Page 1 of 4 1234 LastLast
Results 1 to 10 of 35

Thread: Hopelessly infected, please help!

  1. #1
    Member
    Join Date
    Apr 2006
    Posts
    69

    Default Hopelessly infected, please help!

    Hi all. I'm seriously infected here. I'm in safe mode, and connected manually because wireless doesn't work. Please help me!


    .
    ============== Running Processes ===============
    .
    C:\windows\system32\svchost.exe -k DcomLaunch
    C:\windows\system32\svchost.exe -k RPCSS
    C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\windows\system32\dwm.exe
    C:\windows\system32\svchost.exe -k netsvcs
    C:\windows\system32\svchost.exe -k LocalService
    C:\windows\system32\svchost.exe -k NetworkService
    C:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted
    C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\windows\Explorer.EXE
    C:\windows\system32\ctfmon.exe
    C:\windows\system32\wbem\wmiprvse.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\windows\SysWOW64\NOTEPAD.EXE
    C:\windows\system32\wbem\wmiprvse.exe
    C:\windows\System32\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.com/
    uWindow Title = Internet Explorer provided by TOSHIBA
    uDefault_Page_URL = hxxp://toshiba13.msn.com
    mStart Page = hxxp://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={E907F3B7-E5DD-11E2-BEA0-00266C1D080D}
    mWindow Title = Internet Explorer provided by TOSHIBA
    mDefault_Page_URL = hxxp://toshiba13.msn.com
    mWinlogon: Userinit = userinit.exe,
    BHO: SelectionLinks: {1C8501DD-5580-48AB-B25C-6D5DBE835A6A} - C:\Program Files (x86)\OApps\SelectionLinks.dll
    BHO: WebCake: {2A5A2A90-3B30-4E6E-A955-2F232C6EF517} - C:\Program Files (x86)\WebCake\WebCakeIEClient.dll
    BHO: Search-Results Toolbar: {35a73de5-0093-4279-bc86-0132572828f4} - C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll
    BHO: LyricsContainer: {463B0ED4-8AFA-404B-90E7-4063A0708050} - C:\Program Files (x86)\LyricsContainer\116.dll
    BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
    BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll
    BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ips\ipsbho.dll
    BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
    BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
    BHO: Updater By SweetPacks: {7D4F1959-3F72-49d5-8E59-F02F8AA6815D} - C:\Program Files\Updater By SweetPacks\Extension32.dll
    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
    BHO: SweetPacks Browser Helper: {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
    TB: Search-Results Toolbar: {35a73de5-0093-4279-bc86-0132572828f4} - C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll
    TB: SweetPacks Toolbar for Internet Explorer: {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
    uRun: [NETGEARGenie] "C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe" -mini -redirect
    uRun: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
    uRun: [WebCake Desktop] "C:\Users\scofi_000\AppData\Roaming\WebCake\WebCakeDesktop.exe"
    uRun: [GoogleChromeAutoLaunch_2C08F89D345314C24ADD2C17EECB11A5] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
    mRun: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
    mRun: [ToshibaAppPlace] "C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe"
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
    mRun: [DATAMNGR] C:\PROGRA~2\LPHANT~1\Mediabar\Datamngr\DATAMN~1.EXE
    mRun: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [DigiDo] "C:\Program Files (x86)\Time Warner Cable\TWC WiFi\TrayApp.exe" startup
    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    StartupFolder: C:\Users\SCOFI_~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ERUNTA~1.LNK - C:\Program Files (x86)\ERUNT\AUTOBACK.EXE
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
    TCP: NameServer = 209.18.47.61 209.18.47.62
    TCP: Interfaces\{1ADB8D32-5A05-4207-9B7A-98F473342EA0} : DHCPNameServer = 209.18.47.61 209.18.47.62
    TCP: Interfaces\{D686A208-E0D7-4937-9B06-4CF98EF601CF} : DHCPNameServer = 209.18.47.61 209.18.47.62
    TCP: Interfaces\{D686A208-E0D7-4937-9B06-4CF98EF601CF}\24F6260216E64602A4563737 : DHCPNameServer = 192.168.1.1
    TCP: Interfaces\{D686A208-E0D7-4937-9B06-4CF98EF601CF}\E45445745414254383 : DHCPNameServer = 192.168.1.1
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    AppInit_DLLs= C:\PROGRA~3\Wincert\WIN32C~1.DLL C:\PROGRA~2\LPHANT~1\Mediabar\Datamngr\datamngr.dll C:\PROGRA~2\LPHANT~1\Mediabar\Datamngr\IEBHO.dll
    SSODL: WebCheck - <orphaned>
    SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
    mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
    x64-mStart Page = hxxp://toshiba13.msn.com
    x64-mWindow Title = Internet Explorer provided by TOSHIBA
    x64-mDefault_Page_URL = hxxp://toshiba13.msn.com
    x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
    x64-BHO: Updater By SweetPacks: {7D4F1959-3F72-49d5-8E59-F02F8AA6815D} - C:\Program Files\Updater By SweetPacks\Extension64.dll
    x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
    x64-Run: [IgfxTray] C:\windows\System32\igfxtray.exe
    x64-Run: [HotKeysCmds] C:\windows\System32\hkcmd.exe
    x64-Run: [Persistence] C:\windows\System32\igfxpers.exe
    x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
    x64-Run: [SRS Premium Sound HD] "C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe" /f="C:\Program Files\SRS Labs\SRS Control Panel\SRS_Premium_Sound_HD.zip" /h
    x64-Run: [TCrdMain] C:\Program Files (x86)\TOSHIBA\Hotkey\TCrdMain_Win8.exe
    x64-Run: [TecoResident] C:\Program Files\TOSHIBA\Teco\TecoResident.exe
    x64-Run: [TosWaitSrv] C:\Program Files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe
    x64-Run: [TSleepSrv] C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe
    x64-Run: [TODDMain] C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe
    x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
    x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
    x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
    x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
    x64-Notify: igfxcui - igfxdev.dll
    x64-SSODL: WebCheck - <orphaned>
    x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 iaStorA;iaStorA;C:\windows\System32\Drivers\iaStorA.sys [2012-9-24 645952]
    R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\windows\System32\Drivers\TVALZFL.sys [2012-7-21 16768]
    R3 FwLnk;FwLnk Driver;C:\windows\System32\Drivers\FwLnk.sys [2012-9-24 9216]
    R3 L1C;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;C:\windows\System32\Drivers\L1C63x64.sys [2012-7-13 103936]
    R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;C:\windows\System32\Drivers\RtsUVStor.sys [2012-9-24 315536]
    R3 SmbDrvI;SmbDrvI;C:\windows\System32\Drivers\Smb_driver_Intel.sys [2012-8-16 43832]
    R3 tos_sps64;TOSHIBA tos_sps64 Service;C:\windows\System32\Drivers\tos_sps64.sys [2012-9-24 499096]
    S1 ccSet_NARA;NARA Settings Manager;C:\windows\System32\Drivers\NARAx64\0401000.00B\ccSetx64.sys [2012-9-3 168608]
    S1 ccSet_NAT;Norton Anti-Theft Settings Manager;C:\windows\System32\Drivers\NATx64\0108000.020\ccsetx64.sys [2013-6-18 169048]
    S2 IBUpdaterService;IBUpdaterService;C:\windows\System32\dmwu.exe [2013-7-5 1447728]
    S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-4-20 635104]
    S2 Intel(R) ME Service;Intel(R) ME Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2012-9-24 129856]
    S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe [2012-9-24 166720]
    S2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-6-22 418376]
    S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-6-22 701512]
    S2 NAT;Norton Anti-Theft;C:\Program Files (x86)\Norton Anti-Theft\Engine\1.8.0.32\ccsvchst.exe [2013-6-18 144368]
    S2 NETGEARGenieDaemon;NETGEARGenieDaemon;C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe [2012-9-25 231752]
    S2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccsvchst.exe [2013-6-16 144368]
    S2 NOBU;Norton Online Backup;C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2012-7-11 3939008]
    S2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.18.15\SymcPCCULaunchSvc.exe [2012-9-3 123320]
    S2 PCCUJobMgr;Common Client Job Manager Service;C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.18.15\ccSvcHst.exe [2012-9-3 126392]
    S2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2013-6-22 1153368]
    S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;C:\Program Files\Toshiba\Teco\TecoService.exe [2012-8-24 291240]
    S2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-9-24 365376]
    S2 Updater By SweetPacks;Updater By SweetPacks;C:\Program Files\Updater By SweetPacks\ExtensionUpdaterService.exe [2013-7-5 188760]
    S2 WebCake Desktop Updater;WebCake Desktop Updater;C:\Program Files (x86)\WebCake\WebCakeDesktop.Updater.exe [2013-7-5 23552]
    S3 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\BASHDefs\20130322.001\BHDrvx64.sys [2013-3-21 1387608]
    S3 ccSet_NIS;Norton Internet Security Settings Manager;C:\windows\System32\Drivers\NISx64\1404000.028\ccsetx64.sys [2013-6-16 169048]
    S3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-3-6 138912]
    S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
    S3 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\IPSDefs\20130404.001\IDSviA64.sys [2013-4-4 513184]
    S3 IntcDAud;Intel(R) Display Audio;C:\windows\System32\Drivers\IntcDAud.sys [2012-6-19 342528]
    S3 MBAMProtector;MBAMProtector;C:\windows\System32\Drivers\mbam.sys [2013-6-22 25928]
    S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;C:\windows\System32\Drivers\rtwlane.sys [2012-6-29 1498256]
    S3 RTWlanE;Realtek Wireless LAN 802.11n PCI-E Network Adapter;C:\windows\System32\Drivers\rtwlane.sys [2012-6-29 1498256]
    S3 SymDS;Symantec Data Store;C:\windows\System32\Drivers\NISx64\1404000.028\symds64.sys [2013-6-16 493656]
    S3 SymEFA;Symantec Extended File Attributes;C:\windows\System32\Drivers\NISx64\1404000.028\symefa64.sys [2013-6-16 1139800]
    S3 SymIRON;Symantec Iron Driver;C:\windows\System32\Drivers\NISx64\1404000.028\ironx64.sys [2013-6-16 224416]
    S3 SymNetS;Symantec Network Security WFP Driver;C:\windows\System32\Drivers\NISx64\1404000.028\symnets.sys [2013-6-16 433752]
    S3 TMachInfo;TMachInfo;C:\Program Files\Toshiba\TOSHIBA Service Station\TMachInfo.exe [2012-7-27 53384]
    S3 TPCHSrv;TPCH Service;C:\Program Files\Toshiba\TPHM\TPCHSrv.exe [2012-7-28 458152]
    S3 USBAAPL64;Apple Mobile USB Driver;C:\windows\System32\Drivers\usbaapl64.sys [2012-12-13 54784]
    S3 WUDFWpdMtp;WUDFWpdMtp;C:\windows\System32\Drivers\WUDFRd.sys [2012-7-25 198656]
    S4 SymELAM;Symantec ELAM Driver;C:\windows\System32\Drivers\NISx64\1404000.028\symelam.sys [2013-6-16 23448]
    .
    .
    DDS (Ver_2012-11-20.01)
    .
    Microsoft Windows 8
    Boot Device: \Device\HarddiskVolume2
    Install Date: 3/5/2013 5:44:12 PM
    System Uptime: 8/4/2013 11:08:34 AM (0 hours ago)
    .
    Motherboard: TOSHIBA | | Portable PC
    Processor: Intel(R) Core(TM) i7-3630QM CPU @ 2.40GHz | U3E1 | 2395/100mhz
    .


    ==== Installed Programs ======================
    .
    Adobe AIR
    Adobe Flash Player 11 Plugin
    Adobe Reader X (10.1.7)
    Amazon Music Importer
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
    Audacity 1.2.6
    Bejeweled 3
    Bonjour
    D3DX10
    Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
    ERUNT 1.1j
    Farmscapes
    FATE
    Google Chrome
    Google Update Helper
    iCloud
    inSSIDer 3
    Intel(R) Management Engine Components
    Intel(R) Processor Graphics
    Intel(R) Rapid Storage Technology
    Intel(R) SDK for OpenCL - CPU Only Runtime Package
    Intel® Trusted Connect Service Client
    Internet Explorer Toolbar 4.8 by SweetPacks
    iTunes
    Java 7 Update 25
    Java Auto Updater
    LyricsContainer
    Malwarebytes Anti-Malware version 1.75.0.1300
    Microsoft Application Error Reporting
    Microsoft Office
    Microsoft Office 2010 Service Pack 1 (SP1)
    Microsoft Office Access MUI (English) 2010
    Microsoft Office Access Setup Metadata MUI (English) 2010
    Microsoft Office Excel MUI (English) 2010
    Microsoft Office Groove MUI (English) 2010
    Microsoft Office InfoPath MUI (English) 2010
    Microsoft Office Office 64-bit Components 2010
    Microsoft Office OneNote MUI (English) 2010
    Microsoft Office Outlook MUI (English) 2010
    Microsoft Office PowerPoint MUI (English) 2010
    Microsoft Office Professional Plus 2010
    Microsoft Office Proof (English) 2010
    Microsoft Office Proof (French) 2010
    Microsoft Office Proof (Spanish) 2010
    Microsoft Office Proofing (English) 2010
    Microsoft Office Publisher MUI (English) 2010
    Microsoft Office Shared 64-bit MUI (English) 2010
    Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
    Microsoft Office Shared MUI (English) 2010
    Microsoft Office Shared Setup Metadata MUI (English) 2010
    Microsoft Office Word MUI (English) 2010
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Movie Maker
    MSVCRT
    MSVCRT110
    MSVCRT110_amd64
    NETGEAR Genie
    Norton Anti-Theft
    Norton Internet Security
    Norton Online Backup
    Norton Online Backup ARA
    Norton PC Checkup
    Norton Security Dashboard
    Origin
    Penguins!
    Photo Common
    Photo Gallery
    Plants vs. Zombies - Game of the Year
    PlayReady PC Runtime amd64
    Polar Bowler
    Premium Sound HD
    QuickTime
    Realtek High Definition Audio Driver
    Realtek USB 2.0 Card Reader
    Realtek WLAN Driver
    Search-Results Toolbar
    Security Update for Microsoft Excel 2010 (KB2597126) 32-Bit Edition
    Security Update for Microsoft Filter Pack 2.0 (KB2553501) 32-Bit Edition
    Security Update for Microsoft InfoPath 2010 (KB2687422) 32-Bit Edition
    Security Update for Microsoft InfoPath 2010 (KB2760406) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2553091)
    Security Update for Microsoft Office 2010 (KB2553096)
    Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2687276) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2687501) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2687510) 32-Bit Edition
    Security Update for Microsoft OneNote 2010 (KB2760600) 32-Bit Edition
    Security Update for Microsoft Publisher 2010 (KB2553147) 32-Bit Edition
    Security Update for Microsoft Visio 2010 (KB2810068) 32-Bit Edition
    Security Update for Microsoft Visio Viewer 2010 (KB2687505) 32-Bit Edition
    Security Update for Microsoft Word 2010 (KB2760410) 32-Bit Edition
    SelectionLinks
    SilvestriRN5e
    Spybot - Search & Destroy
    SweetPacks Updater Service
    Synaptics Pointing Device Driver
    Toshiba App Place
    TOSHIBA Application Installer
    Toshiba Book Place
    TOSHIBA Desktop Assist
    TOSHIBA eco Utility
    TOSHIBA Function Key
    TOSHIBA Password Utility
    TOSHIBA PC Health Monitor
    TOSHIBA Quality Application
    TOSHIBA Recovery Media Creator
    TOSHIBA Resolution+ Plug-in for Windows Media Player
    TOSHIBA Service Station
    TOSHIBA System Driver
    TOSHIBA System Settings
    TOSHIBA User's Guide
    TOSHIBA VIDEO PLAYER
    TOSHIBARegistration
    TWC WiFi
    Update for Microsoft Office 2010 (KB2553065)
    Update for Microsoft Office 2010 (KB2553092)
    Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2566458)
    Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition
    Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
    Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition
    Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition
    Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
    Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition
    Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition
    Update Installer for WildTangent Games App
    Updater By SweetPacks 2.0.0.586
    Virtual Villagers 4 - The Tree of Life
    WebCake 3.00
    WildTangent Games
    WildTangent Games App (Toshiba Games)
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Installer
    Windows Live Photo Common
    Windows Live PIMT Platform
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    .
    ==== Event Viewer Messages From Past Week ========
    .
    8/4/2013 11:18:36 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    8/4/2013 11:18:36 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    8/4/2013 11:10:08 AM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
    8/4/2013 11:10:08 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service dps with arguments "Unavailable" in order to run the server: {7022A3B3-D004-4F52-AF11-E9E987FEE25F}
    8/4/2013 11:10:07 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    8/4/2013 11:10:02 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    8/4/2013 11:10:01 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "Unavailable" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    .
    ==== End Of File ===========================

    aswMBR would not run.

    Spybot post:

    Delta.Toolbar: [SBI $20319BF7] User settings (Registry key, nothing done)
    HKEY_USERS\S-1-5-21-2335574572-564295443-247174958-1001\Software\DataMngr

    WebCake.BHO: [SBI $255A0B20] Application ID (Registry key, nothing done)
    HKEY_CLASSES_ROOT\AppID\{7169BBB3-3289-4696-B35D-4A88BCF6FB12}

    WebCake.BHO: [SBI $255A0B20] Application ID (Registry key, nothing done)
    HKEY_CLASSES_ROOT\AppID\{7169BBB3-3289-4696-B35D-4A88BCF6FB12}

    WebCake.BHO: [SBI $08018B9D] Application ID (Registry key, nothing done)
    HKEY_CLASSES_ROOT\AppID\WebCakeIEClient.DLL

    WebCake.BHO: [SBI $08018B9D] Application ID (Registry key, nothing done)
    HKEY_CLASSES_ROOT\AppID\WebCakeIEClient.DLL

    WebCake.BHO: [SBI $2E6E776B] Class ID (Registry key, nothing done)
    HKEY_CLASSES_ROOT\CLSID\{2A5A2A90-3B30-4E6E-A955-2F232C6EF517}

    WebCake.BHO: [SBI $D73E9D37] Class ID (Registry key, nothing done)
    HKEY_CLASSES_ROOT\CLSID\{AF6B0594-6008-4327-93E5-608AD710A6FA}

    WebCake.BHO: [SBI $0C914923] Class ID (Registry key, nothing done)
    HKEY_CLASSES_ROOT\CLSID\{BB975E58-E769-4E5A-BA12-B765BC559FF3}

    WebCake.BHO: [SBI $FDE5A161] Class ID (Registry key, nothing done)
    HKEY_CLASSES_ROOT\CLSID\{DF84E609-C3A4-49CB-A160-61767DAF8899}

    WebCake.BHO: [SBI $F1A6B840] Class ID (Registry key, nothing done)
    HKEY_CLASSES_ROOT\CLSID\{F511AFDB-726E-4458-90E7-1ECB97406544}

    WebCake.BHO: [SBI $3F53FBE0] Class ID (Registry key, nothing done)
    HKEY_CLASSES_ROOT\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}

    WebCake.BHO: [SBI $8048C96E] Interface (Registry key, nothing done)
    HKEY_CLASSES_ROOT\Interface\{0AFD55C8-ADF8-4A33-A6E1-DEDB7A36AEB4}

    WebCake.BHO: [SBI $8048C96E] Interface (Registry key, nothing done)
    HKEY_CLASSES_ROOT\Interface\{0AFD55C8-ADF8-4A33-A6E1-DEDB7A36AEB4}

    WebCake.BHO: [SBI $7BEA5F33] Interface (Registry key, nothing done)
    HKEY_CLASSES_ROOT\Interface\{DF84E609-C3A4-49CB-A160-61767DAF8899}

    WebCake.BHO: [SBI $7BEA5F33] Interface (Registry key, nothing done)
    HKEY_CLASSES_ROOT\Interface\{DF84E609-C3A4-49CB-A160-61767DAF8899}

    WebCake.BHO: [SBI $456A7E87] Type library (Registry key, nothing done)
    HKEY_CLASSES_ROOT\TypeLib\{EFDF368C-8DD9-4E05-87CD-16AA5CB03CB8}

    WebCake.BHO: [SBI $456A7E87] Type library (Registry key, nothing done)
    HKEY_CLASSES_ROOT\TypeLib\{EFDF368C-8DD9-4E05-87CD-16AA5CB03CB8}

    WebCake.BHO: [SBI $84417C1E] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WebCakeIEClient.Api

    WebCake.BHO: [SBI $84417C1E] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WebCakeIEClient.Api.1

    WebCake.BHO: [SBI $84417C1E] Class ID (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF6B0594-6008-4327-93E5-608AD710A6FA}

    WebCake.BHO: [SBI $84417C1E] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WebCakeIEClient.Api.1

    WebCake.BHO: [SBI $84417C1E] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WebCakeIEClient.Api

    WebCake.BHO: [SBI $22D18007] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WebCakeIEClient.Layers

    WebCake.BHO: [SBI $22D18007] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WebCakeIEClient.Layers.1

    WebCake.BHO: [SBI $22D18007] Class ID (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2A5A2A90-3B30-4E6E-A955-2F232C6EF517}

    WebCake.BHO: [SBI $22D18007] Browser helper object (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A5A2A90-3B30-4E6E-A955-2F232C6EF517}

    WebCake.BHO: [SBI $22D18007] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WebCakeIEClient.Layers.1

    WebCake.BHO: [SBI $22D18007] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WebCakeIEClient.Layers

    WebCake.BHO: [SBI $453FCB11] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\fjoijdanhaiflhibkljeklcghcmmfffh

    WebCake.BHO: [SBI $18EFEDA4] Uninstall settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}

    WebCake.BHO: [SBI $5B966508] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\WebCakeUpdaterService

    WebCake.BHO: [SBI $5B966508] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\WebCakeUpdaterService

    WebCake.BHO: [SBI $A2678F5A] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WebCake Desktop Updater

    WebCake.BHO: [SBI $A2678F5A] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WebCake Desktop Updater

    WebCake.BHO: [SBI $2698E3E6] Program directory (Directory, nothing done)
    C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\

    WebCake.BHO: [SBI $885FF297] Library (File, nothing done)
    C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll
    Properties.size=531968
    Properties.md5=E1416C9C40FD81557795D4195FB48E8D
    Properties.filedate=1368563125
    Properties.filedatetext=2013-05-14 16:25:25

    WebCake.BHO: [SBI $0A5B161A] Library (File, nothing done)
    C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll
    Properties.size=273408
    Properties.md5=4C05D85B6C1E2E9AEF5784F0A43B5C3A
    Properties.filedate=1368563125
    Properties.filedatetext=2013-05-14 16:25:24

    WebCake.BHO: [SBI $1107F102] Data (File, nothing done)
    C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat
    Properties.size=56300
    Properties.md5=80151CEC8E3568F19B43CE8D44994E07
    Properties.filedate=1373075203
    Properties.filedatetext=2013-07-05 21:46:43

    WebCake.BHO: [SBI $E98B8D0E] Executable (File, nothing done)
    C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe
    Properties.size=227984
    Properties.md5=5A8222C703B4A34F2227A652A49A2827
    Properties.filedate=1299814153
    Properties.filedatetext=2011-03-10 23:29:12

    WebCake.BHO: [SBI $370B837B] Picture (File, nothing done)
    C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico
    Properties.size=4846
    Properties.md5=60E3EF9326E8C3F574A2C7B5A31FD895
    Properties.filedate=1258611124
    Properties.filedatetext=2009-11-19 02:12:03

    WebCake.BHO: [SBI $99641C16] Program directory (Directory, nothing done)
    C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\

    WebCake.BHO: [SBI $9FCFB66A] Library (File, nothing done)
    C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\_Setup.dll
    Properties.size=839680
    Properties.md5=5FDBCAB90F3199A13123C4D1185E0545
    Properties.filedate=1371773308
    Properties.filedatetext=2013-06-20 20:08:28

