Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Computer Rebooting / Blue Screen [Closed]

Started by sean.dbtrader , Apr 10 2012 09:40 PM

This topic is locked

#46
sean.dbtrader

Posted 23 April 2012 - 02:57 PM

Member

Topic Starter
Member
73 posts

I've attached the OTL log. I can't find an extras.txt file on the desktop where I saved OTL.

OTL logfile created on: 4/23/2012 1:14:10 PM - Run 11
OTL by OldTimer - Version 3.2.41.0 Folder = C:\Users\Sean\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.96 Gb Total Physical Memory | 5.32 Gb Available Physical Memory | 66.78% Memory free
15.92 Gb Paging File | 13.07 Gb Available in Paging File | 82.08% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 921.56 Gb Total Space | 611.99 Gb Free Space | 66.41% Space Free | Partition Type: NTFS
Drive E: | 698.64 Gb Total Space | 230.38 Gb Free Space | 32.98% Space Free | Partition Type: NTFS
Drive W: | 288.04 Gb Total Space | 53.25 Gb Free Space | 18.49% Space Free | Partition Type: NTFS
Drive X: | 288.04 Gb Total Space | 53.25 Gb Free Space | 18.49% Space Free | Partition Type: NTFS
Drive Z: | 288.04 Gb Total Space | 53.25 Gb Free Space | 18.49% Space Free | Partition Type: NTFS

Computer Name: DELLXPSWIN7 | User Name: Sean | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/23 13:07:27 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Users\Sean\Desktop\OTL.exe
PRC - [2012/02/06 16:25:08 | 000,013,672 | ---- | M] (Intuit Inc.) -- C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
PRC - [2011/12/22 05:31:08 | 000,045,056 | ---- | M] (Intuit) -- C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
PRC - [2011/11/07 17:16:12 | 014,767,976 | ---- | M] (GARMIN Corp.) -- C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe
PRC - [2011/04/08 05:50:02 | 000,542,264 | ---- | M] (Google) -- C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe
PRC - [2010/07/15 06:53:02 | 000,546,200 | ---- | M] (Oberon Media ) -- C:\Program Files (x86)\GamesBar\SearchEngineProtection.exe
PRC - [2010/05/21 04:30:20 | 005,207,336 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer.exe
PRC - [2010/05/21 04:27:04 | 000,173,352 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe
PRC - [2009/10/02 11:26:12 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2009/10/02 11:26:10 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
PRC - [2009/06/09 07:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) -- C:\Program Files\Dell\DellDock\DockLogin.exe
PRC - [2009/05/21 06:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
PRC - [2007/02/16 21:08:14 | 000,057,344 | ---- | M] (Nalpeiron Ltd.) -- C:\Windows\SysWOW64\AstSrv.exe

========== Modules (No Company Name) ==========

MOD - [2012/04/22 12:37:26 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\47b9e7f070271ff50f988f75ea68fa3e\WindowsBase.ni.dll
MOD - [2012/04/22 12:27:50 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\a1c4a635721f85bef0ea4194b888b871\System.Runtime.Remoting.ni.dll
MOD - [2012/04/22 12:27:46 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6c51e152e7404188914c9fa4d8503ff9\System.Windows.Forms.ni.dll
MOD - [2012/04/22 12:27:41 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ab87129c2b603f218e4aa5300c9b1bdd\System.Drawing.ni.dll
MOD - [2012/04/22 12:27:35 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\9866d1f6178e1cde25642f1ac293ff8d\System.Xml.ni.dll
MOD - [2012/04/22 12:27:33 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e620323cacb5b6bfd93fd28d263440e4\System.Configuration.ni.dll
MOD - [2012/04/22 12:27:32 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\faf4e8730ecbd07570111bb7c3b20565\System.ni.dll
MOD - [2012/04/22 12:27:27 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/10/18 15:32:28 | 000,161,168 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\systemcore\mfevtps.exe -- (mfevtp)
SRV:64bit: - [2011/10/18 15:23:24 | 000,208,536 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe -- (mfefire)
SRV:64bit: - [2011/10/18 15:23:06 | 000,199,272 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield)
SRV:64bit: - [2011/03/17 16:39:40 | 000,501,768 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\mcafee\virusscan\mcods.exe -- (McODS)
SRV:64bit: - [2011/01/27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McProxy)
SRV:64bit: - [2011/01/27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McOobeSv)
SRV:64bit: - [2011/01/27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McNASvc)
SRV:64bit: - [2011/01/27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McNaiAnn)
SRV:64bit: - [2011/01/27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (mcmscsvc)
SRV:64bit: - [2011/01/27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McMPFSvc)
SRV:64bit: - [2009/12/10 15:15:04 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009/07/13 18:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/06/09 07:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) [Auto | Running] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)
SRV:64bit: - [2008/07/29 13:20:28 | 004,737,024 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe -- (msvsmon90)
SRV:64bit: - [2005/09/23 03:26:42 | 004,476,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x64\msvsmon.exe -- (msvsmon80)
SRV - [2012/04/13 18:04:22 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/02/29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/02/06 16:25:08 | 000,013,672 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe -- (IntuitUpdateServiceV4)
SRV - [2011/12/22 05:31:08 | 000,045,056 | ---- | M] (Intuit) [Auto | Running] -- C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe -- (QBCFMonitorService)
SRV - [2010/05/21 05:29:52 | 001,045,256 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/05/21 05:18:12 | 000,016,680 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe -- (GoToAssist)
SRV - [2010/05/21 04:27:04 | 000,173,352 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/10/02 11:26:12 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel®
SRV - [2009/06/26 09:19:12 | 001,124,848 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCom\RoxMediaDB10.exe -- (RoxMediaDB10)
SRV - [2009/06/10 14:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/05/21 06:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter)
SRV - [2009/02/25 19:06:42 | 000,013,088 | ---- | M] (Intuit Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
SRV - [2008/11/18 15:45:28 | 000,061,440 | ---- | M] (Intuit Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe -- (QBFCService)
SRV - [2007/05/31 17:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007/05/31 17:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2007/02/16 21:08:14 | 000,057,344 | ---- | M] () [Auto | Running] -- C:\Windows\SysWow64\\AstSrv.exe -- (Ast Service)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/04/21 17:33:07 | 000,460,888 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\30044589.sys -- (30044589)
DRV:64bit: - [2012/02/29 23:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/10/15 14:16:16 | 000,647,080 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfehidk.sys -- (mfehidk)
DRV:64bit: - [2011/10/15 14:16:16 | 000,481,768 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfefirek.sys -- (mfefirek)
DRV:64bit: - [2011/10/15 14:16:16 | 000,284,648 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfewfpk.sys -- (mfewfpk)
DRV:64bit: - [2011/10/15 14:16:16 | 000,229,528 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeavfk.sys -- (mfeavfk)
DRV:64bit: - [2011/10/15 14:16:16 | 000,160,280 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeapfk.sys -- (mfeapfk)
DRV:64bit: - [2011/10/15 14:16:16 | 000,100,912 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mferkdet.sys -- (mferkdet)
DRV:64bit: - [2011/10/15 14:16:16 | 000,075,808 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mfenlfk.sys -- (mfenlfk)
DRV:64bit: - [2011/10/15 14:16:16 | 000,065,264 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cfwids.sys -- (cfwids)
DRV:64bit: - [2011/04/20 01:22:34 | 000,306,176 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010/11/20 06:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 06:32:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 06:32:46 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2010/11/20 04:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/09/29 06:01:46 | 000,695,400 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RTL8192su.sys -- (RTL8192su)
DRV:64bit: - [2010/07/21 16:59:28 | 000,045,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2009/12/10 17:40:28 | 006,179,328 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009/12/10 17:40:28 | 006,179,328 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2009/10/16 04:32:24 | 000,321,064 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink ™
DRV:64bit: - [2009/10/02 13:58:58 | 000,537,112 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009/09/30 23:34:00 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009/09/26 08:42:58 | 000,233,984 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel®
DRV:64bit: - [2009/09/17 13:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel®
DRV:64bit: - [2009/07/13 18:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 18:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 18:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 17:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009/07/09 03:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2009/06/10 13:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 13:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 13:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 13:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2007/09/06 21:53:00 | 000,016,384 | ---- | M] (Silicon Laboratories) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\DSI_SiUSBXp_3_1.sys -- (DSI_SiUSBXp_3_1)
DRV:64bit: - [2006/11/01 09:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV - [2009/07/13 18:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009/06/26 08:27:28 | 000,065,520 | ---- | M] (Sonic Solutions) [File_System | System | Stopped] -- C:\Windows\SysWOW64\drivers\RxFilter.sys -- (RxFilter)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {A24E3311-6099-4742-B8EF-15239EF478D3}
IE:64bit: - HKLM\..\SearchScopes\{A24E3311-6099-4742-B8EF-15239EF478D3}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKLM\..\SearchScopes,DefaultScope = {BBDB58D9-ED7F-4BB7-9EF6-C3962031490A}
IE - HKLM\..\SearchScopes\{BBDB58D9-ED7F-4BB7-9EF6-C3962031490A}: "URL" = http://www.bing.com/...rc=IE-SearchBox

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3366800603-694017702-1191280905-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKU\S-1-5-21-3366800603-694017702-1191280905-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-3366800603-694017702-1191280905-1001\..\SearchScopes,DefaultScope = {36377DD7-B3EB-42f5-986F-680BAF59BA9D}
IE - HKU\S-1-5-21-3366800603-694017702-1191280905-1001\..\SearchScopes\{36377DD7-B3EB-42f5-986F-680BAF59BA9D}: "URL" = http://start.msn.ipl...q={searchTerms}
IE - HKU\S-1-5-21-3366800603-694017702-1191280905-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKU\S-1-5-21-3366800603-694017702-1191280905-1001\..\SearchScopes\{BBDB58D9-ED7F-4BB7-9EF6-C3962031490A}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKU\S-1-5-21-3366800603-694017702-1191280905-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~2\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Sean\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Sean\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Sean\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Sean\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Sean\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

O1 HOSTS File: ([2011/09/06 10:25:26 | 000,000,184 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 blokus.com
O1 - Hosts: 127.0.0.1 blokus.fr
O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\mcafee\systemcore\ScriptSn.20120415130335.dll (McAfee, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\mcafee\SystemCore\ScriptSn.20120415130335.dll (McAfee, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (GamesBarBHO Class) - {CB0D163C-E9F4-4236-9496-0597E24B23A5} - C:\Program Files (x86)\GamesBar\2.0.1.59\oberontb.dll (Oberon Media Ltd.)
O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (@C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Zend Studio) - {95188727-288F-4581-A48D-EAB3BD027314} - C:\PROGRA~2\Zend\ZENDST~1.2\toolbars\ZENDIE~1.DLL File not found
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [itype] c:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RunDLLEntry_EptMon] C:\Windows\SysNative\EptMon64.DLL (Creative Technology Ltd.)
O4:64bit: - HKLM..\Run: [RunDLLEntry_THXCfg] C:\Windows\SysNative\THXCfg64.DLL (Creative Technology Ltd.)
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [Intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe (Intuit Inc. All rights reserved.)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [THX Audio Control Panel] C:\Program Files (x86)\Creative\THX TruStudio PC\THXAudioCP\THXAudio.exe (Creative Technology Ltd)
O4 - HKU\.DEFAULT..\Run: [Apple] C:\Users\Sean\AppData\Local\Apps\Apple\qnrxtf.dll (MainConcept GmbH)
O4 - HKU\S-1-5-18..\Run: [Apple] C:\Users\Sean\AppData\Local\Apps\Apple\qnrxtf.dll (MainConcept GmbH)
O4 - HKU\S-1-5-19..\Run: [Apple] C:\Users\Sean\AppData\Local\Apps\Apple\qnrxtf.dll (MainConcept GmbH)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Apple] C:\Users\Sean\AppData\Local\Apps\Apple\qnrxtf.dll (MainConcept GmbH)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3366800603-694017702-1191280905-1001..\Run: [ANT Agent] C:\Users\Sean\AppData\Roaming\Microsoft\Oxvpml\oxvpml.exe ()
O4 - HKU\S-1-5-21-3366800603-694017702-1191280905-1001..\Run: [Apple] C:\Users\Sean\AppData\Local\Apps\Apple\qnrxtf.dll (MainConcept GmbH)
O4 - HKU\S-1-5-21-3366800603-694017702-1191280905-1001..\Run: [omklm] C:\Users\Sean\AppData\Roaming\Microsoft\Oxvpml\oxvpml.exe ()
O4 - HKU\S-1-5-21-3366800603-694017702-1191280905-1001..\Run: [SearchEngineProtection] C:\Program Files (x86)\GamesBar\SearchEngineProtection.exe (Oberon Media )
O4 - HKLM..\RunOnce: [GrpConv] C:\Windows\SysWow64\grpconv.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKLM..\RunOnceEx: [ContentMerger] c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCom\ContentMerger10.exe (Sonic Solutions)
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not found
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-3366800603-694017702-1191280905-1001\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.appl...ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.m...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1D490E2E-9AE1-4F1F-83A3-C7FC20351125}: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8A407679-27E4-4AEF-A01C-8BBB2D930DF9}: DhcpNameServer = 192.168.0.1 205.171.3.25
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\intu-help-qb2 - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\qbwc - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\intu-help-qb2 {84D77A00-41B5-4b8b-8ADF-86486D72E749} - C:\Program Files (x86)\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/02/25 12:27:00 | 000,000,141 | -H-- | M] () - E:\Autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2008/08/26 06:33:31 | 003,122,519 | ---- | M] (EminiTradingStrategies.com ) - Z:\AutoTrader Strategy Setup.exe -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/04/23 13:06:59 | 000,594,944 | ---- | C] (OldTimer Tools) -- C:\Users\Sean\Desktop\OTL.exe
[2012/04/22 23:27:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2012/04/22 15:23:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2012/04/22 15:22:21 | 000,460,888 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\30044589.sys
[2012/04/22 13:52:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Robo TraderFX
[2012/04/22 13:52:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Robo TraderFX
[2012/04/22 12:21:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Keyboard
[2012/04/22 12:21:30 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft IntelliType Pro
[2012/04/18 06:53:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012/04/18 06:53:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012/04/17 10:32:26 | 000,000,000 | ---D | C] -- C:\Users\Sean\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Upd526
[2012/04/14 07:43:08 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SPReview
[2012/04/14 07:42:59 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\EventProviders
[2012/04/13 18:04:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2012/04/13 15:42:53 | 000,000,000 | ---D | C] -- C:\852b8a6f7a39a0e989cdeb36ac2d
[2012/04/13 15:34:26 | 000,116,224 | ---- | C] (Windows ® Codename Longhorn DDK provider) -- C:\Windows\SysNative\fms.dll
[2012/04/13 15:33:42 | 000,093,696 | ---- | C] (Windows ® Codename Longhorn DDK provider) -- C:\Windows\SysWow64\fms.dll
[2012/04/13 09:25:15 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2012/04/13 09:09:38 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012/04/12 13:01:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PC Tools
[2012/04/12 12:58:53 | 000,251,528 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\PCTSD64.sys
[2012/04/12 12:58:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PC Tools
[2012/04/12 12:55:19 | 000,000,000 | ---D | C] -- C:\Users\Sean\AppData\Roaming\TestApp
[2012/04/12 12:55:19 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2012/04/11 15:54:39 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2012/04/11 06:45:33 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012/04/11 06:09:12 | 000,000,000 | ---D | C] -- C:\Windows\system64
[2012/04/07 19:15:22 | 000,000,000 | ---D | C] -- C:\Users\Sean\AppData\Roaming\Mozilla
[2012/04/03 14:54:25 | 000,006,656 | ---- | C] (RoboTraderFX) -- C:\Windows\SysWow64\RoboTraderFX.dll
[1 C:\Users\Sean\Desktop\*.tmp files -> C:\Users\Sean\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/23 13:19:01 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3366800603-694017702-1191280905-1001UA.job
[2012/04/23 13:13:11 | 000,000,454 | ---- | M] () -- C:\Windows\cedt.INI
[2012/04/23 13:07:27 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Users\Sean\Desktop\OTL.exe
[2012/04/23 13:04:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/04/23 06:42:05 | 000,000,590 | ---- | M] () -- C:\Windows\tasks\TradeStation Backup - Daily.job
[2012/04/22 19:19:01 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3366800603-694017702-1191280905-1001Core.job
[2012/04/22 16:22:39 | 000,000,182 | -HS- | M] () -- C:\Windows\9950127drv.spi
[2012/04/22 14:56:34 | 000,002,364 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFX.tlb
[2012/04/22 13:44:05 | 000,006,656 | ---- | M] (RoboTraderFX) -- C:\Windows\SysWow64\RoboTraderFX.dll
[2012/04/22 13:44:04 | 000,015,872 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFX.pdb
[2012/04/22 13:40:23 | 011,545,600 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFXMT.pdb
[2012/04/22 13:40:23 | 000,197,632 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFXMT.dll
[2012/04/22 13:40:22 | 011,701,248 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFXI.pdb
[2012/04/22 13:40:22 | 000,210,432 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFXI.dll
[2012/04/22 13:40:22 | 000,003,206 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFXMT.lib
[2012/04/22 13:40:22 | 000,001,549 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFXMT.exp
[2012/04/22 13:40:20 | 000,003,430 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFXI.lib
[2012/04/22 13:40:20 | 000,001,611 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFXI.exp
[2012/04/22 13:17:00 | 000,000,043 | ---- | M] () -- C:\Windows\WALLSTRT.INI
[2012/04/22 13:10:27 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/22 13:10:27 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/22 13:02:38 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/04/22 13:02:25 | 2115,301,375 | -HS- | M] () -- C:\hiberfil.sys
[2012/04/22 13:00:22 | 000,485,680 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/04/21 17:33:07 | 000,460,888 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\30044589.sys
[2012/04/21 15:59:21 | 000,002,016 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2012/04/21 08:25:35 | 000,228,510 | ---- | M] () -- C:\Users\Sean\Documents\RTTSyncTest.wsp
[2012/04/21 08:25:08 | 000,001,365 | ---- | M] () -- C:\Windows\QUICKEN.INI
[2012/04/20 11:00:04 | 000,000,497 | ---- | M] () -- C:\StrategyMonitor2_1120420_EURUSD_Log.csv
[2012/04/19 18:42:05 | 000,003,584 | ---- | M] () -- C:\StrategyMonitor2_1120419_EURUSD_Log.csv
[2012/04/17 20:19:25 | 000,849,966 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/04/17 20:19:25 | 000,710,360 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/04/17 20:19:25 | 000,139,872 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/04/16 20:28:54 | 000,000,243 | ---- | M] () -- C:\Users\Sean\Desktop\icon.bat
[2012/04/13 10:56:29 | 000,003,352 | ---- | M] () -- C:\bootsqm.dat
[2012/04/13 09:09:45 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/04/12 12:59:43 | 001,479,216 | ---- | M] () -- C:\Windows\SysNative\drivers\Cat.DB
[2012/04/12 12:55:20 | 000,001,867 | ---- | M] () -- C:\Users\Sean\Desktop\sdasetup.exe.lnk
[2012/04/11 17:17:33 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/11 10:19:24 | 000,001,426 | ---- | M] () -- C:\MyWork 8.6.lnk
[2012/04/11 10:19:24 | 000,001,307 | ---- | M] () -- C:\MyWork 9.0.lnk
[2012/04/11 10:19:24 | 000,001,307 | ---- | M] () -- C:\MyWork 8.8.lnk
[2012/04/04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/04/04 09:41:11 | 000,000,316 | ---- | M] () -- C:\Windows\ODBC.INI
[2012/03/26 15:58:04 | 000,045,056 | ---- | M] () -- C:\Windows\SysWow64\cid2.dll
[1 C:\Users\Sean\Desktop\*.tmp files -> C:\Users\Sean\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/04/22 16:22:39 | 000,000,182 | -HS- | C] () -- C:\Windows\9950127drv.spi
[2012/04/22 13:40:23 | 000,197,632 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFXMT.dll
[2012/04/22 13:40:22 | 000,210,432 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFXI.dll
[2012/04/21 18:51:26 | 000,000,590 | ---- | C] () -- C:\Windows\tasks\TradeStation Backup - Daily.job
[2012/04/21 15:58:46 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2012/04/21 15:58:46 | 000,002,016 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2012/04/20 09:48:18 | 000,000,497 | ---- | C] () -- C:\StrategyMonitor2_1120420_EURUSD_Log.csv
[2012/04/19 06:29:30 | 000,003,584 | ---- | C] () -- C:\StrategyMonitor2_1120419_EURUSD_Log.csv
[2012/04/16 20:28:54 | 000,000,243 | ---- | C] () -- C:\Users\Sean\Desktop\icon.bat
[2012/04/15 17:11:31 | 011,701,248 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFXI.pdb
[2012/04/15 17:11:31 | 000,003,430 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFXI.lib
[2012/04/15 17:11:31 | 000,001,611 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFXI.exp
[2012/04/15 16:43:29 | 011,545,600 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFXMT.pdb
[2012/04/15 16:43:29 | 000,003,206 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFXMT.lib
[2012/04/15 16:43:29 | 000,001,549 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFXMT.exp
[2012/04/13 15:35:42 | 000,347,904 | ---- | C] () -- C:\Windows\SysNative\systemsf.ebd
[2012/04/13 15:32:52 | 000,010,429 | ---- | C] () -- C:\Windows\SysNative\ScavengeSpace.xml
[2012/04/13 15:32:12 | 000,105,559 | ---- | C] () -- C:\Windows\SysWow64\RacRules.xml
[2012/04/13 15:32:12 | 000,105,559 | ---- | C] () -- C:\Windows\SysNative\RacRules.xml
[2012/04/13 15:31:51 | 000,001,041 | ---- | C] () -- C:\Windows\SysWow64\tcpbidi.xml
[2012/04/13 10:56:29 | 000,003,352 | ---- | C] () -- C:\bootsqm.dat
[2012/04/13 09:09:45 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/04/12 12:58:58 | 001,479,216 | ---- | C] () -- C:\Windows\SysNative\drivers\Cat.DB
[2012/04/12 12:55:20 | 000,001,867 | ---- | C] () -- C:\Users\Sean\Desktop\sdasetup.exe.lnk
[2012/04/11 17:09:56 | 000,001,111 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/11 16:00:32 | 000,000,830 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/04/07 19:14:56 | 000,000,904 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3366800603-694017702-1191280905-1001UA.job
[2012/04/07 19:14:55 | 000,000,852 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3366800603-694017702-1191280905-1001Core.job
[2012/04/05 19:10:37 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\cid2.dll
[2012/04/03 14:54:25 | 000,015,872 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFX.pdb
[2012/04/03 14:54:25 | 000,002,364 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFX.tlb
[2012/03/15 09:10:45 | 000,196,608 | ---- | C] () -- C:\Windows\SysWow64\RBT1GLock32.dll
[2012/03/12 13:21:26 | 000,000,614 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
[2012/02/21 11:07:30 | 000,254,464 | ---- | C] () -- C:\Windows\SysWow64\RTTMCCheck64.dll
[2012/02/20 15:06:20 | 000,217,088 | ---- | C] () -- C:\Windows\SysWow64\RTTMCCheck.dll
[2012/01/29 16:47:12 | 000,000,110 | ---- | C] () -- C:\Users\Sean\AppData\Roaming\EA Installrecents.ini
[2012/01/06 10:39:37 | 000,200,704 | ---- | C] () -- C:\Windows\SysWow64\FastFileAppend.dll
[2011/12/10 16:57:36 | 000,218,624 | ---- | C] () -- C:\Windows\SysWow64\TTMMCCheck2.dll
[2011/10/29 14:26:46 | 000,192,512 | ---- | C] () -- C:\Windows\SysWow64\DBTSQLLoaderMC.dll
[2011/10/29 09:31:35 | 007,479,296 | ---- | C] () -- C:\Windows\SysWow64\TTM.GlobalVariable.dll
[2011/10/23 17:17:45 | 001,865,728 | ---- | C] () -- C:\Windows\SysWow64\TTMMCCheck.dll
[2011/10/06 07:11:22 | 000,217,088 | ---- | C] () -- C:\Windows\SysWow64\RTTMCCheck2.dll
[2011/09/28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011/09/14 13:57:29 | 003,387,392 | ---- | C] () -- C:\Windows\SysWow64\RTTDataMC.dll
[2011/08/09 19:13:56 | 000,192,512 | ---- | C] () -- C:\Windows\SysWow64\DBTSQLLoader.dll
[2011/08/09 19:13:40 | 000,192,512 | ---- | C] () -- C:\Windows\SysWow64\DBTSQLLoaderR.dll
[2011/08/05 17:10:49 | 000,000,032 | ---- | C] () -- C:\Windows\Autorun.INI
[2011/07/23 07:53:27 | 007,479,296 | ---- | C] () -- C:\Windows\SysWow64\DBGV.dll
[2011/07/20 17:19:27 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\SqlLoaderNetMC.dll
[2011/07/17 16:22:12 | 000,024,576 | ---- | C] ( ) -- C:\Windows\SysWow64\Interop.PLKit.dll
[2011/06/29 15:07:28 | 000,217,088 | ---- | C] () -- C:\Windows\SysWow64\FTOVIWrap.dll
[2011/06/20 16:14:18 | 028,664,832 | ---- | C] () -- C:\Windows\SysWow64\PosDataVal.dll
[2011/05/24 07:29:47 | 000,000,011 | ---- | C] () -- C:\Windows\SysWow64\$StiLocal.dat
[2011/05/24 07:29:47 | 000,000,011 | ---- | C] () -- C:\Windows\SysWow64\$StiDesk.dat
[2011/05/24 07:29:47 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\$StiTrigger.dat
[2011/05/24 07:29:47 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\$StiSymInfo.dat
[2011/05/24 07:29:13 | 000,000,274 | ---- | C] () -- C:\Windows\SysWow64\$StiFees.dat
[2011/05/24 07:29:13 | 000,000,041 | ---- | C] () -- C:\Windows\SysWow64\$StiListExchInfo.dat
[2011/05/24 07:29:12 | 000,000,270 | ---- | C] () -- C:\Windows\SysWow64\$StiLast.ini
[2011/05/24 07:29:12 | 000,000,087 | ---- | C] () -- C:\Windows\SysWow64\$StiValues.ini
[2011/05/07 15:02:58 | 000,303,104 | ---- | C] () -- C:\Windows\SysWow64\RTT1Lock32.dll
[2011/05/07 15:02:58 | 000,147,456 | ---- | C] () -- C:\Windows\SysWow64\RTT1LockPW32.exe
[2011/05/07 15:01:57 | 000,532,480 | ---- | C] () -- C:\Windows\SysWow64\RTTData.dll
[2011/04/27 09:32:42 | 001,868,800 | ---- | C] () -- C:\Windows\SysWow64\TTMCustomerCheck.dll
[2011/04/03 15:09:11 | 000,027,419 | ---- | C] () -- C:\Windows\WinSig.ini
[2011/04/03 15:09:11 | 000,002,980 | ---- | C] () -- C:\Windows\WinRos.ini
[2011/03/17 17:51:46 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011/03/10 11:25:01 | 000,098,304 | ---- | C] () -- C:\Windows\SysWow64\PositionMonitor.dll
[2011/02/06 10:18:21 | 000,000,000 | ---- | C] () -- C:\Windows\regset.INI
[2011/02/06 10:17:57 | 000,164,864 | ---- | C] () -- C:\Windows\SysWow64\patchw32.dll
[2011/02/06 10:17:56 | 000,158,720 | ---- | C] () -- C:\Windows\SysWow64\LFCMP61N.DLL
[2011/02/06 10:17:56 | 000,110,080 | ---- | C] () -- C:\Windows\SysWow64\Lfpng61n.dll
[2011/02/06 10:17:56 | 000,043,008 | ---- | C] () -- C:\Windows\SysWow64\LTFIL61N.DLL
[2011/02/06 10:17:56 | 000,017,920 | ---- | C] () -- C:\Windows\SysWow64\MSWTHK32.DLL
[2011/02/06 10:17:56 | 000,017,920 | ---- | C] () -- C:\Windows\SysWow64\IMPLODE.DLL
[2011/02/06 10:17:56 | 000,003,360 | ---- | C] () -- C:\Windows\SysWow64\MSWTHK16.DLL
[2011/01/24 16:07:18 | 025,627,648 | ---- | C] () -- C:\Windows\SysWow64\FundDataVal.dll
[2011/01/14 16:12:27 | 000,325,845 | ---- | C] () -- C:\Users\Sean\AppData\Local\debuggee.mdmp
[2010/11/03 14:38:16 | 000,446,464 | ---- | C] () -- C:\Windows\SysWow64\DTACollections.dll
[2010/10/07 09:15:19 | 000,106,496 | ---- | C] () -- C:\Windows\SysWow64\Test2005.dll
[2010/09/29 16:09:56 | 000,086,016 | ---- | C] () -- C:\Windows\SysWow64\NtDirect.dll
[2010/09/28 15:20:52 | 002,269,184 | ---- | C] () -- C:\Windows\SysWow64\SmarterStops2.dll
[2010/08/17 19:43:49 | 005,128,192 | ---- | C] () -- C:\Windows\SysWow64\DBTGlobalVariable.dll
[2010/07/28 14:26:12 | 002,269,184 | ---- | C] () -- C:\Windows\SysWow64\SmarterStops.dll
[2010/07/22 08:05:28 | 000,214,528 | ---- | C] () -- C:\Windows\SysWow64\TSCustomMatrixI.dll
[2010/06/30 10:35:56 | 000,007,599 | ---- | C] () -- C:\Users\Sean\AppData\Local\Resmon.ResmonCfg
[2010/06/13 08:04:47 | 027,846,144 | ---- | C] () -- C:\Windows\SysWow64\DBTradeVault_TS.dll
[2010/06/09 07:16:29 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\SqlLoaderNet.dll
[2010/06/06 13:08:29 | 000,038,421 | ---- | C] () -- C:\Users\Sean\AppData\Roaming\Comma Separated Values (DOS).ADR
[2010/06/04 11:06:36 | 000,040,960 | ---- | C] ( ) -- C:\Windows\SysWow64\Interop.TSKITLib.dll
[2010/06/04 11:06:36 | 000,020,480 | ---- | C] () -- C:\Windows\SysWow64\RKWebCheck.dll
[2010/06/04 11:06:36 | 000,011,776 | ---- | C] () -- C:\Windows\SysWow64\RKWebCheckI.dll
[2010/06/03 08:20:33 | 000,000,060 | ---- | C] () -- C:\Windows\TSSupp.INI
[2010/06/03 07:17:45 | 000,000,320 | ---- | C] () -- C:\Users\Sean\AppData\Roaming\SEC398299.trad
[2010/06/02 18:47:14 | 000,000,376 | ---- | C] () -- C:\Windows\TTM_uninstall.ini
[2010/06/01 08:26:06 | 000,196,096 | ---- | C] () -- C:\Windows\SysWow64\TSSpreadMatrix.dll
[2010/06/01 08:26:06 | 000,006,656 | ---- | C] () -- C:\Windows\SysWow64\SpreadMatrixData.dll
[2010/06/01 08:26:06 | 000,006,144 | ---- | C] () -- C:\Windows\SysWow64\TSSpreadMatrixNet.dll
[2010/05/31 10:22:50 | 000,009,728 | ---- | C] () -- C:\Windows\SysWow64\Backfill.dll
[2010/05/29 11:25:26 | 000,000,454 | ---- | C] () -- C:\Windows\cedt.INI
[2010/05/29 08:21:16 | 007,479,296 | ---- | C] () -- C:\Windows\SysWow64\GlobalVariable.dll
[2010/05/28 20:42:08 | 000,000,161 | ---- | C] () -- C:\Windows\DISPARAM.INI
[2010/05/28 19:47:45 | 000,000,576 | ---- | C] () -- C:\Users\Sean\AppData\Roaming\wklnhst.dat
[2010/05/28 12:47:49 | 000,000,064 | ---- | C] () -- C:\Windows\qwimp.ini
[2010/05/28 09:57:15 | 000,001,365 | ---- | C] () -- C:\Windows\QUICKEN.INI
[2010/05/28 09:54:18 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010/05/28 09:31:15 | 000,000,090 | ---- | C] () -- C:\Windows\QBChanUtil_Trigger.ini
[2010/05/28 08:42:01 | 000,446,464 | ---- | C] () -- C:\Windows\SysWow64\ELCollections.dll
[2010/05/28 08:40:53 | 000,000,320 | ---- | C] () -- C:\Users\Sean\AppData\Roaming\SEC429288.trad
[2010/05/28 06:56:05 | 000,000,316 | ---- | C] () -- C:\Windows\ODBC.INI
[2010/05/28 06:55:16 | 000,866,172 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010/05/27 19:59:18 | 000,000,043 | ---- | C] () -- C:\Windows\WALLSTRT.INI
[2010/05/21 07:10:14 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010/05/21 05:30:30 | 000,001,264 | ---- | C] () -- C:\Windows\THXCfg_SP_APOIM.ini
[2010/05/21 05:30:30 | 000,001,247 | ---- | C] () -- C:\Windows\THXCfg_HP_APOIM.ini
[2010/05/21 05:30:30 | 000,001,247 | ---- | C] () -- C:\Windows\THXCfg_APOIM.ini
[2010/05/21 05:30:27 | 000,177,664 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2010/05/21 05:30:27 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL

========== LOP Check ==========

[2010/11/20 16:53:01 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\calibre
[2011/04/03 15:09:42 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\counters
[2012/04/11 04:41:42 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\DDS
[2012/01/29 16:37:40 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\EA Install
[2012/02/29 16:45:40 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\ECSoftware
[2011/04/04 06:38:00 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\eSignal
[2012/01/05 07:34:07 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\Garmin
[2010/05/28 20:16:10 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\Leadertech
[2010/09/13 08:42:04 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\Oberon Media
[2010/06/17 13:40:06 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\PFGBEST.com
[2010/05/28 20:43:23 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\PFU
[2011/05/13 07:32:35 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\RINA Technologies
[2011/10/25 12:20:12 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\TeamViewer
[2010/05/28 19:47:46 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\Template
[2012/04/12 12:55:19 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\TestApp
[2010/05/27 20:01:37 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\TradeStation Technologies
[2012/02/14 09:49:29 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\TS Support
[2012/04/13 09:15:50 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\uTorrent
[2011/06/15 17:28:17 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\Windows Live Writer
[2009/07/13 22:08:49 | 000,020,412 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012/04/23 06:42:05 | 000,000,590 | ---- | M] () -- C:\Windows\Tasks\TradeStation Backup - Daily.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2007/11/07 08:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe

< MD5 for: EXPLORER.EXE >
[2010/05/21 08:02:07 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=00B0358734CAA32C39D181FE6916B178 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_b8b0208ee0ce1889\explorer.exe
[2011/02/25 23:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/25 22:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 18:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/25 22:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2010/05/21 08:02:11 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/25 22:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/24 23:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/25 23:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 05:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\SysWOW64\explorer.exe
[2010/11/20 05:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2010/05/21 08:02:07 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=6D4F9E4B640B413C6F73414327484C80 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_addea9f19345cd81\explorer.exe
[2010/05/21 08:02:08 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/24 22:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/05/21 08:02:11 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2010/05/21 08:02:08 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 06:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\explorer.exe
[2010/11/20 06:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2010/05/21 08:02:11 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2010/05/21 08:02:08 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/13 18:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2010/05/21 08:02:11 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2010/05/21 08:02:07 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=CA17F8620815267DC838E30B68CB5052 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_ae5b763cac6d568e\explorer.exe
[2011/02/25 23:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2010/05/21 08:02:08 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[2010/05/21 08:02:07 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=FC89FACA0473641CB625EDA9277D0885 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_b8335443c7a68f7c\explorer.exe

< MD5 for: SVCHOST.EXE >
[2012/04/04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2009/07/13 18:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\SysWOW64\svchost.exe
[2009/07/13 18:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2009/07/13 18:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\SysNative\svchost.exe
[2009/07/13 18:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\system64\svchost.exe
[2009/07/13 18:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 05:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010/11/20 05:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 18:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/13 18:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 06:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010/11/20 06:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\system64\userinit.exe
[2010/11/20 06:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2012/04/04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010/11/20 06:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010/11/20 06:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\system64\winlogon.exe
[2010/11/20 06:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/13 18:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2010/05/21 08:02:11 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2010/05/21 08:02:11 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

< %Temp%\smtmp\1\*.* >

< %Temp%\smtmp\2\*.* >

< %Temp%\smtmp\3\*.* >

< %Temp%\smtmp\4\*.* >

< type c:\diskreport.txt /c >
Microsoft DiskPart version 6.1.7601
Copyright © 1999-2008 Microsoft Corporation.
On computer: DELLXPSWIN7
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volume 0 D DVD-ROM 0 B No Media
Volume 1 RECOVERY NTFS Partition 9 GB Healthy System
Volume 2 C OS NTFS Partition 921 GB Healthy Boot
Volume 3 E FreeAgent D NTFS Partition 698 GB Healthy
Volume 4 F Removable 0 B No Media
Volume 5 G Removable 0 B No Media
Volume 6 H Removable 0 B No Media
Volume 7 I Removable 0 B No Media

