Inactive [A] Sirefef.. help rebooting every second

[happycan]

Hi.. please help me.. I already did the FRST.txt and searched for services.exe. Attached the log for reference. What to do next? Help!

 

[Broni]

Welcome aboard

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running tools or applying updates other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

============================================================

Please observe forum rules.
All logs have to be pasted not attached.

 

[happycan]

Hi Broni.. Pls help

 

[Broni]

Read all of my instructions very carefully.

Please observe forum rules.
All logs have to be pasted not attached.

 

[happycan]

Sorry here's the frst.txt

Scan result of Farbar Recovery Scan Tool (FRST written by Farbar) Version: 18-06-2012 02
Ran by SYSTEM at 19-06-2012 08:08:56
Running from H:\
Windows 7 Professional (X86) OS Language: English(US)
The current controlset is ControlSet001
========================== Registry (Whitelisted) =============
HKLM\...\Run: [QLBController] C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe /start [254520 2010-01-04] (Hewlett-Packard Company)
HKLM\...\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-08-25] (Intel Corporation)
HKLM\...\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe [563736 2009-10-23] (PDF Complete Inc)
HKLM\...\Run: [HPPowerAssistant] C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe /hidden [1690680 2009-12-16] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1594664 2010-01-04] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe 120 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe /hidden [363064 2009-12-16] (Hewlett-Packard)
HKLM\...\Run: [File Sanitizer] C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11265536 2009-12-11] (Hewlett-Packard)
HKLM\...\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe [495711 2009-12-03] (IDT, Inc.)
HKLM\...\Run: [DTRun] c:\Program Files\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe [518656 2009-11-18] (ArcSoft Inc.)
HKLM\...\Run: [NortonOnlineBackupReminder] "C:\Program Files\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED [600936 2009-06-28] (Symantec Corporation)
HKLM\...\Run: [VMware hqtray] "C:\Program Files\VMware\VMware Player\hqtray.exe" [64048 2010-09-20] (VMware, Inc.)
HKLM\...\Run: [TkBellExe] "C:\Program Files\real\realplayer\update\realsched.exe" -osboot [274608 2010-11-23] (RealNetworks, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [248552 2010-05-13] (Sun Microsystems, Inc.)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-09-26] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2011-10-23] (Apple Inc.)
HKLM\...\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray [462408 2012-04-03] (Malwarebytes Corporation)
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [641664 2012-04-05] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files\AMD AVT\bin\kdbsync.exe" aml [10752 2012-02-20] ()
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [931200 2012-03-26] (Microsoft Corporation)
HKU\Admin\...\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1685048 2009-09-29] (Hewlett-Packard)
HKU\Admin\...\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden [2363392 2009-06-17] (Hewlett-Packard Company)
HKU\Admin\...\Run: [Google Update] "C:\Users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2010-06-23] (Google Inc.)
HKU\Classic .NET AppPool\...\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1685048 2009-09-29] (Hewlett-Packard)
HKU\Default\...\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1685048 2009-09-29] (Hewlett-Packard)
HKU\Default User\...\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1685048 2009-09-29] (Hewlett-Packard)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe, [x]
Winlogon\Notify\DeviceNP: DeviceNP.dll (Hewlett-Packard Limited)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Lsa: [Notification Packages] DPPassFilter
scecli
Startup: C:\Users\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
================================ Services (Whitelisted) ==================
3 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [109056 2009-09-28] (ArcSoft Inc.)
2 AESTFilters; C:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\aestsrv.exe [81920 2009-03-03] (Andrea Electronics Corporation)
2 AMD External Events Utility; C:\Windows\System32\atiesrxx.exe [217600 2012-04-05] (AMD)
2 AppHostSvc; C:\Windows\system32\inetsrv\apphostsvc.dll [61440 2009-07-13] (Microsoft Corporation)
2 BBUpdate; "C:\Program Files\Microsoft\BingBar\SeaPort.EXE" [249648 2011-06-15] (Microsoft Corporation)
2 btwdins; C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe [595232 2009-09-04] (Broadcom Corporation.)
2 dtpd; C:\Program Files\ShrewSoft\VPN Client\dtpd.exe -service [49152 2009-11-15] ()
2 EFS; C:\Windows\System32\lsass.exe [22528 2011-11-16] (Microsoft Corporation)
3 ehRecvr; C:\Windows\ehome\ehRecvr.exe [556032 2010-08-03] (Microsoft Corporation)
3 ehSched; C:\Windows\ehome\ehsched.exe [94720 2009-07-13] (Microsoft Corporation)
2 eventlog; C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted [20992 2009-07-13] (Microsoft Corporation)
3 Fax; C:\Windows\System32\fxssvc.exe [522752 2009-07-13] (Microsoft Corporation)
2 HP Health Check Service; "C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe" [120832 2009-10-15] (Hewlett-Packard)
2 HP Power Assistant Service; "C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe" [102968 2009-12-16] (Hewlett-Packard)
2 HP Wireless Assistant Service; "C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe" [102968 2009-12-16] (Hewlett-Packard)
2 HPFSService; C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe [297984 2009-12-11] (Hewlett-Packard)
2 hpHotkeyMonitor; "C:\Program Files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe" [264248 2010-01-04] (Hewlett-Packard Company)
2 iked; C:\Program Files\ShrewSoft\VPN Client\iked.exe -service [716800 2009-11-15] ()
2 ipsecd; C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe -service [536576 2009-11-15] ()
3 KeyIso; C:\Windows\System32\lsass.exe [22528 2011-11-16] (Microsoft Corporation)
2 MBAMService; "C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe" [654408 2012-04-03] (Malwarebytes Corporation)
3 MozillaMaintenance; "C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe" [113120 2012-06-01] (Mozilla Foundation)
3 MSDTC; C:\Windows\System32\msdtc.exe [134144 2009-07-13] (Microsoft Corporation)
2 MsDtsServer100; "C:\Program Files\Microsoft SQL Server\100\DTS\Binn\MsDtsSrvr.exe" [218136 2008-07-09] (Microsoft Corporation)
3 msiserver; C:\Windows\System32\msiexec.exe /V [73216 2009-07-13] (Microsoft Corporation)
2 MSSQLSERVER; "C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\sqlservr.exe" -sMSSQLSERVER [42727784 2011-02-04] (Microsoft Corporation)
4 MSSQLServerADHelper100; "C:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE" [47128 2008-07-10] (Microsoft Corporation)
4 msvsmon80; "C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /service msvsmon80 [2808664 2007-02-22] (Microsoft Corporation)
4 msvsmon90; "C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /service msvsmon90 [3201024 2008-07-28] (Microsoft Corporation)
3 Netlogon; C:\Windows\System32\lsass.exe [22528 2011-11-16] (Microsoft Corporation)
4 NetMsmqActivator; "C:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe" -NetMsmqActivator [124240 2010-03-17] (Microsoft Corporation)
4 NetPipeActivator; C:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-17] (Microsoft Corporation)
4 NetTcpActivator; C:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-17] (Microsoft Corporation)
4 NetTcpPortSharing; C:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-17] (Microsoft Corporation)
2 nPStarterSVC; C:\windows\system32\nPStarterSVC.exe [250145 2011-09-02] (INCA Internet Co., Ltd.)
2 pdfcDispatcher; C:\Program Files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService [635416 2009-10-23] (PDF Complete Inc)
3 ProtectedStorage; C:\Windows\System32\lsass.exe [22528 2011-11-16] (Microsoft Corporation)
2 ReportServer; "C:\Program Files\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe" [1113448 2009-03-29] (Microsoft Corporation)
3 RpcLocator; C:\Windows\System32\locator.exe [9216 2009-07-13] (Microsoft Corporation)
2 SamSs; C:\Windows\System32\lsass.exe [22528 2011-11-16] (Microsoft Corporation)
3 SNMPTRAP; C:\Windows\System32\snmptrap.exe [12800 2009-07-13] (Microsoft Corporation)
2 Spooler; C:\Windows\System32\spoolsv.exe [316928 2010-08-20] (Microsoft Corporation)
2 sppsvc; C:\Windows\System32\sppsvc.exe [3179520 2009-07-13] (Microsoft Corporation)
3 SQLSERVERAGENT; "C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE" -I MSSQLSERVER [366936 2009-03-29] (Microsoft Corporation)
2 STacSV; C:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\STacSV.exe [229461 2009-12-03] (IDT, Inc.)
3 StorSvc; C:\Windows\System32\storsvc.dll [16384 2009-07-13] (Microsoft Corporation)
2 SWGVCSvc; "C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe" -regserver [227352 2009-03-05] (SonicWALL, Inc.)
2 uArcCapture; C:\windows\system32\uArcCapture.exe [506472 2009-12-04] (ArcSoft, Inc.)
3 UI0Detect; C:\Windows\System32\UI0Detect.exe [35840 2009-07-13] (Microsoft Corporation)
3 VaultSvc; C:\Windows\System32\lsass.exe [22528 2011-11-16] (Microsoft Corporation)
2 vcsFPService; C:\windows\system32\vcsFPService.exe [1639728 2009-12-14] (Validity Sensors, Inc.)
3 vds; C:\Windows\System32\vds.exe [452608 2009-07-13] (Microsoft Corporation)
2 VMAuthdService; "C:\Program Files\VMware\VMware Player\vmware-authd.exe" [113200 2010-09-20] (VMware, Inc.)
2 VMnetDHCP; C:\windows\system32\vmnetdhcp.exe [334384 2010-09-20] (VMware, Inc.)
2 VMUSBArbService; "C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe" [539184 2010-09-20] (VMware, Inc.)
2 VMware NAT Service; C:\windows\system32\vmnat.exe [404016 2010-09-20] (VMware, Inc.)
3 VSS; C:\Windows\System32\vssvc.exe [1025536 2009-07-13] (Microsoft Corporation)
2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [396288 2009-07-13] (Microsoft Corporation)
3 WAS; C:\Windows\system32\inetsrv\iisw3adm.dll [396288 2009-07-13] (Microsoft Corporation)
3 wbengine; "C:\Windows\system32\wbengine.exe" [1202688 2009-07-13] (Microsoft Corporation)
2 wgsslvpnsrc; C:\Program Files\WatchGuard\WatchGuard Mobile VPN with SSL\wgsslvpnsrc.exe [58368 2011-06-29] ()
2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [x]
3 FLCDLOCK; c:\Windows\system32\flcdlock.exe [x]
2 HP ProtectTools Service; "c:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe" [x]
2 HPDayStarterService; "c:\Program Files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe" [x]
2 HPDrvMntSvc.exe; "c:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe" [x]
2 HpFkCryptService; "c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe" [x]
4 MsMpSvc; "c:\Program Files\Microsoft Security Client\MsMpEng.exe" [x]
2 MSSQL$SQLEXPRESS; "c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS [x]
3 MSSQLFDLauncher; "C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\fdlauncher.exe" -s MSSQL10.MSSQLSERVER [x]
2 MSSQLServerOLAPService; "C:\Program Files\Microsoft SQL Server\MSAS10.MSSQLSERVER\OLAP\bin\msmdsrv.exe" -s "C:\Program Files\Microsoft SQL Server\MSAS10.MSSQLSERVER\OLAP\Config" [x]
3 NisSrv; "c:\Program Files\Microsoft Security Client\NisSrv.exe" [x]
2 PSI_SVC_2; "c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe" [x]
3 rpcapd; "C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini" [x]
4 SQLAgent$SQLEXPRESS; "c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE" -I SQLEXPRESS [x]
4 SQLBrowser; "c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe" [x]
2 SQLWriter; "c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [x]
3 ufad-ws60; "C:\Program Files\VMware\VMware Player\vmware-ufad.exe" -d "C:\Program Files\VMware\VMware Player\\" -s ufad-p2v.xml [x]

 

[happycan]

