Courier New]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x][/FONT]
[FONT=Courier New]R3 XE102Mp5;XE102Mp5 NDIS Protocol Driver;c:\windows\system32\Drivers\XE102Mp5.sys [x][/FONT]
[FONT=Courier New]R3 XE102Sp5;XE102Sp5 NDIS Protocol Driver;c:\windows\system32\Drivers\XE102Sp5.sys [x][/FONT]
[FONT=Courier New]R4 ACTIVEWEBCAM;Active WebCam;c:\program files\Active WebCam\WebCam.exe [x][/FONT]
[FONT=Courier New]R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [x][/FONT]
[FONT=Courier New]R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [x][/FONT]
[FONT=Courier New]R4 SQLAgent$MICROSOFTSCM;SQL Server Agent (MICROSOFTSCM);c:\program files\Microsoft SQL Server\MSSQL10.MICROSOFTSCM\MSSQL\Binn\SQLAGENT.EXE [x][/FONT]
[FONT=Courier New]S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x][/FONT]
[FONT=Courier New]S0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);c:\windows\system32\DRIVERS\tdrpm273.sys [x][/FONT]
[FONT=Courier New]S1 kmodurl;kmodurl;c:\program files\Kingsoft\PcDoctor\kmodurl.sys [x][/FONT]
[FONT=Courier New]S1 MpKsl7ad2c85a;MpKsl7ad2c85a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D038EA17-3377-478B-B5ED-19B9E4CFA74B}\MpKsl7ad2c85a.sys [x][/FONT]
[FONT=Courier New]S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [x][/FONT]
[FONT=Courier New]S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [x][/FONT]
[FONT=Courier New]S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [x][/FONT]
[FONT=Courier New]S2 afcdpsrv;Acronis Nonstop Backup service;c:\program files\Common Files\Acronis\CDP\afcdpsrv.exe [x][/FONT]
[FONT=Courier New]S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x][/FONT]
[FONT=Courier New]S2 APC Data Service;APC Data Service;c:\program files\APC\APC PowerChute Personal Edition\dataserv.exe [x][/FONT]
[FONT=Courier New]S2 asdrs;AntiMalware Host-based Intrusion Prevention System;c:\windows\system32\DRIVERS\asdrs.sys [x][/FONT]
[FONT=Courier New]S2 asdsrv;Anvi Smart Defender Realtime Guard Service;c:\program files\Anvisoft\Anvi Smart Defender\ASDSrv.exe [x][/FONT]
[FONT=Courier New]S2 asdws;AnviSmartDefender Web Guard;c:\windows\system32\DRIVERS\asdws.sys [x][/FONT]
[FONT=Courier New]S2 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\SeaPort.EXE [x][/FONT]
[FONT=Courier New]S2 DbgSvc;Debug Diagnostic Service;c:\program files\DebugDiag\DbgSvc.exe [x][/FONT]
[FONT=Courier New]S2 DUMeterSvc;DU Meter Service;c:\program files\DU Meter\DUMeterSvc.exe [x][/FONT]
[FONT=Courier New]S2 KSafeSvc;KSafe service;c:\program files\Kingsoft\PcDoctor\KSafeSvc.exe [x][/FONT]
[FONT=Courier New]S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [x][/FONT]
[FONT=Courier New]S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x][/FONT]
[FONT=Courier New]S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\Malwarebytes' Anti-Malware\mbamservice.exe [x][/FONT]
[FONT=Courier New]S2 MSSQL$MICROSOFTSCM;SQL Server (MICROSOFTSCM);c:\program files\Microsoft SQL Server\MSSQL10.MICROSOFTSCM\MSSQL\Binn\sqlservr.exe [x][/FONT]
[FONT=Courier New]S2 SlingAgentService;SlingAgentService;c:\program files\Sling Media\SlingAgent\SlingAgentService.exe [x][/FONT]
[FONT=Courier New]S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [x][/FONT]
[FONT=Courier New]S2 vmci;VMware vmci;c:\windows\system32\Drivers\vmci.sys [x][/FONT]
[FONT=Courier New]S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [x][/FONT]
[FONT=Courier New]S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x][/FONT]
[FONT=Courier New]S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x][/FONT]
[FONT=Courier New]S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x][/FONT]
[FONT=Courier New]S3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [x][/FONT]
[FONT=Courier New]S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x][/FONT]
[FONT=Courier New]S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x][/FONT]
[FONT=Courier New]S3 PCDSRVC{E9D79540-57D5953E-06020101}_0;PCDSRVC{E9D79540-57D5953E-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc.pkms [x][/FONT]
[FONT=Courier New]S3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\DRIVERS\silabenm.sys [x][/FONT]
[FONT=Courier New]S3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys [x][/FONT]
[FONT=Courier New]S3 VST_DPV;VST_DPV;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x][/FONT]
[FONT=Courier New]S3 VSTHWBS2;VSTHWBS2;c:\windows\system32\DRIVERS\VSTBS23.SYS [x][/FONT]
[FONT=Courier New]S3 VX6000;Microsoft LifeCam VX-6000;c:\windows\system32\DRIVERS\VX6000Xp.sys [x][/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]--- Other Services/Drivers In Memory ---[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]*NewlyCreated* - 22278196[/FONT]
[FONT=Courier New]*NewlyCreated* - 92405968[/FONT]
[FONT=Courier New]*NewlyCreated* - ASDRM[/FONT]
[FONT=Courier New]*NewlyCreated* - ASDRS[/FONT]
[FONT=Courier New]*NewlyCreated* - ASDWS[/FONT]
[FONT=Courier New]*NewlyCreated* - ASWMBR[/FONT]
[FONT=Courier New]*NewlyCreated* - CPUDRV[/FONT]
[FONT=Courier New]*NewlyCreated* - MPKSL7AD2C85A[/FONT]
[FONT=Courier New]*NewlyCreated* - PWLYIKOD[/FONT]
[FONT=Courier New]*Deregistered* - 22278196[/FONT]
[FONT=Courier New]*Deregistered* - 92405968[/FONT]
[FONT=Courier New]*Deregistered* - asdrm[/FONT]
[FONT=Courier New]*Deregistered* - aswMBR[/FONT]
[FONT=Courier New]*Deregistered* - pwlyikod[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]Contents of the 'Scheduled Tasks' folder[/FONT]
[FONT=Courier New].[/FONT]
 
[FONT=Courier New]2012-08-19 c:\windows\Tasks\Adobe Flash Player Updater.job[/FONT]
[FONT=Courier New]- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-15 07:17][/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]2012-08-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job[/FONT]
[FONT=Courier New]- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-28 18:57][/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]2012-08-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job[/FONT]
[FONT=Courier New]- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-28 18:57][/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]2012-08-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1359024441-3580254713-1987414973-1000Core.job[/FONT]
[FONT=Courier New]- c:\users\Reginald\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-22 20:34][/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]2012-08-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1359024441-3580254713-1987414973-1000UA.job[/FONT]
[FONT=Courier New]- c:\users\Reginald\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-22 20:34][/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]2012-08-14 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job[/FONT]
[FONT=Courier New]- c:\program files\Dell Support Center\uaclauncher.exe [2012-04-13 05:40][/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]2012-08-18 c:\windows\Tasks\SystemToolsDailyTest.job[/FONT]
[FONT=Courier New]- c:\program files\Dell Support Center\uaclauncher.exe [2012-04-13 05:40][/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]2012-08-19 c:\windows\Tasks\User_Feed_Synchronization-{1D9D0871-37AF-43C2-BA55-FCB153C904EF}.job[/FONT]
[FONT=Courier New]- c:\windows\system32\msfeedssync.exe [2011-06-03 22:38][/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]------- Supplementary Scan -------[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]uStart Page = hxxp://www.google.com/[/FONT]
[FONT=Courier New]uDefault_Search_URL = hxxp://www.google.com/ie[/FONT]
[FONT=Courier New]mStart Page = hxxp://www.google.com/[/FONT]
[FONT=Courier New]uInternet Settings,ProxyOverride = *.local[/FONT]
[FONT=Courier New]uSearchAssistant = hxxp://www.google.com/ie[/FONT]
[FONT=Courier New]uSearchURL,(Default) = hxxp://www.google.com/search?q=%s[/FONT]
[FONT=Courier New]IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200[/FONT]
[FONT=Courier New]IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html[/FONT]
[FONT=Courier New]IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html[/FONT]
[FONT=Courier New]IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html[/FONT]
[FONT=Courier New]IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html[/FONT]
[FONT=Courier New]IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html[/FONT]
[FONT=Courier New]IE: E&xport to Microsoft Excel - c:\progra~1\Microsoft Office\Office14\EXCEL.EXE/3000[/FONT]
[FONT=Courier New]IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html[/FONT]
[FONT=Courier New]IE: Open with WordPerfect - c:\program files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta[/FONT]
[FONT=Courier New]IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html[/FONT]
[FONT=Courier New]IE: Se&nd to OneNote - c:\progra~1\Microsoft Office\Office14\ONBttnIE.dll/105[/FONT]
[FONT=Courier New]IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm[/FONT]
[FONT=Courier New]IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm[/FONT]
[FONT=Courier New]IE: Show RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html[/FONT]
[FONT=Courier New]Trusted Zone: garmin.com\connect[/FONT]
[FONT=Courier New]Trusted Zone: garmin.com\mygarmin[/FONT]
[FONT=Courier New]Trusted Zone: garmin.com\www[/FONT]
[FONT=Courier New]Trusted Zone: real.com\rhap-app-4-0[/FONT]
[FONT=Courier New]Trusted Zone: real.com\rhapreg[/FONT]
[FONT=Courier New]Trusted Zone: zoombak.com\locate[/FONT]
[FONT=Courier New]Trusted Zone: zoombak.com\shop[/FONT]
[FONT=Courier New]TCP: DhcpNameServer = 72.19.128.53 72.19.128.99[/FONT]
[FONT=Courier New]TCP: Interfaces\{297982DB-7F42-4718-8D4B-A71C72C5621A}: DhcpNameServer = 72.19.128.53 72.19.128.99[/FONT]
[FONT=Courier New]DPF: CaptureClient - hxxp://192.168.1.110/CaptureClient.cab[/FONT]
[FONT=Courier New]DPF: {22D82B43-FF26-455A-A96D-A6C61F056ED7} - hxxp://192.168.1.210/xplugxLiteTW.cab[/FONT]
[FONT=Courier New]FF - ProfilePath - c:\users\Reginald\AppData\Roaming\Mozilla\Firefox\Profiles\0gixnud9.default\[/FONT]
[FONT=Courier New]FF - prefs.js: browser.startup.homepage - hxxp://watch.slingbox.com/watch/sling_player[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]- - - - ORPHANS REMOVED - - - -[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]BHO-{9EBF8AAF-0A31-4786-909A-97A0EF101743} - (no file)[/FONT]
[FONT=Courier New]AddRemove-7-Zip - c:\program files\7-Zip\Uninstall.exe[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DUMeterSvc][/FONT]
[FONT=Courier New]"ImagePath"="c:\program files\DU Meter\DUMeterSvc.exe /startedbyscm:E1F6D4BE-40E33354-DUMeterService"[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{E9D79540-57D5953E-06020101}_0][/FONT]
[FONT=Courier New]"ImagePath"="\??\c:\program files\dell support center\pcdsrvc.pkms"[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]--------------------- LOCKED REGISTRY KEYS ---------------------[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\B*o*o*k*m*a*r*k*s* *T*o*o*l*b*a*r*
\Microsoft][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,02,01,00,00,01,00,00,00,02,00,00,00,78,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,6a,00,32,00,cd,00,00,00,00,a5,ba,a6,20,00,46,72,65,65,20,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\B*o*o*k*m*a*r*k*s* *T*o*o*l*b*a*r*
\News][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,fc,03,00,00,01,00,00,00,09,00,00,00,6c,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,5e,00,32,00,cd,00,00,00,00,bd,65,70,20,00,42,42,43,20,4e,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\B*o*o*k*m*a*r*k*s* *T*o*o*l*b*a*r*
\Popular][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,c4,01,00,00,01,00,00,00,04,00,00,00,66,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,58,00,32,00,cd,00,00,00,00,a2,23,05,20,00,41,6d,61,7a,6f,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\Business and Finance][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,14,05,00,00,01,00,00,00,09,00,00,00,7e,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,70,00,32,00,84,00,00,00,00,86,ca,f9,20,00,43,61,72,65,65,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\Computers and Internet][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,a6,04,00,00,01,00,00,00,09,00,00,00,70,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,f4,d4,29,20,00,40,76,61,6e,74,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\Directories][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,12,05,00,00,01,00,00,00,09,00,00,00,a2,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,94,00,32,00,84,00,00,00,00,37,e6,6b,20,00,34,61,6e,79,74,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\Entertainment and Lifestyles][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,b2,04,00,00,01,00,00,00,09,00,00,00,90,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,82,00,32,00,84,00,00,00,00,1f,71,d7,20,00,43,65,6c,65,62,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\News and Sports][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,ce,04,00,00,01,00,00,00,09,00,00,00,78,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,6a,00,32,00,84,00,00,00,00,c2,11,99,20,00,41,42,43,4e,45,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\Personal Toolbar Folder][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,b0,03,00,00,01,00,00,00,08,00,00,00,70,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,d2,e6,29,20,00,43,61,6c,65,6e,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\Search][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,92,03,00,00,01,00,00,00,08,00,00,00,72,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,dc,5c,7d,20,00,41,62,6f,75,74,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\Shopping and Classifieds][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,b4,04,00,00,01,00,00,00,09,00,00,00,76,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,68,00,32,00,84,00,00,00,00,6b,e0,e3,20,00,41,6d,61,7a,6f,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\Travel and Leisure][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,a0,04,00,00,01,00,00,00,09,00,00,00,82,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,74,00,32,00,84,00,00,00,00,75,30,93,20,00,4c,65,69,73,75,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\What's New and Cool][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,e6,04,00,00,01,00,00,00,09,00,00,00,9c,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,8e,00,32,00,84,00,00,00,00,67,aa,7d,20,00,41,64,76,65,72,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\Business and Finance][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,f0,04,00,00,01,00,00,00,09,00,00,00,7a,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,6c,00,32,00,cd,00,00,00,00,b5,fc,e8,20,00,43,61,72,65,65,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\Computers and Internet][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,82,04,00,00,01,00,00,00,09,00,00,00,6c,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,5e,00,32,00,cd,00,00,00,00,12,d9,88,20,00,40,76,61,6e,74,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\Directories][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,ee,04,00,00,01,00,00,00,09,00,00,00,9e,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,90,00,32,00,cd,00,00,00,00,81,e4,88,20,00,34,61,6e,79,74,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\Entertainment and Lifestyles][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,8e,04,00,00,01,00,00,00,09,00,00,00,8c,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,7e,00,32,00,cd,00,00,00,00,62,71,02,20,00,43,65,6c,65,62,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\News and Sports][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,aa,04,00,00,01,00,00,00,09,00,00,00,74,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,66,00,32,00,cd,00,00,00,00,52,65,7c,20,00,41,42,43,4e,45,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\Personal Toolbar Folder][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,90,03,00,00,01,00,00,00,08,00,00,00,6c,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,5e,00,32,00,cd,00,00,00,00,8d,1f,0f,20,00,43,61,6c,65,6e,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\Search][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,72,03,00,00,01,00,00,00,08,00,00,00,6e,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,60,00,32,00,cd,00,00,00,00,8d,f8,b7,20,00,41,62,6f,75,74,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\Shopping and Classifieds][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,90,04,00,00,01,00,00,00,09,00,00,00,72,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,64,00,32,00,cd,00,00,00,00,83,23,9e,20,00,41,6d,61,7a,6f,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\Travel and Leisure][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,7c,04,00,00,01,00,00,00,09,00,00,00,7e,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,70,00,32,00,cd,00,00,00,00,a7,04,67,20,00,4c,65,69,73,75,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\What's New and Cool][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,c2,04,00,00,01,00,00,00,09,00,00,00,98,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,8a,00,32,00,cd,00,00,00,00,52,d6,a4,20,00,41,64,76,65,72,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*I*n*k*s*