< >

========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\Windows\system64] -> \systemroot\system32 -> Mount Point

========== Alternate Data Streams ==========

@Alternate Data Stream - 152 bytes -> C:\ProgramData\TEMP:322EAACD
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >

Attached Files

OTL.Txt 127.13KB 74 downloads

#47
Essexboy

Posted 23 April 2012 - 03:20 PM

GeekU Moderator

Retired Staff
69,964 posts

Well those jumped straight out at me

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run
To disable MBAM
Open the scanner and select the protection tab
Remove the tick from "Start with Windows"
Reboot and then run OTL
Posted Image

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
O4 - HKU\S-1-5-21-3366800603-694017702-1191280905-1001..\Run: [ANT Agent] C:\Users\Sean\AppData\Roaming\Microsoft\Oxvpml\oxvpml.exe ()
O4 - HKU\S-1-5-21-3366800603-694017702-1191280905-1001..\Run: [Apple] C:\Users\Sean\AppData\Local\Apps\Apple\qnrxtf.dll (MainConcept GmbH)
O4 - HKU\S-1-5-21-3366800603-694017702-1191280905-1001..\Run: [omklm] C:\Users\Sean\AppData\Roaming\Microsoft\Oxvpml\oxvpml.exe ()
O4 - HKU\.DEFAULT..\Run: [Apple] C:\Users\Sean\AppData\Local\Apps\Apple\qnrxtf.dll (MainConcept GmbH)
O4 - HKU\S-1-5-18..\Run: [Apple] C:\Users\Sean\AppData\Local\Apps\Apple\qnrxtf.dll (MainConcept GmbH)
O4 - HKU\S-1-5-19..\Run: [Apple] C:\Users\Sean\AppData\Local\Apps\Apple\qnrxtf.dll (MainConcept GmbH)
O4 - HKU\S-1-5-20..\Run: [Apple] C:\Users\Sean\AppData\Local\Apps\Apple\qnrxtf.dll (MainConcept GmbH)
[C:\Windows\system64] -> \systemroot\system32 -> Mount Point

:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.
Accept the disclaimer and allow to update if it asks
When finished, it shall produce a log for you.
Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

#48
sean.dbtrader

Posted 23 April 2012 - 07:25 PM

Member

Topic Starter
Member
73 posts

Computer seems to be running better now and no google redirect. Thank you.

Attached are the OTL and ComboFix files.

OTL logfile created on: 4/23/2012 3:07:38 PM - Run 12
OTL by OldTimer - Version 3.2.41.0 Folder = C:\Users\Sean\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.96 Gb Total Physical Memory | 5.84 Gb Available Physical Memory | 73.38% Memory free
15.92 Gb Paging File | 13.52 Gb Available in Paging File | 84.92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 921.56 Gb Total Space | 617.31 Gb Free Space | 66.99% Space Free | Partition Type: NTFS
Drive E: | 698.64 Gb Total Space | 266.88 Gb Free Space | 38.20% Space Free | Partition Type: NTFS
Drive W: | 288.04 Gb Total Space | 93.55 Gb Free Space | 32.48% Space Free | Partition Type: NTFS
Drive X: | 288.04 Gb Total Space | 93.55 Gb Free Space | 32.48% Space Free | Partition Type: NTFS
Drive Z: | 288.04 Gb Total Space | 93.55 Gb Free Space | 32.48% Space Free | Partition Type: NTFS

Computer Name: DELLXPSWIN7 | User Name: Sean | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/23 13:07:27 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Users\Sean\Desktop\OTL.exe
PRC - [2012/02/06 16:25:08 | 000,013,672 | ---- | M] (Intuit Inc.) -- C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
PRC - [2011/12/22 05:31:08 | 000,045,056 | ---- | M] (Intuit) -- C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
PRC - [2011/04/08 05:50:02 | 000,542,264 | ---- | M] (Google) -- C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe
PRC - [2010/07/15 06:53:02 | 000,546,200 | ---- | M] (Oberon Media ) -- C:\Program Files (x86)\GamesBar\SearchEngineProtection.exe
PRC - [2010/05/21 04:30:20 | 005,207,336 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer.exe
PRC - [2010/05/21 04:27:04 | 000,173,352 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe
PRC - [2009/10/02 11:26:12 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2009/10/02 11:26:10 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
PRC - [2009/06/09 07:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) -- C:\Program Files\Dell\DellDock\DockLogin.exe
PRC - [2009/05/21 06:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
PRC - [2008/02/27 19:02:30 | 001,159,168 | R--- | M] (PFU LIMITED) -- C:\Program Files (x86)\PFU\ScanSnap\Driver\PfuSsMon.exe
PRC - [2007/02/16 21:08:14 | 000,057,344 | ---- | M] (Nalpeiron Ltd.) -- C:\Windows\SysWOW64\AstSrv.exe

========== Modules (No Company Name) ==========

MOD - [2012/04/22 12:37:26 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\47b9e7f070271ff50f988f75ea68fa3e\WindowsBase.ni.dll
MOD - [2012/04/22 12:27:50 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\a1c4a635721f85bef0ea4194b888b871\System.Runtime.Remoting.ni.dll
MOD - [2012/04/22 12:27:46 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6c51e152e7404188914c9fa4d8503ff9\System.Windows.Forms.ni.dll
MOD - [2012/04/22 12:27:41 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ab87129c2b603f218e4aa5300c9b1bdd\System.Drawing.ni.dll
MOD - [2012/04/22 12:27:35 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\9866d1f6178e1cde25642f1ac293ff8d\System.Xml.ni.dll
MOD - [2012/04/22 12:27:33 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e620323cacb5b6bfd93fd28d263440e4\System.Configuration.ni.dll
MOD - [2012/04/22 12:27:32 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\faf4e8730ecbd07570111bb7c3b20565\System.ni.dll
MOD - [2012/04/22 12:27:27 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll
MOD - [2011/10/05 04:52:30 | 000,756,048 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\MSPTLS.DLL
MOD - [2008/10/26 05:42:14 | 000,065,376 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\ColleagueImport.dll
MOD - [2007/06/26 20:27:18 | 000,167,936 | ---- | M] () -- C:\Program Files (x86)\PFU\ScanSnap\Driver\SSsltsa.dll
MOD - [2006/10/27 15:35:18 | 000,436,512 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll
MOD - [2006/10/12 15:14:50 | 000,036,864 | ---- | M] () -- C:\Program Files (x86)\PFU\ScanSnap\Driver\PfuUpdater.dll
MOD - [2003/03/26 18:46:36 | 000,135,168 | ---- | M] () -- C:\Program Files (x86)\PFU\ScanSnap\Driver\PfuSsImgIO.dll

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/10/18 15:32:28 | 000,161,168 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\systemcore\mfevtps.exe -- (mfevtp)
SRV:64bit: - [2011/10/18 15:23:24 | 000,208,536 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe -- (mfefire)
SRV:64bit: - [2011/10/18 15:23:06 | 000,199,272 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield)
SRV:64bit: - [2011/03/17 16:39:40 | 000,501,768 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\mcafee\virusscan\mcods.exe -- (McODS)
SRV:64bit: - [2011/01/27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McProxy)
SRV:64bit: - [2011/01/27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McOobeSv)
SRV:64bit: - [2011/01/27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McNASvc)
SRV:64bit: - [2011/01/27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (McNaiAnn)
SRV:64bit: - [2011/01/27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe -- (mcmscsvc)
SRV:64bit: - [2011/01/27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McMPFSvc)
SRV:64bit: - [2009/12/10 15:15:04 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009/07/13 18:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/06/09 07:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) [Auto | Running] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)
SRV:64bit: - [2008/07/29 13:20:28 | 004,737,024 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe -- (msvsmon90)
SRV:64bit: - [2005/09/23 03:26:42 | 004,476,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x64\msvsmon.exe -- (msvsmon80)
SRV - [2012/04/13 18:04:22 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/02/29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/02/06 16:25:08 | 000,013,672 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe -- (IntuitUpdateServiceV4)
SRV - [2011/12/22 05:31:08 | 000,045,056 | ---- | M] (Intuit) [Auto | Running] -- C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe -- (QBCFMonitorService)
SRV - [2010/05/21 05:29:52 | 001,045,256 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/05/21 05:18:12 | 000,016,680 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe -- (GoToAssist)
SRV - [2010/05/21 04:27:04 | 000,173,352 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/10/02 11:26:12 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel®
SRV - [2009/06/26 09:19:12 | 001,124,848 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCom\RoxMediaDB10.exe -- (RoxMediaDB10)
SRV - [2009/06/10 14:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/05/21 06:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter)
SRV - [2009/02/25 19:06:42 | 000,013,088 | ---- | M] (Intuit Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
SRV - [2008/11/18 15:45:28 | 000,061,440 | ---- | M] (Intuit Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe -- (QBFCService)
SRV - [2007/05/31 17:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007/05/31 17:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2007/02/16 21:08:14 | 000,057,344 | ---- | M] () [Auto | Running] -- C:\Windows\SysWow64\\AstSrv.exe -- (Ast Service)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/02/29 23:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/10/15 14:16:16 | 000,647,080 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfehidk.sys -- (mfehidk)
DRV:64bit: - [2011/10/15 14:16:16 | 000,481,768 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfefirek.sys -- (mfefirek)
DRV:64bit: - [2011/10/15 14:16:16 | 000,284,648 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfewfpk.sys -- (mfewfpk)
DRV:64bit: - [2011/10/15 14:16:16 | 000,229,528 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeavfk.sys -- (mfeavfk)
DRV:64bit: - [2011/10/15 14:16:16 | 000,160,280 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeapfk.sys -- (mfeapfk)
DRV:64bit: - [2011/10/15 14:16:16 | 000,100,912 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mferkdet.sys -- (mferkdet)
DRV:64bit: - [2011/10/15 14:16:16 | 000,075,808 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mfenlfk.sys -- (mfenlfk)
DRV:64bit: - [2011/10/15 14:16:16 | 000,065,264 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cfwids.sys -- (cfwids)
DRV:64bit: - [2011/04/20 01:22:34 | 000,306,176 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010/11/20 06:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 06:32:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 06:32:46 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2010/11/20 04:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/09/29 06:01:46 | 000,695,400 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RTL8192su.sys -- (RTL8192su)
DRV:64bit: - [2010/07/21 16:59:28 | 000,045,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2009/12/10 17:40:28 | 006,179,328 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009/12/10 17:40:28 | 006,179,328 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2009/10/16 04:32:24 | 000,321,064 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink ™
DRV:64bit: - [2009/10/02 13:58:58 | 000,537,112 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009/09/30 23:34:00 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009/09/26 08:42:58 | 000,233,984 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel®
DRV:64bit: - [2009/09/17 13:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel®
DRV:64bit: - [2009/07/13 18:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 18:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 18:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 17:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009/07/09 03:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2009/06/10 13:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 13:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 13:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 13:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2007/09/06 21:53:00 | 000,016,384 | ---- | M] (Silicon Laboratories) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\DSI_SiUSBXp_3_1.sys -- (DSI_SiUSBXp_3_1)
DRV:64bit: - [2006/11/01 09:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV - [2009/07/13 18:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009/06/26 08:27:28 | 000,065,520 | ---- | M] (Sonic Solutions) [File_System | System | Stopped] -- C:\Windows\SysWOW64\drivers\RxFilter.sys -- (RxFilter)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {A24E3311-6099-4742-B8EF-15239EF478D3}
IE:64bit: - HKLM\..\SearchScopes\{A24E3311-6099-4742-B8EF-15239EF478D3}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKLM\..\SearchScopes,DefaultScope = {BBDB58D9-ED7F-4BB7-9EF6-C3962031490A}
IE - HKLM\..\SearchScopes\{BBDB58D9-ED7F-4BB7-9EF6-C3962031490A}: "URL" = http://www.bing.com/...rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\SearchScopes,DefaultScope = {36377DD7-B3EB-42f5-986F-680BAF59BA9D}
IE - HKCU\..\SearchScopes\{36377DD7-B3EB-42f5-986F-680BAF59BA9D}: "URL" = http://start.msn.ipl...q={searchTerms}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKCU\..\SearchScopes\{BBDB58D9-ED7F-4BB7-9EF6-C3962031490A}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~2\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Sean\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Sean\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Sean\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Sean\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Sean\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

O1 HOSTS File: ([2012/04/23 14:58:53 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\mcafee\systemcore\ScriptSn.20120415130335.dll (McAfee, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\mcafee\SystemCore\ScriptSn.20120415130335.dll (McAfee, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (GamesBarBHO Class) - {CB0D163C-E9F4-4236-9496-0597E24B23A5} - C:\Program Files (x86)\GamesBar\2.0.1.59\oberontb.dll (Oberon Media Ltd.)
O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (@C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Zend Studio) - {95188727-288F-4581-A48D-EAB3BD027314} - C:\PROGRA~2\Zend\ZENDST~1.2\toolbars\ZENDIE~1.DLL File not found
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [itype] c:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RunDLLEntry_EptMon] C:\Windows\SysNative\EptMon64.DLL (Creative Technology Ltd.)
O4:64bit: - HKLM..\Run: [RunDLLEntry_THXCfg] C:\Windows\SysNative\THXCfg64.DLL (Creative Technology Ltd.)
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [Intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe (Intuit Inc. All rights reserved.)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [THX Audio Control Panel] C:\Program Files (x86)\Creative\THX TruStudio PC\THXAudioCP\THXAudio.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [SearchEngineProtection] C:\Program Files (x86)\GamesBar\SearchEngineProtection.exe (Oberon Media )
O4 - HKLM..\RunOnceEx: [ContentMerger] c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCom\ContentMerger10.exe (Sonic Solutions)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.appl...ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.m...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1D490E2E-9AE1-4F1F-83A3-C7FC20351125}: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8A407679-27E4-4AEF-A01C-8BBB2D930DF9}: DhcpNameServer = 192.168.0.1 205.171.3.25
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\intu-help-qb2 - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\qbwc - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\intu-help-qb2 {84D77A00-41B5-4b8b-8ADF-86486D72E749} - C:\Program Files (x86)\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/02/25 12:27:00 | 000,000,141 | -H-- | M] () - E:\Autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2008/08/26 06:33:31 | 003,122,519 | ---- | M] (EminiTradingStrategies.com ) - Z:\AutoTrader Strategy Setup.exe -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/04/23 15:09:56 | 004,473,179 | ---- | C] (Swearware) -- C:\Users\Sean\Desktop\ComboFix.exe
[2012/04/23 15:09:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2012/04/23 13:06:59 | 000,594,944 | ---- | C] (OldTimer Tools) -- C:\Users\Sean\Desktop\OTL.exe
[2012/04/22 15:23:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2012/04/22 13:52:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Robo TraderFX
[2012/04/22 13:52:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Robo TraderFX
[2012/04/22 12:21:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Keyboard
[2012/04/22 12:21:30 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft IntelliType Pro
[2012/04/18 06:53:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012/04/18 06:53:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012/04/17 10:32:26 | 000,000,000 | ---D | C] -- C:\Users\Sean\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Upd526
[2012/04/14 07:43:08 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SPReview
[2012/04/14 07:42:59 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\EventProviders
[2012/04/13 18:04:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2012/04/13 15:42:53 | 000,000,000 | ---D | C] -- C:\852b8a6f7a39a0e989cdeb36ac2d
[2012/04/13 15:34:26 | 000,116,224 | ---- | C] (Windows ® Codename Longhorn DDK provider) -- C:\Windows\SysNative\fms.dll
[2012/04/13 15:33:42 | 000,093,696 | ---- | C] (Windows ® Codename Longhorn DDK provider) -- C:\Windows\SysWow64\fms.dll
[2012/04/13 09:25:15 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2012/04/13 09:09:38 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012/04/12 13:01:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PC Tools
[2012/04/12 12:58:53 | 000,251,528 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\PCTSD64.sys
[2012/04/12 12:58:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PC Tools
[2012/04/12 12:55:19 | 000,000,000 | ---D | C] -- C:\Users\Sean\AppData\Roaming\TestApp
[2012/04/12 12:55:19 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2012/04/11 15:54:39 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2012/04/11 06:45:33 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012/04/07 19:15:22 | 000,000,000 | ---D | C] -- C:\Users\Sean\AppData\Roaming\Mozilla
[2012/04/03 14:54:25 | 000,006,656 | ---- | C] (RoboTraderFX) -- C:\Windows\SysWow64\RoboTraderFX.dll
[1 C:\Users\Sean\Desktop\*.tmp files -> C:\Users\Sean\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/23 15:19:21 | 000,001,365 | ---- | M] () -- C:\Windows\QUICKEN.INI
[2012/04/23 15:19:03 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3366800603-694017702-1191280905-1001UA.job
[2012/04/23 15:11:35 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/23 15:11:35 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/23 15:10:05 | 004,473,179 | ---- | M] (Swearware) -- C:\Users\Sean\Desktop\ComboFix.exe
[2012/04/23 15:04:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/04/23 15:03:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/04/23 15:03:00 | 2115,301,375 | -HS- | M] () -- C:\hiberfil.sys
[2012/04/23 14:58:53 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts
[2012/04/23 13:13:11 | 000,000,454 | ---- | M] () -- C:\Windows\cedt.INI
[2012/04/23 13:07:27 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Users\Sean\Desktop\OTL.exe
[2012/04/23 06:42:05 | 000,000,590 | ---- | M] () -- C:\Windows\tasks\TradeStation Backup - Daily.job
[2012/04/22 19:19:01 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3366800603-694017702-1191280905-1001Core.job
[2012/04/22 16:22:39 | 000,000,182 | -HS- | M] () -- C:\Windows\9950127drv.spi
[2012/04/22 14:56:34 | 000,002,364 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFX.tlb
[2012/04/22 13:44:05 | 000,006,656 | ---- | M] (RoboTraderFX) -- C:\Windows\SysWow64\RoboTraderFX.dll
[2012/04/22 13:44:04 | 000,015,872 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFX.pdb
[2012/04/22 13:40:23 | 011,545,600 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFXMT.pdb
[2012/04/22 13:40:23 | 000,197,632 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFXMT.dll
[2012/04/22 13:40:22 | 011,701,248 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFXI.pdb
[2012/04/22 13:40:22 | 000,210,432 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFXI.dll
[2012/04/22 13:40:22 | 000,003,206 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFXMT.lib
[2012/04/22 13:40:22 | 000,001,549 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFXMT.exp
[2012/04/22 13:40:20 | 000,003,430 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFXI.lib
[2012/04/22 13:40:20 | 000,001,611 | ---- | M] () -- C:\Windows\SysWow64\RoboTraderFXI.exp
[2012/04/22 13:17:00 | 000,000,043 | ---- | M] () -- C:\Windows\WALLSTRT.INI
[2012/04/22 13:00:22 | 000,485,680 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/04/21 15:59:21 | 000,002,016 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2012/04/21 08:25:35 | 000,228,510 | ---- | M] () -- C:\Users\Sean\Documents\RTTSyncTest.wsp
[2012/04/20 11:00:04 | 000,000,497 | ---- | M] () -- C:\StrategyMonitor2_1120420_EURUSD_Log.csv
[2012/04/19 18:42:05 | 000,003,584 | ---- | M] () -- C:\StrategyMonitor2_1120419_EURUSD_Log.csv
[2012/04/17 20:19:25 | 000,849,966 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/04/17 20:19:25 | 000,710,360 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/04/17 20:19:25 | 000,139,872 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/04/16 20:28:54 | 000,000,243 | ---- | M] () -- C:\Users\Sean\Desktop\icon.bat
[2012/04/13 10:56:29 | 000,003,352 | ---- | M] () -- C:\bootsqm.dat
[2012/04/13 09:09:45 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/04/12 12:59:43 | 001,479,216 | ---- | M] () -- C:\Windows\SysNative\drivers\Cat.DB
[2012/04/12 12:55:20 | 000,001,867 | ---- | M] () -- C:\Users\Sean\Desktop\sdasetup.exe.lnk
[2012/04/11 17:17:33 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/11 10:19:24 | 000,001,426 | ---- | M] () -- C:\MyWork 8.6.lnk
[2012/04/11 10:19:24 | 000,001,307 | ---- | M] () -- C:\MyWork 9.0.lnk
[2012/04/11 10:19:24 | 000,001,307 | ---- | M] () -- C:\MyWork 8.8.lnk
[2012/04/04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/04/04 09:41:11 | 000,000,316 | ---- | M] () -- C:\Windows\ODBC.INI
[2012/03/26 15:58:04 | 000,045,056 | ---- | M] () -- C:\Windows\SysWow64\cid2.dll
[1 C:\Users\Sean\Desktop\*.tmp files -> C:\Users\Sean\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/04/22 16:22:39 | 000,000,182 | -HS- | C] () -- C:\Windows\9950127drv.spi
[2012/04/22 13:40:23 | 000,197,632 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFXMT.dll
[2012/04/22 13:40:22 | 000,210,432 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFXI.dll
[2012/04/21 18:51:26 | 000,000,590 | ---- | C] () -- C:\Windows\tasks\TradeStation Backup - Daily.job
[2012/04/21 15:58:46 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2012/04/21 15:58:46 | 000,002,016 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2012/04/20 09:48:18 | 000,000,497 | ---- | C] () -- C:\StrategyMonitor2_1120420_EURUSD_Log.csv
[2012/04/19 06:29:30 | 000,003,584 | ---- | C] () -- C:\StrategyMonitor2_1120419_EURUSD_Log.csv
[2012/04/16 20:28:54 | 000,000,243 | ---- | C] () -- C:\Users\Sean\Desktop\icon.bat
[2012/04/15 17:11:31 | 011,701,248 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFXI.pdb
[2012/04/15 17:11:31 | 000,003,430 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFXI.lib
[2012/04/15 17:11:31 | 000,001,611 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFXI.exp
[2012/04/15 16:43:29 | 011,545,600 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFXMT.pdb
[2012/04/15 16:43:29 | 000,003,206 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFXMT.lib
[2012/04/15 16:43:29 | 000,001,549 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFXMT.exp
[2012/04/13 15:35:42 | 000,347,904 | ---- | C] () -- C:\Windows\SysNative\systemsf.ebd
[2012/04/13 15:32:52 | 000,010,429 | ---- | C] () -- C:\Windows\SysNative\ScavengeSpace.xml
[2012/04/13 15:32:12 | 000,105,559 | ---- | C] () -- C:\Windows\SysWow64\RacRules.xml
[2012/04/13 15:32:12 | 000,105,559 | ---- | C] () -- C:\Windows\SysNative\RacRules.xml
[2012/04/13 15:31:51 | 000,001,041 | ---- | C] () -- C:\Windows\SysWow64\tcpbidi.xml
[2012/04/13 10:56:29 | 000,003,352 | ---- | C] () -- C:\bootsqm.dat
[2012/04/13 09:09:45 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/04/12 12:58:58 | 001,479,216 | ---- | C] () -- C:\Windows\SysNative\drivers\Cat.DB
[2012/04/12 12:55:20 | 000,001,867 | ---- | C] () -- C:\Users\Sean\Desktop\sdasetup.exe.lnk
[2012/04/11 17:09:56 | 000,001,111 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/11 16:00:32 | 000,000,830 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/04/07 19:14:56 | 000,000,904 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3366800603-694017702-1191280905-1001UA.job
[2012/04/07 19:14:55 | 000,000,852 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3366800603-694017702-1191280905-1001Core.job
[2012/04/05 19:10:37 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\cid2.dll
[2012/04/03 14:54:25 | 000,015,872 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFX.pdb
[2012/04/03 14:54:25 | 000,002,364 | ---- | C] () -- C:\Windows\SysWow64\RoboTraderFX.tlb
[2012/03/15 09:10:45 | 000,196,608 | ---- | C] () -- C:\Windows\SysWow64\RBT1GLock32.dll
[2012/03/12 13:21:26 | 000,000,614 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
[2012/02/21 11:07:30 | 000,254,464 | ---- | C] () -- C:\Windows\SysWow64\RTTMCCheck64.dll
[2012/02/20 15:06:20 | 000,217,088 | ---- | C] () -- C:\Windows\SysWow64\RTTMCCheck.dll
[2012/01/29 16:47:12 | 000,000,110 | ---- | C] () -- C:\Users\Sean\AppData\Roaming\EA Installrecents.ini
[2012/01/06 10:39:37 | 000,200,704 | ---- | C] () -- C:\Windows\SysWow64\FastFileAppend.dll
[2011/12/10 16:57:36 | 000,218,624 | ---- | C] () -- C:\Windows\SysWow64\TTMMCCheck2.dll
[2011/10/29 14:26:46 | 000,192,512 | ---- | C] () -- C:\Windows\SysWow64\DBTSQLLoaderMC.dll
[2011/10/29 09:31:35 | 007,479,296 | ---- | C] () -- C:\Windows\SysWow64\TTM.GlobalVariable.dll
[2011/10/23 17:17:45 | 001,865,728 | ---- | C] () -- C:\Windows\SysWow64\TTMMCCheck.dll
[2011/10/06 07:11:22 | 000,217,088 | ---- | C] () -- C:\Windows\SysWow64\RTTMCCheck2.dll
[2011/09/28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011/09/14 13:57:29 | 003,387,392 | ---- | C] () -- C:\Windows\SysWow64\RTTDataMC.dll
[2011/08/09 19:13:56 | 000,192,512 | ---- | C] () -- C:\Windows\SysWow64\DBTSQLLoader.dll
[2011/08/09 19:13:40 | 000,192,512 | ---- | C] () -- C:\Windows\SysWow64\DBTSQLLoaderR.dll
[2011/08/05 17:10:49 | 000,000,032 | ---- | C] () -- C:\Windows\Autorun.INI
[2011/07/23 07:53:27 | 007,479,296 | ---- | C] () -- C:\Windows\SysWow64\DBGV.dll
[2011/07/20 17:19:27 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\SqlLoaderNetMC.dll
[2011/07/17 16:22:12 | 000,024,576 | ---- | C] ( ) -- C:\Windows\SysWow64\Interop.PLKit.dll
[2011/06/29 15:07:28 | 000,217,088 | ---- | C] () -- C:\Windows\SysWow64\FTOVIWrap.dll
[2011/06/20 16:14:18 | 028,664,832 | ---- | C] () -- C:\Windows\SysWow64\PosDataVal.dll
[2011/05/24 07:29:47 | 000,000,011 | ---- | C] () -- C:\Windows\SysWow64\$StiLocal.dat
[2011/05/24 07:29:47 | 000,000,011 | ---- | C] () -- C:\Windows\SysWow64\$StiDesk.dat
[2011/05/24 07:29:47 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\$StiTrigger.dat
[2011/05/24 07:29:47 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\$StiSymInfo.dat
[2011/05/24 07:29:13 | 000,000,274 | ---- | C] () -- C:\Windows\SysWow64\$StiFees.dat
[2011/05/24 07:29:13 | 000,000,041 | ---- | C] () -- C:\Windows\SysWow64\$StiListExchInfo.dat
[2011/05/24 07:29:12 | 000,000,270 | ---- | C] () -- C:\Windows\SysWow64\$StiLast.ini
[2011/05/24 07:29:12 | 000,000,087 | ---- | C] () -- C:\Windows\SysWow64\$StiValues.ini
[2011/05/07 15:02:58 | 000,303,104 | ---- | C] () -- C:\Windows\SysWow64\RTT1Lock32.dll
[2011/05/07 15:02:58 | 000,147,456 | ---- | C] () -- C:\Windows\SysWow64\RTT1LockPW32.exe
[2011/05/07 15:01:57 | 000,532,480 | ---- | C] () -- C:\Windows\SysWow64\RTTData.dll
[2011/04/27 09:32:42 | 001,868,800 | ---- | C] () -- C:\Windows\SysWow64\TTMCustomerCheck.dll
[2011/04/03 15:09:11 | 000,027,419 | ---- | C] () -- C:\Windows\WinSig.ini
[2011/04/03 15:09:11 | 000,002,980 | ---- | C] () -- C:\Windows\WinRos.ini
[2011/03/17 17:51:46 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011/03/10 11:25:01 | 000,098,304 | ---- | C] () -- C:\Windows\SysWow64\PositionMonitor.dll
[2011/02/06 10:18:21 | 000,000,000 | ---- | C] () -- C:\Windows\regset.INI
[2011/02/06 10:17:57 | 000,164,864 | ---- | C] () -- C:\Windows\SysWow64\patchw32.dll
[2011/02/06 10:17:56 | 000,158,720 | ---- | C] () -- C:\Windows\SysWow64\LFCMP61N.DLL
[2011/02/06 10:17:56 | 000,110,080 | ---- | C] () -- C:\Windows\SysWow64\Lfpng61n.dll
[2011/02/06 10:17:56 | 000,043,008 | ---- | C] () -- C:\Windows\SysWow64\LTFIL61N.DLL
[2011/02/06 10:17:56 | 000,017,920 | ---- | C] () -- C:\Windows\SysWow64\MSWTHK32.DLL
[2011/02/06 10:17:56 | 000,017,920 | ---- | C] () -- C:\Windows\SysWow64\IMPLODE.DLL
[2011/02/06 10:17:56 | 000,003,360 | ---- | C] () -- C:\Windows\SysWow64\MSWTHK16.DLL
[2011/01/24 16:07:18 | 025,627,648 | ---- | C] () -- C:\Windows\SysWow64\FundDataVal.dll
[2011/01/14 16:12:27 | 000,325,845 | ---- | C] () -- C:\Users\Sean\AppData\Local\debuggee.mdmp
[2010/11/03 14:38:16 | 000,446,464 | ---- | C] () -- C:\Windows\SysWow64\DTACollections.dll
[2010/10/07 09:15:19 | 000,106,496 | ---- | C] () -- C:\Windows\SysWow64\Test2005.dll
[2010/09/29 16:09:56 | 000,086,016 | ---- | C] () -- C:\Windows\SysWow64\NtDirect.dll
[2010/09/28 15:20:52 | 002,269,184 | ---- | C] () -- C:\Windows\SysWow64\SmarterStops2.dll
[2010/08/17 19:43:49 | 005,128,192 | ---- | C] () -- C:\Windows\SysWow64\DBTGlobalVariable.dll
[2010/07/28 14:26:12 | 002,269,184 | ---- | C] () -- C:\Windows\SysWow64\SmarterStops.dll
[2010/07/22 08:05:28 | 000,214,528 | ---- | C] () -- C:\Windows\SysWow64\TSCustomMatrixI.dll
[2010/06/30 10:35:56 | 000,007,599 | ---- | C] () -- C:\Users\Sean\AppData\Local\Resmon.ResmonCfg
[2010/06/13 08:04:47 | 027,846,144 | ---- | C] () -- C:\Windows\SysWow64\DBTradeVault_TS.dll
[2010/06/09 07:16:29 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\SqlLoaderNet.dll
[2010/06/06 13:08:29 | 000,038,421 | ---- | C] () -- C:\Users\Sean\AppData\Roaming\Comma Separated Values (DOS).ADR
[2010/06/04 11:06:36 | 000,040,960 | ---- | C] ( ) -- C:\Windows\SysWow64\Interop.TSKITLib.dll
[2010/06/04 11:06:36 | 000,020,480 | ---- | C] () -- C:\Windows\SysWow64\RKWebCheck.dll
[2010/06/04 11:06:36 | 000,011,776 | ---- | C] () -- C:\Windows\SysWow64\RKWebCheckI.dll
[2010/06/03 08:20:33 | 000,000,060 | ---- | C] () -- C:\Windows\TSSupp.INI
[2010/06/03 07:17:45 | 000,000,320 | ---- | C] () -- C:\Users\Sean\AppData\Roaming\SEC398299.trad
[2010/06/02 18:47:14 | 000,000,376 | ---- | C] () -- C:\Windows\TTM_uninstall.ini
[2010/06/01 08:26:06 | 000,196,096 | ---- | C] () -- C:\Windows\SysWow64\TSSpreadMatrix.dll
[2010/06/01 08:26:06 | 000,006,656 | ---- | C] () -- C:\Windows\SysWow64\SpreadMatrixData.dll
[2010/06/01 08:26:06 | 000,006,144 | ---- | C] () -- C:\Windows\SysWow64\TSSpreadMatrixNet.dll
[2010/05/31 10:22:50 | 000,009,728 | ---- | C] () -- C:\Windows\SysWow64\Backfill.dll
[2010/05/29 11:25:26 | 000,000,454 | ---- | C] () -- C:\Windows\cedt.INI
[2010/05/29 08:21:16 | 007,479,296 | ---- | C] () -- C:\Windows\SysWow64\GlobalVariable.dll
[2010/05/28 20:42:08 | 000,000,161 | ---- | C] () -- C:\Windows\DISPARAM.INI
[2010/05/28 19:47:45 | 000,000,576 | ---- | C] () -- C:\Users\Sean\AppData\Roaming\wklnhst.dat
[2010/05/28 12:47:49 | 000,000,064 | ---- | C] () -- C:\Windows\qwimp.ini
[2010/05/28 09:57:15 | 000,001,365 | ---- | C] () -- C:\Windows\QUICKEN.INI
[2010/05/28 09:54:18 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010/05/28 09:31:15 | 000,000,090 | ---- | C] () -- C:\Windows\QBChanUtil_Trigger.ini
[2010/05/28 08:42:01 | 000,446,464 | ---- | C] () -- C:\Windows\SysWow64\ELCollections.dll
[2010/05/28 08:40:53 | 000,000,320 | ---- | C] () -- C:\Users\Sean\AppData\Roaming\SEC429288.trad
[2010/05/28 06:56:05 | 000,000,316 | ---- | C] () -- C:\Windows\ODBC.INI
[2010/05/28 06:55:16 | 000,866,172 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010/05/27 19:59:18 | 000,000,043 | ---- | C] () -- C:\Windows\WALLSTRT.INI
[2010/05/21 07:10:14 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010/05/21 05:30:30 | 000,001,264 | ---- | C] () -- C:\Windows\THXCfg_SP_APOIM.ini
[2010/05/21 05:30:30 | 000,001,247 | ---- | C] () -- C:\Windows\THXCfg_HP_APOIM.ini
[2010/05/21 05:30:30 | 000,001,247 | ---- | C] () -- C:\Windows\THXCfg_APOIM.ini
[2010/05/21 05:30:27 | 000,177,664 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2010/05/21 05:30:27 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL

========== LOP Check ==========

[2010/11/20 16:53:01 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\calibre
[2011/04/03 15:09:42 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\counters
[2012/04/11 04:41:42 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\DDS
[2012/01/29 16:37:40 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\EA Install
[2012/02/29 16:45:40 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\ECSoftware
[2011/04/04 06:38:00 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\eSignal
[2012/01/05 07:34:07 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\Garmin
[2010/05/28 20:16:10 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\Leadertech
[2010/09/13 08:42:04 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\Oberon Media
[2010/06/17 13:40:06 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\PFGBEST.com
[2010/05/28 20:43:23 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\PFU
[2011/05/13 07:32:35 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\RINA Technologies
[2011/10/25 12:20:12 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\TeamViewer
[2010/05/28 19:47:46 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\Template
[2012/04/12 12:55:19 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\TestApp
[2010/05/27 20:01:37 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\TradeStation Technologies
[2012/02/14 09:49:29 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\TS Support
[2012/04/13 09:15:50 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\uTorrent
[2011/06/15 17:28:17 | 000,000,000 | ---D | M] -- C:\Users\Sean\AppData\Roaming\Windows Live Writer
[2009/07/13 22:08:49 | 000,020,662 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012/04/23 06:42:05 | 000,000,590 | ---- | M] () -- C:\Windows\Tasks\TradeStation Backup - Daily.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 152 bytes -> C:\ProgramData\TEMP:322EAACD
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >

Attached Files

OTL.Txt 101.32KB 62 downloads
ComboFix.txt 28.18KB 125 downloads

#49
Essexboy

Posted 24 April 2012 - 01:01 PM

GeekU Moderator

Retired Staff
69,964 posts

I would like you to run for a day or so to ensure that it has all gone, especially as I did not see those bad boys on the first run.. I feel that you are now clean. But, discretion is the better part of valour

#50
sean.dbtrader

Posted 26 April 2012 - 08:37 PM

Member

Topic Starter
Member
73 posts

I'm now getting the message "A device attached to the system is not functioning" when running some programs including any new program I create in Visual Studio 2008. This was not happening a few days ago. Is this a virus or something else?

#51
sean.dbtrader

Posted 26 April 2012 - 09:04 PM

Member

Topic Starter
Member
73 posts

I rebooted and this error went away. At least for now.

#52
Essexboy

Posted 27 April 2012 - 12:41 PM

GeekU Moderator

Retired Staff
69,964 posts

This error is sometimes apparent when trying to connect to a domain on the network... A highly explanatory warnig :lol:

http://usrlocal.com/...ot-functioning/

#53
Essexboy

Posted 30 April 2012 - 11:41 AM

GeekU Moderator

Retired Staff
69,964 posts

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.