========================== Drivers (Whitelisted) =============
3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
3 AgereSoftModem; C:\Windows\System32\DRIVERS\AGRSM.sys [1035776 2009-07-13] (LSI Corp)
3 amdkmdag; C:\Windows\System32\DRIVERS\atikmdag.sys [9334784 2012-04-05] (Advanced Micro Devices, Inc.)
3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [29824 2009-12-04] (ArcSoft, Inc.)
3 AtiHdmiService; C:\Windows\System32\drivers\AtiHdmi.sys [100352 2009-11-18] (ATI Technologies, Inc.)
3 atikmdag; C:\Windows\System32\DRIVERS\atikmdag.sys [9334784 2012-04-05] (Advanced Micro Devices, Inc.)
3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv.sys [32312 2009-10-21] (Hewlett-Packard Development Company L.P.)
3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-16] (Deterministic Networks, Inc.)
2 hcmon; \??\C:\windows\system32\drivers\hcmon.sys [32304 2010-09-20] (VMware, Inc.)
3 iirsp; C:\Windows\system32\DRIVERS\iirsp.sys [41040 2009-07-13] (Intel Corp./ICP vortex GmbH)
3 JRSKD24; \??\C:\windows\system32\JRSKD24.SYS [26280 2011-09-02] (SoftSecurity Corporation)
3 kcrtx86; \??\C:\windows\system32\kcrtx86.sys [126048 2011-09-02] (Kings Information & Network)
3 MBAMProtector; \??\C:\windows\system32\drivers\mbam.sys [22344 2012-04-03] (Malwarebytes Corporation)
3 MfeAVFK; C:\Windows\System32\drivers\MfeAVFK.sys [79816 2009-05-15] (McAfee, Inc.)
3 MfeBOPK; C:\Windows\System32\drivers\MfeBOPK.sys [35272 2009-05-15] (McAfee, Inc.)
1 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [214024 2009-05-15] (McAfee, Inc.)
3 MfeRKDK; C:\Windows\System32\drivers\MfeRKDK.sys [34248 2009-05-15] (McAfee, Inc.)
1 mfetdik; C:\Windows\System32\drivers\mfetdik.sys [55336 2009-05-15] (McAfee, Inc.)
0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation)
2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
3 NPIDS; \??\C:\windows\system32\NpIdsVt.sys [47712 2010-05-12] (INCA Internet Co., Ltd.)
4 RsFx0103; C:\Windows\System32\DRIVERS\RsFx0103.sys [239336 2009-03-29] (Microsoft Corporation)
3 RSUSBSTOR; C:\Windows\System32\Drivers\RtsUStor.sys [181792 2009-11-11] (Realtek Semiconductor Corp.)
1 RsvLock; C:\Windows\System32\Drivers\RsvLock.sys [40088 2009-12-15] (McAfee, Inc.)
3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [73344 2009-12-22] (Realtek Semiconductor Corp.)
0 SafeBoot; C:\Windows\System32\Drivers\SafeBoot.sys [110520 2009-12-15] (McAfee, Inc.)
0 SbAlg; C:\Windows\System32\Drivers\SbAlg.sys [51800 2009-12-15] (McAfee, Inc.)
0 SbFsLock; C:\Windows\System32\Drivers\SbFsLock.sys [13256 2009-12-15] (McAfee, Inc.)
3 scsk5; C:\Windows\System32\drivers\scsk5.sys [55864 2011-10-05] ()
1 SWIPsec; \??\C:\windows\system32\Drivers\SWIPsec.sys [87064 2009-03-05] (SonicWALL, Inc.)
3 SWVNIC; C:\Windows\System32\DRIVERS\swvnic.sys [21016 2009-03-04] (SonicWALL, Inc.)
3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [26112 2011-06-29] (The OpenVPN Project)
1 vflt; C:\Windows\System32\DRIVERS\vfilter.sys [17408 2009-11-18] (Shrew Soft Inc)
2 vmci; \??\C:\windows\system32\Drivers\vmci.sys [70704 2010-09-20] (VMware, Inc.)
3 vmkbd; \??\C:\windows\system32\drivers\VMkbd.sys [24624 2010-09-20] (VMware, Inc.)
3 VMnetAdapter; C:\Windows\System32\DRIVERS\vmnetadapter.sys [16560 2010-09-20] (VMware, Inc.)
2 VMnetBridge; C:\Windows\System32\DRIVERS\vmnetbridge.sys [36400 2010-09-20] (VMware, Inc.)
2 VMnetuserif; \??\C:\windows\system32\drivers\vmnetuserif.sys [26288 2010-09-20] (VMware, Inc.)
3 vmusb; C:\Windows\System32\Drivers\vmusb.sys [31280 2010-09-20] (VMware, Inc.)
2 vmx86; \??\C:\windows\system32\Drivers\vmx86.sys [854064 2010-09-20] (VMware, Inc.)
3 vnet; C:\Windows\System32\DRIVERS\virtualnet.sys [9728 2009-11-18] (Shrew Soft Inc)
3 vpcbus; C:\Windows\system32\DRIVERS\vpchbus.sys [165376 2010-01-20] (Microsoft Corporation)
1 vpcnfltr; C:\Windows\System32\DRIVERS\vpcnfltr.sys [55040 2010-01-20] (Microsoft Corporation)
3 vpcusb; C:\Windows\System32\DRIVERS\vpcusb.sys [78336 2010-01-20] (Microsoft Corporation)
1 vpcvmm; C:\Windows\System32\drivers\vpcvmm.sys [295128 2009-12-01] (Microsoft Corporation)
2 vstor2-ws60; \??\C:\Program Files\VMware\VMware Player\vstor2-ws60.sys [22448 2010-08-18] (VMware, Inc.)
========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============
2012-06-19 08:08 - 2012-06-19 08:09 - 00000000 ____D C:\FRST
2012-06-18 15:42 - 2012-06-18 15:42 - 00875626 ____A C:\Users\Admin\Documents\FRST.exe
2012-06-18 15:26 - 2012-06-18 15:26 - 00001094 ____A C:\Users\Admin\Documents\SystemLook1.txt
2012-06-18 13:34 - 2012-06-18 15:24 - 00001092 ____A C:\Users\Admin\Documents\SystemLook.txt
2012-06-18 13:33 - 2012-06-18 13:33 - 00139264 ____A C:\Users\Admin\Documents\SystemLook.exe
2012-06-18 13:33 - 2012-06-18 13:33 - 00000000 ____D C:\Program Files\ESET
2012-06-18 13:23 - 2012-06-18 13:23 - 00000081 ____A C:\Windows\System32\npd_log.txt
2012-06-18 04:59 - 2012-06-18 04:59 - 00000000 ____D C:\Users\Admin\AppData\Roaming\hpqlog
2012-06-18 04:35 - 2012-06-18 04:36 - 00000000 ____D C:\Program Files\Microsoft Security Client
2012-06-18 04:34 - 2012-06-18 04:46 - 00000000 __SHD C:\Config.Msi
2012-06-18 04:23 - 2012-06-18 04:25 - 66343968 ____A (Microsoft Corporation) C:\Users\Admin\Documents\mpam-fe.exe
2012-06-18 04:12 - 2012-06-18 04:12 - 10288512 ____A (Microsoft Corporation) C:\Users\Admin\Documents\mseinstall.exe
2012-06-18 03:58 - 2012-06-18 03:58 - 10288512 ____A (Microsoft Corporation) C:\Users\Admin\Downloads\mseinstall.exe
2012-06-18 01:49 - 2012-06-18 01:49 - 00000000 __SHD C:\Windows\System32\%APPDATA%
2012-06-14 19:48 - 2012-06-14 19:48 - 00402665 ____A C:\Users\Admin\Documents\seafquotation.pdf
2012-06-14 19:48 - 2012-06-14 19:48 - 00380674 ____A C:\Users\Admin\Documents\seafprocedure.pdf
2012-06-14 19:43 - 2012-06-14 19:43 - 00401974 ____A C:\Users\Admin\Documents\airfquotation.pdf
2012-06-14 19:43 - 2012-06-14 19:43 - 00388972 ____A C:\Users\Admin\Documents\airfprocedure.pdf
2012-06-14 17:26 - 2012-05-17 15:11 - 12314624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-06-14 17:26 - 2012-05-17 14:48 - 09737728 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-06-14 17:26 - 2012-05-17 14:45 - 01800192 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-06-14 17:26 - 2012-05-17 14:36 - 01103872 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-06-14 17:26 - 2012-05-17 14:35 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-06-14 17:26 - 2012-05-17 14:35 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-06-14 17:26 - 2012-05-17 14:33 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-06-14 17:26 - 2012-05-17 14:31 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-06-14 17:26 - 2012-05-17 14:29 - 00716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-06-14 17:26 - 2012-05-17 14:29 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-06-14 17:26 - 2012-05-17 14:27 - 01793024 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-06-14 17:26 - 2012-05-17 14:25 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-06-14 17:26 - 2012-05-17 14:24 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-06-14 17:26 - 2012-05-17 14:20 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-06-13 18:15 - 2012-05-14 17:12 - 02342400 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-06-13 18:15 - 2012-05-01 20:52 - 00163328 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2012-06-13 18:15 - 2012-04-27 19:19 - 00177152 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-06-13 18:15 - 2012-04-25 20:48 - 00129536 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-06-13 18:15 - 2012-04-25 20:48 - 00057856 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-06-13 18:15 - 2012-04-25 20:43 - 00008192 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-06-13 18:15 - 2012-04-07 03:34 - 02342400 ____A (Microsoft Corporation) C:\Windows\System32\msi.dll
2012-06-13 18:14 - 2012-04-23 20:47 - 01156608 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-06-13 18:14 - 2012-04-23 20:47 - 00139264 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-06-13 18:14 - 2012-04-23 20:47 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-06-11 20:48 - 2012-06-12 00:07 - 00000226 ____A C:\Users\Admin\Documents\gv_file.txt
2012-06-11 16:53 - 2012-06-11 16:53 - 00143672 ____A C:\Windows\Minidump\061212-27612-01.dmp
2012-06-11 01:22 - 2012-06-11 01:22 - 00000000 ____D C:\Users\Default\AppData\Local\Google
2012-06-11 01:22 - 2012-06-11 01:22 - 00000000 ____D C:\Users\Default User\AppData\Local\Google
2012-06-10 23:57 - 2012-06-10 23:57 - 00023552 ____A C:\Users\Admin\Documents\oxicash_may.xls
2012-06-08 17:38 - 2012-06-02 14:19 - 01933848 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-08 17:38 - 2012-06-02 14:19 - 00577048 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-08 17:38 - 2012-06-02 14:19 - 00053784 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-08 17:38 - 2012-06-02 14:19 - 00045080 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-08 17:38 - 2012-06-02 14:19 - 00035864 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-08 17:38 - 2012-06-02 14:12 - 02422272 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-08 17:38 - 2012-06-02 14:12 - 00088576 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-08 17:38 - 2012-06-01 23:19 - 00171904 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-08 17:38 - 2012-06-01 23:12 - 00033792 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-06 17:52 - 2012-06-06 17:52 - 00000000 ____D C:\Users\All Users\Mozilla
2012-06-06 17:52 - 2012-06-06 17:52 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2012-06-06 17:46 - 2012-06-06 17:47 - 16574016 ____A (Mozilla) C:\Users\Admin\Downloads\Firefox Setup 13.0.exe
2012-06-03 19:52 - 2012-06-06 19:40 - 00000211 ____A C:\Users\Admin\Documents\poliv2_file.txt
2012-06-03 18:46 - 2012-06-03 18:46 - 00250368 ____A C:\Users\Admin\Documents\alipay.doc
2012-06-03 09:53 - 2012-06-18 03:49 - 01108857 ____A C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix1.pdf
2012-06-01 05:14 - 2012-06-01 05:14 - 00920745 ____A C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix.pdf
2012-05-31 22:49 - 2012-05-31 22:49 - 01041870 ____A C:\Users\Admin\Documents\Microsoft.Lead2pass.70-516.v2012-05-31.by.Johny.217q.vce
2012-05-31 22:10 - 2012-06-13 01:15 - 00058178 ____A C:\Users\Admin\Documents\Prometric_Registration_Form.docx
2012-05-30 00:41 - 2012-05-30 00:41 - 00000358 ____A C:\Users\Admin\Documents\bt.htm
2012-05-29 19:54 - 2012-05-29 20:07 - 00353047 ____A C:\Users\Admin\Documents\InstallCert.docx
2012-05-29 19:04 - 2012-05-29 19:04 - 00001800 ____A C:\Users\Admin\Documents\mol3.molsolutions.com.pfx.zip
2012-05-29 19:04 - 2012-05-29 19:04 - 00000000 ____D C:\Users\Admin\Documents\mol3.molsolutions.com.pfx
2012-05-28 01:02 - 2012-05-28 01:15 - 00879616 ____A C:\Users\Admin\Documents\Copy (1) of Payment Flows.vsd
2012-05-28 00:42 - 2012-05-28 00:42 - 00916480 ____A C:\Users\Admin\Documents\Payment Flows.vsd
2012-05-28 00:31 - 2012-05-28 20:38 - 00536064 ____A C:\Users\Admin\Documents\Payment Integration Process Document.doc
2012-05-27 22:54 - 2012-05-27 22:54 - 00362496 ____A C:\Users\Admin\Documents\RE Digicash Pricing.msg
2012-05-27 09:33 - 2012-05-27 09:33 - 01100743 ____A C:\Users\Admin\Documents\metal.docx
2012-05-26 23:54 - 2012-05-26 23:55 - 00010873 ____A C:\Users\Admin\Documents\PaymentProcessFlow.docx
2012-05-26 09:28 - 2012-05-26 09:28 - 01865201 ____A C:\Users\Admin\Documents\Microsoft.TestKing.70-516.v2012-02-03.by.Lyudmyla.v190q.vce
2012-05-26 09:26 - 2012-05-26 09:26 - 01856837 ____A C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-03-16.by.Edom.195q.vce
2012-05-26 09:25 - 2012-05-26 09:25 - 01868219 ____A C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix.193q.vce
2012-05-21 07:57 - 2012-05-21 07:59 - 59399232 ____A C:\Users\Admin\Documents\10264A-ENU-Allfiles.exe
2012-05-21 07:54 - 2012-05-21 07:54 - 08388608 ____A C:\Users\Admin\Downloads\10264A-ENU-Allfiles.exe
2012-05-21 07:47 - 2012-05-21 07:47 - 05124162 ____A C:\Users\Admin\Downloads\10264A-ENU-Companion.zip
2012-05-21 07:47 - 2012-05-21 07:47 - 00000000 ____D C:\Users\Admin\Downloads\10264A-ENU-Companion
============ 3 Months Modified Files and Folders ===============
2012-06-19 08:09 - 2012-06-19 08:08 - 00000000 ____D C:\FRST
2012-06-18 16:03 - 2010-05-30 22:16 - 00000000 ____D C:\Users\Admin\AppData\Local\TSVNCache
2012-06-18 16:01 - 2010-01-20 23:01 - 01093662 ____A C:\Windows\System32\PerfStringBackup.INI
2012-06-18 15:59 - 2012-04-14 21:03 - 00960502 ____A C:\Windows\ntbtlog.txt
2012-06-18 15:59 - 2010-04-26 02:47 - 3203850240 __ASH C:\pagefile.sys
2012-06-18 15:59 - 2010-04-26 02:13 - 2402885632 __ASH C:\hiberfil.sys
2012-06-18 15:58 - 2010-04-26 01:52 - 01629854 ____A C:\Windows\WindowsUpdate.log
2012-06-18 15:48 - 2010-06-23 03:14 - 00000908 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-325877220-3748803948-952250591-1002UA.job
2012-06-18 15:42 - 2012-06-18 15:42 - 00875626 ____A C:\Users\Admin\Documents\FRST.exe
2012-06-18 15:26 - 2012-06-18 15:26 - 00001094 ____A C:\Users\Admin\Documents\SystemLook1.txt
2012-06-18 15:24 - 2012-06-18 13:34 - 00001092 ____A C:\Users\Admin\Documents\SystemLook.txt
2012-06-18 15:21 - 2010-09-18 19:33 - 00000884 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2012-06-18 13:33 - 2012-06-18 13:33 - 00139264 ____A C:\Users\Admin\Documents\SystemLook.exe
2012-06-18 13:33 - 2012-06-18 13:33 - 00000000 ____D C:\Program Files\ESET
2012-06-18 13:33 - 2009-07-13 20:52 - 00000000 ____D C:\Windows\Downloaded Program Files
2012-06-18 13:33 - 2009-07-13 18:37 - 00000000 ___RD C:\Program Files
2012-06-18 13:31 - 2009-07-13 20:34 - 00020944 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-06-18 13:31 - 2009-07-13 20:34 - 00020944 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-06-18 13:24 - 2010-01-20 23:14 - 00000000 ____D C:\Users\All Users\HPQLOG
2012-06-18 13:23 - 2012-06-18 13:23 - 00000081 ____A C:\Windows\System32\npd_log.txt
2012-06-18 13:23 - 2010-11-04 01:44 - 00000000 ____D C:\Users\All Users\VMware
2012-06-18 13:22 - 2010-09-18 19:33 - 00000880 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2012-06-18 13:22 - 2010-06-02 02:33 - 00035220 ____A C:\Windows\PFRO.log
2012-06-18 13:22 - 2009-07-13 20:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-06-18 13:22 - 2009-07-13 20:39 - 00093194 ____A C:\Windows\setupact.log
2012-06-18 13:21 - 2012-01-10 17:55 - 00000000 __SHD C:\Users\Admin\AppData\Local\{72b383ed-1c7a-f259-2e7e-d7c714e35be5}
2012-06-18 08:53 - 2010-05-27 00:23 - 00000000 ____D C:\users\Admin
2012-06-18 08:36 - 2010-01-20 23:32 - 00000000 __SHD C:\System Volume Information
2012-06-18 04:59 - 2012-06-18 04:59 - 00000000 ____D C:\Users\Admin\AppData\Roaming\hpqlog
2012-06-18 04:46 - 2012-06-18 04:34 - 00000000 __SHD C:\Config.Msi
2012-06-18 04:37 - 2011-01-26 18:42 - 00001945 ____A C:\Windows\epplauncher.mif
2012-06-18 04:36 - 2012-06-18 04:35 - 00000000 ____D C:\Program Files\Microsoft Security Client
2012-06-18 04:25 - 2012-06-18 04:23 - 66343968 ____A (Microsoft Corporation) C:\Users\Admin\Documents\mpam-fe.exe
2012-06-18 04:12 - 2012-06-18 04:12 - 10288512 ____A (Microsoft Corporation) C:\Users\Admin\Documents\mseinstall.exe
2012-06-18 03:58 - 2012-06-18 03:58 - 10288512 ____A (Microsoft Corporation) C:\Users\Admin\Downloads\mseinstall.exe
2012-06-18 03:49 - 2012-06-03 09:53 - 01108857 ____A C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix1.pdf
2012-06-18 03:46 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\System32\NDF
2012-06-18 02:28 - 2010-05-30 20:33 - 00000000 ____D C:\Users\Admin\AppData\Roaming\FileZilla
2012-06-18 01:49 - 2012-06-18 01:49 - 00000000 __SHD C:\Windows\System32\%APPDATA%
2012-06-17 20:11 - 2010-06-23 03:14 - 00000000 ____D C:\Users\Admin\AppData\Local\Deployment
2012-06-17 17:34 - 2010-05-30 22:35 - 00000000 ____D C:\Users\Admin\Tracing
2012-06-17 06:48 - 2010-06-23 03:14 - 00000856 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-325877220-3748803948-952250591-1002Core.job
2012-06-15 22:26 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\Microsoft.NET
2012-06-15 06:47 - 2009-07-13 20:33 - 00415608 ____A C:\Windows\System32\FNTCACHE.DAT
2012-06-15 06:42 - 2010-06-04 03:29 - 00000052 ____A C:\Windows\System32\DOErrors.log
2012-06-14 19:48 - 2012-06-14 19:48 - 00402665 ____A C:\Users\Admin\Documents\seafquotation.pdf
2012-06-14 19:48 - 2012-06-14 19:48 - 00380674 ____A C:\Users\Admin\Documents\seafprocedure.pdf
2012-06-14 19:43 - 2012-06-14 19:43 - 00401974 ____A C:\Users\Admin\Documents\airfquotation.pdf
2012-06-14 19:43 - 2012-06-14 19:43 - 00388972 ____A C:\Users\Admin\Documents\airfprocedure.pdf
2012-06-14 17:40 - 2010-01-20 23:21 - 00000000 ____D C:\Users\All Users\Microsoft Help
2012-06-14 17:31 - 2010-12-01 17:47 - 56731752 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-06-13 01:15 - 2012-05-31 22:10 - 00058178 ____A C:\Users\Admin\Documents\Prometric_Registration_Form.docx
2012-06-12 16:42 - 2010-01-20 23:14 - 00000000 ____D C:\Users\All Users\PDFC
2012-06-12 02:49 - 2010-05-30 21:45 - 00000000 ____D C:\Users\Admin\Documents\SQL Server Management Studio
2012-06-12 02:33 - 2010-05-30 22:38 - 00000000 ____D C:\Users\Admin\Documents\My Received Files
2012-06-12 00:07 - 2012-06-11 20:48 - 00000226 ____A C:\Users\Admin\Documents\gv_file.txt
2012-06-11 17:48 - 2010-06-23 03:16 - 00002402 ____A C:\Users\Admin\Desktop\Google Chrome.lnk
2012-06-11 16:53 - 2012-06-11 16:53 - 00143672 ____A C:\Windows\Minidump\061212-27612-01.dmp
2012-06-11 16:53 - 2010-12-20 22:21 - 318521784 ____A C:\Windows\MEMORY.DMP
2012-06-11 16:53 - 2010-12-20 22:21 - 00000000 ____D C:\Windows\Minidump
2012-06-11 16:53 - 2010-12-10 06:01 - 00000320 ____A C:\Windows\Tasks\HPCeeScheduleForAdmin.job
2012-06-11 16:53 - 2009-07-13 18:37 - 00000000 ____D C:\Windows
2012-06-11 04:19 - 2010-05-30 20:08 - 00000000 ____D C:\Users\Admin\Documents\Visual Studio 2008
2012-06-11 01:22 - 2012-06-11 01:22 - 00000000 ____D C:\Users\Default\AppData\Local\Google
2012-06-11 01:22 - 2012-06-11 01:22 - 00000000 ____D C:\Users\Default User\AppData\Local\Google
2012-06-10 23:57 - 2012-06-10 23:57 - 00023552 ____A C:\Users\Admin\Documents\oxicash_may.xls
2012-06-09 21:47 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\rescache
2012-06-06 19:40 - 2012-06-03 19:52 - 00000211 ____A C:\Users\Admin\Documents\poliv2_file.txt
2012-06-06 17:52 - 2012-06-06 17:52 - 00000000 ____D C:\Users\All Users\Mozilla
2012-06-06 17:52 - 2012-06-06 17:52 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2012-06-06 17:52 - 2012-04-14 23:48 - 00001088 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2012-06-06 17:52 - 2009-07-13 18:37 - 00000000 ____D C:\ProgramData
2012-06-06 17:51 - 2010-06-02 18:45 - 00000000 ____D C:\Program Files\Mozilla Firefox
2012-06-06 17:47 - 2012-06-06 17:46 - 16574016 ____A (Mozilla) C:\Users\Admin\Downloads\Firefox Setup 13.0.exe
2012-06-06 00:51 - 2012-05-14 20:19 - 00001030 ____A C:\Users\Admin\Documents\frienster_s2p_file.txt
2012-06-04 22:36 - 2009-07-13 18:04 - 00001370 ____A C:\Windows\System32\Drivers\etc\hosts
2012-06-03 18:46 - 2012-06-03 18:46 - 00250368 ____A C:\Users\Admin\Documents\alipay.doc
2012-06-03 00:07 - 2010-06-09 16:43 - 00000000 ____D C:\Users\Admin\AppData\Local\ElevatedDiagnostics
2012-06-02 14:19 - 2012-06-08 17:38 - 01933848 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-02 14:19 - 2012-06-08 17:38 - 00577048 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-02 14:19 - 2012-06-08 17:38 - 00053784 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-02 14:19 - 2012-06-08 17:38 - 00045080 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-02 14:19 - 2012-06-08 17:38 - 00035864 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-02 14:12 - 2012-06-08 17:38 - 02422272 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-02 14:12 - 2012-06-08 17:38 - 00088576 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-01 23:19 - 2012-06-08 17:38 - 00171904 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-01 23:12 - 2012-06-08 17:38 - 00033792 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-01 05:14 - 2012-06-01 05:14 - 00920745 ____A C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix.pdf
2012-05-31 22:49 - 2012-05-31 22:49 - 01041870 ____A C:\Users\Admin\Documents\Microsoft.Lead2pass.70-516.v2012-05-31.by.Johny.217q.vce
2012-05-30 20:01 - 2012-05-17 00:18 - 00000220 ____A C:\Users\Admin\Documents\rhb_file.txt
2012-05-30 00:41 - 2012-05-30 00:41 - 00000358 ____A C:\Users\Admin\Documents\bt.htm
2012-05-29 20:07 - 2012-05-29 19:54 - 00353047 ____A C:\Users\Admin\Documents\InstallCert.docx
2012-05-29 19:04 - 2012-05-29 19:04 - 00001800 ____A C:\Users\Admin\Documents\mol3.molsolutions.com.pfx.zip
2012-05-29 19:04 - 2012-05-29 19:04 - 00000000 ____D C:\Users\Admin\Documents\mol3.molsolutions.com.pfx
2012-05-28 20:38 - 2012-05-28 00:31 - 00536064 ____A C:\Users\Admin\Documents\Payment Integration Process Document.doc
2012-05-28 01:15 - 2012-05-28 01:02 - 00879616 ____A C:\Users\Admin\Documents\Copy (1) of Payment Flows.vsd
2012-05-28 00:42 - 2012-05-28 00:42 - 00916480 ____A C:\Users\Admin\Documents\Payment Flows.vsd
2012-05-27 22:54 - 2012-05-27 22:54 - 00362496 ____A C:\Users\Admin\Documents\RE Digicash Pricing.msg
2012-05-27 20:10 - 2010-05-30 18:31 - 00000000 ____D C:\Users\Admin\Documents\Visual Studio 2005
2012-05-27 18:33 - 2011-01-28 00:33 - 00000000 ____D C:\Users\Admin\AppData\Roaming\HP
2012-05-27 18:33 - 2011-01-28 00:33 - 00000000 ____D C:\Users\Admin\AppData\Local\HP
2012-05-27 09:33 - 2012-05-27 09:33 - 01100743 ____A C:\Users\Admin\Documents\metal.docx
2012-05-26 23:55 - 2012-05-26 23:54 - 00010873 ____A C:\Users\Admin\Documents\PaymentProcessFlow.docx
2012-05-26 09:28 - 2012-05-26 09:28 - 01865201 ____A C:\Users\Admin\Documents\Microsoft.TestKing.70-516.v2012-02-03.by.Lyudmyla.v190q.vce
2012-05-26 09:26 - 2012-05-26 09:26 - 01856837 ____A C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-03-16.by.Edom.195q.vce
2012-05-26 09:25 - 2012-05-26 09:25 - 01868219 ____A C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix.193q.vce
2012-05-25 19:11 - 2012-05-03 06:21 - 00000000 ____D C:\Users\Admin\Downloads\nopCommerce_2.50_Source
2012-05-23 15:44 - 2012-01-31 19:16 - 00000000 ____D C:\Users\Admin\Documents\m2u_statement
2012-05-21 08:23 - 2011-06-27 01:51 - 00000000 ____D C:\Users\Admin\Documents\Visual Studio 2010
2012-05-21 07:59 - 2012-05-21 07:57 - 59399232 ____A C:\Users\Admin\Documents\10264A-ENU-Allfiles.exe
2012-05-21 07:56 - 2011-08-11 01:46 - 00000000 ____D C:\Program Files\Microsoft Learning
2012-05-21 07:54 - 2012-05-21 07:54 - 08388608 ____A C:\Users\Admin\Downloads\10264A-ENU-Allfiles.exe
2012-05-21 07:47 - 2012-05-21 07:47 - 05124162 ____A C:\Users\Admin\Downloads\10264A-ENU-Companion.zip
2012-05-21 07:47 - 2012-05-21 07:47 - 00000000 ____D C:\Users\Admin\Downloads\10264A-ENU-Companion
2012-05-19 02:45 - 2010-06-02 01:31 - 00000000 ____D C:\Users\Admin\Desktop\ftpfile
2012-05-17 18:45 - 2012-05-17 18:45 - 00001243 ____A C:\Users\Admin\Documents\testrhb.htm
2012-05-17 15:11 - 2012-06-14 17:26 - 12314624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-05-17 14:48 - 2012-06-14 17:26 - 09737728 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-05-17 14:45 - 2012-06-14 17:26 - 01800192 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-05-17 14:36 - 2012-06-14 17:26 - 01103872 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-05-17 14:35 - 2012-06-14 17:26 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-05-17 14:35 - 2012-06-14 17:26 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-05-17 14:33 - 2012-06-14 17:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-05-17 14:31 - 2012-06-14 17:26 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-05-17 14:29 - 2012-06-14 17:26 - 00716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-05-17 14:29 - 2012-06-14 17:26 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-05-17 14:27 - 2012-06-14 17:26 - 01793024 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-05-17 14:25 - 2012-06-14 17:26 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-05-17 14:24 - 2012-06-14 17:26 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-05-17 14:20 - 2012-06-14 17:26 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-05-16 19:29 - 2012-05-16 19:29 - 00504125 ____A C:\Users\Admin\Documents\254291.pdf
2012-05-16 19:29 - 2012-05-16 19:29 - 00139013 ____A C:\Users\Admin\Documents\259141.pdf
2012-05-16 16:47 - 2010-12-31 05:07 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2012-05-16 05:46 - 2012-05-16 05:46 - 00000000 ____D C:\Users\Admin\Documents\Diablo III
2012-05-16 05:46 - 2012-05-16 04:48 - 00000000 ____D C:\Program Files\Diablo III
2012-05-16 05:45 - 2012-05-16 05:45 - 00000000 ____D C:\Users\All Users\ATI
2012-05-16 05:41 - 2012-05-16 05:41 - 00000000 ____D C:\Users\All Users\AMD
2012-05-16 05:41 - 2012-05-16 05:41 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies
2012-05-16 05:41 - 2012-05-16 05:41 - 00000000 ____D C:\Program Files\AMD AVT
2012-05-16 05:41 - 2012-05-16 05:41 - 00000000 ____D C:\Program Files\AMD APP
2012-05-16 05:40 - 2012-05-16 05:39 - 00000000 ____D C:\Program Files\ATI Technologies
2012-05-16 05:38 - 2012-05-16 05:38 - 00016561 ____A C:\Windows\System32\CCCInstall_201205162138499752.log
2012-05-16 05:37 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\System32\DriverStore
2012-05-16 05:33 - 2012-05-16 05:28 - 115013576 ____A (Advanced Micro Devices, Inc.) C:\Users\Admin\Documents\12-4_mobility_vista_win7_32_dd_ccc.exe
2012-05-16 05:33 - 2012-05-16 05:28 - 00000000 ____D C:\AMD
2012-05-16 05:17 - 2012-05-16 04:48 - 00001147 ____A C:\Users\Public\Desktop\Diablo III.lnk
2012-05-16 05:16 - 2012-05-16 04:48 - 00000000 ____D C:\Users\All Users\Blizzard Entertainment
2012-05-16 05:16 - 2012-05-16 04:48 - 00000000 ____D C:\Program Files\Common Files\Blizzard Entertainment
2012-05-16 04:46 - 2012-05-16 04:46 - 00000000 ____D C:\Users\All Users\Battle.net
2012-05-15 00:56 - 2012-05-15 00:56 - 00000551 ____A C:\Users\Admin\Documents\test_rhb.zip
2012-05-15 00:55 - 2012-05-15 00:55 - 00001181 ____A C:\Users\Admin\Documents\test_rhb.html
2012-05-14 17:12 - 2012-06-13 18:15 - 02342400 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-05-13 23:02 - 2012-05-02 19:59 - 00000478 ____A C:\Users\Admin\Documents\molpay_file.txt
2012-05-13 17:33 - 2009-07-13 20:53 - 00032606 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-05-12 09:41 - 2012-05-11 19:52 - 00419488 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2012-05-12 09:41 - 2011-11-25 07:21 - 00070304 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2012-05-12 09:35 - 2012-05-12 09:35 - 00795360 ____A (Solid State Networks) C:\Users\Admin\Downloads\install_flashplayer11x32ax_gtbd_aih.exe
2012-05-11 21:58 - 2009-07-27 05:49 - 00000000 ____D C:\Program Files\Windows Journal
2012-05-09 23:16 - 2012-05-07 02:49 - 00000161 ____A C:\Users\Admin\Documents\molpointscard.txt
2012-05-09 02:07 - 2012-05-09 01:13 - 00075776 ____A C:\Users\Admin\Documents\mps_diagram.vsd
2012-05-09 02:05 - 2012-05-02 02:10 - 00626062 ____A C:\Users\Admin\Documents\mps_thai.docx
2012-05-09 01:48 - 2012-05-09 01:48 - 05221692 ____A C:\Users\Admin\Documents\MOLPoints Pins - Testing.xlsx
2012-05-07 05:23 - 2012-05-07 05:23 - 00017982 ____A C:\Users\Admin\Desktop\hs_err_pid4600.log
2012-05-07 02:21 - 2012-05-07 02:21 - 00001151 ____A C:\Users\Public\Desktop\Mobile VPN with SSL client.lnk
2012-05-07 02:21 - 2012-05-07 02:21 - 00000000 ____D C:\Users\Admin\AppData\Roaming\WatchGuard
2012-05-07 02:21 - 2012-05-07 02:21 - 00000000 ____D C:\Program Files\WatchGuard
2012-05-03 19:52 - 2012-05-03 19:52 - 00000000 ____D C:\Windows\System32\aliedit
2012-05-03 18:36 - 2012-05-03 18:36 - 00017900 ____A C:\Users\Admin\Desktop\hs_err_pid9620.log
2012-05-03 06:18 - 2012-05-03 06:18 - 30169063 ____A C:\Users\Admin\Downloads\nopCommerce_2.50_Source.rar
2012-05-02 20:11 - 2012-04-29 17:49 - 00000000 ____D C:\Users\All Users\Adobe
2012-05-02 06:36 - 2012-05-01 05:39 - 02537644 ____A C:\Users\Admin\Documents\favor.docx
2012-05-02 02:10 - 2012-05-02 02:07 - 00000000 ____D C:\Users\Admin\Documents\Mlogin User Manual 20090317
2012-05-01 22:24 - 2010-06-02 03:18 - 00000000 ____D C:\Users\Admin\AppData\Local\Google
2012-05-01 22:23 - 2010-06-02 03:18 - 00000000 ____D C:\Program Files\Google
2012-05-01 20:52 - 2012-06-13 18:15 - 00163328 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2012-05-01 18:04 - 2012-05-01 18:04 - 00038430 ____A C:\Users\Admin\AppData\Roaming\Comma Separated Values (Windows).ADR
2012-05-01 18:04 - 2012-05-01 18:04 - 00008114 ____A C:\Users\Admin\Documents\contact.CSV
2012-04-29 23:13 - 2012-04-29 23:13 - 00005670 ____A C:\Users\Admin\Documents\molpay_requery.txt
2012-04-29 17:51 - 2011-12-02 18:13 - 00000000 ____D C:\Program Files\Common Files\Adobe
2012-04-29 09:48 - 2012-04-29 09:48 - 00000129 ____A C:\Users\Admin\Documents\favor.txt
2012-04-28 22:51 - 2012-04-28 22:51 - 00000000 ____D C:\Users\Admin\Documents\Little_Hooty_Owls.abr
2012-04-28 22:50 - 2012-04-28 22:50 - 00375719 ____A C:\Users\Admin\Documents\Little_Hooty_Owls.abr.zip
2012-04-28 22:49 - 2012-04-28 22:50 - 00375719 ____A C:\Users\Admin\Downloads\Little_Hooty_Owls.abr.zip
2012-04-27 19:19 - 2012-06-13 18:15 - 00177152 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-04-26 01:40 - 2012-04-26 01:39 - 00000040 ____A C:\Users\Admin\Documents\smart2payFS.txt
2012-04-25 20:48 - 2012-06-13 18:15 - 00129536 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-04-25 20:48 - 2012-06-13 18:15 - 00057856 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-04-25 20:43 - 2012-06-13 18:15 - 00008192 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-04-25 02:49 - 2012-04-25 02:49 - 00003082 ____A C:\Users\Admin\Documents\xmlsample.txt
2012-04-25 01:39 - 2012-04-25 01:39 - 00147579 ____A C:\Users\Admin\Documents\radiobutton.jpg
2012-04-24 23:22 - 2012-04-24 23:22 - 00119808 ____A C:\Users\Admin\Documents\FW Compliance Qs- pls respond by 1014.msg
2012-04-24 23:16 - 2012-04-24 23:16 - 00115712 ____A C:\Users\Admin\Documents\RE GB MY Paused.msg
2012-04-24 19:59 - 2012-04-24 19:59 - 00082432 ____A C:\Users\Admin\Documents\Re Kapi Hospital Payment Error - Card Details.msg
2012-04-24 19:36 - 2012-04-24 19:36 - 00000885 ____A C:\Users\Admin\Documents\test.html
2012-04-24 06:52 - 2011-04-21 03:31 - 00006134 ____A C:\Windows\IE9_main.log
2012-04-24 06:49 - 2012-04-24 06:49 - 03695416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2012-04-24 06:49 - 2012-04-24 06:49 - 00580608 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00434176 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00367104 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2012-04-24 06:49 - 2012-04-24 06:49 - 00353792 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00353584 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00227840 ____A (Microsoft Corporation) C:\Windows\System32\ieaksie.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00223232 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00203776 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00163840 ____A (Microsoft Corporation) C:\Windows\System32\ieakui.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00162304 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00161792 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00152064 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2012-04-24 06:49 - 2012-04-24 06:49 - 00150528 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2012-04-24 06:49 - 2012-04-24 06:49 - 00130560 ____A (Microsoft Corporation) C:\Windows\System32\ieakeng.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00123392 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00118784 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00110592 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00101888 ____A (Microsoft Corporation) C:\Windows\System32\admparse.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00086528 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00078848 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00076800 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2012-04-24 06:49 - 2012-04-24 06:49 - 00074752 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2012-04-24 06:49 - 2012-04-24 06:49 - 00074752 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00074240 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2012-04-24 06:49 - 2012-04-24 06:49 - 00072822 ____A C:\Windows\System32\ieuinit.inf
2012-04-24 06:49 - 2012-04-24 06:49 - 00066048 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00063488 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2012-04-24 06:49 - 2012-04-24 06:49 - 00054272 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00041472 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00035840 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00031744 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00023552 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2012-04-24 06:49 - 2012-04-24 06:49 - 00011776 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2012-04-24 06:49 - 2012-04-24 06:49 - 00010752 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2012-04-24 06:44 - 2012-04-24 06:44 - 00481584 ____A (Microsoft Corporation) C:\Users\Admin\Documents\IE9-Windows7-x86-enu.exe
2012-04-24 05:02 - 2012-04-24 05:02 - 00000038 ____A C:\Users\Admin\Documents\notok.txt
2012-04-24 04:20 - 2012-04-24 04:20 - 00000077 ____A C:\Users\Admin\Documents\faqissue.txt
2012-04-23 20:47 - 2012-06-13 18:14 - 01156608 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-04-23 20:47 - 2012-06-13 18:14 - 00139264 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-04-23 20:47 - 2012-06-13 18:14 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-04-23 19:29 - 2012-04-23 19:29 - 00035304 ____A C:\Users\Admin\Documents\fpx.jpg
2012-04-22 23:31 - 2012-04-22 23:31 - 00024064 ____A C:\Users\Admin\Documents\wheretobuylink.xls
2012-04-20 03:18 - 2012-04-08 18:39 - 00001544 ____A C:\Users\Admin\Documents\frendsterfilechg.txt
2012-04-19 23:19 - 2012-04-17 19:56 - 00011402 ____A C:\Users\Admin\Documents\faq_friendster.xlsx
2012-04-19 23:17 - 2012-04-19 23:17 - 00009291 ____A C:\Users\Admin\Documents\wheretobuylink.xlsx
2012-04-19 23:16 - 2012-04-16 23:58 - 00013664 ____A C:\Users\Admin\Documents\listofpayment.xlsx
2012-04-19 03:55 - 2012-04-19 03:55 - 00090107 ____A C:\Users\Admin\Documents\htmllistchannel.txt
2012-04-14 23:48 - 2012-04-14 23:23 - 00004130 ____A C:\Users\Admin\Desktop\unhide.txt
2012-04-14 23:20 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\Cursors
2012-04-14 21:16 - 2012-04-14 21:16 - 00399264 ____A (Bleeping Computer, LLC) C:\Users\Admin\Desktop\unhide.exe
2012-04-14 21:11 - 2012-04-14 21:11 - 00000361 ____A C:\rkill.log
2012-04-14 21:09 - 2012-04-14 21:09 - 01008141 ____A C:\Users\Admin\Desktop\rkill.com
2012-04-14 21:03 - 2012-01-01 06:46 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2012-04-14 21:02 - 2012-04-14 21:02 - 00001067 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-04-14 20:55 - 2012-04-14 20:34 - 00000168 ____A C:\Users\All Users\-FZ0g9DtPRuLMbnr
2012-04-14 20:55 - 2012-04-14 20:34 - 00000000 ____A C:\Users\All Users\-FZ0g9DtPRuLMbn
2012-04-14 20:54 - 2012-04-14 20:34 - 00000256 ____A C:\Users\All Users\FZ0g9DtPRuLMbn
2012-04-14 20:34 - 2012-04-14 20:34 - 00000647 ____A C:\Users\Admin\Desktop\SMART_HDD.lnk
2012-04-12 02:35 - 2012-04-12 02:34 - 01592760 ____A (WatchGuard ) C:\Users\Admin\Documents\WG-MVPN-SSL.exe
2012-04-12 00:40 - 2012-04-12 00:40 - 00002387 ____A C:\Users\Admin\Documents\PaySafeCard.rar
2012-04-12 00:40 - 2012-04-12 00:40 - 00000000 ____D C:\Users\Admin\Documents\PaySafeCard
2012-04-09 05:59 - 2012-04-09 05:59 - 00065980 ____A C:\Users\Admin\Documents\BE2011_submit_810515145984.pdf
2012-04-09 05:58 - 2012-04-09 05:58 - 00020505 ____A C:\Users\Admin\Documents\slip_810515145984.pdf
2012-04-09 05:30 - 2012-04-09 05:30 - 00052166 ____A C:\Users\Admin\Documents\1005681011-20120409212508.pdf
2012-04-09 05:30 - 2012-04-09 05:30 - 00052105 ____A C:\Users\Admin\Documents\0095575062-20120409212640.pdf
2012-04-09 05:30 - 2012-04-09 05:30 - 00052060 ____A C:\Users\Admin\Documents\0095575046-20120409212816.pdf
2012-04-07 03:34 - 2012-06-13 18:15 - 02342400 ____A (Microsoft Corporation) C:\Windows\System32\msi.dll
2012-04-06 05:33 - 2012-04-06 05:32 - 00000088 ____A C:\Users\Admin\Documents\open.htm
2012-04-06 05:32 - 2012-04-06 05:32 - 00000074 ____A C:\Users\Admin\Documents\open.txt
2012-04-06 02:58 - 2012-04-06 02:58 - 00000261 ____A C:\Users\Admin\Documents\errormsg.txt
2012-04-06 00:08 - 2012-04-06 00:08 - 00001600 ____A C:\Users\Admin\Documents\friendstersorting.txt
2012-04-05 21:21 - 2012-04-05 21:21 - 09334784 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\Drivers\atikmdag.sys
2012-04-05 18:23 - 2012-04-05 18:23 - 00245896 ____A C:\Windows\System32\atiapfxx.blb
2012-04-05 18:22 - 2012-04-05 18:22 - 00159744 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\atiapfxx.exe
2012-04-05 18:21 - 2012-04-05 18:21 - 00909312 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\aticfx32.dll
2012-04-05 18:16 - 2012-04-05 18:16 - 00451072 ____A (AMD) C:\Windows\System32\atieclxx.exe
2012-04-05 18:16 - 2012-04-05 18:16 - 00442368 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\ATIDEMGX.dll
2012-04-05 18:15 - 2012-04-05 18:15 - 00217600 ____A (AMD) C:\Windows\System32\atiesrxx.exe
2012-04-05 18:14 - 2012-04-05 18:14 - 00159744 ____A (AMD) C:\Windows\System32\atitmmxx.dll
2012-04-05 18:14 - 2012-04-05 18:14 - 00043520 ____A (ATI Technologies, Inc.) C:\Windows\System32\ati2edxx.dll
2012-04-05 18:14 - 2012-04-05 18:14 - 00020992 ____A (AMD) C:\Windows\System32\atimuixx.dll
2012-04-05 18:13 - 2009-12-08 10:02 - 06800896 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atidxx32.dll
2012-04-05 18:00 - 2012-04-05 18:00 - 00052736 ____A (AMD) C:\Windows\System32\coinst.dll
2012-04-05 17:50 - 2012-04-05 17:50 - 19753984 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\atioglxx.dll
2012-04-05 17:34 - 2012-04-05 17:34 - 01831424 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiumdmv.dll
2012-04-05 17:34 - 2009-12-08 09:46 - 06203392 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiumdag.dll
2012-04-05 17:30 - 2012-04-05 17:30 - 00046080 ____A (Advanced Micro Devices Inc.) C:\Windows\System32\aticalrt.dll
2012-04-05 17:30 - 2012-04-05 17:30 - 00044032 ____A (Advanced Micro Devices Inc.) C:\Windows\System32\aticalcl.dll
2012-04-05 17:25 - 2012-04-05 17:25 - 13764096 ____A (Advanced Micro Devices Inc.) C:\Windows\System32\aticaldd.dll
2012-04-05 17:22 - 2009-12-08 09:28 - 04795904 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiumdva.dll
2012-04-05 17:21 - 2012-04-05 17:21 - 02664704 ____A C:\Windows\System32\atiumdva.cap
2012-04-05 17:21 - 2012-04-05 17:21 - 00204952 ____A C:\Windows\System32\ativvsvl.dat
2012-04-05 17:21 - 2012-04-05 17:21 - 00157144 ____A C:\Windows\System32\ativvsva.dat
2012-04-05 17:11 - 2012-04-05 17:11 - 00360448 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\atiadlxx.dll
2012-04-05 17:11 - 2012-04-05 17:11 - 00014848 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiglpxx.dll
2012-04-05 17:10 - 2012-04-05 17:10 - 00275968 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\Drivers\atikmpag.sys
2012-04-05 17:10 - 2012-04-05 17:10 - 00033280 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atigktxx.dll
2012-04-05 17:09 - 2012-04-05 17:09 - 00053248 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\Drivers\ati2erec.dll
2012-04-05 17:09 - 2012-04-05 17:09 - 00041984 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiuxpag.dll
2012-04-05 17:09 - 2012-04-05 17:09 - 00032256 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiu9pag.dll
2012-04-05 17:06 - 2012-04-05 17:06 - 00053760 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atimpc32.dll
2012-04-05 17:06 - 2012-04-05 17:06 - 00053760 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\amdpcom32.dll
2012-04-05 06:34 - 2012-04-05 06:34 - 00159232 ____A C:\Windows\System32\clinfo.exe
2012-04-05 06:34 - 2012-04-05 06:34 - 00064512 ____A (Advanced Micro Devices Inc.) C:\Windows\System32\OpenVideo.dll
2012-04-05 06:33 - 2012-04-05 06:33 - 00056320 ____A (Advanced Micro Devices Inc.) C:\Windows\System32\OVDecode.dll
2012-04-05 06:32 - 2012-04-05 06:32 - 13007872 ____A (Advanced Micro Devices Inc.) C:\Windows\System32\amdocl.dll
2012-04-05 06:32 - 2012-04-05 06:32 - 00050176 ____A (Khronos Group) C:\Windows\System32\OpenCL.dll
2012-04-05 05:26 - 2012-04-05 03:22 - 00000688 ____A C:\Users\Admin\Documents\stringparam.txt
2012-04-04 17:44 - 2009-07-13 18:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2012-04-04 17:42 - 2009-07-13 18:04 - 00000478 ____A C:\Windows\win.ini
2012-04-03 23:56 - 2012-01-01 06:46 - 00022344 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-04-01 20:46 - 2012-05-08 17:54 - 03958128 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2012-04-01 20:46 - 2012-05-08 17:54 - 03902320 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-03-30 02:29 - 2012-05-08 17:54 - 01287024 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
ZeroAccess:
C:\Windows\Installer\{72b383ed-1c7a-f259-2e7e-d7c714e35be5}
C:\Windows\Installer\{72b383ed-1c7a-f259-2e7e-d7c714e35be5}\@
C:\Windows\Installer\{72b383ed-1c7a-f259-2e7e-d7c714e35be5}\L
C:\Windows\Installer\{72b383ed-1c7a-f259-2e7e-d7c714e35be5}\U
C:\Windows\Installer\{72b383ed-1c7a-f259-2e7e-d7c714e35be5}\U\00000001.@
C:\Windows\Installer\{72b383ed-1c7a-f259-2e7e-d7c714e35be5}\U\80000000.@
C:\Windows\Installer\{72b383ed-1c7a-f259-2e7e-d7c714e35be5}\U\800000cb.@
ZeroAccess:
C:\Users\Admin\AppData\Local\{72b383ed-1c7a-f259-2e7e-d7c714e35be5}
C:\Users\Admin\AppData\Local\{72b383ed-1c7a-f259-2e7e-d7c714e35be5}\@
C:\Users\Admin\AppData\Local\{72b383ed-1c7a-f259-2e7e-d7c714e35be5}\L
C:\Users\Admin\AppData\Local\{72b383ed-1c7a-f259-2e7e-d7c714e35be5}\U
========================= Known DLLs (Whitelisted) ============

========================= Bamital & volsnap Check ============
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe A302BBFF2A7278C0E239EE5D471D86A9 ZeroAccess <==== ATTENTION!.
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
========================= Memory info ======================
Percentage of memory in use: 14%
Total physical RAM: 3951.43 MB
Available physical RAM: 3370.39 MB
Total Pagefile: 3949.71 MB
Available Pagefile: 3373.88 MB
Total Virtual: 2047.88 MB
Available Virtual: 1960.74 MB
======================= Partitions =========================
1 Drive c: () (Fixed) (Total:280.8 GB) (Free:145.5 GB) NTFS ==>[System with boot components (obtained from reading drive)]
2 Drive e: (HP_RECOVERY) (Fixed) (Total:15 GB) (Free:7.43 GB) NTFS
3 Drive f: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.48 GB) FAT32
5 Drive h: () (Removable) (Total:14.97 GB) (Free:14.97 GB) FAT32
6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
7 Drive y: (SYSTEM) (Fixed) (Total:0.29 GB) (Free:0.25 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 298 GB 0 B
Disk 1 Online 14 GB 0 B
Partitions of Disk 0:
===============
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 300 MB 1024 KB
Partition 2 Primary 280 GB 301 MB
Partition 3 Primary 15 GB 281 GB
Partition 4 Primary 2043 MB 296 GB
======================================================================================================
Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y SYSTEM NTFS Partition 300 MB Healthy
======================================================================================================
Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 280 GB Healthy
======================================================================================================
Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 E HP_RECOVERY NTFS Partition 15 GB Healthy
======================================================================================================
Disk: 0
Partition 4
Type : 0C
Hidden: No
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 F HP_TOOLS FAT32 Partition 2043 MB Healthy
======================================================================================================
Partitions of Disk 1:
===============
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 14 GB 6144 KB
======================================================================================================
Disk: 1
Partition 1
Type : 0C
Hidden: No
Active: Yes
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 H FAT32 Removable 14 GB Healthy
======================================================================================================
==========================================================
Last Boot: 2012-06-09 21:32
======================= End Of Log ==========================

 

[happycan]

Here's the service.exe log

Farbar Recovery Scan Tool Version: 18-06-2012 02
Ran by SYSTEM at 2012-06-19 08:11:00
Running from H:\
================== Search: "services.exe" ===================
C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe
[2009-07-13 15:11] - [2009-07-13 17:14] - 0259072 ____A (Microsoft Corporation) 5F1B6A9C35D3D5CA72D6D6FDEF9747D6
C:\Windows\System32\services.exe
[2009-07-13 15:11] - [2009-07-13 17:14] - 0259072 ____A (Microsoft Corporation) A302BBFF2A7278C0E239EE5D471D86A9
=== End Of Search ===

 

[happycan]

I'm using the MSE and I had temporarily disabled the service of Microsoft Antimalware Service during startup.
Appreciate your help. Thanks

 

[Broni]

Download attached fixlist.txt file and save it to the very same USB flash drive you've been using. Plug the drive back in.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.
On Windows XP: Now please boot into the UBCD.
Run FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

 

[happycan]

Here's the fixlog.txt

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 18-06-2012 02
Ran by SYSTEM at 2012-06-19 12:37:07 Run:1
Running from H:\
==============================================
HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\SubSystems\\Windows Value was restored successfully .
C:\Windows\System32\consrv.dll not found.
C:\Windows\Installer\{72b383ed-1c7a-f259-2e7e-d7c714e35be5} moved successfully.
C:\Users\Admin\AppData\Local\{72b383ed-1c7a-f259-2e7e-d7c714e35be5} moved successfully.
C:\Windows\System32\services.exe moved successfully.
C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe copied successfully to C:\Windows\System32\services.exe
==== End of Fixlog ====

 

[Broni]

See if you can reboot normally.

