OTL logfile created on: 1/17/2012 11:31:53 AM - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Cathy\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1.93 Gb Total Physical Memory | 0.86 Gb Available Physical Memory | 44.31% Memory free 3.86 Gb Paging File | 2.33 Gb Available in Paging File | 60.33% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 220.78 Gb Total Space | 162.63 Gb Free Space | 73.66% Space Free | Partition Type: NTFS Computer Name: CATHY-PC | User Name: Cathy | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2012/01/17 11:28:42 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Cathy\Downloads\OTL (1).exe PRC - [2012/01/05 04:48:46 | 001,047,024 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe PRC - [2011/12/17 12:15:17 | 000,063,048 | ---- | M] (White Sky, Inc.) -- C:\Program Files (x86)\Constant Guard Protection Suite\IDVaultSvc.exe PRC - [2011/12/17 12:15:12 | 004,689,992 | ---- | M] (White Sky, Inc.) -- C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe PRC - [2011/12/14 07:57:35 | 000,126,392 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.48\ccSvcHst.exe PRC - [2011/12/14 07:55:35 | 000,177,080 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.48\SymcPCCULaunchSvc.exe PRC - [2011/07/05 10:24:06 | 000,395,528 | ---- | M] (StrikeForce Technologies Inc.) -- C:\Program Files (x86)\SFT\GuardedID\GIDD.exe PRC - [2011/05/15 17:01:44 | 000,478,720 | ---- | M] (Crossrider) -- C:\Program Files (x86)\CrossriderWebApps\Crossrider.exe PRC - [2011/04/16 19:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Security Suite\Norton Security Suite\Norton Security Suite\Norton Security Suite\Engine\5.1.0.29\ccsvchst.exe PRC - [2009/10/13 14:25:54 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2009/10/13 14:25:30 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe PRC - [2009/08/28 04:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe PRC - [2009/08/19 12:25:52 | 001,589,208 | ---- | M] () -- C:\Program Files (x86)\comcasttb\ComcastSpywareScan\ComcastAntiSpy.exe PRC - [2009/08/18 04:42:08 | 001,157,128 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe PRC - [2009/07/03 21:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe PRC - [2009/06/17 12:49:44 | 000,616,408 | ---- | M] () -- C:\Program Files (x86)\comcasttb\ComcastSpywareScan\ComcastAntiSpyService.exe PRC - [2009/02/10 11:01:49 | 000,116,104 | ---- | M] () -- C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe PRC - [2007/09/26 13:55:04 | 000,283,912 | ---- | M] (CA, Inc.) -- C:\Program Files (x86)\CA\PPRT\bin\ITMRTSVC.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2012/01/05 04:48:44 | 000,411,120 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\ppgooglenaclpluginchrome.dll MOD - [2012/01/05 04:48:43 | 003,767,792 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\pdf.dll MOD - [2012/01/05 04:47:19 | 000,122,880 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\avutil-51.dll MOD - [2012/01/05 04:47:18 | 000,222,208 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\avformat-53.dll MOD - [2012/01/05 04:47:17 | 001,746,432 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\avcodec-53.dll MOD - [2012/01/05 02:06:01 | 008,593,056 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\gcswf32.dll MOD - [2012/01/01 14:26:58 | 001,358,336 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\a612958eaf641f0ba83b0daae44cb7b1\System.WorkflowServices.ni.dll MOD - [2012/01/01 14:25:41 | 001,707,008 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\828e31a37bfd9d432083be6307845630\System.ServiceModel.Web.ni.dll MOD - [2012/01/01 14:11:04 | 001,083,392 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\c0d9df88f2b37d14cf416281364c5b7f\System.IdentityModel.ni.dll MOD - [2012/01/01 14:10:39 | 017,478,656 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\7bc7e33d4568a214f226cdb6a161a37a\System.ServiceModel.ni.dll MOD - [2012/01/01 11:58:10 | 001,840,640 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\be4f1d78d06979df7fd08dedf0d8c804\System.Web.Services.ni.dll MOD - [2012/01/01 11:55:32 | 011,833,344 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\b41e38edbd6dfe20997f6ea7c080aceb\System.Web.ni.dll MOD - [2011/12/17 12:15:16 | 000,091,720 | ---- | M] () -- C:\Program Files (x86)\Constant Guard Protection Suite\IdVaultCore.XmlSerializers.dll MOD - [2011/11/01 23:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011/11/01 23:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2011/10/14 09:58:47 | 000,240,128 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\273292e88c7b60ecbae9d85e94cd097e\WindowsFormsIntegration.ni.dll MOD - [2011/10/14 09:56:32 | 001,051,136 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\1049a76b3de293df726d380932215c91\System.Management.ni.dll MOD - [2011/10/14 09:55:38 | 002,347,008 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\76692f411b404f1db0c95d81dd537c37\System.Runtime.Serialization.ni.dll MOD - [2011/10/14 09:55:35 | 000,256,000 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\6294f61f25c953212b92b7e13a0fd9c1\SMDiagnostics.ni.dll MOD - [2011/10/14 09:33:04 | 000,368,128 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\07cdef1a740151932dcf161f3306bd9c\PresentationFramework.Aero.ni.dll MOD - [2011/10/14 09:33:03 | 000,212,992 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\6f2de1cb69aef1946760a70f355a3075\System.ServiceProcess.ni.dll MOD - [2011/10/14 09:32:38 | 006,611,456 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\f8196c3588c2229e84516af4b6a0ee60\System.Data.ni.dll MOD - [2011/10/14 09:32:24 | 014,339,072 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\70e2ca33ffa52c743285dc5b4910a229\PresentationFramework.ni.dll MOD - [2011/10/14 09:32:00 | 012,433,408 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll MOD - [2011/10/14 09:31:44 | 001,587,200 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll MOD - [2011/10/14 09:31:42 | 000,060,928 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\bb1d36ae26e7cadf563061596682e747\UIAutomationProvider.ni.dll MOD - [2011/10/14 09:31:41 | 012,234,752 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\7c94a121334aeca7553c7f01290740f0\PresentationCore.ni.dll MOD - [2011/10/14 09:31:27 | 003,347,968 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\d7a64c28cf0c90e6c48af4f7d6f9ed41\WindowsBase.ni.dll MOD - [2011/10/14 09:31:24 | 000,680,448 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\ccba14fc93de40f4f53d401f07b9bcb8\System.Security.ni.dll MOD - [2011/10/14 09:31:20 | 005,453,312 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\130ad4d9719e566ca933ac7158a04203\System.Xml.ni.dll MOD - [2011/10/14 09:31:16 | 000,971,264 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\2d5bcbeb9475ef62189f605bcca1cec6\System.Configuration.ni.dll MOD - [2011/10/14 09:31:11 | 007,963,648 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll MOD - [2011/10/14 09:30:59 | 011,490,304 | -H-- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll MOD - [2010/11/20 07:19:56 | 000,232,448 | ---- | M] () -- \\.