    WebCake.BHO: [SBI $C94008FF] Library (File, nothing done)
    C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\_Setupx.dll
    Properties.size=580608
    Properties.md5=C614DF1709CDA0CBA6A4240BD3D5E7E0
    Properties.filedate=1371773297
    Properties.filedatetext=2013-06-20 20:08:17

    WebCake.BHO: [SBI $36FD4F9C] Data (File, nothing done)
    C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\Setup.dat
    Properties.size=120313
    Properties.md5=52911932830C1797DA17F25E69E6BEDF
    Properties.filedate=1373075203
    Properties.filedatetext=2013-07-05 21:46:43

    WebCake.BHO: [SBI $CE713390] Executable (File, nothing done)
    C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\Setup.exe
    Properties.size=227984
    Properties.md5=5A8222C703B4A34F2227A652A49A2827
    Properties.filedate=1299814153
    Properties.filedatetext=2011-03-10 23:29:12

    WebCake.BHO: [SBI $10F13DE5] Picture (File, nothing done)
    C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\Setup.ico
    Properties.size=1150
    Properties.md5=9BF838DF808912CED47CECD61DDA7488
    Properties.filedate=1371773253
    Properties.filedatetext=2013-06-20 20:07:33

    WebCake.BHO: [SBI $FF69A630] Program directory (Directory, nothing done)
    C:\Program Files (x86)\WebCake\

    WebCake.BHO: [SBI $AD7253EC] Executable (File, nothing done)
    C:\Program Files (x86)\WebCake\OptChrome.exe
    Properties.size=220672
    Properties.md5=FE4B52EDE7C3C3139A345432B314FD89
    Properties.filedate=1371773305
    Properties.filedatetext=2013-06-20 20:08:25

    WebCake.BHO: [SBI $999288EA] Executable (File, nothing done)
    C:\Program Files (x86)\WebCake\sqlite3.exe
    Properties.size=465408
    Properties.md5=8D03B10F0DCED524A88A3FF4B370F50D
    Properties.filedate=1371773253
    Properties.filedatetext=2013-06-20 20:07:33

    WebCake.BHO: [SBI $0F7B39CA] Executable (File, nothing done)
    C:\Program Files (x86)\WebCake\WebCakeDesktop.Updater.exe
    Properties.size=23552
    Properties.md5=E89D463AB373CFACCCBB0645E9AE8154
    Properties.filedate=1371773253
    Properties.filedatetext=2013-06-20 20:07:33

    WebCake.BHO: [SBI $BA150585] Library (File, nothing done)
    C:\Program Files (x86)\WebCake\WebCakeIEClient.dll
    Properties.size=197912
    Properties.md5=20FE682335905C6B67B7DE795FBC5381
    Properties.filedate=1371773281
    Properties.filedatetext=2013-06-20 20:08:01

    WebCake.BHO: [SBI $EA45CFC0] Configuration file (File, nothing done)
    C:\Program Files (x86)\WebCake\WebCakeLayers.crx
    Properties.size=3034
    Properties.md5=54D04EAD273CAF7822E1966C87728DBC
    Properties.filedate=1373075198
    Properties.filedatetext=2013-07-05 21:46:37

    WebCake.BHO: [SBI $58E5AC29] Data (File, nothing done)
    C:\Users\scofi_000\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_fjoijdanhaiflhibkljeklcghcmmfffh_0.localstorage
    Properties.size=3072
    Properties.md5=FFA86B325EB3F47FF393596B03E918EF
    Properties.filedate=1375627406
    Properties.filedatetext=2013-08-04 10:43:26

    WebCake.BHO: [SBI $F8AF352E] Data (File, nothing done)
    C:\Users\scofi_000\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_fjoijdanhaiflhibkljeklcghcmmfffh_0.localstorage-journal
    Properties.size=3608
    Properties.md5=CC1D7E7F6281E715CB77F44FDDE3BCCA
    Properties.filedate=1375627407
    Properties.filedatetext=2013-08-04 10:43:26

    IncrediBar: [SBI $8722EB7F] Settings (Registry key, nothing done)
    HKEY_CLASSES_ROOT\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}

    IncrediBar: [SBI $8722EB7F] Settings (Registry key, nothing done)
    HKEY_CLASSES_ROOT\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}

    IncrediBar: [SBI $499FBB8D] Settings (Registry key, nothing done)
    HKEY_CLASSES_ROOT\AppID\Extension.DLL

    IncrediBar: [SBI $499FBB8D] Settings (Registry key, nothing done)
    HKEY_CLASSES_ROOT\AppID\Extension.DLL

    IncrediBar: [SBI $4A0F744C] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Extension.ExtensionHelperObject

    IncrediBar: [SBI $4A0F744C] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Extension.ExtensionHelperObject.1

    IncrediBar: [SBI $4A0F744C] Class ID (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}

    IncrediBar: [SBI $4A0F744C] Browser helper object (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}

    IncrediBar: [SBI $4A0F744C] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Extension.ExtensionHelperObject.1

    IncrediBar: [SBI $4A0F744C] Class ID (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}

    IncrediBar: [SBI $4A0F744C] Browser helper object (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}

    IncrediBar: [SBI $4A0F744C] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Extension.ExtensionHelperObject

    IncrediBar: [SBI $74F85EF4] Settings (Registry key, nothing done)
    HKEY_CLASSES_ROOT\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}

    IncrediBar: [SBI $74F85EF4] Settings (Registry key, nothing done)
    HKEY_CLASSES_ROOT\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}

    IncrediBar: [SBI $1EF302F2] Settings (Registry key, nothing done)
    HKEY_CLASSES_ROOT\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}

    IncrediBar: [SBI $1EF302F2] Settings (Registry key, nothing done)
    HKEY_CLASSES_ROOT\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}

    SelectionLinks: [SBI $75C4FA5F] Settings (Registry key, nothing done)
    HKEY_CLASSES_ROOT\AppID\{1C058FAF-7C4B-4C0F-801F-62924059AFAC}

    SelectionLinks: [SBI $75C4FA5F] Settings (Registry key, nothing done)
    HKEY_CLASSES_ROOT\AppID\{1C058FAF-7C4B-4C0F-801F-62924059AFAC}

    SelectionLinks: [SBI $3579CCB2] Settings (Registry key, nothing done)
    HKEY_CLASSES_ROOT\AppID\SelectionLinks v4.DLL

    SelectionLinks: [SBI $3579CCB2] Settings (Registry key, nothing done)
    HKEY_CLASSES_ROOT\AppID\SelectionLinks v4.DLL

    SelectionLinks: [SBI $DF9517D8] Program directory (Directory, nothing done)
    C:\Program Files (x86)\OApps\

    SweetIM: [SBI $72F19D19] Data (File, nothing done)
    c:\Windows\System32\jmdp\SweetNT.crx
    Properties.size=72293
    Properties.md5=106992C97B87A3C1F92FDD500453817A
    Properties.filedate=1365585340
    Properties.filedatetext=2013-04-10 05:15:40

    SweetIM: [SBI $08F288FC] User settings (Registry key, nothing done)
    HKEY_USERS\.DEFAULT\Software\ImInstaller

    SweetIM: [SBI $B05CF80C] User settings (Registry key, nothing done)
    HKEY_USERS\S-1-5-18\Software\ImInstaller

    SweetIM: [SBI $872D3C83] Settings (Registry key, nothing done)
    HKEY_CLASSES_ROOT\Installer\Products\FB6D58DD787439A4995AF3C00FEA8843

    SweetIM: [SBI $872D3C83] Settings (Registry key, nothing done)
    HKEY_CLASSES_ROOT\Installer\Products\FB6D58DD787439A4995AF3C00FEA8843

    SweetIM: [SBI $C342625D] Uninstall settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DD85D6BF-4787-4A93-99A5-3F0CF0AE8834}

    SweetIM: [SBI $C5E6C371] Uninstall settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNLT

    SweetIM: [SBI $1DD24693] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\WNLT

    SweetIM: [SBI $5CB9D638] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IBUpdaterService

    SweetIM: [SBI $5CB9D638] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IBUpdaterService

    SweetIM: [SBI $D98EA100] Program directory (Directory, nothing done)
    c:\Windows\System32\jmdp\

    SweetIM: [SBI $EE2BE046] Library (File, nothing done)
    c:\Windows\System32\jmdp\lmrn.dll
    Properties.size=423936
    Properties.md5=51A4A9CDCA6141099E51204424E055FE
    Properties.filedate=1371025538
    Properties.filedatetext=2013-06-12 04:25:38

    SweetIM: [SBI $A012DF6A] Library (File, nothing done)
    c:\Windows\System32\jmdp\sqlite3.dll
    Properties.size=362029
    Properties.md5=FEC17D5FB09A03376D3AA204C65562A7
    Properties.filedate=1360049106
    Properties.filedatetext=2013-02-05 03:25:06

    SweetIM: [SBI $37C67CCE] Executable (File, nothing done)
    c:\Windows\System32\jmdp\stij.exe
    Properties.size=18224
    Properties.md5=87FD7AE5432D5EEE6F5776DA866FA01C
    Properties.filedate=1371025656
    Properties.filedatetext=2013-06-12 04:27:36

    SweetIM: [SBI $DD4B3156] Program directory (Directory, nothing done)
    C:\Windows\Installer\{DD85D6BF-4787-4A93-99A5-3F0CF0AE8834}\

    SweetIM: [SBI $15423E4D] Executable (File, nothing done)
    C:\Windows\Installer\{DD85D6BF-4787-4A93-99A5-3F0CF0AE8834}\ARPPRODUCTICON.exe
    Properties.size=10134
    Properties.md5=6E42CF0D47AF25DEA4CECDBE093D521C
    Properties.filedate=1373075263
    Properties.filedatetext=2013-07-05 21:47:42

    SweetIM: [SBI $C2ECAD40] Program directory (Directory, nothing done)
    C:\Windows\System32\ARFC\

    SweetIM: [SBI $AAA00988] Executable (File, nothing done)
    C:\Windows\System32\ARFC\wrtc.exe
    Properties.size=21808
    Properties.md5=235D67FA61C1C37F5A1762C7ED434DDC
    Properties.filedate=1369645088
    Properties.filedatetext=2013-05-27 04:58:08

    SweetIM: [SBI $3F972605] Program directory (Directory, nothing done)
    C:\Windows\System32\WNLT\

    SweetIM: [SBI $AA65CA40] Program directory (Directory, nothing done)
    C:\Windows\System32\WNLT\Installation\

    SweetIM: [SBI $FFF592C0] Executable (File, nothing done)
    C:\Windows\System32\WNLT\Installation\SKSetup.exe
    Properties.size=941320
    Properties.md5=42EA7CAE1C320477D846EC304C3A9500
    Properties.filedate=1373075223
    Properties.filedatetext=2013-07-05 21:47:02

    SweetIM: [SBI $58183A31] Executable (File, nothing done)
    C:\Windows\System32\WNLT\Installation\uninstaller.exe
    Properties.size=121920
    Properties.md5=481C0ACE4FFCFCEFFB5E271D55BFD7AD
    Properties.filedate=1373075211
    Properties.filedatetext=2013-07-05 21:46:51

    SweetIM: [SBI $880E2C20] Interface (Registry key, nothing done)
    HKEY_CLASSES_ROOT\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $880E2C20] Interface (Registry key, nothing done)
    HKEY_CLASSES_ROOT\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $86E9C4F1] Interface (Registry key, nothing done)
    HKEY_CLASSES_ROOT\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $86E9C4F1] Interface (Registry key, nothing done)
    HKEY_CLASSES_ROOT\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $53741EFB] Executable (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\ClearHist.exe
    Properties.size=107792
    Properties.md5=D7F14E9B2430EBE53F7510C6064B05DF
    Properties.filedate=1365019616
    Properties.filedatetext=2013-04-03 16:06:56

    SweetIM: [SBI $F6C40D28] Library (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgcommon.dll
    Properties.size=684816
    Properties.md5=F7831D8194925B5FF3185D5F630EAC3E
    Properties.filedate=1365019616
    Properties.filedatetext=2013-04-03 16:06:56

    SweetIM: [SBI $D6FC4949] Library (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgconfig.dll
    Properties.size=56080
    Properties.md5=F3BDA00411D3823C94A13D12CBF301CD
    Properties.filedate=1365019618
    Properties.filedatetext=2013-04-03 16:06:58

    SweetIM: [SBI $93797E05] Executable (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe
    Properties.size=242960
    Properties.md5=EEC0BA4FB583209F1E431AFEC4CA867D
    Properties.filedate=1365019618
    Properties.filedatetext=2013-04-03 16:06:58

    SweetIM: [SBI $63699788] Library (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mghooking.dll
    Properties.size=153872
    Properties.md5=81EC27141FAF468116B0E45F5672F8FF
    Properties.filedate=1365019618
    Properties.filedatetext=2013-04-03 16:06:58

    SweetIM: [SBI $B1B6F216] Library (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mglogger.dll
    Properties.size=40720
    Properties.md5=CCAFBFFB5CFF3E5222405184C91D9EC2
    Properties.filedate=1365019618
    Properties.filedatetext=2013-04-03 16:06:58

    SweetIM: [SBI $64602916] Library (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgsimcommon.dll
    Properties.size=74000
    Properties.md5=486B9337FD6E559D3A469EDF7F039C8D
    Properties.filedate=1365019618
    Properties.filedatetext=2013-04-03 16:06:58

    SweetIM: [SBI $36735335] Library (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll
    Properties.size=115984
    Properties.md5=922FC0C32C197D3B79A87997F95D2528
    Properties.filedate=1365019618
    Properties.filedatetext=2013-04-03 16:06:58

    SweetIM: [SBI $EADE6326] Library (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgxml_wrapper.dll
    Properties.size=61712
    Properties.md5=0C1404C0929401DE101EF5300C751703
    Properties.filedate=1365019620
    Properties.filedatetext=2013-04-03 16:07:00

    SweetIM: [SBI $AADD8658] Shared DLL (1 apps) (Registry value, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe

    SweetIM: [SBI $24B43D6E] Shared DLL (1 apps) (Registry value, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll

    SweetIM: [SBI $51615461] Settings (Registry value, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\SweetIM\

    SweetIM: [SBI $1EBFD254] Settings (Registry value, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\SweetIM\Toolbars\

    SweetIM: [SBI $5770A858] Settings (Registry value, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\

    SweetIM: [SBI $6C3EBC75] Settings (Registry value, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\conf\

    SweetIM: [SBI $CEB7CBCD] Settings (Registry value, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\Microsoft.VC90.CRT\

    SweetIM: [SBI $6C8B4BDF] Settings (Registry value, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\

    SweetIM: [SBI $27B38A9A] Settings (Registry value, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\blue\

    SweetIM: [SBI $8AC8D9F1] Settings (Registry value, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\green\

    SweetIM: [SBI $15F80965] Settings (Registry value, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\orange\

    SweetIM: [SBI $852C8BC9] Settings (Registry key, nothing done)
    HKEY_CLASSES_ROOT\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $852C8BC9] Settings (Registry key, nothing done)
    HKEY_CLASSES_ROOT\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $0ECF86F0] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D

    SweetIM: [SBI $36562737] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E

    SweetIM: [SBI $E83CAD58] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA

    SweetIM: [SBI $E4D46E67] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E6768B6932D112438F047C54D180635

    SweetIM: [SBI $521BC5C8] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\351716A953E21214898904032EAE2E81

    SweetIM: [SBI $4D93DE77] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED

    SweetIM: [SBI $B6D1C6E1] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\69D6A6B2ED56AF24EA6335EAD6E91CA4

    SweetIM: [SBI $37579FA6] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FFA128C2B0FF414D805FC5627883401

    SweetIM: [SBI $32AF7267] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EDC790504E1834DBC20C9A04328FD2

    SweetIM: [SBI $1AC01A44] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\97C3D0F82E712E241A2F969F45E3351C

    SweetIM: [SBI $3B23C78E] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058

    SweetIM: [SBI $32A9721D] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9E7F556BF224D804D96A96F0F6344789

    SweetIM: [SBI $1820B5D6] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A189D17A469616C4688D23E192996267

    SweetIM: [SBI $7B8D4B0A] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF4F885EDEE45644EB1E0C99E0162399

    SweetIM: [SBI $DB503FB1] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CE21F3FD57B244142880EF15A165A156

    SweetIM: [SBI $0F39C548] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7

    SweetIM: [SBI $B784AA5E] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6

    SweetIM: [SBI $DBEBD935] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D

    SweetIM: [SBI $27DF5EDD] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420

    SweetIM: [SBI $D9B554B8] Program directory (Directory, nothing done)
    C:\Program Files (x86)\SweetIM\

    SweetIM: [SBI $8D9D81BD] Settings (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $B09F27CE] Class ID (Registry key, nothing done)
    HKEY_CLASSES_ROOT\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $BE78CF1F] Class ID (Registry key, nothing done)
    HKEY_CLASSES_ROOT\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $96CF5528] Class ID (Registry key, nothing done)
    HKEY_CLASSES_ROOT\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $0EC96901] Type library (Registry key, nothing done)
    HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $0EC96901] Type library (Registry key, nothing done)
    HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $1DE15072] Type library (Registry key, nothing done)
    HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $1DE15072] Type library (Registry key, nothing done)
    HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $2AE3B6FC] Browser helper object (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $8F9F899A] IE toolbar (Registry value, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{EEE6C35B-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $1CA517E1] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SWEETIE.IEToolbar

    SweetIM: [SBI $1CA517E1] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SWEETIE.IEToolbar.1

    SweetIM: [SBI $1CA517E1] Class ID (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $1CA517E1] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SWEETIE.IEToolbar.1

    SweetIM: [SBI $1CA517E1] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SWEETIE.IEToolbar

    SweetIM: [SBI $23C96D1A] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook

    SweetIM: [SBI $23C96D1A] Class ID (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $23C96D1A] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook

    SweetIM: [SBI $D8D0693A] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook.1

    SweetIM: [SBI $D8D0693A] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook.1

    SweetIM: [SBI $87A14C25] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Toolbar3.SWEETIE

    SweetIM: [SBI $87A14C25] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Toolbar3.SWEETIE.1

    SweetIM: [SBI $87A14C25] Class ID (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}

    SweetIM: [SBI $87A14C25] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Toolbar3.SWEETIE.1

    SweetIM: [SBI $87A14C25] Root class (Registry key, nothing done)
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Toolbar3.SWEETIE

    SweetIM: [SBI $31467DE7] Web page (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\default.xml
    Properties.size=202
    Properties.md5=D9E8318011E4E94DFA6FD8A4511BEBD0
    Properties.filedate=1329681868
    Properties.filedatetext=2012-02-19 16:04:28

    SweetIM: [SBI $8A50AEFB] Library (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
    Properties.size=131344
    Properties.md5=CC3FA70C72F0EE2BAC5B788277633CE1
    Properties.filedate=1365019618
    Properties.filedatetext=2013-04-03 16:06:58

    SweetIM: [SBI $8A50AEFB] Library (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
    Properties.size=1310480
    Properties.md5=AE6D6FEB5ADAFD054DB8BAE4194F3C1B
    Properties.filedate=1365019618
    Properties.filedatetext=2013-04-03 16:06:58

    SweetIM: [SBI $97353702] Web page (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\about.html
    Properties.size=2910
    Properties.md5=3EB2AA9C3DA3FD5A6307C05A62DA653C
    Properties.filedate=1329681870
    Properties.filedatetext=2012-02-19 16:04:30

    SweetIM: [SBI $814B6F15] Data (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\affid.dat
    Properties.size=6
    Properties.md5=D48B2F639B5214B5D02E145D223F3C97
    Properties.filedate=1329681870
    Properties.filedatetext=2012-02-19 16:04:30

    SweetIM: [SBI $67C00D19] Web page (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\basis.xml
    Properties.size=1420
    Properties.md5=10178E6FDDD4327414CDB33E20EF8A62
    Properties.filedate=1363643226
    Properties.filedatetext=2013-03-18 17:47:06

    SweetIM: [SBI $6FC73FEA] Picture (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\bing.png
    Properties.size=1015
    Properties.md5=8222B8B77447C3C3B09718661CF1DE45
    Properties.filedate=1329681870
    Properties.filedatetext=2012-02-19 16:04:30

    SweetIM: [SBI $75F95F1F] Picture (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\clear-history.png
    Properties.size=743
    Properties.md5=DF01C158B06C58D724EC5E65F749A34C
    Properties.filedate=1329681870
    Properties.filedatetext=2012-02-19 16:04:30

    SweetIM: [SBI $2BABE1BE] Data (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\content-notifier.js
    Properties.size=13036
    Properties.md5=4D61BE5C71C857C66263F445FC4C3CB3
    Properties.filedate=1329681870
    Properties.filedatetext=2012-02-19 16:04:30

    SweetIM: [SBI $063CADAD] Picture (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\content-notifier-anim.gif
    Properties.size=5815
    Properties.md5=529A553C5A89BB4ACCD6CC6E7C546AC0
    Properties.filedate=1329681870
    Properties.filedatetext=2012-02-19 16:04:30

    SweetIM: [SBI $3B6CDDD3] Picture (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\content-notifier-anim-over.gif
    Properties.size=1465
    Properties.md5=FA0FFBE225B678531FF437711766055A
    Properties.filedate=1329681870
    Properties.filedatetext=2012-02-19 16:04:30

    SweetIM: [SBI $CD91A31C] Picture (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\dating.png
    Properties.size=3287
    Properties.md5=8D8E1593BA967DE591AFDDD863902AD3
    Properties.filedate=1329681870
    Properties.filedatetext=2012-02-19 16:04:30


    SweetIM: [SBI $5AF4474A] Picture (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\SmileySmile.png
    Properties.size=4706
    Properties.md5=72C9881C090F7C954451691AEC0266D2
    Properties.filedate=1329681870
    Properties.filedatetext=2012-02-19 16:04:30

    SweetIM: [SBI $3ACBE1DF] Picture (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\SmileyWink.png
    Properties.size=4513
    Properties.md5=A75E7B7FB7225134A01B01C6985086C3
    Properties.filedate=1329681870
    Properties.filedatetext=2012-02-19 16:04:30

    SweetIM: [SBI $69D00BAB] Picture (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\sweetim_text.png
    Properties.size=3144
    Properties.md5=1BA2AD1C28A5ADB2567D1B40D77488B6
    Properties.filedate=1329681870
    Properties.filedatetext=2012-02-19 16:04:30

    SweetIM: [SBI $0616EC62] Picture (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\toolbar.xml
    Properties.size=27405
    Properties.md5=7DC3836F9A1C6B214497EBE3DD5BD073
    Properties.filedate=1358705232
    Properties.filedatetext=2013-01-20 14:07:12

    SweetIM: [SBI $1EF64643] Picture (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\video.png
    Properties.size=869
    Properties.md5=920D3D7C15F7AB6E00F2A8C3593CA86C
    Properties.filedate=1329681870
    Properties.filedatetext=2012-02-19 16:04:30

    SweetIM: [SBI $A74C088D] Picture (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\web-search.png
    Properties.size=3337
    Properties.md5=3E2E639063054CCB59DB68C2A9243AFB
    Properties.filedate=1329681870
    Properties.filedatetext=2012-02-19 16:04:30

    SweetIM: [SBI $A7FAF5D7] Picture (File, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\yahoo.png
    Properties.size=442
    Properties.md5=F64113435D357717C72EBF0E86B317E6
    Properties.filedate=1329681870
    Properties.filedatetext=2012-02-19 16:04:30

    SweetIM: [SBI $2AE59744] Program directory (Directory, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\conf\

    SweetIM: [SBI $95E43E63] Program directory (Directory, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\Microsoft.VC90.CRT\

    SweetIM: [SBI $8084BE9C] Program directory (Directory, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\

    SweetIM: [SBI $E866E749] Program directory (Directory, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\

    SweetIM: [SBI $A9F72138] Program directory (Directory, nothing done)
    C:\Program Files (x86)\SweetIM\Toolbars\
    --- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

    Please help me!!! thank you. I had to delete some of the logs 'cuz the post was too long. Please advise.