If so....

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Never rename Combofix unless instructed.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
• Close any open browsers.
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
• Double click on combofix.exe & follow the prompts.

• 
  NOTE1. If Combofix asks you to install Recovery Console, please allow it.
  NOTE 2. If Combofix asks you to update the program, always do so.

• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click Rkill and choose Run as Administrator
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.exe

• Double-click on the Rkill icon to run the tool.
• If using Vista or Windows 7 right-click on it and choose Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• If not, delete the file, then download and use the one provided in Link 2.
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
• Do not reboot until instructed.
• If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

 

[happycan]

Here you go..

ComboFix 12-06-16.02 - Admin 06/19/2012 12:54:02.1.4 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3055.1682 [GMT 8:00]
Running from: c:\users\Admin\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpoFeedb.dll
c:\programdata\Microsoft\corecon\1.0\1033\NonSDKAddonLangVer.dll
c:\programdata\Microsoft\corecon\1.0\1033\SDKAddonLangVer.dll
c:\programdata\Microsoft\corecon\1.0\addons\NonSDKAddonVer.dll
c:\programdata\Microsoft\corecon\1.0\addons\SDKAddonVer.dll
c:\programdata\Microsoft\corecon\1.0\SDKFilesVer.dll
c:\windows\system32\JRSKD24.SYS
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_JRSKD24
-------\Service_JRSKD24
.
.
((((((((((((((((((((((((( Files Created from 2012-05-19 to 2012-06-19 )))))))))))))))))))))))))))))))
.
.
2012-06-19 16:08 . 2012-06-19 16:10 -------- d-----w- C:\FRST
2012-06-19 04:50 . 2012-06-19 05:18 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B3C43066-7052-4CC9-974C-B55D7FC52195}\offreg.dll
2012-06-19 04:40 . 2012-06-19 04:40 -------- d-----w- c:\programdata\AVG Secure Search
2012-06-19 04:30 . 2012-06-19 04:30 -------- d-----w- c:\users\Admin\AppData\Roaming\AVG2012
2012-06-19 01:45 . 2012-06-19 01:45 -------- d-----w- c:\users\Admin\AppData\Local\AVG Secure Search
2012-06-19 01:45 . 2012-06-19 04:33 -------- d-----w- c:\program files\Common Files\AVG Secure Search
2012-06-19 01:44 . 2012-06-19 01:44 -------- d--h--w- c:\programdata\Common Files
2012-06-19 01:44 . 2012-06-19 01:44 -------- d-----w- C:\$AVG
2012-06-19 01:44 . 2012-06-19 04:27 -------- d-----w- c:\windows\system32\drivers\AVG
2012-06-18 21:33 . 2012-06-18 21:33 -------- d-----w- c:\program files\ESET
2012-06-18 16:36 . 2012-05-14 17:43 6737808 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B3C43066-7052-4CC9-974C-B55D7FC52195}\mpengine.dll
2012-06-18 16:35 . 2012-05-14 17:43 6737808 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-06-18 12:59 . 2012-06-18 12:59 -------- d-----w- c:\users\Admin\AppData\Roaming\hpqlog
2012-06-18 12:41 . 2012-02-09 06:17 713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CE26C334-181F-48D7-A58A-5C02023CD32E}\gapaengine.dll
2012-06-18 12:35 . 2012-06-18 12:36 -------- d-----w- c:\program files\Microsoft Security Client
2012-06-18 09:49 . 2012-06-18 09:49 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-06-14 02:15 . 2012-04-28 03:19 177152 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-06-14 02:15 . 2012-04-26 04:48 57856 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-14 02:15 . 2012-04-26 04:48 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-06-14 02:15 . 2012-04-26 04:43 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-06-14 02:15 . 2012-05-02 04:52 163328 ----a-w- c:\windows\system32\profsvc.dll
2012-06-14 02:15 . 2012-04-07 11:34 2342400 ----a-w- c:\windows\system32\msi.dll
2012-06-14 02:15 . 2012-05-15 01:12 2342400 ----a-w- c:\windows\system32\win32k.sys
2012-06-14 02:14 . 2012-04-24 04:47 139264 ----a-w- c:\windows\system32\cryptsvc.dll
2012-06-14 02:14 . 2012-04-24 04:47 1156608 ----a-w- c:\windows\system32\crypt32.dll
2012-06-14 02:14 . 2012-04-24 04:47 103936 ----a-w- c:\windows\system32\cryptnet.dll
2012-06-11 09:22 . 2012-06-11 09:22 -------- d-----w- c:\users\Default\AppData\Local\Google
2012-06-09 01:38 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-09 01:38 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-09 01:38 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-06-09 01:38 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-09 01:38 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-09 01:38 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-09 01:38 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-06-09 01:38 . 2012-06-02 07:19 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-09 01:38 . 2012-06-02 07:12 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-06-07 01:52 . 2012-06-07 01:52 -------- d-----w- c:\program files\Mozilla Maintenance Service
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-12 17:41 . 2012-05-12 03:52 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-12 17:41 . 2011-11-25 15:21 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-24 14:49 . 2012-04-24 14:49 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-04-24 14:49 . 2012-04-24 14:49 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-04-24 14:49 . 2012-04-24 14:49 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-04-24 14:49 . 2012-04-24 14:49 161792 ----a-w- c:\windows\system32\msls31.dll
2012-04-24 14:49 . 2012-04-24 14:49 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-04-24 14:49 . 2012-04-24 14:49 86528 ----a-w- c:\windows\system32\iesysprep.dll
2012-04-24 14:49 . 2012-04-24 14:49 74752 ----a-w- c:\windows\system32\iesetup.dll
2012-04-24 14:49 . 2012-04-24 14:49 63488 ----a-w- c:\windows\system32\tdc.ocx
2012-04-24 14:49 . 2012-04-24 14:49 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-04-24 14:49 . 2012-04-24 14:49 367104 ----a-w- c:\windows\system32\html.iec
2012-04-24 14:49 . 2012-04-24 14:49 35840 ----a-w- c:\windows\system32\imgutil.dll
2012-04-24 14:49 . 2012-04-24 14:49 23552 ----a-w- c:\windows\system32\licmgr10.dll
2012-04-24 14:49 . 2012-04-24 14:49 152064 ----a-w- c:\windows\system32\wextract.exe
2012-04-24 14:49 . 2012-04-24 14:49 150528 ----a-w- c:\windows\system32\iexpress.exe
2012-04-24 14:49 . 2012-04-24 14:49 11776 ----a-w- c:\windows\system32\mshta.exe
2012-04-24 14:49 . 2012-04-24 14:49 101888 ----a-w- c:\windows\system32\admparse.dll
2012-04-06 05:21 . 2012-04-06 05:21 9334784 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2012-04-06 02:22 . 2012-04-06 02:22 159744 ----a-w- c:\windows\system32\atiapfxx.exe
2012-04-06 02:21 . 2012-04-06 02:21 909312 ----a-w- c:\windows\system32\aticfx32.dll
2012-04-06 02:16 . 2012-04-06 02:16 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll
2012-04-06 02:16 . 2012-04-06 02:16 451072 ----a-w- c:\windows\system32\atieclxx.exe
2012-04-06 02:15 . 2012-04-06 02:15 217600 ----a-w- c:\windows\system32\atiesrxx.exe
2012-04-06 02:14 . 2012-04-06 02:14 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2012-04-06 02:14 . 2012-04-06 02:14 20992 ----a-w- c:\windows\system32\atimuixx.dll
2012-04-06 02:14 . 2012-04-06 02:14 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2012-04-06 02:13 . 2009-12-08 18:02 6800896 ----a-w- c:\windows\system32\atidxx32.dll
2012-04-06 02:00 . 2012-04-06 02:00 52736 ----a-w- c:\windows\system32\coinst.dll
2012-04-06 01:50 . 2012-04-06 01:50 19753984 ----a-w- c:\windows\system32\atioglxx.dll
2012-04-06 01:34 . 2012-04-06 01:34 1831424 ----a-w- c:\windows\system32\atiumdmv.dll
2012-04-06 01:34 . 2009-12-08 17:46 6203392 ----a-w- c:\windows\system32\atiumdag.dll
2012-04-06 01:30 . 2012-04-06 01:30 46080 ----a-w- c:\windows\system32\aticalrt.dll
2012-04-06 01:30 . 2012-04-06 01:30 44032 ----a-w- c:\windows\system32\aticalcl.dll
2012-04-06 01:25 . 2012-04-06 01:25 13764096 ----a-w- c:\windows\system32\aticaldd.dll
2012-04-06 01:22 . 2009-12-08 17:28 4795904 ----a-w- c:\windows\system32\atiumdva.dll
2012-04-06 01:11 . 2012-04-06 01:11 360448 ----a-w- c:\windows\system32\atiadlxx.dll
2012-04-06 01:11 . 2012-04-06 01:11 14848 ----a-w- c:\windows\system32\atiglpxx.dll
2012-04-06 01:10 . 2012-04-06 01:10 33280 ----a-w- c:\windows\system32\atigktxx.dll
2012-04-06 01:10 . 2012-04-06 01:10 275968 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2012-04-06 01:09 . 2012-04-06 01:09 41984 ----a-w- c:\windows\system32\atiuxpag.dll
2012-04-06 01:09 . 2012-04-06 01:09 32256 ----a-w- c:\windows\system32\atiu9pag.dll
2012-04-06 01:09 . 2012-04-06 01:09 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2012-04-06 01:06 . 2012-04-06 01:06 53760 ----a-w- c:\windows\system32\atimpc32.dll
2012-04-06 01:06 . 2012-04-06 01:06 53760 ----a-w- c:\windows\system32\amdpcom32.dll
2012-04-05 14:34 . 2012-04-05 14:34 159232 ----a-w- c:\windows\system32\clinfo.exe
2012-04-05 14:34 . 2012-04-05 14:34 64512 ----a-w- c:\windows\system32\OpenVideo.dll
2012-04-05 14:33 . 2012-04-05 14:33 56320 ----a-w- c:\windows\system32\OVDecode.dll
2012-04-05 14:32 . 2012-04-05 14:32 13007872 ----a-w- c:\windows\system32\amdocl.dll
2012-04-05 14:32 . 2012-04-05 14:32 50176 ----a-w- c:\windows\system32\OpenCL.dll
2012-04-04 07:56 . 2012-01-01 14:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-02 04:46 . 2012-05-09 01:54 3902320 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-04-02 04:46 . 2012-05-09 01:54 3958128 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-30 10:29 . 2012-05-09 01:54 1287024 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-06-01 15:40 . 2012-06-07 01:51 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.

 

[happycan]

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2009-06-05 10:01 85712 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2009-06-05 10:01 85712 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2009-06-05 10:01 85712 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2009-06-05 10:01 85712 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2009-06-05 10:01 85712 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2009-06-05 10:01 85712 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2009-06-05 10:01 85712 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2009-06-05 10:01 85712 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2009-06-05 10:01 85712 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPADVISOR"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-09-29 1685048]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"QLBController"="c:\program files\Hewlett-Packard\HP HotKey Support\QLBController.exe" [2010-01-05 254520]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-25 186904]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2009-10-23 563736]
"HPPowerAssistant"="c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe" [2009-12-16 1690680]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-01-04 1594664]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2009-12-16 8192]
"File Sanitizer"="c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2009-12-12 11265536]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-12-03 495711]
"DTRun"="c:\program files\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe" [2009-11-19 518656]
"NortonOnlineBackupReminder"="c:\program files\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-06-29 600936]
"VMware hqtray"="c:\program files\VMware\VMware Player\hqtray.exe" [2010-09-20 64048]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2010-11-23 274608]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-26 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-04-05 641664]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-9-5 795936]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2009-11-17 22:39 75320 ----a-w- c:\windows\System32\DeviceNP.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ DPPassFilter scecli
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 SWIPsec;SonicWALL IPsec Driver;c:\windows\system32\Drivers\SWIPsec.sys [2009-03-05 87064]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-09-19 136176]
R2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2009-12-14 1639728]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-07-07 195336]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-09-17 29472]
R3 DAMDrv;DAMDrv;c:\windows\system32\DRIVERS\DAMDrv.sys [2009-10-21 32312]
R3 FLCDLOCK;HP ProtectTools Device Locking / Auditing;c:\windows\system32\flcdlock.exe [2009-11-17 362040]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-09-19 136176]
R3 kcrtx86;kcrtx86;c:\windows\system32\kcrtx86.sys [2011-09-02 126048]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 22344]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-01 113120]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 74112]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 214952]
R3 NPIDS;NPIDS;c:\windows\system32\NpIdsVt.sys [2010-05-13 47712]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-11-11 181792]
R3 scsk5;SCSK5 Driver Service;c:\windows\system32\drivers\scsk5.sys [2011-10-05 55864]
R3 SWVNIC;SonicWALL Virtual Miniport;c:\windows\system32\DRIVERS\swvnic.sys [2009-03-04 21016]
R3 vnet;Shrew Soft Virtual Adapter;c:\windows\system32\DRIVERS\virtualnet.sys [2009-11-19 9728]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-31 1343400]
R4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-10 47128]
R4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2007-02-22 2808664]
R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-29 239336]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-29 366936]
S0 SafeBoot;SafeBoot; [x]
S0 SbAlg;SbAlg; [x]
S0 SbFsLock;SbFsLock; [x]
S1 RsvLock;RsvLock; [x]
S1 vflt;Shrew Soft Lightweight Filter;c:\windows\system32\DRIVERS\vfilter.sys [2009-11-19 17408]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\aestsrv.exe [2009-03-03 81920]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-04-06 217600]
S2 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\SeaPort.EXE [2011-06-15 249648]
S2 dtpd;ShrewSoft DNS Proxy Daemon;c:\program files\ShrewSoft\VPN Client\dtpd.exe [2009-11-15 49152]
S2 HP Power Assistant Service;HP Power Assistant Service;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [2009-12-16 102968]
S2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [2009-11-18 36864]
S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2009-12-16 102968]
S2 HPDayStarterService;HP DayStarter Service;c:\program files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe [2010-01-08 81920]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2009-12-10 251448]
S2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [2009-12-16 281192]
S2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files\Hewlett-Packard\File Sanitizer\HPFSService.exe [2009-12-12 297984]
S2 hpHotkeyMonitor;HP Hotkey Monitor;c:\program files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [2010-01-05 264248]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2009-07-08 26168]
S2 iked;ShrewSoft IKE Daemon;c:\program files\ShrewSoft\VPN Client\iked.exe [2009-11-15 716800]
S2 ipsecd;ShrewSoft IPSEC Daemon;c:\program files\ShrewSoft\VPN Client\ipsecd.exe [2009-11-15 536576]
S2 MsDtsServer100;SQL Server Integration Services 10.0;c:\program files\Microsoft SQL Server\100\DTS\Binn\MsDtsSrvr.exe [2008-07-09 218136]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35088]
S2 nPStarterSVC;nProtect Starter;c:\windows\system32\nPStarterSVC.exe [2011-09-02 250145]
S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2009-10-23 635416]
S2 ReportServer;SQL Server Reporting Services (MSSQLSERVER);c:\program files\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe [2009-03-29 1113448]
S2 SWGVCSvc;SonicWALL Global VPN Client Service;c:\program files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe [2009-03-05 227352]
S2 uArcCapture;ArcCapture;c:\windows\system32\uArcCapture.exe [2009-12-04 506472]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-04 2320920]
S2 vmci;VMware vmci;c:\windows\system32\Drivers\vmci.sys [2010-09-20 70704]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\Common Files\VMware\USB\vmware-usbarbitrator.exe [2010-09-20 539184]
S2 vToolbarUpdater11.1.0;vToolbarUpdater11.1.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe [2012-06-19 935480]
S2 wgsslvpnsrc;WatchGuard SSLVPN Service;c:\program files\WatchGuard\WatchGuard Mobile VPN with SSL\wgsslvpnsrc.exe [2011-06-29 58368]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2012-04-06 9334784]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2012-04-06 275968]
S3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys [2009-12-04 29824]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2012-02-23 86544]
S3 MSSQLFDLauncher;SQL Full-text Filter Daemon Launcher (MSSQLSERVER);c:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\fdlauncher.exe [2008-07-09 31256]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-12-20 249888]
S3 rtsuvc;HP Webcam [2 MP Fixed];c:\windows\system32\DRIVERS\rtsuvc.sys [2009-12-22 21:37 73344]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 20:11 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2012-06-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-19 03:33]
.
2012-06-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-19 03:33]
.
2012-06-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-325877220-3748803948-952250591-1002Core.job
- c:\users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-23 11:14]
.
2012-06-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-325877220-3748803948-952250591-1002UA.job
- c:\users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-23 11:14]
.
2012-06-12 c:\windows\Tasks\HPCeeScheduleForAdmin.job
- c:\program files\Hewlett-Packard\HP Ceement\HPCEE.exe [2009-10-07 12:22]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.my/
uInternet Settings,ProxyServer = 211.75.247.71:80
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
LSP: c:\program files\VMware\VMware Player\vsocklib.dll
Trusted Zone: alipay.com
Trusted Zone: alisoft.com
Trusted Zone: taobao.com
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = 10.0.5.1
DPF: {1FAF427B-1EE5-43D3-A023-3009142AFCD9} - hxxps://ost.maybank2u.com.my/MBBWecos/Cab/csoex_mbb.cab
DPF: {477D5B9A-6479-44F8-9718-9340119B0308} - hxxp://www.hanabank.com/resource/download/veraport/down/veraport20.cab
DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} - hxxps://download.alipay.com/aliedit/aliedit/2401/aliedit.cab
DPF: {48ECCD73-123C-4C25-A64C-76E8E8A30CAF} - hxxp://mpi.dacom.net/XPayMPI/XPayMPIOCX.cab
DPF: {5EC2D418-1B2A-40E6-904C-CA8B7ADB3682} - hxxps://ost.maybank2u.com.my/MBBWecos/Cab/csta.cab
DPF: {92FD95E5-99AB-403A-98F9-53521AAB82A0} - hxxp://www.cybermap.co.kr/cm2000/company2/kyochonck/CYBERMAP_ASP2_KYOCHONCK.cab
DPF: {967386A1-409E-431A-A93A-FB5FEFF86A58} - hxxp://fx.keb.co.kr/veraport/veraport.cab
DPF: {B9B2EE1A-E314-4338-A305-BE845EACB113} - hxxps://ost.maybank2u.com.my/MBBWecos/Cab/csw25.cab
DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} - hxxps://www.vpay.co.kr/kvpfiles_vista/KVPISPCTLD_VISTA.cab
DPF: {F025D01A-28DC-4C14-8253-7F663864825F} - hxxp://211.57.102.21/ZaolmapClient.cab
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v9jxeddn.default\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: network.proxy.http - 192.192.14.60
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)
Toolbar-{95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-325877220-3748803948-952250591-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\. nj
Š¤NAm²}]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-325877220-3748803948-952250591-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\. nj
Š¤NAm²}\OpenWithList]
@Class="Shell"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'lsass.exe'(660)
c:\windows\system32\DPFPApi.DLL
.
- - - - - - - > 'Explorer.exe'(1028)
c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
c:\program files\TortoiseSVN\bin\TortoiseStub.dll
c:\program files\TortoiseSVN\bin\TortoiseSVN.dll
c:\program files\TortoiseSVN\bin\intl3_tsvn.dll
c:\program files\WIDCOMM\Bluetooth Software\btmmhook.dll
c:\program files\WIDCOMM\Bluetooth Software\btncopy.dll
c:\program files\WinMerge\ShellExtensionU.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\STacSV.exe
c:\windows\system32\atieclxx.exe
c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
c:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\sqlservr.exe
c:\program files\Microsoft SQL Server\MSAS10.MSSQLSERVER\OLAP\bin\msmdsrv.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\windows\system32\npnj5Agent.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\vmnat.exe
c:\windows\system32\vmnetdhcp.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\VMware\VMware Player\vmware-authd.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\fdhost.exe
c:\windows\system32\conhost.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\taskhost.exe
c:\windows\System32\rundll32.exe
c:\windows\system32\conhost.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\TortoiseSVN\bin\TSVNCache.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\mmc.exe
.
**************************************************************************
.
Completion time: 2012-06-19 14:22:17 - machine was rebooted
ComboFix-quarantined-files.txt 2012-06-19 06:22
.
Pre-Run: 156,183,044,096 bytes free
Post-Run: 172,137,218,048 bytes free
.
- - End Of File - - 27F01A9CAC4CB453DFF162D4F98FAA37

 

[Broni]

Looks good

Any current issues?

Download OTL to your Desktop.

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Click the Scan All Users checkbox.
• Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\tasks\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /I " " /c
dir /b "%systemroot%\*.exe" | find /I " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\LastSuccessTime /rs
/md5start
/md5stop

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
• When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

 

[happycan]

here's the otl
OTL logfile created on: 6/20/2012 4:23:55 PM - Run 1
OTL by OldTimer - Version 3.2.50.0 Folder = C:\Users\Admin\Documents
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.98 Gb Total Physical Memory | 1.21 Gb Available Physical Memory | 40.67% Memory free
5.97 Gb Paging File | 3.22 Gb Available in Paging File | 53.91% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 280.80 Gb Total Space | 162.45 Gb Free Space | 57.85% Space Free | Partition Type: NTFS
Drive F: | 1.99 Gb Total Space | 1.48 Gb Free Space | 74.69% Space Free | Partition Type: FAT32
Drive Y: | 1365.97 Gb Total Space | 577.03 Gb Free Space | 42.24% Space Free | Partition Type: NTFS
Drive Z: | 1365.97 Gb Total Space | 577.03 Gb Free Space | 42.24% Space Free | Partition Type: NTFS

Computer Name: ENOPL4JNA2HRF | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/06/20 16:20:04 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Documents\OTL.exe
PRC - [2012/06/19 09:45:14 | 000,935,480 | ---- | M] () -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe
PRC - [2012/04/06 10:16:24 | 000,451,072 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2012/04/06 10:15:50 | 000,217,600 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/04/04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/03/26 17:08:12 | 000,931,200 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2012/03/26 17:03:40 | 000,258,712 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MpCmdRun.exe
PRC - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2012/01/03 21:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/09/02 23:48:40 | 000,213,279 | ---- | M] (INCA Internet Co., Ltd.) -- C:\Windows\System32\npnj5Agent.exe
PRC - [2011/09/02 23:48:39 | 000,250,145 | ---- | M] (INCA Internet Co., Ltd.) -- C:\Windows\System32\npstartersvc.exe
PRC - [2011/06/29 23:02:50 | 000,058,368 | ---- | M] () -- C:\Program Files\WatchGuard\WatchGuard Mobile VPN with SSL\wgsslvpnsrc.exe
PRC - [2011/06/24 12:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011/06/15 17:33:20 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE
PRC - [2011/02/25 13:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/11/23 20:41:34 | 000,274,608 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\real\realplayer\Update\realsched.exe
PRC - [2010/11/20 20:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010/09/21 02:42:38 | 000,064,048 | ---- | M] (VMware, Inc.) -- C:\Program Files\VMware\VMware Player\hqtray.exe
PRC - [2010/09/21 02:42:06 | 000,113,200 | ---- | M] (VMware, Inc.) -- C:\Program Files\VMware\VMware Player\vmware-authd.exe
PRC - [2010/09/21 02:41:38 | 000,334,384 | ---- | M] (VMware, Inc.) -- C:\Windows\System32\vmnetdhcp.exe
PRC - [2010/09/21 02:41:34 | 000,404,016 | ---- | M] (VMware, Inc.) -- C:\Windows\System32\vmnat.exe
PRC - [2010/09/21 01:42:44 | 000,539,184 | ---- | M] (VMware, Inc.) -- C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
PRC - [2010/01/08 08:14:12 | 000,081,920 | ---- | M] (Hewlett-Packard Company) -- c:\Program Files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe
PRC - [2010/01/05 11:36:04 | 000,264,248 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
PRC - [2010/01/05 11:35:22 | 000,254,520 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe
PRC - [2010/01/05 10:23:36 | 000,309,816 | ---- | M] (Hewlett-Packard Development Company L.P.) -- C:\Program Files\Hewlett-Packard\Shared\hpCaslNotification.exe
PRC - [2009/12/17 06:51:46 | 000,363,064 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
PRC - [2009/12/17 06:51:46 | 000,102,968 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
PRC - [2009/12/17 06:48:12 | 001,690,680 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
PRC - [2009/12/17 06:48:12 | 000,102,968 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
PRC - [2009/12/16 09:11:14 | 000,281,192 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
PRC - [2009/12/12 09:57:38 | 011,265,536 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\File Sanitizer\coreshredder.exe
PRC - [2009/12/12 09:57:20 | 000,297,984 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
PRC - [2009/12/11 07:03:52 | 000,251,448 | ---- | M] (Hewlett-Packard Company) -- c:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
PRC - [2009/12/04 20:22:40 | 000,506,472 | ---- | M] (ArcSoft, Inc.) -- C:\Windows\System32\uArcCapture.exe
PRC - [2009/12/04 04:30:42 | 000,495,711 | ---- | M] (IDT, Inc.) -- C:\Program Files\IDT\WDM\sttray.exe
PRC - [2009/12/04 04:30:42 | 000,229,461 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\stacsv.exe
PRC - [2009/11/25 10:57:20 | 000,300,808 | ---- | M] (DigitalPersona, Inc.) -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
PRC - [2009/11/19 07:17:36 | 000,036,864 | ---- | M] (Hewlett-Packard Development Company, L.P) -- c:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
PRC - [2009/11/16 02:31:08 | 000,049,152 | ---- | M] () -- C:\Program Files\ShrewSoft\VPN Client\dtpd.exe
PRC - [2009/11/16 02:29:10 | 000,716,800 | ---- | M] () -- C:\Program Files\ShrewSoft\VPN Client\iked.exe
PRC - [2009/11/16 02:26:42 | 000,536,576 | ---- | M] () -- C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe
PRC - [2009/11/05 05:46:56 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2009/11/05 05:46:54 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2009/10/24 03:52:36 | 000,635,416 | ---- | M] (PDF Complete Inc) -- C:\Program Files\PDF Complete\pdfsvc.exe
PRC - [2009/09/05 03:43:40 | 000,795,936 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2009/09/05 03:43:38 | 000,595,232 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
PRC - [2009/08/26 00:57:52 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2009/08/26 00:57:44 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009/06/20 12:27:54 | 000,615,176 | ---- | M] (http://tortoisesvn.net) -- C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
PRC - [2009/03/05 23:57:56 | 000,227,352 | ---- | M] (SonicWALL, Inc.) -- C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe
PRC - [2009/03/03 18:43:08 | 000,081,920 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\AEstSrv.exe
PRC - [2008/07/30 10:06:58 | 001,100,280 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\devenv.exe
PRC - [2007/07/25 03:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe


========== Modules (No Company Name) ==========

MOD - [2012/06/20 10:41:04 | 000,240,128 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\f2f8201dd3453250dfd9ed1afce630a0\WindowsFormsIntegration.ni.dll
MOD - [2012/06/20 10:40:32 | 000,112,128 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\VJSharpCodeProvider\48994c45bfe7350638c99c3ed9f2630c\VJSharpCodeProvider.ni.dll
MOD - [2012/06/20 10:40:25 | 001,358,336 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\e3e5aa45736b95804bf6bb7eca08a57b\System.WorkflowServices.ni.dll
MOD - [2012/06/20 10:40:10 | 002,209,792 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\4a90802e36dee6e10d9bf54832cbf549\System.Web.Mobile.ni.dll
MOD - [2012/06/20 10:40:07 | 000,860,160 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\4f13c2c06fb97f6659473f02802b377b\System.Web.Extensions.Design.ni.dll
MOD - [2012/06/20 10:39:28 | 002,404,352 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\c45efc7ec92c1da8e67eb597559ec39c\System.Web.Extensions.ni.dll
MOD - [2012/06/20 10:39:23 | 000,141,312 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\c6aad1edcc51862ceb26b6b65dad1490\System.Web.Abstractions.ni.dll
MOD - [2012/06/20 10:39:22 | 001,707,008 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\ed560b26f2f86b3f07b7f6d384f92275\System.ServiceModel.Web.ni.dll
MOD - [2012/06/20 10:39:09 | 000,401,408 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\64de6810023adccdc56ddae13bdd6b03\System.Xml.Linq.ni.dll
MOD - [2012/06/20 10:38:06 | 000,135,680 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\940f62a5d077405e0b324422afb6ff2c\System.Data.DataSetExtensions.ni.dll
MOD - [2012/06/20 10:33:35 | 006,610,944 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\825b9227072708414d6811de8dbafddd\Microsoft.VisualStudio.Editors.ni.dll
MOD - [2012/06/20 10:33:12 | 001,443,328 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\642fe513f63c79db4692e615e1f717af\Microsoft.VisualStudio.Design.ni.dll
MOD - [2012/06/20 10:33:00 | 001,873,920 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\cb397428d551d6fba4903834a7e17a89\Microsoft.VisualStudio.CommonIDE.ni.dll
MOD - [2012/06/20 10:32:30 | 000,681,984 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\c84271d048a39671b32613384d2323ba\Microsoft.VisualStudio.ni.dll
MOD - [2012/06/20 10:31:56 | 000,035,840 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\51d670a1c1b9a93c350ad442f84d4d7b\Microsoft.SqlServer.PolicyEnum.ni.dll
MOD - [2012/06/20 10:31:03 | 000,073,216 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\5181f608c3a5dbf9a9131640188d9319\Microsoft.SqlServer.BatchParserClient.ni.dll
MOD - [2012/06/20 10:30:12 | 000,018,944 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Internal.#\1d0cf94a53c1ae342a2dc6828d75d195\Microsoft.Internal.VisualStudio.Shell.Interop.9.0.ni.dll
MOD - [2012/06/20 10:27:24 | 000,220,672 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\626d0ac2f4ada682d7ca6c4ebf821469\CustomMarshalers.ni.dll
MOD - [2012/06/20 10:27:19 | 001,083,392 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\2ce8210219c7123610072357358df470\System.IdentityModel.ni.dll
MOD - [2012/06/20 10:27:16 | 002,347,008 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\72a24b45e11d64eb2bc840aae9419ba5\System.Runtime.Serialization.ni.dll
MOD - [2012/06/20 10:27:10 | 017,478,656 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\107779ca2708d2b31b2e1560e47f6d15\System.ServiceModel.ni.dll
MOD - [2012/06/20 10:24:12 | 000,902,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\msvcm80\ba48f63128639313585d747f446fee30\msvcm80.ni.dll
MOD - [2012/06/20 10:22:40 | 000,225,792 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\ObjectExplorerRepli#\d0b08caf4373636e5a9e09833483c500\ObjectExplorerReplication.ni.dll
MOD - [2012/06/20 10:22:24 | 000,141,312 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\5dc1fbdc999ea87d94a985852a9f5524\Microsoft.SqlServer.Management.SqlStudio.Migration.ni.dll
MOD - [2012/06/20 10:22:23 | 000,557,568 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\f9c12ff7e800c83740ecf9272dd3ac25\Microsoft.SqlServer.Management.SqlStudio.Explorer.ni.dll
MOD - [2012/06/20 10:22:20 | 000,125,952 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\1fbf55cf7bdeafa7de1772ae19d1e177\Microsoft.SqlServer.Management.SqlStudio.ni.dll
MOD - [2012/06/20 10:18:40 | 004,137,984 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\ObjectExplorer\198fbc742741ee811db032f3a41c9213\ObjectExplorer.ni.dll
MOD - [2012/06/20 10:18:31 | 001,670,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\6c59a14a23f734093e80d6093e25302a\Microsoft.VisualBasic.ni.dll
MOD - [2012/06/20 10:18:13 | 009,370,624 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\e621640851891c9cc37057d4cccd143a\Microsoft.SqlServer.Management.Reports.ni.dll
MOD - [2012/06/20 10:18:07 | 001,428,992 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\AppIDPackage\75cefbf270616f0f15f0fddbf897feaf\AppIDPackage.ni.dll
MOD - [2012/06/20 10:17:15 | 000,065,536 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\054ff376d0135cd54d6d9c85d1322284\Microsoft.SqlServer.Instapi.ni.dll
MOD - [2012/06/20 10:17:13 | 000,450,048 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\1d3d234d90fdb19586de054fbecac93f\Microsoft.VisualStudio.Debugger.Interop.ni.dll
MOD - [2012/06/20 10:17:12 | 000,628,736 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\7e9e743cf39be9de09d0f0ba7def0902\Microsoft.SqlServer.SqlTools.VSIntegration.ni.dll
MOD - [2012/06/20 10:17:10 | 000,334,336 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\28dd81025c3fd1453953a59a3fad1882\Microsoft.SqlServer.Management.SDK.SqlStudio.ni.dll
MOD - [2012/06/20 10:16:56 | 000,118,272 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\fda69a3df4aea8f490d5d59d46bcb655\Microsoft.SqlServer.Sqm.ni.dll
MOD - [2012/06/20 10:16:56 | 000,077,824 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.DataWareh#\0b1b9ede0e557076c1364a8cd72b836a\Microsoft.DataWarehouse.SQM.ni.dll
MOD - [2012/06/20 10:16:54 | 000,263,680 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\0a374189e967700aa475e62fecc00653\Microsoft.SqlServer.Management.UserSettings.ni.dll
MOD - [2012/06/20 10:16:53 | 000,205,824 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\3fafb6a18f737ad75cb03fa7fb5079e2\Microsoft.SqlServer.Management.RegisteredServers.ni.dll
MOD - [2012/06/20 10:16:51 | 000,674,304 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\73cab4b77a83b764f609c66f9d3460fd\Microsoft.SqlServer.Management.Controls.ni.dll
MOD - [2012/06/20 10:16:50 | 001,192,448 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\ConnectionDlg\b9ce056b272cb809a7ec7782a095affd\ConnectionDlg.ni.dll
MOD - [2012/06/20 10:16:06 | 002,956,288 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.DataWareh#\e332578a9f247f49821aa16e6887b5af\Microsoft.DataWarehouse.ni.dll
MOD - [2012/06/20 10:16:01 | 000,086,528 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\SqlWorkbench.Interf#\3eaf3af8fd5184a05b764d212fe9dec7\SqlWorkbench.Interfaces.ni.dll
MOD - [2012/06/20 10:15:59 | 005,335,040 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\SqlMgmt\6743eb50f7a4be623d4bbb07a73a115b\SqlMgmt.ni.dll
MOD - [2012/06/20 10:13:07 | 002,335,744 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\e3d2577e00aef6bc9b3e235eb83634f3\Microsoft.JScript.ni.dll
MOD - [2012/06/20 10:13:07 | 000,055,296 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\06fcf2fbbe38d9425fc49d935498ec93\Microsoft.Vsa.ni.dll
MOD - [2012/06/20 10:13:04 | 001,051,136 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\9b2f17fb61b7197f2a04108f5d1a1cc6\System.Management.ni.dll
MOD - [2012/06/20 10:13:02 | 001,282,048 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\ec6e4a4681407bd82193397e9df9b56d\Microsoft.SqlServer.Dmf.ni.dll
MOD - [2012/06/20 10:13:00 | 001,579,008 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\77b4b7194b5c711ec8df3338c5172d91\Microsoft.SqlServer.SqlEnum.ni.dll
MOD - [2012/06/20 10:12:59 | 006,738,944 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\427380ddeacfb16f11fb404d6465922d\Microsoft.SqlServer.Smo.ni.dll
MOD - [2012/06/20 10:12:43 | 000,640,000 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\d9ace980a7380c6d7c67ff5bae5e4e27\Microsoft.SqlServer.BatchParser.ni.dll
MOD - [2012/06/20 10:12:38 | 000,075,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ebd6b5a74c66195a910f60e80bce709a\Microsoft.VisualStudio.Shell.Interop.9.0.ni.dll
MOD - [2012/06/20 10:12:38 | 000,022,016 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5288ab86c56e7e057a09ecd5b94f3754\Microsoft.VisualStudio.Designer.Interfaces.ni.dll
MOD - [2012/06/20 10:12:37 | 000,876,032 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\7513750db8f18d9acd7146c2014e7c6c\Microsoft.VisualStudio.Shell.9.0.ni.dll
MOD - [2012/06/20 10:12:36 | 000,513,024 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\56aba4c24c909b036e0c19e3fe347b62\Microsoft.VisualStudio.Shell.Design.ni.dll
MOD - [2012/06/20 10:12:35 | 000,124,416 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a279d73baa30eb4ae0b75efd13160c2f\Microsoft.VisualStudio.TextManager.Interop.8.0.ni.dll
MOD - [2012/06/20 10:12:34 | 000,373,248 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\b109dd43c9480dca0225b5b7dc399e86\Microsoft.VisualStudio.Shell.Interop.8.0.ni.dll
MOD - [2012/06/20 10:12:34 | 000,306,176 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9ba0792a761f8d0113086ea6c2cbb6d4\Microsoft.VisualStudio.OLE.Interop.ni.dll
MOD - [2012/06/20 10:12:34 | 000,281,088 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\d3cb9392ffd7004b9578dc2640a6f1aa\Microsoft.VisualStudio.TextManager.Interop.ni.dll
MOD - [2012/06/20 10:12:33 | 000,838,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\04554d3d95450b0835cd8c9431a9eb1f\Microsoft.VisualStudio.Shell.ni.dll
MOD - [2012/06/20 10:12:33 | 000,577,024 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bcfaa65924b82c1e6fcadfa0e942e71b\Microsoft.VisualStudio.Shell.Interop.ni.dll
MOD - [2012/06/20 10:12:31 | 000,276,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\EnvDTE80\88e27448b6dfea3ea7a981d09906935a\EnvDTE80.ni.dll
MOD - [2012/06/20 10:12:13 | 000,042,496 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\1fa1d800a03e3d5dcde9117019aa5b9f\Microsoft.SqlServer.SString.ni.dll
MOD - [2012/06/20 10:12:05 | 000,023,040 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\78ca851a3ccafd8f44d8f2fe622078c9\Microsoft.VisualStudio.VSHelp80.ni.dll
MOD - [2012/06/20 10:12:04 | 000,232,960 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.NetEnterp#\968ade5bc7149e8f72b1d5c43b4cf96b\Microsoft.NetEnterpriseServers.ExceptionMessageBox.ni.dll
MOD - [2012/06/20 10:12:04 | 000,026,112 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\9f58257b3d3eefa80050123c54b760be\Microsoft.SqlServer.SqlClrProvider.ni.dll
MOD - [2012/06/20 10:12:03 | 001,391,104 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\262086e3e34d6e3ca6c2956cfeefb749\Microsoft.SqlServer.Management.Sdk.Sfc.ni.dll
MOD - [2012/06/20 10:12:03 | 000,272,896 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\038e682b0a0b762c8aae2ed9d5ead010\Microsoft.SqlServer.ConnectionInfo.ni.dll
MOD - [2012/06/20 10:12:01 | 000,128,000 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\052d20cd83fa7eed005b1b79125e6f4f\Microsoft.SqlServer.RegSvrEnum.ni.dll
MOD - [2012/06/20 10:11:57 | 000,532,992 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\6e498d4b076ce92fc546df1bc42f5927\Microsoft.SqlServer.GridControl.ni.dll
MOD - [2012/06/20 10:11:53 | 000,532,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\c66125712c1f26367702432574f82d35\Microsoft.SqlServer.Diagnostics.STrace.ni.dll
MOD - [2012/06/20 10:11:53 | 000,041,472 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\47b6fca009f90c7ee97899e49bd7c61c\Microsoft.SqlServer.SqlTDiagM.ni.dll
MOD - [2012/06/20 10:11:07 | 002,297,856 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\dfd33f59a5803a3c73cf408362e6e0b7\System.Core.ni.dll
MOD - [2012/06/20 10:10:55 | 000,573,440 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\EnvDTE\5b8667c6746bd6dff357a27fe2d5aa3a\EnvDTE.ni.dll
MOD - [2012/06/20 09:51:21 | 000,008,704 | ---- | M] () -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\web\9cdbf797\16f5b2b\App_global.asax.l_6jpoqg.dll
MOD - [2012/06/20 09:51:20 | 000,643,072 | ---- | M] () -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\web\9cdbf797\16f5b2b\App_Code.s7seuiuj.dll
MOD - [2012/06/20 09:51:12 | 000,176,128 | ---- | M] () -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\web\9cdbf797\16f5b2b\App_WebReferences.9nwlmzw_.dll
MOD - [2012/06/20 09:51:04 | 000,015,872 | ---- | M] () -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\web\9cdbf797\16f5b2b\assembly\dl3\1251b94e\011160a3_925ccc01\WEBAPIUtilizer.DLL
MOD - [2012/06/20 09:51:03 | 000,016,384 | ---- | M] () -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\web\9cdbf797\16f5b2b\assembly\dl3\0dda1723\275a59a3_925ccc01\WebAPI.DLL
MOD - [2012/06/20 09:50:59 | 000,008,704 | ---- | M] () -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\web\9cdbf797\16f5b2b\assembly\dl3\e3cdd566\14c29980_853bcc01\rixtyclient.DLL
MOD - [2012/06/20 09:50:59 | 000,005,120 | ---- | M] () -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\web\9cdbf797\16f5b2b\assembly\dl3\344cdcbc\0f866235_9751cc01\ModelClass.DLL
MOD - [2012/06/20 09:50:58 | 000,023,040 | ---- | M] () -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\web\9cdbf797\16f5b2b\assembly\dl3\f6863abf\cb2e5d35_9751cc01\com.DLL
MOD - [2012/06/20 09:50:57 | 005,516,800 | ---- | M] () -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\web\9cdbf797\16f5b2b\assembly\dl3\fd6458a4\e5cffff1_4fedcc01\AjaxControlToolkit.DLL
MOD - [2012/06/20 09:15:01 | 000,368,128 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8e56489276063ededde74e597a121df3\PresentationFramework.Aero.ni.dll
MOD - [2012/06/20 09:14:55 | 000,202,240 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\2b129372a27469195acbe3b6b81786ef\System.Web.RegularExpressions.ni.dll
MOD - [2012/06/20 09:14:53 | 000,208,384 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\912a0776c2bfd35ff76bd0b8ba977ed4\System.Drawing.Design.ni.dll
MOD - [2012/06/20 09:14:51 | 010,580,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\7c144f89b1f8f292d6940a1b2f8ffbec\System.Design.ni.dll
MOD - [2012/06/20 09:14:41 | 001,840,640 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\761fd1afc17f11bf6d49c3a7d16465ca\System.Web.Services.ni.dll
MOD - [2012/06/20 09:14:37 | 011,833,344 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll
MOD - [2012/06/20 09:14:29 | 000,771,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012/06/20 09:14:27 | 000,628,224 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\168755d010e5a96ac940b0ddd27616a4\System.EnterpriseServices.ni.dll
MOD - [2012/06/20 09:14:25 | 000,627,200 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\80fae9f16f80075535e72458ef293f7a\System.Transactions.ni.dll
MOD - [2012/06/20 09:14:23 | 006,610,944 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\e2073751227120ce228e00e26dfe5fca\System.Data.ni.dll
MOD - [2012/06/20 09:14:04 | 014,340,608 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e717a230496832656b05b515eb9f3bc5\PresentationFramework.ni.dll
MOD - [2012/06/20 09:13:24 | 012,436,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012/06/20 09:13:16 | 001,591,808 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012/06/20 09:13:11 | 000,185,344 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\d8af9a65cf0ed85d47360796e2645a06\UIAutomationTypes.ni.dll
MOD - [2012/06/20 09:13:10 | 000,025,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\2ec98ab0193d64e95b7d09d094deed97\Accessibility.ni.dll
MOD - [2012/06/20 09:13:09 | 012,237,824 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\14a87218ea49639f38097e278b98a3da\PresentationCore.ni.dll
MOD - [2012/06/20 09:12:56 | 003,347,968 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012/06/20 09:12:47 | 005,452,800 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012/06/20 09:12:43 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012/06/20 09:12:41 | 007,967,232 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012/06/20 09:11:20 | 011,492,864 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2012/06/20 01:08:32 | 000,370,528 | ---- | M] () -- C:\windows\assembly\GAC_32\Microsoft.SqlServer.BatchParser\10.0.0.0__89845dcd8080cc91\Microsoft.SqlServer.BatchParser.dll
MOD - [2012/04/05 22:00:20 | 000,369,152 | ---- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2011/11/09 09:55:02 | 000,016,384 | ---- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll
MOD - [2011/10/05 03:52:30 | 000,756,048 | ---- | M] () -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSPTLS.DLL
MOD - [2011/06/27 17:19:59 | 004,427,776 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\Microsoft.VSDesigner\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VSDesigner.dll
MOD - [2011/06/27 17:19:58 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.WCFReference.Interop\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.WCFReference.Interop.dll
MOD - [2011/06/27 17:19:58 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.ManagedInterfaces.WCF\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.ManagedInterfaces.WCF.dll
MOD - [2011/06/27 17:19:57 | 000,671,744 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.CommonIDE\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.CommonIDE.dll
MOD - [2011/06/22 11:46:12 | 000,434,016 | ---- | M] () -- C:\Program Files\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll
MOD - [2010/11/05 09:58:05 | 002,927,616 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2010/11/05 09:57:39 | 000,069,120 | ---- | M] () -- C:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
MOD - [2010/09/21 02:42:38 | 000,068,656 | ---- | M] () -- C:\Program Files\VMware\VMware Player\zlib1.dll
MOD - [2010/09/21 02:42:20 | 000,970,288 | ---- | M] () -- C:\Program Files\VMware\VMware Player\libxml2.dll
MOD - [2010/05/31 13:35:50 | 000,294,912 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.dll
MOD - [2010/05/31 12:56:08 | 000,012,800 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.XmlEditor\3.5.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.XmlEditor.dll
MOD - [2010/05/31 12:55:53 | 000,348,160 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Package.LanguageService.9.0\3.5.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Package.LanguageService.9.0.dll
MOD - [2010/05/31 12:12:23 | 000,102,400 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CppCodeProvider\8.0.0.0__b03f5f7f11d50a3a\CppCodeProvider.dll
MOD - [2010/03/22 02:19:50 | 000,094,208 | ---- | M] () -- C:\Program Files\FileZilla FTP Client\fzshellext.dll
MOD - [2010/01/21 15:19:40 | 000,101,376 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\HP.ActiveSupportLibrary\2.0.0.1__01a974bc1760f423\HP.ActiveSupportLibrary.dll
MOD - [2010/01/21 15:16:00 | 000,236,600 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\hpCASLLibrary\3.0.1.1__67b8d1b5179ba5f8\hpCASLLibrary.dll
MOD - [2010/01/21 15:14:52 | 000,011,320 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\Interop.HPQWMIEXLib\1.0.0.0__67b8d1b5179ba5f8\Interop.HPQWMIEXLib.dll
MOD - [2010/01/21 14:55:30 | 000,130,616 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\hpcasl\3.5.1.1__9c6f83d5b7f3d097\hpcasl.dll
MOD - [2010/01/21 14:55:30 | 000,062,008 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CaslShared\3.5.1.1__9c6f83d5b7f3d097\CaslShared.dll
MOD - [2009/12/17 06:51:48 | 000,052,280 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll
MOD - [2009/12/17 06:51:44 | 000,030,264 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll
MOD - [2009/12/17 06:48:12 | 000,055,352 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Power Assistant\Graphs.dll
MOD - [2009/12/17 06:48:12 | 000,052,280 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Power Assistant\HardwareAccess.dll
MOD - [2009/12/17 06:48:10 | 000,267,832 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Power Assistant\HPCommon.XmlSerializers.dll
MOD - [2009/09/30 07:25:46 | 000,061,440 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll
MOD - [2009/09/30 07:25:44 | 000,131,072 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll
MOD - [2009/09/30 07:25:38 | 000,040,960 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingServer.dll
MOD - [2009/09/30 07:25:38 | 000,036,864 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingClients.dll
MOD - [2009/09/30 07:25:38 | 000,007,680 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\RemotingClient.dll
MOD - [2009/09/30 07:25:36 | 000,005,632 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingInterface.dll
MOD - [2009/09/30 07:25:28 | 000,018,944 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingMessages.dll
MOD - [2009/09/05 03:43:54 | 000,132,384 | ---- | M] () -- C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll
MOD - [2009/06/20 12:27:10 | 000,101,128 | ---- | M] () -- C:\Program Files\TortoiseSVN\bin\CrashRpt.dll
MOD - [2009/06/18 03:40:16 | 007,745,536 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtGui4.dll
MOD - [2009/06/18 03:40:16 | 002,121,728 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtCore4.dll
MOD - [2009/06/18 03:40:16 | 000,135,168 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
MOD - [2009/06/11 05:23:19 | 000,261,632 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2009/02/26 13:46:56 | 000,064,344 | ---- | M] () -- C:\Program Files\Microsoft Office\Office12\ADDINS\ColleagueImport.dll


========== Win32 Services (SafeList) ==========

SRV - [2012/06/20 16:26:11 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/06/19 09:45:14 | 000,935,480 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe -- (vToolbarUpdater11.1.0)
SRV - [2012/06/01 23:39:50 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/04/06 10:15:50 | 000,217,600 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/03/26 17:03:40 | 000,214,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012/01/03 21:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/09/02 23:48:39 | 000,250,145 | ---- | M] (INCA Internet Co., Ltd.) [Auto | Running] -- C:\Windows\System32\npstartersvc.exe -- (nPStarterSVC)
SRV - [2011/07/07 19:31:08 | 000,195,336 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/06/29 23:02:50 | 000,058,368 | ---- | M] () [Auto | Running] -- C:\Program Files\WatchGuard\WatchGuard Mobile VPN with SSL\wgsslvpnsrc.exe -- (wgsslvpnsrc)
SRV - [2011/06/15 17:33:20 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2010/11/20 20:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/11/20 20:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2010/11/20 20:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2010/09/21 02:42:06 | 000,113,200 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService)
SRV - [2010/09/21 02:41:38 | 000,334,384 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\System32\vmnetdhcp.exe -- (VMnetDHCP)
SRV - [2010/09/21 02:41:34 | 000,404,016 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\System32\vmnat.exe -- (VMware NAT Service)
SRV - [2010/09/21 01:42:44 | 000,539,184 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe -- (VMUSBArbService)
SRV - [2010/08/19 13:57:14 | 000,191,024 | ---- | M] (VMware, Inc.) [On_Demand | Stopped] -- C:\Program Files\VMware\VMware Player\vmware-ufad.exe -- (ufad-ws60)
SRV - [2010/06/26 01:07:20 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2010/05/31 19:28:45 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2010/01/08 08:14:12 | 000,081,920 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- c:\Program Files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe -- (HPDayStarterService)
SRV - [2010/01/05 11:36:04 | 000,264,248 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe -- (hpHotkeyMonitor)
SRV - [2009/12/17 06:51:46 | 000,102,968 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe -- (HP Wireless Assistant Service)
SRV - [2009/12/17 06:48:12 | 000,102,968 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe -- (HP Power Assistant Service)
SRV - [2009/12/16 09:11:14 | 000,281,192 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe -- (HpFkCryptService)
SRV - [2009/12/15 01:47:46 | 001,639,728 | ---- | M] (Validity Sensors, Inc.) [Auto | Stopped] -- C:\Windows\System32\vcsFPService.exe -- (vcsFPService)
SRV - [2009/12/12 09:57:20 | 000,297,984 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe -- (HPFSService)
SRV - [2009/12/11 07:03:52 | 000,251,448 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- c:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2009/12/04 20:22:40 | 000,506,472 | ---- | M] (ArcSoft, Inc.) [Auto | Running] -- C:\Windows\System32\uArcCapture.exe -- (uArcCapture)
SRV - [2009/12/04 04:30:42 | 000,229,461 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\stacsv.exe -- (STacSV)
SRV - [2009/11/25 10:57:20 | 000,300,808 | ---- | M] (DigitalPersona, Inc.) [Auto | Running] -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe -- (DpHost)
SRV - [2009/11/19 07:17:36 | 000,036,864 | ---- | M] (Hewlett-Packard Development Company, L.P) [Auto | Running] -- c:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe -- (HP ProtectTools Service)
SRV - [2009/11/18 06:39:16 | 000,362,040 | ---- | M] (Hewlett-Packard Ltd) [On_Demand | Stopped] -- C:\Windows\System32\flcdlock.exe -- (FLCDLOCK)
SRV - [2009/11/16 02:31:08 | 000,049,152 | ---- | M] () [Auto | Running] -- C:\Program Files\ShrewSoft\VPN Client\dtpd.exe -- (dtpd)
SRV - [2009/11/16 02:29:10 | 000,716,800 | ---- | M] () [Auto | Running] -- C:\Program Files\ShrewSoft\VPN Client\iked.exe -- (iked)
SRV - [2009/11/16 02:26:42 | 000,536,576 | ---- | M] () [Auto | Running] -- C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe -- (ipsecd)
SRV - [2009/11/05 05:46:56 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2009/11/05 05:46:54 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009/10/24 03:52:36 | 000,635,416 | ---- | M] (PDF Complete Inc) [Auto | Running] -- C:\Program Files\PDF Complete\pdfsvc.exe -- (pdfcDispatcher)
SRV - [2009/09/29 00:42:50 | 000,109,056 | ---- | M] (ArcSoft Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/09/05 03:43:38 | 000,595,232 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2009/08/26 00:57:52 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2009/07/14 09:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009/07/14 09:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 09:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/14 09:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/03/05 23:57:56 | 000,227,352 | ---- | M] (SonicWALL, Inc.) [Auto | Running] -- C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe -- (SWGVCSvc)
SRV - [2009/03/03 18:43:08 | 000,081,920 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\AEstSrv.exe -- (AESTFilters)
SRV - [2008/07/29 13:10:46 | 003,201,024 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe -- (msvsmon90)
SRV - [2007/07/25 03:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2007/02/22 18:39:44 | 002,808,664 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe -- (msvsmon80)

 

[happycan]

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Admin\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2012/04/06 13:21:10 | 009,334,784 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2012/04/06 13:21:10 | 009,334,784 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2012/04/06 09:10:22 | 000,275,968 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/03/20 20:44:12 | 000,074,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2012/02/23 20:31:58 | 000,086,544 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService)
DRV - [2011/10/05 16:46:54 | 000,055,864 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SCSK5.sys -- (scsk5)
DRV - [2011/09/02 23:47:45 | 000,126,048 | ---- | M] (Kings Information & Network) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\kcrtx86.sys -- (kcrtx86)
DRV - [2011/06/29 23:02:16 | 000,026,112 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tap0901.sys -- (tap0901)
DRV - [2010/11/20 20:30:17 | 000,296,064 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcvmm.sys -- (vpcvmm)
DRV - [2010/11/20 20:30:17 | 000,172,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpchbus.sys -- (vpcbus)
DRV - [2010/11/20 20:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 20:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 20:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 18:50:38 | 000,078,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpcusb.sys -- (vpcusb)
DRV - [2010/11/20 18:50:37 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcnfltr.sys -- (vpcnfltr)
DRV - [2010/11/20 18:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 17:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\winusb.sys -- (WinUSB)
DRV - [2010/11/20 17:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 17:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/09/21 02:42:46 | 000,070,704 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmci.sys -- (vmci)
DRV - [2010/09/21 02:42:44 | 000,854,064 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmx86.sys -- (vmx86)
DRV - [2010/09/21 02:41:08 | 000,024,624 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMkbd.sys -- (vmkbd)
DRV - [2010/09/21 02:40:04 | 000,026,288 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmnetuserif.sys -- (VMnetuserif)
DRV - [2010/09/21 01:42:32 | 000,032,304 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\hcmon.sys -- (hcmon)
DRV - [2010/09/20 23:18:16 | 000,031,280 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmusb.sys -- (vmusb)
DRV - [2010/09/20 23:18:14 | 000,036,400 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmnetbridge.sys -- (VMnetBridge)
DRV - [2010/09/20 23:18:14 | 000,016,560 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV - [2010/08/19 13:56:38 | 000,022,448 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Program Files\VMware\VMware Player\vstor2-ws60.sys -- (vstor2-ws60)
DRV - [2010/06/26 01:07:14 | 000,035,088 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2010/05/13 14:55:18 | 000,047,712 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\NPIdsVt.sys -- (NPIDS)
DRV - [2009/12/23 05:37:28 | 000,073,344 | ---- | M] (Realtek Semiconductor Corp.) [2 MP Fixed] [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtsuvc.sys -- (rtsuvc)
DRV - [2009/12/16 09:12:28 | 000,051,800 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\windows\System32\drivers\SbAlg.sys -- (SbAlg)
DRV - [2009/12/16 09:12:16 | 000,013,256 | ---- | M] (McAfee, Inc.) [File_System | Boot | Running] -- C:\windows\System32\drivers\SbFsLock.sys -- (SbFsLock)
DRV - [2009/12/16 09:12:14 | 000,040,088 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\windows\System32\drivers\rsvlock.sys -- (RsvLock)
DRV - [2009/12/16 09:12:10 | 000,110,520 | ---- | M] () [Kernel | Boot | Running] -- C:\windows\System32\drivers\SafeBoot.sys -- (SafeBoot)
DRV - [2009/12/04 18:48:18 | 000,029,824 | ---- | M] (ArcSoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ArcSoftVCapture.sys -- (ARCVCAM)
DRV - [2009/12/04 04:30:42 | 000,423,424 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2009/11/19 08:06:18 | 000,017,408 | ---- | M] (Shrew Soft Inc) [Kernel | System | Running] -- C:\Windows\System32\drivers\vfilter.sys -- (vflt)
DRV - [2009/11/19 08:06:16 | 000,009,728 | ---- | M] (Shrew Soft Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\virtualnet.sys -- (vnet)
DRV - [2009/11/18 20:25:04 | 000,100,352 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2009/11/11 17:11:00 | 000,181,792 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV - [2009/10/22 05:37:52 | 000,032,312 | ---- | M] (Hewlett-Packard Development Company L.P.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\DAMDrv.sys -- (DAMDrv)
DRV - [2009/10/06 00:31:50 | 001,221,632 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009/09/18 04:54:14 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HECI.sys -- (HECI) Intel(R)
DRV - [2009/07/17 05:16:50 | 000,015,872 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2009/07/14 07:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\serial.sys -- (Serial)
DRV - [2009/07/14 07:12:52 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tpm.sys -- (TPM)
DRV - [2009/07/14 06:13:48 | 001,035,776 | ---- | M] (LSI Corp) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2009/07/09 05:48:38 | 000,025,656 | ---- | M] (Hewlett-Packard) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hpdskflt.sys -- (hpdskflt)
DRV - [2009/07/09 05:48:22 | 000,033,848 | ---- | M] (Hewlett-Packard) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Accelerometer.sys -- (Accelerometer)
DRV - [2009/05/16 09:15:14 | 000,214,024 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2009/05/16 09:15:14 | 000,079,816 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mfeavfk.sys -- (MfeAVFK)
DRV - [2009/05/16 09:15:14 | 000,055,336 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mfetdik.sys -- (mfetdik)
DRV - [2009/05/16 09:15:14 | 000,035,272 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mfebopk.sys -- (MfeBOPK)
DRV - [2009/05/16 09:15:14 | 000,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mferkdk.sys -- (MfeRKDK)
DRV - [2009/03/30 03:09:28 | 000,239,336 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\RsFx0103.sys -- (RsFx0103)
DRV - [2009/03/05 23:58:12 | 000,087,064 | ---- | M] (SonicWALL, Inc.) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\SWIPsec.sys -- (SWIPsec)
DRV - [2009/03/04 18:03:32 | 000,021,016 | ---- | M] (SonicWALL, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SWVNIC.sys -- (SWVNIC)
DRV - [2008/11/16 18:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
DRV - [2006/11/11 06:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPCOM/1
IE - HKLM\..\SearchScopes,DefaultScope = {A824A130-D6EE-4CCF-B11F-66015843DFA5}
IE - HKLM\..\SearchScopes\{A824A130-D6EE-4CCF-B11F-66015843DFA5}: "URL" = http://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-325877220-3748803948-952250591-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.my/
IE - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - No CLSID value found
IE - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={...685a418f123&lang=en&ds=AVG&pr=fr&d=2012-06-19 09:45:15&v=11.1.0.7&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..\SearchScopes\{A824A130-D6EE-4CCF-B11F-66015843DFA5}: "URL" = http://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
IE - HKU\S-1-5-21-325877220-3748803948-952250591-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-325877220-3748803948-952250591-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 211.75.247.71:80

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..extensions.enabledItems: otis@digitalpersona.com:5.0.0.4191
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.2
FF - prefs.js..extensions.enabledItems: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.16
FF - prefs.js..extensions.enabledItems: firecookie@janodvarko.cz:1.2.1
FF - prefs.js..extensions.enabledItems: firesheep@codebutler.com:0.1
FF - prefs.js..extensions.enabledItems: xssme@security.compass:0.4.4
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..network.proxy.http: "192.192.14.60"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@ahnlab.com/asp/npaosmgr.1: C:\Program Files\AhnLab\ASP\Components\aosmgr\npaosmgr.dll (AhnLab, Inc.)
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\\npsitesafety.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@interezen.co.kr/npi3gmanager: C:\Program Files\Interezen\Plugins\NPI3GManager.dll (Interezen (c) Interezen.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.609: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.609: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.609: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.609: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@softforum.com/npKeyPro: C:\windows\system32\npKeyPro.dll (SoftForum Co., Ltd.)
FF - HKLM\Software\MozillaPlugins\@softforum.com/npxwebplugins: C:\Program Files\SoftForum\XecureWeb\ActiveX\npxwebplugin.dll (SoftForum Co., Ltd.)
FF - HKLM\Software\MozillaPlugins\@softforum.com/npxwebplugins_file: C:\Program Files\SoftForum\XecureWeb\ActiveX\npxwebplugin_file.dll (SoftForum Co., Ltd.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@wizvera.com/npVeraport20: C:\Program Files\Wizvera\Veraport20\npveraport20.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Admin\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Admin\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\otis@digitalpersona.com: c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\ [2010/01/21 15:14:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/11/23 20:41:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\11.1.0.7\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/07 09:51:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/06/19 23:50:56 | 000,000,000 | ---D | M]

[2010/06/03 10:45:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions
[2012/06/07 09:53:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\v9jxeddn.default\extensions
[2012/06/07 09:52:45 | 000,000,000 | ---D | M] (Live HTTP Headers) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\v9jxeddn.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}
[2011/05/03 12:44:40 | 000,000,000 | ---D | M] (Firecookie) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\v9jxeddn.default\extensions\firecookie@janodvarko.cz
[2010/11/10 10:59:05 | 000,000,000 | ---D | M] (Firesheep) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\v9jxeddn.default\extensions\firesheep@codebutler.com
[2012/06/19 23:51:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/06/19 23:51:10 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012/06/07 09:53:58 | 001,335,949 | ---- | M] () (No name found) -- C:\USERS\ADMIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\V9JXEDDN.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI
[2012/06/07 09:52:51 | 000,106,978 | ---- | M] () (No name found) -- C:\USERS\ADMIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\V9JXEDDN.DEFAULT\EXTENSIONS\XSSME@SECURITY.COMPASS.XPI
[2012/06/01 23:40:25 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/06/19 09:45:11 | 000,003,747 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/06/01 23:39:16 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/06/01 23:39:16 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

 

[happycan]

========== Chrome ==========

CHR - default_search_provider: Bing (Enabled)
CHR - default_search_provider: search_url = http://www.bing.com/search?setmkt=en-US&q={searchTerms}
CHR - default_search_provider: suggest_url = http://api.bing.com/osjson.aspx?query={searchTerms}&language={language}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Admin\AppData\Local\Google\Chrome\Application\19.0.1084.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Admin\AppData\Local\Google\Chrome\Application\19.0.1084.56\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Admin\AppData\Local\Google\Chrome\Application\19.0.1084.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U23 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: AhnLab Online Security (Enabled) = C:\Program Files\AhnLab\ASP\Components\aosmgr\npaosmgr.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: NPI3GManager (c) Interezen. plugin (Enabled) = C:\Program Files\Interezen\Plugins\NPI3GManager.dll
CHR - plugin: SoftForum XecureWeb Control Plug-in (Enabled) = C:\Program Files\SoftForum\XecureWeb\ActiveX\npxwebplugin.dll
CHR - plugin: SoftForum XecureWeb File Control Plug-in (Enabled) = C:\Program Files\SoftForum\XecureWeb\ActiveX\npxwebplugin_file.dll
CHR - plugin: Veraport Mozilla Plugin (Enabled) = C:\Program Files\Wizvera\Veraport20\npveraport20.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: ClientKeeper KeyPro for Multi-Browser (Enabled) = C:\windows\system32\npKeyPro.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - Extension: Entanglement = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd\2.7.9_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.3_0\
CHR - Extension: Poppit = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi\2.2_0\

O1 HOSTS File: ([2012/06/20 16:16:30 | 000,000,054 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 172.16.43.45 friendsterdb
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll File not found
O2 - BHO: (File Sanitizer for HP ProtectTools) - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
O2 - BHO: (HP ProtectTools Security Manager Extension) - {395610AE-C624-4f58-B89E-23733EA00F9A} - c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: [AMD AVT] C:\windows\System32\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [DTRun] c:\Program Files\Arcsoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [File Sanitizer] C:\Program Files\Hewlett-Packard\File Sanitizer\coreshredder.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPPowerAssistant] C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe ()
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files\Symantec\Norton Online Backup\Activation\NobuActivation.exe (Symantec Corporation)
O4 - HKLM..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe (PDF Complete Inc)
O4 - HKLM..\Run: [QLBController] C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [VMware hqtray] C:\Program Files\VMware\VMware Player\hqtray.exe (VMware, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-325877220-3748803948-952250591-1002\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-325877220-3748803948-952250591-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-325877220-3748803948-952250591-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll File not found
O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O15 - HKLM\..Trusted Domains: //about.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //Exclude.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //LanguageSelection.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //Message.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //MyAgttryCmd.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //MyAgttryNag.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //MyNotification.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //NOCLessUpdate.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //quarantine.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //ScanNow.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //strings.vbs/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //Template.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //Update.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //VirFound.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafee.com ([*] http in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafee.com ([*] https in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafeeasap.com ([betavscan] http in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafeeasap.com ([betavscan] https in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafeeasap.com ([vs] http in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafeeasap.com ([vs] https in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafeeasap.com ([www] http in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafeeasap.com ([www] https in Trusted sites)
O15 - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..Trusted Domains: alipay.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..Trusted Domains: alipay.com ([]https in Trusted sites)
O15 - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..Trusted Domains: alisoft.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..Trusted Domains: alisoft.com ([]https in Trusted sites)
O15 - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..Trusted Domains: taobao.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..Trusted Domains: taobao.com ([]https in Trusted sites)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/Plants%20vs.%20Zombies/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1FAF427B-1EE5-43D3-A023-3009142AFCD9} https://ost.maybank2u.com.my/MBBWecos/Cab/csoex_mbb.cab (CS Order Entry Control (MBB))
O16 - DPF: {39461460-2552-4D51-A062-3AB6A7B902E9} http://img.shinhan.com/shttp/install/70045/down/INIS70.cab (INISAFE Updater Control)
O16 - DPF: {477D5B9A-6479-44F8-9718-9340119B0308} http://www.hanabank.com/resource/download/veraport/down/veraport20.cab (Veraport20Ctl Class)
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} https://download.alipay.com/aliedit/aliedit/2401/aliedit.cab (EditCtrl Class)
O16 - DPF: {48ECCD73-123C-4C25-A64C-76E8E8A30CAF} http://mpi.dacom.net/XPayMPI/XPayMPIOCX.cab (XPayMPIOCX Control)
O16 - DPF: {5EC2D418-1B2A-40E6-904C-CA8B7ADB3682} https://ost.maybank2u.com.my/MBBWecos/Cab/csta.cab (csta Control)
O16 - DPF: {6CE20149-ABE3-462E-A1B4-5B549971AA38} Reg Error: Key error. (XecureCKKB Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {92FD95E5-99AB-403A-98F9-53521AAB82A0} http://www.cybermap.co.kr/cm2000/company2/kyochonck/CYBERMAP_ASP2_KYOCHONCK.cab (CYBERMAP_ASP2_KYOCHONCK Control)
O16 - DPF: {967386A1-409E-431A-A93A-FB5FEFF86A58} http://fx.keb.co.kr/veraport/veraport.cab (AXMObjectCtl Class)
O16 - DPF: {B9B2EE1A-E314-4338-A305-BE845EACB113} https://ost.maybank2u.com.my/MBBWecos/Cab/csw25.cab (CyberStock 250)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.4.2/jinstall-1_4_2_03-windows-i586.cab (Java Plug-in 1.4.2_03)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Plants%20vs.%20Zombies/Images/armhelper.ocx (ArmHelper Control)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} https://www.vpay.co.kr/kvpfiles_vista/KVPISPCTLD_VISTA.cab (KvpIspCtlD Control)
O16 - DPF: {F025D01A-28DC-4C14-8253-7F663864825F} http://211.57.102.21/ZaolmapClient.cab (ZaolmapClient Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{738E1823-B922-4CDC-B206-AB4F49100175}: DhcpNameServer = 10.0.5.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7409A480-2E91-46C5-B90C-749F041A61C2}: DhcpNameServer = 192.168.100.242 192.168.100.240
O18 - Protocol\Handler\s-http {D37E6C5F-1C0F-47C0-A3B6-403EEC555402} - C:\Program Files\INITECH\SHTTP\InitechSHTTPInterface.10121.dll ((c) INITECH)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\DeviceNP: DllName - (DeviceNP.dll) - C:\windows\System32\DeviceNP.dll (Hewlett-Packard Limited)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.VMnc - C:\windows\System32\vmnc.dll (VMware, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/06/20 16:20:13 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Admin\Documents\OTL.exe
[2012/06/20 09:35:24 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{87709746-F0AF-4E87-B88E-A55CEC9D5478}
[2012/06/20 09:35:13 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{6DCD8328-3DD4-4034-81ED-17105AC0480E}
[2012/06/20 09:23:37 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012/06/20 09:18:39 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Windows Live
[2012/06/20 00:38:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WCF RIA Services V1.0 SP1
[2012/06/20 00:38:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 4 SDK
[2012/06/20 00:37:23 | 000,000,000 | ---D | C] -- C:\ProgramData\VS
[2012/06/20 00:13:16 | 000,000,000 | ---D | C] -- C:\windows\System32\SPReview
[2012/06/20 00:11:03 | 000,000,000 | ---D | C] -- C:\windows\System32\EventProviders
[2012/06/20 00:08:43 | 000,000,000 | ---D | C] -- C:\FRST
[2012/06/19 14:19:07 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/06/19 13:14:18 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\temp
[2012/06/19 13:03:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox
[2012/06/19 12:50:48 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe
[2012/06/19 12:50:48 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe
[2012/06/19 12:50:48 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe
[2012/06/19 12:47:40 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/06/19 12:46:42 | 000,000,000 | ---D | C] -- C:\windows\erdnt
[2012/06/19 12:40:23 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG Secure Search
[2012/06/19 12:30:00 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\AVG2012
[2012/06/19 11:34:46 | 010,142,944 | ---- | C] (OPSWAT, Inc.) -- C:\Users\Admin\Documents\AppRemover.exe
[2012/06/19 11:09:06 | 004,560,591 | R--- | C] (Swearware) -- C:\Users\Admin\Desktop\ComboFix.exe
[2012/06/19 09:45:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\AVG Secure Search
[2012/06/19 09:45:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2012/06/19 09:45:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AVG Secure Search
[2012/06/19 09:44:55 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012/06/19 09:44:19 | 000,000,000 | ---D | C] -- C:\$AVG
[2012/06/19 09:44:18 | 000,000,000 | ---D | C] -- C:\windows\System32\drivers\AVG
[2012/06/19 05:33:36 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012/06/18 20:59:47 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\hpqlog
[2012/06/18 20:35:54 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2012/06/18 17:49:18 | 000,000,000 | -HSD | C] -- C:\windows\System32\%APPDATA%
[2012/06/11 17:23:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Apps Sync
[2012/06/07 09:52:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012/06/07 09:52:04 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2012/05/30 11:04:45 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\mol3.molsolutions.com.pfx

========== Files - Modified Within 30 Days ==========

[2012/06/20 16:26:12 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012/06/20 16:22:08 | 000,020,944 | ---- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/20 16:22:08 | 000,020,944 | ---- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/20 16:21:05 | 000,000,884 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/20 16:21:02 | 000,000,885 | ---- | M] () -- C:\Users\Admin\Documents\hosts
[2012/06/20 16:20:04 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Documents\OTL.exe
[2012/06/20 16:16:30 | 000,000,054 | ---- | M] () -- C:\windows\System32\drivers\etc\hosts
[2012/06/20 16:10:15 | 000,000,880 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/20 16:09:20 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012/06/20 16:09:10 | 2402,885,632 | -HS- | M] () -- C:\hiberfil.sys
[2012/06/20 16:09:08 | 374,022,632 | ---- | M] () -- C:\windows\MEMORY.DMP
[2012/06/20 15:48:00 | 000,000,908 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-325877220-3748803948-952250591-1002UA.job
[2012/06/20 15:29:33 | 000,028,672 | ---- | M] () -- C:\Users\Admin\Documents\Notice Digicash will be in maintenance at 20 June 2012.msg
[2012/06/20 09:14:37 | 000,883,956 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012/06/20 09:14:37 | 000,205,796 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012/06/20 03:06:46 | 000,415,608 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2012/06/19 22:48:06 | 000,000,856 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-325877220-3748803948-952250591-1002Core.job
[2012/06/19 17:35:56 | 000,003,454 | ---- | M] () -- C:\Users\Admin\Documents\rptapr.htm
[2012/06/19 17:24:10 | 000,003,455 | ---- | M] () -- C:\Users\Admin\Documents\rptmay.htm
[2012/06/19 17:12:42 | 000,003,560 | ---- | M] () -- C:\Users\Admin\Documents\rpt.htm
[2012/06/19 11:35:08 | 010,142,944 | ---- | M] (OPSWAT, Inc.) -- C:\Users\Admin\Documents\AppRemover.exe
[2012/06/19 11:09:10 | 004,560,591 | R--- | M] (Swearware) -- C:\Users\Admin\Desktop\ComboFix.exe
[2012/06/19 10:11:34 | 000,034,764 | ---- | M] () -- C:\Users\Admin\AppData\Local\dt.dat
[2012/06/19 07:42:52 | 000,875,626 | ---- | M] () -- C:\Users\Admin\Documents\FRST.exe
[2012/06/19 05:33:15 | 000,139,264 | ---- | M] () -- C:\Users\Admin\Documents\SystemLook.exe
[2012/06/18 20:37:34 | 000,001,945 | ---- | M] () -- C:\windows\epplauncher.mif
[2012/06/18 19:49:23 | 001,108,857 | ---- | M] () -- C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix1.pdf
[2012/06/15 11:48:45 | 000,380,674 | ---- | M] () -- C:\Users\Admin\Documents\seafprocedure.pdf
[2012/06/15 11:48:38 | 000,402,665 | ---- | M] () -- C:\Users\Admin\Documents\seafquotation.pdf
[2012/06/15 11:43:20 | 000,388,972 | ---- | M] () -- C:\Users\Admin\Documents\airfprocedure.pdf
[2012/06/15 11:43:00 | 000,401,974 | ---- | M] () -- C:\Users\Admin\Documents\airfquotation.pdf
[2012/06/12 09:48:12 | 000,002,402 | ---- | M] () -- C:\Users\Admin\Desktop\Google Chrome.lnk
[2012/06/12 08:53:49 | 000,000,320 | ---- | M] () -- C:\windows\tasks\HPCeeScheduleForAdmin.job
[2012/06/07 09:52:07 | 000,001,990 | ---- | M] () -- C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/06/07 09:52:07 | 000,001,088 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/06/01 21:14:27 | 000,920,745 | ---- | M] () -- C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix.pdf
[2012/06/01 14:49:11 | 001,041,870 | ---- | M] () -- C:\Users\Admin\Documents\Microsoft.Lead2pass.70-516.v2012-05-31.by.Johny.217q.vce
[2012/05/30 16:41:12 | 000,000,358 | ---- | M] () -- C:\Users\Admin\Documents\bt.htm
[2012/05/30 11:04:26 | 000,001,800 | ---- | M] () -- C:\Users\Admin\Documents\mol3.molsolutions.com.pfx.zip
[2012/05/28 17:15:16 | 000,879,616 | ---- | M] () -- C:\Users\Admin\Documents\Copy (1) of Payment Flows.vsd
[2012/05/28 16:42:35 | 000,916,480 | ---- | M] () -- C:\Users\Admin\Documents\Payment Flows.vsd
[2012/05/28 14:54:35 | 000,362,496 | ---- | M] () -- C:\Users\Admin\Documents\RE Digicash Pricing.msg
[2012/05/27 01:28:09 | 001,865,201 | ---- | M] () -- C:\Users\Admin\Documents\Microsoft.TestKing.70-516.v2012-02-03.by.Lyudmyla.v190q.vce
[2012/05/27 01:26:46 | 001,856,837 | ---- | M] () -- C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-03-16.by.Edom.195q.vce
[2012/05/27 01:25:15 | 001,868,219 | ---- | M] () -- C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix.193q.vce
[2012/05/21 23:59:58 | 059,399,232 | ---- | M] () -- C:\Users\Admin\Documents\10264A-ENU-Allfiles.exe

========== Files Created - No Company Name ==========

[2012/06/20 16:21:01 | 000,000,885 | ---- | C] () -- C:\Users\Admin\Documents\hosts
[2012/06/20 16:13:26 | 000,000,830 | ---- | C] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012/06/20 15:29:32 | 000,028,672 | ---- | C] () -- C:\Users\Admin\Documents\Notice Digicash will be in maintenance at 20 June 2012.msg
[2012/06/20 09:26:47 | 000,002,432 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2012/06/19 17:35:56 | 000,003,454 | ---- | C] () -- C:\Users\Admin\Documents\rptapr.htm
[2012/06/19 17:24:09 | 000,003,455 | ---- | C] () -- C:\Users\Admin\Documents\rptmay.htm
[2012/06/19 16:56:46 | 000,003,560 | ---- | C] () -- C:\Users\Admin\Documents\rpt.htm
[2012/06/19 12:50:48 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe
[2012/06/19 12:50:48 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe
[2012/06/19 12:50:48 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe
[2012/06/19 12:50:48 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe
[2012/06/19 12:50:48 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe
[2012/06/19 10:11:34 | 000,034,764 | ---- | C] () -- C:\Users\Admin\AppData\Local\dt.dat
[2012/06/19 07:42:57 | 000,875,626 | ---- | C] () -- C:\Users\Admin\Documents\FRST.exe
[2012/06/19 05:33:27 | 000,139,264 | ---- | C] () -- C:\Users\Admin\Documents\SystemLook.exe
[2012/06/18 20:36:05 | 000,001,915 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2012/06/15 11:48:46 | 000,380,674 | ---- | C] () -- C:\Users\Admin\Documents\seafprocedure.pdf
[2012/06/15 11:48:40 | 000,402,665 | ---- | C] () -- C:\Users\Admin\Documents\seafquotation.pdf
[2012/06/15 11:43:55 | 000,401,974 | ---- | C] () -- C:\Users\Admin\Documents\airfquotation.pdf
[2012/06/15 11:43:42 | 000,388,972 | ---- | C] () -- C:\Users\Admin\Documents\airfprocedure.pdf
[2012/06/07 09:52:07 | 000,001,100 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/06/04 01:53:45 | 001,108,857 | ---- | C] () -- C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix1.pdf
[2012/06/01 21:14:27 | 000,920,745 | ---- | C] () -- C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix.pdf
[2012/06/01 14:49:19 | 001,041,870 | ---- | C] () -- C:\Users\Admin\Documents\Microsoft.Lead2pass.70-516.v2012-05-31.by.Johny.217q.vce
[2012/05/30 16:41:11 | 000,000,358 | ---- | C] () -- C:\Users\Admin\Documents\bt.htm
[2012/05/30 11:04:06 | 000,001,800 | ---- | C] () -- C:\Users\Admin\Documents\mol3.molsolutions.com.pfx.zip
[2012/05/28 17:02:32 | 000,879,616 | ---- | C] () -- C:\Users\Admin\Documents\Copy (1) of Payment Flows.vsd
[2012/05/28 16:42:33 | 000,916,480 | ---- | C] () -- C:\Users\Admin\Documents\Payment Flows.vsd
[2012/05/28 14:54:34 | 000,362,496 | ---- | C] () -- C:\Users\Admin\Documents\RE Digicash Pricing.msg
[2012/05/27 01:28:06 | 001,865,201 | ---- | C] () -- C:\Users\Admin\Documents\Microsoft.TestKing.70-516.v2012-02-03.by.Lyudmyla.v190q.vce
[2012/05/27 01:26:43 | 001,856,837 | ---- | C] () -- C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-03-16.by.Edom.195q.vce
[2012/05/27 01:25:19 | 001,868,219 | ---- | C] () -- C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix.193q.vce
[2012/05/21 23:57:54 | 059,399,232 | ---- | C] () -- C:\Users\Admin\Documents\10264A-ENU-Allfiles.exe
[2012/05/02 10:04:40 | 000,038,430 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Comma Separated Values (Windows).ADR
[2012/04/15 12:34:12 | 000,000,168 | ---- | C] () -- C:\ProgramData\-FZ0g9DtPRuLMbnr
[2012/04/15 12:34:12 | 000,000,000 | ---- | C] () -- C:\ProgramData\-FZ0g9DtPRuLMbn
[2012/04/15 12:34:08 | 000,000,256 | ---- | C] () -- C:\ProgramData\FZ0g9DtPRuLMbn
[2012/04/06 09:21:42 | 000,204,952 | ---- | C] () -- C:\windows\System32\ativvsvl.dat
[2012/04/06 09:21:42 | 000,157,144 | ---- | C] () -- C:\windows\System32\ativvsva.dat
[2012/04/05 22:34:22 | 000,159,232 | ---- | C] () -- C:\windows\System32\clinfo.exe
[2012/03/09 14:06:14 | 000,024,576 | ---- | C] () -- C:\windows\System32\kdbsdk32.dll
[2012/03/05 16:16:04 | 000,087,552 | ---- | C] () -- C:\windows\System32\cpwmon2k.dll
[2012/01/11 05:10:08 | 000,601,728 | ---- | C] () -- C:\windows\System32\atiicdxx.dat
[2012/01/03 22:23:18 | 000,007,602 | ---- | C] () -- C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
[2012/01/01 21:23:07 | 000,009,994 | -HS- | C] () -- C:\Users\Admin\AppData\Local\j20wm44mssx6c68jnw5vxejp35847tgjo
[2012/01/01 21:23:07 | 000,009,994 | -HS- | C] () -- C:\ProgramData\j20wm44mssx6c68jnw5vxejp35847tgjo
[2012/01/01 21:04:45 | 000,010,120 | -HS- | C] () -- C:\Users\Admin\AppData\Local\fr1gt65txj52885ix1u64r8v365x8j108565a4e2g7grf
[2012/01/01 21:04:45 | 000,010,120 | -HS- | C] () -- C:\ProgramData\fr1gt65txj52885ix1u64r8v365x8j108565a4e2g7grf
[2011/12/12 09:35:24 | 000,000,000 | ---- | C] () -- C:\Users\Admin\AppData\Local\{52F8E5AF-8487-43F1-9BDE-2F39FE993B62}
[2011/10/04 09:58:44 | 000,055,864 | ---- | C] () -- C:\windows\System32\drivers\SCSK5.sys
[2011/09/13 06:06:16 | 000,003,917 | ---- | C] () -- C:\windows\System32\atipblag.dat
[2011/09/06 09:52:47 | 000,000,024 | ---- | C] () -- C:\windows\System32\scskConfigEH.ini
[2011/09/02 23:49:07 | 000,015,512 | ---- | C] () -- C:\windows\System32\IRTrace.dll
[2011/09/02 23:49:05 | 000,072,272 | ---- | C] () -- C:\windows\System32\cosa.dll
[2011/07/01 10:39:34 | 000,066,048 | ---- | C] () -- C:\windows\System32\PrintBrmUi.exe
[2010/07/15 10:14:48 | 001,205,544 | ---- | C] () -- C:\windows\System32\ISPPopUpDlg.exe
[2010/06/26 01:03:12 | 000,053,299 | ---- | C] () -- C:\windows\System32\pthreadVC.dll

========== LOP Check ==========

[2012/06/19 12:30:00 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\AVG2012
[2010/05/27 16:24:06 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\DigitalPersona
[2012/06/20 16:07:36 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FileZilla
[2010/06/07 23:11:16 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\SpinTop
[2010/05/31 14:17:17 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Subversion
[2012/05/07 18:21:05 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\WatchGuard
[2012/05/14 09:33:09 | 000,032,606 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/11/04 17:44:51 | 000,001,024 | ---- | M] () -- C:\.rnd
[2009/07/14 09:38:58 | 000,383,562 | RHS- | M] () -- C:\bootmgr
[2012/06/19 14:22:18 | 000,031,037 | ---- | M] () -- C:\ComboFix.txt
[2010/12/01 17:03:11 | 000,000,584 | ---- | M] () -- C:\errorVerify.log
[2012/06/20 16:09:10 | 2402,885,632 | -HS- | M] () -- C:\hiberfil.sys
[2010/05/31 12:52:31 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/06/28 09:30:22 | 000,000,292 | ---- | M] () -- C:\kmupdload.log
[2011/07/25 12:22:09 | 000,001,512 | ---- | M] () -- C:\Log.txt
[2011/07/23 10:09:52 | 000,000,136 | ---- | M] () -- C:\MerchantDetails.property
[2011/06/10 12:32:01 | 000,001,620 | ---- | M] () -- C:\molepointscard.txt
[2010/08/20 10:39:31 | 000,002,715 | ---- | M] () -- C:\molepointscard1.txt
[2010/05/31 12:52:31 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2012/06/20 16:09:09 | 3203,850,240 | -HS- | M] () -- C:\pagefile.sys
[2012/04/15 13:11:14 | 000,000,361 | ---- | M] () -- C:\rkill.log
[2009/10/20 04:43:06 | 000,047,104 | ---- | M] () -- C:\Thumbs.db
[2010/12/01 17:09:30 | 000,001,464 | ---- | M] () -- C:\Verify.log

< %systemroot%\Fonts\*.com >
[2009/07/14 12:52:25 | 000,026,040 | ---- | M] () -- C:\windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 12:52:25 | 000,026,489 | ---- | M] () -- C:\windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 12:52:25 | 000,029,779 | ---- | M] () -- C:\windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 12:52:25 | 000,043,318 | ---- | M] () -- C:\windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/11 05:31:19 | 000,000,065 | ---- | M] () -- C:\windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/14 09:15:05 | 000,071,168 | ---- | M] (CANON INC.) -- C:\windows\system32\spool\prtprocs\w32x86\CNBPP4.DLL
[2010/04/24 05:00:00 | 000,027,648 | ---- | M] (CANON INC.) -- C:\windows\system32\spool\prtprocs\w32x86\CNMPD9W.DLL
[2010/04/24 05:00:00 | 000,070,656 | ---- | M] (CANON INC.) -- C:\windows\system32\spool\prtprocs\w32x86\CNMPP9W.DLL
[2009/07/14 09:15:35 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2010/11/20 20:21:36 | 000,030,208 | ---- | M] (Microsoft Corporation) -- C:\windows\system32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 12:41:57 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2012/04/24 22:58:20 | 000,000,221 | -HS- | M] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2012/06/19 11:09:10 | 004,560,591 | R--- | M] (Swearware) -- C:\Users\Admin\Desktop\ComboFix.exe
[2012/04/15 13:16:27 | 000,399,264 | ---- | M] (Bleeping Computer, LLC) -- C:\Users\Admin\Desktop\unhide.exe
[2010/11/02 18:29:52 | 109,195,048 | ---- | M] (VMware, Inc.) -- C:\Users\Admin\Desktop\VMware-player-3.1.2-301548.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\tasks\*.* >
[2012/06/20 16:26:12 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012/06/20 16:10:15 | 000,000,880 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/20 16:21:05 | 000,000,884 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/19 22:48:06 | 000,000,856 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-325877220-3748803948-952250591-1002Core.job
[2012/06/20 15:48:00 | 000,000,908 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-325877220-3748803948-952250591-1002UA.job
[2012/06/12 08:53:49 | 000,000,320 | ---- | M] () -- C:\windows\tasks\HPCeeScheduleForAdmin.job
[2012/06/20 16:09:49 | 000,000,006 | -H-- | M] () -- C:\windows\tasks\SA.DAT
[2012/05/14 09:33:09 | 000,032,606 | ---- | M] () -- C:\windows\tasks\SCHEDLGU.TXT

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/11 05:20:04 | 000,000,802 | ---- | M] () -- C:\windows\ADDINS\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2012/06/20 07:39:41 | 000,000,402 | -HS- | M] () -- C:\Users\Admin\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2012/04/15 12:55:15 | 000,000,000 | ---- | M] () -- C:\ProgramData\-FZ0g9DtPRuLMbn
[2012/04/15 12:55:15 | 000,000,168 | ---- | M] () -- C:\ProgramData\-FZ0g9DtPRuLMbnr
[2012/01/01 21:23:07 | 000,010,120 | -HS- | M] () -- C:\ProgramData\fr1gt65txj52885ix1u64r8v365x8j108565a4e2g7grf
[2012/04/15 12:54:04 | 000,000,256 | ---- | M] () -- C:\ProgramData\FZ0g9DtPRuLMbn
[2012/01/02 01:23:38 | 000,009,994 | -HS- | M] () -- C:\ProgramData\j20wm44mssx6c68jnw5vxejp35847tgjo

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /I " " /c >

< dir /b "%systemroot%\*.exe" | find /I " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\LastSuccessTime /rs >

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:7D6EC5BE
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMPFC5A2B2
< End of report >

 

[happycan]

OTL Extras logfile created on: 6/20/2012 4:23:55 PM - Run 1
OTL by OldTimer - Version 3.2.50.0 Folder = C:\Users\Admin\Documents
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.98 Gb Total Physical Memory | 1.21 Gb Available Physical Memory | 40.67% Memory free
5.97 Gb Paging File | 3.22 Gb Available in Paging File | 53.91% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 280.80 Gb Total Space | 162.45 Gb Free Space | 57.85% Space Free | Partition Type: NTFS
Drive F: | 1.99 Gb Total Space | 1.48 Gb Free Space | 74.69% Space Free | Partition Type: FAT32
Drive Y: | 1365.97 Gb Total Space | 577.03 Gb Free Space | 42.24% Space Free | Partition Type: NTFS
Drive Z: | 1365.97 Gb Total Space | 577.03 Gb Free Space | 42.24% Space Free | Partition Type: NTFS