\Bookmarks bar][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,e4,1f,00,00,01,00,00,00,49,00,00,00,68,00,[/FONT]
[FONT=Courier New] 00,00,48,00,00,00,5a,00,32,00,cd,00,00,00,00,3f,e0,7d,20,00,7e,72,65,67,68,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,28,04,00,00,01,00,00,00,0b,00,00,00,6c,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,5e,00,31,00,00,00,00,00,00,f6,fa,3e,10,00,41,6c,74,65,72,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Alternative][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,30,0c,00,00,01,00,00,00,15,00,00,00,96,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,ec,9c,e4,20,00,33,57,4b,20,55,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Classical][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,a0,05,00,00,01,00,00,00,09,00,00,00,96,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,ed,a9,92,20,00,43,42,43,20,52,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Country][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,70,07,00,00,01,00,00,00,0c,00,00,00,9a,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,e1,cc,2f,20,00,39,36,2e,33,20,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\International][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,98,03,00,00,01,00,00,00,06,00,00,00,96,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,b6,16,80,20,00,4e,65,74,52,61,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Jazz][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,12,05,00,00,01,00,00,00,08,00,00,00,9a,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,5f,eb,8f,20,00,42,65,61,63,68,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\News][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,98,05,00,00,01,00,00,00,09,00,00,00,96,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,5b,fd,5d,20,00,43,42,43,20,52,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Pop][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,cc,10,00,00,01,00,00,00,1c,00,00,00,96,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,0e,03,54,20,00,39,33,2e,31,20,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Rock][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,ca,09,00,00,01,00,00,00,10,00,00,00,a0,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,92,00,32,00,84,00,00,00,00,dd,b9,a0,20,00,39,32,20,4b,51,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Spiritual][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,5e,03,00,00,01,00,00,00,06,00,00,00,9a,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,3a,18,ad,20,00,43,68,72,69,73,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Sports][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,b8,05,00,00,01,00,00,00,0a,00,00,00,ac,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,91,03,de,20,00,45,53,50,4e,20,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Talk][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,02,09,00,00,01,00,00,00,10,00,00,00,96,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,4b,42,b9,20,00,37,37,20,57,41,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,fc,03,00,00,01,00,00,00,0b,00,00,00,68,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,5a,00,31,00,00,00,00,00,00,0f,0b,f9,10,00,41,6c,74,65,72,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Alternative][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,dc,0b,00,00,01,00,00,00,15,00,00,00,92,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,84,00,32,00,cd,00,00,00,00,1f,d5,8f,20,00,33,57,4b,20,55,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Classical][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,7c,05,00,00,01,00,00,00,09,00,00,00,92,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,84,00,32,00,cd,00,00,00,00,5a,f6,4a,20,00,43,42,43,20,52,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Country][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,ae,06,00,00,01,00,00,00,0b,00,00,00,96,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,cd,00,00,00,00,ed,e9,b7,20,00,39,36,2e,33,20,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\International][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,80,03,00,00,01,00,00,00,06,00,00,00,92,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,84,00,32,00,cd,00,00,00,00,fd,f2,65,20,00,4e,65,74,52,61,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*[/FONT]
 
[FONT=Courier New] \RealPlayer Stations\Jazz][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,12,05,00,00,01,00,00,00,08,00,00,00,9a,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,5f,eb,8f,20,00,42,65,61,63,68,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\News][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,98,05,00,00,01,00,00,00,09,00,00,00,96,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,5b,fd,5d,20,00,43,42,43,20,52,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Pop][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,cc,10,00,00,01,00,00,00,1c,00,00,00,96,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,0e,03,54,20,00,39,33,2e,31,20,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Rock][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,ca,09,00,00,01,00,00,00,10,00,00,00,a0,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,92,00,32,00,84,00,00,00,00,dd,b9,a0,20,00,39,32,20,4b,51,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Spiritual][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,5e,03,00,00,01,00,00,00,06,00,00,00,9a,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,3a,18,ad,20,00,43,68,72,69,73,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Sports][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,b8,05,00,00,01,00,00,00,0a,00,00,00,ac,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,91,03,de,20,00,45,53,50,4e,20,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Talk][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,02,09,00,00,01,00,00,00,10,00,00,00,96,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,4b,42,b9,20,00,37,37,20,57,41,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,fc,03,00,00,01,00,00,00,0b,00,00,00,68,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,5a,00,31,00,00,00,00,00,00,0f,0b,f9,10,00,41,6c,74,65,72,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Alternative][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,dc,0b,00,00,01,00,00,00,15,00,00,00,92,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,84,00,32,00,cd,00,00,00,00,1f,d5,8f,20,00,33,57,4b,20,55,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Classical][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,7c,05,00,00,01,00,00,00,09,00,00,00,92,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,84,00,32,00,cd,00,00,00,00,5a,f6,4a,20,00,43,42,43,20,52,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Country][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,ae,06,00,00,01,00,00,00,0b,00,00,00,96,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,cd,00,00,00,00,ed,e9,b7,20,00,39,36,2e,33,20,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\International][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,80,03,00,00,01,00,00,00,06,00,00,00,92,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,84,00,32,00,cd,00,00,00,00,fd,f2,65,20,00,4e,65,74,52,61,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Jazz][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,f2,04,00,00,01,00,00,00,08,00,00,00,96,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,cd,00,00,00,00,ce,ea,5b,20,00,42,65,61,63,68,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\News][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,74,05,00,00,01,00,00,00,09,00,00,00,92,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,84,00,32,00,cd,00,00,00,00,86,76,c7,20,00,43,42,43,20,52,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Pop][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,5c,10,00,00,01,00,00,00,1c,00,00,00,92,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,84,00,32,00,cd,00,00,00,00,df,4d,5e,20,00,39,33,2e,31,20,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Rock][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,8a,09,00,00,01,00,00,00,10,00,00,00,9c,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,8e,00,32,00,cd,00,00,00,00,8b,58,cc,20,00,39,32,20,4b,51,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Spiritual][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,46,03,00,00,01,00,00,00,06,00,00,00,96,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,cd,00,00,00,00,ea,15,5b,20,00,43,68,72,69,73,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Sports][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,90,05,00,00,01,00,00,00,0a,00,00,00,a8,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,9a,00,32,00,cd,00,00,00,00,9e,c3,6b,20,00,45,53,50,4e,20,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Talk][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,c2,08,00,00,01,00,00,00,10,00,00,00,92,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,84,00,32,00,cd,00,00,00,00,7a,47,b3,20,00,37,37,20,57,41,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*B*C* *Y*a*h*o*o*!* *D*S*L*
\Yahoo!][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,38,0a,00,00,01,00,00,00,14,00,00,00,7c,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,6e,00,32,00,84,00,00,00,00,aa,87,d2,20,00,4c,41,55,4e,43,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*B*C* *Y*a*h*o*o*!* *D*S*L*

\Yahoo!][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,e8,09,00,00,01,00,00,00,14,00,00,00,78,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,6a,00,32,00,cd,00,00,00,00,18,84,70,20,00,4c,41,55,4e,43,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Baseball][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,28,07,00,00,01,00,00,00,0a,00,00,00,c0,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,b2,00,32,00,84,00,00,00,00,a5,a1,9f,20,00,42,61,73,65,62,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Gardening][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,08,02,00,00,01,00,00,00,03,00,00,00,9c,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,8e,00,32,00,84,00,00,00,00,9d,ef,03,20,00,46,69,6e,65,20,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Graduation][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,04,04,00,00,01,00,00,00,05,00,00,00,00,01,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,f2,00,32,00,84,00,00,00,00,d3,92,d6,20,00,47,6f,72,64,6f,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Home Improvement][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,22,03,00,00,01,00,00,00,05,00,00,00,c4,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,b6,00,32,00,84,00,00,00,00,9e,c8,e0,20,00,42,6f,62,56,69,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Microsoft Windows Plus! DME][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,fa,00,00,00,01,00,00,00,01,00,00,00,ee,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,e0,00,32,00,84,00,00,00,00,bc,3c,ae,20,00,4d,69,63,72,6f,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Mother's Day][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,90,03,00,00,01,00,00,00,07,00,00,00,5a,00,[/FONT]
[FONT=Courier New] 00,00,01,00,00,00,4c,00,31,00,00,00,00,00,00,dd,f6,b2,10,00,43,61,72,64,73,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Mother's Day\Cards][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,f0,02,00,00,01,00,00,00,04,00,00,00,ca,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,bc,00,32,00,84,00,00,00,00,bc,a7,ca,20,00,41,6d,65,72,69,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Mother's Day\Flowers & Chocolate][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,66,03,00,00,01,00,00,00,05,00,00,00,8a,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,0d,6c,9e,20,00,31,2d,38,30,30,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Mother's Day\Gifts][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,b0,04,00,00,01,00,00,00,06,00,00,00,88,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,ef,f4,ab,20,00,41,6d,61,7a,6f,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Mother's Day\Kids][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,92,02,00,00,01,00,00,00,03,00,00,00,ee,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,e0,00,32,00,84,00,00,00,00,77,f8,b6,20,00,42,69,6c,6c,79,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Outdoor Activities][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,9e,04,00,00,01,00,00,00,05,00,00,00,cc,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,be,00,32,00,84,00,00,00,00,98,c4,27,20,00,43,61,6d,70,69,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Photography][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,70,05,00,00,01,00,00,00,07,00,00,00,8e,00,[/FONT]
[FONT=Courier New] 00,00,03,00,00,00,80,00,31,00,00,00,00,00,00,86,0b,4f,10,00,4e,65,77,73,2c,\[/FONT]
[FONT=Courier New].[/FONT]
 
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Photography\News, Reviews & How To][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,e0,04,00,00,01,00,00,00,05,00,00,00,3c,01,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,2e,01,32,00,84,00,00,00,00,4a,0f,14,20,00,44,69,67,69,74,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Photography\On-Line Stores][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,5e,04,00,00,01,00,00,00,05,00,00,00,2a,01,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,1c,01,32,00,84,00,00,00,00,27,d9,dd,20,00,41,6d,61,7a,6f,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Wildlife & Nature][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,b0,04,00,00,01,00,00,00,05,00,00,00,3c,01,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,2e,01,32,00,84,00,00,00,00,3a,bb,a1,20,00,41,64,76,65,6e,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Baseball][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,00,07,00,00,01,00,00,00,0a,00,00,00,bc,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,ae,00,32,00,cd,00,00,00,00,2d,83,89,20,00,42,61,73,65,62,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Gardening][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,fc,01,00,00,01,00,00,00,03,00,00,00,98,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,8a,00,32,00,cd,00,00,00,00,35,68,30,20,00,46,69,6e,65,20,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Graduation][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,f0,03,00,00,01,00,00,00,05,00,00,00,fc,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,ee,00,32,00,cd,00,00,00,00,0c,9d,1b,20,00,47,6f,72,64,6f,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Home Improvement][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,0e,03,00,00,01,00,00,00,05,00,00,00,c0,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,b2,00,32,00,cd,00,00,00,00,39,4b,fc,20,00,42,6f,62,56,69,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Microsoft Windows Plus! DME][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,f6,00,00,00,01,00,00,00,01,00,00,00,ea,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,dc,00,32,00,cd,00,00,00,00,86,0b,c5,20,00,4d,69,63,72,6f,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Mother's Day][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,74,03,00,00,01,00,00,00,07,00,00,00,56,00,[/FONT]
[FONT=Courier New] 00,00,01,00,00,00,48,00,31,00,00,00,00,00,00,9d,36,10,10,00,43,61,72,64,73,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Mother's Day\Cards][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,e0,02,00,00,01,00,00,00,04,00,00,00,c6,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,b8,00,32,00,cd,00,00,00,00,93,a0,ac,20,00,41,6d,65,72,69,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Mother's Day\Flowers & Chocolate][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,52,03,00,00,01,00,00,00,05,00,00,00,86,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,78,00,32,00,cd,00,00,00,00,ce,ed,38,20,00,31,2d,38,30,30,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Mother's Day\Gifts][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,98,04,00,00,01,00,00,00,06,00,00,00,84,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,76,00,32,00,cd,00,00,00,00,5b,7c,87,20,00,41,6d,61,7a,6f,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Mother's Day\Kids][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,86,02,00,00,01,00,00,00,03,00,00,00,ea,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,dc,00,32,00,cd,00,00,00,00,77,5f,7e,20,00,42,69,6c,6c,79,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Outdoor Activities][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,8a,04,00,00,01,00,00,00,05,00,00,00,c8,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,ba,00,32,00,cd,00,00,00,00,39,70,fa,20,00,43,61,6d,70,69,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Photography][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,54,05,00,00,01,00,00,00,07,00,00,00,8a,00,[/FONT]
[FONT=Courier New] 00,00,03,00,00,00,7c,00,31,00,00,00,00,00,00,58,d9,86,10,00,4e,65,77,73,2c,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Photography\News, Reviews & How To][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,cc,04,00,00,01,00,00,00,05,00,00,00,38,01,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,2a,01,32,00,cd,00,00,00,00,f6,57,84,20,00,44,69,67,69,74,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Photography\On-Line Stores][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,4a,04,00,00,01,00,00,00,05,00,00,00,26,01,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,18,01,32,00,cd,00,00,00,00,ec,14,f7,20,00,41,6d,61,7a,6f,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Wildlife & Nature][/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,9c,04,00,00,01,00,00,00,05,00,00,00,38,01,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,2a,01,32,00,cd,00,00,00,00,8a,a1,a7,20,00,41,64,76,65,6e,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-10[/FONT]
 
[FONT=Courier New]1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\T*V*
][/FONT]
[FONT=Courier New]@SACL=(02 0001)[/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,ea,01,00,00,01,00,00,00,02,00,00,00,ee,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,e0,00,32,00,84,00,00,00,00,5c,13,09,20,00,77,77,69,54,56,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\T*V*

][/FONT]
[FONT=Courier New]@SACL=(02 0001)[/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,e2,01,00,00,01,00,00,00,02,00,00,00,ea,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,dc,00,32,00,cd,00,00,00,00,d6,dc,c6,20,00,77,77,69,54,56,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\X*p*
][/FONT]
[FONT=Courier New]@SACL=(02 0001)[/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,36,01,00,00,01,00,00,00,02,00,00,00,9a,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,ec,21,94,20,00,57,69,6e,64,6f,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\X*p*

][/FONT]
[FONT=Courier New]@SACL=(02 0001)[/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,2e,01,00,00,01,00,00,00,02,00,00,00,96,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,cd,00,00,00,00,de,77,65,20,00,57,69,6e,64,6f,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\X*
][/FONT]
[FONT=Courier New]@SACL=(02 0001)[/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,18,0a,00,00,01,00,00,00,0d,00,00,00,f0,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,e2,00,32,00,84,00,00,00,00,9d,d1,af,20,00,41,63,74,69,76,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\X*

][/FONT]
[FONT=Courier New]@SACL=(02 0001)[/FONT]
[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,fe,08,00,00,01,00,00,00,0c,00,00,00,ec,00,[/FONT]
[FONT=Courier New] 00,00,00,00,00,00,de,00,32,00,cd,00,00,00,00,ea,9a,0d,20,00,41,63,74,69,76,\[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings][/FONT]
[FONT=Courier New]@Denied: (A) (Users)[/FONT]
[FONT=Courier New]@Denied: (A) (Everyone)[/FONT]
[FONT=Courier New]@Allowed: (B 1 2 3 4 5) (S-1-5-20)[/FONT]
[FONT=Courier New]"BlindDial"=dword:00000000[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security][/FONT]
[FONT=Courier New]@Denied: (Full) (Everyone)[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]Completion time: 2012-08-18 21:47:51[/FONT]
[FONT=Courier New]ComboFix-quarantined-files.txt 2012-08-19 03:47[/FONT]
[FONT=Courier New]ComboFix2.txt 2012-08-17 15:10[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]Pre-Run: 91,629,699,072 bytes free[/FONT]
[FONT=Courier New]Post-Run: 91,735,994,368 bytes free[/FONT]
[FONT=Courier New].[/FONT]
[FONT=Courier New]- - End Of File - - BB601623529C5AB9E01A11839EF477FF[/FONT]
 
[FONT=Courier New]Rkill 2.2.1 by Lawrence Abrams (Grinler)[/FONT]

[FONT=Courier New]http://www.bleepingcomputer.com/[/FONT]

[FONT=Courier New]Copyright 2008-2012 BleepingComputer.com[/FONT]

[FONT=Courier New]More Information about Rkill can be found at this link:[/FONT]

[FONT=Courier New] http://www.bleepingcomputer.com/forums/topic308364.html[/FONT]

[FONT=Courier New] [/FONT]

[FONT=Courier New]Program started at: 08/18/2012 10:16:20 PM in x86 mode.[/FONT]

[FONT=Courier New]Windows Version: Windows 7[/FONT]

[FONT=Courier New] [/FONT]

[FONT=Courier New]Checking for Windows services to stop.[/FONT]

[FONT=Courier New] [/FONT]

[FONT=Courier New] * No malware services found to stop.[/FONT]

