All attempts at Windows update are failing. The error codes say it's a problem with Windows installer. Because Windows installer is an integral part of Windows 7 I cannot reinstall it. Some online sites have suggested is a problem with folder permissions on the C:\Windows\Installer folder. However the installer is in C:\Windows\system32 and every time I tried to change permissions on that folder it will not let me.
Even if the Advanced System Protection program is not malware, there may have been other viruses or malware on the machine possibly obtained through ads on Facebook or suspicious emails "I like your profile and I really want to chat with you" (this guy isn't very Internet savvy. God knows what he's clicked on).
Attempts to download various programs such as Super anti-spyware and malware bites have failed to download. The only way I was able to install them was to download the installer file on a different PC and transfer it through file transfer on team viewer. I could then run both of those programs and the scans turned up nothing except the usual tracking cookies.
Attempts to change any system settings such as folder options, taskbar options, notification tray behavior etc. all seems to fail. When you try to make a change to the settings it does not stick. Attempts to disable or remove toolbars from Internet Explorer all fail. In many cases the disable button is gray and cannot be clicked on.
OTL and extra files are attached. This guy does not have a lot of stuff on his PC and so wiping it is an option. I'm not fully investigated but I think he's got an OS in a protected partition. He does not have a Windows installation CD. I would prefer not to wipe and start from scratch if we can come up with a way to repair the system.
The members of this forum have helped me work magic in the past. I'm hoping you can do it again.
OTL logfile created on: 9/19/2013 12:32:35 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Administrator\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16660)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.25 Gb Total Physical Memory | 2.25 Gb Available Physical Memory | 69.33% Memory free
6.50 Gb Paging File | 5.11 Gb Available in Paging File | 78.67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 694.40 Gb Total Space | 531.76 Gb Free Space | 76.58% Space Free | Partition Type: NTFS
Drive E: | 3.43 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: DUKE-HP505B | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013/09/19 12:31:50 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
PRC - [2013/09/12 04:31:24 | 004,536,160 | ---- | M] (TeamViewer GmbH) -- c:\Program Files\TeamViewer\Version8\TeamViewer_Desktop.exe
PRC - [2013/09/12 04:31:23 | 012,614,496 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version8\TeamViewer.exe
PRC - [2013/09/12 04:31:23 | 005,071,712 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
PRC - [2013/09/12 04:22:33 | 000,195,936 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version8\tv_w32.exe
PRC - [2013/09/03 16:42:21 | 000,257,136 | ---- | M] (Microsoft Corporation) -- C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
PRC - [2013/08/05 16:13:28 | 004,624,712 | ---- | M] (Mozy, Inc.) -- C:\Program Files\MozyHome\mozystat.exe
PRC - [2013/06/13 17:14:50 | 000,067,584 | ---- | M] (PasswordBox, Inc.) -- C:\Program Files\PasswordBox\pbbtnService.exe
PRC - [2013/05/23 16:11:42 | 000,119,056 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe
PRC - [2013/05/11 06:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013/04/16 03:07:08 | 000,039,056 | ---- | M] () -- C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
PRC - [2013/03/26 18:13:08 | 000,196,624 | ---- | M] (Nitro PDF Software) -- C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe
PRC - [2013/02/05 11:48:44 | 000,272,248 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe
PRC - [2012/11/22 22:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2012/10/02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/09/27 12:55:16 | 000,086,528 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
PRC - [2012/06/18 13:34:28 | 000,361,472 | ---- | M] (Alcatel-Lucent) -- C:\Program Files\Common Files\Motive\pcCMService.exe
PRC - [2012/03/12 22:02:26 | 000,069,640 | ---- | M] (Nalpeiron Ltd.) -- C:\Windows\System32\NLSSRV32.EXE
PRC - [2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/06/18 12:29:12 | 000,635,416 | ---- | M] (PDF Complete Inc) -- C:\Program Files\PDF Complete\pdfsvc.exe
PRC - [2008/08/01 05:01:22 | 001,832,192 | ---- | M] (Verdiem) -- C:\Program Files\Verdiem\PowerManager\PowerManager.exe
========== Modules (No Company Name) ==========
MOD - [2013/08/15 10:31:39 | 001,051,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\9a1bc983c28c695729b3e46acdc6933e\System.Management.ni.dll
MOD - [2013/08/15 10:03:27 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\c664f44617c6a89edcc171fa8596c89d\System.ServiceProcess.ni.dll
MOD - [2013/08/15 10:02:41 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\e06dbdafb38c38517aef61ac41e2fd9d\System.Runtime.Remoting.ni.dll
MOD - [2013/08/15 10:02:38 | 006,611,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\62f93ab850d8784b320de819666df705\System.Data.ni.dll
MOD - [2013/08/15 10:02:16 | 014,340,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\548bbc2efbc316bb53319785c6d18c44\PresentationFramework.ni.dll
MOD - [2013/08/15 10:02:03 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\28ea347a952d20959ac6ae02d7457d39\System.Windows.Forms.ni.dll
MOD - [2013/08/15 10:01:56 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5aa44bce7933e4de09d935848f868a4b\System.Drawing.ni.dll
MOD - [2013/08/15 10:01:55 | 012,238,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\f93d632cb58d2d161d60f7c6d0e725fc\PresentationCore.ni.dll
MOD - [2013/08/15 10:01:45 | 003,348,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1f6f220f9efe936d1158c79b9d4b451f\WindowsBase.ni.dll
MOD - [2013/08/15 10:01:39 | 005,464,064 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\09db78d6068543df01862a023aca785a\System.Xml.ni.dll
MOD - [2013/08/15 10:01:36 | 000,978,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\8f7d83126a3cf283e5ac97f2d6d99f12\System.Configuration.ni.dll
MOD - [2013/08/15 10:01:22 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5d22a30e587e2cac106b81fb351e7c08\System.ni.dll
MOD - [2013/07/11 06:47:08 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a2920ed81e097f8551231a9350697bbd\PresentationFramework.Aero.ni.dll
MOD - [2013/07/11 06:46:07 | 000,185,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\033da6b735d41afaa20309b5e87e2ae0\UIAutomationTypes.ni.dll
MOD - [2013/07/11 06:45:38 | 011,499,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll
MOD - [2012/11/18 16:15:46 | 000,037,280 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\HP.ActiveSupportLibrary\2.0.0.1__01a974bc1760f423\HP.ActiveSupportLibrary.dll
MOD - [2012/10/11 21:56:46 | 000,087,952 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/10/11 21:56:22 | 001,242,512 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010/11/04 21:58:05 | 002,927,616 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2009/07/15 20:51:04 | 000,061,440 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll
MOD - [2009/07/15 20:51:02 | 000,131,072 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll
MOD - [2009/07/15 20:50:58 | 000,040,960 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingServer.dll
MOD - [2009/07/15 20:50:56 | 000,036,864 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingClients.dll
MOD - [2009/07/15 20:50:56 | 000,007,680 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\RemotingClient.dll
MOD - [2009/07/15 20:50:54 | 000,005,632 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingInterface.dll
MOD - [2009/07/15 20:50:52 | 000,018,944 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingMessages.dll
MOD - [2009/07/15 20:50:44 | 000,028,672 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll
========== Services (SafeList) ==========
SRV - File not found [Auto | Stopped] -- C:\Users\Duke\AppData\Local\temp\7zS4731\hpslpsvc32.dll -- (HPSLPSVC)
SRV - File not found [Auto | Stopped] -- C:\Users\Duke\AppData\Local\Temp\000071~1.EXE -- (0000711334670334mcinstcleanup)
SRV - [2013/09/17 15:39:42 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/09/12 04:31:23 | 005,071,712 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe -- (TeamViewer8)
SRV - [2013/07/30 18:47:46 | 000,117,656 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/06/13 17:14:50 | 000,067,584 | ---- | M] (PasswordBox, Inc.) [Auto | Running] -- C:\Program Files\PasswordBox\pbbtnService.exe -- (PasswordBox)
SRV - [2013/05/27 00:57:27 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/05/23 16:11:42 | 000,119,056 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCore.exe -- (!SASCORE)
SRV - [2013/05/11 06:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013/04/16 03:07:08 | 000,039,056 | ---- | M] () [Auto | Running] -- C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe -- (RealNetworks Downloader Resolver Service)
SRV - [2013/03/26 18:13:08 | 000,196,624 | ---- | M] (Nitro PDF Software) [Auto | Running] -- C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe -- (NitroReaderDriverReadSpool3)
SRV - [2013/02/28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/02/05 11:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)
SRV - [2012/10/02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012/09/27 12:55:16 | 000,086,528 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Hewlett-Packard\HP Support Framework\HPSA_Service.exe -- (HP Support Assistant Service)
SRV - [2012/06/18 13:34:28 | 000,361,472 | ---- | M] (Alcatel-Lucent) [Auto | Running] -- C:\Program Files\Common Files\Motive\pcCMService.exe -- (pcCMService)
SRV - [2012/03/12 22:02:26 | 000,069,640 | ---- | M] (Nalpeiron Ltd.) [Auto | Running] -- C:\Windows\System32\NLSSRV32.EXE -- (nlsX86cc)
SRV - [2010/11/20 08:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/11/20 08:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2010/11/20 08:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2010/10/23 14:16:43 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/07/13 21:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/06/18 12:29:12 | 000,635,416 | ---- | M] (PDF Complete Inc) [Auto | Running] -- C:\Program Files\PDF Complete\pdfsvc.exe -- (pdfcDispatcher)
SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [On_Demand | Stopped] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/08/01 05:01:20 | 000,075,008 | ---- | M] (Verdiem) [Auto | Stopped] -- C:\Program Files\Verdiem\PowerManager\edsvc.exe -- (edsvc)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | System | Stopped] -- C:\Windows\system32\drivers\wncfomir.sys -- (wncfomir)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS -- (MRENDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS -- (MREMPR5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\ADMINI~1\AppData\Local\Temp\cpuz134\cpuz134_x32.sys -- (cpuz134)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Duke\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | Auto | Stopped] -- c:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys -- (AODDriver4.01)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\amdiox86.sys -- (amdiox86)
DRV - [2013/07/13 08:58:27 | 000,027,424 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hitmanpro36.sys -- (hitmanpro35)
DRV - [2013/06/20 20:02:44 | 000,142,496 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2013/05/20 12:43:33 | 000,013,560 | ---- | M] (GFI Software) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\gfibto.sys -- (gfibto)
DRV - [2013/04/11 11:06:45 | 000,041,584 | ---- | M] (ThreatTrack Security) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\gfiark.sys -- (gfiark)
DRV - [2013/01/10 15:41:34 | 000,037,064 | ---- | M] (Anchorfree Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\taphss6.sys -- (taphss6)
DRV - [2012/08/23 10:44:32 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2012/08/23 10:40:25 | 000,049,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2012/08/17 21:00:00 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2012/08/17 21:00:00 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/02/08 14:11:51 | 011,621,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2011/07/22 12:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011/07/12 17:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/11/20 08:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 08:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 08:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 06:06:36 | 000,117,760 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rmcast.sys -- (RMCAST)
DRV - [2010/11/20 05:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 05:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/09/22 16:17:32 | 000,015,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpdispm.sys -- (RDPDISPM)
DRV - [2010/04/30 18:09:44 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
DRV - [2010/04/30 18:09:22 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
DRV - [2009/12/30 11:21:18 | 000,027,192 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\revoflt.sys -- (Revoflt)
DRV - [2009/11/10 15:28:44 | 000,246,000 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SRS_PremiumSound_i386.sys -- (SRS_PremiumSound_Service)
DRV - [2009/07/31 01:12:54 | 000,287,392 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET)
DRV - [2009/06/22 23:35:00 | 000,212,000 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...&bd=all&pf=cmdt
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.snap.do/...Date=13/04/2013
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?...CID=msnHomepage
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snap.do/...Date=13/04/2013
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snap.do/...Date=13/04/2013
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snap.do/...Date=13/04/2013
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE10SR
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3508.0205: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF.PrevVerNRD: File not found
FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media )
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.2: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.2: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.2: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll File not found
FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5: C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/01/07 01:38:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FCE04E1F-9378-4f39-96F6-5689A9159E45}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/01/07 01:38:59 | 000,000,000 | ---D | M]
[2011/11/20 09:41:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Extensions
[2013/09/01 15:07:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/09/03 14:58:08 | 000,000,000 | ---D | M] (Define Ext) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2013/08/11 12:19:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/08/11 12:19:41 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/09/17 15:38:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\updated\extensions
[2013/09/17 15:38:28 | 000,000,000 | ---D | M] (Define Ext) -- C:\Program Files\Mozilla Firefox\updated\extensions\[email protected]
[2013/09/17 15:38:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions
[2013/09/17 15:38:58 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
O1 HOSTS File: ([2013/05/05 11:35:11 | 000,447,746 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 15373 more lines...
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll File not found
O2 - BHO: (PasswordBox Helper) - {5DB69B97-934B-451D-94DB-32EF802A01CD} - C:\Program Files\PasswordBox\Application\pbbtn.dll (PasswordBox, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - No CLSID value found.
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (PasswordBox Toolbar) - {25E2E5C9-C43C-4EE8-B23E-4383915F2BCE} - C:\Program Files\PasswordBox\Application\pbbtn.dll (PasswordBox, Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [Edison] C:\Program Files\Verdiem\PowerManager\PowerManager.exe (Verdiem)
O4 - HKLM..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe (PDF Complete Inc)
O4 - HKCU..\Run: [SkyDrive] C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)
O4 - HKCU..\RunOnce: [Uninstall C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910" File not found
O4 - HKCU..\RunOnce: [Uninstall C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\17.0.2010.0530_1] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\17.0.2010.0530_1" File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLockedUserId = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://utilities.pcp...ols/pcmatic.cab (PCPitstop Utility)
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20614.www2.h...pdetect1262.cab (GMNRev Class)
O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} http://zone.msn.com/...vl.cab55579.cab (ZPA_SHVL Object)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn...k.cab102118.cab (MSN Games - Installer)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcp.../PCPitStop2.cab (PCPitstop Exam)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D2C94D0C-AA1E-41BA-8942-C223B2B830DD}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D2C94D0C-AA1E-41BA-8942-C223B2B830DD}: NameServer = 8.8.8.8,8.8.4.4
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (MACHINE BootExecut)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2013/09/19 12:31:50 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
[2013/09/17 17:08:01 | 000,000,000 | ---D | C] -- C:\Temp
[2013/09/17 15:48:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2013/09/17 15:39:52 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee Security Scan
[2013/09/17 15:39:46 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee Security Scan
[2013/09/11 18:18:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector
[2013/09/11 18:12:12 | 000,027,192 | ---- | C] (VS Revo Group) -- C:\Windows\System32\drivers\revoflt.sys
[2013/09/11 18:12:12 | 000,000,000 | ---D | C] -- C:\ProgramData\VS Revo Group
[2013/09/11 18:12:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
[2013/09/11 18:12:11 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2013/09/11 14:40:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/09/11 14:40:33 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013/09/11 14:40:33 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013/09/11 13:57:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2013/09/11 13:57:40 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2013/09/11 13:57:40 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2013/09/08 18:12:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Systweak
[2013/09/08 17:35:58 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\adawarebp
[2013/09/04 16:52:38 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\LavasoftStatistics
[2013/09/04 16:51:49 | 000,000,000 | ---D | C] -- C:\ProgramData\blekko toolbars
[2013/09/04 16:51:40 | 000,000,000 | ---D | C] -- C:\Program Files\Toolbar Cleaner
[2013/09/04 16:51:34 | 000,000,000 | ---D | C] -- C:\Program Files\Lavasoft
[2013/09/04 15:40:33 | 000,000,000 | ---D | C] -- C:\Program Files\Advanced System Protector
[2013/09/03 13:45:10 | 000,000,000 | ---D | C] -- C:\07374f318e9024eb990d0701ec761199
[2013/09/03 13:42:41 | 000,000,000 | ---D | C] -- C:\560d6bcdc7dfb34c90b4c6087b77d3
[2013/09/03 12:05:51 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Documents\10 things the intern won’t tell you - 10 things - MarketWatch_files
[2013/09/01 15:51:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auslogics
[2013/09/01 15:51:14 | 000,000,000 | ---D | C] -- C:\Program Files\Auslogics
[2013/09/01 15:06:05 | 000,000,000 | ---D | C] -- C:\Mozilla
[2013/08/26 16:43:07 | 000,000,000 | ---D | C] -- C:\Oberon Media
[2013/08/24 01:15:31 | 000,000,000 | ---D | C] -- C:\Windows\System32\%LOCALAPPDATA%
[2013/08/24 01:00:32 | 000,000,000 | ---D | C] -- C:\adawarebp
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013/09/19 12:31:50 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
[2013/09/19 12:30:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/09/19 12:29:00 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/09/19 12:28:00 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\HP Photo Creations Communicator.job
[2013/09/19 12:19:44 | 000,000,878 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/09/19 12:19:37 | 000,000,396 | ---- | M] () -- C:\Windows\tasks\Wise Care 365.job
[2013/09/19 12:19:37 | 000,000,392 | ---- | M] () -- C:\Windows\tasks\DriverUpdate Startup.job
[2013/09/19 11:31:31 | 000,005,814 | ---- | M] () -- C:\Windows\mozy.flt
[2013/09/19 11:31:31 | 000,003,272 | ---- | M] () -- C:\Windows\mozy.blk
[2013/09/19 11:17:03 | 000,014,832 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/09/19 11:17:03 | 000,014,832 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/09/19 11:10:50 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2013/09/19 11:09:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/09/19 11:09:24 | 2616,696,832 | -HS- | M] () -- C:\hiberfil.sys
[2013/09/18 13:58:00 | 000,000,508 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 2e906e7d-0589-4821-a51d-f67192fbbb80.job
[2013/09/18 02:00:00 | 000,000,508 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 093a5736-5e31-4ea1-94c3-e1c41bb54106.job
[2013/09/17 17:10:59 | 000,015,202 | ---- | M] () -- C:\mbam-log-2013-09-17 (16-32-24) - Notepad.pdf
[2013/09/17 17:08:01 | 000,000,146 | ---- | M] () -- C:\Windows\System32\~.inf
[2013/09/17 15:48:26 | 000,001,925 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2013/09/17 15:48:26 | 000,001,925 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013/09/16 22:52:00 | 000,000,440 | ---- | M] () -- C:\Windows\tasks\Wise Registry Cleaner Schedule Task.job
[2013/09/16 18:48:13 | 000,000,438 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Duke.job
[2013/09/16 11:18:08 | 000,000,428 | ---- | M] () -- C:\Windows\tasks\Wise Disk Cleaner Schedule Task.job
[2013/09/15 03:00:02 | 000,000,380 | ---- | M] () -- C:\Windows\tasks\RegSERVO.job
[2013/09/11 20:23:54 | 000,002,150 | ---- | M] () -- C:\Windows\epplauncher.mif
[2013/09/11 18:12:13 | 000,001,232 | ---- | M] () -- C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
[2013/09/11 14:40:35 | 000,001,069 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/09/11 13:57:43 | 000,001,963 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2013/09/09 00:15:22 | 001,556,784 | ---- | M] () -- C:\Users\Administrator\Documents\Aiming Higher for Indiana's Future.mht
[2013/09/04 13:55:15 | 000,000,229 | ---- | M] () -- C:\prefs.js
[2013/09/04 10:25:37 | 000,007,641 | ---- | M] () -- C:\Users\Administrator\AppData\Local\resmon.resmoncfg
[2013/09/03 15:52:02 | 000,000,316 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForDuke.job
[2013/09/03 14:20:26 | 000,894,855 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn32.mht
[2013/09/03 14:13:44 | 001,573,257 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn31.mht
[2013/09/03 14:12:44 | 001,573,292 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn30.mht
[2013/09/03 14:11:40 | 001,573,728 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn29.mht
[2013/09/03 14:10:13 | 001,560,448 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn28.mht
[2013/09/03 14:09:11 | 001,573,292 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn27.mht
[2013/09/03 14:07:56 | 001,573,238 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn26.mht
[2013/09/03 14:07:18 | 001,569,272 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn25.mht
[2013/09/03 14:06:37 | 001,573,293 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn24.mht
[2013/09/03 14:05:05 | 001,573,255 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn23.mht
[2013/09/03 14:04:24 | 001,573,292 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn22.mht
[2013/09/03 14:03:50 | 001,573,293 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn21.mht
[2013/09/03 14:03:14 | 001,573,254 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn20.mht
[2013/09/03 14:02:42 | 001,573,293 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn19.mht
[2013/09/03 14:01:41 | 001,573,292 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn18.mht
[2013/09/03 14:01:15 | 001,573,292 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn17.mht
[2013/09/03 14:00:41 | 001,573,294 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn16.mht
[2013/09/03 13:59:57 | 001,573,257 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn15.mht
[2013/09/03 13:59:22 | 001,573,360 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn14.mht
[2013/09/03 13:58:45 | 001,573,172 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn13.mht
[2013/09/03 13:57:57 | 001,573,297 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn12.mht
[2013/09/03 13:57:21 | 001,573,296 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn11.mht
[2013/09/03 13:56:19 | 001,573,297 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn10.mht
[2013/09/03 13:55:33 | 001,573,258 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn9.mht
[2013/09/03 13:54:56 | 001,573,277 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn8.mht
[2013/09/03 13:54:25 | 001,573,259 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn7.mht
[2013/09/03 13:53:23 | 001,573,223 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn6.mht
[2013/09/03 13:52:55 | 001,573,296 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn5.mht
[2013/09/03 13:52:33 | 001,573,261 | ---- | M] () -- C:\Users\Administrator\Documents\4linkedin.mht
[2013/09/03 13:51:57 | 001,573,295 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn3.mht
[2013/09/03 13:51:07 | 001,573,220 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn2.mht
[2013/09/03 13:47:41 | 001,576,185 | ---- | M] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn.mht
[2013/09/03 12:05:53 | 000,132,364 | ---- | M] () -- C:\Users\Administrator\Documents\10 things the intern won’t tell you - 10 things - MarketWatch.htm
[2013/09/01 15:06:08 | 000,000,009 | ---- | M] () -- C:\END
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013/09/17 17:10:57 | 000,015,202 | ---- | C] () -- C:\mbam-log-2013-09-17 (16-32-24) - Notepad.pdf
[2013/09/17 17:08:01 | 000,000,146 | ---- | C] () -- C:\Windows\System32\~.inf
[2013/09/17 15:39:47 | 000,001,925 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2013/09/17 15:39:47 | 000,001,925 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013/09/11 18:12:13 | 000,001,232 | ---- | C] () -- C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
[2013/09/11 14:40:35 | 000,001,069 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/09/11 13:58:23 | 000,000,508 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 2e906e7d-0589-4821-a51d-f67192fbbb80.job
[2013/09/11 13:58:23 | 000,000,508 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 093a5736-5e31-4ea1-94c3-e1c41bb54106.job
[2013/09/11 13:57:43 | 000,001,963 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2013/09/09 00:15:20 | 001,556,784 | ---- | C] () -- C:\Users\Administrator\Documents\Aiming Higher for Indiana's Future.mht
[2013/09/04 15:40:33 | 000,017,136 | ---- | C] () -- C:\Windows\System32\sasnative32.exe
[2013/09/03 14:20:23 | 000,894,855 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn32.mht
[2013/09/03 14:13:43 | 001,573,257 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn31.mht
[2013/09/03 14:12:43 | 001,573,292 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn30.mht
[2013/09/03 14:11:38 | 001,573,728 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn29.mht
[2013/09/03 14:10:11 | 001,560,448 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn28.mht
[2013/09/03 14:09:09 | 001,573,292 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn27.mht
[2013/09/03 14:07:55 | 001,573,238 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn26.mht
[2013/09/03 14:07:13 | 001,569,272 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn25.mht
[2013/09/03 14:06:36 | 001,573,293 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn24.mht
[2013/09/03 14:05:04 | 001,573,255 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn23.mht
[2013/09/03 14:04:23 | 001,573,292 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn22.mht
[2013/09/03 14:03:48 | 001,573,293 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn21.mht
[2013/09/03 14:03:11 | 001,573,254 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn20.mht
[2013/09/03 14:02:41 | 001,573,293 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn19.mht
[2013/09/03 14:01:40 | 001,573,292 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn18.mht
[2013/09/03 14:01:14 | 001,573,292 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn17.mht
[2013/09/03 14:00:39 | 001,573,294 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn16.mht
[2013/09/03 13:59:56 | 001,573,257 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn15.mht
[2013/09/03 13:59:19 | 001,573,360 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn14.mht
[2013/09/03 13:58:44 | 001,573,172 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn13.mht
[2013/09/03 13:57:56 | 001,573,297 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn12.mht
[2013/09/03 13:57:20 | 001,573,296 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn11.mht
[2013/09/03 13:56:17 | 001,573,297 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn10.mht
[2013/09/03 13:55:32 | 001,573,258 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn9.mht
[2013/09/03 13:54:54 | 001,573,277 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn8.mht
[2013/09/03 13:54:23 | 001,573,259 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn7.mht
[2013/09/03 13:53:21 | 001,573,223 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn6.mht
[2013/09/03 13:52:54 | 001,573,296 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn5.mht
[2013/09/03 13:52:32 | 001,573,261 | ---- | C] () -- C:\Users\Administrator\Documents\4linkedin.mht
[2013/09/03 13:51:56 | 001,573,295 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn3.mht
[2013/09/03 13:51:05 | 001,573,220 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn2.mht
[2013/09/03 13:47:39 | 001,576,185 | ---- | C] () -- C:\Users\Administrator\Documents\People You May Know LinkedIn.mht
[2013/09/03 12:05:50 | 000,132,364 | ---- | C] () -- C:\Users\Administrator\Documents\10 things the intern won’t tell you - 10 things - MarketWatch.htm
[2013/07/18 16:43:11 | 000,000,706 | RHS- | C] () -- C:\Users\Administrator\ntuser.pol
[2013/06/07 14:02:26 | 000,221,292 | ---- | C] () -- C:\Windows\hpoins19.dat.temp
[2013/06/07 14:02:26 | 000,013,898 | ---- | C] () -- C:\Windows\hpomdl19.dat.temp
[2013/06/05 12:39:34 | 000,001,684 | ---- | C] () -- C:\Windows\System32\ASOROSet.bin
[2013/05/28 14:05:32 | 000,007,641 | ---- | C] () -- C:\Users\Administrator\AppData\Local\resmon.resmoncfg
[2013/05/06 09:37:31 | 000,000,162 | ---- | C] () -- C:\Windows\Reimage.ini
[2013/04/15 16:42:03 | 000,000,000 | ---- | C] () -- C:\ProgramData\2c3c3831423a295d594636_c
[2013/04/07 14:57:32 | 000,221,078 | ---- | C] () -- C:\Windows\hpoins19.dat
[2013/04/07 14:57:32 | 000,013,898 | ---- | C] () -- C:\Windows\hpomdl19.dat
[2013/03/18 16:19:22 | 000,246,000 | ---- | C] () -- C:\Windows\System32\drivers\SRS_PremiumSound_i386.sys
[2012/10/31 00:53:00 | 000,000,064 | ---- | C] () -- C:\Windows\GPlrLanc.dat
[2012/06/16 10:02:42 | 000,027,424 | ---- | C] () -- C:\Windows\System32\drivers\hitmanpro36.sys
[2012/05/02 12:11:56 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/05/02 12:11:56 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/05/02 12:11:55 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/05/02 12:11:55 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/05/02 12:11:55 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/03/12 22:00:40 | 000,508,224 | ---- | C] () -- C:\Windows\System32\ICCProfiles.dll
[2011/12/19 07:18:48 | 000,202,904 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT
[2011/10/13 15:53:18 | 000,056,832 | ---- | C] () -- C:\Windows\System32\OpenVideo.dll
[2011/10/13 15:53:02 | 000,056,832 | ---- | C] () -- C:\Windows\System32\OVDecoder.dll
========== ZeroAccess Check ==========
[2009/07/14 00:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/02/27 00:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\Windows\system32\wbem\fastprox.dll -- [2010/11/20 08:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\Windows\system32\wbem\wbemess.dll -- [2009/07/13 21:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
========== LOP Check ==========
[2013/06/01 05:16:52 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Ad-Aware Antivirus
[2013/04/11 14:22:06 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\DriverCure
[2013/06/04 14:20:19 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\FileOpen
[2013/04/03 19:20:37 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Free-backup.info
[2013/04/10 16:15:41 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\InterVideo
[2013/06/04 14:20:19 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Nitro
[2013/06/01 12:34:22 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Nitro PDF
[2013/04/11 23:59:00 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Oberon Media
[2013/04/11 14:22:06 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\ParetoLogic
[2013/04/07 13:47:32 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\PCCUStubInstaller
[2013/09/11 17:48:27 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Systweak
[2013/04/11 13:26:01 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Visan
[2013/09/04 11:05:35 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Windows Live Writer
[2013/04/08 13:16:47 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Wise Registry Cleaner
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 192 bytes -> C:\Windows:nlsPreferences
@Alternate Data Stream - 186 bytes -> C:\ProgramData\TEMP:C5B78274
@Alternate Data Stream - 150 bytes -> C:\ProgramData\TEMP:029E021F
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:0B4227B4
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:815D61C4
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:5C321E34
< End of report >