Computer Name: ENOPL4JNA2HRF | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0294BB2F-6178-459D-8C46-8D1C40D6AD6B}" = rport=445 | protocol=6 | dir=out | app=system |
"{057550CC-1C7E-4C7B-A2F8-3A8DDC978C8C}" = lport=138 | protocol=17 | dir=in | app=system |
"{08E024BB-596A-4DFF-A430-159062EB67CE}" = lport=10243 | protocol=6 | dir=in | app=system |
"{19A5737B-0BEE-43C8-BCD3-3CC714AA4FD3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{25B9D31D-64EC-44F5-900B-17177C3E5D3C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{295EF879-34FC-4A05-A484-51AA1443280E}" = lport=445 | protocol=6 | dir=in | app=system |
"{2FA65B31-3A9D-4C20-AFC6-469495F0EF44}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4048E338-ED31-4476-81A6-BF98C6DB2770}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{4084E937-EAAA-47EE-9520-7BE7CE434C09}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4BF5EB07-06A2-40E2-B5B6-244EF5C49A0F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{5456EA1E-AF45-48BD-9C96-AB99A6CCF1D9}" = lport=139 | protocol=6 | dir=in | app=system |
"{6364B77A-8796-4078-B3CC-5963A3E70B4F}" = rport=139 | protocol=6 | dir=out | app=system |
"{6EFD3216-D4DB-448C-81DA-E8838C66FFD2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{70AF949A-598B-4415-8D2B-0D724B262182}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{7C7BD74E-D59D-40F9-8481-A74C4729E9DD}" = rport=138 | protocol=17 | dir=out | app=system |
"{86444BB3-291D-4D31-A046-BB4AA3243C28}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AF8150A9-8B4A-4262-900E-D368942052B3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BE10AB93-C4A6-464B-BE93-069E778BFF99}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C232D951-55E7-4D04-9346-F88A07FC0B22}" = lport=137 | protocol=17 | dir=in | app=system |
"{C428A183-FD79-40B5-990D-895328F43AC8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CF0676E6-E2EC-438A-9741-7029DEBD00CE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F534D21D-02A4-4E48-A237-A3745ED5E6D3}" = rport=137 | protocol=17 | dir=out | app=system |
"{F9C1EEE5-72B7-40C6-BC7C-64E9DF7DEB39}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{003C7A18-60D9-4C89-94D8-DE42C1AA1D76}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{02A4D600-582A-4C14-ADFE-C125CF0CB18F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1473D86F-6F04-46A3-9153-CD04272511DC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{4849799C-D8E9-4360-8F9A-6B5F2BCC7EA4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{56E808A1-BFD0-4B79-B567-B9FA848D697F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{61FB8AD2-C831-45AB-9DFB-D685C3A8300D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{62F27534-2769-4D2F-B42F-E96E62F64F44}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{65901CFC-D156-4C8F-90EA-C26D256CA195}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{68F6992D-6E9D-4F14-88EC-3E0B8BEC7EFF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{777A783F-F37D-4956-97D7-427B4F228A26}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{8642AF85-31DC-4BB3-8E9D-1E478C224084}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A5589677-56C4-46C1-A86B-1F0B5425786F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB3FBA72-52C3-4476-9A38-230DBE05659B}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BC7833D1-AE4B-4CAB-BDD5-6EA587E5C763}" = protocol=6 | dir=out | app=system |
"{CE504808-152F-4073-8BB9-0F8E7C4D30C6}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D3648D1D-2BA3-4973-9B7E-EDC907B6E342}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E8715BB0-E132-4617-B344-62E03BFE2C1C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E926E57D-011D-4F63-BCC5-FFCFDC28D091}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{EFA98652-B437-42AA-B7D3-EFFD71ED4ECD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F7DCF881-DB9D-4779-8D1C-CCCBAC7C73FF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{1B7F41C1-B0D5-4B2A-AD10-961292CFF466}C:\program files\windows live\messenger\msnmsgr.exe" = protocol=6 | dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"UDP Query User{6717EBF8-C112-404D-AC29-8EBD1F638BB1}C:\program files\windows live\messenger\msnmsgr.exe" = protocol=17 | dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{36C95AD3-D330-4BAA-884A-9F3EFD15A5EA}" = Corel Home Office
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01C5A10F-AD9B-405B-853A-6659841A1242}" = Microsoft SQL Server 2008 Policies
"{0279C882-B150-44B6-A769-A7C8A2F31CE3}" = HP Wireless Assistant
"{02D0DF6E-BE8D-66B0-3C3F-ED0F395DF765}" = CCC Help Finnish
"{033B535A-1AFF-435D-B8D9-B0B83A800569}" = Microsoft SQL Server 2008 Full text search
"{04801E42-B1A6-4C52-9F3D-CADB5A050433}" = HP Software Setup
"{0497B553-0E3F-4CCD-BE13-E28F1A54B318}" = HP HotKey Support
"{05855322-BE43-41FE-B583-D3AE0C326D58}" = Microsoft Silverlight 4 SDK
"{05EC21B8-4593-3037-A781-A6B5AFFCB19D}" = Microsoft Windows SDK for Visual Studio 2008 .NET Framework Tools - enu
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{09C52940-A4D1-4409-A7CC-1AAE630CF578}" = Microsoft SQL Server 2008 R2 Transact-SQL Language Service
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0BE273CD-AAB9-361B-8C32-D955EAC929E3}" = Microsoft Visual Studio 2010 SharePoint Developer Tools
"{0C19D563-5F25-4621-BF10-01F741BD283F}" = Microsoft SQL Server Compact 3.5 SP1 Design Tools English
"{0C262D84-FFA4-4621-8ED7-41F8287369F5}" = Google Apps Migration For Microsoft Outlook® 2.3.12.34
"{0DF3AE91-E533-3960-8516-B23737F8B7A2}" = Visual C++ 2008 x64 Runtime - (v9.0.30729)
"{0DF3AE91-E533-3960-8516-B23737F8B7A2}.vc_x64runtime_30729_01" = Visual C++ 2008 x64 Runtime - v9.0.30729.01
"{0F37D969-1260-419E-B308-EF7D29ABDE20}" = Web Deployment Tool
"{0F842B77-56EA-4AAF-8295-81A022350B5E}" = Microsoft Security Client
"{112C23F2-C036-4D40-BED4-0CB47BF5555C}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP250_series" = Canon MP250 series MP Drivers
"{1389C6A4-4965-4AEC-9175-08B54A10FA48}" = Microsoft SQL Server 2005 Mobile [ENU] Developer Tools
"{1395B38D-5889-19E5-D02E-BD1A02BF373B}" = CCC Help Spanish
"{13D5F9B6-D70A-DCCA-A00D-E43839CDFA83}" = CCC Help Chinese Standard
"{1410D707-A9C3-2E70-9476-2427EC18134F}" = CCC Help Turkish
"{142D2DFA-1FB7-41B9-8509-DAB5F3978CE4}" = Privacy Manager for HP ProtectTools
"{14DD7530-CCD2-3798-B37D-3839ED6A441C}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{16D0F2D2-242C-4885-BEF1-4B1655C141AE}" = Bing Bar
"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2
"{190A7D93-3823-439C-91B9-ADCE3EC2A6A2}" = ArcSoft Webcam Sharing Manager
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{196E77C5-F524-4B50-BD1A-2C21EEE9B8F7}" = Microsoft SQL Server 2008 Common Files
"{1A1E33D2-9824-454A-B8CB-50072118635A}" = Corel Home Office - CS Templates
"{1AA5BD63-6614-44B2-88A7-605191EDB835}" = Dotfuscator Software Services - Community Edition
"{1D11E96F-0405-4B99-8356-5750B1D9FAE9}" = Corel Home Office - JP Templates
"{1D423B7C-A57F-DC76-DBED-43DCE9BAFA0E}" = ccc-utility
"{1E6219D4-027E-47EE-AB83-DD2F26E31A32}" = HP Setup
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2012098D-EEE9-4769-8DD3-B038050854D4}" = Microsoft Silverlight 3 SDK
"{2020045B-8DCF-4449-8D5C-EB5BA37440F1}" = Microsoft SQL Server 2008 Management Studio
"{22E23C71-C27A-3F30-8849-BB6129E50679}" = Visual C++ 2008 IA64 Runtime - (v9.0.30729)
"{22E23C71-C27A-3F30-8849-BB6129E50679}.vc_i64runtime_30729_01" = Visual C++ 2008 IA64 Runtime - v9.0.30729.01
"{23F70562-02F4-4805-ACF5-6E52BAD167C2}" = Microsoft SQL Server 2008 Reporting Services
"{241F2BF7-69EB-42A4-9156-96B2426C7504}" = Microsoft SQL Server Compact 3.5 for Devices ENU
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33
"{26D19512-874B-4EDA-B7F1-779850B2AD5A}" = Corel Home Office - CT Templates
"{2712DAD6-C1F7-4295-B06E-17D6DC62EC20}" = HP Software Framework
"{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition
"{275ABBA2-4817-4443-9AB8-ED43CA9AAA17}" = Microsoft SQL Server 2008 BI Development Studio
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{291B3A3B-F808-45B8-8113-DF232FCB6C82}" = Microsoft .NET Compact Framework 3.5
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2D992E01-604B-472C-A883-1DDA105A24D5}_is1" = Veraport20(Security module management) - 2,5,0,4
"{2DA697D7-FED3-4DE2-A174-92A2A12F9688}" = HP SoftPaq Download Manager
"{2F8B731A-5F2D-3EA8-8B25-C3E5E43F4BDB}" = Microsoft Visual C++ Compilers 2010 Standard - enu - x86
"{33AE9E89-47C9-4A0D-9E9D-BDD6966A3804}" = Microsoft SQL Server 2008 RsFx Driver
"{33C9F24B-1D92-4632-A915-81E3BB1D5D6B}" = Theft Recovery
"{3513DD3C-7680-4C7C-BF18-BA375D5F4132}" = Pre-Boot Security for HP ProtectTools
"{35A3A4F4-B792-11D6-A78A-00B0D0142030}" = Java 2 SDK, SE v1.4.2_03
"{36C95AD3-D330-4BAA-884A-9F3EFD15A5EA}" = Corel Home Office
"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
"{39FE455F-9478-451B-9420-73C15143DF8E}" = Corel Home Office - IPM
"{3A9FC03D-C685-4831-94CF-4EDFD3749497}" = Microsoft SQL Server Compact 3.5 SP2 ENU
"{3BC1954F-F5C9-4ED2-BB2A-BAEEF4DAC74D}" = TortoiseSVN 1.6.3.16613 (32 bit)
"{3BDB9B89-56B5-4953-B052-AEB75FCBFC93}" = HP User Guides 0189
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3F8D9A47-9C50-3F46-8F12-B92DD5CA0A2E}" = Visual C++ 2008 x86 Runtime - (v9.0.30729.6161)
"{3F8D9A47-9C50-3F46-8F12-B92DD5CA0A2E}.vc_x86runtime_30729_6161" = Visual C++ 2008 x86 Runtime - v9.0.30729.6161
"{40416836-56CC-4C0E-A6AF-5C34BADCE483}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools
"{40624553-811E-400E-B69B-38D8926A66BD}" = SonicWALL Global VPN Client
"{40F34A1C-65A2-4163-98CE-A0D0646CABEF}" = Microsoft SQL Server 2008 Integration Services
"{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}" = HP Advisor
"{4112625F-2D38-49EF-924F-48511BC5CD34}" = Microsoft SQL Server 2008 Database Engine Services
"{41281565-7B55-4374-AC93-A1A93CA42D43}" = IPG2 Merchant Software
"{41A01180-D9FD-3428-9FD6-749F4C637CBF}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"{437AB8E0-FB69-4222-B280-A64F3DE22591}" = Microsoft Visual Studio 2005 Professional Edition - ENU
"{44D4AF75-6870-41F5-9181-662EA05507E1}" = Microsoft Document Explorer 2005
"{46AFD359-AAE9-2843-B7CE-10FB46C76E99}" = CCC Help German
"{4815BD99-96A4-49FE-A885-DCF06E9E4E78}" = Microsoft SQL Server 2008 Database Engine Shared
"{495A8A3C-8FD0-4C46-9979-95C26181A1AB}" = HP Support Assistant
"{49E98741-B7A4-4A44-A536-6AFCA23106FE}" = Microsoft SQL Server 2008 Reporting Services
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A6F34E2-09E5-4616-B227-4A26A488A6F9}" = Microsoft SQL Server 2008 Common Files
"{4D28EFCF-5999-44D2-8D4E-AC643E76C33F}" = Microsoft SQL Server 2008 Client Tools
"{4F44B5AE-82A6-4A8A-A3E3-E24D489728E3}" = Microsoft SQL Server 2008 Native Client
"{4F765E00-EE1C-4392-93B4-54310358F41A}" = ArcSoft TotalMedia
"{5017D60D-C0A5-4CC8-8D2F-0BDA1ADF39D0}" = Corel Home Office - Templates1
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{55B52830-024A-443E-AF61-61E1E71AFA1B}" = Device Access Manager for HP ProtectTools
"{5746E4F9-77C6-47E8-A737-A5975A57B4AA}" = Corel Home Office - KR Templates
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{57BB52B7-6B7B-31F3-89F4-4EE8FE5CEF6D}" = Microsoft Help Viewer 1.1
"{57D5FAFB-30E8-63EB-D4F7-07298597578F}" = Catalyst Control Center
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5AB7D739-1735-3A9E-BE73-C43507CB4E6F}" = Microsoft Visual Studio 2010 Service Pack 1
"{5BF8E079-D6E2-4323-B794-75152371122A}" = Windows 7 Default Setting
"{5CAA69CD-9C1B-5604-B14B-8FAC2BC5E228}" = Catalyst Control Center InstallProxy
"{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}" = Microsoft Visual C++ 2010 x86 Runtime - 10.0.40219
"{5DCBD841-3768-4D3A-8517-65BFB87E05D3}" = Validity Fingerprint Driver
"{5E903AAE-A6E7-4972-B74C-E38663E69540}" = Google Apps Sync™ for Microsoft Outlook® 3.1.94.203
"{60D46DEE-5221-47AA-B978-BA25C5D9F560}" = Microsoft SQL Server 2008 Client Tools
"{6249567F-65C3-4EE7-B023-E4FA035B0520}" = Microsoft SQL Server 2008 Analysis Services
"{624D63F7-BE19-6147-376A-581DA8B7A216}" = AMD Media Foundation Decoders
"{631471BE-DEAB-454B-A9AC-CE3EB42C28B3}" = Microsoft ASP.NET Web Pages
"{64c5b887-b5ee-42b8-8596-78905a6b5f1f}" = Microsoft Windows SDK for Visual Studio 2008 SDK Reference Assemblies and IntelliSense
"{64CDE8F2-3791-46F5-BAD2-72FFF5252FAB}" = Microsoft SQL Server Compact 3.5 SP1 Query Tools English
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{659211A9-C390-4EB6-8FA8-3F6485905302}" = PayPal ASP.NET SDK
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{670234D0-42BE-493E-B3EB-6B5275530461}" = Corel Home Office
"{6753B40C-0FBD-3BED-8A9D-0ACAC2DCD85D}" = Microsoft Document Explorer 2008
"{67C090D6-109A-47D7-8DED-4160C4D96F32}" = HP 3D DriveGuard
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{6C531060-84FB-4F96-8F33-29DF020632EB}" = Microsoft .NET Compact Framework 1.0 SP3 Developer
"{6C9F6D23-E9AD-43C9-B43A-011562AAF876}" = Windows Mobile 5.0 SDK R2 for Pocket PC
"{6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}" = Microsoft Visual Studio Macro Tools
"{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}" = File Sanitizer For HP ProtectTools
"{6ED37A91-7710-3183-BE50-AB043FF6689E}" = Microsoft Team Foundation Server 2010 Object Model - ENU
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{7322467B-FAD1-5529-C4EF-7EA4BC17C0A2}" = CCC Help Korean
"{74E4B282-F25A-53A1-BBA5-7A3EFB90FAF4}" = CCC Help Japanese
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{77F1F8AD-51B8-4490-AEEC-BF480073E0FC}" = Microsoft SQL Server 2008 R2 Management Objects
"{7861911B-4270-498A-8F7A-FCF0570F485D}" = HP QuickWeb
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7A56D81D-6406-40E7-9184-8AC1769C4D69}" = Microsoft SQL Server 2008 R2 Data-Tier Application Project
"{7B33F480-496D-334A-BAC2-205DEC0CBC2D}" = Visual C++ 2008 x86 Runtime - (v9.0.30729.4148)
"{7B33F480-496D-334A-BAC2-205DEC0CBC2D}.vc_x86runtime_30729_4148" = Visual C++ 2008 x86 Runtime - v9.0.30729.4148
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7EFBE3EE-3EC2-96F4-560C-E56E65F2183C}" = AMD Accelerated Video Transcoding
"{827990C7-4D30-3627-A2D1-5FFA09198BB2}" = Microsoft Visual Studio 2010 Office Developer Tools (x86)
"{82EF29B1-9B60-4142-A155-0599216DD053}" = LightScribe System Software
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{842FAF7C-50EF-4463-9B8F-6222E1384D7D}" = Microsoft Windows SDK for Visual Studio 2008 Headers and Libraries
"{85467CBC-7A39-33C9-8940-D72D9269B84F}" = Microsoft Visual F# 2.0 Runtime
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{871732B3-1EE5-4C54-8462-8BFF516880B7}" = HP ESU for Microsoft Windows 7
"{877B76B2-F83F-4F5A-B28D-3F398641ADB6}" = Microsoft SQL Server System CLR Types
"{89D7DD37-5A15-46E0-9C3C-A0004C4F1A38}" = Drive Encryption for HP ProtectTools
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A0590BF-9036-47D5-BBE7-50590649760C}" = HP ProtectTools Security Manager
"{8AC115AA-27D2-4024-6E7D-D9FCD93D0487}" = CCC Help Portuguese
"{8B49BD5E-C896-4F65-95DC-3F84424226E8}" = HP QuickLook
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8FB53850-246A-3507-8ADE-0060093FFEA6}" = Visual Studio Tools for the Office system 3.0 Runtime
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0015-041E-0000-0000000FF1CE}" = Microsoft Office Access MUI (Thai) 2007
"{90120000-0015-041E-0000-0000000FF1CE}_PROHYBRIDR_{54F94746-3663-43F2-933C-B4DC35793565}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-041E-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Thai) 2007
"{90120000-0016-041E-0000-0000000FF1CE}_PROHYBRIDR_{54F94746-3663-43F2-933C-B4DC35793565}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-041E-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Thai) 2007
"{90120000-0018-041E-0000-0000000FF1CE}_PROHYBRIDR_{54F94746-3663-43F2-933C-B4DC35793565}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-041E-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Thai) 2007
"{90120000-0019-041E-0000-0000000FF1CE}_PROHYBRIDR_{54F94746-3663-43F2-933C-B4DC35793565}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-041E-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Thai) 2007
"{90120000-001A-041E-0000-0000000FF1CE}_PROHYBRIDR_{54F94746-3663-43F2-933C-B4DC35793565}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-041E-0000-0000000FF1CE}" = Microsoft Office Word MUI (Thai) 2007
"{90120000-001B-041E-0000-0000000FF1CE}_PROHYBRIDR_{54F94746-3663-43F2-933C-B4DC35793565}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-041E-0000-0000000FF1CE}" = Microsoft Office Proof (Thai) 2007
"{90120000-001F-041E-0000-0000000FF1CE}_PROHYBRIDR_{E9E01036-7842-437F-B99E-984D738A81DA}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0021-0000-0000-0000000FF1CE}" = Microsoft Office Visual Web Developer 2007
"{90120000-0021-0409-0000-0000000FF1CE}" = Microsoft Office Visual Web Developer MUI (English) 2007
"{90120000-0021-0409-0000-0000000FF1CE}_VisualWebDeveloper_{C00A9857-850C-4C68-A583-2EF4F24706F5}" = Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-002C-041E-0000-0000000FF1CE}" = Microsoft Office Proofing (Thai) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}_VisualWebDeveloper_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-041E-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Thai) 2007
"{90120000-006E-041E-0000-0000000FF1CE}_PROHYBRIDR_{7A723282-13D6-4C76-AAFD-3D20A35B2F60}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A4-0409-0000-0000000FF1CE}" = Microsoft Office 2003 Web Components
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}_VisualWebDeveloper_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.VISIOR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.VISIOR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.VISIOR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-0000-0000000FF1CE}_Office14.VISIOR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0054-0409-0000-0000000FF1CE}" = Microsoft Office Visio MUI (English) 2010
"{90140000-0054-0409-0000-0000000FF1CE}_Office14.VISIOR_{CDC4310F-8189-485F-B47D-D972217CE173}" = Microsoft Office 2010 Language Pack Service Pack 1 (SP1)
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}_Office14.VISIOR_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}_Office14.VISIOR_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{908F82B4-3675-4011-B625-7573EA9067B2}" = IMail Client Apps
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91140000-0057-0000-0000-0000000FF1CE}" = Microsoft Office Visio 2010
"{91140000-0057-0000-0000-0000000FF1CE}_Office14.VISIOR_{01D8AE4B-A04D-47E5-81BF-E3F98B81B8C3}" = Microsoft Visio 2010 Service Pack 1 (SP1)
"{91EDBF6E-2260-646A-4D80-CB0802132736}" = Catalyst Control Center Localization All
"{931AED36-CF8A-F34F-8C13-5C19010DF6C6}" = CCC Help French
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9656F3AC-6BA9-43F0-ABED-F214B5DAB27B}" = Windows Mobile 5.0 SDK R2 for Smartphone
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{97CE8B73-AA5A-4987-A1BE-50DD1A187478}" = Microsoft Sync Framework SDK v1.0 SP1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A33B83D-FFC4-44CF-BEEF-632DECEF2FCD}" = Microsoft SQL Server Database Publishing Wizard 1.3
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C780DBC-F527-FC46-7719-C4B163F75A37}" = Catalyst Control Center InstallProxy
"{9E75789D-E176-A72B-DE9E-D2AE63FE601B}" = Catalyst Control Center Graphics Previews Common
"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = HP Integrated Module with Bluetooth wireless technology
"{9F711CB6-8E76-63DA-6ABA-C21B7C839CA5}" = CCC Help Russian
"{A0E52598-872B-9E9A-181F-1A80C6AA4493}" = CCC Help Italian
"{A0F2B472-5F4E-87A0-88BB-9FB5BB559466}" = AMD Drag and Drop Transcoding
"{A2425E6C-8A37-3D63-A3A7-8ED5355FDF0B}" = Visual C++ 2008 x86 Runtime - KB2465361 - (v9.0.30729.5570)
"{A2425E6C-8A37-3D63-A3A7-8ED5355FDF0B}.vc_x86runtime_30729_5570" = Visual C++ 2008 x86 Runtime - v9.0.30729.5570
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A53A11EA-0095-493F-86FA-A15E8A86A405}" = VMware Player
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A879B90E-B62C-4DA4-9C3F-79A1A6CFAAF9}" = Microsoft ASP.NET Web Pages - Visual Studio 2010 Tools
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA467959-A1D6-4F45-90CD-11DC57733F32}" = Crystal Reports Basic for Visual Studio 2008
"{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}" = Microsoft Visual Studio Tools for Applications 2.0 - ENU
"{AC41D924-8C68-4BD5-A7A1-0AE4176C31A6}" = Crystal Reports for Visual Studio
"{AC54DC1F-EDA7-448C-BA4C-218A92F5E985}" = Microsoft SQL Server 2008 BI Development Studio
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.3)
"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4
"{AEB03FAF-90EB-4B4F-BA32-9C4DDE2C9804}" = Microsoft SQL Server 2008 Integration Services
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B268E9A1-04A9-40D0-9866-846BE2B74BA7}" = Microsoft Windows SDK for Visual Studio 2008 SP1 Win32 Tools
"{B32E7732-B2FB-3FD0-81AC-6025B1104C66}" = Microsoft Device Emulator version 3.0 - ENU
"{B3D1CFF9-C5DA-3590-894B-40821DDB67C5}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"{B857D868-F8B0-43EE-BC2B-D9E5ED21F237}" = Microsoft SQL Server VSS Writer
"{B8E9F8A1-9F4D-43D5-ABD6-1DF067FAA469}" = Microsoft SQL Server 2008 Database Engine Services
"{BA0C9AAF-1327-3F06-B49C-349B4BE8F740}" = Microsoft Visual Studio 2008 Shell (integrated mode) - ENU
"{BC537AE0-88AF-47ED-B762-33B0D62B5188}" = Microsoft SQL Server 2008 R2 Data-Tier Application Framework
"{BE8DCA37-A15A-4C0B-B601-D18AC34C944D}" = NuGet
"{BF251EAF-8697-4E89-BF09-C998F97BBC40}" = Microsoft SQL Server Native Client
"{BFA7A60F-D018-AF0D-47E9-A13D0219E86A}" = CCC Help Thai
"{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program
"{C3C35CB3-82B6-F36F-B39A-B2AFAA74F7D2}" = CCC Help Norwegian
"{C47C2F4D-4419-D823-C272-325FD9B92415}" = CCC Help Czech
"{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}" = Norton Online Backup
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C688457E-03FD-4941-923B-A27F4D42A7DD}" = Microsoft SQL Server 2008 Browser
"{C68C6E34-A103-F7BC-8682-C1C4190BAC1F}" = CCC Help Greek
"{C6DD625F-4B61-4561-8286-87CA0275CEA1}" = Microsoft Sync Framework Runtime v1.0 SP1 (x86)
"{C912D6C8-B870-42AB-BB22-9AC7AF09798D}" = Microsoft ASP.NET MVC 3 - Visual Studio 2010 Tools
"{C965F01C-76EA-4BD7-973E-46236AE312D7}" = Sql Server Customer Experience Improvement Program
"{CAA376AF-0DE8-4FCA-942E-C6AC579B94B3}" = Microsoft Windows SDK for Visual Studio 2008 SP1 Tools
"{CB65A1C3-533D-4EA6-82B5-FBA926F19079}" = Face Recognition for HP ProtectTools
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240B7}" = WinZip 12.0
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D0251102-442C-6FE0-4FDC-2ACF2AD2A2A5}" = CCC Help English
"{D102611A-6466-4101-A51D-51069303AC65}" = tools-linux
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D2A90CAF-AF34-C526-D4C7-AE4FF4547B66}" = CCC Help Polish
"{D428AB95-35B2-4868-B656-5C316E25EC69}" = Microsoft SQL Server 2008 Database Engine Services
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D441BD04-E548-4F8E-97A4-1B66135BAAA8}" = Microsoft SQL Server 2008 Setup Support Files
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D6B15AE6-B052-363E-B6BB-C4714CBA6509}" = Microsoft Visual Studio 2010 Professional - ENU
"{D7DAD1E4-45F4-3B2B-899A-EA728167EC4F}" = Microsoft Visual Studio 2008 Professional Edition - ENU
"{D9E6001A-5DC3-4620-AF7A-80B6CD48645D}" = WCF RIA Services V1.0 SP1
"{DAA8590D-D93E-4697-9CBE-D96A7590A8E3}" = Microsoft SQL Server 2008 Analysis Services
"{DC3D6AFB-78B4-489F-81D7-30B66E0C2417}" = Microsoft Sync Services for ADO.NET v2.0 SP1 (x86)
"{DCDEC776-BADD-48B9-8F9A-DFF513C3D7FA}" = Microsoft ASP.NET MVC 3
"{DF781E6F-BF29-4340-BEFB-09F7511B424D}" = Microsoft SQL Server 2008 Database Engine Services
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}" = HP Webcam Driver
"{E19490CD-5380-4F37-B0A7-624D635605DC}" = Catalyst Control Center - Branding
"{E366F338-BF6E-4165-BDDB-3DCCB3388F9F}" = HP Power Data
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E5C76964-F17B-7FCB-958F-1C067A2D217C}" = CCC Help Swedish
"{E74EA3B1-7192-489D-9A57-0AE918FEC001}" = Corel Home Office - Launcher
"{E7E76AEC-266C-C1A0-E39B-21AB97402CA1}" = CCC Help Chinese Traditional
"{E7F12C4C-9932-A039-4FAC-CAD1672EB633}" = CCC Help Hungarian
"{EBE9A607-31AB-696D-5220-5098B61AA9B2}" = CCC Help Dutch
"{EDDF99D9-9FE3-4871-A7DB-D1522C51EE9A}" = Microsoft .NET Compact Framework 2.0 SP2
"{EEB023B5-8EBE-4BEB-90C8-BDA16ABEDBB4}" = HP Power Assistant
"{F173C2B3-296F-458C-98FF-1676A42EBA02}" = HP Wallpaper
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F3494AB6-6900-41C6-AF57-823626827ED8}" = Microsoft SQL Server 2008 Database Engine Shared
"{F45048A1-12C4-4B08-A3EB-32D88033368A}" = Corel Home Office - Templates RU
"{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}" = Realtek Ethernet Controller All-In-One Windows Driver
"{F990B526-8F7C-46E0-B1F1-6C893A8B478F}" = Microsoft Sync Framework Services v1.0 SP1 (x86)
"{FA9C3624-C693-4423-8A8B-2BC2B9F607AB}" = Microsoft SQL Server 2008 Management Studio
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"{FE641E1B-387D-963C-E13B-C23240B8F2DC}" = AMD Catalyst Install Manager
"{FF29527A-44CD-3422-945E-981A13584000}" = VC Runtimes MSI
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FFAF4DB9-943E-97E5-051C-DC6C4E7094C0}" = CCC Help Danish
"7-Zip" = 7-Zip 9.15 beta
"A6A8668C0A13640CA28FE2A7D9654BE4AE478B13" = Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"ArcSoft TotalMedia" = ArcSoft TotalMedia
"B7541EC5F72AA713F557569278EB6273725F5607" = Windows Driver Package - Broadcom Bluetooth (06/15/2009 6.2.0.9000)
"BF20603967CFDCB2BBF91950E8A56DFBC5C833FE" = Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800)
"CutePDF Writer Installation" = CutePDF Writer 2.7
"Diablo III" = Diablo III
"Drive Encryption" = Drive Encryption for HP ProtectTools
"ESET Online Scanner" = ESET Online Scanner v3
"FileZilla Client" = FileZilla Client 3.3.2.1
"HPProtectTools" = HP ProtectTools Security Manager
"InstallShield_{33C9F24B-1D92-4632-A915-81E3BB1D5D6B}" = Theft Recovery
"InstallShield_{CB65A1C3-533D-4EA6-82B5-FBA926F19079}" = Face Recognition for HP ProtectTools
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Document Explorer 2005" = Microsoft Document Explorer 2005
"Microsoft Document Explorer 2008" = Microsoft Document Explorer 2008
"Microsoft Help Viewer 1.1" = Microsoft Help Viewer 1.1
"Microsoft Security Client" = Microsoft Security Essentials
"Microsoft SQL Server 10" = Microsoft SQL Server 2008
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Microsoft Team Foundation Server 2010 Object Model - ENU" = Microsoft Team Foundation Server 2010 Object Model - ENU
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Microsoft Visual Studio 2005 Professional Edition - ENU" = Microsoft Visual Studio 2005 Professional Edition - ENU
"Microsoft Visual Studio 2005 Tools for Office Runtime" = Visual Studio 2005 Tools for Office Second Edition Runtime
"Microsoft Visual Studio 2008 Professional Edition - ENU" = Microsoft Visual Studio 2008 Professional Edition - ENU
"Microsoft Visual Studio 2010 Professional - ENU" = Microsoft Visual Studio 2010 Professional - ENU
"Microsoft Visual Studio 2010 Service Pack 1" = Microsoft Visual Studio 2010 Service Pack 1
"Microsoft Visual Studio 2010 Tools for Office Runtime (x86)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"Microsoft Visual Studio Macro Tools" = Microsoft Visual Studio Macro Tools
"Mobile VPN with SSL client_is1" = WatchGuard Mobile VPN with SSL client 11.4.2
"Mozilla Firefox 13.0 (x86 en-US)" = Mozilla Firefox 13.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"npn5" = nProtect Netizen SVC (remove only)
"Office14.VISIOR" = Microsoft Visio Professional 2010
"PDF Complete" = PDF Complete Special Edition
"PROHYBRIDR" = 2007 Microsoft Office system
"RealPlayer 12.0" = RealPlayer
"Shrew Soft VPN Client" = Shrew Soft VPN Client
"SoftcampSCSK" = SoftCamp Secure KeyStroke 4.0
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"UnINISafeWeb7" = INISafeWeb 7.0 (SFilter v1.0)
"VeraPort" = VeraPort (º¸¾È¸ðµâ°ü¸® ÇÁ·Î±×·¥)
"Visual CertExam Suite_is1" = Visual CertExam Suite 1.9
"Visual Studio Tools for the Office system 3.0 Runtime" = Visual Studio Tools for the Office system 3.0 Runtime
"VisualWebDeveloper" = Microsoft Visual Studio Web Authoring Component
"VMware_Player" = VMware Player
"WinLiveSuite" = Windows Live Essentials
"WinMerge_is1" = WinMerge 2.12.4
"WinPcapInst" = WinPcap 4.1.2
"XecureCK" = ClientKeeper KeyPro with E2E for 32bit
"XecureWeb Control" = XecureWeb Control

 

[happycan]

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-325877220-3748803948-952250591-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 6/19/2012 3:08:14 PM | Computer Name = ENOPL4JNA2HRF | Source = Report Server Windows Service (MSSQLSERVER) | ID = 107
Description = Report Server Windows Service (MSSQLSERVER) cannot connect to the
report server database.

Error - 6/19/2012 7:39:38 PM | Computer Name = ENOPL4JNA2HRF | Source = ESENT | ID = 215
Description = WinMail (4888) WindowsMail0: The backup has been stopped because it
was halted by the client or the connection with the client failed.

Error - 6/19/2012 9:08:16 PM | Computer Name = ENOPL4JNA2HRF | Source = Report Server Windows Service (MSSQLSERVER) | ID = 107
Description = Report Server Windows Service (MSSQLSERVER) cannot connect to the
report server database.

Error - 6/19/2012 9:08:18 PM | Computer Name = ENOPL4JNA2HRF | Source = Report Server Windows Service (MSSQLSERVER) | ID = 107
Description = Report Server Windows Service (MSSQLSERVER) cannot connect to the
report server database.

Error - 6/19/2012 9:19:39 PM | Computer Name = ENOPL4JNA2HRF | Source = VSS | ID = 8194
Description =

Error - 6/19/2012 9:23:37 PM | Computer Name = ENOPL4JNA2HRF | Source = Microsoft-Windows-RestartManager | ID = 10006
Description = Application or service 'Internet Explorer' could not be shut down.

Error - 6/19/2012 9:23:37 PM | Computer Name = ENOPL4JNA2HRF | Source = Microsoft-Windows-RestartManager | ID = 10006
Description = Application or service 'Internet Explorer' could not be shut down.

Error - 6/20/2012 4:09:59 AM | Computer Name = ENOPL4JNA2HRF | Source = Validity USDK | ID = 65540
Description = Sensor device initialization failed: State:0x00000005 Status:0x00000004.

Error - 6/20/2012 4:12:05 AM | Computer Name = ENOPL4JNA2HRF | Source = Report Server Windows Service (MSSQLSERVER) | ID = 107
Description = Report Server Windows Service (MSSQLSERVER) cannot connect to the
report server database.

Error - 6/20/2012 4:12:06 AM | Computer Name = ENOPL4JNA2HRF | Source = Report Server Windows Service (MSSQLSERVER) | ID = 107
Description = Report Server Windows Service (MSSQLSERVER) cannot connect to the
report server database.