[FONT=Courier New] [/FONT]

[FONT=Courier New]Checking for processes to terminate.[/FONT]

[FONT=Courier New] [/FONT]

[FONT=Courier New] * No malware processes found to kill.[/FONT]

[FONT=Courier New] [/FONT]

[FONT=Courier New]Checking Registry for malware related settings.[/FONT]

[FONT=Courier New] [/FONT]

[FONT=Courier New] * Advanced Explorer Setting Removed: HideIcons [HKCU][/FONT]

[FONT=Courier New] [/FONT]

[FONT=Courier New]Backup Registry file created at:[/FONT]

[FONT=Courier New] C:\Users\Reginald\Desktop\rkill\rkill-08-18-2012-10-16-21.reg[/FONT]

[FONT=Courier New] [/FONT]

[FONT=Courier New]Resetting .EXE, .COM, & .BAT associations in the Windows Registry.[/FONT]

[FONT=Courier New] * HKLM\Software\Classes\.com "@" has been changed to ComFile![/FONT]

[FONT=Courier New] * HKLM\Software\Classes\.com "@" was reset to comfile![/FONT]

[FONT=Courier New] [/FONT]

[FONT=Courier New] [/FONT]

[FONT=Courier New]Performing miscellaneous checks.[/FONT]

[FONT=Courier New] [/FONT]

[FONT=Courier New] * No issues found.[/FONT]

[FONT=Courier New] [/FONT]

[FONT=Courier New]Checking Windows Service Integrity: [/FONT]

[FONT=Courier New] [/FONT]

[FONT=Courier New] * atapi => \SystemRoot\system32\drivers\atapi.sys [Incorrect ImagePath][/FONT]

[FONT=Courier New] [/FONT]

[FONT=Courier New]Searching for Missing Digital Signatures: [/FONT]

[FONT=Courier New] * No issues found.[/FONT]

[FONT=Courier New] [/FONT]

[FONT=Courier New]Program finished at: 08/18/2012 10:16:27 PM[/FONT]
[FONT=Courier New]Execution time: 0 hours(s), 0 minute(s), and 7 seconds(s[/FONT]
 
Combofix in saf mode immediately after Rkill

[FONT=Courier New]ComboFix 12-08-18.03 - Reginald 08/18/2012 22:19:44.4.4 - x86 MINIMAL[/FONT]

[FONT=Courier New]Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3070.2559 [GMT -6:00][/FONT]

[FONT=Courier New]Running from: c:\users\Reginald\Desktop\ComboFix.exe[/FONT]

[FONT=Courier New]AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}[/FONT]

[FONT=Courier New]SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}[/FONT]

[FONT=Courier New]SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}[/FONT]

[FONT=Courier New] * Created a new restore point[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]((((((((((((((((((((((((( Files Created from 2012-07-19 to 2012-08-19 )))))))))))))))))))))))))))))))[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]2012-08-19 04:30 . 2012-08-19 04:30-------- d-----w- c:\users\Default\AppData\Local\temp[/FONT]

[FONT=Courier New]2012-08-18 14:28 . 2012-08-18 14:2856200----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D038EA17-3377-478B-B5ED-19B9E4CFA74B}\offreg.dll[/FONT]

[FONT=Courier New]2012-08-18 14:27 . 2012-08-18 14:27-------- d-----w- c:\users\Reginald\AppData\Roaming\Anvisoft[/FONT]

[FONT=Courier New]2012-08-18 14:27 . 2012-07-13 05:4914160----a-w- c:\windows\system32\drivers\asdws.sys[/FONT]

[FONT=Courier New]2012-08-18 14:27 . 2012-07-13 05:4922864----a-w- c:\windows\system32\drivers\asdrs.sys[/FONT]

[FONT=Courier New]2012-08-18 14:27 . 2012-07-13 05:4916208----a-w- c:\windows\system32\drivers\asdrm.sys[/FONT]

[FONT=Courier New]2012-08-18 14:27 . 2012-08-18 14:27-------- d-----w- c:\programdata\Anvisoft[/FONT]

[FONT=Courier New]2012-08-18 14:27 . 2012-08-18 14:27-------- d-----w- c:\program files\Anvisoft[/FONT]

[FONT=Courier New]2012-08-17 20:51 . 2009-08-20 05:5022872----a-r- c:\windows\system32\AdobePDFUI.dll[/FONT]

[FONT=Courier New]2012-08-17 20:47 . 2012-07-30 20:52103904 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll[/FONT]

[FONT=Courier New]2012-08-17 19:02 . 2012-07-16 08:416891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D038EA17-3377-478B-B5ED-19B9E4CFA74B}\mpengine.dll[/FONT]

[FONT=Courier New]2012-08-17 16:23 . 2012-08-17 16:23-------- d-----w- c:\program files\ESET[/FONT]

[FONT=Courier New]2012-08-16 17:25 . 2012-08-17 14:20-------- d-----w- c:\users\Reginald\AppData\Roaming\ActiveWords 2.0[/FONT]

[FONT=Courier New]2012-08-16 17:25 . 2012-08-16 17:25-------- d-----w- c:\programdata\Licenses[/FONT]

[FONT=Courier New]2012-08-16 17:25 . 2012-08-16 17:25232915 ----a-w- c:\windows\ActiveWords Uninstaller.exe[/FONT]

[FONT=Courier New]2012-08-16 17:25 . 2012-08-16 17:25-------- d-----w- c:\program files\Common Files\orangequava[/FONT]

[FONT=Courier New]2012-08-16 17:25 . 2012-08-16 17:25-------- d-----w- c:\program files\ActiveWords[/FONT]

[FONT=Courier New]2012-08-16 13:42 . 2012-07-16 08:416891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll[/FONT]

[FONT=Courier New]2012-08-16 13:13 . 2012-07-06 19:23393728 ----a-w- c:\windows\system32\drivers\bthport.sys[/FONT]

[FONT=Courier New]2012-08-16 13:09 . 2012-07-18 17:472345984 ----a-w- c:\windows\system32\win32k.sys[/FONT]

[FONT=Courier New]2012-08-16 13:09 . 2012-05-05 07:46400896 ----a-w- c:\windows\system32\srcore.dll[/FONT]

[FONT=Courier New]2012-08-16 13:09 . 2012-07-04 21:1441984----a-w- c:\windows\system32\browcli.dll[/FONT]

[FONT=Courier New]2012-08-16 13:09 . 2012-07-04 21:14102912 ----a-w- c:\windows\system32\browser.dll[/FONT]

[FONT=Courier New]2012-08-16 13:09 . 2012-05-14 04:33769024 ----a-w- c:\windows\system32\localspl.dll[/FONT]

[FONT=Courier New]2012-08-15 23:44 . 2012-08-15 23:44-------- d-----w- c:\program files\AirPort[/FONT]

[FONT=Courier New]2012-08-15 15:23 . 2012-08-15 15:23-------- d-----w- C:\Backreg[/FONT]

[FONT=Courier New]2012-08-15 12:10 . 2012-08-15 12:10691696 ----a-w- c:\windows\system32\drivers\sptd.sys[/FONT]

[FONT=Courier New]2012-08-15 12:10 . 2012-08-15 12:10-------- d-----w- c:\program files\LSoft Technologies[/FONT]

[FONT=Courier New]2012-08-15 03:59 . 2012-08-15 03:59-------- d-----w- c:\windows\RestoreSafeDeleted[/FONT]

[FONT=Courier New]2012-08-15 03:52 . 2012-08-15 15:17-------- d-----w- c:\program files\UnHackMe[/FONT]

[FONT=Courier New]2012-08-15 03:28 . 2012-08-15 03:282 --shatr- c:\windows\winstart.bat[/FONT]

[FONT=Courier New]2012-08-15 03:28 . 2012-08-15 03:28-------- d-----w- c:\program files\Greatis[/FONT]

[FONT=Courier New]2012-08-15 03:23 . 2012-08-15 15:10-------- d-----w- c:\programdata\RegRun[/FONT]

[FONT=Courier New]2012-08-15 02:08 . 2012-08-15 02:10-------- d-----w- c:\programdata\HitmanPro[/FONT]

[FONT=Courier New]2012-08-15 01:14 . 2012-02-09 20:17713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{93354889-7EA1-40C7-AC78-80F571619CC8}\gapaengine.dll[/FONT]

[FONT=Courier New]2012-08-15 01:13 . 2012-08-15 01:13100864 ----a-w- C:\pwlyikod.sys[/FONT]

[FONT=Courier New]2012-08-15 01:08 . 2012-08-15 01:08-------- d-----w- c:\program files\Microsoft Security Client[/FONT]

[FONT=Courier New]2012-08-15 00:41 . 2012-08-15 00:41-------- d-----w- c:\programdata\Sophos[/FONT]

[FONT=Courier New]2012-08-15 00:41 . 2012-08-15 00:4173728----a-r- c:\users\Reginald\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\SVRTgui.exe1_810EDD9E2F0A4E2BACF86673C38D9F48.exe[/FONT]

[FONT=Courier New]2012-08-15 00:41 . 2012-08-15 00:4173728----a-r- c:\users\Reginald\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\SVRTgui.exe_810EDD9E2F0A4E2BACF86673C38D9F48.exe[/FONT]

[FONT=Courier New]2012-08-15 00:41 . 2012-08-15 00:4173728----a-r- c:\users\Reginald\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\ARPPRODUCTICON.exe[/FONT]

[FONT=Courier New]2012-08-15 00:41 . 2012-08-15 00:41-------- d-----w- c:\program files\Sophos[/FONT]

[FONT=Courier New]2012-08-15 00:19 . 2012-08-15 02:50-------- d-----w- C:\TDSSKiller_Quarantine[/FONT]

[FONT=Courier New]2012-07-21 11:43 . 2012-07-21 11:43-------- d-----w- c:\users\Reginald\AppData\Roaming\SUPERAntiSpyware.com[/FONT]

[FONT=Courier New]2012-07-21 11:43 . 2012-07-21 11:43-------- d-----w- c:\program files\SUPERAntiSpyware[/FONT]

[FONT=Courier New]2012-07-21 11:43 . 2012-07-21 11:43-------- d-----w- c:\programdata\SUPERAntiSpyware.com[/FONT]

[FONT=Courier New]2012-07-20 19:18 . 2012-07-20 19:18-------- d-----w- c:\program files\Common Files\Skype[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New](((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]2012-08-16 16:11 . 2010-06-10 14:52848 --sha-w- c:\programdata\KGyGaAvL.sys[/FONT]

[FONT=Courier New]2012-08-15 07:17 . 2012-04-15 11:37426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe[/FONT]

[FONT=Courier New]2012-08-15 07:17 . 2011-06-03 22:4970344----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl[/FONT]

[FONT=Courier New]2012-08-15 00:20 . 2009-07-13 23:11259072 ----a-w- c:\windows\system32\services.exe[/FONT]

[FONT=Courier New]2012-07-12 09:36 . 2010-04-05 15:5483392----a-w- c:\windows\system32\LMIRfsClientNP.dll[/FONT]

[FONT=Courier New]2012-07-12 09:36 . 2010-04-05 15:5452128----a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll[/FONT]

[FONT=Courier New]2012-07-12 09:36 . 2010-04-05 15:5430624----a-w- c:\windows\system32\LMIport.dll[/FONT]

[FONT=Courier New]2012-07-12 09:36 . 2010-04-05 15:5487456----a-w- c:\windows\system32\LMIinit.dll[/FONT]

[FONT=Courier New]2012-07-03 19:46 . 2012-04-17 22:1622344----a-w- c:\windows\system32\drivers\mbam.sys[/FONT]

[FONT=Courier New]2012-06-06 14:49 . 2012-06-06 14:491070152 ----a-w- c:\windows\system32\MSCOMCTL.OCX[/FONT]

[FONT=Courier New]2012-06-06 05:05 . 2012-07-11 07:531390080 ----a-w- c:\windows\system32\msxml6.dll[/FONT]

[FONT=Courier New]2012-06-06 05:05 . 2012-07-11 07:531236992 ----a-w- c:\windows\system32\msxml3.dll[/FONT]

[FONT=Courier New]2012-06-06 05:03 . 2012-07-11 07:53805376 ----a-w- c:\windows\system32\cdosys.dll[/FONT]

[FONT=Courier New]2012-06-02 22:19 . 2012-06-21 16:5453784----a-w- c:\windows\system32\wuauclt.exe[/FONT]

[FONT=Courier New]2012-06-02 22:19 . 2012-06-21 16:5445080----a-w- c:\windows\system32\wups2.dll[/FONT]

[FONT=Courier New]2012-06-02 22:19 . 2012-06-21 16:5435864----a-w- c:\windows\system32\wups.dll[/FONT]

[FONT=Courier New]2012-06-02 22:19 . 2012-06-21 16:54577048 ----a-w- c:\windows\system32\wuapi.dll[/FONT]

[FONT=Courier New]2012-06-02 22:19 . 2012-06-21 16:541933848 ----a-w- c:\windows\system32\wuaueng.dll[/FONT]

[FONT=Courier New]2012-06-02 22:12 . 2012-06-21 16:542422272 ----a-w- c:\windows\system32\wucltux.dll[/FONT]

[FONT=Courier New]2012-06-02 22:12 . 2012-06-21 16:5488576----a-w- c:\windows\system32\wudriver.dll[/FONT]

[FONT=Courier New]2012-06-02 21:19 . 2012-06-21 16:54171904 ----a-w- c:\windows\system32\wuwebv.dll[/FONT]

[FONT=Courier New]2012-06-02 21:12 . 2012-06-21 16:5433792----a-w- c:\windows\system32\wuapp.exe[/FONT]

[FONT=Courier New]2012-06-02 04:45 . 2012-07-11 07:5367440----a-w- c:\windows\system32\drivers\ksecdd.sys[/FONT]

[FONT=Courier New]2012-06-02 04:45 . 2012-07-11 07:53134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys[/FONT]

[FONT=Courier New]2012-06-02 04:40 . 2012-07-11 07:53369336 ----a-w- c:\windows\system32\drivers\cng.sys[/FONT]

[FONT=Courier New]2012-06-02 04:40 . 2012-07-11 07:53225280 ----a-w- c:\windows\system32\schannel.dll[/FONT]

[FONT=Courier New]2012-06-02 04:39 . 2012-07-11 07:53219136 ----a-w- c:\windows\system32\ncrypt.dll[/FONT]

[FONT=Courier New]2012-05-22 19:16 . 2010-04-05 15:5483360----a-w- c:\windows\system32\LMIRfsClientNP.dll.000.bak[/FONT]

[FONT=Courier New]2012-04-17 02:14 . 2011-08-07 19:2097208----a-w- c:\program files\mozilla firefox\components\browsercomps.dll[/FONT]

[FONT=Courier New]2010-08-14 12:06 . 2010-08-14 12:06119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]*Note* empty entries & legit default entries are not shown [/FONT]

[FONT=Courier New]REGEDIT4[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks][/FONT]

[FONT=Courier New]"{fa887e92-8f5f-4ec9-99ca-09be0e4120d6}"= "c:\program files\AddThis Toolbar\Helper.dll" [2010-06-08 243200][/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_CLASSES_ROOT\clsid\{fa887e92-8f5f-4ec9-99ca-09be0e4120d6}][/FONT]

[FONT=Courier New][HKEY_CLASSES_ROOT\FreeCauseURLSearchHook.FCToolbarURLSearchHook.1][/FONT]

[FONT=Courier New][HKEY_CLASSES_ROOT\TypeLib\{4ACB7285-8557-43C3-80DA-22D40B15DC77}][/FONT]

[FONT=Courier New][HKEY_CLASSES_ROOT\FreeCauseURLSearchHook.FCToolbarURLSearchHook][/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1][/FONT]

[FONT=Courier New]@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"[/FONT]

[FONT=Courier New][HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}][/FONT]

[FONT=Courier New]2011-02-18 05:12 94208----a-w- c:\users\Reginald\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2][/FONT]

[FONT=Courier New]@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"[/FONT]

[FONT=Courier New][HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}][/FONT]

[FONT=Courier New]2011-02-18 05:12 94208----a-w- c:\users\Reginald\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3][/FONT]

[FONT=Courier New]@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"[/FONT]

[FONT=Courier New][HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}][/FONT]

[FONT=Courier New]2011-02-18 05:12 94208----a-w- c:\users\Reginald\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4][/FONT]

[FONT=Courier New]@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"[/FONT]

[FONT=Courier New][HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}][/FONT]

[FONT=Courier New]2011-02-18 05:12 94208----a-w- c:\users\Reginald\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run][/FONT]