\globalroot\systemroot\syswow64\mswsock.dll MOD - [2010/11/04 20:58:05 | 002,927,616 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll MOD - [2009/11/05 13:00:43 | 008,007,680 | -H-- | M] () -- C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll MOD - [2009/08/19 12:25:52 | 001,589,208 | ---- | M] () -- C:\Program Files (x86)\comcasttb\ComcastSpywareScan\ComcastAntiSpy.exe MOD - [2009/06/12 16:32:16 | 000,104,456 | ---- | M] () -- C:\Windows\SysWOW64\EasyHook32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV:[b]64bit:[/b] - [2009/10/29 13:10:02 | 000,844,320 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files\eMachines\eMachines Power Management\ePowerSvc.exe -- (ePowerSvc) SRV:[b]64bit:[/b] - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:[b]64bit:[/b] - [2009/07/03 21:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe -- (Updater Service) SRV - [2011/12/17 12:15:17 | 000,063,048 | ---- | M] (White Sky, Inc.) [Auto | Running] -- C:\Program Files (x86)\Constant Guard Protection Suite\IDVaultSvc.exe -- (IDVaultSvc) SRV - [2011/12/14 07:57:35 | 000,126,392 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.48\ccSvcHst.exe -- (PCCUJobMgr) SRV - [2011/12/14 07:55:35 | 000,177,080 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.48\SymcPCCULaunchSvc.exe -- (Norton PC Checkup Application Launcher) SRV - [2011/04/16 19:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files (x86)\Norton Security Suite\Norton Security Suite\Norton Security Suite\Norton Security Suite\Engine\5.1.0.29\ccSvcHst.exe -- (N360) SRV - [2010/10/12 12:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService) SRV - [2010/03/18 16:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009/10/13 14:25:30 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R) SRV - [2009/08/28 04:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe -- (Greg_Service) SRV - [2009/06/17 12:49:44 | 000,616,408 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\comcasttb\ComcastSpywareScan\ComcastAntiSpyService.exe -- (AntiSpywareService) SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009/02/10 11:01:49 | 000,116,104 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC) SRV - [2007/09/26 13:55:04 | 000,283,912 | ---- | M] (CA, Inc.) [Auto | Running] -- C:\Program Files (x86)\CA\PPRT\bin\ITMRTSVC.exe -- (ITMRTSVC) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV:[b]64bit:[/b] - [2011/12/24 16:37:22 | 000,174,200 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent) DRV:[b]64bit:[/b] - [2011/07/05 10:18:38 | 000,029,288 | ---- | M] (StrikeForce Technologies, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\gidv2.sys -- (GIDv2) DRV:[b]64bit:[/b] - [2011/05/13 02:21:04 | 000,177,640 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdm.sys -- (ssadmdm) DRV:[b]64bit:[/b] - [2011/05/13 02:21:04 | 000,146,920 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadserd.sys -- (ssadserd) SAMSUNG Android USB Diagnostic Serial Port (WDM) DRV:[b]64bit:[/b] - [2011/05/13 02:21:02 | 000,157,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadbus.sys -- (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) DRV:[b]64bit:[/b] - [2011/05/13 02:21:02 | 000,016,872 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdfl.sys -- (ssadmdfl) SAMSUNG Android USB Modem (Filter) DRV:[b]64bit:[/b] - [2011/03/30 22:00:09 | 000,744,568 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\srtsp64.sys -- (SRTSP) DRV:[b]64bit:[/b] - [2011/03/30 22:00:09 | 000,040,568 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\srtspx64.sys -- (SRTSPX) Symantec Real Time Storage Protection (PEL) DRV:[b]64bit:[/b] - [2011/03/21 19:39:49 | 000,382,584 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\symnets.sys -- (SymNetS) DRV:[b]64bit:[/b] - [2011/03/14 21:31:23 | 000,912,504 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\symefa64.sys -- (SymEFA) DRV:[b]64bit:[/b] - [2011/03/11 01:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:[b]64bit:[/b] - [2011/03/11 01:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:[b]64bit:[/b] - [2011/01/27 01:47:10 | 000,450,680 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\symds64.sys -- (SymDS) DRV:[b]64bit:[/b] - [2010/11/20 08:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:[b]64bit:[/b] - [2010/11/20 06:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:[b]64bit:[/b] - [2010/11/15 20:45:33 | 000,171,128 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\ironx64.sys -- (SymIRON) DRV:[b]64bit:[/b] - [2010/09/28 18:44:52 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:[b]64bit:[/b] - [2010/08/20 23:59:12 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:[b]64bit:[/b] - [2009/10/13 14:16:40 | 000,409,624 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:[b]64bit:[/b] - [2009/10/05 16:34:00 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:[b]64bit:[/b] - [2009/09/02 18:54:20 | 007,369,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:[b]64bit:[/b] - [2009/09/01 20:58:08 | 000,225,280 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR) DRV:[b]64bit:[/b] - [2009/08/21 04:18:16 | 002,978,296 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX) DRV:[b]64bit:[/b] - [2009/07/27 02:04:36 | 000,058,880 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20) DRV:[b]64bit:[/b] - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:[b]64bit:[/b] - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:[b]64bit:[/b] - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:[b]64bit:[/b] - [2009/06/18 07:12:32 | 000,272,432 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:[b]64bit:[/b] - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:[b]64bit:[/b] - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:[b]64bit:[/b] - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:[b]64bit:[/b] - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:[b]64bit:[/b] - [2009/05/05 03:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr) DRV:[b]64bit:[/b] - [2009/05/05 03:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper) DRV - [2011/12/23 16:20:08 | 000,488,568 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20111223.001\IDSviA64.sys -- (IDSVia64) DRV - [2011/12/23 01:00:00 | 002,048,632 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20111223.035\EX64.SYS -- (NAVEX15) DRV - [2011/12/23 01:00:00 | 000,482,936 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl) DRV - [2011/12/23 01:00:00 | 000,117,880 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20111223.035\ENG64.SYS -- (NAVENG) DRV - [2011/12/21 22:50:32 | 001,156,216 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20111221.003\BHDrvx64.sys -- (BHDrvx64) DRV - [2009/09/01 20:58:08 | 000,225,280 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\RtsUStor.sys -- (RSUSBSTOR) DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e525&r=273606101105l0464z175r5542494q IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e525&r=273606101105l0464z175r5542494q IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=bf&s={searchTerms}&f=4 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3960724563-295947535-3481900843-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=e525&r=273606101105l0464z175r5542494q IE - HKU\S-1-5-21-3960724563-295947535-3481900843-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://xfinity.comcast.net/?