[ Hewlett-Packard Events ]
Error - 10/7/2011 9:26:38 AM | Computer Name = ENOPL4JNA2HRF | Source = Hewlett-Packard | ID = 0
Description = en-US Could not find file 'C:\Program Files\Hewlett-Packard\HP Support
Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) at
System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)
at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a(Object
A_0, EventArgs A_1)

Error - 10/7/2011 9:26:38 AM | Computer Name = ENOPL4JNA2HRF | Source = Hewlett-Packard | ID = 0
Description = en-US Could not find file 'C:\Program Files\Hewlett-Packard\HP Support
Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) at
System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)
at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a(Object
A_0, EventArgs A_1)

Error - 11/11/2011 9:18:17 AM | Computer Name = ENOPL4JNA2HRF | Source = Hewlett-Packard | ID = 0
Description = en-US Could not find file 'C:\Program Files\Hewlett-Packard\HP Support
Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) at
System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)
at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a(Object
A_0, EventArgs A_1)

Error - 11/11/2011 9:18:18 AM | Computer Name = ENOPL4JNA2HRF | Source = Hewlett-Packard | ID = 0
Description = en-US Could not find file 'C:\Program Files\Hewlett-Packard\HP Support
Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) at
System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)
at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a(Object
A_0, EventArgs A_1)

Error - 6/8/2012 8:31:11 AM | Computer Name = ENOPL4JNA2HRF | Source = Hewlett-Packard | ID = 0
Description = en-US Could not find file 'C:\Program Files\Hewlett-Packard\HP Support
Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) at
System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)
at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a(Object
A_0, EventArgs A_1)

[ HP Power Assistant Events ]
Error - 3/8/2012 5:40:46 AM | Computer Name = ENOPL4JNA2HRF | Source = HP PA Service | ID = 0
Description = System.InvalidOperationException There is an error in the XML document.
at System.Xml.Serialization.XmlSerializer.Deserialize(XmlReader xmlReader, String
encodingStyle, XmlDeserializationEvents events) at System.Xml.Serialization.XmlSerializer.Deserialize(XmlReader
xmlReader) at HP_Common.CaslWrapper.GetPMCData(GetPMCDataOutput& pmcData) at
HPPA_Service.CurrentConfiguration.getPMCData(GetPMCDataOutput& pmcData)

Error - 3/8/2012 5:40:46 AM | Computer Name = ENOPL4JNA2HRF | Source = HP PA Service | ID = 0
Description = System.FormatException The string '2017-17-17T17:17:17' is not a valid
AllXsd value. at System.Xml.Schema.XsdDateTime..ctor(String text, XsdDateTimeFlags
kinds) at System.Xml.XmlConvert.ToDateTime(String s, XmlDateTimeSerializationMode
dateTimeOption) at System.Xml.Serialization.XmlCustomFormatter.ToDateTime(String
value) at System.Xml.Serialization.XmlSerializationReader.ToDateTime(String value)
at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReader1.Read96_GetPMCDataOutputOutputData(Boolean
isNullable, Boolean checkType) at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReader1.Read97_GetPMCDataOutputOutput(Boolean
isNullable, Boolean checkType) at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReader1.Read98_GetPMCDataOutput(Boolean
isNullable, Boolean checkType) at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReader1.Read227_GetPMCDataOutput()

Error - 3/8/2012 5:59:46 AM | Computer Name = ENOPL4JNA2HRF | Source = HP PA Service | ID = 0
Description = System.InvalidOperationException There is an error in the XML document.
at System.Xml.Serialization.XmlSerializer.Deserialize(XmlReader xmlReader, String
encodingStyle, XmlDeserializationEvents events) at System.Xml.Serialization.XmlSerializer.Deserialize(XmlReader
xmlReader) at HP_Common.CaslWrapper.GetPMCData(GetPMCDataOutput& pmcData) at
HPPA_Service.CurrentConfiguration.getPMCData(GetPMCDataOutput& pmcData)

Error - 3/8/2012 5:59:46 AM | Computer Name = ENOPL4JNA2HRF | Source = HP PA Service | ID = 0
Description = System.FormatException The string '2017-17-17T17:17:17' is not a valid
AllXsd value. at System.Xml.Schema.XsdDateTime..ctor(String text, XsdDateTimeFlags
kinds) at System.Xml.XmlConvert.ToDateTime(String s, XmlDateTimeSerializationMode
dateTimeOption) at System.Xml.Serialization.XmlCustomFormatter.ToDateTime(String
value) at System.Xml.Serialization.XmlSerializationReader.ToDateTime(String value)
at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReader1.Read96_GetPMCDataOutputOutputData(Boolean
isNullable, Boolean checkType) at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReader1.Read97_GetPMCDataOutputOutput(Boolean
isNullable, Boolean checkType) at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReader1.Read98_GetPMCDataOutput(Boolean
isNullable, Boolean checkType) at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReader1.Read227_GetPMCDataOutput()

Error - 3/8/2012 6:05:45 AM | Computer Name = ENOPL4JNA2HRF | Source = HP PA Service | ID = 0
Description = System.InvalidOperationException There is an error in the XML document.
at System.Xml.Serialization.XmlSerializer.Deserialize(XmlReader xmlReader, String
encodingStyle, XmlDeserializationEvents events) at System.Xml.Serialization.XmlSerializer.Deserialize(XmlReader
xmlReader) at HP_Common.CaslWrapper.GetPMCData(GetPMCDataOutput& pmcData) at
HPPA_Service.CurrentConfiguration.getPMCData(GetPMCDataOutput& pmcData)

Error - 3/8/2012 6:05:45 AM | Computer Name = ENOPL4JNA2HRF | Source = HP PA Service | ID = 0
Description = System.FormatException The string '2005-46-46T46:46:46' is not a valid
AllXsd value. at System.Xml.Schema.XsdDateTime..ctor(String text, XsdDateTimeFlags
kinds) at System.Xml.XmlConvert.ToDateTime(String s, XmlDateTimeSerializationMode
dateTimeOption) at System.Xml.Serialization.XmlCustomFormatter.ToDateTime(String
value) at System.Xml.Serialization.XmlSerializationReader.ToDateTime(String value)
at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReader1.Read96_GetPMCDataOutputOutputData(Boolean
isNullable, Boolean checkType) at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReader1.Read97_GetPMCDataOutputOutput(Boolean
isNullable, Boolean checkType) at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReader1.Read98_GetPMCDataOutput(Boolean
isNullable, Boolean checkType) at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReader1.Read227_GetPMCDataOutput()

Error - 3/8/2012 9:38:16 PM | Computer Name = ENOPL4JNA2HRF | Source = HP PA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObjectSearcher.Initialize()
at System.Management.ManagementObjectSearcher.Get() at HPPA_Service.CurrentConfiguration.FindDevice(String
hostPath, String portName) at HPPA_Service.CurrentConfiguration.ApplyDeviceManagerState(List`1
radios) at HPPA_Service.CurrentConfiguration.ReloadRadioList()

Error - 3/13/2012 7:23:32 AM | Computer Name = ENOPL4JNA2HRF | Source = HP PA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at System.Management.ManagementBaseObject.get_Item(String propertyName)
at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

Error - 3/13/2012 7:40:18 PM | Computer Name = ENOPL4JNA2HRF | Source = HP PA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObjectSearcher.Initialize()
at System.Management.ManagementObjectSearcher.Get() at HPPA_Service.CurrentConfiguration.FindDevice(String
hostPath, String portName) at HPPA_Service.CurrentConfiguration.ApplyDeviceManagerState(List`1
radios) at HPPA_Service.CurrentConfiguration.ReloadRadioList()

Error - 3/14/2012 7:16:07 AM | Computer Name = ENOPL4JNA2HRF | Source = HP PA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at System.Management.ManagementBaseObject.get_Item(String propertyName)
at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

[ HP Wireless Assistant Events ]
Error - 3/13/2012 7:23:32 AM | Computer Name = ENOPL4JNA2HRF | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at System.Management.ManagementBaseObject.get_Item(String propertyName)
at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

Error - 3/13/2012 7:40:18 PM | Computer Name = ENOPL4JNA2HRF | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObjectSearcher.Initialize()
at System.Management.ManagementObjectSearcher.Get() at HPPA_Service.CurrentConfiguration.FindDevice(String
hostPath, String portName) at HPPA_Service.CurrentConfiguration.ApplyDeviceManagerState(List`1
radios) at HPPA_Service.CurrentConfiguration.ReloadRadioList()

Error - 3/14/2012 7:16:07 AM | Computer Name = ENOPL4JNA2HRF | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at System.Management.ManagementBaseObject.get_Item(String propertyName)
at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

Error - 4/9/2012 7:27:45 AM | Computer Name = ENOPL4JNA2HRF | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at System.Management.ManagementBaseObject.get_Item(String propertyName)
at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

Error - 4/11/2012 9:08:13 AM | Computer Name = ENOPL4JNA2HRF | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObjectSearcher.Initialize()
at System.Management.ManagementObjectSearcher.Get() at HPPA_Service.CurrentConfiguration.FindDevice(String
hostPath, String portName) at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__9(RadioHardware
radio) at System.Linq.Enumerable.WhereSelectListIterator`2.MoveNext() at System.Linq.Enumerable.WhereSelectEnumerableIterator`2.MoveNext()
at HPPA_Service.CurrentConfiguration.ReloadRadioList()

Error - 4/20/2012 7:37:21 AM | Computer Name = ENOPL4JNA2HRF | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at System.Management.ManagementBaseObject.get_Item(String propertyName)
at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

Error - 5/8/2012 7:40:00 AM | Computer Name = ENOPL4JNA2HRF | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at System.Management.ManagementBaseObject.get_Item(String propertyName)
at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

Error - 5/17/2012 7:04:28 AM | Computer Name = ENOPL4JNA2HRF | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObjectSearcher.Initialize()
at System.Management.ManagementObjectSearcher.Get() at HPPA_Service.CurrentConfiguration.FindDevice(String
hostPath, String portName) at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__9(RadioHardware
radio) at System.Linq.Enumerable.WhereSelectListIterator`2.MoveNext() at System.Linq.Enumerable.WhereSelectEnumerableIterator`2.MoveNext()
at HPPA_Service.CurrentConfiguration.ReloadRadioList()

Error - 5/29/2012 6:59:25 AM | Computer Name = ENOPL4JNA2HRF | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at System.Management.ManagementBaseObject.get_Item(String propertyName)
at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

Error - 6/13/2012 6:34:15 AM | Computer Name = ENOPL4JNA2HRF | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at System.Management.ManagementBaseObject.get_Item(String propertyName)
at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()

[ System Events ]
Error - 6/20/2012 4:16:46 AM | Computer Name = ENOPL4JNA2HRF | Source = DCOM | ID = 10009
Description =

Error - 6/20/2012 4:16:54 AM | Computer Name = ENOPL4JNA2HRF | Source = DCOM | ID = 10009
Description =

Error - 6/20/2012 4:18:29 AM | Computer Name = ENOPL4JNA2HRF | Source = Schannel | ID = 36887
Description = The following fatal alert was received: 40.

Error - 6/20/2012 4:18:29 AM | Computer Name = ENOPL4JNA2HRF | Source = Schannel | ID = 36887
Description = The following fatal alert was received: 40.

Error - 6/20/2012 4:18:29 AM | Computer Name = ENOPL4JNA2HRF | Source = Schannel | ID = 36887
Description = The following fatal alert was received: 40.

Error - 6/20/2012 4:18:30 AM | Computer Name = ENOPL4JNA2HRF | Source = Schannel | ID = 36887
Description = The following fatal alert was received: 40.

Error - 6/20/2012 4:44:46 AM | Computer Name = ENOPL4JNA2HRF | Source = DCOM | ID = 10009
Description =

Error - 6/20/2012 4:44:54 AM | Computer Name = ENOPL4JNA2HRF | Source = DCOM | ID = 10009
Description =

Error - 6/20/2012 5:13:42 AM | Computer Name = ENOPL4JNA2HRF | Source = DCOM | ID = 10009
Description =

Error - 6/20/2012 5:13:49 AM | Computer Name = ENOPL4JNA2HRF | Source = DCOM | ID = 10009
Description =


< End of report >

 

[Broni]

You didn't say:

Any current issues?

===================================================

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  IE - HKU\S-1-5-21-325877220-3748803948-952250591-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 211.75.247.71:80
  O1 - Hosts: 172.16.43.45 friendsterdb
  O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll File not found
  O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
  O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
  O3 - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
  O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll File not found
  O15 - HKLM\..Trusted Domains: //about.htm/ ([]myui in Trusted sites)
  O15 - HKLM\..Trusted Domains: //Exclude.htm/ ([]myui in Trusted sites)
  O15 - HKLM\..Trusted Domains: //LanguageSelection.htm/ ([]myui in Trusted sites)
  O15 - HKLM\..Trusted Domains: //Message.htm/ ([]myui in Trusted sites)
  O15 - HKLM\..Trusted Domains: //MyAgttryCmd.htm/ ([]myui in Trusted sites)
  O15 - HKLM\..Trusted Domains: //MyAgttryNag.htm/ ([]myui in Trusted sites)
  O15 - HKLM\..Trusted Domains: //MyNotification.htm/ ([]myui in Trusted sites)
  O15 - HKLM\..Trusted Domains: //NOCLessUpdate.htm/ ([]myui in Trusted sites)
  O15 - HKLM\..Trusted Domains: //quarantine.htm/ ([]myui in Trusted sites)
  O15 - HKLM\..Trusted Domains: //ScanNow.htm/ ([]myui in Trusted sites)
  O15 - HKLM\..Trusted Domains: //strings.vbs/ ([]myui in Trusted sites)
  O15 - HKLM\..Trusted Domains: //Template.htm/ ([]myui in Trusted sites)
  O15 - HKLM\..Trusted Domains: //Update.htm/ ([]myui in Trusted sites)
  O15 - HKLM\..Trusted Domains: //VirFound.htm/ ([]myui in Trusted sites)
  O15 - HKLM\..Trusted Domains: mcafee.com ([*] http in Trusted sites)
  O15 - HKLM\..Trusted Domains: mcafee.com ([*] https in Trusted sites)
  O15 - HKLM\..Trusted Domains: mcafeeasap.com ([betavscan] http in Trusted sites)
  O15 - HKLM\..Trusted Domains: mcafeeasap.com ([betavscan] https in Trusted sites)
  O15 - HKLM\..Trusted Domains: mcafeeasap.com ([vs] http in Trusted sites)
  O15 - HKLM\..Trusted Domains: mcafeeasap.com ([vs] https in Trusted sites)
  O15 - HKLM\..Trusted Domains: mcafeeasap.com ([www] http in Trusted sites)
  O15 - HKLM\..Trusted Domains: mcafeeasap.com ([www] https in Trusted sites)
  O15 - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..Trusted Domains: alipay.com ([]http in Trusted sites)
  O15 - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..Trusted Domains: alipay.com ([]https in Trusted sites)
  O15 - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..Trusted Domains: alisoft.com ([]http in Trusted sites)
  O15 - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..Trusted Domains: alisoft.com ([]https in Trusted sites)
  O15 - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..Trusted Domains: taobao.com ([]http in Trusted sites)
  O15 - HKU\S-1-5-21-325877220-3748803948-952250591-1002\..Trusted Domains: taobao.com ([]https in Trusted sites)
  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
  [2012/01/01 21:23:07 | 000,009,994 | -HS- | C] () -- C:\Users\Admin\AppData\Local\j20wm44mssx6c68jnw5vxejp35847tgjo
  [2012/01/01 21:23:07 | 000,009,994 | -HS- | C] () -- C:\ProgramData\j20wm44mssx6c68jnw5vxejp35847tgjo
  [2012/01/01 21:04:45 | 000,010,120 | -HS- | C] () -- C:\Users\Admin\AppData\Local\fr1gt65txj52885ix1u64r8v365x8j108565a4e2g7grf
  [2012/01/01 21:04:45 | 000,010,120 | -HS- | C] () -- C:\ProgramData\fr1gt65txj52885ix1u64r8v365x8j108565a4e2g7grf
  @Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:7D6EC5BE
  @Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:DFC5A2B2
  
  :Commands
  [purity]
  [emptytemp]
  [emptyjava]
  [emptyflash]
  [resethosts]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• You will get a log that shows the results of the fix. Please post it.
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply. Only one log will be created.

 

[happycan]

fingers crossed.. so far no issue

All processes killed
========== OTL ==========
HKU\S-1-5-21-325877220-3748803948-952250591-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
172.16.43.45 friendsterdb removed from HOSTS file successfully
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{0BF43445-2F28-4351-9252-17FE6E806AA0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BF43445-2F28-4351-9252-17FE6E806AA0}\ not found.
Registry value HKEY_USERS\S-1-5-21-325877220-3748803948-952250591-1002\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{68BCFFE1-A2DA-4B40-9068-87ECBFC19D16}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{68BCFFE1-A2DA-4B40-9068-87ECBFC19D16}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//about.htm/\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//Exclude.htm/\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//LanguageSelection.htm/\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//Message.htm/\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//MyAgttryCmd.htm/\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//MyAgttryNag.htm/\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//MyNotification.htm/\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//NOCLessUpdate.htm/\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//quarantine.htm/\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//ScanNow.htm/\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//strings.vbs/\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//Template.htm/\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//Update.htm/\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\//VirFound.htm/\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mcafee.com\*\ deleted successfully.
Invalid CLSID key: *
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mcafee.com\*\ not found.
Invalid CLSID key: *
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mcafeeasap.com\betavscan\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mcafeeasap.com\betavscan\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mcafeeasap.com\vs\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mcafeeasap.com\vs\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mcafeeasap.com\www\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mcafeeasap.com\www\ not found.
Registry key HKEY_USERS\S-1-5-21-325877220-3748803948-952250591-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\alipay.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-325877220-3748803948-952250591-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\alipay.com\ not found.
Registry key HKEY_USERS\S-1-5-21-325877220-3748803948-952250591-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\alisoft.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-325877220-3748803948-952250591-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\alisoft.com\ not found.
Registry key HKEY_USERS\S-1-5-21-325877220-3748803948-952250591-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\taobao.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-325877220-3748803948-952250591-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\taobao.com\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
C:\Users\Admin\AppData\Local\j20wm44mssx6c68jnw5vxejp35847tgjo moved successfully.
C:\ProgramData\j20wm44mssx6c68jnw5vxejp35847tgjo moved successfully.
C:\Users\Admin\AppData\Local\fr1gt65txj52885ix1u64r8v365x8j108565a4e2g7grf moved successfully.
C:\ProgramData\fr1gt65txj52885ix1u64r8v365x8j108565a4e2g7grf moved successfully.
ADS C:\ProgramData\TEMP:7D6EC5BE deleted successfully.
ADS C:\ProgramData\TEMPFC5A2B2 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Admin
->Temp folder emptied: 671498098 bytes
->Temporary Internet Files folder emptied: 304695528 bytes
->Java cache emptied: 23017945 bytes
->FireFox cache emptied: 66846645 bytes
->Google Chrome cache emptied: 285317283 bytes
->Flash cache emptied: 173133 bytes

User: All Users

User: Classic .NET AppPool
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56475 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 111064042 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 208468 bytes

Total Files Cleaned = 1,395.00 mb


[EMPTYJAVA]

User: Admin
->Java cache emptied: 0 bytes

User: All Users

User: Classic .NET AppPool

User: Default

User: Default User

User: Public

Total Java Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: Admin
->Flash cache emptied: 0 bytes

User: All Users

User: Classic .NET AppPool

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

C:\windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.50.0 log created on 06212012_210230
Files\Folders moved on Reboot...
File\Folder C:\Users\Admin\AppData\Local\Temp\~DF0102B820CBB0104E.TMP not found!
File\Folder C:\Users\Admin\AppData\Local\Temp\~DF07DD3BD277880EAD.TMP not found!
File\Folder C:\Users\Admin\AppData\Local\Temp\~DF1008BAA892986FC2.TMP not found!
File\Folder C:\Users\Admin\AppData\Local\Temp\~DF289417D25E156123.TMP not found!
File\Folder C:\Users\Admin\AppData\Local\Temp\~DF4C82FAEB9DA5A7A5.TMP not found!
File\Folder C:\Users\Admin\AppData\Local\Temp\~DF522F39CF5E0E4762.TMP not found!
File\Folder C:\Users\Admin\AppData\Local\Temp\~DF538C4E69090628B4.TMP not found!
File\Folder C:\Users\Admin\AppData\Local\Temp\~DF56C064625B5E1A13.TMP not found!
File\Folder C:\Users\Admin\AppData\Local\Temp\~DF6AE20FD0E84DAA3E.TMP not found!
File\Folder C:\Users\Admin\AppData\Local\Temp\~DF6B073DF09125E185.TMP not found!
File\Folder C:\Users\Admin\AppData\Local\Temp\~DF821B5574C3A86063.TMP not found!
File\Folder C:\Users\Admin\AppData\Local\Temp\~DF82A44FCF9C8FBCC2.TMP not found!
File\Folder C:\Users\Admin\AppData\Local\Temp\~DF8348770A80D1A721.TMP not found!
File\Folder C:\Users\Admin\AppData\Local\Temp\~DFA5352CF1AA8E7612.TMP not found!
File\Folder C:\Users\Admin\AppData\Local\Temp\~DFBDF38D4903925AF7.TMP not found!
File\Folder C:\Users\Admin\AppData\Local\Temp\~DFCC39343607C11F64.TMP not found!
File\Folder C:\Users\Admin\AppData\Local\Temp\~DFF6459243CB61868D.TMP not found!
File\Folder C:\Users\Admin\AppData\Local\Temp\~DFFA10E872CFF047D1.TMP not found!
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V2CCE6LE\checkOAuth[1].js moved successfully.
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V2CCE6LE\form-tabs[1].js moved successfully.
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V2CCE6LE\p[2].js moved successfully.
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TZAMN1OW\em_js[1].js moved successfully.
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OQZ7G3VU\CheckConnection[1].htm moved successfully.
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OQZ7G3VU\ServiceLogin[1].htm moved successfully.
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NV1PIHV6\checkOAuth[1].js moved successfully.
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3C0CHSPF\em_js[1].js moved successfully.
C:\windows\temp\vmware-SYSTEM\vmware-usbarb-SYSTEM-5240.log moved successfully.
Registry entries deleted on Reboot...

 

[happycan]

OTL logfile created on: 6/21/2012 9:15:50 PM - Run 2
OTL by OldTimer - Version 3.2.50.0 Folder = C:\Users\Admin\Documents
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.98 Gb Total Physical Memory | 1.35 Gb Available Physical Memory | 45.26% Memory free
5.97 Gb Paging File | 3.81 Gb Available in Paging File | 63.90% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 280.80 Gb Total Space | 162.09 Gb Free Space | 57.72% Space Free | Partition Type: NTFS
Drive F: | 1.99 Gb Total Space | 1.48 Gb Free Space | 74.69% Space Free | Partition Type: FAT32

Computer Name: ENOPL4JNA2HRF | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/06/20 16:20:04 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Documents\OTL.exe
PRC - [2012/06/19 09:45:14 | 000,935,480 | ---- | M] () -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe
PRC - [2012/04/06 10:16:24 | 000,451,072 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2012/04/06 10:15:50 | 000,217,600 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2012/04/06 01:24:32 | 000,641,664 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
PRC - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/04/04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/03/26 17:08:12 | 000,931,200 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2012/01/03 21:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/09/02 23:48:40 | 000,213,279 | ---- | M] (INCA Internet Co., Ltd.) -- C:\Windows\System32\npnj5Agent.exe
PRC - [2011/09/02 23:48:39 | 000,250,145 | ---- | M] (INCA Internet Co., Ltd.) -- C:\Windows\System32\npstartersvc.exe
PRC - [2011/06/29 23:02:50 | 000,058,368 | ---- | M] () -- C:\Program Files\WatchGuard\WatchGuard Mobile VPN with SSL\wgsslvpnsrc.exe
PRC - [2011/06/24 12:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011/06/15 17:33:20 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE
PRC - [2011/02/25 13:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/11/23 20:41:34 | 000,274,608 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\real\realplayer\Update\realsched.exe
PRC - [2010/11/20 20:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010/09/21 02:42:38 | 000,064,048 | ---- | M] (VMware, Inc.) -- C:\Program Files\VMware\VMware Player\hqtray.exe
PRC - [2010/09/21 02:42:06 | 000,113,200 | ---- | M] (VMware, Inc.) -- C:\Program Files\VMware\VMware Player\vmware-authd.exe
PRC - [2010/09/21 02:41:38 | 000,334,384 | ---- | M] (VMware, Inc.) -- C:\Windows\System32\vmnetdhcp.exe
PRC - [2010/09/21 02:41:34 | 000,404,016 | ---- | M] (VMware, Inc.) -- C:\Windows\System32\vmnat.exe
PRC - [2010/09/21 01:42:44 | 000,539,184 | ---- | M] (VMware, Inc.) -- C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
PRC - [2010/01/08 08:14:12 | 000,081,920 | ---- | M] (Hewlett-Packard Company) -- c:\Program Files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe
PRC - [2010/01/05 11:36:04 | 000,264,248 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
PRC - [2010/01/05 11:35:22 | 000,254,520 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe
PRC - [2010/01/05 10:23:36 | 000,309,816 | ---- | M] (Hewlett-Packard Development Company L.P.) -- C:\Program Files\Hewlett-Packard\Shared\hpCaslNotification.exe
PRC - [2009/12/17 06:51:46 | 000,363,064 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
PRC - [2009/12/17 06:51:46 | 000,102,968 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
PRC - [2009/12/17 06:48:12 | 001,690,680 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
PRC - [2009/12/17 06:48:12 | 000,102,968 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
PRC - [2009/12/16 09:11:14 | 000,281,192 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
PRC - [2009/12/12 09:57:38 | 011,265,536 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\File Sanitizer\coreshredder.exe
PRC - [2009/12/12 09:57:20 | 000,297,984 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
PRC - [2009/12/11 07:03:52 | 000,251,448 | ---- | M] (Hewlett-Packard Company) -- c:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
PRC - [2009/12/04 20:22:40 | 000,506,472 | ---- | M] (ArcSoft, Inc.) -- C:\Windows\System32\uArcCapture.exe
PRC - [2009/12/04 04:30:42 | 000,495,711 | ---- | M] (IDT, Inc.) -- C:\Program Files\IDT\WDM\sttray.exe
PRC - [2009/12/04 04:30:42 | 000,229,461 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\stacsv.exe
PRC - [2009/11/25 10:57:20 | 000,300,808 | ---- | M] (DigitalPersona, Inc.) -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
PRC - [2009/11/19 07:17:36 | 000,036,864 | ---- | M] (Hewlett-Packard Development Company, L.P) -- c:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
PRC - [2009/11/16 02:31:08 | 000,049,152 | ---- | M] () -- C:\Program Files\ShrewSoft\VPN Client\dtpd.exe
PRC - [2009/11/16 02:29:10 | 000,716,800 | ---- | M] () -- C:\Program Files\ShrewSoft\VPN Client\iked.exe
PRC - [2009/11/16 02:26:42 | 000,536,576 | ---- | M] () -- C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe
PRC - [2009/11/05 05:46:56 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2009/11/05 05:46:54 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2009/10/24 03:52:36 | 000,635,416 | ---- | M] (PDF Complete Inc) -- C:\Program Files\PDF Complete\pdfsvc.exe
PRC - [2009/09/05 03:43:40 | 000,795,936 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2009/09/05 03:43:38 | 000,595,232 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
PRC - [2009/08/26 00:57:52 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2009/08/26 00:57:44 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009/06/20 12:27:54 | 000,615,176 | ---- | M] (http://tortoisesvn.net) -- C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
PRC - [2009/03/05 23:57:56 | 000,227,352 | ---- | M] (SonicWALL, Inc.) -- C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe
PRC - [2009/03/03 18:43:08 | 000,081,920 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\AEstSrv.exe
PRC - [2007/07/25 03:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe


========== Modules (No Company Name) ==========

MOD - [2012/06/20 10:13:04 | 001,051,136 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\9b2f17fb61b7197f2a04108f5d1a1cc6\System.Management.ni.dll
MOD - [2012/06/20 10:11:07 | 002,297,856 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\dfd33f59a5803a3c73cf408362e6e0b7\System.Core.ni.dll
MOD - [2012/06/20 09:15:01 | 000,368,128 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8e56489276063ededde74e597a121df3\PresentationFramework.Aero.ni.dll
MOD - [2012/06/20 09:14:37 | 011,833,344 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll
MOD - [2012/06/20 09:14:29 | 000,771,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012/06/20 09:14:23 | 006,610,944 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\e2073751227120ce228e00e26dfe5fca\System.Data.ni.dll
MOD - [2012/06/20 09:14:04 | 014,340,608 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e717a230496832656b05b515eb9f3bc5\PresentationFramework.ni.dll
MOD - [2012/06/20 09:13:24 | 012,436,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012/06/20 09:13:16 | 001,591,808 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012/06/20 09:13:11 | 000,185,344 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\d8af9a65cf0ed85d47360796e2645a06\UIAutomationTypes.ni.dll
MOD - [2012/06/20 09:13:09 | 012,237,824 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\14a87218ea49639f38097e278b98a3da\PresentationCore.ni.dll
MOD - [2012/06/20 09:12:56 | 003,347,968 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012/06/20 09:12:47 | 005,452,800 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012/06/20 09:12:43 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012/06/20 09:12:41 | 007,967,232 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012/06/20 09:11:20 | 011,492,864 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2010/11/05 09:58:05 | 002,927,616 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2010/09/21 02:42:38 | 000,068,656 | ---- | M] () -- C:\Program Files\VMware\VMware Player\zlib1.dll
MOD - [2010/09/21 02:42:20 | 000,970,288 | ---- | M] () -- C:\Program Files\VMware\VMware Player\libxml2.dll
MOD - [2010/01/21 15:19:40 | 000,101,376 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\HP.ActiveSupportLibrary\2.0.0.1__01a974bc1760f423\HP.ActiveSupportLibrary.dll
MOD - [2010/01/21 15:16:00 | 000,236,600 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\hpCASLLibrary\3.0.1.1__67b8d1b5179ba5f8\hpCASLLibrary.dll
MOD - [2010/01/21 15:14:52 | 000,011,320 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\Interop.HPQWMIEXLib\1.0.0.0__67b8d1b5179ba5f8\Interop.HPQWMIEXLib.dll
MOD - [2010/01/21 14:55:30 | 000,130,616 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\hpcasl\3.5.1.1__9c6f83d5b7f3d097\hpcasl.dll
MOD - [2010/01/21 14:55:30 | 000,062,008 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CaslShared\3.5.1.1__9c6f83d5b7f3d097\CaslShared.dll
MOD - [2009/12/17 06:51:48 | 000,052,280 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll
MOD - [2009/12/17 06:51:44 | 000,030,264 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll
MOD - [2009/12/17 06:48:12 | 000,055,352 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Power Assistant\Graphs.dll
MOD - [2009/12/17 06:48:12 | 000,052,280 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Power Assistant\HardwareAccess.dll
MOD - [2009/12/17 06:48:10 | 000,267,832 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Power Assistant\HPCommon.XmlSerializers.dll
MOD - [2009/09/30 07:25:46 | 000,061,440 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll
MOD - [2009/09/30 07:25:44 | 000,131,072 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll
MOD - [2009/09/30 07:25:38 | 000,040,960 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingServer.dll
MOD - [2009/09/30 07:25:38 | 000,036,864 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingClients.dll
MOD - [2009/09/30 07:25:38 | 000,007,680 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\RemotingClient.dll
MOD - [2009/09/30 07:25:36 | 000,005,632 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingInterface.dll
MOD - [2009/09/30 07:25:28 | 000,018,944 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingMessages.dll
MOD - [2009/09/05 03:43:54 | 000,132,384 | ---- | M] () -- C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll
MOD - [2009/06/20 12:27:10 | 000,101,128 | ---- | M] () -- C:\Program Files\TortoiseSVN\bin\CrashRpt.dll
MOD - [2009/06/18 03:40:16 | 007,745,536 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtGui4.dll
MOD - [2009/06/18 03:40:16 | 002,121,728 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtCore4.dll
MOD - [2009/06/18 03:40:16 | 000,135,168 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll


========== Win32 Services (SafeList) ==========

SRV - [2012/06/20 16:26:11 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/06/19 09:45:14 | 000,935,480 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe -- (vToolbarUpdater11.1.0)
SRV - [2012/06/01 23:39:50 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/04/06 10:15:50 | 000,217,600 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/03/26 17:03:40 | 000,214,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012/01/03 21:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/09/02 23:48:39 | 000,250,145 | ---- | M] (INCA Internet Co., Ltd.) [Auto | Running] -- C:\Windows\System32\npstartersvc.exe -- (nPStarterSVC)
SRV - [2011/07/07 19:31:08 | 000,195,336 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/06/29 23:02:50 | 000,058,368 | ---- | M] () [Auto | Running] -- C:\Program Files\WatchGuard\WatchGuard Mobile VPN with SSL\wgsslvpnsrc.exe -- (wgsslvpnsrc)
SRV - [2011/06/15 17:33:20 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2010/11/20 20:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/11/20 20:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2010/11/20 20:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2010/09/21 02:42:06 | 000,113,200 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService)
SRV - [2010/09/21 02:41:38 | 000,334,384 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\System32\vmnetdhcp.exe -- (VMnetDHCP)
SRV - [2010/09/21 02:41:34 | 000,404,016 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\System32\vmnat.exe -- (VMware NAT Service)
SRV - [2010/09/21 01:42:44 | 000,539,184 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe -- (VMUSBArbService)
SRV - [2010/08/19 13:57:14 | 000,191,024 | ---- | M] (VMware, Inc.) [On_Demand | Stopped] -- C:\Program Files\VMware\VMware Player\vmware-ufad.exe -- (ufad-ws60)
SRV - [2010/06/26 01:07:20 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2010/05/31 19:28:45 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2010/01/08 08:14:12 | 000,081,920 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- c:\Program Files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe -- (HPDayStarterService)
SRV - [2010/01/05 11:36:04 | 000,264,248 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe -- (hpHotkeyMonitor)
SRV - [2009/12/17 06:51:46 | 000,102,968 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe -- (HP Wireless Assistant Service)
SRV - [2009/12/17 06:48:12 | 000,102,968 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe -- (HP Power Assistant Service)
SRV - [2009/12/16 09:11:14 | 000,281,192 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe -- (HpFkCryptService)
SRV - [2009/12/15 01:47:46 | 001,639,728 | ---- | M] (Validity Sensors, Inc.) [Auto | Stopped] -- C:\Windows\System32\vcsFPService.exe -- (vcsFPService)
SRV - [2009/12/12 09:57:20 | 000,297,984 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe -- (HPFSService)
SRV - [2009/12/11 07:03:52 | 000,251,448 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- c:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2009/12/04 20:22:40 | 000,506,472 | ---- | M] (ArcSoft, Inc.) [Auto | Running] -- C:\Windows\System32\uArcCapture.exe -- (uArcCapture)
SRV - [2009/12/04 04:30:42 | 000,229,461 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\stacsv.exe -- (STacSV)
SRV - [2009/11/25 10:57:20 | 000,300,808 | ---- | M] (DigitalPersona, Inc.) [Auto | Running] -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe -- (DpHost)
SRV - [2009/11/19 07:17:36 | 000,036,864 | ---- | M] (Hewlett-Packard Development Company, L.P) [Auto | Running] -- c:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe -- (HP ProtectTools Service)
SRV - [2009/11/18 06:39:16 | 000,362,040 | ---- | M] (Hewlett-Packard Ltd) [On_Demand | Stopped] -- C:\Windows\System32\flcdlock.exe -- (FLCDLOCK)
SRV - [2009/11/16 02:31:08 | 000,049,152 | ---- | M] () [Auto | Running] -- C:\Program Files\ShrewSoft\VPN Client\dtpd.exe -- (dtpd)
SRV - [2009/11/16 02:29:10 | 000,716,800 | ---- | M] () [Auto | Running] -- C:\Program Files\ShrewSoft\VPN Client\iked.exe -- (iked)
SRV - [2009/11/16 02:26:42 | 000,536,576 | ---- | M] () [Auto | Running] -- C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe -- (ipsecd)
SRV - [2009/11/05 05:46:56 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2009/11/05 05:46:54 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009/10/24 03:52:36 | 000,635,416 | ---- | M] (PDF Complete Inc) [Auto | Running] -- C:\Program Files\PDF Complete\pdfsvc.exe -- (pdfcDispatcher)
SRV - [2009/09/29 00:42:50 | 000,109,056 | ---- | M] (ArcSoft Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/09/05 03:43:38 | 000,595,232 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2009/08/26 00:57:52 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2009/07/14 09:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009/07/14 09:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 09:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/14 09:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/03/05 23:57:56 | 000,227,352 | ---- | M] (SonicWALL, Inc.) [Auto | Running] -- C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe -- (SWGVCSvc)
SRV - [2009/03/03 18:43:08 | 000,081,920 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9fc8b38ddee9fbba\AEstSrv.exe -- (AESTFilters)
SRV - [2008/07/29 13:10:46 | 003,201,024 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe -- (msvsmon90)
SRV - [2007/07/25 03:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2007/02/22 18:39:44 | 002,808,664 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe -- (msvsmon80)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Admin\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2012/04/06 13:21:10 | 009,334,784 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2012/04/06 13:21:10 | 009,334,784 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2012/04/06 09:10:22 | 000,275,968 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/03/20 20:44:12 | 000,074,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2012/02/23 20:31:58 | 000,086,544 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService)
DRV - [2011/10/05 16:46:54 | 000,055,864 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SCSK5.sys -- (scsk5)
DRV - [2011/09/02 23:47:45 | 000,126,048 | ---- | M] (Kings Information & Network) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\kcrtx86.sys -- (kcrtx86)
DRV - [2011/06/29 23:02:16 | 000,026,112 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tap0901.sys -- (tap0901)
DRV - [2010/11/20 20:30:17 | 000,296,064 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcvmm.sys -- (vpcvmm)
DRV - [2010/11/20 20:30:17 | 000,172,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpchbus.sys -- (vpcbus)
DRV - [2010/11/20 20:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 20:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 20:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 18:50:38 | 000,078,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpcusb.sys -- (vpcusb)
DRV - [2010/11/20 18:50:37 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcnfltr.sys -- (vpcnfltr)
DRV - [2010/11/20 18:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 17:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\winusb.sys -- (WinUSB)
DRV - [2010/11/20 17:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 17:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/09/21 02:42:46 | 000,070,704 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmci.sys -- (vmci)
DRV - [2010/09/21 02:42:44 | 000,854,064 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmx86.sys -- (vmx86)
DRV - [2010/09/21 02:41:08 | 000,024,624 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMkbd.sys -- (vmkbd)
DRV - [2010/09/21 02:40:04 | 000,026,288 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmnetuserif.sys -- (VMnetuserif)
DRV - [2010/09/21 01:42:32 | 000,032,304 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\hcmon.sys -- (hcmon)
DRV - [2010/09/20 23:18:16 | 000,031,280 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmusb.sys -- (vmusb)
DRV - [2010/09/20 23:18:14 | 000,036,400 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmnetbridge.sys -- (VMnetBridge)
DRV - [2010/09/20 23:18:14 | 000,016,560 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV - [2010/08/19 13:56:38 | 000,022,448 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Program Files\VMware\VMware Player\vstor2-ws60.sys -- (vstor2-ws60)
DRV - [2010/06/26 01:07:14 | 000,035,088 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2010/05/13 14:55:18 | 000,047,712 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\NPIdsVt.sys -- (NPIDS)
DRV - [2009/12/23 05:37:28 | 000,073,344 | ---- | M] (Realtek Semiconductor Corp.) [2 MP Fixed] [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtsuvc.sys -- (rtsuvc)
DRV - [2009/12/16 09:12:28 | 000,051,800 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\windows\System32\drivers\SbAlg.sys -- (SbAlg)
DRV - [2009/12/16 09:12:16 | 000,013,256 | ---- | M] (McAfee, Inc.) [File_System | Boot | Running] -- C:\windows\System32\drivers\SbFsLock.sys -- (SbFsLock)
DRV - [2009/12/16 09:12:14 | 000,040,088 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\windows\System32\drivers\rsvlock.sys -- (RsvLock)
DRV - [2009/12/16 09:12:10 | 000,110,520 | ---- | M] () [Kernel | Boot | Running] -- C:\windows\System32\drivers\SafeBoot.sys -- (SafeBoot)
DRV - [2009/12/04 18:48:18 | 000,029,824 | ---- | M] (ArcSoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ArcSoftVCapture.sys -- (ARCVCAM)
DRV - [2009/12/04 04:30:42 | 000,423,424 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2009/11/19 08:06:18 | 000,017,408 | ---- | M] (Shrew Soft Inc) [Kernel | System | Running] -- C:\Windows\System32\drivers\vfilter.sys -- (vflt)
DRV - [2009/11/19 08:06:16 | 000,009,728 | ---- | M] (Shrew Soft Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\virtualnet.sys -- (vnet)
DRV - [2009/11/18 20:25:04 | 000,100,352 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2009/11/11 17:11:00 | 000,181,792 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV - [2009/10/22 05:37:52 | 000,032,312 | ---- | M] (Hewlett-Packard Development Company L.P.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\DAMDrv.sys -- (DAMDrv)
DRV - [2009/10/06 00:31:50 | 001,221,632 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009/09/18 04:54:14 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HECI.sys -- (HECI) Intel(R)
DRV - [2009/07/17 05:16:50 | 000,015,872 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2009/07/14 07:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\serial.sys -- (Serial)
DRV - [2009/07/14 07:12:52 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tpm.sys -- (TPM)
DRV - [2009/07/14 06:13:48 | 001,035,776 | ---- | M] (LSI Corp) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2009/07/09 05:48:38 | 000,025,656 | ---- | M] (Hewlett-Packard) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hpdskflt.sys -- (hpdskflt)
DRV - [2009/07/09 05:48:22 | 000,033,848 | ---- | M] (Hewlett-Packard) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Accelerometer.sys -- (Accelerometer)
DRV - [2009/05/16 09:15:14 | 000,214,024 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2009/05/16 09:15:14 | 000,079,816 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mfeavfk.sys -- (MfeAVFK)
DRV - [2009/05/16 09:15:14 | 000,055,336 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mfetdik.sys -- (mfetdik)
DRV - [2009/05/16 09:15:14 | 000,035,272 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mfebopk.sys -- (MfeBOPK)
DRV - [2009/05/16 09:15:14 | 000,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mferkdk.sys -- (MfeRKDK)
DRV - [2009/03/30 03:09:28 | 000,239,336 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\RsFx0103.sys -- (RsFx0103)
DRV - [2009/03/05 23:58:12 | 000,087,064 | ---- | M] (SonicWALL, Inc.) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\SWIPsec.sys -- (SWIPsec)
DRV - [2009/03/04 18:03:32 | 000,021,016 | ---- | M] (SonicWALL, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SWVNIC.sys -- (SWVNIC)
DRV - [2008/11/16 18:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
DRV - [2006/11/11 06:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc)

 

[happycan]

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPCOM/1
IE - HKLM\..\SearchScopes,DefaultScope = {A824A130-D6EE-4CCF-B11F-66015843DFA5}
IE - HKLM\..\SearchScopes\{A824A130-D6EE-4CCF-B11F-66015843DFA5}: "URL" = http://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.my/
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={...685a418f123&lang=en&ds=AVG&pr=fr&d=2012-06-19 09:45:15&v=11.1.0.7&sap=dsp&q={searchTerms}
IE - HKCU\..\SearchScopes\{A824A130-D6EE-4CCF-B11F-66015843DFA5}: "URL" = http://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..extensions.enabledItems: otis@digitalpersona.com:5.0.0.4191
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.2
FF - prefs.js..extensions.enabledItems: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.16
FF - prefs.js..extensions.enabledItems: firecookie@janodvarko.cz:1.2.1
FF - prefs.js..extensions.enabledItems: firesheep@codebutler.com:0.1
FF - prefs.js..extensions.enabledItems: xssme@security.compass:0.4.4
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..network.proxy.http: "192.192.14.60"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@ahnlab.com/asp/npaosmgr.1: C:\Program Files\AhnLab\ASP\Components\aosmgr\npaosmgr.dll (AhnLab, Inc.)
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\\npsitesafety.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@interezen.co.kr/npi3gmanager: C:\Program Files\Interezen\Plugins\NPI3GManager.dll (Interezen (c) Interezen.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.609: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.609: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.609: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.609: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@softforum.com/npKeyPro: C:\windows\system32\npKeyPro.dll (SoftForum Co., Ltd.)
FF - HKLM\Software\MozillaPlugins\@softforum.com/npxwebplugins: C:\Program Files\SoftForum\XecureWeb\ActiveX\npxwebplugin.dll (SoftForum Co., Ltd.)
FF - HKLM\Software\MozillaPlugins\@softforum.com/npxwebplugins_file: C:\Program Files\SoftForum\XecureWeb\ActiveX\npxwebplugin_file.dll (SoftForum Co., Ltd.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@wizvera.com/npVeraport20: C:\Program Files\Wizvera\Veraport20\npveraport20.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Admin\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Admin\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\otis@digitalpersona.com: c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\ [2010/01/21 15:14:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/11/23 20:41:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\11.1.0.7\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/07 09:51:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/06/19 23:50:56 | 000,000,000 | ---D | M]

[2010/06/03 10:45:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions
[2012/06/07 09:53:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\v9jxeddn.default\extensions
[2012/06/07 09:52:45 | 000,000,000 | ---D | M] (Live HTTP Headers) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\v9jxeddn.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}
[2011/05/03 12:44:40 | 000,000,000 | ---D | M] (Firecookie) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\v9jxeddn.default\extensions\firecookie@janodvarko.cz
[2010/11/10 10:59:05 | 000,000,000 | ---D | M] (Firesheep) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\v9jxeddn.default\extensions\firesheep@codebutler.com
[2012/06/19 23:51:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/06/19 23:51:10 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012/06/07 09:53:58 | 001,335,949 | ---- | M] () (No name found) -- C:\USERS\ADMIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\V9JXEDDN.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI
[2012/06/07 09:52:51 | 000,106,978 | ---- | M] () (No name found) -- C:\USERS\ADMIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\V9JXEDDN.DEFAULT\EXTENSIONS\XSSME@SECURITY.COMPASS.XPI
[2012/06/01 23:40:25 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/06/19 09:45:11 | 000,003,747 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/06/01 23:39:16 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/06/01 23:39:16 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: AVG Secure Search (Enabled)
CHR - default_search_provider: search_url = http://isearch.avg.com/search?cid={...685a418f123&lang=en&ds=AVG&pr=fr&d=2012-06-19 09:45:15&v=11.1.0.7&sap=dsp&q={searchTerms}
CHR - default_search_provider: suggest_url = http://clients5.google.com/complete...inputEncoding}&outputencoding={outputEncoding}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Admin\AppData\Local\Google\Chrome\Application\19.0.1084.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Admin\AppData\Local\Google\Chrome\Application\19.0.1084.56\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Admin\AppData\Local\Google\Chrome\Application\19.0.1084.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U23 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: AhnLab Online Security (Enabled) = C:\Program Files\AhnLab\ASP\Components\aosmgr\npaosmgr.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: NPI3GManager (c) Interezen. plugin (Enabled) = C:\Program Files\Interezen\Plugins\NPI3GManager.dll
CHR - plugin: SoftForum XecureWeb Control Plug-in (Enabled) = C:\Program Files\SoftForum\XecureWeb\ActiveX\npxwebplugin.dll
CHR - plugin: SoftForum XecureWeb File Control Plug-in (Enabled) = C:\Program Files\SoftForum\XecureWeb\ActiveX\npxwebplugin_file.dll
CHR - plugin: Veraport Mozilla Plugin (Enabled) = C:\Program Files\Wizvera\Veraport20\npveraport20.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: ClientKeeper KeyPro for Multi-Browser (Enabled) = C:\windows\system32\npKeyPro.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - Extension: Entanglement = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd\2.7.9_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.3_0\
CHR - Extension: Poppit = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi\2.2_0\

O1 HOSTS File: ([2012/06/21 21:09:42 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (File Sanitizer for HP ProtectTools) - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
O2 - BHO: (HP ProtectTools Security Manager Extension) - {395610AE-C624-4f58-B89E-23733EA00F9A} - c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O4 - HKLM..\Run: [AMD AVT] C:\windows\System32\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [DTRun] c:\Program Files\Arcsoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [File Sanitizer] C:\Program Files\Hewlett-Packard\File Sanitizer\coreshredder.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPPowerAssistant] C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe ()
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files\Symantec\Norton Online Backup\Activation\NobuActivation.exe (Symantec Corporation)
O4 - HKLM..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe (PDF Complete Inc)
O4 - HKLM..\Run: [QLBController] C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [VMware hqtray] C:\Program Files\VMware\VMware Player\hqtray.exe (VMware, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/Plants%20vs.%20Zombies/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1FAF427B-1EE5-43D3-A023-3009142AFCD9} https://ost.maybank2u.com.my/MBBWecos/Cab/csoex_mbb.cab (CS Order Entry Control (MBB))
O16 - DPF: {39461460-2552-4D51-A062-3AB6A7B902E9} http://img.shinhan.com/shttp/install/70045/down/INIS70.cab (INISAFE Updater Control)
O16 - DPF: {477D5B9A-6479-44F8-9718-9340119B0308} http://www.hanabank.com/resource/download/veraport/down/veraport20.cab (Veraport20Ctl Class)
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} https://download.alipay.com/aliedit/aliedit/2401/aliedit.cab (EditCtrl Class)
O16 - DPF: {48ECCD73-123C-4C25-A64C-76E8E8A30CAF} http://mpi.dacom.net/XPayMPI/XPayMPIOCX.cab (XPayMPIOCX Control)
O16 - DPF: {5EC2D418-1B2A-40E6-904C-CA8B7ADB3682} https://ost.maybank2u.com.my/MBBWecos/Cab/csta.cab (csta Control)
O16 - DPF: {6CE20149-ABE3-462E-A1B4-5B549971AA38} Reg Error: Key error. (XecureCKKB Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {92FD95E5-99AB-403A-98F9-53521AAB82A0} http://www.cybermap.co.kr/cm2000/company2/kyochonck/CYBERMAP_ASP2_KYOCHONCK.cab (CYBERMAP_ASP2_KYOCHONCK Control)
O16 - DPF: {967386A1-409E-431A-A93A-FB5FEFF86A58} http://fx.keb.co.kr/veraport/veraport.cab (AXMObjectCtl Class)
O16 - DPF: {B9B2EE1A-E314-4338-A305-BE845EACB113} https://ost.maybank2u.com.my/MBBWecos/Cab/csw25.cab (CyberStock 250)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.4.2/jinstall-1_4_2_03-windows-i586.cab (Java Plug-in 1.4.2_03)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Plants%20vs.%20Zombies/Images/armhelper.ocx (ArmHelper Control)
O16 - DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} https://www.vpay.co.kr/kvpfiles_vista/KVPISPCTLD_VISTA.cab (KvpIspCtlD Control)
O16 - DPF: {F025D01A-28DC-4C14-8253-7F663864825F} http://211.57.102.21/ZaolmapClient.cab (ZaolmapClient Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{738E1823-B922-4CDC-B206-AB4F49100175}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7409A480-2E91-46C5-B90C-749F041A61C2}: DhcpNameServer = 192.168.100.242 192.168.100.240
O18 - Protocol\Handler\s-http {D37E6C5F-1C0F-47C0-A3B6-403EEC555402} - C:\Program Files\INITECH\SHTTP\InitechSHTTPInterface.10121.dll ((c) INITECH)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\DeviceNP: DllName - (DeviceNP.dll) - C:\windows\System32\DeviceNP.dll (Hewlett-Packard Limited)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/06/21 21:02:30 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/06/21 09:52:40 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{52472DC3-B39B-47EC-B2D5-2B67BA0E3730}
[2012/06/21 09:52:14 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{BF219663-8228-465A-B700-71530F0CAB06}
[2012/06/20 16:20:13 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Admin\Documents\OTL.exe
[2012/06/20 09:35:24 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{87709746-F0AF-4E87-B88E-A55CEC9D5478}
[2012/06/20 09:35:13 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{6DCD8328-3DD4-4034-81ED-17105AC0480E}
[2012/06/20 09:23:37 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012/06/20 09:18:39 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Windows Live
[2012/06/20 00:38:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WCF RIA Services V1.0 SP1
[2012/06/20 00:38:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 4 SDK
[2012/06/20 00:37:23 | 000,000,000 | ---D | C] -- C:\ProgramData\VS
[2012/06/20 00:13:16 | 000,000,000 | ---D | C] -- C:\windows\System32\SPReview
[2012/06/20 00:11:03 | 000,000,000 | ---D | C] -- C:\windows\System32\EventProviders
[2012/06/20 00:08:43 | 000,000,000 | ---D | C] -- C:\FRST
[2012/06/19 14:19:07 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/06/19 13:14:18 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\temp
[2012/06/19 13:03:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox
[2012/06/19 12:50:48 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe
[2012/06/19 12:50:48 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe
[2012/06/19 12:50:48 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe
[2012/06/19 12:47:40 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/06/19 12:46:42 | 000,000,000 | ---D | C] -- C:\windows\erdnt
[2012/06/19 12:40:23 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG Secure Search
[2012/06/19 12:30:00 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\AVG2012
[2012/06/19 11:34:46 | 010,142,944 | ---- | C] (OPSWAT, Inc.) -- C:\Users\Admin\Documents\AppRemover.exe
[2012/06/19 11:09:06 | 004,560,591 | R--- | C] (Swearware) -- C:\Users\Admin\Desktop\ComboFix.exe
[2012/06/19 09:45:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\AVG Secure Search
[2012/06/19 09:45:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2012/06/19 09:45:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AVG Secure Search
[2012/06/19 09:44:55 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012/06/19 09:44:19 | 000,000,000 | ---D | C] -- C:\$AVG
[2012/06/19 09:44:18 | 000,000,000 | ---D | C] -- C:\windows\System32\drivers\AVG
[2012/06/19 05:33:36 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012/06/18 20:59:47 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\hpqlog
[2012/06/18 20:35:54 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2012/06/18 17:49:18 | 000,000,000 | -HSD | C] -- C:\windows\System32\%APPDATA%
[2012/06/11 17:23:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Apps Sync
[2012/06/07 09:52:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012/06/07 09:52:04 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2012/05/30 11:04:45 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\mol3.molsolutions.com.pfx

========== Files - Modified Within 30 Days ==========

[2012/06/21 21:26:00 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012/06/21 21:21:00 | 000,000,884 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/21 21:19:14 | 000,020,944 | ---- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/21 21:19:14 | 000,020,944 | ---- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/21 21:11:12 | 000,000,880 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/21 21:11:05 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012/06/21 21:10:59 | 2402,885,632 | -HS- | M] () -- C:\hiberfil.sys
[2012/06/21 21:09:42 | 000,000,098 | ---- | M] () -- C:\windows\System32\drivers\etc\Hosts
[2012/06/21 20:48:00 | 000,000,908 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-325877220-3748803948-952250591-1002UA.job
[2012/06/21 17:55:01 | 001,132,525 | ---- | M] () -- C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix1.pdf
[2012/06/20 22:48:02 | 000,000,856 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-325877220-3748803948-952250591-1002Core.job
[2012/06/20 21:20:54 | 000,883,956 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012/06/20 21:20:54 | 000,205,796 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012/06/20 16:21:02 | 000,000,885 | ---- | M] () -- C:\Users\Admin\Documents\hosts
[2012/06/20 16:20:04 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Documents\OTL.exe
[2012/06/20 16:09:08 | 374,022,632 | ---- | M] () -- C:\windows\MEMORY.DMP
[2012/06/20 15:29:33 | 000,028,672 | ---- | M] () -- C:\Users\Admin\Documents\Notice Digicash will be in maintenance at 20 June 2012.msg
[2012/06/20 03:06:46 | 000,415,608 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2012/06/19 17:35:56 | 000,003,454 | ---- | M] () -- C:\Users\Admin\Documents\rptapr.htm
[2012/06/19 17:24:10 | 000,003,455 | ---- | M] () -- C:\Users\Admin\Documents\rptmay.htm
[2012/06/19 17:12:42 | 000,003,560 | ---- | M] () -- C:\Users\Admin\Documents\rpt.htm
[2012/06/19 11:35:08 | 010,142,944 | ---- | M] (OPSWAT, Inc.) -- C:\Users\Admin\Documents\AppRemover.exe
[2012/06/19 11:09:10 | 004,560,591 | R--- | M] (Swearware) -- C:\Users\Admin\Desktop\ComboFix.exe
[2012/06/19 10:11:34 | 000,034,764 | ---- | M] () -- C:\Users\Admin\AppData\Local\dt.dat
[2012/06/19 07:42:52 | 000,875,626 | ---- | M] () -- C:\Users\Admin\Documents\FRST.exe
[2012/06/19 05:33:15 | 000,139,264 | ---- | M] () -- C:\Users\Admin\Documents\SystemLook.exe
[2012/06/18 20:37:34 | 000,001,945 | ---- | M] () -- C:\windows\epplauncher.mif
[2012/06/15 11:48:45 | 000,380,674 | ---- | M] () -- C:\Users\Admin\Documents\seafprocedure.pdf
[2012/06/15 11:48:38 | 000,402,665 | ---- | M] () -- C:\Users\Admin\Documents\seafquotation.pdf
[2012/06/15 11:43:20 | 000,388,972 | ---- | M] () -- C:\Users\Admin\Documents\airfprocedure.pdf
[2012/06/15 11:43:00 | 000,401,974 | ---- | M] () -- C:\Users\Admin\Documents\airfquotation.pdf
[2012/06/12 09:48:12 | 000,002,402 | ---- | M] () -- C:\Users\Admin\Desktop\Google Chrome.lnk
[2012/06/12 08:53:49 | 000,000,320 | ---- | M] () -- C:\windows\tasks\HPCeeScheduleForAdmin.job
[2012/06/07 09:52:07 | 000,001,990 | ---- | M] () -- C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/06/07 09:52:07 | 000,001,088 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/06/01 21:14:27 | 000,920,745 | ---- | M] () -- C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix.pdf
[2012/06/01 14:49:11 | 001,041,870 | ---- | M] () -- C:\Users\Admin\Documents\Microsoft.Lead2pass.70-516.v2012-05-31.by.Johny.217q.vce
[2012/05/30 16:41:12 | 000,000,358 | ---- | M] () -- C:\Users\Admin\Documents\bt.htm
[2012/05/30 11:04:26 | 000,001,800 | ---- | M] () -- C:\Users\Admin\Documents\mol3.molsolutions.com.pfx.zip
[2012/05/28 17:15:16 | 000,879,616 | ---- | M] () -- C:\Users\Admin\Documents\Copy (1) of Payment Flows.vsd
[2012/05/28 16:42:35 | 000,916,480 | ---- | M] () -- C:\Users\Admin\Documents\Payment Flows.vsd
[2012/05/28 14:54:35 | 000,362,496 | ---- | M] () -- C:\Users\Admin\Documents\RE Digicash Pricing.msg
[2012/05/27 01:28:09 | 001,865,201 | ---- | M] () -- C:\Users\Admin\Documents\Microsoft.TestKing.70-516.v2012-02-03.by.Lyudmyla.v190q.vce
[2012/05/27 01:26:46 | 001,856,837 | ---- | M] () -- C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-03-16.by.Edom.195q.vce
[2012/05/27 01:25:15 | 001,868,219 | ---- | M] () -- C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix.193q.vce

========== Files Created - No Company Name ==========

[2012/06/20 16:21:01 | 000,000,885 | ---- | C] () -- C:\Users\Admin\Documents\hosts
[2012/06/20 16:13:26 | 000,000,830 | ---- | C] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012/06/20 15:29:32 | 000,028,672 | ---- | C] () -- C:\Users\Admin\Documents\Notice Digicash will be in maintenance at 20 June 2012.msg
[2012/06/20 09:26:47 | 000,002,432 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2012/06/19 17:35:56 | 000,003,454 | ---- | C] () -- C:\Users\Admin\Documents\rptapr.htm
[2012/06/19 17:24:09 | 000,003,455 | ---- | C] () -- C:\Users\Admin\Documents\rptmay.htm
[2012/06/19 16:56:46 | 000,003,560 | ---- | C] () -- C:\Users\Admin\Documents\rpt.htm
[2012/06/19 12:50:48 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe
[2012/06/19 12:50:48 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe
[2012/06/19 12:50:48 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe
[2012/06/19 12:50:48 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe
[2012/06/19 12:50:48 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe
[2012/06/19 10:11:34 | 000,034,764 | ---- | C] () -- C:\Users\Admin\AppData\Local\dt.dat
[2012/06/19 07:42:57 | 000,875,626 | ---- | C] () -- C:\Users\Admin\Documents\FRST.exe
[2012/06/19 05:33:27 | 000,139,264 | ---- | C] () -- C:\Users\Admin\Documents\SystemLook.exe
[2012/06/18 20:36:05 | 000,001,915 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2012/06/15 11:48:46 | 000,380,674 | ---- | C] () -- C:\Users\Admin\Documents\seafprocedure.pdf
[2012/06/15 11:48:40 | 000,402,665 | ---- | C] () -- C:\Users\Admin\Documents\seafquotation.pdf
[2012/06/15 11:43:55 | 000,401,974 | ---- | C] () -- C:\Users\Admin\Documents\airfquotation.pdf
[2012/06/15 11:43:42 | 000,388,972 | ---- | C] () -- C:\Users\Admin\Documents\airfprocedure.pdf
[2012/06/07 09:52:07 | 000,001,100 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/06/04 01:53:45 | 001,132,525 | ---- | C] () -- C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix1.pdf
[2012/06/01 21:14:27 | 000,920,745 | ---- | C] () -- C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix.pdf
[2012/06/01 14:49:19 | 001,041,870 | ---- | C] () -- C:\Users\Admin\Documents\Microsoft.Lead2pass.70-516.v2012-05-31.by.Johny.217q.vce
[2012/05/30 16:41:11 | 000,000,358 | ---- | C] () -- C:\Users\Admin\Documents\bt.htm
[2012/05/30 11:04:06 | 000,001,800 | ---- | C] () -- C:\Users\Admin\Documents\mol3.molsolutions.com.pfx.zip
[2012/05/28 17:02:32 | 000,879,616 | ---- | C] () -- C:\Users\Admin\Documents\Copy (1) of Payment Flows.vsd
[2012/05/28 16:42:33 | 000,916,480 | ---- | C] () -- C:\Users\Admin\Documents\Payment Flows.vsd
[2012/05/28 14:54:34 | 000,362,496 | ---- | C] () -- C:\Users\Admin\Documents\RE Digicash Pricing.msg
[2012/05/27 01:28:06 | 001,865,201 | ---- | C] () -- C:\Users\Admin\Documents\Microsoft.TestKing.70-516.v2012-02-03.by.Lyudmyla.v190q.vce
[2012/05/27 01:26:43 | 001,856,837 | ---- | C] () -- C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-03-16.by.Edom.195q.vce
[2012/05/27 01:25:19 | 001,868,219 | ---- | C] () -- C:\Users\Admin\Documents\Microsoft.PrepKing.70-516.v2012-04-06.by.Matrix.193q.vce
[2012/05/02 10:04:40 | 000,038,430 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Comma Separated Values (Windows).ADR
[2012/04/15 12:34:12 | 000,000,168 | ---- | C] () -- C:\ProgramData\-FZ0g9DtPRuLMbnr
[2012/04/15 12:34:12 | 000,000,000 | ---- | C] () -- C:\ProgramData\-FZ0g9DtPRuLMbn
[2012/04/15 12:34:08 | 000,000,256 | ---- | C] () -- C:\ProgramData\FZ0g9DtPRuLMbn
[2012/04/06 09:21:42 | 000,204,952 | ---- | C] () -- C:\windows\System32\ativvsvl.dat
[2012/04/06 09:21:42 | 000,157,144 | ---- | C] () -- C:\windows\System32\ativvsva.dat
[2012/04/05 22:34:22 | 000,159,232 | ---- | C] () -- C:\windows\System32\clinfo.exe
[2012/03/09 14:06:14 | 000,024,576 | ---- | C] () -- C:\windows\System32\kdbsdk32.dll
[2012/03/05 16:16:04 | 000,087,552 | ---- | C] () -- C:\windows\System32\cpwmon2k.dll
[2012/01/11 05:10:08 | 000,601,728 | ---- | C] () -- C:\windows\System32\atiicdxx.dat
[2012/01/03 22:23:18 | 000,007,602 | ---- | C] () -- C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
[2011/12/12 09:35:24 | 000,000,000 | ---- | C] () -- C:\Users\Admin\AppData\Local\{52F8E5AF-8487-43F1-9BDE-2F39FE993B62}
[2011/10/04 09:58:44 | 000,055,864 | ---- | C] () -- C:\windows\System32\drivers\SCSK5.sys
[2011/09/13 06:06:16 | 000,003,917 | ---- | C] () -- C:\windows\System32\atipblag.dat
[2011/09/06 09:52:47 | 000,000,024 | ---- | C] () -- C:\windows\System32\scskConfigEH.ini
[2011/09/02 23:49:07 | 000,015,512 | ---- | C] () -- C:\windows\System32\IRTrace.dll
[2011/09/02 23:49:05 | 000,072,272 | ---- | C] () -- C:\windows\System32\cosa.dll
[2011/07/01 10:39:34 | 000,066,048 | ---- | C] () -- C:\windows\System32\PrintBrmUi.exe
[2010/07/15 10:14:48 | 001,205,544 | ---- | C] () -- C:\windows\System32\ISPPopUpDlg.exe
[2010/06/26 01:03:12 | 000,053,299 | ---- | C] () -- C:\windows\System32\pthreadVC.dll

========== LOP Check ==========

[2012/06/19 12:30:00 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\AVG2012
[2010/05/27 16:24:06 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\DigitalPersona
[2012/06/21 17:44:01 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FileZilla
[2010/06/07 23:11:16 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\SpinTop
[2010/05/31 14:17:17 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Subversion
[2012/05/07 18:21:05 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\WatchGuard
[2012/05/14 09:33:09 | 000,032,606 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========


< End of report >

 

[Broni]

Good

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

• Double-click SecurityCheck.exe
• Follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  
  NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

• Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

3. Download Temp File Cleaner (TFC)

• Double click on TFC.exe to run the program.
• Click on Start button to begin cleaning process.
• TFC will close all running programs, and it may ask you to restart computer.

4. Please run a free online scan with the ESET Online Scanner

• Disable your antivirus program
• Tick the box next to YES, I accept the Terms of Use
• Click Start
• Accept any security warnings from your browser.
• Check Scan archives
• Click Start
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, click on List of found threats
• Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• NOTE. If Eset won't find any threats, it won't produce any log.

 

[Broni]

Still with me?