2nd part of OTL.Txt:
========== Chrome ==========
CHR - Extension: No name found = C:\Documents and Settings\John Fringer\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp\1.4.7_0\
CHR - Extension: No name found = C:\Documents and Settings\John Fringer\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: No name found = C:\Documents and Settings\John Fringer\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: No name found = C:\Documents and Settings\John Fringer\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\hphibigbodkkohoglgfkddblldpfohjl\1.1_0\
CHR - Extension: No name found = C:\Documents and Settings\John Fringer\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.0_0\
CHR - Extension: No name found = C:\Documents and Settings\John Fringer\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\14.0.2.14_0\
CHR - Extension: No name found = C:\Documents and Settings\John Fringer\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2013/03/03 21:44:22 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (CtxIEInterceptorBHO Class) - {2C4631FF-5CC8-4EBC-A0DF-34C92291759E} - C:\Program Files\Citrix\ICA Client\IEInterceptor.dll (Citrix Systems, Inc.)
O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
O2 - BHO: (Reg Error: Value error.) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Advanced SystemCare Browser Protection) - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\Program Files\IObit\Advanced SystemCare Ultimate\BrowerProtect\ASCPlugin_Protection.dll (IObit)
O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKLM\..\Toolbar: (&RoboForm) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKU\S-1-5-21-1841321574-3558567648-798452987-1005\..\Toolbar\ShellBrowser: (no name) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - No CLSID value found.
O3 - HKU\S-1-5-21-1841321574-3558567648-798452987-1005\..\Toolbar\WebBrowser: (no name) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - No CLSID value found.
O3 - HKU\S-1-5-21-1841321574-3558567648-798452987-1005\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKU\S-1-5-21-1841321574-3558567648-798452987-1005\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [ConnectionCenter] c:\program files\citrix\ica client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe" File not found
O4 - HKU\.DEFAULT..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKU\S-1-5-18..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKU\S-1-5-21-1841321574-3558567648-798452987-1005..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKLM..\RunOnce: [AvgRemover] C:\Documents and Settings\John Fringer\Local Settings\Temporary Internet Files\Content.IE5\0K0TTPUQ\avg_remover_stf_x86_2013_2706[1].exe (AVG Technologies CZ, s.r.o.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: verbosestatus = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1841321574-3558567648-798452987-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1841321574-3558567648-798452987-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1841321574-3558567648-798452987-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKU\S-1-5-21-1841321574-3558567648-798452987-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1841321574-3558567648-798452987-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: PDFill PDF Editor - {FB858B22-55E2-413f-87F5-30ADC5552151} - C:\Program Files\PlotSoft\PDFill\DownloadPDF.exe (PlotSoft LLC)
O15 - HKU\S-1-5-21-1841321574-3558567648-798452987-1005\..Trusted Domains: cnet.com ([download] http in Trusted sites)
O15 - HKU\S-1-5-21-1841321574-3558567648-798452987-1005\..Trusted Domains: download.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1841321574-3558567648-798452987-1005\..Trusted Domains: imdb.com ([www] http in Trusted sites)
O15 - HKU\S-1-5-21-1841321574-3558567648-798452987-1005\..Trusted Domains: intuit.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1841321574-3558567648-798452987-1005\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKU\S-1-5-21-1841321574-3558567648-798452987-1005\..Trusted Domains: nrc.gov ([access1] https in Trusted sites)
O15 - HKU\S-1-5-21-1841321574-3558567648-798452987-1005\..Trusted Domains: pnl.gov ([earrth] https in Trusted sites)
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED}
https://activatemyfios.verizon.net/sdcCommon/download/FIOS/Verizon FiOS Installer.cab (Reg Error: Value error.)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8}
http://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab (Reg Error: Value error.)
O16 - DPF: {08F04139-8DFC-11D2-80E9-006008B066EE}
https://icam.nrc.gov/certificates/vscnfchk.cab (ConfigChkr Class)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83}
http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4}
http://download.microsoft.com/download/0/f/b/0fb0fab9-7f09-4bb6-86d8-8e791ba99ac5/VirtualEarth3D.cab (SentinelVE3D Class)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000}
http://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab (Reg Error: Value error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
http://go.microsoft.com/fwlink/?LinkID=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258}
http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} Reg Error: Value error. (Reg Error: Value error.)