[FONT=Courier New]"AirVideoServer"="c:\program files\AirVideoServer\AirVideoServer.exe" [2010-09-22 4923784][/FONT]

[FONT=Courier New]"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-08-23 4608][/FONT]

[FONT=Courier New]"DU Meter"="c:\program files\DU Meter\DUMeter.exe" [2010-09-29 2942856][/FONT]

[FONT=Courier New]"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2010-11-20 144384][/FONT]

[FONT=Courier New]"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112][/FONT]

[FONT=Courier New]"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-08-14 39408][/FONT]

[FONT=Courier New]"OfficeSyncProcess"="c:\program files\Microsoft Office\Office14\MSOSYNC.EXE" [2012-01-21 719672][/FONT]

[FONT=Courier New]"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480][/FONT]

[FONT=Courier New]"MobileDocuments"="c:\program files\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240][/FONT]

[FONT=Courier New]"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2012-07-19 109336][/FONT]

[FONT=Courier New]"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-07-09 4777856][/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run][/FONT]

[FONT=Courier New]"VX6000"="c:\windows\vVX6000.exe" [2009-06-26 759296][/FONT]

[FONT=Courier New]"Bluetooth HCI Monitor"="HCIMNTR.DLL" [2006-12-07 9728][/FONT]

[FONT=Courier New]"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2012-07-30 640480][/FONT]

[FONT=Courier New]"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2012-07-31 41944][/FONT]

[FONT=Courier New]"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2009-03-11 611712][/FONT]

[FONT=Courier New]"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240][/FONT]

[FONT=Courier New]"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424][/FONT]

[FONT=Courier New]"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920][/FONT]

[FONT=Courier New]"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-14 30192][/FONT]

[FONT=Courier New]"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712][/FONT]

[FONT=Courier New]"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2009-07-24 118640][/FONT]

[FONT=Courier New]"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048][/FONT]

[FONT=Courier New]"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304][/FONT]

[FONT=Courier New]"QuickFinder Scheduler"="c:\program files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE" [2009-06-22 83232][/FONT]

[FONT=Courier New]"vmware-tray"="c:\program files\VMware\VMware Workstation\vmware-tray.exe" [2009-03-27 96816][/FONT]

[FONT=Courier New]"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296][/FONT]

[FONT=Courier New]"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2009-07-08 236016][/FONT]

[FONT=Courier New]"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520][/FONT]

[FONT=Courier New]"SysMetrix"="c:\program files\SysMetrix\SysMetrix.exe" [2010-02-17 2621440][/FONT]

[FONT=Courier New]"SAOB Monitor"="c:\program files\Acronis\OnlineBackupStandalone\TrueImageMonitor.exe" [2010-08-20 2536448][/FONT]

[FONT=Courier New]"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2010-08-21 5458848][/FONT]

[FONT=Courier New]"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2010-08-21 390736][/FONT]

[FONT=Courier New]"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 1821576][/FONT]

[FONT=Courier New]"KSafeTray"="c:\program files\Kingsoft\PcDoctor\KSafeTray.exe" [2012-04-11 1308064][/FONT]

[FONT=Courier New]"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240][/FONT]

[FONT=Courier New]"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920][/FONT]

[FONT=Courier New]"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200][/FONT]

[FONT=Courier New]"AirPort Base Station Agent"="c:\program files\AirPort\APAgent.exe" [2009-11-11 771360][/FONT]

[FONT=Courier New]"Anvi Smart Defender"="c:\program files\Anvisoft\Anvi Smart Defender\ASDTray.exe" [2012-07-20 1217864][/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]c:\users\Reginald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\[/FONT]

[FONT=Courier New]Active WebCam.LNK - c:\program files\Active WebCam\WebCam.exe [2009-8-18 4899136][/FONT]

[FONT=Courier New]ActiveWords.lnk - c:\program files\ActiveWords\AWMonitor.exe [2012-3-3 3506176][/FONT]

[FONT=Courier New]Dropbox.lnk - c:\users\Reginald\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840][/FONT]

[FONT=Courier New]Virtual Weather Station.lnk - c:\vws\vws.exe [2011-10-19 21328896][/FONT]

[FONT=Courier New]WePrint Server.lnk - c:\program files\WePrint\WePrint Server.exe [2011-8-26 2542080][/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\[/FONT]

[FONT=Courier New]APC UPS Status.lnk - c:\program files\APC\APC PowerChute Personal Edition\Display.exe [2010-9-14 271736][/FONT]

[FONT=Courier New]Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-4-13 791840][/FONT]

[FONT=Courier New]Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-4-26 50688][/FONT]

[FONT=Courier New]Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-10-30 282624][/FONT]

[FONT=Courier New]Snagit 10.lnk - c:\program files\TechSmith\Snagit 10\Snagit32.exe [2010-4-13 7046984][/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system][/FONT]

[FONT=Courier New]"ConsentPromptBehaviorAdmin"= 0 (0x0)[/FONT]

[FONT=Courier New]"ConsentPromptBehaviorUser"= 3 (0x3)[/FONT]

[FONT=Courier New]"EnableLUA"= 0 (0x0)[/FONT]

[FONT=Courier New]"EnableUIADesktopToggle"= 0 (0x0)[/FONT]

[FONT=Courier New]"PromptOnSecureDesktop"= 0 (0x0)[/FONT]

[FONT=Courier New]"EnableLinkedConnections"= 1 (0x1)[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler][/FONT]

[FONT=Courier New]"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences\FencesMenu.dll" [2010-11-30 279912][/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks][/FONT]

[FONT=Courier New]"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024][/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon][/FONT]

[FONT=Courier New]2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE][/FONT]

[FONT=Courier New]@=""[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36][/FONT]

[FONT=Courier New]@=""[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36.sys][/FONT]

[FONT=Courier New]@=""[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc][/FONT]

[FONT=Courier New]@="Service"[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys][/FONT]

[FONT=Courier New]"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x][/FONT]

[FONT=Courier New]R1 asdrm;asdrm;c:\windows\system32\DRIVERS\asdrm.sys [x][/FONT]

[FONT=Courier New]R1 kmodurl;kmodurl;c:\program files\Kingsoft\PcDoctor\kmodurl.sys [x][/FONT]

[FONT=Courier New]R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [x][/FONT]

[FONT=Courier New]R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [x][/FONT]

[FONT=Courier New]R2 afcdpsrv;Acronis Nonstop Backup service;c:\program files\Common Files\Acronis\CDP\afcdpsrv.exe [x][/FONT]

[FONT=Courier New]R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x][/FONT]

[FONT=Courier New]R2 APC Data Service;APC Data Service;c:\program files\APC\APC PowerChute Personal Edition\dataserv.exe [x][/FONT]

[FONT=Courier New]R2 asdrs;AntiMalware Host-based Intrusion Prevention System;c:\windows\system32\DRIVERS\asdrs.sys [x][/FONT]

[FONT=Courier New]R2 asdsrv;Anvi Smart Defender Realtime Guard Service;c:\program files\Anvisoft\Anvi Smart Defender\ASDSrv.exe [x][/FONT]

[FONT=Courier New]R2 asdws;AnviSmartDefender Web Guard;c:\windows\system32\DRIVERS\asdws.sys [x][/FONT]

[FONT=Courier New]R2 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\SeaPort.EXE [x][/FONT]

[FONT=Courier New]R2 DbgSvc;Debug Diagnostic Service;c:\program files\DebugDiag\DbgSvc.exe [x][/FONT]

[FONT=Courier New]R2 DUMeterSvc;DU Meter Service;c:\program files\DU Meter\DUMeterSvc.exe [x][/FONT]

[FONT=Courier New]R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x][/FONT]

[FONT=Courier New]R2 KSafeSvc;KSafe service;c:\program files\Kingsoft\PcDoctor\KSafeSvc.exe [x][/FONT]

[FONT=Courier New]R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [x][/FONT]

[FONT=Courier New]R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x][/FONT]

[FONT=Courier New]R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\Malwarebytes' Anti-Malware\mbamservice.exe [x][/FONT]

[FONT=Courier New]R2 MSSQL$MICROSOFTSCM;SQL Server (MICROSOFTSCM);c:\program files\Microsoft SQL Server\MSSQL10.MICROSOFTSCM\MSSQL\Binn\sqlservr.exe [x][/FONT]

[FONT=Courier New]R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [x][/FONT]

[FONT=Courier New]R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x][/FONT]

[FONT=Courier New]R2 SlingAgentService;SlingAgentService;c:\program files\Sling Media\SlingAgent\SlingAgentService.exe [x][/FONT]

[FONT=Courier New]R2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [x][/FONT]

[FONT=Courier New]R2 vmci;VMware vmci;c:\windows\system32\Drivers\vmci.sys [x][/FONT]

[FONT=Courier New]R3 ACTIVEWEBCAMWATCHDOG;Active WebCam Watchdog;c:\program files\Active WebCam\Watchdog.exe [x][/FONT]

[FONT=Courier New]R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x][/FONT]

[FONT=Courier New]R3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [x][/FONT]

[FONT=Courier New]R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x][/FONT]

[FONT=Courier New]R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x][/FONT]

[FONT=Courier New]R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [x][/FONT]

[FONT=Courier New]R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x][/FONT]

[FONT=Courier New]R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x][/FONT]

[FONT=Courier New]R3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [x][/FONT]

[FONT=Courier New]R3 DUMeterDrv;Hagel Technologies DU Meter traffic accounting driver;c:\program files\DU Meter\DUMETR32.SYS [x][/FONT]

[FONT=Courier New]R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [x][/FONT]

[FONT=Courier New]R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [x][/FONT]

[FONT=Courier New]R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [x][/FONT]

[FONT=Courier New]R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x][/FONT]

[FONT=Courier New]R3 libusb0;LibUsb-Win32 - Kernel Driver 06/04/2010,1.12.1.0;c:\windows\system32\DRIVERS\libusb0.sys [x][/FONT]

[FONT=Courier New]R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x][/FONT]

[FONT=Courier New]R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x][/FONT]

[FONT=Courier New]R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x][/FONT]

[FONT=Courier New]R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x][/FONT]

[FONT=Courier New]R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x][/FONT]

[FONT=Courier New]R3 PCDSRVC{E9D79540-57D5953E-06020101}_0;PCDSRVC{E9D79540-57D5953E-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc.pkms [x][/FONT]

[FONT=Courier New]R3 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;c:\windows\system32\PLCNDIS5.SYS [x][/FONT]

[FONT=Courier New]R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x][/FONT]

[FONT=Courier New]R3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Professional Business 2009.SP3c\RpcAgentSrv.exe [x][/FONT]

[FONT=Courier New]R3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\DRIVERS\silabenm.sys [x][/FONT]

[FONT=Courier New]R3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys [x][/FONT]

[FONT=Courier New]R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x][/FONT]

[FONT=Courier New]R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x][/FONT]

[FONT=Courier New]R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x][/FONT]

[FONT=Courier New]R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x][/FONT]

[FONT=Courier New]R3 VST_DPV;VST_DPV;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x][/FONT]

[FONT=Courier New]R3 VSTHWBS2;VSTHWBS2;c:\windows\system32\DRIVERS\VSTBS23.SYS [x][/FONT]

[FONT=Courier New]R3 VX6000;Microsoft LifeCam VX-6000;c:\windows\system32\DRIVERS\VX6000Xp.sys [x][/FONT]

[FONT=Courier New]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x][/FONT]

[FONT=Courier New]R3 XE102Mp5;XE102Mp5 NDIS Protocol Driver;c:\windows\system32\Drivers\XE102Mp5.sys [x][/FONT]

[FONT=Courier New]R3 XE102Sp5;XE102Sp5 NDIS Protocol Driver;c:\windows\system32\Drivers\XE102Sp5.sys [x][/FONT]

[FONT=Courier New]R4 ACTIVEWEBCAM;Active WebCam;c:\program files\Active WebCam\WebCam.exe [x][/FONT]

[FONT=Courier New]R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [x][/FONT]

[FONT=Courier New]R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [x][/FONT]

[FONT=Courier New]R4 SQLAgent$MICROSOFTSCM;SQL Server Agent (MICROSOFTSCM);c:\program files\Microsoft SQL Server\MSSQL10.MICROSOFTSCM\MSSQL\Binn\SQLAGENT.EXE [x][/FONT]

[FONT=Courier New]S0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);c:\windows\system32\DRIVERS\tdrpm273.sys [x][/FONT]

[FONT=Courier New]S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [x][/FONT]

[FONT=Courier New]S3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [x][/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]--- Other Services/Drivers In Memory ---[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]*NewlyCreated* - CPUDRV[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]Contents of the 'Scheduled Tasks' folder[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]2012-08-19 c:\windows\Tasks\Adobe Flash Player Updater.job[/FONT]

[FONT=Courier New]- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-15 07:17][/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]2012-08-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job[/FONT]

[FONT=Courier New]- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-28 18:57][/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]2012-08-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job[/FONT]

[FONT=Courier New]- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-28 18:57][/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]2012-08-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1359024441-3580254713-1987414973-1000Core.job[/FONT]

[FONT=Courier New]- c:\users\Reginald\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-22 20:34][/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]2012-08-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1359024441-3580254713-1987414973-1000UA.job[/FONT]

[FONT=Courier New]- c:\users\Reginald\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-22 20:34][/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]2012-08-14 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job[/FONT]

[FONT=Courier New]- c:\program files\Dell Support Center\uaclauncher.exe [2012-04-13 05:40][/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]2012-08-19 c:\windows\Tasks\SystemToolsDailyTest.job[/FONT]
 
[FONT=Courier New]- c:\program files\Dell Support Center\uaclauncher.exe [2012-04-13 05:40][/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]2012-08-19 c:\windows\Tasks\User_Feed_Synchronization-{1D9D0871-37AF-43C2-BA55-FCB153C904EF}.job[/FONT]

[FONT=Courier New]- c:\windows\system32\msfeedssync.exe [2011-06-03 22:38][/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]------- Supplementary Scan -------[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]uStart Page = hxxp://www.google.com/[/FONT]

[FONT=Courier New]uDefault_Search_URL = hxxp://www.google.com/ie[/FONT]

[FONT=Courier New]mStart Page = hxxp://www.google.com/[/FONT]

[FONT=Courier New]uInternet Settings,ProxyOverride = *.local[/FONT]

[FONT=Courier New]uSearchAssistant = hxxp://www.google.com/ie[/FONT]

[FONT=Courier New]uSearchURL,(Default) = hxxp://www.google.com/search?q=%s[/FONT]

[FONT=Courier New]IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200[/FONT]

[FONT=Courier New]IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html[/FONT]

[FONT=Courier New]IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html[/FONT]

[FONT=Courier New]IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html[/FONT]

[FONT=Courier New]IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html[/FONT]

[FONT=Courier New]IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html[/FONT]

[FONT=Courier New]IE: E&xport to Microsoft Excel - c:\progra~1\Microsoft Office\Office14\EXCEL.EXE/3000[/FONT]

[FONT=Courier New]IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html[/FONT]

[FONT=Courier New]IE: Open with WordPerfect - c:\program files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta[/FONT]

[FONT=Courier New]IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html[/FONT]

[FONT=Courier New]IE: Se&nd to OneNote - c:\progra~1\Microsoft Office\Office14\ONBttnIE.dll/105[/FONT]

[FONT=Courier New]IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm[/FONT]

[FONT=Courier New]IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm[/FONT]

[FONT=Courier New]IE: Show RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html[/FONT]

[FONT=Courier New]Trusted Zone: garmin.com\connect[/FONT]

[FONT=Courier New]Trusted Zone: garmin.com\mygarmin[/FONT]

[FONT=Courier New]Trusted Zone: garmin.com\www[/FONT]

[FONT=Courier New]Trusted Zone: real.com\rhap-app-4-0[/FONT]

[FONT=Courier New]Trusted Zone: real.com\rhapreg[/FONT]

[FONT=Courier New]Trusted Zone: zoombak.com\locate[/FONT]

[FONT=Courier New]Trusted Zone: zoombak.com\shop[/FONT]

[FONT=Courier New]TCP: DhcpNameServer = 72.19.128.53 72.19.128.99[/FONT]

[FONT=Courier New]TCP: Interfaces\{297982DB-7F42-4718-8D4B-A71C72C5621A}: DhcpNameServer = 72.19.128.53 72.19.128.99[/FONT]

[FONT=Courier New]DPF: CaptureClient - hxxp://192.168.1.110/CaptureClient.cab[/FONT]

[FONT=Courier New]DPF: {22D82B43-FF26-455A-A96D-A6C61F056ED7} - hxxp://192.168.1.210/xplugxLiteTW.cab[/FONT]