  2. #2
    Malware Team-Emeritus
    Join Date
    Sep 2012
    Location
    Florida, USA
    Posts
    1,161

    Default

    Hi Scofield,

    My name is OCD. I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
    • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
    • The fixes are specific to your problem and should only be used for the issues on this machine.
    • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
    • It's often worth reading through these instructions and printing them for ease of reference.
    • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
    • Please reply to this thread. Do not start a new topic.
    • Copy and Paste logs directly into the reply window. DO NOT attach the logs unless specifically instructed to do so.

    IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.

    DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

    Please stay with this topic until I let you know that your system appears to be "All Clear"

    Important: All tools MUST be run from the Desktop.

    =========================

    IMPORTANT INFORMATION:

    If you cannot run these scans in Normal Mode, use Safe Mode.

    Also, if the logs will not fit in one (1) reply use multiple replies to submit the entire log. All the information contained in the logs is important to help evaluate what malware might be present on your computer.

    =========================

    1. Security Check

    Download Security Check by screen317 from here or here.
    • Save it to your Desktop.
      • Windows XP : Double click on the icon to run it.
      • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

    =========================

    2. aswMBR

    Download aswMBR.exe and save it to your desktop.
      • Windows XP : Double click on the icon to run it.
      • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
    • When asked if you want to download Avast's virus definitions please select Yes.
    • Click Scan
    • Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
    • You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.

    =========================


    3. OTL

    Download OTL to your desktop.
    • Make sure all other windows are closed and to let it run uninterrupted.
      • Windows XP : Double click on the icon to run it.
      • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
    • When the window appears, underneath Output at the top change it to Minimal Output.
    • Check the boxes beside LOP Check and Purity Check.
    • Under Custom Scan paste this in

      %USERPROFILE%\..|smtmp;true;true;true /FP
      %temp%\smtmp\*.* /s >
      /md5start
      iexplore.*
      explorer.*
      winlogon.*
      dll
      zx.dll
      hlp.dat
      consrv.dll
      services.*
      /md5stop
      netsvcs
      drivers32
      %SYSTEMDRIVE%\*.*
      %systemroot%\Fonts\*.com
      %systemroot%\Fonts\*.dll
      %systemroot%\Fonts\*.ini
      %systemroot%\Fonts\*.ini2
      %systemroot%\Fonts\*.exe
      %systemroot%\system32\spool\prtprocs\w32x86\*.*
      %systemroot%\REPAIR\*.bak1
      %systemroot%\REPAIR\*.ini
      %systemroot%\system32\*.jpg
      %systemroot%\*.jpg
      %systemroot%\*.png
      %systemroot%\*.scr
      %systemroot%\*._sy
      %APPDATA%\Adobe\Update\*.*
      %ALLUSERSPROFILE%\Favorites\*.*
      %APPDATA%\Microsoft\*.*
      %PROGRAMFILES%\*.*
      %APPDATA%\Update\*.*
      %systemroot%\*. /mp /s
      dir "%systemdrive%\*" /S /A:L /C
      CREATERESTOREPOINT
      %systemroot%\System32\config\*.sav
      %PROGRAMFILES%\bak. /s
      %systemroot%\system32\bak. /s
      %ALLUSERSPROFILE%\Start Menu\*.lnk /x
      %systemroot%\system32\config\systemprofile\*.dat /x
      %systemroot%\*.config
      %systemroot%\system32\*.db
      %PROGRAMFILES%\Internet Explorer\*.dat
      %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
      %USERPROFILE%\Desktop\*.exe
      %PROGRAMFILES%\Common Files\*.*
      %systemroot%\*.src
      %systemroot%\install\*.*
      %systemroot%\system32\DLL\*.*
      %systemroot%\system32\HelpFiles\*.*
      %systemroot%\system32\rundll\*.*
      %systemroot%\winn32\*.*
      %systemroot%\Java\*.*
      %systemroot%\system32\test\*.*
      %systemroot%\system32\Rundll32\*.*
      %systemroot%\AppPatch\Custom\*.*
      HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
      BASESERVICES
      DRIVES
      CREATERESTOREPOINT

    • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
      • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
      • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
      • You may need two posts to fit them both in.

    =========================

    In your next post please provide the following:
    • checkup.txt
    • aswMBR.txt
    • attach MBR.zip
    • OTL.txt
    • Extras.txt
    OCD
    ----------
    Graduate of WTT Classroom
    Member of UNITE

    Threads will be closed if no response after 5 days

  3. #3
    Member
    Join Date
    Apr 2006
    Posts
    69

    Default

    Hi OCD and thank you very much! Just so you know, I'm running Windows 8, and I'm not that familiar with it, so if I have questions, I will ask.


    Results of screen317's Security Check version 0.99.72
    x64 (UAC is enabled)
    Internet Explorer 10
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Firewall Enabled!
    Windows Defender
    Norton Internet Security
    WMI entry may not exist for antivirus; attempting automatic update.
    `````````Anti-malware/Other Utilities Check:`````````
    Spybot - Search & Destroy
    Malwarebytes Anti-Malware version 1.75.0.1300
    Java 7 Update 25
    Adobe Flash Player 11.7.700.224
    Adobe Reader 10.1.7 Adobe Reader out of Date!
    Google Chrome 27.0.1453.110
    Google Chrome 27.0.1453.116
    ````````Process Check: objlist.exe by Laurent````````
    Norton ccSvcHst.exe
    Windows Defender MSMpEng.exe
    Malwarebytes Anti-Malware mbamservice.exe
    Malwarebytes Anti-Malware mbamgui.exe
    Malwarebytes' Anti-Malware mbamscheduler.exe
    Windows Defender MsMpEng.exe
    Symantec Norton Online Backup NOBuAgent.exe
    `````````````````System Health check`````````````````
    Total Fragmentation on Drive C: %
    ````````````````````End of Log``````````````````````

    aswMBR log:

    aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
    Run date: 2013-08-08 21:44:41
    -----------------------------
    21:44:41.087 OS Version: Windows x64 6.2.9200
    21:44:41.087 Number of processors: 8 586 0x3A09
    21:44:41.087 ComputerName: SHERLOCK UserName:
    21:44:41.399 Initialze error 1
    21:46:09.629 AVAST engine defs: 13080801
    21:46:18.832 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000040
    21:46:18.832 Disk 0 Vendor: TOSHIBA_MK6475GSX GT001M Size: 610480MB BusType: 11
    21:46:18.864 Disk 0 MBR read successfully
    21:46:18.879 Disk 0 MBR scan
    21:46:18.879 Disk 0 unknown MBR code
    21:46:18.895 Disk 0 Partition 1 00 EE GPT 2097151 MB offset 1
    21:46:18.911 Disk 0 scanning C:\windows\system32\drivers
    21:46:18.911 Service scanning
    21:46:19.442 Modules scanning
    21:46:19.442 Disk 0 trace - called modules:
    21:46:19.520 ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys hal.dll iaStorA.sys
    21:46:19.536 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800835d060]
    21:46:19.536 3 CLASSPNP.SYS[fffff88000a0cfea] -> nt!IofCallDriver -> \Device\00000040[0xfffffa80062be5e0]
    21:46:19.551 AVAST engine scan C:\windows
    21:46:19.551 AVAST engine scan C:\windows\system32
    21:46:19.567 AVAST engine scan C:\windows\system32\drivers
    21:46:19.567 AVAST engine scan C:\Users\scofi_000
    21:46:19.567 AVAST engine scan C:\ProgramData
    21:46:19.567 Scan finished successfully
    21:46:42.304 Disk 0 MBR has been saved successfully to "C:\Users\scofi_000\Desktop\MBR.dat"
    21:46:42.304 The log file has been saved successfully to "C:\Users\scofi_000\Desktop\aswMBR.txt"


    There is another icon on the desktop called MBR, not MBR.dat.... but I will compress that and attach. Since the OTL instructions have me closing all open windows, I will post this now, complete the rest of the instructions, then post another reply. Thanks again so much!
    Attached Files Attached Files

  4. #4
    Member
    Join Date
    Apr 2006
    Posts
    69

    Default

    Have to break up the reports, too long.... here goes....

    OTL logfile created on: 8/8/2013 9:57:50 PM - Run 1
    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\scofi_000\Desktop
    64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
    Internet Explorer (Version = 9.10.9200.16635)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    5.89 Gb Total Physical Memory | 4.02 Gb Available Physical Memory | 68.30% Memory free
    18.39 Gb Paging File | 16.40 Gb Available in Paging File | 89.18% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 586.06 Gb Total Space | 522.01 Gb Free Space | 89.07% Space Free | Partition Type: NTFS

    Computer Name: SHERLOCK | User Name: scofi_000 | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - C:\Users\scofi_000\Desktop\OTL.exe (OldTimer Tools)
    PRC - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccsvchst.exe (Symantec Corporation)
    PRC - C:\Program Files (x86)\Norton Anti-Theft\Engine\1.8.0.32\ccsvchst.exe (Symantec Corporation)
    PRC - C:\Program Files\Updater By SweetPacks\ExtensionUpdaterService.exe ()
    PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
    PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
    PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
    PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
    PRC - C:\Program Files (x86)\Time Warner Cable\TWC WiFi\TrayApp.exe (Affinegy, Inc.)
    PRC - C:\Program Files (x86)\Time Warner Cable\TWC WiFi\AffinegyService.exe (Affinegy, Inc.)
    PRC - C:\Program Files (x86)\Time Warner Cable\TWC WiFi\TWC WiFi.exe (Affinegy, Inc.)
    PRC - C:\Program Files (x86)\PC Checkup\SymcPCCULaunchSvc.exe (Symantec Corporation)
    PRC - C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\datamngrUI.exe (Bandoo Media Inc)
    PRC - C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe ()
    PRC - C:\Program Files (x86)\NETGEAR Genie\bin\genie2_tray.exe ()
    PRC - C:\Program Files (x86)\Toshiba\System Setting\TSleepSrv.exe (TOSHIBA Corporation)
    PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
    PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
    PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation)
    PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Intel Corporation)
    PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
    PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)


    ========== Modules (No Company Name) ==========

    MOD - C:\Program Files (x86)\Time Warner Cable\TWC WiFi\AffinegyServicePS.dll ()
    MOD - C:\Program Files (x86)\Time Warner Cable\TWC WiFi\gateways\UbeeDVW3201BLOC.dll ()
    MOD - C:\Program Files (x86)\Time Warner Cable\TWC WiFi\gateways\ArrisDG860ALOC.dll ()
    MOD - C:\Program Files (x86)\Time Warner Cable\TWC WiFi\gateways\ArrisTG862GLOC.dll ()
    MOD - C:\Program Files (x86)\Time Warner Cable\TWC WiFi\gateways\ArrisTG852GLOC.dll ()
    MOD - C:\Program Files (x86)\Time Warner Cable\TWC WiFi\gateways\NetgearWNR1000v3LOC.dll ()
    MOD - C:\Program Files (x86)\Time Warner Cable\TWC WiFi\gateways\MotorolaSBG900LOC.dll ()
    MOD - C:\Program Files (x86)\Time Warner Cable\TWC WiFi\DigiDoFlavor.dll ()
    MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
    MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Map.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Resource.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\SvtNetworkTool.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_RouterConfiguration.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_ParentalControl.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Internet.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Ui.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\InnerPlugin_Update.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Statistics.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\InnerPlugin_WirelessExport.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_NetworkProblem.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\Genie.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Wireless.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Airprint.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\DragonNetTool.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\DiagnoseDll.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\airprintdll.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\DiagnosePlugin.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\WSetupApiPlugin.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\QRCode.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\NetcardApi.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\SVTUtils.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\WSetupDll.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\drivers\libntgr_api.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\genie2_tray.exe ()
    MOD - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\wincfi39.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\QtGui4.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\QtCore4.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\QtNetwork4.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\QtXml4.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qjpeg4.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qico4.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qgif4.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\libgcc_s_dw2-1.dll ()
    MOD - C:\Program Files (x86)\NETGEAR Genie\bin\mingwm10.dll ()
    MOD - C:\Program Files (x86)\Time Warner Cable\TWC WiFi\imageformats\qjpeg4.dll ()
    MOD - C:\Program Files (x86)\Time Warner Cable\TWC WiFi\QtGui4.dll ()
    MOD - C:\Program Files (x86)\Time Warner Cable\TWC WiFi\QtXml4.dll ()
    MOD - C:\Program Files (x86)\Time Warner Cable\TWC WiFi\QtCore4.dll ()
    MOD - C:\Program Files (x86)\Time Warner Cable\TWC WiFi\QtNetwork4.dll ()


    ========== Services (SafeList) ==========

    SRV:64bit: - (DsmSvc) -- C:\Windows\SysNative\DeviceSetupManager.dll (Microsoft Corporation)
    SRV:64bit: - (Updater By SweetPacks) -- C:\Program Files\Updater By SweetPacks\ExtensionUpdaterService.exe ()
    SRV:64bit: - (netprofm) -- C:\Windows\SysNative\netprofmsvc.dll (Microsoft Corporation)
    SRV:64bit: - (BrokerInfrastructure) -- C:\Windows\SysNative\bisrv.dll (Microsoft Corporation)
    SRV:64bit: - (AudioEndpointBuilder) -- C:\Windows\SysNative\AudioEndpointBuilder.dll (Microsoft Corporation)
    SRV:64bit: - (TimeBroker) -- C:\Windows\SysNative\TimeBrokerServer.dll (Microsoft Corporation)
    SRV:64bit: - (SystemEventsBroker) -- C:\Windows\SysNative\SystemEventsBrokerServer.dll (Microsoft Corporation)
    SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
    SRV:64bit: - (wlidsvc) -- C:\Windows\SysNative\wlidsvc.dll (Microsoft Corporation)
    SRV:64bit: - (LSM) -- C:\Windows\SysNative\lsm.dll (Microsoft Corporation)
    SRV:64bit: - (PrintNotify) -- C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll (Microsoft Corporation)
    SRV:64bit: - (WSService) -- C:\Windows\SysNative\WSService.dll (Microsoft Corporation)
    SRV:64bit: - (fhsvc) -- C:\Windows\SysNative\fhsvc.dll (Microsoft Corporation)
    SRV:64bit: - (TOSHIBA eco Utility Service) -- C:\Program Files\Toshiba\Teco\TecoService.exe (TOSHIBA Corporation)
    SRV:64bit: - (TPCHSrv) -- C:\Program Files\Toshiba\TPHM\TPCHSrv.exe (TOSHIBA Corporation)
    SRV:64bit: - (TMachInfo) -- C:\Program Files\Toshiba\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
    SRV:64bit: - (WiaRpc) -- C:\Windows\SysNative\wiarpc.dll (Microsoft Corporation)
    SRV:64bit: - (Wcmsvc) -- C:\Windows\SysNative\wcmsvc.dll (Microsoft Corporation)
    SRV:64bit: - (VaultSvc) -- C:\Windows\SysNative\vaultsvc.dll (Microsoft Corporation)
    SRV:64bit: - (svsvc) -- C:\Windows\SysNative\svsvc.dll (Microsoft Corporation)
    SRV:64bit: - (Netlogon) -- C:\Windows\SysNative\netlogon.dll (Microsoft Corporation)
    SRV:64bit: - (NcaSvc) -- C:\Windows\SysNative\NcaSvc.dll (Microsoft Corporation)
    SRV:64bit: - (NcdAutoSetup) -- C:\Windows\SysNative\NcdAutoSetup.dll (Microsoft Corporation)
    SRV:64bit: - (KeyIso) -- C:\Windows\SysNative\keyiso.dll (Microsoft Corporation)
    SRV:64bit: - (EFS) -- C:\Windows\SysNative\efssvc.dll (Microsoft Corporation)
    SRV:64bit: - (DeviceAssociationService) -- C:\Windows\SysNative\das.dll (Microsoft Corporation)
    SRV:64bit: - (AllUserInstallAgent) -- C:\Windows\SysNative\AUInstallAgent.dll (Microsoft Corporation)
    SRV:64bit: - (vmicvss) -- C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
    SRV:64bit: - (vmictimesync) -- C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
    SRV:64bit: - (vmicshutdown) -- C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
    SRV:64bit: - (vmicrdv) -- C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
    SRV:64bit: - (vmickvpexchange) -- C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
    SRV:64bit: - (vmicheartbeat) -- C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
    SRV:64bit: - (Intel(R) -- C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel(R) Corporation)
    SRV:64bit: - (TODDSrv) -- C:\Windows\SysNative\TODDSrv.exe (TOSHIBA Corporation)
    SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
    SRV - (NIS) -- C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe (Symantec Corporation)
    SRV - (NAT) -- C:\Program Files (x86)\Norton Anti-Theft\Engine\1.8.0.32\ccSvcHst.exe (Symantec Corporation)
    SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
    SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
    SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
    SRV - (AffinegyService) -- C:\Program Files (x86)\Time Warner Cable\TWC WiFi\AffinegyService.exe (Affinegy, Inc.)
    SRV - (Norton PC Checkup Application Launcher) -- C:\Program Files (x86)\PC Checkup\SymcPCCULaunchSvc.exe (Symantec Corporation)
    SRV - (PrintNotify) -- C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll (Microsoft Corporation)
    SRV - (NETGEARGenieDaemon) -- C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe (NETGEAR)
    SRV - (cphs) -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe (Intel Corporation)
    SRV - (StorSvc) -- C:\Windows\SysWOW64\StorSvc.dll (Microsoft Corporation)
    SRV - (PCCUJobMgr) -- C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.18.15\ccSvcHst.exe (Symantec Corporation)
    SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
    SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
    SRV - (NOBU) -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (Symantec Corporation)
    SRV - (Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation)
    SRV - (jhi_service) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Intel Corporation)
    SRV - (GamesAppService) -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.)