/ IE - HKU\S-1-5-21-3960724563-295947535-3481900843-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://redirecturls.info/ IE - HKU\S-1-5-21-3960724563-295947535-3481900843-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) IE - HKU\S-1-5-21-3960724563-295947535-3481900843-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3960724563-295947535-3481900843-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\7\NP_wtapp.dll () FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Cathy\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\crossriderapp435@crossrider.com: C:\ProgramData\CodecCheck\firefox [2011/07/26 12:12:58 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\IPSFFPlgn\ [2012/01/14 17:53:29 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\coFFPlgn\ [2012/01/14 17:53:29 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\shabtay@gmail.com: C:\Program Files (x86)\2YourFace\2YourFace.xpi [2011/07/26 12:12:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Cathy\AppData\Roaming\Mozilla\Firefox\extensions [2011/07/26 12:12:42 | 000,000,000 | ---D | M] (2YourFace) -- C:\Users\Cathy\AppData\Roaming\Mozilla\Firefox\extensions\support@2yourface.com [2011/10/14 15:00:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Cathy\AppData\Roaming\Mozilla\Firefox\Profiles\extensions [2012/01/01 12:49:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Cathy\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\extensions [2011/07/26 12:12:42 | 000,000,000 | ---D | M] (2YourFace) -- C:\Users\Cathy\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\support@2yourface.com [2011/12/31 20:22:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2011/01/22 20:43:38 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2011/08/23 12:48:46 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} [2011/12/31 22:00:46 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} [2011/07/19 04:05:25 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2011/07/26 12:12:33 | 000,002,045 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml [color=#E56717]========== Chrome ==========[/color] CHR - default_search_provider: facemoods (Enabled) CHR - default_search_provider: search_url = http://start.facemoods.com/?a=bf&s={searchTerms}&f=4 CHR - default_search_provider: suggest_url = CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: Java Deployment Toolkit 6.0.270.7 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U27 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll CHR - plugin: CANON iMAGE GATEWAY Album Plugin Utility (Enabled) = C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll CHR - plugin: WildTangent Games App Presence Detector (Enabled) = C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\7\NP_wtapp.dll CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Zylom Plugin (Enabled) = C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll CHR - plugin: Unity Player (Enabled) = C:\Users\Cathy\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: YouTube = C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.3_0\ CHR - Extension: YouTube = C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\ CHR - Extension: Google Search = C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\ CHR - Extension: Google Search = C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\ CHR - Extension: Premiumplay Codec-C = C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpnbdefcbnoefmmcpelplabbkfmfhlho\1.14.36_0\ CHR - Extension: Premiumplay Codec-C = C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpnbdefcbnoefmmcpelplabbkfmfhlho\1.8.18_0\ CHR - Extension: We-Care Reminder Lite = C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkpmjnommfoljgjbckjmjhkmnhfmcmon\1.2.0.2_0\ CHR - Extension: We-Care Reminder Lite = C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkpmjnommfoljgjbckjmjhkmnhfmcmon\1.2.0.2_0\.bak CHR - Extension: Gmail = C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\ CHR - Extension: Gmail = C:\Users\Cathy\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ Hosts file not found O2:[b]64bit:[/b] - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found. O2 - BHO: (2YourFace Addon) - {1185823F-F22F-4027-80E5-4F68ACD5DE5E} - C:\Program Files (x86)\2YourFace\bho.dll File not found O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) O2 - BHO: (XFINITY Toolbar) - {4b9bcce8-a70b-402a-a7e1-db96831ee26f} - C:\Program Files (x86)\xfin_portal\comcastdx.dll () O2 - BHO: (ooVoo Toolbar) - {574be437-25ae-4010-a53e-8c63b6ae02ff} - C:\Program Files (x86)\oovootoolbar\vmntemplateX.dll () O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Norton Security Suite\Norton Security Suite\Norton Security Suite\Engine\5.1.0.29\coieplg.dll (Symantec Corporation) O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Security Suite\Norton Security Suite\Norton Security Suite\Norton Security Suite\Engine\5.1.0.29\ips\ipsbho.dll (Symantec Corporation) O2 - BHO: (CrossRider) - {A876E312-7D08-401a-B7A6-FAFC5DC2F292} - C:\Program Files (x86)\CrossriderWebApps\Crossrider.dll () O2 - BHO: (Constant Guard Protection Suite (COM)) - {B84CDBE7-1B46-494B-A188-01D4C52DEB61} - C:\Program Files (x86)\Constant Guard Protection Suite\NativeBHO.dll (WhiteSky) O2 - BHO: (Updater For XFIN_PORTAL) - {bb46be07-13eb-4c49-b0f0-fc78b9ea4983} - C:\Program Files (x86)\xfin_portal\auxi\comcastAu.dll (Visicom Media) O2 - BHO: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (WeCareReminder Class) - {D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} - C:\ProgramData\WeCareReminder\IEHelperv2.5.0.dll (We-Care.com) O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo Layers Runtime\YontooIEClient.dll File not found O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (XFINITY Toolbar) - {4b9bcce8-a70b-402a-a7e1-db96831ee26f} - C:\Program Files (x86)\xfin_portal\comcastdx.dll () O3 - HKLM\..\Toolbar: (ooVoo Toolbar) - {574be437-25ae-4010-a53e-8c63b6ae02ff} - C:\Program Files (x86)\oovootoolbar\vmntemplateX.dll () O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Norton Security Suite\Norton Security Suite\Norton Security Suite\Engine\5.1.0.29\coieplg.dll (Symantec Corporation) O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-3960724563-295947535-3481900843-1000\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found. O3 - HKU\S-1-5-21-3960724563-295947535-3481900843-1000\..\Toolbar\WebBrowser: (no name) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No CLSID value found. O3 - HKU\S-1-5-21-3960724563-295947535-3481900843-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O4:[b]64bit:[/b] - HKLM..\Run: [Acer ePower Management] C:\Program Files\eMachines\eMachines Power Management\ePowerTray.exe (Acer Incorporated) O4:[b]64bit:[/b] - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4:[b]64bit:[/b] - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.) O4:[b]64bit:[/b] - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe File not found O4:[b]64bit:[/b] - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [GIDDesktop] C:\Program Files (x86)\SFT\GuardedID\gidd.exe (StrikeForce Technologies Inc.) O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-3960724563-295947535-3481900843-1000..\Run: [ComcastAntispyClient] C:\Program Files (x86)\comcasttb\ComcastSpywareScan\ComcastAntispy.exe () O4 - HKU\S-1-5-21-3960724563-295947535-3481900843-1000..\Run: [CrossRiderPlugin] C:\Program Files (x86)\CrossriderWebApps\Crossrider.exe (Crossrider) O4 - HKU\S-1-5-21-3960724563-295947535-3481900843-1000..\Run: [Microsoft® Windows® Operating System] C:\Users\Cathy\AppData\Roaming\Microsoft\Protect\Credentials [2012/01/07 16:29:37 | 000,000,000 | -HSD | M] O4 - HKU\S-1-5-21-3960724563-295947535-3481900843-1000..\Run: [Windows Regedit Setup] C:\Users\Cathy\AppData\Local\Temp\svchosts.exe File not found O4 - HKU\S-1-5-21-3960724563-295947535-3481900843-1000..\Run: [Windows Update System] C:\Users\Cathy\AppData\Roaming\msnmsgrs.exe File not found O4 - HKU\S-1-5-21-3960724563-295947535-3481900843-1000..\Run: [winscp8.exe] C:\Windows\Temp\winscp8.exe File not found O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-21-3960724563-295947535-3481900843-1000..\RunServices: [MicrosoftWindows] C:\Users\Cathy\AppData\Roaming\windows32.exe File not found O4 - HKU\S-1-5-21-3960724563-295947535-3481900843-1000..\RunServicesOnce: [MicrosoftWindows] C:\Users\Cathy\AppData\Roaming\windows32.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\S-1-5-21-3960724563-295947535-3481900843-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-3960724563-295947535-3481900843-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKU\S-1-5-21-3960724563-295947535-3481900843-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O8:[b]64bit:[/b] - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html File not found O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html File not found O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O13[b]64bit:[/b] - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27) O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} http://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx (WRC Class) O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{50AD20DE-C320-46CB-94B8-09A536E0B9B6}: DhcpNameServer = 192.168.1.1 192.168.1.1 O18:[b]64bit:[/b] - Protocol\Handler\livecall - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\ms-help - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\ms-itss - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\msnim - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\skype4com - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\wlmailhtml - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\gopher - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:[b]64bit:[/b] - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %* O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* CREATERESTOREPOINT Restore point Set: OTL Restore Point [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2012/01/14 15:11:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2012/01/14 15:10:53 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2012/01/14 15:10:52 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2012/01/14 15:10:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes [2012/01/14 15:08:33 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour [2012/01/14 15:08:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour [2012/01/14 15:07:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime [2012/01/14 15:07:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime [2012/01/14 12:46:07 | 000,000,000 | ---D | C] -- C:\ProgramData\ParetoLogic [2012/01/14 12:46:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ParetoLogic [2012/01/14 12:46:02 | 000,000,000 | ---D | C] -- C:\ProgramData\XoftSpySE [2012/01/14 12:46:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\XoftSpySE [2012/01/14 12:45:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\XoftSpySE6 [2012/01/12 22:07:58 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec [2012/01/12 16:09:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab [2012/01/11 17:31:47 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2012/01/07 16:52:43 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group [2012/01/07 16:52:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard [2012/01/03 20:35:38 | 000,000,000 | ---D | C] -- C:\Users\Cathy\AppData\Roaming\PCToolsFirewallPlus [2012/01/03 20:35:35 | 000,000,000 | ---D | C] -- C:\Users\Cathy\AppData\Roaming\Spam Monitor [2012/01/03 20:23:57 | 000,073,856 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\pctNdis64.sys [2012/01/03 20:23:49 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools [2012/01/03 20:23:24 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP [2012/01/03 20:20:37 | 000,000,000 | ---D | C] -- C:\Users\Cathy\Desktop\Downloads [2012/01/03 20:20:33 | 000,000,000 | ---D | C] -- C:\Users\Cathy\AppData\Roaming\GetRightToGo [2012/01/03 20:08:42 | 000,000,000 | ---D | C] -- C:\Users\Cathy\AppData\Local\Apps [2012/01/03 20:08:41 | 000,000,000 | ---D | C] -- C:\Users\Cathy\AppData\Local\Deployment [2012/01/01 21:30:39 | 000,802,864 | R--- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\N360x64\0500000.07D\SymEFA64.sys [2012/01/01 21:30:26 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\N360x64\0500000.07D [2012/01/01 12:49:01 | 000,702,464 | ---- | C] (CelebSauce) -- C:\Program Files (x86)\Uninstall CelebSauce.dll [2011/12/31 21:00:38 | 000,000,000 | ---D | C] -- C:\Users\Cathy\Documents\IceSword122en [2011/12/26 18:59:44 | 000,000,000 | ---D | C] -- C:\Users\Cathy\AppData\Local\CrashDumps [2011/12/25 21:39:24 | 000,000,000 | ---D | C] -- C:\NBRT [2011/12/25 18:09:52 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\NBRTWizardx64 [2011/12/25 18:09:52 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\NBRTWizardx64\0401000.00F [2011/12/25 18:09:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Bootable Recovery Tool Wizard [2011/12/25 18:09:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Norton Bootable Recovery Tool Wizard [2011/12/25 18:08:37 | 000,000,000 | ---D | C] -- C:\Users\Cathy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Norton [2011/12/25 17:45:55 | 000,000,000 | ---D | C] -- C:\Users\Cathy\AppData\Roaming\Tific [2011/12/24 18:39:15 | 000,000,000 | ---D | C] -- C:\Users\Cathy\AppData\Local\NPE [2011/12/24 16:37:20 | 000,382,584 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\symnets.sys [2011/12/24 16:37:19 | 000,912,504 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\symefa64.sys [2011/12/24 16:37:19 | 000,744,568 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\srtsp64.sys [2011/12/24 16:37:19 | 000,450,680 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\symds64.sys [2011/12/24 16:37:19 | 000,040,568 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\srtspx64.sys [2011/12/24 16:37:18 | 000,171,128 | R--- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\ironx64.sys [2011/12/24 16:36:35 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\N360x64\0501000.01D [2011/12/24 15:59:55 | 000,000,000 | ---D | C] -- C:\Users\Cathy\AppData\Local\Symantec [2011/12/24 15:55:26 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\NortonPCCheckupx64 [2011/12/24 15:55:26 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\NortonPCCheckupx64\0200110.030 [2011/12/24 15:55:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton PC Checkup [2011/12/24 15:55:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Norton PC Checkup [2011/12/24 13:30:29 | 000,174,200 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS [2011/12/24 13:30:29 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Symantec Shared [2011/12/24 13:02:29 | 000,029,288 | ---- | C] (StrikeForce Technologies, Inc.) -- C:\Windows\SysNative\drivers\gidv2.sys [2011/12/24 13:02:28 | 000,446,752 | ---- | C] (StrikeForce Technologies Inc.) -- C:\Windows\SysNative\GIDHookLogon64.dll [2011/12/24 13:02:28 | 000,206,608 | ---- | C] (StrikeForce Technologies Inc.) -- C:\Windows\SysNative\GIDBIN1.DLL [2011/12/24 13:02:28 | 000,102,160 | ---- | C] (StrikeForce Technologies Inc.) -- C:\Windows\SysNative\GIDBIN3.DLL [2011/12/24 13:02:28 | 000,065,816 | ---- | C] (StrikeForce Technologies Inc.) -- C:\Windows\SysNative\GIDLogonCP64.dll [2011/12/24 13:02:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\scanner [2011/12/24 13:00:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\xfin_portal [2011/12/19 19:50:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client [2011/12/19 18:35:28 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client [2011/12/18 22:54:43 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\N360x64 [2011/12/18 22:46:39 | 000,467,224 | ---- | C] (StrikeForce Technologies Inc.) -- C:\Windows\SysNative\GIDHOOK64.DLL [2011/12/18 21:34:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update [2011/12/18 12:05:11 | 000,000,000 | ---D | C] -- C:\Users\Cathy\Documents\Symantec [2011/12/18 11:46:06 | 000,000,000 | ---D | C] -- C:\Users\Cathy\AppData\Local\ID Vault [2011/12/18 11:38:26 | 000,000,000 | ---D | C] -- C:\Users\Cathy\AppData\Roaming\ID Vault [2010/03/22 13:17:23 | 000,049,464 | -H-- | C] ( ) -- C:\Windows\AutosetFrequency.exe [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2012/01/17 11:14:34 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012/01/17 11:13:00 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At24.job [2012/01/17 11:05:14 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At32.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At30.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At28.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At26.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At22.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At20.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At18.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At16.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At14.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At12.job [2012/01/17 11:05:13 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At8.job [2012/01/17 11:05:13 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At10.job [2012/01/17 11:05:10 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At6.job [2012/01/17 11:05:09 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At4.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At48.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At46.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At44.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At42.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At40.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At38.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At36.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At34.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\At2.job [2012/01/17 11:05:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012/01/14 19:04:53 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012/01/14 19:04:53 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012/01/14 15:11:28 | 000,001,752 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk [2012/01/14 15:09:01 | 001,876,440 | ---- | M] () -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\Cat.DB [2012/01/14 15:07:53 | 000,001,814 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [2012/01/14 14:55:30 | 1555,550,208 | -HS- | M] () -- C:\hiberfil.sys [2012/01/11 17:32:06 | 000,001,983 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2012/01/07 18:06:16 | 000,000,228 | ---- | M] () -- C:\Windows\tasks\0.job [2012/01/03 07:24:31 | 235,932,303 | -H-- | M] () -- C:\Windows\MEMORY.DMP [2012/01/01 12:49:02 | 000,000,307 | -H-- | M] () -- C:\Windows\wininit.ini [2012/01/01 03:03:07 | 000,740,374 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012/01/01 03:03:07 | 000,624,178 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012/01/01 03:03:07 | 000,106,522 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011/12/24 18:44:39 | 000,003,327 | ---- | M] () -- C:\Users\Public\Desktop\Norton Security Suite.lnk [2011/12/24 18:37:47 | 000,007,601 | ---- | M] () -- C:\Users\Cathy\AppData\Local\Resmon.ResmonCfg [2011/12/24 16:37:22 | 000,174,200 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS [2011/12/24 16:37:22 | 000,007,488 | ---- | M] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT [2011/12/24 16:37:22 | 000,000,855 | ---- | M] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.INF [2011/12/24 15:55:31 | 000,002,303 | ---- | M] () -- C:\Users\Public\Desktop\Norton PC Checkup.LNK [2011/12/24 13:28:16 | 000,001,334 | ---- | M] () -- C:\Users\Cathy\Desktop\Norton Installation Files.lnk [2011/12/24 13:00:09 | 000,002,274 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Constant Guard.lnk [2011/12/24 13:00:09 | 000,002,256 | ---- | M] () -- C:\Users\Public\Desktop\Constant Guard.lnk [2011/12/24 12:44:30 | 000,001,802 | ---- | M] () -- C:\Users\Cathy\Documents\At48 [2011/12/19 19:40:37 | 000,196,608 | ---- | M] () -- C:\Users\Cathy\Documents\RestoreUI.1.etl [2011/12/18 23:45:44 | 000,002,944 | ---- | M] () -- C:\{ED0CA637-1812-4848-BC76-44E9868335B2} [2011/12/18 23:12:13 | 000,003,640 | ---- | M] () -- C:\{62E6173E-0C0B-43CF-98FA-811243B5EC29} [2011/12/18 23:06:26 | 000,002,296 | ---- | M] () -- C:\{2B800D34-63B1-4A7C-865D-8E4A1DC1CE3E} [2011/12/18 21:56:19 | 000,343,552 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011/12/18 21:33:58 | 000,000,118 | ---- | M] () -- C:\Windows\SysNative\MRT.INI [2011/12/18 12:13:10 | 000,485,112 | ---- | M] () -- C:\{587DB485-3AC5-4118-9F1B-E548B9A1730D} [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2012/01/14 15:11:28 | 000,001,752 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk [2012/01/14 15:07:53 | 000,001,814 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [2012/01/07 18:06:16 | 000,000,228 | ---- | C] () -- C:\Windows\tasks\0.job [2012/01/01 21:38:03 | 000,007,492 | R--- | C] () -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\iron.cat [2012/01/01 21:13:29 | 000,001,802 | ---- | C] () -- C:\Users\Cathy\Documents\At48 [2011/12/30 21:32:43 | 000,196,608 | ---- | C] () -- C:\Users\Cathy\Documents\RestoreUI.1.etl [2011/12/24 18:42:57 | 001,876,440 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\Cat.DB [2011/12/24 16:37:20 | 000,007,458 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\symnet64.cat [2011/12/24 16:37:19 | 000,007,462 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\srtspx64.cat [2011/12/24 16:37:19 | 000,007,460 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\symefa64.cat [2011/12/24 16:37:19 | 000,003,373 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\symefa.inf [2011/12/24 16:37:19 | 000,002,792 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\symds.inf [2011/12/24 16:37:19 | 000,001,446 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\symnet.inf [2011/12/24 16:37:19 | 000,001,422 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\srtspx64.inf [2011/12/24 16:37:18 | 000,007,458 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\srtsp64.cat [2011/12/24 16:37:18 | 000,001,438 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\srtsp64.inf [2011/12/24 16:37:18 | 000,000,772 | R--- | C] () -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\iron.inf [2011/12/24 16:36:38 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\symds64.cat [2011/12/24 16:36:35 | 000,000,172 | ---- | C] () -- C:\Windows\SysNative\drivers\N360x64\0501000.01D\isolate.ini [2011/12/24 15:55:31 | 000,002,303 | ---- | C] () -- C:\Users\Public\Desktop\Norton PC Checkup.LNK [2011/12/24 15:55:26 | 000,000,172 | ---- | C] () -- C:\Windows\SysNative\drivers\NortonPCCheckupx64\0200110.030\isolate.ini [2011/12/24 13:30:29 | 000,007,488 | ---- | C] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT [2011/12/24 13:30:29 | 000,000,855 | ---- | C] () -- C:\Windows\SysNative\drivers\SYMEVENT64x86.INF [2011/12/24 13:28:16 | 000,001,334 | ---- | C] () -- C:\Users\Cathy\Desktop\Norton Installation Files.lnk [2011/12/24 13:00:09 | 000,002,274 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Constant Guard.lnk [2011/12/24 13:00:09 | 000,002,268 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Constant Guard.lnk [2011/12/24 13:00:09 | 000,002,256 | ---- | C] () -- C:\Users\Public\Desktop\Constant Guard.lnk [2011/12/24 12:44:30 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At48.job [2011/12/24 12:44:29 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At46.job [2011/12/24 12:44:28 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At44.job [2011/12/24 12:44:27 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At42.job [2011/12/24 12:44:26 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At40.job [2011/12/24 12:44:25 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At38.job [2011/12/24 12:44:25 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At36.job [2011/12/24 12:44:24 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At34.job [2011/12/24 12:44:24 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At32.job [2011/12/24 12:44:23 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At30.job [2011/12/24 12:44:23 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At28.job [2011/12/24 12:44:23 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At26.job [2011/12/24 12:44:22 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At24.job [2011/12/24 12:44:21 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At22.job [2011/12/24 12:44:20 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At20.job [2011/12/24 12:44:19 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At18.job [2011/12/24 12:44:19 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At16.job [2011/12/24 12:44:19 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At14.job [2011/12/24 12:44:18 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At12.job [2011/12/24 12:44:18 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At10.job [2011/12/24 12:44:17 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At8.job [2011/12/24 12:44:17 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At6.job [2011/12/24 12:44:16 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At4.job [2011/12/24 12:44:15 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\At2.job [2011/12/18 23:45:38 | 000,002,944 | ---- | C] () -- C:\{ED0CA637-1812-4848-BC76-44E9868335B2} [2011/12/18 23:12:13 | 000,003,640 | ---- | C] () -- C:\{62E6173E-0C0B-43CF-98FA-811243B5EC29} [2011/12/18 23:06:23 | 000,002,296 | ---- | C] () -- C:\{2B800D34-63B1-4A7C-865D-8E4A1DC1CE3E} [2011/12/18 22:55:26 | 000,003,327 | ---- | C] () -- C:\Users\Public\Desktop\Norton Security Suite.lnk [2011/12/18 12:13:09 | 000,485,112 | ---- | C] () -- C:\{587DB485-3AC5-4118-9F1B-E548B9A1730D} [2011/12/18 11:37:41 | 000,109,064 | ---- | C] () -- C:\Windows\SysNative\EasyHook64.dll [2011/12/15 15:15:20 | 000,010,276 | -HS- | C] () -- C:\ProgramData\054452l2d078j880h735m5rji6p4 [2011/11/23 15:22:59 | 000,000,000 | ---- | C] () -- C:\ProgramData\o5EPBy3.dat [2011/08/18 12:46:52 | 000,000,000 | ---- | C] () -- C:\Users\Cathy\AppData\Roaming\wklnhst.dat [2011/07/28 20:39:12 | 000,000,000 | ---- | C] () -- C:\Users\Cathy\AppData\Local\{3B03E096-523B-454F-A046-CD5CAF6D5083} [2011/07/01 19:42:56 | 000,000,000 | ---- | C] () -- C:\Users\Cathy\AppData\Local\{80A57DBB-704F-4FDA-B977-914E6A17A1B4} [2011/06/04 19:55:39 | 000,040,960 | RHS- | C] () -- C:\Users\Cathy\AppData\Roaming\svchost.exe [2011/05/29 14:22:06 | 000,000,500 | -H-- | C] () -- C:\Windows\eReg.dat [2011/05/28 21:41:13 | 000,000,000 | ---- | C] () -- C:\Users\Cathy\AppData\Local\{C5CBC799-FC87-451C-9655-C3ED90924CD2} [2011/05/21 06:07:18 | 000,000,000 | ---- | C] () -- C:\Users\Cathy\AppData\Local\{47226909-F2AA-44F1-8ACF-CE453E4D1A00} [2011/05/20 05:54:23 | 000,000,149 | -H-- | C] () -- C:\Windows\winmnsssgr.exe [2011/05/11 18:29:27 | 000,000,028 | -H-- | C] () -- C:\Windows\422201911.exe [2011/05/11 17:22:53 | 000,000,028 | -H-- | C] () -- C:\Windows\49201911.exe [2011/05/10 20:16:36 | 000,011,576 | -HS- | C] () -- C:\ProgramData\6y4t3qeqg1505v0i7fby712c2kd3ryy3t8wh05 [2011/03/19 11:17:26 | 000,000,028 | -H-- | C] () -- C:\Windows\tmp3739514.exe [2011/03/14 18:15:49 | 000,000,028 | -H-- | C] () -- C:\Windows\Temp4067621.exe [2011/03/14 17:41:53 | 000,000,028 | -H-- | C] () -- C:\Windows\Temp409855621.exe [2011/03/13 19:06:54 | 000,000,028 | -H-- | C] () -- C:\Windows\tmp3423451421.exe [2011/02/10 14:51:39 | 000,000,307 | -H-- | C] () -- C:\Windows\wininit.ini [2011/01/22 20:45:44 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2011/01/11 13:50:37 | 000,007,601 | ---- | C] () -- C:\Users\Cathy\AppData\Local\Resmon.ResmonCfg [2010/12/21 17:13:59 | 000,000,000 | -H-- | C] () -- C:\Windows\nsreg.dat [2010/08/25 21:52:00 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\iglhsip32.dll [2010/08/25 21:52:00 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\iglhcp32.dll [2010/08/07 13:56:58 | 000,000,035 | -H-- | C] () -- C:\Windows\popcinfo.dat [2010/03/22 13:17:23 | 000,632,056 | -H-- | C] () -- C:\Windows\Image.dll [2010/03/22 13:17:23 | 000,025,848 | -H-- | C] () -- C:\Windows\USB_VIDEO_REG.exe [2010/03/22 13:17:23 | 000,000,637 | -H-- | C] () -- C:\Windows\AutoSetFrequency.ini [2010/03/22 13:17:23 | 000,000,378 | -H-- | C] () -- C:\Windows\PidList.ini [2009/11/05 12:34:56 | 000,134,592 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin [2009/09/02 18:52:46 | 000,982,220 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin [2009/09/02 18:52:46 | 000,439,300 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin [2009/09/02 18:52:46 | 000,092,216 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin [2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009/06/12 16:32:16 | 000,104,456 | ---- | C] () -- C:\Windows\SysWow64\EasyHook32.dll [2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat [color=#E56717]========== LOP Check ==========[/color] [2011/11/23 10:47:16 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\AB0C3 [2011/11/27 17:04:55 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\C03AB [2011/02/19 09:13:28 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\Canon [2011/11/22 14:14:24 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\f49lbJYtDHZVO [2011/12/24 18:06:13 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\FrostWire [2010/10/10 20:19:39 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\funkitron [2011/07/06 20:19:49 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\Gamelab [2012/01/03 20:31:37 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\GetRightToGo [2011/11/27 17:05:21 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\Hoyle Blackjack [2011/11/27 17:05:21 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\Hoyle Card Games [2011/11/27 17:05:21 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\Hoyle FaceCreator [2011/12/18 12:01:31 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\ID Vault [2010/06/15 16:17:21 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\iWin [2011/11/22 14:14:36 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\L0SbYWU2gymXr2W [2011/11/22 14:15:52 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\nTSEPW4lQ9jlPcv [2011/07/06 23:35:50 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\ooVoo Details [2012/01/03 20:35:38 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\PCToolsFirewallPlus [2012/01/03 20:35:35 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\Spam Monitor [2011/08/18 12:46:54 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\Template [2011/12/25 17:45:55 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\Tific [2011/09/30 17:54:27 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\Unity [2010/10/14 18:00:27 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\WeatherBug [2010/11/11 21:43:17 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\Windows Live Writer [2011/11/25 17:23:22 | 000,000,000 | ---D | M] -- C:\Users\Cathy.Cathy-PC\AppData\Roaming\ID Vault [2011/12/15 15:18:17 | 000,000,000 | ---D | M] -- C:\Users\Janice\AppData\Roaming\A8fRL9hTXjCkBzN [2012/01/01 11:29:16 | 000,000,000 | ---D | M] -- C:\Users\Janice\AppData\Roaming\AB0C3 [2011/11/27 17:05:34 | 000,000,000 | ---D | M] -- C:\Users\Janice\AppData\Roaming\b24pJ68zp8jr03W [2012/01/01 11:29:12 | 000,000,000 | ---D | M] -- C:\Users\Janice\AppData\Roaming\C03AB [2011/11/23 10:49:45 | 000,000,000 | ---D | M] -- C:\Users\Janice\AppData\Roaming\DVltPy1v2npHQ7E [2011/12/15 15:18:17 | 000,000,000 | ---D | M] -- C:\Users\Janice\AppData\Roaming\fTTqqjkVzOtAc [2011/11/22 11:36:40 | 000,000,000 | ---D | M] -- C:\Users\Janice\AppData\Roaming\glONtxPuc1b3n4m [2011/12/15 15:12:47 | 000,000,000 | ---D | M] -- C:\Users\Janice\AppData\Roaming\iBrzPNyxAuSoF [2011/11/22 09:46:29 | 000,000,000 | ---D | M] -- C:\Users\Janice\AppData\Roaming\pYCkxoJgUyopH8Y [2011/11/22 09:47:23 | 000,000,000 | ---D | M] -- C:\Users\Janice\AppData\Roaming\VV13oHH7lz1pJ8B [2011/11/22 09:46:25 | 000,000,000 | ---D | M] -- C:\Users\Janice\AppData\Roaming\VVy4Rzm8wCBPy1b [2011/11/26 09:59:12 | 000,000,000 | ---D | M] -- C:\Users\Janiiceee\AppData\Roaming\ID Vault [2011/05/05 17:32:34 | 000,000,000 | ---D | M] -- C:\Users\june\AppData\Roaming\Canon [2011/11/25 20:44:45 | 000,000,000 | ---D | M] -- C:\Users\june\AppData\Roaming\ID Vault [2011/07/11 16:21:54 | 000,000,000 | ---D | M] -- C:\Users\june\AppData\Roaming\ooVoo Details [2011/09/25 22:35:47 | 000,000,000 | ---D | M] -- C:\Users\june\AppData\Roaming\uTorrent [2010/09/06 21:35:47 | 000,000,000 | ---D | M] -- C:\Users\june\AppData\Roaming\WildTangent [2012/01/07 18:06:16 | 000,000,228 | ---- | M] () -- C:\Windows\Tasks\0.job [2012/01/17 11:05:13 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At10.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At12.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At14.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At16.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At18.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At2.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At20.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At22.job [2012/01/17 11:13:00 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At24.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At26.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At28.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At30.job [2012/01/17 11:05:14 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At32.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At34.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At36.