[FONT=Courier New]FF - ProfilePath - c:\users\Reginald\AppData\Roaming\Mozilla\Firefox\Profiles\0gixnud9.default\[/FONT]

[FONT=Courier New]FF - prefs.js: browser.startup.homepage - hxxp://watch.slingbox.com/watch/sling_player[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DUMeterSvc][/FONT]

[FONT=Courier New]"ImagePath"="c:\program files\DU Meter\DUMeterSvc.exe /startedbyscm:E1F6D4BE-40E33354-DUMeterService"[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{E9D79540-57D5953E-06020101}_0][/FONT]

[FONT=Courier New]"ImagePath"="\??\c:\program files\dell support center\pcdsrvc.pkms"[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]--------------------- LOCKED REGISTRY KEYS ---------------------[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\B*o*o*k*m*a*r*k*s* *T*o*o*l*b*a*r*
\Microsoft]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,02,01,00,00,01,00,00,00,02,00,00,00,78,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,6a,00,32,00,cd,00,00,00,00,a5,ba,a6,20,00,46,72,65,65,20,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\B*o*o*k*m*a*r*k*s* *T*o*o*l*b*a*r*
\News]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,fc,03,00,00,01,00,00,00,09,00,00,00,6c,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,5e,00,32,00,cd,00,00,00,00,bd,65,70,20,00,42,42,43,20,4e,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\B*o*o*k*m*a*r*k*s* *T*o*o*l*b*a*r*
\Popular]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,c4,01,00,00,01,00,00,00,04,00,00,00,66,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,58,00,32,00,cd,00,00,00,00,a2,23,05,20,00,41,6d,61,7a,6f,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\Business and Finance]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,14,05,00,00,01,00,00,00,09,00,00,00,7e,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,70,00,32,00,84,00,00,00,00,86,ca,f9,20,00,43,61,72,65,65,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\Computers and Internet]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,a6,04,00,00,01,00,00,00,09,00,00,00,70,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,f4,d4,29,20,00,40,76,61,6e,74,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\Directories]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,12,05,00,00,01,00,00,00,09,00,00,00,a2,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,94,00,32,00,84,00,00,00,00,37,e6,6b,20,00,34,61,6e,79,74,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\Entertainment and Lifestyles]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,b2,04,00,00,01,00,00,00,09,00,00,00,90,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,82,00,32,00,84,00,00,00,00,1f,71,d7,20,00,43,65,6c,65,62,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\News and Sports]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,ce,04,00,00,01,00,00,00,09,00,00,00,78,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,6a,00,32,00,84,00,00,00,00,c2,11,99,20,00,41,42,43,4e,45,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\Personal Toolbar Folder]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,b0,03,00,00,01,00,00,00,08,00,00,00,70,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,d2,e6,29,20,00,43,61,6c,65,6e,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\Search]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,92,03,00,00,01,00,00,00,08,00,00,00,72,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,dc,5c,7d,20,00,41,62,6f,75,74,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\Shopping and Classifieds]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,b4,04,00,00,01,00,00,00,09,00,00,00,76,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,68,00,32,00,84,00,00,00,00,6b,e0,e3,20,00,41,6d,61,7a,6f,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\Travel and Leisure]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,a0,04,00,00,01,00,00,00,09,00,00,00,82,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,74,00,32,00,84,00,00,00,00,75,30,93,20,00,4c,65,69,73,75,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*
\What's New and Cool]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,e6,04,00,00,01,00,00,00,09,00,00,00,9c,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,8e,00,32,00,84,00,00,00,00,67,aa,7d,20,00,41,64,76,65,72,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\Business and Finance]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,f0,04,00,00,01,00,00,00,09,00,00,00,7a,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,6c,00,32,00,cd,00,00,00,00,b5,fc,e8,20,00,43,61,72,65,65,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\Computers and Internet]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,82,04,00,00,01,00,00,00,09,00,00,00,6c,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,5e,00,32,00,cd,00,00,00,00,12,d9,88,20,00,40,76,61,6e,74,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\Directories]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,ee,04,00,00,01,00,00,00,09,00,00,00,9e,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,90,00,32,00,cd,00,00,00,00,81,e4,88,20,00,34,61,6e,79,74,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\Entertainment and Lifestyles]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,8e,04,00,00,01,00,00,00,09,00,00,00,8c,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,7e,00,32,00,cd,00,00,00,00,62,71,02,20,00,43,65,6c,65,62,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\News and Sports]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,aa,04,00,00,01,00,00,00,09,00,00,00,74,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,66,00,32,00,cd,00,00,00,00,52,65,7c,20,00,41,42,43,4e,45,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\Personal Toolbar Folder]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,90,03,00,00,01,00,00,00,08,00,00,00,6c,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,5e,00,32,00,cd,00,00,00,00,8d,1f,0f,20,00,43,61,6c,65,6e,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\Search]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,72,03,00,00,01,00,00,00,08,00,00,00,6e,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,60,00,32,00,cd,00,00,00,00,8d,f8,b7,20,00,41,62,6f,75,74,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\Shopping and Classifieds]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,90,04,00,00,01,00,00,00,09,00,00,00,72,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,64,00,32,00,cd,00,00,00,00,83,23,9e,20,00,41,6d,61,7a,6f,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\Travel and Leisure]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,7c,04,00,00,01,00,00,00,09,00,00,00,7e,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,70,00,32,00,cd,00,00,00,00,a7,04,67,20,00,4c,65,69,73,75,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\I*m*p*o*r*t*e*d* *b*o*o*k*m*a*r*k*s*

\What's New and Cool]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,c2,04,00,00,01,00,00,00,09,00,00,00,98,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,8a,00,32,00,cd,00,00,00,00,52,d6,a4,20,00,41,64,76,65,72,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*I*n*k*s*


\Bookmarks bar]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,e4,1f,00,00,01,00,00,00,49,00,00,00,68,00,[/FONT]

[FONT=Courier New] 00,00,48,00,00,00,5a,00,32,00,cd,00,00,00,00,3f,e0,7d,20,00,7e,72,65,67,68,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,28,04,00,00,01,00,00,00,0b,00,00,00,6c,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,5e,00,31,00,00,00,00,00,00,f6,fa,3e,10,00,41,6c,74,65,72,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Alternative]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,30,0c,00,00,01,00,00,00,15,00,00,00,96,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,ec,9c,e4,20,00,33,57,4b,20,55,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Classical]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,a0,05,00,00,01,00,00,00,09,00,00,00,96,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,ed,a9,92,20,00,43,42,43,20,52,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Country]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,70,07,00,00,01,00,00,00,0c,00,00,00,9a,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,e1,cc,2f,20,00,39,36,2e,33,20,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\International]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,98,03,00,00,01,00,00,00,06,00,00,00,96,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,b6,16,80,20,00,4e,65,74,52,61,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Jazz]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,12,05,00,00,01,00,00,00,08,00,00,00,9a,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,5f,eb,8f,20,00,42,65,61,63,68,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\News]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,98,05,00,00,01,00,00,00,09,00,00,00,96,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,5b,fd,5d,20,00,43,42,43,20,52,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Pop]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,cc,10,00,00,01,00,00,00,1c,00,00,00,96,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,0e,03,54,20,00,39,33,2e,31,20,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Rock]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,ca,09,00,00,01,00,00,00,10,00,00,00,a0,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,92,00,32,00,84,00,00,00,00,dd,b9,a0,20,00,39,32,20,4b,51,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Spiritual]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,5e,03,00,00,01,00,00,00,06,00,00,00,9a,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,3a,18,ad,20,00,43,68,72,69,73,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Sports]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,b8,05,00,00,01,00,00,00,0a,00,00,00,ac,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,91,03,de,20,00,45,53,50,4e,20,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*
\RealPlayer Stations\Talk]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,02,09,00,00,01,00,00,00,10,00,00,00,96,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,4b,42,b9,20,00,37,37,20,57,41,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,fc,03,00,00,01,00,00,00,0b,00,00,00,68,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,5a,00,31,00,00,00,00,00,00,0f,0b,f9,10,00,41,6c,74,65,72,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Alternative]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,dc,0b,00,00,01,00,00,00,15,00,00,00,92,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,84,00,32,00,cd,00,00,00,00,1f,d5,8f,20,00,33,57,4b,20,55,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Classical]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,7c,05,00,00,01,00,00,00,09,00,00,00,92,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,84,00,32,00,cd,00,00,00,00,5a,f6,4a,20,00,43,42,43,20,52,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Country]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,ae,06,00,00,01,00,00,00,0b,00,00,00,96,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,cd,00,00,00,00,ed,e9,b7,20,00,39,36,2e,33,20,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\International]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,80,03,00,00,01,00,00,00,06,00,00,00,92,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,84,00,32,00,cd,00,00,00,00,fd,f2,65,20,00,4e,65,74,52,61,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Jazz]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,f2,04,00,00,01,00,00,00,08,00,00,00,96,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,cd,00,00,00,00,ce,ea,5b,20,00,42,65,61,63,68,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\News]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,74,05,00,00,01,00,00,00,09,00,00,00,92,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,84,00,32,00,cd,00,00,00,00,86,76,c7,20,00,43,42,43,20,52,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Pop]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,5c,10,00,00,01,00,00,00,1c,00,00,00,92,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,84,00,32,00,cd,00,00,00,00,df,4d,5e,20,00,39,33,2e,31,20,\[/FONT]
 
[FONT=Courier New] [HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-.[/FONT]

[FONT=Courier New]1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Rock]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,8a,09,00,00,01,00,00,00,10,00,00,00,9c,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,8e,00,32,00,cd,00,00,00,00,8b,58,cc,20,00,39,32,20,4b,51,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Spiritual]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,46,03,00,00,01,00,00,00,06,00,00,00,96,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,cd,00,00,00,00,ea,15,5b,20,00,43,68,72,69,73,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Sports]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,90,05,00,00,01,00,00,00,0a,00,00,00,a8,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,9a,00,32,00,cd,00,00,00,00,9e,c3,6b,20,00,45,53,50,4e,20,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*e*d*I*a*

\RealPlayer Stations\Talk]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,c2,08,00,00,01,00,00,00,10,00,00,00,92,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,84,00,32,00,cd,00,00,00,00,7a,47,b3,20,00,37,37,20,57,41,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*B*C* *Y*a*h*o*o*!* *D*S*L*
\Yahoo!]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,38,0a,00,00,01,00,00,00,14,00,00,00,7c,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,6e,00,32,00,84,00,00,00,00,aa,87,d2,20,00,4c,41,55,4e,43,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*B*C* *Y*a*h*o*o*!* *D*S*L*

\Yahoo!]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,e8,09,00,00,01,00,00,00,14,00,00,00,78,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,6a,00,32,00,cd,00,00,00,00,18,84,70,20,00,4c,41,55,4e,43,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Baseball]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,28,07,00,00,01,00,00,00,0a,00,00,00,c0,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,b2,00,32,00,84,00,00,00,00,a5,a1,9f,20,00,42,61,73,65,62,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Gardening]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,08,02,00,00,01,00,00,00,03,00,00,00,9c,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,8e,00,32,00,84,00,00,00,00,9d,ef,03,20,00,46,69,6e,65,20,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Graduation]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,04,04,00,00,01,00,00,00,05,00,00,00,00,01,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,f2,00,32,00,84,00,00,00,00,d3,92,d6,20,00,47,6f,72,64,6f,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Home Improvement]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,22,03,00,00,01,00,00,00,05,00,00,00,c4,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,b6,00,32,00,84,00,00,00,00,9e,c8,e0,20,00,42,6f,62,56,69,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Microsoft Windows Plus! DME]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,fa,00,00,00,01,00,00,00,01,00,00,00,ee,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,e0,00,32,00,84,00,00,00,00,bc,3c,ae,20,00,4d,69,63,72,6f,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Mother's Day]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,90,03,00,00,01,00,00,00,07,00,00,00,5a,00,[/FONT]

[FONT=Courier New] 00,00,01,00,00,00,4c,00,31,00,00,00,00,00,00,dd,f6,b2,10,00,43,61,72,64,73,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Mother's Day\Cards]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,f0,02,00,00,01,00,00,00,04,00,00,00,ca,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,bc,00,32,00,84,00,00,00,00,bc,a7,ca,20,00,41,6d,65,72,69,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Mother's Day\Flowers & Chocolate]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,66,03,00,00,01,00,00,00,05,00,00,00,8a,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,0d,6c,9e,20,00,31,2d,38,30,30,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Mother's Day\Gifts]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,b0,04,00,00,01,00,00,00,06,00,00,00,88,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,ef,f4,ab,20,00,41,6d,61,7a,6f,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Mother's Day\Kids]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,92,02,00,00,01,00,00,00,03,00,00,00,ee,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,e0,00,32,00,84,00,00,00,00,77,f8,b6,20,00,42,69,6c,6c,79,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Outdoor Activities]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,9e,04,00,00,01,00,00,00,05,00,00,00,cc,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,be,00,32,00,84,00,00,00,00,98,c4,27,20,00,43,61,6d,70,69,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Photography]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,70,05,00,00,01,00,00,00,07,00,00,00,8e,00,[/FONT]

[FONT=Courier New] 00,00,03,00,00,00,80,00,31,00,00,00,00,00,00,86,0b,4f,10,00,4e,65,77,73,2c,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Photography\News, Reviews & How To]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,e0,04,00,00,01,00,00,00,05,00,00,00,3c,01,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,2e,01,32,00,84,00,00,00,00,4a,0f,14,20,00,44,69,67,69,74,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Photography\On-Line Stores]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,5e,04,00,00,01,00,00,00,05,00,00,00,2a,01,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,1c,01,32,00,84,00,00,00,00,27,d9,dd,20,00,41,6d,61,7a,6f,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*
\Wildlife & Nature]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,b0,04,00,00,01,00,00,00,05,00,00,00,3c,01,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,2e,01,32,00,84,00,00,00,00,3a,bb,a1,20,00,41,64,76,65,6e,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Baseball]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,00,07,00,00,01,00,00,00,0a,00,00,00,bc,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,ae,00,32,00,cd,00,00,00,00,2d,83,89,20,00,42,61,73,65,62,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Gardening]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,fc,01,00,00,01,00,00,00,03,00,00,00,98,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,8a,00,32,00,cd,00,00,00,00,35,68,30,20,00,46,69,6e,65,20,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Graduation]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,f0,03,00,00,01,00,00,00,05,00,00,00,fc,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,ee,00,32,00,cd,00,00,00,00,0c,9d,1b,20,00,47,6f,72,64,6f,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Home Improvement]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,0e,03,00,00,01,00,00,00,05,00,00,00,c0,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,b2,00,32,00,cd,00,00,00,00,39,4b,fc,20,00,42,6f,62,56,69,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Microsoft Windows Plus! DME]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,f6,00,00,00,01,00,00,00,01,00,00,00,ea,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,dc,00,32,00,cd,00,00,00,00,86,0b,c5,20,00,4d,69,63,72,6f,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Mother's Day]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,74,03,00,00,01,00,00,00,07,00,00,00,56,00,[/FONT]

[FONT=Courier New] 00,00,01,00,00,00,48,00,31,00,00,00,00,00,00,9d,36,10,10,00,43,61,72,64,73,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Mother's Day\Cards]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,e0,02,00,00,01,00,00,00,04,00,00,00,c6,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,b8,00,32,00,cd,00,00,00,00,93,a0,ac,20,00,41,6d,65,72,69,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Mother's Day\Flowers & Chocolate]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,52,03,00,00,01,00,00,00,05,00,00,00,86,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,78,00,32,00,cd,00,00,00,00,ce,ed,38,20,00,31,2d,38,30,30,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Mother's Day\Gifts]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,98,04,00,00,01,00,00,00,06,00,00,00,84,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,76,00,32,00,cd,00,00,00,00,5b,7c,87,20,00,41,6d,61,7a,6f,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Mother's Day\Kids]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,86,02,00,00,01,00,00,00,03,00,00,00,ea,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,dc,00,32,00,cd,00,00,00,00,77,5f,7e,20,00,42,69,6c,6c,79,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Outdoor Activities]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,8a,04,00,00,01,00,00,00,05,00,00,00,c8,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,ba,00,32,00,cd,00,00,00,00,39,70,fa,20,00,43,61,6d,70,69,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Photography]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,54,05,00,00,01,00,00,00,07,00,00,00,8a,00,[/FONT]

[FONT=Courier New] 00,00,03,00,00,00,7c,00,31,00,00,00,00,00,00,58,d9,86,10,00,4e,65,77,73,2c,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Photography\News, Reviews & How To]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,cc,04,00,00,01,00,00,00,05,00,00,00,38,01,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,2a,01,32,00,cd,00,00,00,00,f6,57,84,20,00,44,69,67,69,74,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Photography\On-Line Stores]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,4a,04,00,00,01,00,00,00,05,00,00,00,26,01,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,18,01,32,00,cd,00,00,00,00,ec,14,f7,20,00,41,6d,61,7a,6f,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\S*p*r*I*n*g* *F*a*v*o*r*I*t*e*s*

\Wildlife & Nature]
[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,9c,04,00,00,01,00,00,00,05,00,00,00,38,01,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,2a,01,32,00,cd,00,00,00,00,8a,a1,a7,20,00,41,64,76,65,6e,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\T*V*
]
[/FONT]

[FONT=Courier New]@SACL=(02 0001)[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,ea,01,00,00,01,00,00,00,02,00,00,00,ee,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,e0,00,32,00,84,00,00,00,00,5c,13,09,20,00,77,77,69,54,56,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\T*V*

]
[/FONT]

[FONT=Courier New]@SACL=(02 0001)[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,e2,01,00,00,01,00,00,00,02,00,00,00,ea,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,dc,00,32,00,cd,00,00,00,00,d6,dc,c6,20,00,77,77,69,54,56,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\X*p*
]
[/FONT]

[FONT=Courier New]@SACL=(02 0001)[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,36,01,00,00,01,00,00,00,02,00,00,00,9a,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,ec,21,94,20,00,57,69,6e,64,6f,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\X*p*

]
[/FONT]

[FONT=Courier New]@SACL=(02 0001)[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,2e,01,00,00,01,00,00,00,02,00,00,00,96,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,88,00,32,00,cd,00,00,00,00,de,77,65,20,00,57,69,6e,64,6f,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\X*
]
[/FONT]

[FONT=Courier New]@SACL=(02 0001)[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,18,0a,00,00,01,00,00,00,0d,00,00,00,f0,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,e2,00,32,00,84,00,00,00,00,9d,d1,af,20,00,41,63,74,69,76,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\X*

]
[/FONT]

[FONT=Courier New]@SACL=(02 0001)[/FONT]

[FONT=Courier New]"Order"=hex:08,00,00,00,02,00,00,00,fe,08,00,00,01,00,00,00,0c,00,00,00,ec,00,[/FONT]

[FONT=Courier New] 00,00,00,00,00,00,de,00,32,00,cd,00,00,00,00,ea,9a,0d,20,00,41,63,74,69,76,\[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings][/FONT]

[FONT=Courier New]@Denied: (A) (Users)[/FONT]

[FONT=Courier New]@Denied: (A) (Everyone)[/FONT]

[FONT=Courier New]@Allowed: (B 1 2 3 4 5) (S-1-5-20)[/FONT]

[FONT=Courier New]"BlindDial"=dword:00000000[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security][/FONT]

[FONT=Courier New]@Denied: (Full) (Everyone)[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]--------------------- DLLs Loaded Under Running Processes ---------------------[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]- - - - - - - > 'Explorer.exe'(1720)[/FONT]

[FONT=Courier New]c:\users\Reginald\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll[/FONT]

[FONT=Courier New]c:\program files\Stardock\Fences\FencesMenu.dll[/FONT]

[FONT=Courier New]c:\program files\stardock\fences\DesktopDock.dll[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]Completion time: 2012-08-18 22:32:59[/FONT]

[FONT=Courier New]ComboFix-quarantined-files.txt 2012-08-19 04:32[/FONT]

[FONT=Courier New]ComboFix2.txt 2012-08-19 03:47[/FONT]

[FONT=Courier New]ComboFix3.txt 2012-08-17 15:10[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]Pre-Run: 91,843,907,584 bytes free[/FONT]

[FONT=Courier New]Post-Run: 91,733,569,536 bytes free[/FONT]

[FONT=Courier New].[/FONT]

[FONT=Courier New]- - End Of File - - 43DC461521D8EC9EDFB6CD546CC4E67A[/FONT]
 
Looks good :)

Any current issues?

Please don't change your posts font because it's harder to read.

=================================================

Download Malwarebytes' Anti-Malware (MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.
Alternate download: http://www.filehippo.com/download_malwarebytes_anti_malware/
NOTE. If you already have MBAM installed, update it before running the scan.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer IF MBAM asks you to do so.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

============================================

Download OTL to your Desktop.
Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe

  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Click the Scan All Users checkbox.
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
 
lwarebytes Anti-Malware (PRO) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.08.19.01

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Reginald :: REGINALD-PC [administrator]

Protection: Disabled

8/18/2012 11:32:25 PM
mbam-log-2012-08-18 (23-32-25).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 241792
Time elapsed: 15 minute(s), 44 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
 
Evert time I try and upload the extras.txt and the otl.txt file it won't save
here is my attempt with extras.txt
OTL Extras logfile created on: 8/18/2012 11:50:13 PM - Run 1
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Reginald\Desktop\Tech
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.15 Gb Available Physical Memory | 38.31% Memory free
5.99 Gb Paging File | 2.97 Gb Available in Paging File | 49.62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 283.04 Gb Total Space | 85.45 Gb Free Space | 30.19% Space Free | Partition Type: NTFS
Drive D: | 15.00 Gb Total Space | 10.94 Gb Free Space | 72.96% Space Free | Partition Type: NTFS
Drive E: | 375.88 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive I: | 468.19 Mb Total Space | 451.19 Mb Free Space | 96.37% Space Free | Partition Type: FAT
Drive K: | 74.52 Gb Total Space | 32.02 Gb Free Space | 42.97% Space Free | Partition Type: NTFS

Computer Name: REGINALD-PC | User Name: Reginald | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Key error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UpdatesDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0294BB2F-6178-459D-8C46-8D1C40D6AD6B}" = rport=445 | protocol=6 | dir=out | app=system |
"{05515B24-EE02-422F-BE48-07496B1D6615}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{057550CC-1C7E-4C7B-A2F8-3A8DDC978C8C}" = lport=138 | protocol=17 | dir=in | app=system |
"{08E024BB-596A-4DFF-A430-159062EB67CE}" = lport=10243 | protocol=6 | dir=in | app=system |
"{19A5737B-0BEE-43C8-BCD3-3CC714AA4FD3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{25B9D31D-64EC-44F5-900B-17177C3E5D3C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{295EF879-34FC-4A05-A484-51AA1443280E}" = lport=445 | protocol=6 | dir=in | app=system |
"{2FA65B31-3A9D-4C20-AFC6-469495F0EF44}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4084E937-EAAA-47EE-9520-7BE7CE434C09}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4BF5EB07-06A2-40E2-B5B6-244EF5C49A0F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{5456EA1E-AF45-48BD-9C96-AB99A6CCF1D9}" = lport=139 | protocol=6 | dir=in | app=system |
"{6364B77A-8796-4078-B3CC-5963A3E70B4F}" = rport=139 | protocol=6 | dir=out | app=system |
"{6EFD3216-D4DB-448C-81DA-E8838C66FFD2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7C7BD74E-D59D-40F9-8481-A74C4729E9DD}" = rport=138 | protocol=17 | dir=out | app=system |
"{86444BB3-291D-4D31-A046-BB4AA3243C28}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9E1A23C6-C5DD-412E-AF38-5661E096BA9F}" = lport=5353 | protocol=17 | dir=in | name=bonjour |
"{AF8150A9-8B4A-4262-900E-D368942052B3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BE10AB93-C4A6-464B-BE93-069E778BFF99}" = rport=10243 | protocol=6 | dir=out | app=system |
"{BED88789-1DDC-409E-ABA4-8C58366C11A8}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C232D951-55E7-4D04-9346-F88A07FC0B22}" = lport=137 | protocol=17 | dir=in | app=system |
"{C428A183-FD79-40B5-990D-895328F43AC8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CF0676E6-E2EC-438A-9741-7029DEBD00CE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F534D21D-02A4-4E48-A237-A3745ED5E6D3}" = rport=137 | protocol=17 | dir=out | app=system |
"{F9C1EEE5-72B7-40C6-BC7C-64E9DF7DEB39}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{003C7A18-60D9-4C89-94D8-DE42C1AA1D76}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{02A4D600-582A-4C14-ADFE-C125CF0CB18F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1473D86F-6F04-46A3-9153-CD04272511DC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{395ED008-86FE-4B1D-94E2-0215C02B99B1}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version7\teamviewer_service.exe |
"{4849799C-D8E9-4360-8F9A-6B5F2BCC7EA4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{56E808A1-BFD0-4B79-B567-B9FA848D697F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{61FB8AD2-C831-45AB-9DFB-D685C3A8300D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{62F27534-2769-4D2F-B42F-E96E62F64F44}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{65901CFC-D156-4C8F-90EA-C26D256CA195}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{65EFC9AF-7FD1-478A-A836-708FB79D4577}" = dir=in | app=c:\program files\airport\apagent.exe |
"{68F6992D-6E9D-4F14-88EC-3E0B8BEC7EFF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6EAB84B0-599F-4687-A098-4A8DFD0A14E3}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version7\teamviewer.exe |
"{72247DBA-507C-447A-A540-C834D3A67F45}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version7\teamviewer.exe |
"{8642AF85-31DC-4BB3-8E9D-1E478C224084}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A5589677-56C4-46C1-A86B-1F0B5425786F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A9747A1A-C901-485B-B24D-5F38591BD9A9}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version7\teamviewer_service.exe |
"{AB3FBA72-52C3-4476-9A38-230DBE05659B}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BC7833D1-AE4B-4CAB-BDD5-6EA587E5C763}" = protocol=6 | dir=out | app=system |
"{CE504808-152F-4073-8BB9-0F8E7C4D30C6}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D3648D1D-2BA3-4973-9B7E-EDC907B6E342}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E8715BB0-E132-4617-B344-62E03BFE2C1C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E926E57D-011D-4F63-BCC5-FFCFDC28D091}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{EFA98652-B437-42AA-B7D3-EFFD71ED4ECD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F7DCF881-DB9D-4779-8D1C-CCCBAC7C73FF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{16BB53E0-2CF3-49F9-9A46-835E253BD868}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{1B7C658A-5BC5-4CCA-BFDA-A08D5FDF8597}C:\program files\airport\aputil.exe" = protocol=6 | dir=in | app=c:\program files\airport\aputil.exe |
"TCP Query User{2DD15C1F-443A-4A2E-B403-D670309C0FEB}C:\program files\weprint\weprint server.exe" = protocol=6 | dir=in | app=c:\program files\weprint\weprint server.exe |
"TCP Query User{AA726E93-1869-4477-8C7B-80802953B0DF}C:\program files\airvideoserver\airvideoserver.exe" = protocol=6 | dir=in | app=c:\program files\airvideoserver\airvideoserver.exe |
"TCP Query User{B3A9A1FC-EF63-4873-890A-D135E8C1A33F}C:\program files\weprint\weprint server.exe" = protocol=6 | dir=in | app=c:\program files\weprint\weprint server.exe |
"TCP Query User{BD4FC17D-1BA0-404C-8733-85722EAEB974}C:\program files\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"TCP Query User{ED853B16-6ECD-43AB-8278-6F8B467C7C29}C:\program files\airvideoserver\airvideoserver.exe" = protocol=6 | dir=in | app=c:\program files\airvideoserver\airvideoserver.exe |
"UDP Query User{482DD29E-CD28-4301-B8F9-542D861CED73}C:\program files\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"UDP Query User{AA2B871D-7C55-4A6C-A4BD-C1FB50E24EF1}C:\program files\airvideoserver\airvideoserver.exe" = protocol=17 | dir=in | app=c:\program files\airvideoserver\airvideoserver.exe |
"UDP Query User{BAB0A388-C74A-4CAD-9077-15E8F79F565F}C:\program files\airvideoserver\airvideoserver.exe" = protocol=17 | dir=in | app=c:\program files\airvideoserver\airvideoserver.exe |
"UDP Query User{BB272032-5C38-4FE0-9A16-3A6BA2E17755}C:\program files\weprint\weprint server.exe" = protocol=17 | dir=in | app=c:\program files\weprint\weprint server.exe |
"UDP Query User{D00D5BFF-8220-4E5A-BF46-15B06ED24EAD}C:\program files\weprint\weprint server.exe" = protocol=17 | dir=in | app=c:\program files\weprint\weprint server.exe |
"UDP Query User{EA2B715C-A7F6-4404-B435-05C9BBE8AFC7}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{FE6EB834-4072-4703-ACF8-7D69EC77B8CB}C:\program files\airport\aputil.exe" = protocol=17 | dir=in | app=c:\program files\airport\aputil.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{DCDAB2ED-5741-4C30-A1A4-0FCB8A529001}" = WordPerfect Office X4
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{007B37D9-0C45-4202-834B-DD5FAAE99D63}" = ArcSoft Print Creations - Slimline Card
"{0090A87C-3E0E-43D4-AA71-A71B06563A4A}" = Dell Support Center
"{02EBDBB9-4600-41D3-B566-40CB861511D2}" = World of Warcraft FREE Trial
"{03EDED24-8375-407D-A721-4643D9768BE1}" = kgchlwn
"{04A3A6B0-8E19-49BB-82FF-65C5A55F917D}" = Acronis True Image Home 2011
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{0F842B77-56EA-4AAF-8295-81A022350B5E}" = Microsoft Security Client
"{11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}" = ATI Catalyst Registration
"{11F3F858-4131-4FFA-A560-3FE282933B6E}" = kgchday
"{1374CC63-B520-4f3f-98E8-E9020BF01CFF}" = Windows XP Mode
"{13BBBB38-22D8-4BF1-80CA-7D54152C2980}" = WebSlingPlayer ActiveX
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16D0F2D2-242C-4885-BEF1-4B1655C141AE}" = Bing Bar
"{183E58A5-A6F5-4FDD-8B37-5F483B6CCDDC}" = NETGEAR XE104 Powerline Encryption Utility
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{196E77C5-F524-4B50-BD1A-2C21EEE9B8F7}" = Microsoft SQL Server 2008 Common Files
"{1A22A15D-E88A-427A-90E2-137245143239}" = Garmin Lifetime Updater
"{1DF03ECE-6AF4-414E-B118-C316F151A9A2}" = Corel WordPerfect Office - iFilter
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23B8A91D-680B-462B-87AD-3D70F7341731}" = iTunes
"{23C3F5C0-566B-478B-AAB6-197ADAD0C945}" = Uniblue SpeedUpMyPC 2009
"{23DD8A17-65DB-4D49-A2E0-164C6F460E3F}" = Adobe Photoshop Lightroom 3
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 17
"{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{30C8AA56-4088-426F-91D1-0EDFD3A25678}" = Adobe Dreamweaver CS4
"{33AE9E89-47C9-4A0D-9E9D-BDD6966A3804}" = Microsoft SQL Server 2008 RsFx Driver
"{34AFE453-F544-4269-89C9-CAB7F0744963}" = Nuance OmniPage 17
"{34F93E31-E1A0-421C-8E86-BCF7C4193A91}" = LogMeIn
"{36C97B5B-5593-45B8-B50E-DAD87036BD9D}" = Microsoft LifeCam
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D08333C-C366-425D-8C2D-D05630D68A46}" = SlingPlayer
"{3DB2107E-82FE-3167-6E71-B9D44EA4FD26}" = AMD Drag and Drop Transcoding
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{42938595-0D83-404D-9F73-F8177FDD531A}" = ESScore
"{4537EA4B-F603-4181-89FB-2953FC695AB1}" = netbrdg
"{4815BD99-96A4-49FE-A885-DCF06E9E4E78}" = Microsoft SQL Server 2008 Database Engine Shared
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A6F34E2-09E5-4616-B227-4A26A488A6F9}" = Microsoft SQL Server 2008 Common Files
"{4F44B5AE-82A6-4A8A-A3E3-E24D489728E3}" = Microsoft SQL Server 2008 Native Client
"{52232EF4-CC12-4C21-ABCF-ADB79618302D}" = Adobe Soundbooth CS4 Codecs
"{5316DFC9-CE99-4458-9AB3-E8726EDE0210}" = skin0001
"{561968FD-56A1-49FD-9ED0-F55482C7C5BC}" = Adobe Media Encoder CS4 Exporter
"{56589DFE-0C29-4DFE-8E42-887B771ECD23}" = ArcSoft Print Creations - Photo Book
"{58721EC3-8D4E-4B79-BC51-1054E2DDCD10}" = Microsoft SQL Server 2008 Database Engine Services
"{58F4D4FD-1814-4068-B316-C28FC776C6DD}" = GoToMyPC
"{59D007A3-05CD-4D7C-A660-FE2450BE4BDE}_is1" = Sanmaxi Outlook Password Recovery Trial Version 5.0.1
"{5A0C892E-FD1C-4203-941E-0956AED20A6A}" = APC PowerChute Personal Edition
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5BCC634A-58AD-42F9-B3C6-2EA52F81CF85}" = Snagit 10
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{608D2A3C-6889-4C11-9B54-A42F45ACBFDB}" = fflink
"{61D6891E-E822-4448-9F9A-0AAAAEB6AF6C}" = Adobe Creative Suite 4 Master Collection
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{665C721C-49A3-49E9-AED0-EBEDC1327D57}" = Setup Wizard
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{67A9747A-E1F5-4E9A-81CC-12B5D5B81B6E}" = Adobe After Effects CS4 Third Party Content
"{689E0AB3-50B2-4E5A-9DCE-6DA9F5BE1314}" = BlackBerry® Media Sync
"{693C08A7-9E76-43FF-B11E-9A58175474C4}" = kgckids
"{6E2DDDB8-1E70-4219-994B-5B9761F964FF}" = Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{73F01EB9-1682-4678-B856-F672D09F1E32}" = Garmin Lifetime Updater
"{76109814-439E-46A1-8BD3-A3D5DEEF1FD6}" = NETGEAR XE102 Powerline Encryption Utility
"{7694E0B1-2332-448B-9235-929F84B41E3F}" = Active@ ISO Burner
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{782A8AEE-0722-4E08-BB72-34C218CF166B}" = Uniblue PowerSuite 2009
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7AAA00C4-26E6-4EC0-8069-955B0A9D6009}" = Intel(R) Network Connections 15.2.89.0
"{7B08D306-7266-4647-A926-2F78817ED1E0}" = Microsoft Corporation
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{807CF799-E1B8-464D-8F6A-C01655332EFD}" = Microsoft Security Compliance Manager 1.0
"{8186FF34-D389-4B7E-9A2F-C197585BCFBD}" = Adobe Media Encoder CS4 Importer
"{83E3E4FD-1C5F-BB72-1118-799EC15CB30B}" = ATI Catalyst Install Manager
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{84513125-0BC7-46F8-BE1E-309263B79AE2}" = Xmarks Thumbnails for IE
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87323561-58BA-4D5B-BADA-A791B69D1705}" = Catalyst Control Center - Branding
"{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr
"{89CEAE14-DD0F-448E-9554-15781EC9DB24}" = Product Documentation Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8A8664E1-84C8-4936-891C-BC1F07797549}" = kgcvday
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0015-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-0044-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-00BA-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{91F34319-08DE-457a-99C0-0BCDFAC145B9}" = CuteFTP 8 Professional
"{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}" = MobileMe Control Panel
"{942E5031-2BD6-4C1B-918C-C8A1CBAE7B8C}" = Microsoft IntelliPoint 8.2
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9578C0CD-8108-4379-9026-4601F59859A0}" = Google Earth Pro
"{9591C049-5CAE-4E89-A8D9-191F1899628B}" = ArcSoft Print Creations - Funhouse
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{98177940-C048-4831-A279-F3888B1E2C7F}" = InstallMgr
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BD54685-1496-46A5-AB62-357CD140ED8B}" = kgcinvt
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = HP Integrated Module with Bluetooth wireless technology
"{A1588373-1D86-4D44-86C9-78ABD190F9CC}" = kgcmove
"{A3FF5CB2-FB35-4658-8751-9EDE1D65B3AA}" = VMware Workstation
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A73BDB2A-E4A7-4FE8-960E-6A5C8BF76FCB}" = XPS MiniView Gadget
"{A7DEBAA4-B211-4D1A-A6B3-E52BFAAA1D0C}" = Garmin Communicator Plugin
"{A8AC89BA-D8CB-4372-9743-1C54D23286B0}" = MSN Toolbar
"{A92A4DB0-CD37-42D1-BE1D-603D53C24328}" = Intel(R) Processor ID Utility
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA68AAAE-41F0-40B5-8896-5947F5FD6889}" = AirPort
"{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}" = Windows 7 Upgrade Advisor
"{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AC76BA86-1033-F400-7761-000000000004}_952" = Adobe Acrobat 9.5.2 - CPSID_83708
"{AC76BA86-1033-F400-7761-000000000004}{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AD88355B-A4E0-4DA1-BAC3-EA4FEA930691}" = Ipswitch WS_FTP Pro
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{AF72E557-0647-4DE5-ACDA-ECFB38D5D732}" = Licensing Service Install
"{B0D83FCD-9D42-43ED-8315-250326AADA02}" = ArcSoft Print Creations - Scrapbook
"{B1102A25-3AA3-446B-AA0F-A699B07A02FD}" = Garmin USB Drivers
"{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B26B00DA-2E5D-4CF2-83C5-911198C0F009}" = GoodSync
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B4FEA924-630D-11D4-B78E-005004566E4D}" = ViewSonic Monitor Drivers
"{B5153233-9AEE-4CD4-9D2C-4FAAC870DBE2}" = Microsoft SQL Server 2008 Database Engine Services
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B7148D71-0A8F-4501-96B4-4E1CC67F874E}" = Microsoft Default Manager
"{B829E117-D072-41EA-9606-9826A38D34C1}" = Sophos Virus Removal Tool
"{B857D868-F8B0-43EE-BC2B-D9E5ED21F237}" = Microsoft SQL Server VSS Writer
"{B98BE95C-E76F-4246-B8E6-BEB8EE791D06}" = Roxio Media Manager
"{BA4DA261-CB60-4690-B202-44998DFC6986}" = Microsoft SQL Server 2008 Setup Support Files
"{C05C9016-8774-46C0-8BD4-A8EE5E25572F}" = IPView Pro 2.0
"{C3113E55-7BCB-4de3-8EBF-60E6CE6B2196}_is1" = SiSoftware Sandra Professional Business 2009.SP3c
"{C427E746-4EC9-4E3C-AACB-C6BB1F714D7F}" = Uniblue DriverScanner 2009
"{C56BBAC8-0DD2-4CE4-86E0-F2BDEABDD0CF}" = Xmarks for IE
"{C688457E-03FD-4941-923B-A27F4D42A7DD}" = Microsoft SQL Server 2008 Browser
"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari
"{C938BE91-3BB5-4B84-9EF6-88F0505D0038}" = Adobe Premiere Pro CS4 Third Party Content
"{C965F01C-76EA-4BD7-973E-46236AE312D7}" = Sql Server Customer Experience Improvement Program
"{CA9ED5E4-1548-485B-A293-417840060158}" = ArcSoft Print Creations - Photo Calendar
"{CAE8A0F1-B498-4C23-95FA-55047E730C8F}" = ArcSoft Print Creations
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240B8}" = WinZip 12.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE6DEE87-1C87-42ED-A108-7369BFE9076F}" = 32 bit Windows Card Reader Driver
"{D25F26E6-7F37-4580-9E83-2BDD9BE9E0CE}" = BlackBerry Desktop Software 6.0
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare software
"{D3B1C799-CB73-42DE-BA0F-2344793A095C}" = Catalyst Control Center - Branding
"{D7769185-9A7C-48D4-8874-5388743A1DE2}" = Music, Photos & Videos Launcher
"{DA7DF8E2-4B8F-4286-97FE-DE3FFFE9B728}" = iCloud
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529000}" = WordPerfect Office X4
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529001}" = WordPerfect Office X4 - ICA
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529010}" = WordPerfect Office X4 - Common
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529011}" = WordPerfect Office X4 - WP
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529012}" = WordPerfect Office X4 - QP
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529013}" = WordPerfect Office X4 - PR
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529014}" = WordPerfect Office X4 - Content
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529016}" = WordPerfect Office X4 - Skins
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529017}" = WordPerfect Office X4 - Filters
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529018}" = WordPerfect Office X4 - Graphics
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529023}" = WordPerfect Office X4 - System
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529030}" = WordPerfect Office X4 - Migration Manager
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529040}" = WordPerfect Office X4 - IPM
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529041}" = WordPerfect Office X4 - IPM EN
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529050}" = WordPerfect Office X4 - PerfectExperts
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529080}" = WordPerfect Office X4 - MAIL
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529100}" = WordPerfect Office X4 - EN
"{E18B549C-5D15-45DA-8D8F-8FD2BD946344}" = kgcbaby
"{E2C98732-F973-4985-A9C5-DC06178E16EE}" = Microsoft Mathematics Add-in (32-bit)
"{E5839ADC-1116-49E2-8A0A-FE9EB65027DF}" = WeatherLink 5.8.3
"{E63E34A7-E552-412B-9E40-FD6FC5227ABA}" = Uniblue RegistryBooster 2009
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E6B4117F-AC59-4B13-9274-EB136E8897EE}" = ArcSoft Print Creations - Album Page
"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
"{E79987F0-0E34-42CC-B8FF-6C860AEEB26A}" = tooltips
"{E8EE9410-8AC4-4F43-A626-DDECA75C79F3}" = Adobe Setup
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EFC04D3F-A152-47E7-8517-EE0F6201AFEF}" = Apple Mobile Device Support
"{F04F9557-81A9-4293-BC49-2C216FA325A7}" = ArcSoft Print Creations - Greeting Card
"{F0C003B5-6F66-49A3-86C4-49D7D2502ADA}" = Debug Diagnostics 1.2 32-bit
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F1486DE6-CC2E-48C0-AD20-C2C142FA1636}" = APC PowerChute Personal Edition 3.0
"{F3494AB6-6900-41C6-AF57-823626827ED8}" = Microsoft SQL Server 2008 Database Engine Shared
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F7186715-3AEE-4C0A-B191-0D1835E57BE2}" = SetupWizard
"{F7FC9307-374E-4017-8E9D-DE1154780480}" = System Requirements Lab for Intel
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FB2A5FCC-B81B-48C2-A009-7804694D83E9}" = Adobe Encore CS4 Codecs
"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
"{FD5FC366-49CA-497D-975C-B4C11696325F}" = Virtual Weather Station
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"45A7283175C62FAC673F913C1F532C5361F97841" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0)
"ActiveWords" = ActiveWords
"AddThis Toolbar" = AddThis Toolbar
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe_b2d6abde968e6f277ddbfd501383e02" = Adobe Creative Suite 4 Master Collection
"AI RoboForm" = RoboForm 7-7-9-9 (All Users)
"Air Video Server" = Air Video Server 2.4.3
"Anvi Smart Defender" = Anvi Smart Defender 1.5
"Any Video Converter Professional_is1" = Any Video Converter Professional 2.7.6
"BlackBerry_Desktop" = BlackBerry Desktop Software 6.0
"BSPlayerp" = BS.Player PRO
"CCleaner" = CCleaner
"CopyTrans Suite" = CopyTrans Suite Remove Only
"Cumulus_is1" = Cumulus 1.9.2
"Dell Support Center" = Dell Support Center
"DUMeter3_is1" = DU Meter
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 9.0.0 Home Edition
"ESET Online Scanner" = ESET Online Scanner v3
"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v5.02
"Fences Pro" = Fences Pro
"Google Chrome Frame" = Google Chrome Frame
"Google Desktop" = Google Desktop
"Greatis Reanimator_is1" = RegRun Reanimator
"HD Tune_is1" = HD Tune 2.55
"HijackThis" = HijackThis 2.0.2
"InstallShield_{3D08333C-C366-425D-8C2D-D05630D68A46}" = SlingPlayer
"Jawbone Updater" = Jawbone Updater
"Kingsoft PC Doctor" = Kingsoft PC Doctor 3.3.1.9
"Loki ActiveX Control" = Loki ActiveX Control
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2
"Microsoft Security Client" = Microsoft Security Essentials
"Microsoft SQL Server 10" = Microsoft SQL Server 2008
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008
"Mozilla Firefox 11.0 (x86 en-US)" = Mozilla Firefox 11.0 (x86 en-US)
"NetworkView_is1" = NetworkView Version 3.60
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"Picasa 3" = Picasa 3
"PROSetDX" = Intel(R) Network Connections 15.2.89.0
"RealVNC_is1" = VNC Enterprise Edition E4.4.2
"SABnzbd" = SABnzbd 0.6.10
"StarDot_Tools_1.5" = StarDot Tools 1.5.3
"SysMetrix" = SysMetrix 3.44
"TeamViewer 6" = TeamViewer 6
"TeamViewer 7" = TeamViewer 7
"TerraExplorer" = TerraExplorer
"Uniblue DriverScanner 2009" = Uniblue DriverScanner 2009
"Uniblue PowerSuite 2009" = Uniblue PowerSuite 2009
"Uniblue RegistryBooster 2009" = Uniblue RegistryBooster 2009
"Uniblue SpeedUpMyPC 2009" = Uniblue SpeedUpMyPC 2009
"V CAST Music with Rhapsody" = V CAST Music with Rhapsody
"VLC media player" = VLC media player 1.0.0
"VNCMirror_is1" = VNC Mirror Driver 1.8.0
"WePrint" = WePrint
"WinRAR archiver" = WinRAR archiver

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1359024441-3580254713-1987414973-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Chromium" = Chromium
"Dropbox" = Dropbox
"f031ef6ac137efc5" = Dell Driver Download Manager
"Google Chrome" = Google Chrome
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
"UnityWebPlayer" = Unity Web Player
"uTorrent" = µTorrent

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 8/18/2012 8:39:44 AM | Computer Name = Reginald-PC | Source = Application Hang | ID = 1002
Description = The program iTunes.exe version 10.6.1.7 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: 1ca0 Start Time:
01cd7cb83d4588cc Termination Time: 1087 Application Path: C:\Program Files\iTunes\iTunes.exe

Report
Id:

Error - 8/18/2012 8:48:16 AM | Computer Name = Reginald-PC | Source = WinMgmt | ID = 10
Description =

Error - 8/18/2012 10:35:55 PM | Computer Name = Reginald-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\EASEUS\easeus
partition master 9.0.0 home edition\res\Help.exe". Dependent Assembly Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 8/19/2012 12:12:28 AM | Computer Name = Reginald-PC | Source = WinMgmt | ID = 10
Description =

Error - 8/19/2012 12:15:50 AM | Computer Name = Reginald-PC | Source = WinMgmt | ID = 10
Description =

Error - 8/19/2012 12:18:24 AM | Computer Name = Reginald-PC | Source = VSS | ID = 18
Description =

Error - 8/19/2012 12:18:24 AM | Computer Name = Reginald-PC | Source = VSS | ID = 8193
Description =

Error - 8/19/2012 12:18:24 AM | Computer Name = Reginald-PC | Source = System Restore | ID = 8193
Description =

Error - 8/19/2012 12:38:55 AM | Computer Name = Reginald-PC | Source = WinMgmt | ID = 10
Description =

Error - 8/19/2012 12:43:45 AM | Computer Name = Reginald-PC | Source = Application Hang | ID = 1002
Description = The program IEXPLORE.EXE version 9.0.8112.16448 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 1f6c Start
Time: 01cd7dc4992a8e97 Termination Time: 24 Application Path: C:\Program Files\Internet
Explorer\IEXPLORE.EXE Report Id:

[ Media Center Events ]
Error - 7/2/2009 10:07:30 AM | Computer Name = Reginald-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.SqmFlushSession failed; Win32 GetLastError
returned 0D Process: DefaultDomain Object Name: Media Center Guide

[ System Events ]
Error - 8/19/2012 12:31:49 AM | Computer Name = Reginald-PC | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 8/19/2012 12:31:49 AM | Computer Name = Reginald-PC | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 8/19/2012 12:31:49 AM | Computer Name = Reginald-PC | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 8/19/2012 12:35:32 AM | Computer Name = Reginald-PC | Source = Service Control Manager | ID = 7000
Description = The VMware Bridge Protocol service failed to start due to the following
error: %%2

Error - 8/19/2012 12:37:55 AM | Computer Name = Reginald-PC | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Roxio
Hard Drive Watcher 9 service to connect.