    ========== Driver Services (SafeList) ==========

    DRV:64bit: - (SymEvent) -- C:\Windows\SysNative\Drivers\SYMEVENT64x86.SYS (Symantec Corporation)
    DRV:64bit: - (sdbus) -- C:\Windows\SysNative\Drivers\sdbus.sys (Microsoft Corporation)
    DRV:64bit: - (USBXHCI) -- C:\Windows\SysNative\Drivers\USBXHCI.SYS (Microsoft Corporation)
    DRV:64bit: - (UCX01000) -- C:\Windows\SysNative\Drivers\UCX01000.SYS (Microsoft Corporation)
    DRV:64bit: - (BthAvrcpTg) -- C:\Windows\SysNative\Drivers\BthAvrcpTg.sys (Microsoft Corporation)
    DRV:64bit: - (SymEFA) -- C:\Windows\SysNative\Drivers\NISx64\1404000.028\symefa64.sys (Symantec Corporation)
    DRV:64bit: - (SymDS) -- C:\Windows\SysNative\Drivers\NISx64\1404000.028\symds64.sys (Symantec Corporation)
    DRV:64bit: - (SRTSP) -- C:\Windows\SysNative\Drivers\NISx64\1404000.028\srtsp64.sys (Symantec Corporation)
    DRV:64bit: - (USBHUB3) -- C:\Windows\SysNative\Drivers\USBHUB3.SYS (Microsoft Corporation)
    DRV:64bit: - (spaceport) -- C:\Windows\SysNative\Drivers\spaceport.sys (Microsoft Corporation)
    DRV:64bit: - (SymNetS) -- C:\Windows\SysNative\Drivers\NISx64\1404000.028\symnets.sys (Symantec Corporation)
    DRV:64bit: - (ccSet_NIS) -- C:\Windows\SysNative\Drivers\NISx64\1404000.028\ccsetx64.sys (Symantec Corporation)
    DRV:64bit: - (ccSet_NAT) -- C:\Windows\SysNative\Drivers\NATx64\0108000.020\ccsetx64.sys (Symantec Corporation)
    DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\Drivers\mbam.sys (Malwarebytes Corporation)
    DRV:64bit: - (NPF) -- C:\Windows\SysNative\Drivers\npf.sys (CACE Technologies, Inc.)
    DRV:64bit: - (SymIRON) -- C:\Windows\SysNative\Drivers\NISx64\1404000.028\ironx64.sys (Symantec Corporation)
    DRV:64bit: - (SRTSPX) -- C:\Windows\SysNative\Drivers\NISx64\1404000.028\srtspx64.sys (Symantec Corporation)
    DRV:64bit: - (storahci) -- C:\Windows\SysNative\Drivers\storahci.sys (Microsoft Corporation)
    DRV:64bit: - (TPM) -- C:\Windows\SysNative\Drivers\tpm.sys (Microsoft Corporation)
    DRV:64bit: - (pdc) -- C:\Windows\SysNative\Drivers\pdc.sys (Microsoft Corporation)
    DRV:64bit: - (WdBoot) -- C:\Windows\SysNative\Drivers\WdBoot.sys (Microsoft Corporation)
    DRV:64bit: - (WdFilter) -- C:\Windows\SysNative\Drivers\WdFilter.sys (Microsoft Corporation)
    DRV:64bit: - (msgpiowin32) -- C:\Windows\SysNative\Drivers\msgpiowin32.sys (Microsoft Corporation)
    DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\Drivers\usbaapl64.sys (Apple, Inc.)
    DRV:64bit: - (bthhfhid) -- C:\Windows\SysNative\Drivers\BthhfHid.sys (Microsoft Corporation)
    DRV:64bit: - (hidi2c) -- C:\Windows\SysNative\Drivers\hidi2c.sys (Microsoft Corporation)
    DRV:64bit: - (FxPPM) -- C:\Windows\SysNative\Drivers\fxppm.sys (Microsoft Corporation)
    DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\Drivers\rdpvideominiport.sys (Microsoft Corporation)
    DRV:64bit: - (sdstor) -- C:\Windows\SysNative\Drivers\sdstor.sys (Microsoft Corporation)
    DRV:64bit: - (dam) -- C:\Windows\SysNative\Drivers\dam.sys (Microsoft Corporation)
    DRV:64bit: - (GPIOClx0101) -- C:\Windows\SysNative\Drivers\msgpioclx.sys (Microsoft Corporation)
    DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\Drivers\evbda.sys (Broadcom Corporation)
    DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\Drivers\bxvbda.sys (Broadcom Corporation)
    DRV:64bit: - (RTWlanE) -- C:\Windows\SysNative\Drivers\rtwlane.sys (Realtek Semiconductor Corporation )
    DRV:64bit: - (RTL8192Ce) -- C:\Windows\SysNative\Drivers\rtwlane.sys (Realtek Semiconductor Corporation )
    DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
    DRV:64bit: - (SynTP) -- C:\Windows\SysNative\Drivers\SynTP.sys (Synaptics Incorporated)
    DRV:64bit: - (SmbDrvI) -- C:\Windows\SysNative\Drivers\Smb_driver_Intel.sys (Synaptics Incorporated)
    DRV:64bit: - (igfx) -- C:\Windows\SysNative\Drivers\igdkmd64.sys (Intel Corporation)
    DRV:64bit: - (Thotkey) -- C:\Windows\SysNative\Drivers\Thotkey.sys (Windows (R) Win 7 DDK provider)
    DRV:64bit: - (iaStorA) -- C:\Windows\SysNative\Drivers\iaStorA.sys (Intel Corporation)
    DRV:64bit: - (Fs_Rec) -- C:\windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
    DRV:64bit: - (condrv) -- C:\Windows\SysNative\Drivers\condrv.sys (Microsoft Corporation)
    DRV:64bit: - (VSTXRAID) -- C:\Windows\SysNative\Drivers\VSTXRAID.SYS (VIA Corporation)
    DRV:64bit: - (VerifierExt) -- C:\Windows\SysNative\Drivers\VerifierExt.sys (Microsoft Corporation)
    DRV:64bit: - (UASPStor) -- C:\Windows\SysNative\Drivers\uaspstor.sys (Microsoft Corporation)
    DRV:64bit: - (acpiex) -- C:\Windows\SysNative\Drivers\acpiex.sys (Microsoft Corporation)
    DRV:64bit: - (mvumis) -- C:\Windows\SysNative\Drivers\mvumis.sys (Marvell Semiconductor, Inc.)
    DRV:64bit: - (stexstor) -- C:\Windows\SysNative\Drivers\stexstor.sys (Promise Technology, Inc.)
    DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\Drivers\lsi_sas2.sys (LSI Corporation)
    DRV:64bit: - (LSI_SSS) -- C:\Windows\SysNative\Drivers\lsi_sss.sys (LSI Corporation)
    DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\Drivers\HpSAMD.sys (Hewlett-Packard Company)
    DRV:64bit: - (EhStorTcgDrv) -- C:\Windows\SysNative\Drivers\EhStorTcgDrv.sys (Microsoft Corporation)
    DRV:64bit: - (EhStorClass) -- C:\Windows\SysNative\Drivers\EhStorClass.sys (Microsoft Corporation)
    DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\Drivers\amdsbs.sys (AMD Technologies Inc.)
    DRV:64bit: - (3ware) -- C:\Windows\SysNative\Drivers\3ware.sys (LSI)
    DRV:64bit: - (amdsata) -- C:\Windows\SysNative\Drivers\amdsata.sys (Advanced Micro Devices)
    DRV:64bit: - (amdxata) -- C:\Windows\SysNative\Drivers\amdxata.sys (Advanced Micro Devices)
    DRV:64bit: - (CLFS) -- C:\Windows\SysNative\Drivers\clfs.sys (Microsoft Corporation)
    DRV:64bit: - (WFPLWFS) -- C:\Windows\SysNative\Drivers\wfplwfs.sys (Microsoft Corporation)
    DRV:64bit: - (vpci) -- C:\Windows\SysNative\Drivers\vpci.sys (Microsoft Corporation)
    DRV:64bit: - (terminpt) -- C:\Windows\SysNative\Drivers\terminpt.sys (Microsoft Corporation)
    DRV:64bit: - (mshidumdf) -- C:\Windows\SysNative\Drivers\mshidumdf.sys (Microsoft Corporation)
    DRV:64bit: - (BasicDisplay) -- C:\Windows\SysNative\Drivers\BasicDisplay.sys (Microsoft Corporation)
    DRV:64bit: - (HyperVideo) -- C:\Windows\SysNative\Drivers\HyperVideo.sys (Microsoft Corporation)
    DRV:64bit: - (BasicRender) -- C:\Windows\SysNative\Drivers\BasicRender.sys (Microsoft Corporation)
    DRV:64bit: - (gencounter) -- C:\Windows\SysNative\Drivers\vmgencounter.sys (Microsoft Corporation)
    DRV:64bit: - (kdnic) -- C:\Windows\SysNative\Drivers\kdnic.sys (Microsoft Corporation)
    DRV:64bit: - (acpitime) -- C:\Windows\SysNative\Drivers\acpitime.sys (Microsoft Corporation)
    DRV:64bit: - (npsvctrig) -- C:\Windows\SysNative\Drivers\npsvctrig.sys (Microsoft Corporation)
    DRV:64bit: - (WpdUpFltr) -- C:\Windows\SysNative\Drivers\WpdUpFltr.sys (Microsoft Corporation)
    DRV:64bit: - (acpipagr) -- C:\Windows\SysNative\Drivers\acpipagr.sys (Microsoft Corporation)
    DRV:64bit: - (hyperkbd) -- C:\Windows\SysNative\Drivers\hyperkbd.sys (Microsoft Corporation)
    DRV:64bit: - (SerCx) -- C:\Windows\SysNative\Drivers\SerCx.sys (Microsoft Corporation)
    DRV:64bit: - (SpbCx) -- C:\Windows\SysNative\Drivers\SpbCx.sys (Microsoft Corporation)
    DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\Drivers\TsUsbGD.sys (Microsoft Corporation)
    DRV:64bit: - (BthHFEnum) -- C:\Windows\SysNative\Drivers\bthhfenum.sys (Microsoft Corporation)
    DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\Drivers\dmvsc.sys (Microsoft Corporation)
    DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\Drivers\TsUsbFlt.sys (Microsoft Corporation)
    DRV:64bit: - (wpcfltr) -- C:\Windows\SysNative\Drivers\wpcfltr.sys (Microsoft Corporation)
    DRV:64bit: - (NdisImPlatform) -- C:\Windows\SysNative\Drivers\NdisImPlatform.sys (Microsoft Corporation)
    DRV:64bit: - (MsLldp) -- C:\Windows\SysNative\Drivers\mslldp.sys (Microsoft Corporation)
    DRV:64bit: - (Ndu) -- C:\Windows\SysNative\Drivers\Ndu.sys (Microsoft Corporation)
    DRV:64bit: - (TVALZ) -- C:\Windows\SysNative\Drivers\TVALZ_O.SYS (TOSHIBA Corporation)
    DRV:64bit: - (tdcmdpst) -- C:\Windows\SysNative\Drivers\tdcmdpst.sys (TOSHIBA Corporation.)
    DRV:64bit: - (TVALZFL) -- C:\Windows\SysNative\Drivers\TVALZFL.sys (TOSHIBA Corporation)
    DRV:64bit: - (L1C) -- C:\Windows\SysNative\Drivers\L1C63x64.sys (Qualcomm Atheros Co., Ltd.)
    DRV:64bit: - (FwLnk) -- C:\Windows\SysNative\Drivers\FwLnk.sys (TOSHIBA Corporation)
    DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\Drivers\HECIx64.sys (Intel Corporation)
    DRV:64bit: - (SymELAM) -- C:\Windows\SysNative\Drivers\NISx64\1404000.028\symelam.sys (Symantec Corporation)
    DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\Drivers\IntcDAud.sys (Intel(R) Corporation)
    DRV:64bit: - (tos_sps64) -- C:\Windows\SysNative\Drivers\tos_sps64.sys (TOSHIBA Corporation)
    DRV:64bit: - (RSUSBVSTOR) -- C:\Windows\SysNative\Drivers\RtsUVStor.sys (Realtek Semiconductor Corp.)
    DRV:64bit: - (ccSet_NARA) -- C:\Windows\SysNative\Drivers\NARAx64\0401000.00B\ccSetx64.sys (Symantec Corporation)
    DRV - (BHDrvx64) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\BASHDefs\20130322.001\BHDrvx64.sys (Symantec Corporation)
    DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\VirusDefs\20130404.018\ex64.sys (Symantec Corporation)
    DRV - (eeCtrl) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
    DRV - (EraserUtilRebootDrv) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
    DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\VirusDefs\20130404.018\eng64.sys (Symantec Corporation)
    DRV - (IDSVia64) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\IPSDefs\20130404.001\IDSviA64.sys (Symantec Corporation)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshiba13.msn.com
    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://mystart.toshiba.com [binary data]
    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://mystart.toshiba.com [binary data]
    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://toshiba13.msn.com
    IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD24}
    IE:64bit: - HKLM\..\SearchScopes\{3D99CF16-1853-41FF-962D-DF6CFB884979}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATBJS
    IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD24}: "URL" = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=157&systemid=4&apn_dtid=IME004&apn_ptnrs=AG3&o=APN10642&apn_uid=1350503644714625&q={searchTerms}
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshiba13.msn.com
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://mystart.toshiba.com [binary data]
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://mystart.toshiba.com [binary data]
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={E907F3B7-E5DD-11E2-BEA0-00266C1D080D}
    IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
    IE - HKLM\..\SearchScopes\{3D99CF16-1853-41FF-962D-DF6CFB884979}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATBJS
    IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD24}: "URL" = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=157&systemid=4&apn_dtid=IME004&apn_ptnrs=AG3&o=APN10642&apn_uid=1350503644714625&q={searchTerms}

    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshiba13.msn.com
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://mystart.toshiba.com [binary data]
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
    IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD24}
    IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD24}: "URL" = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=157&systemid=4&apn_dtid=IME004&apn_ptnrs=AG3&o=APN10642&apn_uid=1350503644714625&q={searchTerms}
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


    ========== FireFox ==========

    FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
    FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
    FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
    FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
    FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
    FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3503.0728: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

    64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}: C:\PROGRAM FILES\UPDATER BY SWEETPACKS\FIREFOX [2013/07/05 21:47:53 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\coFFPlgn\ [2013/08/04 13:54:29 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\IPSFFPlgn\ [2013/03/05 18:48:29 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}: C:\Program Files\Updater By SweetPacks\Firefox [2013/07/05 21:47:53 | 000,000,000 | ---D | M]
    FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\Lyrics@LyricsContainer.co: C:\Program Files (x86)\LyricsContainer\116.xpi [2013/07/05 21:46:32 | 000,005,593 | ---- | M] ()


    ========== Chrome ==========

    CHR - default_search_provider: Bing (Enabled)
    CHR - default_search_provider: search_url = http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10042&barid={E907F3B7-E5DD-11E2-BEA0-00266C1D080D}
    CHR - default_search_provider: suggest_url =
    CHR - homepage: http://search.lphant.com
    CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll
    CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
    CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll
    CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\pdf.dll
    CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
    CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
    CHR - plugin: Intel\u00C2\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
    CHR - plugin: Intel\u00C2\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll
    CHR - plugin: Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
    CHR - Extension: LyricsContainer = C:\Users\scofi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\abfmigjiaapipflmopkaaooigcjjdojh\1.116_0\
    CHR - Extension: Google Docs = C:\Users\scofi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
    CHR - Extension: Google Drive = C:\Users\scofi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
    CHR - Extension: YouTube = C:\Users\scofi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
    CHR - Extension: Google Search = C:\Users\scofi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
    CHR - Extension: Norton Identity Protection = C:\Users\scofi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.4.0.10_0\
    CHR - Extension: Gmail = C:\Users\scofi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

    O1 HOSTS File: ([2012/07/26 01:26:49 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\Drivers\etc\hosts
    O2 - BHO: (SelectionLinks) - {1C8501DD-5580-48AB-B25C-6D5DBE835A6A} - C:\Program Files (x86)\OApps\SelectionLinks.dll File not found
    O2 - BHO: (Search-Results Toolbar) - {35a73de5-0093-4279-bc86-0132572828f4} - C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
    O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
    O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation)
    O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
    O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
    O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O3 - HKLM\..\Toolbar: (Search-Results Toolbar) - {35a73de5-0093-4279-bc86-0132572828f4} - C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
    O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
    O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O4:64bit: - HKLM..\Run: [] File not found
    O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
    O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
    O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
    O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
    O4:64bit: - HKLM..\Run: [SRS Premium Sound HD] C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe (SRS Labs, Inc.)
    O4:64bit: - HKLM..\Run: [TCrdMain] C:\Program Files\Toshiba\Hotkey\TCrdMain_Win8.exe (TOSHIBA Corporation)
    O4:64bit: - HKLM..\Run: [TecoResident] C:\Program Files\Toshiba\Teco\TecoResident.exe (TOSHIBA Corporation)
    O4:64bit: - HKLM..\Run: [TODDMain] C:\Program Files (x86)\Toshiba\System Setting\TODDMain.exe ()
    O4:64bit: - HKLM..\Run: [TosWaitSrv] C:\Program Files\Toshiba\TPHM\TosWaitSrv.exe (TOSHIBA Corporation)
    O4:64bit: - HKLM..\Run: [TSleepSrv] C:\Program Files (x86)\Toshiba\System Setting\TSleepSrv.exe (TOSHIBA Corporation)
    O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
    O4 - HKLM..\Run: [DATAMNGR] C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\datamngrUI.exe (Bandoo Media Inc)
    O4 - HKLM..\Run: [DigiDo] C:\Program Files (x86)\Time Warner Cable\TWC WiFi\TrayApp.exe (Affinegy, Inc.)
    O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)
    O4 - HKLM..\Run: [ToshibaAppPlace] C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe (Toshiba)
    O4 - HKCU..\Run: [NETGEARGenie] C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe ()
    O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
    O4 - HKCU..\Run: [WebCake Desktop] "C:\Users\scofi_000\AppData\Roaming\WebCake\WebCakeDesktop.exe" File not found
    O4 - Startup: C:\Users\scofi_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files (x86)\ERUNT\AUTOBACK.EXE ()
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Activities present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
    O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
    O1364bit: - gopher Prefix: missing
    O13 - gopher Prefix: missing
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1ADB8D32-5A05-4207-9B7A-98F473342EA0}: DhcpNameServer = 209.18.47.61 209.18.47.62
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D686A208-E0D7-4937-9B06-4CF98EF601CF}: DhcpNameServer = 209.18.47.61 209.18.47.62
    O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
    O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
    O20:64bit: - AppInit_DLLs: (C:\PROGRA~3\Wincert\WIN64C~1.DLL) - C:\ProgramData\Wincert\win64cert.dll ()
    O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\LPHANT~1\Mediabar\Datamngr\x64\datamngr.dll) - C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\x64\datamngr.dll (Bandoo Media Inc)
    O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\LPHANT~1\Mediabar\Datamngr\x64\IEBHO.dll) - C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\x64\IEBHO.dll (Discordia, LTD)
    O20 - AppInit_DLLs: (C:\PROGRA~3\Wincert\WIN32C~1.DLL) - C:\ProgramData\Wincert\win32cert.dll ()
    O20 - AppInit_DLLs: (C:\PROGRA~2\LPHANT~1\Mediabar\Datamngr\datamngr.dll) - C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\datamngr.dll (Bandoo Media Inc)
    O20 - AppInit_DLLs: (C:\PROGRA~2\LPHANT~1\Mediabar\Datamngr\IEBHO.dll) - C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\IEBHO.dll (Discordia, LTD)
    O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
    O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
    O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
    O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
    O30 - LSA: Security Packages - (livessp) - File not found
    O32 - HKLM CDRom: AutoRun - 1
    O34 - HKLM BootExecute: (autocheck autochk *)
    O35:64bit: - HKLM\..comfile [open] -- "%1" %*
    O35:64bit: - HKLM\..exefile [open] -- "%1" %*
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
    O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
    O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
    O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

    NetSvcs:64bit: wlidsvc - C:\Windows\SysNative\wlidsvc.dll (Microsoft Corporation)
    NetSvcs:64bit: DsmSvc - C:\Windows\SysNative\DeviceSetupManager.dll (Microsoft Corporation)
    NetSvcs:64bit: NcaSvc - C:\Windows\SysNative\NcaSvc.dll (Microsoft Corporation)
    NetSvcs:64bit: SystemEventsBroker - C:\Windows\SysNative\SystemEventsBrokerServer.dll (Microsoft Corporation)

    Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: vidc.cvid - C:\windows\SysWow64\iccvid.dll (Radius Inc.)

  5. #5
    Member
    Join Date
    Apr 2006
    Posts
    69

    Default

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point

    ========== Files/Folders - Created Within 30 Days ==========

    [2013/08/08 21:56:30 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\scofi_000\Desktop\OTL.exe
    [2013/08/04 14:16:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Checkup
    [2013/08/04 14:16:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PC Checkup
    [2013/08/04 11:16:59 | 000,000,000 | ---D | C] -- C:\windows\ERDNT
    [2013/08/04 11:08:07 | 000,000,000 | ---D | C] -- C:\windows\pss
    [2013/08/04 10:23:03 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro
    [2013/08/04 10:20:56 | 000,000,000 | ---D | C] -- C:\Users\scofi_000\AppData\Local\LogMeIn Rescue Applet
    [2013/08/04 09:26:00 | 002,219,520 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\dwmcore.dll
    [2013/08/04 09:25:59 | 006,987,008 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ntoskrnl.exe
    [2013/08/04 09:25:59 | 002,391,280 | ---- | C] (Microsoft Corporation) -- C:\windows\explorer.exe
    [2013/08/04 09:25:59 | 002,106,176 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\explorer.exe
    [2013/08/04 09:25:59 | 001,842,176 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\dwmcore.dll
    [2013/08/04 09:25:58 | 001,527,808 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\mfcore.dll
    [2013/08/04 09:25:58 | 000,729,600 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\samsrv.dll
    [2013/08/04 09:25:57 | 001,453,568 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\mfcore.dll
    [2013/08/04 09:25:56 | 001,403,296 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\winload.efi
    [2013/08/04 09:25:56 | 001,271,584 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\winload.exe
    [2013/08/04 09:25:56 | 000,523,264 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\XpsGdiConverter.dll
    [2013/08/04 09:25:55 | 001,217,352 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\winresume.efi
    [2013/08/04 09:25:49 | 001,093,904 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\winresume.exe
    [2013/08/04 09:25:44 | 001,048,576 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\mfasfsrcsnk.dll
    [2013/08/04 09:25:44 | 000,850,944 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\mfasfsrcsnk.dll
    [2013/08/04 09:25:44 | 000,583,168 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\mscms.dll
    [2013/08/04 09:25:44 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\XpsGdiConverter.dll
    [2013/08/04 09:25:44 | 000,337,152 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\drivers\USBXHCI.SYS
    [2013/08/04 09:25:44 | 000,213,248 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\drivers\UCX01000.SYS
    [2013/08/04 09:25:44 | 000,207,872 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\DeviceSetupManager.dll
    [2013/08/04 09:25:44 | 000,194,816 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\drivers\sdbus.sys
    [2013/08/04 09:25:44 | 000,190,976 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\vdsutil.dll
    [2013/08/04 09:25:44 | 000,125,184 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\drivers\dumpsd.sys
    [2013/08/04 09:25:44 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\samlib.dll
    [2013/08/04 09:25:44 | 000,080,896 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\MbaeParserTask.exe
    [2013/08/04 09:25:43 | 000,037,632 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\drivers\BthAvrcpTg.sys
    [2013/08/04 09:21:36 | 000,000,000 | ---D | C] -- C:\Users\scofi_000\AppData\Roaming\PCCUStubInstaller
    [2013/07/17 19:41:53 | 000,000,000 | ---D | C] -- C:\Users\scofi_000\AppData\Local\ElevatedDiagnostics
    [2013/07/10 16:53:17 | 001,838,080 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\DWrite.dll
    [2013/07/10 16:52:37 | 000,595,968 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\qedit.dll
    [2013/07/10 16:52:37 | 000,496,640 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\qedit.dll
    [2013/07/10 16:52:10 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\jscript9.dll
    [2013/07/10 16:52:06 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\jscript.dll
    [2013/07/10 16:52:06 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\jscript.dll
    [2013/07/10 16:52:06 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\msfeeds.dll
    [2013/07/10 16:52:06 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ie4uinit.exe
    [2013/07/10 16:52:00 | 002,842,112 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\WMVDECOD.DLL
    [2013/07/10 16:52:00 | 002,620,928 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\WMVDECOD.DLL

    ========== Files - Modified Within 30 Days ==========

    [2013/08/08 21:56:31 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\scofi_000\Desktop\OTL.exe
    [2013/08/08 21:50:14 | 000,000,138 | ---- | M] () -- C:\Users\scofi_000\Desktop\MBR.zip
    [2013/08/08 21:46:42 | 000,000,512 | ---- | M] () -- C:\Users\scofi_000\Desktop\MBR.dat
    [2013/08/08 21:39:01 | 000,000,922 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
    [2013/08/08 21:36:39 | 000,891,115 | ---- | M] () -- C:\Users\scofi_000\Desktop\SecurityCheck.exe
    [2013/08/08 21:36:05 | 000,000,434 | ---- | M] () -- C:\windows\tasks\LyricsContainer Update.job
    [2013/08/08 21:35:00 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
    [2013/08/08 21:32:07 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
    [2013/08/04 19:20:23 | 000,000,918 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
    [2013/08/04 15:43:44 | 000,001,120 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    [2013/08/04 13:56:30 | 000,848,230 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
    [2013/08/04 13:56:30 | 000,719,418 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
    [2013/08/04 13:56:30 | 000,132,748 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
    [2013/08/04 13:51:57 | 268,435,456 | -HS- | M] () -- C:\swapfile.sys
    [2013/08/04 13:51:55 | 761,864,191 | -HS- | M] () -- C:\hiberfil.sys
    [2013/08/04 12:35:16 | 000,006,899 | ---- | M] () -- C:\windows\wininit.ini
    [2013/08/04 11:16:14 | 000,001,115 | ---- | M] () -- C:\Users\scofi_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
    [2013/08/04 11:16:13 | 000,000,916 | ---- | M] () -- C:\Users\scofi_000\Desktop\ERUNT.lnk
    [2013/07/17 20:02:33 | 000,422,160 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT

    ========== Files Created - No Company Name ==========

    [2013/08/08 21:50:14 | 000,000,138 | ---- | C] () -- C:\Users\scofi_000\Desktop\MBR.zip
    [2013/08/08 21:46:42 | 000,000,512 | ---- | C] () -- C:\Users\scofi_000\Desktop\MBR.dat
    [2013/08/08 21:36:28 | 000,891,115 | ---- | C] () -- C:\Users\scofi_000\Desktop\SecurityCheck.exe
    [2013/08/04 15:43:43 | 000,001,120 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    [2013/08/04 10:20:58 | 000,002,198 | ---- | C] () -- C:\Users\scofi_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ID1028688 TPUSA, Inc..lnk
    [2013/08/04 09:26:00 | 000,386,642 | ---- | C] () -- C:\windows\SysNative\ApnDatabase.xml
    [2013/07/17 20:02:21 | 000,422,160 | ---- | C] () -- C:\windows\SysNative\FNTCACHE.DAT
    [2013/06/22 02:25:42 | 000,006,899 | ---- | C] () -- C:\windows\wininit.ini
    [2013/06/21 21:36:41 | 000,000,037 | -HS- | C] () -- C:\Users\scofi_000\AppData\Local\70149b02515b3bb20dd492.47983420
    [2013/03/05 18:51:52 | 000,083,968 | ---- | C] () -- C:\windows\SysWow64\OEMLicense.dll
    [2012/09/24 04:27:09 | 000,451,072 | ---- | C] () -- C:\windows\SysWow64\ISSRemoveSP.exe
    [2012/08/06 09:36:22 | 000,598,780 | ---- | C] () -- C:\windows\SysWow64\igvpkrng700.bin
    [2012/08/06 09:36:08 | 000,064,512 | ---- | C] () -- C:\windows\SysWow64\igdde32.dll
    [2012/08/06 09:36:06 | 000,755,048 | ---- | C] () -- C:\windows\SysWow64\igcodeckrng700.bin
    [2012/07/26 04:13:10 | 000,215,943 | ---- | C] () -- C:\windows\SysWow64\dssec.dat
    [2012/07/26 04:13:09 | 000,000,741 | ---- | C] () -- C:\windows\SysWow64\NOISE.DAT
    [2012/07/26 03:21:26 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat
    [2012/07/25 21:17:42 | 000,043,520 | ---- | C] () -- C:\windows\SysWow64\BWContextHandler.dll
    [2012/07/25 16:37:29 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin
    [2012/07/25 16:28:31 | 000,364,544 | ---- | C] () -- C:\windows\SysWow64\msjetoledb40.dll
    [2012/06/02 10:31:19 | 000,673,088 | ---- | C] () -- C:\windows\SysWow64\mlang.dat
    [2012/04/20 16:59:44 | 000,001,536 | ---- | C] () -- C:\windows\SysWow64\IusEventLog.dll

    ========== ZeroAccess Check ==========

    [2013/07/05 21:46:15 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini

    [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

    [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

    [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

    [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
    "" = C:\Windows\SysNative\shell32.dll -- [2013/03/06 02:31:28 | 019,758,592 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
    "" = %SystemRoot%\system32\shell32.dll -- [2013/03/06 01:03:37 | 017,561,600 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
    "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2012/07/25 23:05:38 | 001,004,544 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
    "" = %systemroot%\system32\wbem\fastprox.dll -- [2012/07/25 23:18:27 | 000,784,896 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
    "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2012/07/25 23:07:41 | 000,455,680 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Both