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At38.job [2012/01/17 11:05:09 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At4.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At40.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At42.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At44.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At46.job [2012/01/17 11:05:08 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At48.job [2012/01/17 11:05:10 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At6.job [2012/01/17 11:05:13 | 000,000,354 | ---- | M] () -- C:\Windows\Tasks\At8.job [2012/01/01 03:04:50 | 000,032,626 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Custom Scans ==========[/color] [color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color] [color=#A23BEC]< MD5 for: CONSRV.DLL >[/color] [2012/01/07 16:29:40 | 000,054,272 | ---- | M] (Microsoft Corporation) MD5=63E99B675A1337DB6D8430195EA3EFD2 -- C:\Windows\SysNative\consrv.dll [2012/01/07 16:29:40 | 000,054,272 | ---- | M] (Microsoft Corporation) MD5=63E99B675A1337DB6D8430195EA3EFD2 -- C:\Windows\system64\consrv.dll [color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color] [2011/02/26 01:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe [2011/02/26 00:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe [2009/07/13 20:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2011/02/26 00:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe [2009/10/31 00:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe [2011/02/26 00:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe [2011/02/25 01:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe [2011/02/25 01:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe [2011/02/26 01:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe [2010/11/20 07:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe [2009/08/03 01:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe [2011/02/25 00:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe [2011/02/25 00:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe [2009/10/31 01:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe [2009/08/03 00:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe [2010/11/20 08:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe [2009/10/31 01:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe [2009/08/03 00:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe [2009/07/13 20:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2009/10/31 01:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe [2011/02/26 01:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe [2009/08/03 01:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe [color=#A23BEC]< MD5 for: SVCHOST.EXE >[/color] [2009/07/13 20:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\SysWOW64\svchost.exe [2009/07/13 20:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe [2009/07/13 20:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\SysNative\svchost.exe [2009/07/13 20:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\system64\svchost.exe [2009/07/13 20:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe [2011/06/04 19:55:31 | 000,040,960 | RHS- | M] () MD5=FE40D7FBE500976A0F3812D033622762 -- C:\Users\Cathy\AppData\Roaming\svchost.exe [color=#A23BEC]< MD5 for: USERINIT.EXE >[/color] [2010/11/20 07:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe [2010/11/20 07:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009/07/13 20:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009/07/13 20:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe [2010/11/20 08:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe [2010/11/20 08:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\system64\userinit.exe [2010/11/20 08:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe [color=#A23BEC]< MD5 for: WINLOGON.EXE >[/color] [2010/11/20 08:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2010/11/20 08:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\system64\winlogon.exe [2010/11/20 08:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe [2009/07/13 20:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2009/10/28 02:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2009/10/28 01:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe [color=#A23BEC]< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT /s >[/color] "DisplayName" = @%SystemRoot%\system32\drivers\netbt.sys,-2 "Group" = PNP_TDI "ImagePath" = System32\DRIVERS\netbt.sys "Description" = @%SystemRoot%\system32\drivers\netbt.sys,-1 "ErrorControl" = 1 "Start" = 1 "Type" = 1 "DependOnService" = Tdxtcpip [binary data] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Linkage] "OtherDependencies" = Tcpip [binary data] "Bind" = [Binary data over 100 bytes] "Route" = [Binary data over 100 bytes] "Export" = [Binary data over 100 bytes] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters] "BcastNameQueryCount" = 3 "BcastQueryTimeout" = 750 "CacheTimeout" = 600000 "EnableLMHOSTS" = 1 "NameServerPort" = 137 "NameSrvQueryCount" = 3 "NameSrvQueryTimeout" = 1500 "NbProvider" = _tcp "SessionKeepAlive" = 3600000 "Size/Small/Medium/Large" = 1 "TransportBindName" = \Device\ "UseNewSmb" = 1 "DhcpNodeType" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces\Tcpip_{50AD20DE-C320-46CB-94B8-09A536E0B9B6}] "NameServerList" = [binary data] "NetbiosOptions" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces\Tcpip_{DD5D3D63-591C-47D3-8673-1AEDDEB14120}] "NameServerList" = [binary data] "NetbiosOptions" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Security] "Security" = [Binary data over 100 bytes] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Enum] "0" = Root\LEGACY_NETBT\0000 "Count" = 1 "NextInstance" = 1 [color=#A23BEC]< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS /s >[/color] "Type" = 2 "Start" = 1 "ErrorControl" = 1 "Tag" = 2 "ImagePath" = system32\DRIVERS\netbios.sys "DisplayName" = NetBIOS Interface "Group" = NetBIOSGroup "Description" = NetBIOS Interface [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS\Linkage] "LanaMap" = 01 02 01 00 01 01 01 06 01 05 01 07 01 04 01 03 [binary data] "Bind" = [Binary data over 100 bytes] "Route" = [Binary data over 100 bytes] "Export" = [Binary data over 100 bytes] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS\Parameters] "MaxLana" = 7 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS\Enum] "0" = Root\LEGACY_NETBIOS\0000 "Count" = 1 "NextInstance" = 1 [color=#A23BEC]< C:\Windows\assembly\tmp\U\*.* /s >[/color] [color=#A23BEC]< %Temp%\smtmp\1\*.* >[/color] [color=#A23BEC]< %Temp%\smtmp\2\*.* >[/color] [color=#A23BEC]< %Temp%\smtmp\3\*.* >[/color] [color=#A23BEC]< %Temp%\smtmp\4\*.* >[/color] [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:430C6D84 @Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:5160F090 < End of report >