Error - 8/19/2012 12:38:04 AM | Computer Name = Reginald-PC | Source = Service Control Manager | ID = 7000
Description = The VMware Network Application Interface service failed to start due
to the following error: %%2

Error - 8/19/2012 12:38:04 AM | Computer Name = Reginald-PC | Source = Service Control Manager | ID = 7001
Description = The VMware NAT Service service depends on the VMware Network Application
Interface service which failed to start because of the following error: %%2

Error - 8/19/2012 12:39:04 AM | Computer Name = Reginald-PC | Source = Service Control Manager | ID = 7001
Description = The VMware DHCP Service service depends on the VMware Network Application
Interface service which failed to start because of the following error: %%2

Error - 8/19/2012 12:41:23 AM | Computer Name = Reginald-PC | Source = WMPNetworkSvc | ID = 866306
Description =

Error - 8/19/2012 12:41:23 AM | Computer Name = Reginald-PC | Source = WMPNetworkSvc | ID = 866306
Description =


< End of report >
 
OTL logfile created on: 8/18/2012 11:50:13 PM - Run 1
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Reginald\Desktop\Tech
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.15 Gb Available Physical Memory | 38.31% Memory free
5.99 Gb Paging File | 2.97 Gb Available in Paging File | 49.62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 283.04 Gb Total Space | 85.45 Gb Free Space | 30.19% Space Free | Partition Type: NTFS
Drive D: | 15.00 Gb Total Space | 10.94 Gb Free Space | 72.96% Space Free | Partition Type: NTFS
Drive E: | 375.88 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive I: | 468.19 Mb Total Space | 451.19 Mb Free Space | 96.37% Space Free | Partition Type: FAT
Drive K: | 74.52 Gb Total Space | 32.02 Gb Free Space | 42.97% Space Free | Partition Type: NTFS

Computer Name: REGINALD-PC | User Name: Reginald | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/08/18 23:47:46 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Reginald\Desktop\Tech\OTL.exe
PRC - [2012/07/30 15:02:22 | 000,640,480 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
PRC - [2012/07/25 11:27:38 | 003,506,176 | ---- | M] (ActiveWord Systems, Inc.) -- C:\Program Files\ActiveWords\AWMonitor.exe
PRC - [2012/07/25 09:59:15 | 000,112,640 | ---- | M] (ActiveWord Systems, Inc.) -- C:\Program Files\ActiveWords\AWApps\L&T\AWLearnTrain.exe
PRC - [2012/07/25 09:59:04 | 000,419,840 | ---- | M] (ActiveWords) -- C:\Program Files\ActiveWords\AWApps\AWInkPad\AWInkpad.exe
PRC - [2012/07/25 09:59:01 | 000,035,328 | ---- | M] (ActiveWord Systems, Inc.) -- C:\Program Files\ActiveWords\AWFeedback.exe
PRC - [2012/07/25 09:58:48 | 000,509,440 | ---- | M] (ActiveWord Systems, Inc.) -- C:\Program Files\ActiveWords\Nahuatl.exe
PRC - [2012/07/20 02:11:38 | 000,686,408 | ---- | M] (Anvisoft) -- C:\Program Files\Anvisoft\Anvi Smart Defender\ASDSrv.exe
PRC - [2012/07/20 02:11:28 | 001,217,864 | ---- | M] (Anvisoft) -- C:\Program Files\Anvisoft\Anvi Smart Defender\ASDTray.exe
PRC - [2012/07/19 15:13:17 | 000,109,336 | ---- | M] (Siber Systems) -- C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
PRC - [2012/07/16 08:31:32 | 007,445,416 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version7\TeamViewer.exe
PRC - [2012/07/16 08:31:32 | 002,673,064 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
PRC - [2012/07/16 08:22:42 | 000,106,408 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version7\tv_w32.exe
PRC - [2012/07/13 04:18:26 | 000,186,832 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\1.3.21.115\GoogleCrashHandler.exe
PRC - [2012/07/12 03:36:52 | 000,136,616 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\ramaint.exe
PRC - [2012/07/12 03:36:32 | 000,374,184 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
PRC - [2012/07/09 17:38:53 | 004,777,856 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
PRC - [2012/07/03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/05/24 12:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Users\Reginald\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012/04/10 22:26:24 | 001,308,064 | ---- | M] (Kingsoft Corporation) -- C:\Program Files\Kingsoft\PcDoctor\KSafeTray.exe
PRC - [2012/04/10 22:26:22 | 000,452,512 | ---- | M] (Kingsoft Corporation) -- C:\Program Files\Kingsoft\PcDoctor\KSafeSvc.exe
PRC - [2012/04/03 07:14:04 | 002,542,080 | ---- | M] (EuroSmartz Ltd) -- C:\Program Files\WePrint\WePrint Server.exe
PRC - [2012/03/26 17:08:12 | 000,931,200 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2012/02/23 12:30:40 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
PRC - [2012/01/20 21:03:48 | 000,719,672 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
PRC - [2011/11/13 07:53:42 | 002,996,592 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Program Files\Citrix\GoToMyPC\g2tray.exe
PRC - [2011/11/13 07:53:40 | 000,946,032 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Program Files\Citrix\GoToMyPC\g2svc.exe
PRC - [2011/11/13 07:53:36 | 002,120,048 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Program Files\Citrix\GoToMyPC\g2pre.exe
PRC - [2011/11/13 07:53:28 | 001,687,408 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Program Files\Citrix\GoToMyPC\g2comm.exe
PRC - [2011/10/19 10:28:50 | 021,328,896 | ---- | M] (Ambient, LLC) -- C:\vws\vws.exe
PRC - [2011/08/11 17:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe
PRC - [2011/07/12 18:01:38 | 000,345,352 | ---- | M] (Microsoft Corporation) -- C:\Program Files\DebugDiag\DbgSvc.exe
PRC - [2011/07/08 03:25:22 | 000,401,408 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2011/07/08 03:24:54 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2011/06/23 22:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011/06/15 17:33:20 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE
PRC - [2011/02/24 23:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/12/08 11:20:14 | 000,390,528 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeIn.exe
PRC - [2010/11/20 06:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010/10/27 20:17:52 | 000,207,424 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
PRC - [2010/09/29 15:30:36 | 002,942,856 | ---- | M] (Hagel Technologies Ltd.) -- C:\Program Files\DU Meter\DUMeter.exe
PRC - [2010/09/29 15:30:36 | 001,412,488 | ---- | M] (Hagel Technologies Ltd.) -- C:\Program Files\DU Meter\DUMeterSvc.exe
PRC - [2010/09/21 19:03:56 | 004,923,784 | ---- | M] () -- C:\Program Files\AirVideoServer\AirVideoServer.exe
PRC - [2010/09/14 17:54:12 | 000,021,880 | ---- | M] (American Power Conversion Corporation) -- C:\Program Files\APC\APC PowerChute Personal Edition\dataserv.exe
PRC - [2010/09/14 17:53:40 | 000,705,912 | ---- | M] (American Power Conversion Corporation) -- C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
PRC - [2010/09/14 17:53:20 | 000,660,856 | ---- | M] (American Power Conversion Corporation) -- C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
PRC - [2010/09/01 10:58:32 | 003,975,088 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
PRC - [2010/08/21 08:54:14 | 000,390,736 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
PRC - [2010/08/21 08:54:08 | 000,779,960 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
PRC - [2010/08/21 08:51:50 | 005,458,848 | ---- | M] (Acronis) -- C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
PRC - [2010/08/20 16:00:50 | 002,536,448 | ---- | M] (Acronis) -- C:\Program Files\Acronis\OnlineBackupStandalone\TrueImageMonitor.exe
PRC - [2010/04/30 13:35:12 | 004,899,136 | ---- | M] (PY Software) -- C:\Program Files\Active WebCam\WebCam.exe
PRC - [2010/04/30 13:35:02 | 000,738,640 | ---- | M] (PY Software) -- C:\Program Files\Active WebCam\Watchdog.exe
PRC - [2010/04/30 13:08:32 | 000,323,072 | ---- | M] () -- C:\Program Files\Active WebCam\CompParams.exe
PRC - [2010/04/13 19:01:58 | 000,094,024 | ---- | M] (TechSmith Corporation) -- C:\Program Files\TechSmith\Snagit 10\TscHelp.exe
PRC - [2010/04/13 19:01:56 | 000,079,688 | ---- | M] (TechSmith Corporation) -- C:\Program Files\TechSmith\Snagit 10\SnagPriv.exe
PRC - [2010/04/13 19:01:52 | 007,384,904 | ---- | M] (TechSmith Corporation) -- C:\Program Files\TechSmith\Snagit 10\SnagitEditor.exe
PRC - [2010/04/13 19:01:52 | 007,046,984 | ---- | M] (TechSmith Corporation) -- C:\Program Files\TechSmith\Snagit 10\Snagit32.exe
PRC - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2010/02/17 13:44:17 | 002,621,440 | ---- | M] (Nicholas Decker) -- C:\Program Files\SysMetrix\SysMetrix.exe
PRC - [2009/11/11 16:17:02 | 000,771,360 | ---- | M] (Apple Inc.) -- C:\Program Files\AirPort\APAgent.exe
PRC - [2009/09/25 13:16:06 | 000,093,960 | ---- | M] (Sling Media Inc.) -- C:\Program Files\Sling Media\SlingAgent\SlingAgentService.exe
PRC - [2009/09/10 15:12:10 | 000,185,632 | ---- | M] (Protexis Inc.) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
PRC - [2009/07/24 15:05:24 | 000,139,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
PRC - [2009/06/26 17:21:00 | 000,759,296 | ---- | M] (Microsoft Corporation
) -- C:\Windows\vVX6000.exe
PRC - [2009/04/13 11:21:26 | 002,344,224 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
PRC - [2009/04/13 11:21:26 | 000,791,840 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2009/04/13 11:21:26 | 000,578,848 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
PRC - [2009/03/26 23:05:22 | 000,096,816 | ---- | M] (VMware, Inc.) -- C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
PRC - [2009/03/26 23:04:16 | 000,113,200 | ---- | M] (VMware, Inc.) -- C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008/10/30 15:16:42 | 000,282,624 | ---- | M] (Eastman Kodak Company) -- C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
PRC - [2008/08/11 12:41:00 | 000,063,048 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
PRC - [2007/10/03 14:45:02 | 000,358,936 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2007/10/03 14:44:58 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2007/05/28 10:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe


========== Modules (No Company Name) ==========

MOD - [2012/08/18 22:40:41 | 000,065,024 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
MOD - [2012/08/18 22:40:41 | 000,052,736 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
MOD - [2012/08/18 22:37:27 | 000,079,480 | ---- | M] () -- C:\jexepackres\JX94E44\miniupnpc.dll
MOD - [2012/08/18 22:37:27 | 000,034,166 | ---- | M] () -- C:\jexepackres\JX94E44\natpmp.dll
MOD - [2012/08/16 19:31:08 | 000,442,392 | ---- | M] () -- C:\Users\Reginald\AppData\Local\Google\Chrome\Application\21.0.1180.81\ppgooglenaclpluginchrome.dll
MOD - [2012/08/16 19:31:06 | 012,236,824 | ---- | M] () -- C:\Users\Reginald\AppData\Local\Google\Chrome\Application\21.0.1180.81\PepperFlash\pepflashplayer.dll
MOD - [2012/08/16 19:31:05 | 003,997,720 | ---- | M] () -- C:\Users\Reginald\AppData\Local\Google\Chrome\Application\21.0.1180.81\pdf.dll
MOD - [2012/08/16 19:29:39 | 000,526,872 | ---- | M] () -- C:\Users\Reginald\AppData\Local\Google\Chrome\Application\21.0.1180.81\libglesv2.dll
MOD - [2012/08/16 19:29:38 | 000,104,984 | ---- | M] () -- C:\Users\Reginald\AppData\Local\Google\Chrome\Application\21.0.1180.81\libegl.dll
MOD - [2012/08/16 19:29:27 | 000,144,424 | ---- | M] () -- C:\Users\Reginald\AppData\Local\Google\Chrome\Application\21.0.1180.81\avutil-51.dll
MOD - [2012/08/16 19:29:26 | 000,266,792 | ---- | M] () -- C:\Users\Reginald\AppData\Local\Google\Chrome\Application\21.0.1180.81\avformat-54.dll
MOD - [2012/08/16 19:29:24 | 002,480,680 | ---- | M] () -- C:\Users\Reginald\AppData\Local\Google\Chrome\Application\21.0.1180.81\avcodec-54.dll
MOD - [2012/07/25 09:59:01 | 000,014,848 | ---- | M] () -- C:\Program Files\ActiveWords\AWApps\AWInkPad\AxInterop.AWCONTROLLib.dll
MOD - [2012/07/21 05:44:05 | 000,117,760 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
MOD - [2012/07/21 05:44:04 | 000,052,224 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
MOD - [2012/07/20 02:11:36 | 000,784,712 | ---- | M] () -- C:\Program Files\Anvisoft\Anvi Smart Defender\sqlite3.dll
MOD - [2012/06/13 03:51:10 | 001,361,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Ink\4d381048e3b9c0914c0f72c6aa0a599d\Microsoft.Ink.ni.dll
MOD - [2012/06/13 03:45:57 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012/06/13 03:45:40 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012/05/12 03:51:48 | 000,628,224 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\168755d010e5a96ac940b0ddd27616a4\System.EnterpriseServices.ni.dll
MOD - [2012/05/12 03:51:48 | 000,280,064 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\168755d010e5a96ac940b0ddd27616a4\System.EnterpriseServices.Wrapper.dll
MOD - [2012/05/12 03:51:46 | 000,627,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\80fae9f16f80075535e72458ef293f7a\System.Transactions.ni.dll
MOD - [2012/05/12 03:51:45 | 006,611,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\f3814b488d9e083cbbc623e01b389f09\System.Data.ni.dll
MOD - [2012/05/12 03:49:48 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012/05/12 03:49:42 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012/05/12 03:49:40 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012/05/12 03:49:11 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2012/04/03 07:14:04 | 000,059,904 | ---- | M] () -- C:\Program Files\WePrint\zlib1.dll
MOD - [2011/10/21 03:01:40 | 000,075,160 | ---- | M] () -- C:\Program Files\Kingsoft\PcDoctor\json.dll
MOD - [2011/06/24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/06/24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/05/23 19:34:50 | 000,140,664 | ---- | M] () -- C:\Program Files\Kingsoft\PcDoctor\zlib1.dll
MOD - [2011/03/17 00:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2010/11/19 22:12:59 | 000,113,664 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
MOD - [2010/11/04 19:58:05 | 002,927,616 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2010/10/20 15:45:26 | 008,801,120 | ---- | M] () -- C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
MOD - [2010/09/21 19:03:56 | 004,923,784 | ---- | M] () -- C:\Program Files\AirVideoServer\AirVideoServer.exe
MOD - [2010/04/30 13:08:32 | 000,323,072 | ---- | M] () -- C:\Program Files\Active WebCam\CompParams.exe
MOD - [2009/07/13 19:15:45 | 000,364,544 | ---- | M] () -- C:\Windows\System32\msjetoledb40.dll
MOD - [2009/06/10 15:23:19 | 000,261,632 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2009/02/28 17:21:08 | 000,143,360 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\VPrintOnlineHelper40.dll
MOD - [2009/02/28 17:21:07 | 000,688,128 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\VPrintOnline.dll
MOD - [2009/02/28 17:21:02 | 000,236,544 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\SpiffyExt.dll
MOD - [2009/02/28 17:21:01 | 000,159,744 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxZipV.dll
MOD - [2009/02/28 17:21:00 | 000,798,720 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxXML2V.dll
MOD - [2009/02/28 17:20:59 | 000,528,384 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxProcV.dll
MOD - [2009/02/28 17:20:58 | 000,786,432 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxImV.dll
MOD - [2009/02/28 17:20:57 | 000,462,848 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxFFV.dll
MOD - [2009/02/28 17:20:55 | 001,400,832 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxCommonV.dll
MOD - [2009/02/28 17:20:54 | 002,236,416 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxCmpV.dll
MOD - [2009/02/28 17:20:50 | 000,872,448 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxBaseV.dll
MOD - [2009/02/28 17:20:31 | 000,010,240 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\LocUpdateCheck.dll
MOD - [2009/02/28 17:20:15 | 000,044,544 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\LocCamBack.dll
MOD - [2009/02/28 17:20:14 | 000,090,112 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\LocAcqMod.dll
MOD - [2009/02/28 17:19:59 | 000,128,512 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\kpries40.dll
MOD - [2009/02/28 17:19:57 | 000,404,480 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\KFx.dll
MOD - [2009/02/28 17:19:57 | 000,052,224 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\KPCDInterface.dll
MOD - [2009/02/28 17:19:56 | 000,084,480 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\keml40.dll
MOD - [2009/02/28 17:19:51 | 000,466,944 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\ESCom.dll
MOD - [2009/02/28 17:19:44 | 000,354,816 | ---- | M] () -- C:\Program Files\Kodak\Kodak EasyShare software\bin\Atlas.dll
 
Status
Not open for further replies.
Back