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

    ========== LOP Check ==========

    [2013/03/20 21:29:24 | 000,000,000 | ---D | M] -- C:\Users\scofi_000\AppData\Roaming\Book Place
    [2013/03/31 22:27:10 | 000,000,000 | ---D | M] -- C:\Users\scofi_000\AppData\Roaming\MusicNet
    [2013/03/06 17:44:42 | 000,000,000 | ---D | M] -- C:\Users\scofi_000\AppData\Roaming\Opera
    [2013/08/04 09:21:36 | 000,000,000 | ---D | M] -- C:\Users\scofi_000\AppData\Roaming\PCCUStubInstaller
    [2013/03/05 18:47:31 | 000,000,000 | ---D | M] -- C:\Users\scofi_000\AppData\Roaming\WinBatch

    ========== Purity Check ==========



    ========== Custom Scans ==========

    < %USERPROFILE%\..|smtmp;true;true;true /FP >

    < %temp%\smtmp\*.* /s > >

    < MD5 for: EXPLORER.0.LOCALSETTINGUNIT >
    [2013/03/05 18:52:00 | 000,000,359 | -HS- | M] () MD5=1135FB5CFFDCA1707FEB5E3EC4D904B2 -- C:\Users\scofi_000\AppData\Local\Microsoft\Windows\Live\Roaming\LocalCache\windows-explorer\Explorer.0.localsettingunit
    [2013/02/12 21:35:08 | 000,000,359 | -HS- | M] () MD5=1135FB5CFFDCA1707FEB5E3EC4D904B2 -- C:\Windows.old\Users\scofi_000\AppData\Local\Microsoft\Windows\Live\Roaming\LocalCache\windows-explorer\Explorer.0.localsettingunit
    [2013/03/31 12:05:13 | 000,000,357 | -HS- | M] () MD5=CB434B1A74F1B07A7A9F444F25D4AD59 -- C:\Users\jleem_000\AppData\Local\Microsoft\Windows\Live\Roaming\LocalCache\windows-explorer\Explorer.0.localsettingunit

    < MD5 for: EXPLORER.ADML >
    [2012/07/26 03:49:05 | 000,003,671 | ---- | M] () MD5=007B16AEF3E958080573CDB80648167D -- C:\Windows\WinSxS\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.2.9200.16384_en-us_7bca26f6f419a854\Explorer.adml
    [2012/07/26 03:49:05 | 000,003,671 | ---- | M] () MD5=007B16AEF3E958080573CDB80648167D -- C:\Windows\WinSxS\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.2.9200.16433_en-us_7bff382ef3f2006f\Explorer.adml
    [2012/07/26 03:49:05 | 000,003,671 | ---- | M] () MD5=007B16AEF3E958080573CDB80648167D -- C:\Windows\WinSxS\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.2.9200.20534_en-us_7c89d5440d0eb990\Explorer.adml

    < MD5 for: EXPLORER.ADMX >
    [2012/06/02 10:32:35 | 000,003,836 | ---- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 -- C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.16384_none_6e8451187a9a1607\Explorer.admx
    [2012/06/02 10:32:35 | 000,003,836 | ---- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 -- C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.16420_none_6ec1315e7a6d062c\Explorer.admx
    [2012/06/02 10:32:35 | 000,003,836 | ---- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 -- C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.16433_none_6eb962507a726e22\Explorer.admx
    [2012/06/02 10:32:35 | 000,003,836 | ---- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 -- C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.20521_none_6f4bce739389bf4d\Explorer.admx
    [2012/06/02 10:32:35 | 000,003,836 | ---- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 -- C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.20534_none_6f43ff65938f2743\Explorer.admx

    < MD5 for: EXPLORER.EXE >
    [2013/06/01 07:34:21 | 002,391,280 | ---- | M] (Microsoft Corporation) MD5=0E8E6463F81C80AFBED533E0F1F8895D -- C:\Windows\explorer.exe
    [2013/06/01 07:34:21 | 002,391,280 | ---- | M] (Microsoft Corporation) MD5=0E8E6463F81C80AFBED533E0F1F8895D -- C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16628_none_aac334d9034c59e1\explorer.exe
    [2013/06/01 06:17:57 | 002,116,520 | ---- | M] (Microsoft Corporation) MD5=15C505AD0118275E7363A539009EF3AF -- C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.20733_none_b591aa9850d758e4\explorer.exe
    [2013/06/14 20:15:06 | 000,145,657 | ---- | M] () MD5=4D4C1FB914B2BE4A256B0A3B4416596E -- C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16384_none_b4d2f8c937e166b1\explorer.exe
    [2013/06/14 20:15:09 | 000,004,958 | ---- | M] () MD5=55FFE25E78BF81948965A97E4AE8BA5B -- C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.20534_none_b592a71650d677ed\explorer.exe
    [2012/10/11 01:56:41 | 002,115,952 | ---- | M] (Microsoft Corporation) MD5=953ADECFF08202A01EFC6110214FDE02 -- C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16433_none_b5080a0137b9becc\explorer.exe
    [2013/06/14 18:30:09 | 000,188,441 | ---- | M] () MD5=AB36259FAC74D5C123A23BF4323BD463 -- C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16384_none_aa7e4e770380a4b6\explorer.exe
    [2013/06/14 18:30:11 | 000,003,739 | ---- | M] () MD5=C24628C798B1A9514D74DC7DECA7E7EB -- C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.20534_none_ab3dfcc41c75b5f2\explorer.exe
    [2013/06/01 08:41:08 | 002,380,968 | ---- | M] (Microsoft Corporation) MD5=D1FF6792A3B0FBD2F2F17DC936AF6177 -- C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.20733_none_ab3d00461c7696e9\explorer.exe
    [2012/10/11 03:35:16 | 002,380,944 | ---- | M] (Microsoft Corporation) MD5=E13A31D5254C25406A7946BDD9B06364 -- C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16433_none_aab35faf0358fcd1\explorer.exe
    [2013/06/01 06:24:46 | 002,106,176 | ---- | M] (Microsoft Corporation) MD5=EAFE46B0292D2BD2467835E2ACF717CC -- C:\Windows\SysWOW64\explorer.exe
    [2013/06/01 06:24:46 | 002,106,176 | ---- | M] (Microsoft Corporation) MD5=EAFE46B0292D2BD2467835E2ACF717CC -- C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16628_none_b517df2b37ad1bdc\explorer.exe

  6. #6
    Member
    Join Date
    Apr 2006
    Posts
    69

    Default

    < MD5 for: EXPLORER.EXE.2276.DMP >
    [2013/06/28 16:31:21 | 005,023,144 | ---- | M] () MD5=73DC0495B687519F0CCC999CC1B5DB4F -- C:\Users\jleem_000\AppData\Local\CrashDumps\explorer.exe.2276.dmp

    < MD5 for: EXPLORER.EXE.2360.DMP >
    [2013/03/31 12:04:13 | 004,655,525 | ---- | M] () MD5=CB8B4D5EBBD92AE1BE13276C38512849 -- C:\Users\jleem_000\AppData\Local\CrashDumps\explorer.exe.2360.dmp

    < MD5 for: EXPLORER.EXE.3228.DMP >
    [2013/04/07 20:11:41 | 002,301,215 | ---- | M] () MD5=19CEF5839C46CA0524959C6320C3BAD1 -- C:\Users\jleem_000\AppData\Local\CrashDumps\explorer.exe.3228.dmp

    < MD5 for: EXPLORER.EXE.3464.DMP >
    [2013/07/15 17:40:15 | 002,270,135 | ---- | M] () MD5=D15015F0EC696C2B5D5F81F6CBF6AA5C -- C:\Users\jleem_000\AppData\Local\CrashDumps\explorer.exe.3464.dmp

    < MD5 for: EXPLORER.EXE.4004.DMP >
    [2013/07/01 16:06:41 | 005,659,471 | ---- | M] () MD5=64D11493299611A9E3FE0AC55D5D4304 -- C:\Users\jleem_000\AppData\Local\CrashDumps\explorer.exe.4004.dmp

    < MD5 for: EXPLORER.EXE.8068.DMP >
    [2013/06/24 07:58:46 | 004,651,045 | ---- | M] () MD5=9C97CA2B295AFFF52C0E26BEA7560837 -- C:\Users\jleem_000\AppData\Local\CrashDumps\explorer.exe.8068.dmp

    < MD5 for: EXPLORER.EXE.MUI >
    [2012/07/26 03:48:57 | 000,020,480 | ---- | M] (Microsoft Corporation) MD5=C25D32FEDB5AA6FF87B5A29D56D35FFA -- C:\Windows\en-US\explorer.exe.mui
    [2012/07/26 03:48:57 | 000,020,480 | ---- | M] (Microsoft Corporation) MD5=C25D32FEDB5AA6FF87B5A29D56D35FFA -- C:\Windows\SysWOW64\en-US\explorer.exe.mui
    [2012/07/26 03:48:57 | 000,020,480 | ---- | M] (Microsoft Corporation) MD5=C25D32FEDB5AA6FF87B5A29D56D35FFA -- C:\Windows\WinSxS\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.2.9200.16384_en-us_5ebc2e81fd6600eb\explorer.exe.mui
    [2012/07/26 03:48:57 | 000,020,480 | ---- | M] (Microsoft Corporation) MD5=C25D32FEDB5AA6FF87B5A29D56D35FFA -- C:\Windows\WinSxS\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.2.9200.16384_en-us_6910d8d431c6c2e6\explorer.exe.mui

    < MD5 for: EXPLORER.EXE-03C49D11.PF >
    [2013/08/04 19:20:29 | 000,225,202 | ---- | M] () MD5=9C07EA4388DDA0FE1D03A4DB9C668247 -- C:\Windows\Prefetch\EXPLORER.EXE-03C49D11.pf

    < MD5 for: EXPLORER.ZIP >
    [2009/06/03 21:15:06 | 000,020,394 | ---- | M] () MD5=B469409C2B2A33C542190B720E11BD79 -- C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Explorer.zip

    < MD5 for: IEXPLORE.EXE >
    [2013/02/21 07:11:26 | 000,770,624 | ---- | M] (Microsoft Corporation) MD5=0A1FC149D1F01AEE5D66D42953CDD751 -- C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20742_none_2b6065cf3a44582a\iexplore.exe
    [2013/06/14 20:15:32 | 000,005,657 | ---- | M] () MD5=100DA13DD2170E21BF0596AD49BD95A8 -- C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20589_none_2b7967573a31390b\iexplore.exe
    [2013/06/14 18:31:28 | 000,005,624 | ---- | M] () MD5=14C1C3C2BC369ABE5F4AEDD46541EC60 -- C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20544_none_21212dc505d3918f\iexplore.exe
    [2013/06/14 18:31:26 | 000,000,383 | ---- | M] () MD5=16E8C0EF2C72B24977D95166A96CDC2C -- C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16540_none_37ef2f80ec2bcb56\iexplore.exe
    [2013/06/14 18:31:32 | 000,003,063 | ---- | M] () MD5=194CDBFC3391875EE91B9D8C5DCA90F5 -- C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20703_none_2107a38d05e74a74\iexplore.exe
    [2013/06/14 20:15:25 | 000,005,019 | ---- | M] () MD5=19519D97219BE80F2AF67B8FC0659254 -- C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16433_none_424d651d2085a4ec\iexplore.exe
    [2013/06/14 20:15:33 | 000,005,644 | ---- | M] () MD5=1B09212177AE37710F6539A32D496916 -- C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20624_none_2b6907973a3e3ccd\iexplore.exe
    [2013/06/14 18:31:26 | 000,006,244 | ---- | M] () MD5=1D927DED9BAA38EC25BDEF562AEB7633 -- C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16519_none_37eb619aec2f65fa\iexplore.exe
    [2013/06/14 18:31:23 | 000,006,786 | ---- | M] () MD5=436BCB6E0A50FE816BDED7B85352C16A -- C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16384_none_38087560ec185f54\iexplore.exe
    [2013/06/14 20:15:23 | 000,006,706 | ---- | M] () MD5=594819C3D0E41D86AF22E7809699C92A -- C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16384_none_425d1fb32079214f\iexplore.exe
    [2013/02/21 08:59:57 | 000,775,216 | ---- | M] (Microsoft Corporation) MD5=6554208814632C25C77EE02355EB8E95 -- C:\Program Files\Internet Explorer\iexplore.exe
    [2013/02/21 08:59:57 | 000,775,216 | ---- | M] (Microsoft Corporation) MD5=6554208814632C25C77EE02355EB8E95 -- C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16599_none_37f363eaec2830b2\iexplore.exe
    [2013/02/21 08:59:57 | 000,775,216 | ---- | M] (Microsoft Corporation) MD5=6554208814632C25C77EE02355EB8E95 -- C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16635_none_37e2ed62ec354e15\iexplore.exe
    [2013/06/14 18:31:23 | 000,006,281 | ---- | M] () MD5=70023B07A75E8EC51A5B3B690FFDBD6B -- C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16433_none_37f8bacaec24e2f1\iexplore.exe
    [2013/06/14 18:31:25 | 000,005,561 | ---- | M] () MD5=7B06D719B59F6714CB2BB62879BEB5CB -- C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16484_none_37fda574ec207b45\iexplore.exe
    [2013/06/14 18:31:30 | 000,003,063 | ---- | M] () MD5=85D2CBD6F76F357F9AB040C91A857B5F -- C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20644_none_21165dd905dbad80\iexplore.exe
    [2013/06/14 20:15:26 | 000,005,080 | ---- | M] () MD5=885795819B7080962452F7EEFE7C6D25 -- C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16442_none_424e7c2f2084a4a2\iexplore.exe
    [2013/06/14 20:15:31 | 000,005,022 | ---- | M] () MD5=967CAE99688151BCF86F530D105CFF4D -- C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20544_none_2b75d8173a34538a\iexplore.exe
    [2013/06/14 20:15:29 | 000,000,400 | ---- | M] () MD5=9AA157592F82D24D6B7622F6B7EE3FB0 -- C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16580_none_4247dafb2088f2ad\iexplore.exe
    [2013/06/14 20:15:34 | 000,005,039 | ---- | M] () MD5=A8DBB97496881D2BC0887C32E9CE7051 -- C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20644_none_2b6b082b3a3c6f7b\iexplore.exe
    [2013/06/14 20:15:28 | 000,000,400 | ---- | M] () MD5=ABD3DE2375F2AFEE68EFDABCF49D94C6 -- C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16540_none_4243d9d3208c8d51\iexplore.exe
    [2013/06/14 20:15:27 | 000,004,525 | ---- | M] () MD5=ADCE5060E6A20349A4E924EF4B4A6533 -- C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16519_none_42400bed209027f5\iexplore.exe
    [2013/06/14 20:15:30 | 000,005,024 | ---- | M] () MD5=AF0986EFE392443A99C6E241AF7F2C2D -- C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20534_none_2b74d7cd3a353a33\iexplore.exe
    [2013/06/14 20:15:36 | 000,005,039 | ---- | M] () MD5=AF14DCEDE14A25460406F498A91E54F0 -- C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20703_none_2b5c4ddf3a480c6f\iexplore.exe
    [2013/06/14 18:31:29 | 000,006,213 | ---- | M] () MD5=B1A8AB5A24B309A313A36DD251F307B8 -- C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20589_none_2124bd0505d07710\iexplore.exe
    [2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
    [2013/06/14 18:31:27 | 000,000,383 | ---- | M] () MD5=B5F631E2BFB706D31ADF52C851A6E631 -- C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16580_none_37f330a8ec2830b2\iexplore.exe
    [2013/06/14 18:31:31 | 000,003,063 | ---- | M] () MD5=D04C88EAFA8C7B98EB2281699F611399 -- C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20684_none_211a5f0105d812dc\iexplore.exe
    [2013/06/14 18:31:24 | 000,005,635 | ---- | M] () MD5=DD73AAFE0569B47A57FA8C3CD0EB4EEC -- C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16442_none_37f9d1dcec23e2a7\iexplore.exe
    [2013/02/21 07:28:11 | 000,770,608 | ---- | M] (Microsoft Corporation) MD5=E4F6125ED5185F8FA37CC4F449B85526 -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
    [2013/02/21 07:28:11 | 000,770,608 | ---- | M] (Microsoft Corporation) MD5=E4F6125ED5185F8FA37CC4F449B85526 -- C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16599_none_42480e3d2088f2ad\iexplore.exe
    [2013/02/21 07:28:11 | 000,770,608 | ---- | M] (Microsoft Corporation) MD5=E4F6125ED5185F8FA37CC4F449B85526 -- C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16635_none_423797b520961010\iexplore.exe
    [2013/02/21 09:13:16 | 000,775,216 | ---- | M] (Microsoft Corporation) MD5=E61732C1203A6BCA2FFB91022CA48AC6 -- C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20742_none_210bbb7d05e3962f\iexplore.exe
    [2013/06/14 18:31:30 | 000,006,274 | ---- | M] () MD5=ED6C2C12A863413C42036FB0E3C90225 -- C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20624_none_21145d4505dd7ad2\iexplore.exe
    [2013/06/14 20:15:26 | 000,005,677 | ---- | M] () MD5=EFC8B7405CE6910AD4A797937E4B683C -- C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16484_none_42524fc720813d40\iexplore.exe
    [2013/06/14 18:31:27 | 000,006,230 | ---- | M] () MD5=F642B1013BE1FED510E32906461A5FD7 -- C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20534_none_21202d7b05d47838\iexplore.exe
    [2013/06/14 20:15:35 | 000,005,039 | ---- | M] () MD5=FE0FF3263318727E804979338ED84E19 -- C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20684_none_2b6f09533a38d4d7\iexplore.exe

    < MD5 for: IEXPLORE.EXE.MUI >
    [2012/07/26 03:49:06 | 000,005,632 | ---- | M] (Microsoft Corporation) MD5=4C724BBF739D40D8AA3023943F3450A7 -- C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui
    [2012/07/26 03:49:06 | 000,005,632 | ---- | M] (Microsoft Corporation) MD5=4C724BBF739D40D8AA3023943F3450A7 -- C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
    [2012/07/26 03:49:06 | 000,005,632 | ---- | M] (Microsoft Corporation) MD5=4C724BBF739D40D8AA3023943F3450A7 -- C:\Users\scofi_000\AppData\Local\Temp\iexplore.exe.mui
    [2012/07/26 03:49:06 | 000,005,632 | ---- | M] (Microsoft Corporation) MD5=4C724BBF739D40D8AA3023943F3450A7 -- C:\Windows\WinSxS\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_10.0.9200.16384_en-us_31b50ad823c5a03b\iexplore.exe.mui
    [2012/07/26 03:49:06 | 000,005,632 | ---- | M] (Microsoft Corporation) MD5=4C724BBF739D40D8AA3023943F3450A7 -- C:\Windows\WinSxS\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_10.0.9200.16384_en-us_3c09b52a58266236\iexplore.exe.mui

    < MD5 for: IEXPLORE.EXE-6C28DB75.PF >
    [2013/06/25 19:32:02 | 000,109,784 | ---- | M] () MD5=9AEAC689204E560320341D99E64962B1 -- C:\Windows\Prefetch\IEXPLORE.EXE-6C28DB75.pf

    < MD5 for: IEXPLORE.EXE-6C28DB76.PF >
    [2013/06/25 19:32:03 | 000,338,030 | ---- | M] () MD5=53B34F4C9DA95B69722C4571A63B0324 -- C:\Windows\Prefetch\IEXPLORE.EXE-6C28DB76.pf

    < MD5 for: IEXPLORE.EXE-7A9337F2.PF >
    [2013/08/08 21:33:20 | 000,080,330 | ---- | M] () MD5=552050526E189C6B2BF4E6520D6126EC -- C:\Windows\Prefetch\IEXPLORE.EXE-7A9337F2.pf

    < MD5 for: IEXPLORE.EXE-F4FB5D2D.PF >
    [2013/08/04 14:59:46 | 000,016,402 | ---- | M] () MD5=78B2D427D5ADE29FD43E5C8EBD684B61 -- C:\Windows\Prefetch\IEXPLORE.EXE-F4FB5D2D.pf

    < MD5 for: IEXPLORE.EXE-F4FB5D2F.PF >
    [2013/08/08 21:33:22 | 000,410,622 | ---- | M] () MD5=C552481C05574ED6B582216AC11FD9F2 -- C:\Windows\Prefetch\IEXPLORE.EXE-F4FB5D2F.pf

    < MD5 for: SERVICES >
    [2012/07/26 01:26:47 | 000,017,463 | ---- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 -- C:\Windows\WinSxS\amd64_microsoft-windows-w..ucture-other-minwin_31bf3856ad364e35_6.2.9200.16384_none_8e0944daeed62829\services

    < MD5 for: SERVICES.CFG >
    [2013/05/10 03:57:30 | 000,558,879 | ---- | M] () MD5=3679F8D3253DC110D1D8F2AE115EE00C -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Services\Services.cfg
    [2011/06/06 15:55:30 | 000,584,045 | R--- | M] () MD5=B82DD53FA8C260DDD7FDC42182DB816E -- C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\services.cfg

    < MD5 for: SERVICES.EXE >
    [2013/06/14 19:15:17 | 000,038,189 | ---- | M] () MD5=526A042FD7BE49EADCEC41345F17DF89 -- C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.2.9200.16384_none_97e26cd38667756c\services.exe
    [2012/09/20 02:33:46 | 000,410,624 | ---- | M] (Microsoft Corporation) MD5=8F226143046435C75C033B0C52E90FFE -- C:\windows\SysNative\services.exe
    [2012/09/20 02:33:46 | 000,410,624 | ---- | M] (Microsoft Corporation) MD5=8F226143046435C75C033B0C52E90FFE -- C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.2.9200.16420_none_981f4d19863a6591\services.exe
    [2013/06/14 19:15:18 | 000,001,252 | ---- | M] () MD5=9079997D2A66807109B8C71E1894BDF8 -- C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.2.9200.20521_none_98a9ea2e9f571eb2\services.exe

    < MD5 for: SERVICES.EXE.MUI >
    [2012/07/26 03:48:33 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=8BCB19134E995FA62587DCE26E13B36C -- C:\windows\SysNative\en-US\services.exe.mui
    [2012/07/26 03:48:33 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=8BCB19134E995FA62587DCE26E13B36C -- C:\Windows\WinSxS\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.2.9200.16384_en-us_c2c6ee7bafb963b8\services.exe.mui

    < MD5 for: SERVICES.JS >
    [2013/04/29 22:45:15 | 000,052,388 | ---- | M] () MD5=170AC4B9F3DC60E0D38D7CC307CEFD12 -- C:\Program Files\WindowsApps\Microsoft.BingFinance_2.0.0.300_x64__8wekyb3d8bbwe\common\js\services.js
    [2012/07/26 03:54:02 | 000,056,775 | ---- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 -- C:\Program Files\WindowsApps\Microsoft.BingFinance_1.2.0.135_x64__8wekyb3d8bbwe\platform\js\services.js
    [2012/07/26 03:53:53 | 000,056,775 | ---- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 -- C:\Program Files\WindowsApps\Microsoft.BingNews_1.2.0.135_x64__8wekyb3d8bbwe\platform\js\services.js
    [2012/07/26 03:53:50 | 000,056,775 | ---- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 -- C:\Program Files\WindowsApps\Microsoft.BingSports_1.2.0.135_x64__8wekyb3d8bbwe\platform\js\services.js
    [2012/07/26 03:54:33 | 000,056,775 | ---- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 -- C:\Program Files\WindowsApps\Microsoft.BingTravel_1.2.0.145_x64__8wekyb3d8bbwe\platform\js\services.js
    [2012/07/26 03:53:57 | 000,056,775 | ---- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 -- C:\Program Files\WindowsApps\Microsoft.BingWeather_1.2.0.135_x64__8wekyb3d8bbwe\platform\js\services.js
    [2013/02/12 23:07:32 | 000,069,359 | ---- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 -- C:\Program Files\WindowsApps\Microsoft.BingFinance_1.7.0.38_x64__8wekyb3d8bbwe\common\js\services.js
    [2013/02/12 23:07:16 | 000,069,359 | ---- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 -- C:\Program Files\WindowsApps\Microsoft.BingNews_1.7.0.38_x64__8wekyb3d8bbwe\common\js\services.js
    [2013/02/12 23:10:00 | 000,069,359 | ---- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 -- C:\Program Files\WindowsApps\Microsoft.BingTravel_1.7.0.26_x64__8wekyb3d8bbwe\Common\js\services.js
    [2013/02/12 23:08:37 | 000,069,359 | ---- | M] () MD5=6AA9F10CF05F9848EFAA91062BBEB586 -- C:\Program Files\WindowsApps\Microsoft.BingWeather_1.7.0.26_x64__8wekyb3d8bbwe\common\js\services.js
    [2013/02/12 23:09:42 | 000,069,359 | ---- | M] () MD5=80CE8A6918A7BDB5328F93F4A3BB26B0 -- C:\Program Files\WindowsApps\Microsoft.BingSports_1.8.0.51_x64__8wekyb3d8bbwe\common\js\services.js