O16 - DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77}
http://I.dell.com/images/global/js/scanner/SysProExe.cab (Scanner.SysScanner)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0}
http://www.clarkcolor.com/ClarkActivia.cab (Snapfish Activia)
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345}
https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab (Symantec Script Runner Class)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967}
http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab (DLM Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}
http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1345079956609 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5}
http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Value error.)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968}
http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {B1D475FE-75CD-11D2-8301-0060B0B32E16}
https://icam.nrc.gov/certificates/vsimport.cab (ImpPKCS12 Class)
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD}
http://www.superadblocker.com/activex/sabspx.cab (SABScanProcesses Class)
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809}
http://www.cvsphoto.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab (Photo Upload Plugin Class)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277}
http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA}
http://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/update/1.7.0/jinstall-1_7_0_11-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CE8267C2-D41A-4A50-A69D-F32B5C289F14}
http://plugin.fileopen.com/current/FileOpen.CAB (FoInstaller Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Value error.)
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D}
http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326 (QDiagHUpdateObj Class)
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7}
http://utilities.pcpitstop.com/Optimize2/pcpitstop2.dll (PCPitstop Exam)
O16 - DPF: Garmin Communicator Plug-In
https://static.garmincdn.com/gcp/ie/4.0.4.0/GarminAxControl_32.CAB (Reg Error: Key error.)
O16 - DPF: vzTCPConfig
http://my.verizon.com/micro/speedoptimizer/fios/vzTCPConfig.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0B8054C3-6EC3-44D7-B1A2-9902255F9372}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\mhtml - No CLSID value found
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\John Fringer\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\John Fringer\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/08/16 05:43:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2013/03/04 18:28:49 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\John Fringer\Desktop\OTL.exe
[2013/03/04 18:15:59 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2013/03/04 18:15:54 | 000,000,000 | ---D | C] -- C:\JRT
[2013/03/04 18:14:32 | 000,547,601 | ---- | C] (Oleg N. Scherbakov) -- C:\Documents and Settings\John Fringer\Desktop\JRT.exe
[2013/03/04 17:58:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\John Fringer\Local Settings\Application Data\Avg2013
[2013/03/04 17:55:49 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2013/03/03 21:31:42 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2013/03/03 21:31:41 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2013/03/03 21:31:41 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2013/03/03 21:31:41 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2013/03/03 21:31:28 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013/03/03 20:51:19 | 005,036,260 | R--- | C] (Swearware) -- C:\Documents and Settings\John Fringer\Desktop\ComboFix.exe
[2013/03/03 11:56:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\John Fringer\My Documents\MBAR
[2013/03/03 08:10:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\John Fringer\Desktop\RK_Quarantine
[2013/03/02 18:01:19 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\John Fringer\Recent
[2013/03/02 17:49:16 | 000,000,000 | R--D | C] -- C:\Documents and Settings\John Fringer\Start Menu\Programs\Administrative Tools
[2013/03/01 19:08:57 | 000,368,248 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2013/03/01 19:08:57 | 000,062,448 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2013/03/01 19:08:57 | 000,049,832 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2013/03/01 19:08:57 | 000,029,880 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2013/03/01 19:08:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2013/03/01 19:08:56 | 000,765,808 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/03/01 19:08:56 | 000,228,600 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2013/03/01 19:08:56 | 000,066,408 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/03/01 19:08:19 | 000,041,664 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2013/03/01 19:07:37 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2013/03/01 19:06:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2013/03/01 09:05:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\John Fringer\Application Data\ElevatedDiagnostics
[2013/02/17 10:24:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Yahoo!
[2013/02/16 12:05:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Verizon Yahoo!
[2013/02/07 07:48:13 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013/02/06 19:11:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\John Fringer\My Documents\FundX
[2006/03/24 16:58:04 | 000,093,184 | ---- | C] (Microsoft Corporation) -- C:\Program Files\CARDFILE.EXE
========== Files - Modified Within 30 Days ==========
[2013/03/04 18:31:59 | 000,000,436 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{DB2AE189-C5C4-4C09-9299-B0198135388E}.job
[2013/03/04 18:28:50 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\John Fringer\Desktop\OTL.exe
[2013/03/04 18:14:34 | 000,547,601 | ---- | M] (Oleg N. Scherbakov) -- C:\Documents and Settings\John Fringer\Desktop\JRT.exe
[2013/03/04 18:09:59 | 000,000,292 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1841321574-3558567648-798452987-1005.job
[2013/03/04 18:09:57 | 000,000,328 | -H-- | M] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/03/04 18:09:56 | 000,000,300 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1841321574-3558567648-798452987-1005.job
[2013/03/04 18:07:17 | 000,000,292 | ---- | M] () -- C:\WINDOWS\tasks\SmartDefragUpdate.job
[2013/03/04 18:07:12 | 000,000,894 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/03/04 18:07:11 | 000,000,288 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1841321574-3558567648-798452987-1010.job
[2013/03/04 18:07:01 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/03/04 18:06:57 | 3219,296,256 | -HS- | M] () -- C:\hiberfil.sys
[2013/03/04 18:05:00 | 000,000,898 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/03/04 18:02:54 | 000,594,019 | ---- | M] () -- C:\Documents and Settings\John Fringer\Desktop\adwcleaner.exe
[2013/03/04 17:52:15 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/03/03 21:44:22 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2013/03/03 20:51:29 | 005,036,260 | R--- | M] (Swearware) -- C:\Documents and Settings\John Fringer\Desktop\ComboFix.exe
[2013/03/03 19:06:57 | 013,786,977 | ---- | M] () -- C:\Documents and Settings\John Fringer\My Documents\mbar-1.01.0.1021.zip
[2013/03/03 08:09:11 | 000,816,640 | ---- | M] () -- C:\Documents and Settings\John Fringer\Desktop\RogueKiller.exe
[2013/03/01 20:42:59 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/03/01 19:08:56 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2013/03/01 11:25:00 | 000,000,296 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1841321574-3558567648-798452987-1010.job
[2013/02/28 03:36:37 | 000,765,808 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/02/28 03:36:37 | 000,368,248 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2013/02/28 03:36:37 | 000,163,784 | ---- | M] () -- C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/02/28 03:36:37 | 000,062,448 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2013/02/28 03:36:36 | 000,066,408 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/02/28 03:36:36 | 000,049,832 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2013/02/28 03:36:36 | 000,049,320 | ---- | M] () -- C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/02/28 03:36:35 | 000,029,880 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2013/02/28 03:36:07 | 000,041,664 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2013/02/28 03:35:59 | 000,228,600 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2013/02/23 07:56:38 | 000,000,325 | RHS- | M] () -- C:\boot.ini
[2013/02/18 10:56:07 | 000,033,112 | ---- | M] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys
[2013/02/16 12:05:20 | 000,001,710 | ---- | M] () -- C:\Documents and Settings\John Fringer\Application Data\Microsoft\Internet Explorer\Quick Launch\Verizon Yahoo! Messenger.lnk
[2013/02/16 12:05:20 | 000,001,692 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Verizon Yahoo! Messenger.lnk
[2013/02/16 10:27:24 | 000,348,912 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/02/16 10:03:11 | 000,547,094 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/02/16 10:03:11 | 000,098,376 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/02/08 12:30:21 | 000,000,133 | ---- | M] () -- C:\DeletePrintJobs.cmd
[2013/02/03 13:53:14 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
========== Files Created - No Company Name ==========
[2013/03/04 18:02:53 | 000,594,019 | ---- | C] () -- C:\Documents and Settings\John Fringer\Desktop\adwcleaner.exe
[2013/03/03 21:31:42 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2013/03/03 21:31:42 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2013/03/03 21:31:41 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2013/03/03 21:31:41 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2013/03/03 21:31:41 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2013/03/03 19:06:53 | 013,786,977 | ---- | C] () -- C:\Documents and Settings\John Fringer\My Documents\mbar-1.01.0.1021.zip
[2013/03/03 08:09:20 | 000,816,640 | ---- | C] () -- C:\Documents and Settings\John Fringer\Desktop\RogueKiller.exe
[2013/03/01 19:08:56 | 000,163,784 | ---- | C] () -- C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/03/01 19:08:56 | 000,049,320 | ---- | C] () -- C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/03/01 19:08:56 | 000,000,328 | -H-- | C] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/03/01 09:06:30 | 3219,296,256 | -HS- | C] () -- C:\hiberfil.sys
[2013/02/16 12:05:20 | 000,001,710 | ---- | C] () -- C:\Documents and Settings\John Fringer\Application Data\Microsoft\Internet Explorer\Quick Launch\Verizon Yahoo! Messenger.lnk
[2013/02/16 12:05:20 | 000,001,692 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Verizon Yahoo! Messenger.lnk
[2013/02/08 12:30:21 | 000,000,133 | ---- | C] () -- C:\DeletePrintJobs.cmd
[2013/02/01 14:43:15 | 000,014,776 | ---- | C] () -- C:\WINDOWS\System32\drivers\SmartDefragDriver.sys
[2013/01/20 02:37:11 | 000,005,022 | ---- | C] () -- C:\Documents and Settings\John Fringer\secedit.INTEG.RAW
[2013/01/11 18:40:21 | 000,492,088 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2012/08/25 11:18:45 | 000,032,131 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2012/08/24 17:39:56 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\xrfk2aJBF.DLL
[2012/08/24 17:37:00 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\xrhk2aLM.DLL
[2012/08/24 17:36:40 | 001,695,232 | ---- | C] () -- C:\WINDOWS\System32\xrqsreg.dll
[2012/08/12 21:01:17 | 000,027,520 | ---- | C] () -- C:\Documents and Settings\John Fringer\Local Settings\Application Data\dt.dat
[2012/05/21 08:54:23 | 000,683,022 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1841321574-3558567648-798452987-1010-0.dat
[2012/04/08 21:12:17 | 000,000,590 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Microsoft.SqlServer.Compact.400.32.bc
[2012/02/18 08:48:08 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/11/28 18:56:14 | 000,020,312 | ---- | C] () -- C:\WINDOWS\System32\RegistryDefragBootTime.exe
[2011/09/27 19:59:01 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat
[2011/09/27 19:59:01 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\statistics.dat
[2011/09/27 19:59:01 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat
[2011/05/13 21:38:20 | 001,503,232 | ---- | C] () -- C:\WINDOWS\System32\ptj.exe
[2011/05/13 21:38:20 | 001,103,360 | ---- | C] () -- C:\WINDOWS\System32\cidfont.dll
[2011/05/13 21:38:19 | 004,369,408 | ---- | C] () -- C:\WINDOWS\System32\pdftk.exe
[2011/05/13 21:38:19 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\office.exe
[2011/03/15 12:24:46 | 000,001,598 | ---- | C] () -- C:\WINDOWS\System32\CommonSetting.ini
[2011/02/02 22:36:27 | 004,443,662 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1841321574-3558567648-798452987-1005-0.dat
[2010/10/31 18:35:55 | 000,341,942 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2010/07/25 10:04:21 | 000,000,251 | ---- | C] () -- C:\Program Files\wt3d.ini
[2010/03/12 09:31:11 | 000,000,222 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\PrimoPDFSet.xml
[2010/03/07 12:53:46 | 000,000,787 | -H-- | C] () -- C:\Documents and Settings\John Fringer\hpothb07.tif
[2010/03/07 12:53:46 | 000,000,540 | -H-- | C] () -- C:\Documents and Settings\John Fringer\hpothb07.dat
[2010/03/07 12:53:44 | 000,000,517 | -H-- | C] () -- C:\Documents and Settings\All Users\hpothb07.tif
[2010/03/07 12:53:44 | 000,000,345 | -H-- | C] () -- C:\Documents and Settings\All Users\hpothb07.dat
[2010/03/07 12:53:33 | 000,000,503 | -H-- | C] () -- C:\Program Files\hpothb07.tif
[2010/03/07 12:53:33 | 000,000,294 | -H-- | C] () -- C:\Program Files\hpothb07.dat
[2009/11/27 16:35:54 | 007,368,704 | ---- | C] () -- C:\Documents and Settings\John Fringer\s-1-5-21-1841321574-3558567648-798452987-1005.rrr
[2009/07/26 22:04:09 | 000,000,222 | ---- | C] () -- C:\Documents and Settings\NetworkService\Application Data\PrimoPDFSet.xml
[2009/01/19 16:40:10 | 000,006,821 | ---- | C] () -- C:\Documents and Settings\John Fringer\Application Data\PrimoPDFSet.xml
[2008/04/04 19:56:35 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\John Fringer\Application Data\PFP120JPR.{PB
[2008/04/04 19:56:35 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\John Fringer\Application Data\PFP120JCM.{PB
[2007/09/13 21:54:08 | 000,000,122 | ---- | C] () -- C:\Documents and Settings\John Fringer\default.pls
[2007/09/13 19:49:22 | 000,002,508 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\$_hpcst$.hpc
[2007/09/12 21:47:51 | 000,002,508 | ---- | C] () -- C:\Documents and Settings\John Fringer\Application Data\$_hpcst$.hpc
[2006/10/15 09:27:41 | 000,000,761 | ---- | C] () -- C:\Documents and Settings\John Fringer\webex.ini
[2006/07/23 22:55:34 | 000,006,144 | ---- | C] () -- C:\Documents and Settings\John Fringer\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/06/30 21:28:46 | 000,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/02/19 11:52:37 | 000,000,135 | ---- | C] () -- C:\Documents and Settings\John Fringer\Local Settings\Application Data\fusioncache.dat
[2006/02/19 11:52:22 | 000,262,144 | ---- | C] () -- C:\Documents and Settings\All Users\Original Copy of NTUSER.DAT
========== ZeroAccess Check ==========
[2005/08/16 05:39:16 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/13 19:12:05 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 07:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/13 19:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
========== LOP Check ==========
[2013/03/01 19:07:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/10/05 14:22:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Citrix
[2011/03/05 15:14:25 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2005/08/16 21:54:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DIGStream
[2012/11/24 13:35:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Downloaded Installations
[2009/05/09 12:48:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DriverScanner
[2008/12/14 12:13:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\eFax Messenger 4.0 Setup
[2010/04/12 16:11:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\eFax Messenger 4.4 Output
[2006/03/13 21:01:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\espionServerData
[2009/03/29 19:15:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FileOpen
[2013/01/21 13:10:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Foresight Software
[2006/02/20 02:04:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Freedom
[2012/10/08 11:21:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GARMIN
[2012/10/22 14:49:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GoodSync
[2013/02/01 14:42:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IObit
[2009/08/11 20:24:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2013/03/01 19:15:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2006/03/12 20:55:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2012/11/26 06:41:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Napster
[2006/03/26 20:57:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Otto
[2009/08/10 21:18:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2008/12/14 12:13:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PCPitstop
[2010/03/19 10:42:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PDF Writer
[2010/03/19 10:56:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PlotSoft
[2006/02/20 02:05:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Polesoft
[2006/02/19 20:51:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PureEdge
[2011/08/14 12:28:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RapidTyping
[2006/02/19 21:46:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RoboForm
[2012/08/25 12:30:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2009/04/15 17:26:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SpeedBit
[2012/07/01 11:41:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SUPERSetup
[2010/09/14 20:51:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2012/08/25 12:30:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Zeon
[2010/07/17 09:36:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012/12/23 15:25:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{5A85B23A-4B58-47D1-9B9C-DFBD7866099F}
[2013/01/28 09:53:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{CED89F1A-945F-46EC-B23C-5EAF6D2DB12A}
[2012/11/26 06:11:07 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Application Data\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
[2010/09/13 09:45:22 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Application Data\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2012/12/23 15:25:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{D76294E6-03B8-4971-AF2E-3F846161A690}
[2011/05/23 09:33:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\IObit
[2012/10/22 09:28:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\TuneUp Software
[2006/02/20 02:05:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\VERITAS
[2012/05/05 10:54:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\addpcs
[2009/05/06 18:45:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\Amazon
[2012/09/21 15:03:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\anpo.republika.pl
[2012/09/21 19:38:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\Azureus
[2010/09/25 00:30:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\CBS Interactive
[2009/01/23 16:44:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\Citrix
[2006/02/19 21:48:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\com.codeode
[2006/10/07 16:26:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\eFax Messenger
[2013/03/01 09:05:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\ElevatedDiagnostics
[2009/03/29 19:15:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\FileOpen
[2012/09/21 12:12:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\fltk.org
[2013/01/21 13:09:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\Foresight Software
[2012/10/08 11:21:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\GARMIN
[2012/10/22 14:49:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\GoodSync
[2009/12/18 12:16:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\ICAClient
[2013/02/01 14:42:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\IObit
[2010/04/12 16:11:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\j2 Global
[2006/02/21 08:24:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\Leadertech
[2007/05/26 22:42:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\OfficeUpdate12
[2006/03/19 22:45:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\Opera
[2010/08/07 14:06:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\passport_photo
[2010/03/19 10:42:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\PDF Writer
[2012/09/15 11:33:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\PhotoScape
[2006/02/19 20:51:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\PureEdge
[2011/08/14 12:28:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\RapidTyping
[2011/11/05 18:09:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\RoboForm
[2012/08/25 11:45:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\ScanSoft
[2006/03/20 00:58:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\Snapfish
[2009/08/10 20:45:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\Software Informer
[2009/01/20 10:43:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\Stamps.com Internet Postage
[2012/08/25 12:24:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\Swiftdata
[2009/01/02 18:50:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\TeamViewer
[2012/09/27 21:22:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\TuneUp Software
[2011/08/25 08:16:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\webex
[2009/05/23 16:42:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\Windows Desktop Search
[2012/08/25 11:45:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Fringer\Application Data\Zeon
[2012/10/24 17:58:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\IObit
[2008/12/23 11:06:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\TeamViewer
[2009/07/26 22:05:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\FileOpen
[2009/06/28 12:49:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix\Application Data\Citrix
[2009/12/02 12:28:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix\Application Data\FileOpen
[2009/12/02 06:52:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix\Application Data\ICAClient
[2009/12/02 06:30:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix\Application Data\IObit
[2006/02/20 02:05:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix\Application Data\VERITAS
[2009/06/25 10:18:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix 2\Application Data\FileOpen
[2009/11/13 22:54:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix 2\Application Data\ICAClient
[2006/02/20 02:05:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix 2\Application Data\VERITAS
[2013/02/08 12:11:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix.D3BJHC91\Application Data\ElevatedDiagnostics
[2010/04/10 10:55:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix.D3BJHC91\Application Data\FileOpen
[2012/05/21 07:54:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix.D3BJHC91\Application Data\Garmin
[2011/08/02 07:15:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix.D3BJHC91\Application Data\ICAClient
[2013/02/22 07:28:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix.D3BJHC91\Application Data\IObit
[2010/11/19 14:32:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix.D3BJHC91\Application Data\PDF Writer
[2011/02/04 12:42:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix.D3BJHC91\Application Data\ScanSoft
[2012/01/20 10:46:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix.D3BJHC91\Application Data\ShopAtHomeToolbar
[2006/02/20 02:05:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix.D3BJHC91\Application Data\VERITAS
[2011/05/06 14:31:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NRC Citrix.D3BJHC91\Application Data\Windows Search
[2006/02/20 02:05:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\com.codeode
[2006/02/20 02:05:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Freedom
[2006/02/20 02:05:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Leadertech
[2006/02/20 02:02:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\MSNInstaller
[2006/02/20 02:05:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Polesoft
[2006/02/20 01:39:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\PureEdge
[2006/02/20 02:05:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\VERITAS
[2010/07/25 09:54:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TEMP\Application Data\ICAClient
[2006/02/20 02:05:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\TEMP\Application Data\VERITAS
========== Purity Check ==========
< End of report >