    < MD5 for: SERVICES.LNK >
    [2012/07/25 16:19:37 | 000,001,158 | ---- | M] () MD5=5C11B0E362D426FD6E99B07705BA4A48 -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
    [2012/07/25 16:19:37 | 000,001,158 | ---- | M] () MD5=5C11B0E362D426FD6E99B07705BA4A48 -- C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
    [2012/07/25 16:19:37 | 000,001,158 | ---- | M] () MD5=5C11B0E362D426FD6E99B07705BA4A48 -- C:\Windows.old\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
    [2012/07/25 16:19:37 | 000,001,158 | ---- | M] () MD5=5C11B0E362D426FD6E99B07705BA4A48 -- C:\Windows\WinSxS\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.2.9200.16384_none_282d8a08cf7f1ada\services.lnk

    < MD5 for: SERVICES.MOF >
    [2012/06/02 10:35:05 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\windows\SysNative\wbem\services.mof
    [2012/06/02 10:35:05 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\WinSxS\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.2.9200.16384_none_282967cc570d3701\services.mof

    < MD5 for: SERVICES.MSC >
    [2012/07/26 03:48:57 | 000,092,746 | ---- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 -- C:\windows\SysNative\en-US\services.msc
    [2012/06/02 10:31:20 | 000,092,746 | ---- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 -- C:\windows\SysNative\services.msc
    [2012/07/26 03:48:57 | 000,092,746 | ---- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 -- C:\Windows\SysWOW64\en-US\services.msc
    [2012/06/02 10:31:13 | 000,092,746 | ---- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 -- C:\Windows\SysWOW64\services.msc
    [2012/07/26 03:48:57 | 000,092,746 | ---- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 -- C:\Windows\WinSxS\amd64_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.2.9200.16384_en-us_fd08be678622fdab\services.msc
    [2012/06/02 10:31:20 | 000,092,746 | ---- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 -- C:\Windows\WinSxS\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.2.9200.16384_none_282d8a08cf7f1ada\services.msc
    [2012/06/02 10:31:13 | 000,092,746 | ---- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 -- C:\Windows\WinSxS\wow64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.2.9200.16384_none_3282345b03dfdcd5\services.msc
    [2012/07/26 03:48:57 | 000,092,746 | ---- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 -- C:\Windows\WinSxS\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.2.9200.16384_en-us_a0ea22e3cdc58c75\services.msc

    < MD5 for: SERVICES.PTXML >
    [2012/07/25 16:30:54 | 000,001,061 | ---- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 -- C:\windows\SysNative\wdi\perftrack\Services.ptxml
    [2012/07/25 16:30:54 | 000,001,061 | ---- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 -- C:\Windows\WinSxS\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.2.9200.16384_none_282967cc570d3701\Services.ptxml

    < MD5 for: SERVICES.SBS >
    [2013/07/16 13:21:30 | 000,034,818 | ---- | M] () MD5=E2ACBC77020C8D5CE97CA61D0D859A44 -- C:\Program Files (x86)\Spybot - Search & Destroy\Includes\Services.sbs

    < MD5 for: SERVICES.SINCLAIR.EDU443.IDX >
    [2013/05/18 14:55:58 | 000,000,650 | ---- | M] () MD5=6FFF8A46586EE18768B42E912C89FA02 -- C:\Users\jleem_000\AppData\Local\Opera\Opera\icons\services.sinclair.edu443.idx

    < MD5 for: WINLOGON.ADML >
    [2012/07/26 03:49:05 | 000,008,017 | ---- | M] () MD5=C270056255498A723E7331EFF1AA162F -- C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_6.2.9200.16384_en-us_edcdb8ec66a62fc0\WinLogon.adml

    < MD5 for: WINLOGON.ADMX >
    [2012/06/02 10:34:22 | 000,005,237 | ---- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C -- C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-adm_31bf3856ad364e35_6.2.9200.16384_none_d3d704270306719d\WinLogon.admx

    < MD5 for: WINLOGON.EXE >
    [2013/06/14 20:04:18 | 000,053,889 | ---- | M] () MD5=728D5E4736624F94E586846B61979CF3 -- C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.16384_none_c88ca87b5eb5b1ec\winlogon.exe
    [2013/06/14 20:04:20 | 000,001,620 | ---- | M] () MD5=898380B8CA3E563F034A58A1E6BEE16E -- C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.20534_none_c94c56c877aac328\winlogon.exe
    [2013/06/14 20:04:19 | 000,053,876 | ---- | M] () MD5=A6D817BB925C32311A2F8A7FEF8E3FC3 -- C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.16420_none_c8c988c15e88a211\winlogon.exe
    [2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
    [2013/06/14 20:04:20 | 000,053,884 | ---- | M] () MD5=B8705365DF550053894D57648060D8BB -- C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.20521_none_c95425d677a55b32\winlogon.exe
    [2012/10/11 01:46:58 | 000,517,120 | ---- | M] (Microsoft Corporation) MD5=BCF2036A0DD579E47C008C133550283E -- C:\windows\SysNative\winlogon.exe
    [2012/10/11 01:46:58 | 000,517,120 | ---- | M] (Microsoft Corporation) MD5=BCF2036A0DD579E47C008C133550283E -- C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.16433_none_c8c1b9b35e8e0a07\winlogon.exe

    < MD5 for: WINLOGON.EXE.MUI >
    [2012/07/26 03:48:51 | 000,024,064 | ---- | M] (Microsoft Corporation) MD5=B9094B7088CD579E5AED57A693F9BFBD -- C:\windows\SysNative\en-US\winlogon.exe.mui
    [2012/07/26 03:48:51 | 000,024,064 | ---- | M] (Microsoft Corporation) MD5=B9094B7088CD579E5AED57A693F9BFBD -- C:\Windows\WinSxS\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.2.9200.16384_en-us_23c238ef8ddaa831\winlogon.exe.mui

    < MD5 for: WINLOGON.EXE-0D9AB72B.PF >
    [2013/08/04 19:20:11 | 000,026,860 | ---- | M] () MD5=A28B55221DFAAF2FE5E5CAC441A4B648 -- C:\Windows\Prefetch\WINLOGON.EXE-0D9AB72B.pf

    < MD5 for: WINLOGON.MFL >
    [2012/07/26 03:48:52 | 000,001,080 | ---- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A -- C:\windows\SysNative\wbem\en-US\winlogon.mfl
    [2012/07/26 03:48:52 | 000,001,080 | ---- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A -- C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.2.9200.16384_en-us_81848abaa91301c6\winlogon.mfl

    < MD5 for: WINLOGON.MOF >
    [2012/07/25 16:30:16 | 000,003,192 | ---- | M] () MD5=DF722B96F32A61783BC310FACF10240B -- C:\windows\SysNative\wbem\winlogon.mof
    [2012/07/25 16:30:16 | 000,003,192 | ---- | M] () MD5=DF722B96F32A61783BC310FACF10240B -- C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.2.9200.16384_none_d9027134ffac135f\winlogon.mof

    < %SYSTEMDRIVE%\*.* >
    [2012/07/25 23:44:30 | 000,398,156 | RHS- | M] () -- C:\bootmgr
    [2012/06/02 10:30:55 | 000,000,001 | -HS- | M] () -- C:\BOOTNXT
    [2013/08/04 13:51:55 | 761,864,191 | -HS- | M] () -- C:\hiberfil.sys
    [2013/08/04 13:51:57 | 536,870,909 | -HS- | M] () -- C:\pagefile.sys
    [2013/08/04 13:51:57 | 268,435,456 | -HS- | M] () -- C:\swapfile.sys

    < %systemroot%\Fonts\*.com >
    [2012/08/01 06:06:37 | 000,026,040 | ---- | M] () -- C:\windows\Fonts\GlobalMonospace.CompositeFont
    [2012/08/01 06:06:37 | 000,026,489 | ---- | M] () -- C:\windows\Fonts\GlobalSansSerif.CompositeFont
    [2012/08/01 06:06:37 | 000,029,779 | ---- | M] () -- C:\windows\Fonts\GlobalSerif.CompositeFont
    [2012/08/01 06:06:37 | 000,043,318 | ---- | M] () -- C:\windows\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2012/07/26 04:11:41 | 000,000,065 | ---- | M] () -- C:\windows\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >
    [2012/07/28 05:54:00 | 000,321,472 | ---- | M] (Microsoft Corporation) -- C:\windows\WLXPGSS.SCR

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >
    [2012/07/26 04:11:35 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < dir "%systemdrive%\*" /S /A:L /C >
    Volume in drive C is TI10653400C
    Volume Serial Number is 4415-5794
    Directory of C:\
    07/26/2012 03:22 AM <JUNCTION> Documents and Settings [C:\Users]
    0 File(s) 0 bytes
    Directory of C:\ProgramData
    07/26/2012 03:22 AM <JUNCTION> Application Data [C:\ProgramData]
    07/26/2012 03:22 AM <JUNCTION> Desktop [C:\Users\Public\Desktop]
    07/26/2012 03:22 AM <JUNCTION> Documents [C:\Users\Public\Documents]
    07/26/2012 03:22 AM <JUNCTION> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
    07/26/2012 03:22 AM <JUNCTION> Templates [C:\ProgramData\Microsoft\Windows\Templates]
    0 File(s) 0 bytes
    Directory of C:\Users
    07/26/2012 03:22 AM <SYMLINKD> All Users [C:\ProgramData]
    07/26/2012 03:22 AM <JUNCTION> Default User [C:\Users\Default]
    0 File(s) 0 bytes
    Directory of C:\Users\Administrator
    09/03/2012 09:37 PM <JUNCTION> Application Data [C:\Users\Administrator\AppData\Roaming]
    09/03/2012 09:37 PM <JUNCTION> Cookies [C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies]
    09/03/2012 09:37 PM <JUNCTION> Local Settings [C:\Users\Administrator\AppData\Local]
    09/03/2012 09:37 PM <JUNCTION> My Documents [C:\Users\Administrator\Documents]
    09/03/2012 09:37 PM <JUNCTION> NetHood [C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
    09/03/2012 09:37 PM <JUNCTION> PrintHood [C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
    09/03/2012 09:37 PM <JUNCTION> Recent [C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent]
    09/03/2012 09:37 PM <JUNCTION> SendTo [C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\SendTo]
    09/03/2012 09:37 PM <JUNCTION> Start Menu [C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu]
    09/03/2012 09:37 PM <JUNCTION> Templates [C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates]
    0 File(s) 0 bytes
    Directory of C:\Users\Administrator\AppData\Local
    09/03/2012 09:37 PM <JUNCTION> Application Data [C:\Users\Administrator\AppData\Local]
    09/03/2012 09:37 PM <JUNCTION> History [C:\Users\Administrator\AppData\Local\Microsoft\Windows\History]
    09/03/2012 09:37 PM <JUNCTION> Temporary Internet Files [C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files]
    0 File(s) 0 bytes
    Directory of C:\Users\Administrator\Documents
    09/03/2012 09:37 PM <JUNCTION> My Music [C:\Users\Administrator\Music]
    09/03/2012 09:37 PM <JUNCTION> My Pictures [C:\Users\Administrator\Pictures]
    09/03/2012 09:37 PM <JUNCTION> My Videos [C:\Users\Administrator\Videos]
    0 File(s) 0 bytes
    Directory of C:\Users\All Users
    07/26/2012 03:22 AM <JUNCTION> Application Data [C:\ProgramData]
    07/26/2012 03:22 AM <JUNCTION> Desktop [C:\Users\Public\Desktop]
    07/26/2012 03:22 AM <JUNCTION> Documents [C:\Users\Public\Documents]
    07/26/2012 03:22 AM <JUNCTION> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
    07/26/2012 03:22 AM <JUNCTION> Templates [C:\ProgramData\Microsoft\Windows\Templates]
    0 File(s) 0 bytes
    Directory of C:\Users\Default
    07/26/2012 03:22 AM <JUNCTION> Application Data [C:\Users\Default\AppData\Roaming]
    07/26/2012 03:22 AM <JUNCTION> Cookies [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies]
    07/26/2012 03:22 AM <JUNCTION> Local Settings [C:\Users\Default\AppData\Local]
    07/26/2012 03:22 AM <JUNCTION> My Documents [C:\Users\Default\Documents]
    07/26/2012 03:22 AM <JUNCTION> NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
    07/26/2012 03:22 AM <JUNCTION> PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
    07/26/2012 03:22 AM <JUNCTION> Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]
    07/26/2012 03:22 AM <JUNCTION> SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]
    07/26/2012 03:22 AM <JUNCTION> Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]
    07/26/2012 03:22 AM <JUNCTION> Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]
    0 File(s) 0 bytes
    Directory of C:\Users\Default\AppData\Local
    07/26/2012 03:22 AM <JUNCTION> Application Data [C:\Users\Default\AppData\Local]
    07/26/2012 03:22 AM <JUNCTION> History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]
    07/26/2012 03:22 AM <JUNCTION> Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]
    0 File(s) 0 bytes
    Directory of C:\Users\Default\Documents
    07/26/2012 03:22 AM <JUNCTION> My Music [C:\Users\Default\Music]
    07/26/2012 03:22 AM <JUNCTION> My Pictures [C:\Users\Default\Pictures]
    07/26/2012 03:22 AM <JUNCTION> My Videos [C:\Users\Default\Videos]
    0 File(s) 0 bytes
    Directory of C:\Users\jleem_000
    03/25/2013 01:19 PM <JUNCTION> Application Data [C:\Users\jleem_000\AppData\Roaming]
    03/25/2013 01:19 PM <JUNCTION> Cookies [C:\Users\jleem_000\AppData\Roaming\Microsoft\Windows\Cookies]
    03/25/2013 01:19 PM <JUNCTION> Local Settings [C:\Users\jleem_000\AppData\Local]
    03/25/2013 01:19 PM <JUNCTION> My Documents [C:\Users\jleem_000\Documents]
    03/25/2013 01:19 PM <JUNCTION> NetHood [C:\Users\jleem_000\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
    03/25/2013 01:19 PM <JUNCTION> PrintHood [C:\Users\jleem_000\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
    03/25/2013 01:19 PM <JUNCTION> Recent [C:\Users\jleem_000\AppData\Roaming\Microsoft\Windows\Recent]
    03/25/2013 01:19 PM <JUNCTION> SendTo [C:\Users\jleem_000\AppData\Roaming\Microsoft\Windows\SendTo]
    03/25/2013 01:19 PM <JUNCTION> Start Menu [C:\Users\jleem_000\AppData\Roaming\Microsoft\Windows\Start Menu]
    03/25/2013 01:19 PM <JUNCTION> Templates [C:\Users\jleem_000\AppData\Roaming\Microsoft\Windows\Templates]
    0 File(s) 0 bytes
    Directory of C:\Users\jleem_000\AppData\Local
    03/25/2013 01:19 PM <JUNCTION> Application Data [C:\Users\jleem_000\AppData\Local]
    03/25/2013 01:19 PM <JUNCTION> History [C:\Users\jleem_000\AppData\Local\Microsoft\Windows\History]
    03/25/2013 01:19 PM <JUNCTION> Temporary Internet Files [C:\Users\jleem_000\AppData\Local\Microsoft\Windows\Temporary Internet Files]
    0 File(s) 0 bytes
    Directory of C:\Users\jleem_000\Documents
    03/25/2013 01:19 PM <JUNCTION> My Music [C:\Users\jleem_000\Music]
    03/25/2013 01:19 PM <JUNCTION> My Pictures [C:\Users\jleem_000\Pictures]
    03/25/2013 01:19 PM <JUNCTION> My Videos [C:\Users\jleem_000\Videos]
    0 File(s) 0 bytes
    Directory of C:\Users\Public\Documents
    07/26/2012 03:22 AM <JUNCTION> My Music [C:\Users\Public\Music]
    07/26/2012 03:22 AM <JUNCTION> My Pictures [C:\Users\Public\Pictures]
    07/26/2012 03:22 AM <JUNCTION> My Videos [C:\Users\Public\Videos]
    0 File(s) 0 bytes
    Directory of C:\Users\scofi_000
    03/05/2013 06:43 PM <JUNCTION> Application Data [C:\Users\scofi_000\AppData\Roaming]
    03/05/2013 06:43 PM <JUNCTION> Cookies [C:\Users\scofi_000\AppData\Roaming\Microsoft\Windows\Cookies]
    03/05/2013 06:43 PM <JUNCTION> Local Settings [C:\Users\scofi_000\AppData\Local]
    03/05/2013 06:43 PM <JUNCTION> My Documents [C:\Users\scofi_000\Documents]
    03/05/2013 06:43 PM <JUNCTION> NetHood [C:\Users\scofi_000\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
    03/05/2013 06:43 PM <JUNCTION> PrintHood [C:\Users\scofi_000\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
    03/05/2013 06:43 PM <JUNCTION> Recent [C:\Users\scofi_000\AppData\Roaming\Microsoft\Windows\Recent]
    03/05/2013 06:43 PM <JUNCTION> SendTo [C:\Users\scofi_000\AppData\Roaming\Microsoft\Windows\SendTo]
    03/05/2013 06:43 PM <JUNCTION> Start Menu [C:\Users\scofi_000\AppData\Roaming\Microsoft\Windows\Start Menu]
    03/05/2013 06:43 PM <JUNCTION> Templates [C:\Users\scofi_000\AppData\Roaming\Microsoft\Windows\Templates]
    0 File(s) 0 bytes
    Directory of C:\Users\scofi_000\AppData\Local
    03/05/2013 06:43 PM <JUNCTION> Application Data [C:\Users\scofi_000\AppData\Local]
    03/05/2013 06:43 PM <JUNCTION> History [C:\Users\scofi_000\AppData\Local\Microsoft\Windows\History]
    03/05/2013 06:43 PM <JUNCTION> Temporary Internet Files [C:\Users\scofi_000\AppData\Local\Microsoft\Windows\Temporary Internet Files]
    0 File(s) 0 bytes
    Directory of C:\Users\scofi_000\Documents
    03/05/2013 06:43 PM <JUNCTION> My Music [C:\Users\scofi_000\Music]
    03/05/2013 06:43 PM <JUNCTION> My Pictures [C:\Users\scofi_000\Pictures]
    03/05/2013 06:43 PM <JUNCTION> My Videos [C:\Users\scofi_000\Videos]
    0 File(s) 0 bytes
    Directory of C:\Windows.old\Users
    07/26/2012 03:22 AM <SYMLINKD> All Users [C:\ProgramData]
    07/26/2012 03:22 AM <JUNCTION> Default User [C:\Users\Default]
    0 File(s) 0 bytes
    Directory of C:\Windows.old\Users\All Users
    07/26/2012 03:22 AM <JUNCTION> Application Data [C:\ProgramData]
    07/26/2012 03:22 AM <JUNCTION> Desktop [C:\Users\Public\Desktop]
    07/26/2012 03:22 AM <JUNCTION> Documents [C:\Users\Public\Documents]
    07/26/2012 03:22 AM <JUNCTION> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
    07/26/2012 03:22 AM <JUNCTION> Templates [C:\ProgramData\Microsoft\Windows\Templates]
    0 File(s) 0 bytes
    Directory of C:\Windows.old\Users\Default
    07/26/2012 03:22 AM <JUNCTION> Application Data [C:\Users\Default\AppData\Roaming]
    07/26/2012 03:22 AM <JUNCTION> Cookies [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies]
    07/26/2012 03:22 AM <JUNCTION> Local Settings [C:\Users\Default\AppData\Local]
    07/26/2012 03:22 AM <JUNCTION> My Documents [C:\Users\Default\Documents]
    07/26/2012 03:22 AM <JUNCTION> NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
    07/26/2012 03:22 AM <JUNCTION> PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
    07/26/2012 03:22 AM <JUNCTION> Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]
    07/26/2012 03:22 AM <JUNCTION> SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]
    07/26/2012 03:22 AM <JUNCTION> Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]
    07/26/2012 03:22 AM <JUNCTION> Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]
    0 File(s) 0 bytes
    Directory of C:\Windows.old\Users\Default\AppData\Local
    07/26/2012 03:22 AM <JUNCTION> Application Data [C:\Users\Default\AppData\Local]
    07/26/2012 03:22 AM <JUNCTION> History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]
    07/26/2012 03:22 AM <JUNCTION> Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]
    0 File(s) 0 bytes
    Directory of C:\Windows.old\Users\Default\Documents
    07/26/2012 03:22 AM <JUNCTION> My Music [C:\Users\Default\Music]
    07/26/2012 03:22 AM <JUNCTION> My Pictures [C:\Users\Default\Pictures]
    07/26/2012 03:22 AM <JUNCTION> My Videos [C:\Users\Default\Videos]
    0 File(s) 0 bytes
    Directory of C:\Windows.old\Users\Public\Documents
    07/26/2012 03:22 AM <JUNCTION> My Music [C:\Users\Public\Music]
    07/26/2012 03:22 AM <JUNCTION> My Pictures [C:\Users\Public\Pictures]
    07/26/2012 03:22 AM <JUNCTION> My Videos [C:\Users\Public\Videos]
    0 File(s) 0 bytes
    Directory of C:\Windows.old\Users\scofi_000
    02/12/2013 08:45 PM <JUNCTION> Application Data [C:\Users\scofi_000\AppData\Roaming]
    02/12/2013 08:45 PM <JUNCTION> Cookies [C:\Users\scofi_000\AppData\Roaming\Microsoft\Windows\Cookies]
    02/12/2013 08:45 PM <JUNCTION> Local Settings [C:\Users\scofi_000\AppData\Local]
    02/12/2013 08:45 PM <JUNCTION> My Documents [C:\Users\scofi_000\Documents]
    02/12/2013 08:45 PM <JUNCTION> NetHood [C:\Users\scofi_000\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
    02/12/2013 08:45 PM <JUNCTION> PrintHood [C:\Users\scofi_000\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
    02/12/2013 08:45 PM <JUNCTION> Recent [C:\Users\scofi_000\AppData\Roaming\Microsoft\Windows\Recent]
    02/12/2013 08:45 PM <JUNCTION> SendTo [C:\Users\scofi_000\AppData\Roaming\Microsoft\Windows\SendTo]
    02/12/2013 08:45 PM <JUNCTION> Start Menu [C:\Users\scofi_000\AppData\Roaming\Microsoft\Windows\Start Menu]
    02/12/2013 08:45 PM <JUNCTION> Templates [C:\Users\scofi_000\AppData\Roaming\Microsoft\Windows\Templates]
    0 File(s) 0 bytes
    Directory of C:\Windows.old\Users\scofi_000\AppData\Local
    02/12/2013 08:45 PM <JUNCTION> Application Data [C:\Users\scofi_000\AppData\Local]
    02/12/2013 08:45 PM <JUNCTION> History [C:\Users\scofi_000\AppData\Local\Microsoft\Windows\History]
    02/12/2013 08:45 PM <JUNCTION> Temporary Internet Files [C:\Users\scofi_000\AppData\Local\Microsoft\Windows\Temporary Internet Files]
    0 File(s) 0 bytes
    Directory of C:\Windows.old\Users\scofi_000\Documents
    02/12/2013 08:45 PM <JUNCTION> My Music [C:\Users\scofi_000\Music]
    02/12/2013 08:45 PM <JUNCTION> My Pictures [C:\Users\scofi_000\Pictures]
    02/12/2013 08:45 PM <JUNCTION> My Videos [C:\Users\scofi_000\Videos]
    0 File(s) 0 bytes
    Total Files Listed:
    0 File(s) 0 bytes
    122 Dir(s) 560,289,067,008 bytes free

    < %systemroot%\System32\config\*.sav >

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2013/03/05 18:52:29 | 000,000,223 | -HS- | M] () -- C:\Users\scofi_000\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

    < %USERPROFILE%\Desktop\*.exe >
    [2013/06/22 20:31:19 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Users\scofi_000\Desktop\aswMBR.exe
    [2013/06/22 20:12:36 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Users\scofi_000\Desktop\erunt-setup.exe
    [2013/07/05 21:46:52 | 014,391,552 | ---- | M] (PortableApps.com) -- C:\Users\scofi_000\Desktop\Java_Portable_6_Update_21_online.paf.exe
    [2013/08/08 21:56:31 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\scofi_000\Desktop\OTL.exe
    [2013/08/08 21:36:39 | 000,891,115 | ---- | M] () -- C:\Users\scofi_000\Desktop\SecurityCheck.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

    ========== Base Services ==========
    SRV:64bit: - [2012/09/20 02:30:35 | 000,190,976 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\aelupsvc.dll -- (AeLookupSvc)
    SRV:64bit: - [2013/03/06 02:29:15 | 000,070,144 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\appinfo.dll -- (Appinfo)
    SRV:64bit: - [2012/07/25 23:08:16 | 000,094,208 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\alg.exe -- (ALG)
    SRV:64bit: - [2012/07/25 23:07:01 | 000,826,368 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\qmgr.dll -- (BITS)
    SRV:64bit: - [2012/11/27 00:17:32 | 000,718,848 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\BFE.DLL -- (BFE)
    SRV:64bit: - [2012/07/25 23:05:55 | 000,059,904 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\keyiso.dll -- (KeyIso)
    SRV - [2012/07/25 23:18:47 | 000,043,520 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\keyiso.dll -- (KeyIso)
    SRV:64bit: - [2012/07/25 23:05:36 | 000,507,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\es.dll -- (EventSystem)
    SRV - [2012/07/25 23:18:26 | 000,394,240 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\es.dll -- (EventSystem)
    SRV:64bit: - [2012/07/25 23:05:12 | 000,134,144 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\browser.dll -- (Browser)
    SRV:64bit: - [2013/04/23 18:55:48 | 000,068,096 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\cryptsvc.dll -- (CryptSvc)
    SRV:64bit: - [2012/07/25 23:07:06 | 000,817,152 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (DcomLaunch)
    SRV:64bit: - [2012/10/11 01:43:40 | 000,331,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dhcpcore.dll -- (Dhcp)
    SRV - [2012/10/11 01:06:02 | 000,270,336 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\dhcpcore.dll -- (Dhcp)
    SRV:64bit: - [2012/09/20 02:31:07 | 000,210,432 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dnsrslvr.dll -- (Dnscache)
    SRV:64bit: - [2012/07/25 23:05:34 | 000,105,472 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\eapsvc.dll -- (Eaphost)
    SRV:64bit: - [2012/07/25 23:05:46 | 000,036,352 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\hidserv.dll -- (hidserv)
    SRV - [2012/07/25 23:18:34 | 000,049,152 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\hidserv.dll -- (hidserv)
    SRV:64bit: - [2012/07/25 23:05:51 | 000,438,784 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\ipnathlp.dll -- (SharedAccess)
    SRV:64bit: - [2012/07/25 23:05:51 | 000,474,624 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\IPSECSVC.DLL -- (PolicyAgent)
    No service found with a name of MsMpSvc
    No service found with a name of NisSrv
    SRV:64bit: - [2012/07/25 23:07:25 | 000,502,784 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\swprv.dll -- (swprv)
    SRV:64bit: - [2012/09/20 02:31:57 | 000,080,896 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\mmcss.dll -- (MMCSS)
    SRV:64bit: - [2012/07/25 23:06:34 | 000,255,488 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netman.dll -- (Netman)
    SRV:64bit: - [2013/05/04 02:58:02 | 000,470,528 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofmsvc.dll -- (netprofm)
    SRV:64bit: - [2012/09/20 02:32:17 | 000,356,352 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\nlasvc.dll -- (NlaSvc)
    SRV:64bit: - [2012/07/26 01:26:47 | 000,025,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\nsisvc.dll -- (nsi)
    SRV:64bit: - [2012/09/20 02:33:04 | 000,107,008 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\umpnpmgr.dll -- (PlugPlay)
    SRV:64bit: - [2012/07/25 23:08:47 | 000,769,024 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\spoolsv.exe -- (Spooler)
    No service found with a name of ProtectedStorage
    No service found with a name of EMDMgmt
    SRV:64bit: - [2012/07/25 23:07:03 | 000,099,840 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\rasauto.dll -- (RasAuto)
    SRV:64bit: - [2012/07/25 23:07:03 | 000,358,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\rasmans.dll -- (RasMan)
    SRV:64bit: - [2012/07/25 23:07:06 | 000,817,152 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (RpcSs)
    SRV:64bit: - [2012/07/25 23:07:09 | 000,030,720 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\seclogon.dll -- (seclogon)
    SRV:64bit: - [2012/09/20 02:33:39 | 000,035,840 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsass.exe -- (SamSs)
    SRV:64bit: - [2013/04/09 00:51:41 | 000,099,840 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wscsvc.dll -- (wscsvc)
    SRV:64bit: - [2012/07/25 23:07:23 | 000,309,248 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\srvsvc.dll -- (LanmanServer)
    SRV:64bit: - [2012/07/25 23:07:16 | 000,565,760 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\shsvcs.dll -- (ShellHWDetection)
    SRV - [2012/07/25 23:19:59 | 000,506,368 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\shsvcs.dll -- (ShellHWDetection)
    No service found with a name of slsvc
    SRV:64bit: - [2013/04/09 00:50:39 | 001,285,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\schedsvc.dll -- (Schedule)
    SRV:64bit: - [2012/07/25 23:07:28 | 000,305,664 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\tapisrv.dll -- (TapiSrv)
    SRV - [2012/07/25 23:20:06 | 000,245,760 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\tapisrv.dll -- (TapiSrv)
    SRV:64bit: - [2012/07/25 23:07:30 | 000,047,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\themeservice.dll -- (Themes)
    SRV:64bit: - [2012/07/25 23:07:00 | 000,209,920 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\profsvc.dll -- (ProfSvc)
    SRV:64bit: - [2013/05/04 02:59:51 | 001,483,776 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\VSSVC.exe -- (VSS)
    SRV:64bit: - [2013/06/01 05:19:42 | 000,785,408 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\audiosrv.dll -- (Audiosrv)
    SRV:64bit: - [2013/04/09 00:48:42 | 000,169,472 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\AudioEndpointBuilder.dll -- (AudioEndpointBuilder)
    SRV:64bit: - [2012/07/25 23:07:08 | 000,148,480 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\sdrsvc.dll -- (SDRSVC)
    SRV:64bit: - [2013/01/28 21:57:14 | 000,014,920 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)
    SRV:64bit: - [2012/07/25 23:07:47 | 001,731,584 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wevtsvc.dll -- (EventLog)
    SRV:64bit: - [2012/10/11 01:44:35 | 000,904,192 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\MPSSVC.dll -- (MpsSvc)
    SRV:64bit: - [2012/07/25 23:07:47 | 000,570,880 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wiaservc.dll -- (stisvc)
    SRV:64bit: - [2012/07/25 23:08:34 | 000,124,416 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\windows\SysNative\msiexec.exe -- (msiserver)
    SRV - [2012/07/25 23:20:50 | 000,062,976 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\windows\SysWow64\msiexec.exe -- (msiserver)
    SRV:64bit: - [2012/07/25 23:08:06 | 000,219,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wbem\WMIsvc.dll -- (Winmgmt)
    SRV:64bit: - [2013/05/04 02:59:24 | 003,241,472 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wuaueng.dll -- (wuauserv)
    SRV:64bit: - [2012/07/25 23:05:31 | 000,252,928 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\dot3svc.dll -- (dot3svc)
    SRV:64bit: - [2012/11/06 00:19:59 | 001,386,496 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wlansvc.dll -- (WlanSvc)
    SRV:64bit: - [2012/07/25 23:08:02 | 000,191,488 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wkssvc.dll -- (LanmanWorkstation)

    ========== Drive Information ==========

    Physical Drives
    ---------------

    Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
    Interface type: IDE
    Media Type: Fixed hard disk media
    Model: TOSHIBA MK6475GSX
    Partitions: 4
    Status: OK
    Status Info: 0

    Partitions
    ---------------

    DeviceID: Disk #0, Partition #0
    PartitionType: GPT: Unknown
    Bootable: False
    BootPartition: False
    PrimaryPartition: False
    Size: 450.00MB
    Starting Offset: 1048576
    Hidden sectors: 0


    DeviceID: Disk #0, Partition #1
    PartitionType: GPT: System
    Bootable: True
    BootPartition: True
    PrimaryPartition: True
    Size: 260.00MB
    Starting Offset: 472907776
    Hidden sectors: 0


    DeviceID: Disk #0, Partition #2
    PartitionType: GPT: Basic Data
    Bootable: False
    BootPartition: False
    PrimaryPartition: True
    Size: 586.00GB
    Starting Offset: 879755264
    Hidden sectors: 0


    DeviceID: Disk #0, Partition #3
    PartitionType: GPT: Unknown
    Bootable: False
    BootPartition: False
    PrimaryPartition: False
    Size: 9.00GB
    Starting Offset: 630152232960
    Hidden sectors: 0


    < End of report >

  7. #7
    Member
    Join Date
    Apr 2006
    Posts
    69

    Default

    OTL Extras logfile created on: 8/8/2013 9:57:50 PM - Run 1
    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\scofi_000\Desktop
    64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
    Internet Explorer (Version = 9.10.9200.16635)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    5.89 Gb Total Physical Memory | 4.02 Gb Available Physical Memory | 68.30% Memory free
    18.39 Gb Paging File | 16.40 Gb Available in Paging File | 89.18% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 586.06 Gb Total Space | 522.01 Gb Free Space | 89.07% Space Free | Partition Type: NTFS

    Computer Name: SHERLOCK | User Name: scofi_000 | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
    .url[@ = InternetShortcut] -- C:\windows\SysNative\rundll32.exe (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation)
    .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

    [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
    .html [@ = ChromeHTML] -- Reg Error: Key error. File not found

    ========== Shell Spawning ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
    InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
    InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

    ========== Security Center Settings ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "VistaSp1" = CE 37 E6 AF FF 6A CD 01 [binary data]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0

    ========== Authorized Applications List ==========


    ========== Vista Active Open Ports Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{4CD1F394-2E18-4C02-A76B-9AC169FA0D50}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe |
    "{C0DAEA4B-3980-4122-A680-3676149F260E}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
    "{D735D71A-BF7C-4585-AD10-C13C9F5702D3}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |

    ========== Vista Active Application Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{01C85B82-0B54-4B66-99C3-62C01B536B79}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
    "{02111CEB-AF18-4768-BC44-C9EB3F951096}" = dir=out | name=windows_ie_ac_001 |
    "{035E4545-3624-48CD-AAE4-260C42CE1226}" = protocol=6 | dir=in | app=c:\windows\syswow64\arfc\wrtc.exe |
    "{045B263F-08E2-46A6-99DF-445BE86A4ABE}" = dir=out | name=@{microsoft.bingweather_1.7.0.26_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/apptitle} |
    "{05D76E5D-9398-416A-B729-EDE38A1537C4}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
    "{080A5BB8-6CB0-46C4-94B5-66D983DBAD4D}" = dir=in | name=@{microsoft.skypeapp_1.3.0.112_x86__kzf8qxf38zg5c?ms-resource://microsoft.skypeapp/resources/manifest_display_name} |
    "{08CC3E5D-56FA-4314-88D9-A0447D5358BF}" = dir=in | app=c:\program files (x86)\time warner cable\twc wifi\twc wifi.exe |
    "{0B0642F9-427A-4789-BF65-6FC6E10FB071}" = dir=out | name=@{44352gadgetwe.unitconversion_1.0.1.4_neutral__wrnqd43hr7tc6?ms-resource://44352gadgetwe.unitconversion/resources/appstorename} |
    "{0DB8AC84-76BA-4D3E-B895-AB2267708A23}" = dir=out | name=@{microsoft.bingmaps_1.5.1.240_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingmaps/resources/appdisplayname} |
    "{0E413966-E498-476B-A7F1-F392534C19D1}" = dir=out | name=@{microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
    "{10847F2B-A57D-4B6B-A185-2AD093EA62CD}" = dir=out | name=norton studio |
    "{1317C480-88A8-48C5-93B6-5CBA10B81F1C}" = dir=out | name=iheartradio |
    "{189962E1-BD3F-4EDE-BEAD-B06E822085EC}" = dir=out | name=@{microsoft.bing_1.5.1.259_x64__8wekyb3d8bbwe?ms-resource://microsoft.bing/resources/app_name} |
    "{1B851272-C5F4-4CE2-BE17-EF52053CEF01}" = protocol=17 | dir=in | app=c:\windows\syswow64\arfc\wrtc.exe |
    "{1F001211-B99F-4081-84AE-494C32D5D7F0}" = dir=out | name=@{microsoft.bingweather_1.7.0.26_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/apptitle} |
    "{1FAC1527-AE30-4BBD-8B35-8E963956657B}" = dir=in | name=@{microsoft.xboxcompanion_1.1.134.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxcompanion/resources/33279} |
    "{21C7F422-D458-4EA3-8DC1-DFD5A21DD1D3}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe |
    "{227C3ED7-EE10-47E8-ACAE-4032EE8385F6}" = dir=out | name=@{microsoft.bingmaps_1.2.0.136_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingmaps/resources/appdisplayname} |
    "{25DF386C-F7E8-48A7-9DD9-C7F46E36953B}" = dir=out | name=@{microsoft.xboxlivegames_1.1.134.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxlivegames/resources/34150} |
    "{28205C5D-86AB-450B-8DCA-B36BA848059C}" = dir=out | name=@{microsoft.bingfinance_1.7.0.38_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingfinance/resources/apptitle} |
    "{2AFBCF0D-C99A-4AC9-928D-525FC88C5F38}" = dir=out | name=@{microsoft.reader_6.2.8516.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |
    "{2B791D68-34BD-4518-9703-FBDBB89DEF75}" = dir=out | name=iheartradio |
    "{2F2F82B6-4EC6-4BE1-8FF5-967B30E4ECFA}" = dir=out | name=netflix |
    "{32D2CABF-E5EB-4E1E-871D-F7908E8E2F27}" = dir=out | name=@{microsoft.bingtravel_1.7.0.26_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingtravel/resources/apptitle} |
    "{336A16D5-1CCB-435E-BC6B-429D98F76B53}" = dir=out | name=@{microsoft.zunemusic_1.1.144.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/resources/33273} |
    "{34B3279B-C737-4509-BA55-6B122A629A19}" = dir=out | name=- games app - |
    "{3A229A5D-4A20-483A-A099-FFFD1F698694}" = dir=out | name=@{microsoft.microsoftskydrive_16.4.4204.712_x64__8wekyb3d8bbwe?ms-resource://microsoft.microsoftskydrive/resources/shortproductname} |
    "{3A8E1AAC-F9B9-4C47-ACEA-7F888F56D6B4}" = protocol=17 | dir=in | app=c:\program files (x86)\lphant applications\lphant\lphant.exe |
    "{3B179949-829D-4567-AA7A-AB10D5982192}" = dir=out | name=@{microsoft.bingsports_1.8.0.51_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingsports/resources/bingsports} |
    "{3D42D195-84CC-4C97-B1D6-3E33BD982AAA}" = dir=in | name=@{microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
    "{43B14E54-6349-4361-A52B-96E843CC9A58}" = dir=out | name=@{microsoft.bing_1.2.0.137_x64__8wekyb3d8bbwe?ms-resource://microsoft.bing/resources/app_name} |
    "{4A087C25-F18E-4E92-92BB-21C9E4BA1563}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
    "{52409E24-C8C2-4495-A224-487B2407082C}" = dir=in | name=@{microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
    "{52EE1415-B841-4FB3-B0E6-B5481C665466}" = dir=out | name=news place |
    "{55A9CE24-FE9F-4188-9A33-CF78B99FA0F8}" = dir=out | name=- games app - |
    "{56EC0FFA-E043-4ACA-89BB-15C7A9DBA052}" = dir=out | name=merriam-webster dictionary |
    "{5AB2F712-D96E-47D6-99A1-26B7DEE7AE0B}" = dir=out | name=@{microsoft.zunemusic_1.0.927.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/resources/33273} |
    "{5CA45D3F-A4E5-4585-B0FA-BDB118B022CD}" = dir=in | name=@{microsoft.bing_1.2.0.137_x64__8wekyb3d8bbwe?ms-resource://microsoft.bing/resources/app_name} |
    "{5D4F2C2F-70FD-426C-9835-A6A34ED0901C}" = dir=out | name=any3 filesharing |
    "{5D901DC5-6747-40B5-8E29-B506B1C9536F}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
    "{5DE8B357-3200-42C0-8954-6371240F3948}" = dir=out | name=vimeo |
    "{605C02C5-21F2-4D97-AFA6-D881F9F41859}" = dir=out | name=kindle |
    "{614C0DDD-2E57-4F11-86D0-FB8CA4A7B91C}" = dir=out | name=@{microsoft.bingnews_1.2.0.135_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingnews/resources/news} |
    "{62B3AD47-6E0A-4875-87FC-E2EAE93235BC}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
    "{6301CB4E-E09A-4108-97B4-31BEFB9F77EB}" = dir=out | name=@{microsoft.skypeapp_1.3.0.112_x86__kzf8qxf38zg5c?ms-resource://microsoft.skypeapp/resources/manifest_display_name} |
    "{649FFFF9-1089-4DF8-B2B8-9E9B421FE0D9}" = dir=out | name=@{microsoft.xboxcompanion_1.1.134.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxcompanion/resources/33279} |
    "{64A4EBAF-500C-4A92-A406-8240E812CAD6}" = dir=out | name=merriam-webster dictionary |
    "{66A19E63-6049-4ED0-A2EA-836C44F6A21B}" = dir=in | name=toshiba media player by smedio truelink+ |
    "{68221484-4DB3-40A7-B023-2C598D67AFD8}" = dir=out | name=amazon |
    "{696A5BA3-1E44-4679-8055-71D5674A1E10}" = dir=in | name=@{microsoft.xboxcompanion_1.1.134.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxcompanion/resources/33279} |
    "{6CD9FAD4-E703-468C-93C2-36D5EE62B0C7}" = dir=out | name=norton studio |
    "{74FC8CB1-EB23-4606-9D53-13742CA04EE4}" = dir=out | name=@{microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
    "{7943ABB5-2319-493B-866F-608A2C6D3531}" = dir=in | name=toshiba media player by smedio truelink+ |
    "{7C28B327-E7EA-47A2-9C33-33D2AE4919C7}" = dir=out | name=toshiba central |
    "{7CC21485-FA80-4C57-A48C-7FBCBCED7AAF}" = dir=out | name=@{microsoft.bingnews_1.7.0.38_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingnews/resources/news} |
    "{808F1451-4108-46FD-ADBB-F17324B5F0BD}" = dir=out | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
    "{80ADA86C-AE2B-491F-8C4C-5544C38F5522}" = dir=out | name=encyclopaedia britannica |
    "{81B318FB-A0E8-4127-B345-B5587722DC4C}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
    "{8478DEA6-42F2-4D53-9EBD-87EF16151159}" = protocol=17 | dir=in | app=c:\program files (x86)\lphant applications\mediabar\datamngr\srtool~1\dtuser.exe |
    "{8A6A8023-FC88-40DB-A22B-9D74A19381EE}" = dir=in | name=@{microsoft.reader_6.2.8516.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |
    "{8BAFF3CC-4FF8-4835-B210-CC3693F72E6E}" = protocol=6 | dir=in | app=c:\program files (x86)\lphant applications\mediabar\datamngr\srtool~1\dtuser.exe |
    "{8D3D62DC-CEB2-42B3-AD96-ACC83AFE2EC9}" = protocol=6 | dir=in | app=c:\program files (x86)\lphant applications\lphant\lphant.exe |
    "{8D7CBD4F-887D-4492-8C3B-DBE0A38AED02}" = dir=out | name=@{microsoft.zunevideo_1.0.927.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/33270} |
    "{9335158D-CDCC-428A-A68D-E400C7605A76}" = dir=out | name=news place |
    "{942710AB-B365-4FFD-BA76-B3EED6BF71B6}" = dir=out | name=netflix |
    "{94C3805B-536A-4899-B86B-37E34876092D}" = protocol=17 | dir=in | app=c:\program files (x86)\lphant applications\lphant\lphant.exe |
    "{982FC14B-297D-4739-8F3D-7CBFB7CF47C9}" = dir=out | name=amazon for windows |
    "{98D8575F-D8C0-4A60-8999-46352C2E4563}" = protocol=6 | dir=in | app=c:\program files (x86)\time warner cable\twc wifi\twc wifi.exe |
    "{99BADCE3-6DBF-4383-BA0A-CBEA7F7ED183}" = dir=in | name=ebay |
    "{9AC08141-B31B-423D-91BB-B8214A62904D}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe |
    "{9DD901DE-2209-414D-B26B-49FBED8A423F}" = dir=in | name=@{microsoft.windowsphotos_16.4.4204.712_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
    "{9EFFE149-D0B3-463B-A11D-C512C8694DAC}" = dir=out | name=vimeo |
    "{A030489D-6243-4AEF-B32D-532FAF7A6F6B}" = dir=out | name=@{microsoft.xboxlivegames_1.0.927.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxlivegames/resources/34150} |
    "{A0FCAB8B-2F0F-485D-8553-1AD5593D340C}" = dir=out | name=@{microsoft.zunevideo_1.1.134.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/33270} |
    "{A30BC125-5235-4F68-8B40-FCF3B1EEDD71}" = protocol=6 | dir=in | app=c:\program files (x86)\lphant applications\lphant\lphant.exe |
    "{A464B0D1-361D-4428-BCC8-B1DB5B5033BC}" = dir=out | name=toshiba central |
    "{A5095A7B-8CDF-4245-9A20-45DAA4E82ED9}" = dir=out | name=encyclopaedia britannica |
    "{AA1AB04A-85EF-472F-9682-588A91562FD6}" = dir=in | name=@{microsoft.windowsphotos_16.4.4388.928_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
    "{AAC923AA-DBB5-43CB-88A5-D75A540E384E}" = dir=out | name=@{microsoft.windowsphotos_16.4.4204.712_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
    "{AE776C1F-FB84-4264-AFB4-6249A7B8171B}" = dir=in | name=any3 filesharing |
    "{AF88AD97-08A8-4EE6-A6EB-267EBCAC6C73}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
    "{B04B3FC7-F84F-49E0-ABF3-6BFD43B525D1}" = dir=out | name=icookbook se |
    "{B13C748B-2446-4AFD-A916-91C3CE2ACBB3}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
    "{B314EE11-E9EF-4F5F-8DC4-9305A041E480}" = dir=in | name=@{microsoft.reader_6.2.9200.20523_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |
    "{B5CB853D-75D2-494A-BCBD-B51568D89FF3}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
    "{B9DDC996-0B17-48AE-9BAC-63F05185E227}" = dir=out | name=toshiba media player by smedio truelink+ |
    "{BB1716B1-31A1-4CBA-8B3A-80A9E1A9FD94}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
    "{BCE624F1-E6A2-42D3-905A-EFFC23CFD952}" = dir=in | name=amazon for windows |
    "{BCFF849F-DD7B-4F27-A3F5-B285A004B3AE}" = dir=out | name=@{microsoft.reader_6.2.9200.20523_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |
    "{C03EEC7C-8328-4C8D-8B43-9B70BCF7FE42}" = dir=out | name=toshiba media player by smedio truelink+ |
    "{C2847DA1-37E3-4671-AD1D-3A988226E796}" = dir=out | name=@{microsoft.microsoftskydrive_16.4.4388.928_x64__8wekyb3d8bbwe?ms-resource://microsoft.microsoftskydrive/resources/shortproductname} |
    "{C388610B-F0F4-4B7C-BCD7-66F80F921479}" = dir=out | name=stumbleupon |
    "{C42E9145-01C5-4782-85B8-7B6F4E3EFF25}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{C70A2849-887D-451C-B751-DFCE40765B67}" = dir=out | name=book place |
    "{CAEA0F09-0FA7-4AE4-9476-207F5B6E87FC}" = dir=out | name=@{microsoft.bingtravel_1.2.0.145_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingtravel/resources/apptitle} |
    "{D0BB690A-CAE6-45BE-9694-21ECB09A63AF}" = protocol=17 | dir=in | app=c:\program files (x86)\time warner cable\twc wifi\twc wifi.exe |
    "{D29A8912-17BB-47CF-BBC6-B2F9B642AF63}" = dir=in | name=ebay |
    "{D4C9D475-547E-4D59-87C0-1D75C86A22BC}" = dir=out | name=book place |
    "{D5222CC1-384E-4ED1-BF3F-BB2E91840578}" = dir=out | name=stumbleupon |
    "{DBB5C8D3-CAA1-4939-AEF1-E75E8FA620FD}" = protocol=6 | dir=in | app=c:\program files (x86)\time warner cable\twc wifi\twc wifi.exe |
    "{DD2BB1A3-F036-4567-9155-4DFD3EA29D49}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
    "{E3B51649-1367-47FA-9746-D59869277A17}" = dir=out | name=windows 8 cheat keys |
    "{E5618CE0-BEB4-48F7-AEB1-6283885B93D7}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{E7985E1D-C36F-4787-80A8-6350D07E9266}" = dir=in | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
    "{E90C9740-A349-4A29-B395-E73EC1C3C260}" = dir=out | name=ebay |
    "{ED128452-C7A4-4FD4-BBC5-43D95574486F}" = dir=out | name=icookbook se |
    "{EE3BCA83-04AA-4C1A-8BAC-50F8F414B559}" = dir=out | name=@{microsoft.xboxcompanion_1.1.134.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxcompanion/resources/33279} |
    "{F304D851-7B1F-436F-B308-365159729CF8}" = protocol=17 | dir=in | app=c:\program files (x86)\time warner cable\twc wifi\twc wifi.exe |
    "{F6F90BB2-9C07-4E15-8074-165A4AECD4FD}" = dir=out | name=ebay |
    "{F84A5DCD-5417-49D4-AA12-A05976E232D3}" = dir=out | name=@{microsoft.windowsphotos_16.4.4388.928_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
    "TCP Query User{5D635DC7-BDE3-4E58-A39A-160410499768}C:\program files (x86)\netgear genie\bin\netgeargenie.exe" = protocol=6 | dir=in | app=c:\program files (x86)\netgear genie\bin\netgeargenie.exe |
    "TCP Query User{668ACCCE-F546-4EFF-A2E0-F0F4FFB23DF9}C:\users\scofi_000\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe" = protocol=6 | dir=in | app=c:\users\scofi_000\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe |
    "TCP Query User{97F3DC59-D449-4714-8D2B-AC832087DA92}C:\program files (x86)\netgear genie\bin\netgeargenie.exe" = protocol=6 | dir=in | app=c:\program files (x86)\netgear genie\bin\netgeargenie.exe |
    "UDP Query User{22B345C0-4FC1-4080-9D1A-73AE40AF4070}C:\program files (x86)\netgear genie\bin\netgeargenie.exe" = protocol=17 | dir=in | app=c:\program files (x86)\netgear genie\bin\netgeargenie.exe |
    "UDP Query User{8FF267F3-1EB7-4A5A-BB97-7C58211FA280}C:\users\scofi_000\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe" = protocol=17 | dir=in | app=c:\users\scofi_000\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe |
    "UDP Query User{EF74E58A-4CD4-469F-B41B-74AA8B9DCD0B}C:\program files (x86)\netgear genie\bin\netgeargenie.exe" = protocol=17 | dir=in | app=c:\program files (x86)\netgear genie\bin\netgeargenie.exe |

    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{16562A90-71BC-41A0-B890-D91B0C267120}" = TOSHIBA Function Key
    "{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
    "{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support
    "{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
    "{5944B9D4-3C2A-48DE-931E-26B31714A2F7}" = TOSHIBA eco Utility
    "{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
    "{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
    "{704C0303-D20C-45AF-BD2B-556EAF31BE09}" = iCloud
    "{76FF0F03-B707-4332-B5D1-A56C8303514E}" = iTunes
    "{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}_is1" = Updater By SweetPacks 2.0.0.586
    "{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
    "{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
    "{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
    "{94F03B8E-CB73-4653-AFE9-79112C01FED2}" = Premium Sound HD
    "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{95CCACF0-010D-45F0-82BF-858643D8BC02}" = TOSHIBA Desktop Assist
    "{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}" = TOSHIBA PC Health Monitor
    "{B8C8422F-01F1-4791-B084-047AAFF9BFCC}" = TOSHIBA Service Station
    "{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
    "{F4404AFD-2EF3-40C1-8C09-29E5F3B6972B}" = Intel® Trusted Connect Service Client
    "{F842F8B0-6942-4930-821F-543E976B2C66}" = MSVCRT110_amd64
    "{FF07604E-C860-40E9-A230-E37FA41F103A}" = TOSHIBA VIDEO PLAYER
    "SynTPDeinstKey" = Synaptics Pointing Device Driver

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{05A55927-DB9B-4E26-BA44-828EBFF829F0}" = TOSHIBA System Settings
    "{1057511B-F8FE-4230-9ED3-AB949A57EE4A}" = Windows Live PIMT Platform
    "{1E6A96A1-2BAB-43EF-8087-30437593C66C}" = TOSHIBA System Driver
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{24B45620-22B6-4E4A-B836-FF30A0B0404E}" = Toshiba Book Place
    "{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 25
    "{29315CEC-E6CE-4394-84DC-6F862E8D9A52}" = Windows Live UX Platform
    "{2D416A80-0BB1-4D8B-B770-7BE8F53D5937}" = Windows Live UX Platform Language Pack
    "{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
    "{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
    "{3384E1D9-3F18-4A98-8655-180FEF0DFC02}" = TOSHIBA User's Guide
    "{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
    "{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}" = Norton Online Backup
    "{40F55150-F43D-4C9F-9A00-1A0A6F1EB7F0}" = Movie Maker
    "{46316411-80D8-4F68-8118-696E05FCE199}" = Windows Live Essentials
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{4F9A382F-4478-4036-905C-F77DF2EA0370}" = Windows Live SOXE
    "{4FA8F084-C42F-45E1-B7E5-E0C8A1083DC5}" = Windows Live SOXE Definitions
    "{5AF4B3C4-C393-48D7-AC7E-8E7615579548}" = Adobe AIR
    "{5AF550B4-BB67-4E7E-82F1-2C4300279050}" = TOSHIBARegistration
    "{5CC4C963-F772-4766-BFF2-DE551E205EE9}" = Photo Common
    "{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
    "{60A1253C-2D51-4166-95C2-52E9CF4F8D64}" = Photo Gallery
    "{64DF7404-9D46-44AF-AFA1-A2F8D5648C2D}" = Windows Live Photo Common
    "{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
    "{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}" = TOSHIBA Resolution+ Plug-in for Windows Media Player
    "{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-toshiba" = WildTangent Games App (Toshiba Games)
    "{76EE8FE7-1957-4C51-9074-4930A8CFB1AF}" = Windows Live Installer
    "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
    "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
    "{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110
    "{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
    "{90140000-0015-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
    "{90140000-0016-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
    "{90140000-0018-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
    "{90140000-0019-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
    "{90140000-001A-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
    "{90140000-001B-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
    "{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
    "{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
    "{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-002A-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
    "{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
    "{90140000-0044-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
    "{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
    "{90140000-00A1-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
    "{90140000-00BA-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
    "{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-0116-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
    "{90140000-0117-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
    "{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
    "{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office
    "{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
    "{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}" = TOSHIBA Application Installer
    "{98823CC0-51DA-565C-FF90-DCC72D47BD24}" = Amazon Music Importer
    "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    "{9B2E55F8-5BA8-4A45-9682-ACB6F2CC0DA5}" = Photo Gallery
    "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    "{9D3D8C60-A55F-4fed-B2B9-173001290E16}" = Realtek WLAN Driver
    "{A80CEA4E-74C1-4F9F-806B-E1D9AFC01768}" = inSSIDer 3
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.7)
    "{B1786E63-2127-42C9-95A3-146E5F727BF1}" = TOSHIBA Password Utility
    "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
    "{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Media Creator
    "{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime
    "{BA73469B-D8C7-4FE3-B33C-1340D09F0709}" = Windows Live Communications Platform
    "{D71BC54E-A4E6-4E06-866C-FD6EE16EA187}" = Movie Maker
    "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
    "{E69992ED-A7F6-406C-9280-1C156417BC49}" = TOSHIBA Quality Application
    "{ED3CBA78-488F-4E8C-B33F-8E3BF4DDB4D2}" = Toshiba App Place
    "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
    "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    "{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
    "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
    "{FCB3772C-B7D0-4933-B1A9-3707EBACC573}" = Intel(R) SDK for OpenCL - CPU Only Runtime Package
    "Adobe AIR" = Adobe AIR
    "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
    "Audacity_is1" = Audacity 1.2.6
    "com.amazon.music.uploader" = Amazon Music Importer
    "ERUNT_is1" = ERUNT 1.1j
    "Google Chrome" = Google Chrome
    "lphanttoolbargaw" = Search-Results Toolbar
    "Lyrics@LyricsContainer.co" = LyricsContainer
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
    "NARA" = Norton Online Backup ARA
    "NAT" = Norton Anti-Theft
    "NETGEAR Genie" = NETGEAR Genie
    "NIS" = Norton Internet Security
    "Norton PC Checkup_is1" = Norton PC Checkup
    "NortonPCCheckup" = Norton PC Checkup
    "NortonSD" = Norton Security Dashboard
    "Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
    "Origin" = Origin
    "SilvestriRN5e" = SilvestriRN5e
    "sl-apl" = SelectionLinks
    "TWC WiFi_is1" = TWC WiFi
    "WildTangent toshiba Master Uninstall" = WildTangent Games
    "WinLiveSuite" = Windows Live Essentials
    "WTA-22613472-505d-4266-91b1-884fe7ca87c9" = Bejeweled 3
    "WTA-33c04cd6-c19c-4367-8813-a332e0867105" = Polar Bowler
    "WTA-6c2ce72d-2095-4a88-960e-969e46757f2f" = Plants vs. Zombies - Game of the Year
    "WTA-9bed2caf-ff07-4619-a45c-7747d073991a" = Farmscapes
    "WTA-cb48ae24-be02-4839-b1e7-8e1045baa39c" = Virtual Villagers 4 - The Tree of Life
    "WTA-cc1fe785-899e-41be-8add-7bb652e98cd4" = FATE
    "WTA-d1961006-145d-495d-abe6-0bd78ea3a62a" = Penguins!

    ========== Last 20 Event Log Errors ==========

    [ Application Events ]
    Error - 7/17/2013 7:50:14 PM | Computer Name = Sherlock | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledSPRetry 7941937

    Error - 7/17/2013 7:50:30 PM | Computer Name = Sherlock | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: Continuously busy for more than a second

    Error - 7/17/2013 7:50:30 PM | Computer Name = Sherlock | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledEvent 7957515

    Error - 7/17/2013 7:50:30 PM | Computer Name = Sherlock | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledSPRetry 7957515

    Error - 7/17/2013 7:50:45 PM | Computer Name = Sherlock | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: Continuously busy for more than a second

    Error - 7/17/2013 7:50:45 PM | Computer Name = Sherlock | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledEvent 7973125

    Error - 7/17/2013 7:50:45 PM | Computer Name = Sherlock | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledSPRetry 7973125

    Error - 7/17/2013 7:51:29 PM | Computer Name = Sherlock | Source = Toshiba App Place | ID = 0
    Description =

    Error - 7/17/2013 7:53:43 PM | Computer Name = Sherlock | Source = Toshiba App Place | ID = 0
    Description =

    Error - 7/17/2013 7:56:15 PM | Computer Name = Sherlock | Source = Toshiba App Place | ID = 0
    Description =

    [ System Events ]
    Error - 4/27/2013 9:09:04 PM | Computer Name = Sherlock | Source = Service Control Manager | ID = 7000
    Description = The Multimedia Class Scheduler service failed to start due to the
    following error: %%1053

    Error - 4/27/2013 9:09:04 PM | Computer Name = Sherlock | Source = Service Control Manager | ID = 7000
    Description = The Multimedia Class Scheduler service failed to start due to the
    following error: %%1053

    Error - 4/27/2013 9:09:04 PM | Computer Name = Sherlock | Source = Service Control Manager | ID = 7000
    Description = The Multimedia Class Scheduler service failed to start due to the
    following error: %%1053

    Error - 4/27/2013 9:09:04 PM | Computer Name = Sherlock | Source = Service Control Manager | ID = 7000
    Description = The Multimedia Class Scheduler service failed to start due to the
    following error: %%1053

    Error - 4/27/2013 9:09:04 PM | Computer Name = Sherlock | Source = Service Control Manager | ID = 7000
    Description = The Multimedia Class Scheduler service failed to start due to the
    following error: %%1053

    Error - 4/27/2013 9:09:04 PM | Computer Name = Sherlock | Source = Service Control Manager | ID = 7000
    Description = The Multimedia Class Scheduler service failed to start due to the
    following error: %%1053

    Error - 4/27/2013 9:09:04 PM | Computer Name = Sherlock | Source = Service Control Manager | ID = 7000
    Description = The Multimedia Class Scheduler service failed to start due to the
    following error: %%1053

    Error - 4/27/2013 9:09:04 PM | Computer Name = Sherlock | Source = Service Control Manager | ID = 7000
    Description = The Multimedia Class Scheduler service failed to start due to the
    following error: %%1053

    Error - 4/27/2013 9:09:04 PM | Computer Name = Sherlock | Source = Service Control Manager | ID = 7000
    Description = The Multimedia Class Scheduler service failed to start due to the
    following error: %%1053

    Error - 4/27/2013 9:09:04 PM | Computer Name = Sherlock | Source = Service Control Manager | ID = 7000
    Description = The Multimedia Class Scheduler service failed to start due to the
    following error: %%1053


    < End of report >

  8. #8
    Malware Team-Emeritus
    Join Date
    Sep 2012
    Location
    Florida, USA
    Posts
    1,161

    Default

    Hi Scofield,

    1. Windows 8 Uninstall Programs

    Click on the Control Panel app in the Windows 8 Start Screen.



    Then scroll to the bottom and click on the More Settings option.

    You will now be at the Programs and Features, or Uninstall or change a program, screen as shown below. From this screen you can uninstall programs, view installed updates, and turn Windows features on and off.



    Locate and select the following that are present on the list and click the Remove button:
    • "lphanttoolbargaw" = Search-Results Toolbar
    • "sl-apl" = SelectionLinks

    =========================

    2. Run OTL.exe

    Windows Vista and Windows 7 & 8 users Right Click and select "Run as Administrator" on the icon to run it.
    • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

      Code:
      :OTL
      PRC - C:\Program Files\Updater By SweetPacks\ExtensionUpdaterService.exe ()
      PRC - C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\datamngrUI.exe (Bandoo Media Inc)
      IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD24}
      IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD24}: "URL" = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=157&systemid=4&apn_dtid=IME004&apn_ptnrs=AG3&o=APN10642&apn_uid=1350503644714625&q={searchTerms}
      IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={E907F3B7-E5DD-11E2-BEA0-00266C1D080D}
      IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
      IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD24}
      IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD24}: "URL" = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=157&systemid=4&apn_dtid=IME004&apn_ptnrs=AG3&o=APN10642&apn_uid=1350503644714625&q={searchTerms}
      IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD24}
      IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD24}: "URL" = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=157&systemid=4&apn_dtid=IME004&apn_ptnrs=AG3&o=APN10642&apn_uid=1350503644714625&q={searchTerms}
      64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}: C:\PROGRAM FILES\UPDATER BY SWEETPACKS\FIREFOX [2013/07/05 21:47:53 | 000,000,000 | ---D | M]
      FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}: C:\Program Files\Updater By SweetPacks\Firefox [2013/07/05 21:47:53 | 000,000,000 | ---D | M]
      CHR - default_search_provider: search_url = http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10042&barid={E907F3B7-E5DD-11E2-BEA0-00266C1D080D}
      O2 - BHO: (SelectionLinks) - {1C8501DD-5580-48AB-B25C-6D5DBE835A6A} - C:\Program Files (x86)\OApps\SelectionLinks.dll File not found
      O2 - BHO: (Search-Results Toolbar) - {35a73de5-0093-4279-bc86-0132572828f4} - C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
      O3 - HKLM\..\Toolbar: (Search-Results Toolbar) - {35a73de5-0093-4279-bc86-0132572828f4} - C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
      O4 - HKLM..\Run: [DATAMNGR] C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\datamngrUI.exe (Bandoo Media Inc)
      O4 - HKCU..\Run: [WebCake Desktop] "C:\Users\scofi_000\AppData\Roaming\WebCake\WebCakeDesktop.exe" File not found
      O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\LPHANT~1\Mediabar\Datamngr\x64\datamngr.dll) - C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\x64\datamngr.dll (Bandoo Media Inc)
      O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\LPHANT~1\Mediabar\Datamngr\x64\IEBHO.dll) - C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\x64\IEBHO.dll (Discordia, LTD)
      O20 - AppInit_DLLs: (C:\PROGRA~2\LPHANT~1\Mediabar\Datamngr\datamngr.dll) - C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\datamngr.dll (Bandoo Media Inc)
      O20 - AppInit_DLLs: (C:\PROGRA~2\LPHANT~1\Mediabar\Datamngr\IEBHO.dll) - C:\Program Files (x86)\Lphant Applications\Mediabar\Datamngr\IEBHO.dll (Discordia, LTD)
      
      :Files
      C:\Program Files\Updater By SweetPacks
      
      :Services
      Updater By SweetPacks
      
      :Commands
      [purity]
      [createrestorepoint]
      [Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot when it is done

    =========================

    3. Reset / Change Homepage in Chrome
    • Click the Chrome menu on the browser toolbar.
    • Select Settings.
      • Add the home button to the browser toolbar
        Home page button is off by default. Select the "Show Home button" checkbox in the "Appearance" section to show it on the browser toolbar.
      • Set your home page
        When the "Show Home button" checkbox is selected, a web address appears below it. This is the address you will want to change. (hxxp://search.lphant.com)
        Click Change to enter a link (i.e. http://www.google.com). You can also choose the New Tab page as your home page.
    =========================

    4. AdwCleaner

    Download AdwCleaner to your desktop.

    Windows Vista and Windows 7 & 8 users Right Click and select "Run as Administrator" on the icon to run it.
    • Run AdwCleaner and select Delete
    • Once done it will ask to reboot, allow the reboot
    • On reboot a log will be produced, please attach the content of the log to your next reply

    =========================

    5. Re-run OTL (it should be located on your desktop).

    Windows Vista and Windows 7 & 8 users Right Click and select "Run as Administrator" on the icon to run it.
    • Make sure all other windows are closed and to let it run uninterrupted.
    • When the window appears, underneath Output at the top change it to Minimal Output.
    • Uncheck the boxes beside LOP Check and Purity Check.
    • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open one notepad window. OTL.Txt. (No Extras.txt will be produced)
      Note:The log can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
    • Please copy (Edit->Select All, Edit->Copy) the contents of the file, and post it with your next reply.

    =========================

    In your next post please provide the following:
    • OTL fix log
    • AdwCleaner[S1].txt
    • New OTL.txt
    • What symptoms are you experiencing?
    OCD
    ----------
    Graduate of WTT Classroom
    Member of UNITE

    Threads will be closed if no response after 5 days

  9. #9
    Member
    Join Date
    Apr 2006
    Posts
    69

    Default

    Hi OCD... this computer was my girlfriends, and she gave her daughter my admin password. She downloaded lphant, and I deleted it a long time ago. Neither lphant nor sl-apl showed up in the add/remove section (she has another account on here, could be there, not sure). Changed homepage to chrome, but get a lot of pop-ups now. New Tab is re-directed to transport-preservers and ask.com. I will follow the rest of instructions from Chrome the best I can, but might have to go back to I.E. Let me know if I should not do that in the future. Since I'll have to reboot after ADWcleaner, I will post this now, and the rest when done.

  10. #10
    Member
    Join Date
    Apr 2006
    Posts
    69

    Default

    Chrome was re-directed multiple time, went to I.E. Got one report so far....


    # AdwCleaner v2.306 - Logfile created 08/09/2013 at 01:29:21
    # Updated 19/07/2013 by Xplode
    # Operating system : Windows 8 (64 bits)
    # User : scofi_000 - SHERLOCK
    # Boot Mode : Normal
    # Running from : C:\Users\scofi_000\Desktop\AdwCleaner.exe
    # Option [Delete]


    ***** [Services] *****


    ***** [Files / Folders] *****

    Deleted on reboot : C:\ProgramData\boost_interprocess
    File Deleted : C:\windows\Tasks\LyricsContainer Update.job
    Folder Deleted : C:\Program Files (x86)\LyricsContainer
    Folder Deleted : C:\ProgramData\APN
    Folder Deleted : C:\ProgramData\Tarma Installer
    Folder Deleted : C:\Users\jleem_000\AppData\LocalLow\SweetIM
    Folder Deleted : C:\Users\scofi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\abfmigjiaapipflmopkaaooigcjjdojh
    Folder Deleted : C:\Users\scofi_000\AppData\Local\PackageAware
    Folder Deleted : C:\Users\scofi_000\AppData\LocalLow\SweetIM

    ***** [Registry] *****

    Key Deleted : HKCU\Software\APN DTX
    Key Deleted : HKCU\Software\AppDataLow\Software\LyricsContainer
    Key Deleted : HKCU\Software\DataMngr
    Key Deleted : HKCU\Software\IM
    Key Deleted : HKCU\Software\WNLT
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll
    Key Deleted : HKLM\Software\Classes\Installer\Features\FB6D58DD787439A4995AF3C00FEA8843
    Key Deleted : HKLM\Software\InstallIQ
    Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
    Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{AF6B0594-6008-4327-93E5-608AD710A6FA}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\abfmigjiaapipflmopkaaooigcjjdojh
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Lyrics@LyricsContainer.co
    Key Deleted : HKLM\SOFTWARE\Tarma Installer
    Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]
    Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]

    ***** [Internet Browsers] *****

    -\\ Internet Explorer v10.0.9200.16537

    [OK] Registry is clean.

    -\\ Google Chrome v27.0.1453.116

    File : C:\Users\scofi_000\AppData\Local\Google\Chrome\User Data\Default\Preferences

    [OK] File is clean.

    File : C:\Users\jleem_000\AppData\Local\Google\Chrome\User Data\Default\Preferences

    [OK] File is clean.

    -\\ Opera v [Unable to get version]

    File : C:\Users\scofi_000\AppData\Roaming\Opera\Opera\operaprefs.ini

    [OK] File is clean.

    File : C:\Users\jleem_000\AppData\Roaming\Opera\Opera\operaprefs.ini

    [OK] File is clean.

    *************************

    AdwCleaner[S1].txt - [3041 octets] - [09/08/2013 01:29:21]

    ########## EOF - C:\AdwCleaner[S1].txt - [3101 octets] ##########

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •