[lantis33]

Hello and thank you in advance for any help provided!

My issues seem to revolve around programs called Jotzey and savingsbul that appeared on my computer when I needed an xml reader and thought I downloaded a clean version but, alas, not so!

When I click on links in firefox like in facebook or emails, ad windows pop up like lifebettering and insurancegirl. There is an ad bar that appears at the bottom of my google searches that says "articles by getsavin" and when I close it, it says "closing bottom google search bar." There are also smaller pop-up windows from savingsbul that appear in the bottom right corner.

I've run spybot S&D and malwarebytes (not at the same time) and they found bits of the malware at first but not anymore. I've also run SUPERantispyware and it keeps finding tracking cookies but doesn't get rid of the problem. I have Avast! and ran that but it didn't locate anything.

Here is my OTL file:




OTL logfile created on: 3/4/2014 9:38:29 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Sara\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.80 Gb Total Physical Memory | 1.83 Gb Available Physical Memory | 48.20% Memory free
7.60 Gb Paging File | 5.21 Gb Available in Paging File | 68.58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 452.70 Gb Total Space | 376.96 Gb Free Space | 83.27% Space Free | Partition Type: NTFS

Computer Name: SARA-PC | User Name: Sara | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014/03/04 09:38:22 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sara\Downloads\OTL.scr
PRC - [2014/02/28 18:29:00 | 006,600,048 | ---- | M] (Systweak) -- C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe
PRC - [2014/02/21 17:05:12 | 001,863,560 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_70.exe
PRC - [2014/02/15 08:26:40 | 000,275,568 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2014/02/10 17:57:07 | 000,223,112 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler.exe
PRC - [2013/12/21 01:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013/10/30 01:21:38 | 002,561,088 | ---- | M] () -- C:\Program Files (x86)\IDMSQ\idmsq.exe
PRC - [2013/08/30 02:47:34 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2013/08/30 02:47:33 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2011/03/31 17:19:44 | 001,646,056 | ---- | M] (Rosetta Stone Ltd.) -- C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe
PRC - [2010/03/03 16:42:02 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
PRC - [2010/03/03 16:41:58 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
PRC - [2008/11/09 15:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe


========== Modules (No Company Name) ==========

MOD - [2014/02/28 18:29:00 | 001,730,928 | ---- | M] () -- C:\Program Files (x86)\Advanced System Protector\aspsys.dll
MOD - [2014/02/21 17:05:11 | 016,265,096 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll
MOD - [2014/02/15 08:26:38 | 003,578,992 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2013/10/30 01:21:38 | 002,561,088 | ---- | M] () -- C:\Program Files (x86)\IDMSQ\idmsq.exe
MOD - [2013/02/14 19:32:48 | 000,212,992 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\bfceac53dda4bf7ba2f5020573f80163\System.ServiceProcess.ni.dll
MOD - [2013/02/14 19:32:43 | 001,840,640 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\9e64c6dea847aec2685eec4da29ea9b0\System.Web.Services.ni.dll
MOD - [2013/02/14 19:32:31 | 012,433,920 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\05682429807d34d6ff05a77ea153935f\System.Windows.Forms.ni.dll
MOD - [2013/02/14 19:32:23 | 001,806,848 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\5f97c350057f7217d1fff2366fb472bf\System.Deployment.ni.dll
MOD - [2013/01/25 22:26:59 | 002,295,296 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\7d3a95d2123d5a7982a451f1319fab8d\System.Core.ni.dll
MOD - [2013/01/25 22:26:56 | 000,997,888 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\ee4683cbfd60ee35d95e2e6d32fc3981\System.Management.ni.dll
MOD - [2013/01/25 22:26:20 | 000,220,672 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\24ab5f14e55ae0dec23141f6e59a577c\CustomMarshalers.ni.dll
MOD - [2013/01/08 20:18:31 | 000,628,224 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\2b54822a40e9b08479a79cce0e196af1\System.EnterpriseServices.ni.dll
MOD - [2013/01/08 20:18:30 | 000,627,200 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\00038bb019bb7e4470d3962b58b1926f\System.Transactions.ni.dll
MOD - [2013/01/08 20:18:29 | 006,618,624 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\d0dd051976a66e08325379754531421c\System.Data.ni.dll
MOD - [2013/01/08 20:17:47 | 001,592,832 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\e2ee5d77ebe0bd025e7a7a317a43d677\System.Drawing.ni.dll
MOD - [2013/01/08 20:17:23 | 005,453,312 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\10aba2c167cc1119b80159fd9ac71ca8\System.Xml.ni.dll
MOD - [2013/01/08 20:17:19 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\96a3b737db1e72adaf32d2b350e50c23\System.Configuration.ni.dll
MOD - [2013/01/08 20:17:18 | 007,974,400 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\c54750e64ba10d0fb7b6a636fb3695ca\System.ni.dll
MOD - [2013/01/08 20:17:09 | 011,490,816 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b0b8554c05f194f546a8ed531320760b\mscorlib.ni.dll
MOD - [2012/07/25 12:03:14 | 000,886,272 | ---- | M] () -- C:\Program Files (x86)\Advanced System Protector\System.Data.SQLite.dll
MOD - [2012/07/25 12:03:12 | 000,168,448 | ---- | M] () -- C:\Program Files (x86)\Advanced System Protector\unrar.dll
MOD - [2009/06/10 16:23:19 | 000,261,632 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2009/06/10 16:23:17 | 002,933,248 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2009/06/10 16:22:50 | 000,069,120 | ---- | M] () -- C:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll


========== Services (SafeList) ==========

SRV:64bit: - [2013/10/10 17:54:28 | 000,144,152 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCore64.exe -- (!SASCORE)
SRV:64bit: - [2013/08/30 02:47:33 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2010/10/26 16:42:16 | 005,790,064 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Program Files\Tablet\Pen\Pen_Tablet.exe -- (TabletServicePen)
SRV:64bit: - [2010/10/26 16:42:16 | 000,487,280 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Program Files\Tablet\Pen\Pen_TouchService.exe -- (TouchServicePen)
SRV:64bit: - [2010/07/28 12:27:16 | 000,267,192 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\TECO\TecoService.exe -- (TOSHIBA eco Utility Service)
SRV:64bit: - [2010/07/22 18:36:16 | 000,822,192 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe -- (TPCHSrv)
SRV:64bit: - [2010/06/29 13:05:02 | 000,489,384 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV:64bit: - [2010/03/05 12:26:38 | 001,425,168 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2010/03/05 12:07:58 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)
SRV:64bit: - [2010/03/05 12:06:22 | 000,831,760 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:64bit: - [2010/02/05 19:44:48 | 000,137,560 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
SRV:64bit: - [2009/10/21 11:30:36 | 000,531,520 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\ThpSrv.exe -- (Thpsrv)
SRV:64bit: - [2009/07/28 17:48:06 | 000,140,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2014/02/21 17:05:12 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2014/02/18 08:47:06 | 000,036,392 | ---- | M] (Just Develop It) [Auto | Stopped] -- C:\Program Files (x86)\MyPC Backup\BackupStack.exe -- (BackupStack)
SRV - [2014/02/15 08:26:39 | 000,118,896 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/12/21 01:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013/10/23 08:15:08 | 000,172,192 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011/04/04 20:48:29 | 001,045,256 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011/03/31 17:19:44 | 001,646,056 | ---- | M] (Rosetta Stone Ltd.) [Auto | Running] -- C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe -- (RosettaStoneDaemon)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/03 16:42:02 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010/03/03 16:41:58 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2009/10/06 11:21:50 | 000,051,512 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/11/09 15:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2013/08/30 02:48:10 | 001,030,952 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2013/08/30 02:48:10 | 000,378,944 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2013/08/30 02:48:10 | 000,204,880 | ---- | M] () [Kernel | Boot | Running] -- C:\windows\SysNative\drivers\aswVmm.sys -- (aswVmm)
DRV:64bit: - [2013/08/30 02:48:10 | 000,072,016 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2013/08/30 02:48:10 | 000,065,336 | ---- | M] () [Kernel | Boot | Running] -- C:\windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)
DRV:64bit: - [2013/08/30 02:48:10 | 000,064,288 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2013/08/30 02:48:09 | 000,080,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2013/08/30 02:48:09 | 000,033,400 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2012/08/21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012/07/09 13:42:54 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012/03/01 01:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/07/22 11:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
DRV:64bit: - [2011/07/12 16:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
DRV:64bit: - [2011/03/11 01:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 01:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/10/11 14:19:36 | 000,018,288 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wacmoumonitor.sys -- (wacmoumonitor)
DRV:64bit: - [2010/10/11 14:19:28 | 000,012,848 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV:64bit: - [2010/10/11 14:19:26 | 000,016,168 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wacomvhid.sys -- (wacomvhid)
DRV:64bit: - [2010/06/18 12:38:06 | 000,039,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WDKMD.sys -- (wdkmd)
DRV:64bit: - [2010/05/31 14:05:06 | 007,689,216 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64)
DRV:64bit: - [2010/05/18 18:02:48 | 000,164,464 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR)
DRV:64bit: - [2010/05/08 20:38:56 | 000,482,384 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\tos_sps64.sys -- (tos_sps64)
DRV:64bit: - [2010/05/03 16:44:02 | 000,331,880 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010/04/21 13:18:44 | 010,326,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010/03/10 20:51:32 | 000,316,464 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2010/02/26 18:32:12 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2010/02/03 08:38:30 | 000,271,872 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2010/01/15 14:22:08 | 000,538,136 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009/10/09 21:41:20 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2009/09/17 14:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009/07/30 23:02:36 | 000,044,912 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LPCFilter.sys -- (LPCFilter)
DRV:64bit: - [2009/07/30 22:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV:64bit: - [2009/07/14 17:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 19:00:24 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acpials.sys -- (acpials)
DRV:64bit: - [2009/06/29 18:16:20 | 000,014,784 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\Thpevm.sys -- (Thpevm)
DRV:64bit: - [2009/06/29 12:25:22 | 000,034,880 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\thpdrv.sys -- (Thpdrv)
DRV:64bit: - [2009/06/22 19:06:38 | 000,035,008 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)
DRV:64bit: - [2009/06/19 21:15:22 | 000,014,472 | ---- | M] (TOSHIBA Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TVALZFL.sys -- (TVALZFL)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {B1B2FE82-E32D-417D-B6E7-1889A538F5A8}
IE:64bit: - HKLM\..\SearchScopes\{B1B2FE82-E32D-417D-B6E7-1889A538F5A8}: "URL" = http://www.google.co...ng}&rlz=1I7TSND
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co...=TSND&bmod=TSND
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co...=TSND&bmod=TSND
IE - HKLM\..\SearchScopes,DefaultScope = {8B860874-5AF8-4C63-8430-BDE6C5964CFE}
IE - HKLM\..\SearchScopes\{8B860874-5AF8-4C63-8430-BDE6C5964CFE}: "URL" = http://www.google.co...ng}&rlz=1I7TSND

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co...=TSND&bmod=TSND
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://start.toshiba.com/g/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.google.com/ig?brand=TSN [Binary data over 200 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\SearchScopes,DefaultScope = {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
IE - HKCU\..\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}: "URL" = http://search.condui...rchTerms}&SSPV=
IE - HKCU\..\SearchScopes\{8B860874-5AF8-4C63-8430-BDE6C5964CFE}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{FE116612-30A2-4B22-85C2-171E3BD596A2}: "URL" = http://www.google.co...ND_enUS411US411
IE - HKCU\..\SearchScopes\8ECABF36530B433DB35EA82200C91869: "URL" = http://www.google.co...ng}&rlz=1I7TSND
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local

========== FireFox ==========

FF - prefs.js..browser.search.order.3: "Bing "
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://www.yahoo.com/"
FF - prefs.js..extensions.enabledAddons: printwithoutads%40oleg.vaskevich:1.2
FF - prefs.js..extensions.enabledAddons: SimpleBlock%40aksoftware.ne1.net:0.0.7
FF - prefs.js..extensions.enabledAddons: wrc%40avast.com:8.0.1497
FF - prefs.js..extensions.enabledAddons: %7Bb1df372d-8b32-4c7d-b6b4-9c5b78cf6fb1%7D:0.87
FF - prefs.js..extensions.enabledAddons: imageblock%40hemantvats.com:2.1
FF - prefs.js..extensions.enabledAddons: %7B15312e9a-4905-48da-aae4-15b24bdc2a24%7D:1.0.5
FF - prefs.js..extensions.enabledAddons: idmsq%40idmsq.com:1.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:27.0.1


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.51.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.51.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.5: C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2013/10/05 09:08:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2014/02/15 08:26:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014/02/15 08:26:34 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2014/02/15 08:26:32 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014/02/15 08:26:34 | 000,000,000 | ---D | M]

[2010/12/25 07:41:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sara\AppData\Roaming\Mozilla\Extensions
[2014/03/04 09:37:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\extensions
[2013/08/20 15:21:35 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2014/03/04 09:37:11 | 000,000,000 | ---D | M] (Internet Download Manager Squared) -- C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\extensions\[email protected]
[2014/02/27 19:35:50 | 000,000,000 | ---D | M] (SavingsBull) -- C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\extensions\SavingsBull@jetpack
[2014/02/13 17:25:53 | 000,016,361 | ---- | M] () (No name found) -- C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\extensions\[email protected]
[2014/03/03 19:33:20 | 000,018,146 | ---- | M] () (No name found) -- C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\extensions\[email protected]
[2012/02/20 11:46:13 | 000,013,620 | ---- | M] () (No name found) -- C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\extensions\[email protected]
[2013/12/28 10:03:37 | 000,011,079 | ---- | M] () (No name found) -- C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\extensions\[email protected]
[2011/12/18 20:09:24 | 000,006,237 | ---- | M] () (No name found) -- C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\extensions\[email protected]
[2014/03/03 19:34:22 | 000,122,054 | ---- | M] () (No name found) -- C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\extensions\{15312e9a-4905-48da-aae4-15b24bdc2a24}.xpi
[2014/03/03 19:33:20 | 000,039,512 | ---- | M] () (No name found) -- C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\extensions\{b1df372d-8b32-4c7d-b6b4-9c5b78cf6fb1}.xpi
[2014/02/27 16:55:08 | 000,957,290 | ---- | M] () (No name found) -- C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2014/01/19 18:14:27 | 000,002,273 | ---- | M] () -- C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\searchplugins\bingp.xml
[2014/02/27 19:35:56 | 000,000,975 | ---- | M] () -- C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\searchplugins\conduit-search.xml
[2014/02/15 08:26:32 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2014/02/15 08:26:40 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/10/05 09:08:30 | 000,000,000 | ---D | M] (avast! Online Security) -- C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST5\WEBREP\FF

========== Chrome ==========

CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.google.co...=TSND&bmod=TSND

O1 HOSTS File: ([2014/03/04 09:31:26 | 000,000,867 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 d3oxij66pru1i3.cloudfront.net
O2:64bit: - BHO: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (Idmsq Extension) - {3AA4FC9D-FB51-44a2-B09F-0457857CA7C2} - C:\Users\Sara\AppData\Roaming\IDMSQ\idmsqext.dll (Or Interactive Ltd)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
O3:64bit: - HKLM\..\Toolbar: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4:64bit: - HKLM..\Run: [] File not found
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [ThpSrv] C:\windows\SysNative\thpsrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [20131121] C:\Program Files\Alwil Software\Avast5\setup\emupdate\aa55e97b-63d7-4411-8a34-c4f538d94a41.exe (AVAST Software)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [mobilegeni daemon] C:\Program Files (x86)\Mobogenie\DaemonProcess.exe File not found
O4 - HKCU..\Run: [IDMSQ] C:\Program Files (x86)\IDMSQ\idmsq.exe ()
O4 - HKCU..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe File not found
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware)
O4 - Startup: C:\Users\Sara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk = C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.51.2)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.51.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.254.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{665A2DFD-A7BB-418D-9725-737BF8F5F608}: DhcpNameServer = 192.168.254.254
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll) - File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2014/03/04 09:32:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector
[2014/03/04 09:32:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Systweak
[2014/03/04 09:32:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Advanced System Protector
[2014/03/04 09:31:48 | 000,000,000 | ---D | C] -- C:\Users\Sara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
[2014/03/04 09:31:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MyPC Backup
[2014/03/04 09:31:29 | 000,000,000 | ---D | C] -- C:\Users\Sara\AppData\Roaming\Systweak
[2014/03/04 09:31:29 | 000,000,000 | ---D | C] -- C:\ProgramData\OEM Links
[2014/03/04 09:31:28 | 000,000,000 | ---D | C] -- C:\MININT
[2014/03/04 09:31:27 | 000,020,312 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\windows\SysNative\roboot64.exe
[2014/03/04 09:31:26 | 000,000,000 | ---D | C] -- C:\Users\Sara\AppData\Roaming\IDMSQ
[2014/03/04 09:31:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro
[2014/03/04 09:31:23 | 000,000,000 | ---D | C] -- C:\Users\Sara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IDMSQ
[2014/03/04 09:31:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RegClean Pro
[2014/03/04 09:31:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\IDMSQ
[2014/03/04 08:39:45 | 000,000,000 | ---D | C] -- C:\SUPERDelete
[2014/03/04 08:08:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2014/03/04 08:08:03 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2014/03/03 20:04:38 | 000,000,000 | ---D | C] -- C:\Users\Sara\AppData\Roaming\SUPERAntiSpyware.com
[2014/03/03 20:04:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2014/03/03 20:04:21 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2014/03/03 20:04:21 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2014/02/27 20:51:27 | 000,000,000 | ---D | C] -- C:\Users\Sara\Desktop\texts
[2014/02/27 20:01:11 | 000,000,000 | ---D | C] -- C:\Users\Sara\Documents\Coolmuster files
[2014/02/27 20:01:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Coolmuster
[2014/02/27 19:35:29 | 000,000,000 | ---D | C] -- C:\temp
[2014/02/27 19:35:23 | 000,000,000 | ---D | C] -- C:\Program Files\Level Quality Watcher
[2014/02/15 08:26:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[53 C:\Users\Sara\Documents\*.tmp files -> C:\Users\Sara\Documents\*.tmp -> ]
[10 C:\Users\Sara\Desktop\*.tmp files -> C:\Users\Sara\Desktop\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2014/03/04 09:31:48 | 000,001,068 | ---- | M] () -- C:\Users\Sara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
[2014/03/04 09:31:41 | 000,000,282 | ---- | M] () -- C:\windows\tasks\RegClean Pro_UPDATES.job
[2014/03/04 09:31:41 | 000,000,274 | ---- | M] () -- C:\windows\tasks\RegClean Pro_DEFAULT.job
[2014/03/04 09:28:17 | 000,016,304 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014/03/04 09:28:17 | 000,016,304 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014/03/04 09:20:34 | 000,000,908 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2014/03/04 09:20:18 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2014/03/04 09:20:12 | 3059,748,864 | -HS- | M] () -- C:\hiberfil.sys
[2014/03/04 09:15:02 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2014/03/04 09:02:11 | 000,000,912 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2014/03/03 20:04:24 | 000,001,819 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2014/02/26 13:08:32 | 000,530,301 | ---- | M] () -- C:\Users\Sara\Desktop\TaxReturn2013.pdf
[2014/02/15 11:08:07 | 000,002,055 | ---- | M] () -- C:\Users\Sara\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[53 C:\Users\Sara\Documents\*.tmp files -> C:\Users\Sara\Documents\*.tmp -> ]
[10 C:\Users\Sara\Desktop\*.tmp files -> C:\Users\Sara\Desktop\*.tmp -> ]
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2014/03/04 09:32:01 | 000,016,896 | ---- | C] () -- C:\windows\SysNative\sasnative64.exe
[2014/03/04 09:31:48 | 000,001,068 | ---- | C] () -- C:\Users\Sara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
[2014/03/04 09:31:41 | 000,000,282 | ---- | C] () -- C:\windows\tasks\RegClean Pro_UPDATES.job
[2014/03/04 09:31:41 | 000,000,274 | ---- | C] () -- C:\windows\tasks\RegClean Pro_DEFAULT.job
[2014/03/03 20:04:24 | 000,001,819 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2014/02/26 13:08:32 | 000,530,301 | ---- | C] () -- C:\Users\Sara\Desktop\TaxReturn2013.pdf
[2010/03/17 22:52:02 | 000,116,024 | ---- | C] () -- C:\Users\Sara\typogarden-demo.ttf

========== ZeroAccess Check ==========

[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012/06/09 00:30:56 | 014,165,504 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 23:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 20:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/07/13 20:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 20:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2011/03/16 10:17:29 | 000,000,000 | ---D | M] -- C:\Users\Sara\AppData\Roaming\Amazon
[2010/12/25 15:11:52 | 000,000,000 | ---D | M] -- C:\Users\Sara\AppData\Roaming\Book Place
[2011/08/24 09:22:25 | 000,000,000 | ---D | M] -- C:\Users\Sara\AppData\Roaming\Carnival Software
[2011/02/18 16:31:15 | 000,000,000 | ---D | M] -- C:\Users\Sara\AppData\Roaming\EPSON
[2014/03/04 09:36:36 | 000,000,000 | ---D | M] -- C:\Users\Sara\AppData\Roaming\IDMSQ
[2011/12/01 15:52:06 | 000,000,000 | ---D | M] -- C:\Users\Sara\AppData\Roaming\MyPublisher
[2014/03/04 09:51:05 | 000,000,000 | ---D | M] -- C:\Users\Sara\AppData\Roaming\Systweak
[2010/12/31 12:38:49 | 000,000,000 | ---D | M] -- C:\Users\Sara\AppData\Roaming\Tific
[2011/04/15 15:08:52 | 000,000,000 | ---D | M] -- C:\Users\Sara\AppData\Roaming\Toshiba
[2011/05/26 19:39:21 | 000,000,000 | ---D | M] -- C:\Users\Sara\AppData\Roaming\Wacom
[2011/05/26 19:39:23 | 000,000,000 | ---D | M] -- C:\Users\Sara\AppData\Roaming\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1
[2010/12/25 07:30:53 | 000,000,000 | ---D | M] -- C:\Users\Sara\AppData\Roaming\WinBatch
[2012/07/03 18:06:29 | 000,000,000 | ---D | M] -- C:\Users\Sara\AppData\Roaming\Windows Live Writer

========== Purity Check ==========



< End of report >





And then an Extras log report also was produced:



OTL Extras logfile created on: 3/4/2014 9:38:29 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Sara\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.80 Gb Total Physical Memory | 1.83 Gb Available Physical Memory | 48.20% Memory free
7.60 Gb Paging File | 5.21 Gb Available in Paging File | 68.58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 452.70 Gb Total Space | 376.96 Gb Free Space | 83.27% Space Free | Partition Type: NTFS

Computer Name: SARA-PC | User Name: Sara | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- C:\Program Files (x86)\Advanced System Protector\filetypehelper.exe -scanunknown "%1" (Systweak)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- C:\Program Files (x86)\Advanced System Protector\filetypehelper.exe -scanunknown "%1" (Systweak)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{038E3F3B-E2C8-4D90-889F-BA106F07C1FB}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{0E254EC1-F057-4D52-9712-74F76139F061}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{1792F794-0424-4D8B-B180-ECC70BD6E85E}" = lport=445 | protocol=6 | dir=in | app=system |
"{1C0CDCFA-62DA-4B78-B4C2-B4FB820F0124}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{22BEFFF6-4D23-43C9-9436-D575F96AC4A2}" = rport=10243 | protocol=6 | dir=out | app=system |
"{2DEEFE07-CA35-4039-97A4-77AF7A068CAE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{331CA94A-50A2-4CF2-9090-73E6AA26A5A1}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |
"{3D80E672-2CE8-47FE-B2C0-E9A590C5EACF}" = rport=445 | protocol=6 | dir=out | app=system |
"{4AD0E15D-67E9-46E1-A608-602B8A6A93ED}" = rport=137 | protocol=17 | dir=out | app=system |
"{4DD91CD0-9625-4CE7-AD84-5B17AC69E045}" = lport=10243 | protocol=6 | dir=in | app=system |
"{4E3A874F-A13E-46C6-A76A-93C37FFFC430}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4E612F40-751A-4C55-99A6-121E92061298}" = lport=2869 | protocol=6 | dir=in | app=system |
"{4EAB6B70-71A2-4A29-AFAF-822FA762659E}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{5EA2A6BE-514C-4A4C-AF35-EC3A264B5C86}" = lport=137 | protocol=17 | dir=in | app=system |
"{6111A038-3FAD-4C9B-BC17-C1C8DC2A1AB5}" = lport=138 | protocol=17 | dir=in | app=system |
"{7C4394BA-8460-43D8-9C1B-97551D049FED}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7CDCEF25-EE09-416C-8E5D-A4111841C563}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{8004060E-0272-4717-B842-2B6CB94AA814}" = lport=2869 | protocol=6 | dir=in | app=system |
"{8920EDBC-A221-4C6D-8A21-F7971A519E03}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{AB4DBB42-CF87-46FA-8CF4-6ED4C1BAE22A}" = rport=139 | protocol=6 | dir=out | app=system |
"{B1FCA713-69C9-473D-BD51-018CA1151412}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B26FBEF4-D295-4F54-988E-DEDF110CB7AF}" = lport=139 | protocol=6 | dir=in | app=system |
"{BCD73E37-1A8A-452E-826C-500C5A7C37FE}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DF432E4C-B0A6-419D-8C3E-4F2C36B27999}" = rport=138 | protocol=17 | dir=out | app=system |
"{EA20551B-7A89-4AA4-BE80-050D3F6F7947}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{EBC34DE2-38F8-4170-987F-F1CDA2A0E96A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{FB692FD1-CEB3-469C-9A01-54ACF2920752}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00A988E4-EAE6-49F5-922E-E539A9B9ECB1}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{011125CF-15A6-4A13-8051-61535054B5F0}" = dir=in | app=c:\program files (x86)\intel corporation\intel wireless display\widiapp.exe |
"{03B3E254-D94B-41D7-AE3D-26F3DA16E350}" = protocol=6 | dir=out | app=c:\program files (x86)\rosettastoneltdservices\rosettastonedaemon.exe |
"{042E50BE-01A6-4206-B60A-2DC94ACF54BF}" = dir=in | app=c:\program files\intel\wifi\bin\pandhcpdns.exe |
"{070375FA-425B-4F13-965E-88BD9ED6D349}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{103C9D8D-052E-43D4-A24F-84DBC7E38826}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{12A963D3-6D1A-4D89-AC4B-027FEC7FFF44}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{195525D1-AA55-403A-A694-B9F634076B78}" = protocol=58 | dir=out | [email protected],-28546 |
"{2C1D0D27-77A7-4B6A-8BAC-4403B7D730EF}" = dir=in | app=c:\program files (x86)\rosettastoneltdservices\rosettastoneltdservices.exe |
"{3C6D4A1C-8A42-43AE-9333-76CBC1BABF80}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{50169529-257D-4E2E-A9D4-21A11A857E43}" = protocol=6 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe |
"{52C1825B-F17F-46A4-BFA6-C140F5A5C8F8}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{531478F6-2AB1-4AF5-AEBA-1BF24480AF24}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{6FF2DA8A-C6FC-490F-892E-E4751191A6B8}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7447005E-846A-4AE6-8965-F0A88C2DF0A2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{7621BE3B-5414-43B9-8665-DDE6462AC63B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{794BCAAC-9E97-4844-9418-FC744E448E39}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{7C43950B-E26F-4241-BA41-374116353EB6}" = dir=in | app=c:\program files (x86)\rosettastoneltdservices\rosettastonedaemon.exe |
"{8059D3C4-563C-43FD-AF0E-65A975C21EB6}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{92C9C816-3F02-4D64-8951-8267D47ECEFD}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A0E32EB5-139C-4EE8-A636-16D4F4C68A9D}" = protocol=6 | dir=out | app=system |
"{A9B42D29-C080-4E6A-97C0-73E15B99E336}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{BCCF3FC5-F467-453F-8B70-0F086DF95CC6}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{C17DCFD8-5D52-4AA3-9F75-5F3E530DB1C6}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{C3982309-A81A-4D3B-86D3-0F2235D77C0E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C71D2AC7-D67E-4D18-A33B-82F8B1F6CFE7}" = protocol=1 | dir=out | [email protected],-28544 |
"{CC258DEA-A66C-4DE0-B786-1B9D5DF0F7D0}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{D3A4A855-02A0-431D-9628-6CAA4488AE1E}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D867B2D1-4F93-42EE-8510-C63AF621AE0D}" = protocol=1 | dir=in | [email protected],-28543 |
"{DDEE80E0-FC88-43CF-97D5-59F6D45AE0BD}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{EC25A428-18E6-405F-9652-D35284BEC43D}" = protocol=17 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe |
"{F41E86B6-B53B-4C5A-8C73-542D507D2DB9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{F6DCD075-2AE2-4041-9A30-FC34B206C8C4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F85BAFC1-A298-437E-92D5-84FF2E20350F}" = protocol=6 | dir=out | app=c:\program files (x86)\rosettastoneltdservices\rosettastoneltdservices.exe |
"{FCD36871-1710-421A-A693-0C5F3C02A566}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{FFCAD8BA-1B6C-4D83-ABFE-AC6C9BAF6FA5}" = protocol=58 | dir=in | [email protected],-28545 |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}" = iTunes
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{2086A549-ED96-4dc9-BBE3-0538AB29ABEC}" = PSP Thumbnail Handler
"{24811C12-F4A9-4D0F-8494-A7B8FE46123C}" = TOSHIBA ReelTime
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{63DA1F6A-2E65-4367-99B9-9E39FADEC446}" = HDMI Control Manager
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}" = Apple Mobile Device Support
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{94A90C69-71C1-470A-88F5-AA47ECC96B40}" = TOSHIBA HDD Protection
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}" = TOSHIBA PC Health Monitor
"{B3FF1CD9-B2F0-4D71-BB55-5F580401C48E}" = TOSHIBA eco Utility
"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Media Creator
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{C14518AF-1A0F-4D39-8011-69BAA01CD380}" = TOSHIBA Bulletin Board
"{C298FF86-AB23-4B58-AC53-A23383C07B3A}" = Intel® Wireless Display
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{D16A2127-B927-4379-B153-3DEC091E4EEB}" = Intel® PROSet/Wireless WiFi Software
"{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F67FA545-D8E5-4209-86B1-AEE045D1003F}" = TOSHIBA Face Recognition
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"MyPC Backup" = MyPC Backup
"Pen Tablet Driver" = Bamboo
"ProInst" = Intel PROSet Wireless
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{53A908D4-99C6-469B-BC13-F4189F260742}" = Corel Painter Essentials 4
"{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D795777-9D60-4692-8386-F2B3F2B5E5BF}" = Label@Once 1.0
"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1A15507A-8551-4626-915D-3D5FA095CC1B}" = Corel Paint Shop Pro X
"{1B87C40B-A60B-4EF3-9A68-706CF4B69978}" = TOSHIBA Assist
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron Flash Media Controller Driver
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 24
"{26A24AE4-039D-4CA4-87B4-2F83217045FF}" = Java 7 Update 51
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology
"{4010ADCB-1347-D570-FCF1-3002CABEBD2F}" = Rosetta Stone TOTALe
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.11
"{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
"{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"{53A908D4-99C6-469B-BC13-F4189F260742}" = Corel Painter Essentials 4
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5AF550B4-BB67-4E7E-82F1-2C4300279050}" = ToshibaRegistration
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{5E6F6CF3-BACC-4144-868C-E14622C658F3}" = TOSHIBA Web Camera Application
"{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility
"{63DA1F6A-2E65-4367-99B9-9E39FADEC446}" = HDMI Control Manager
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{654F7484-88C5-46DC-AB32-C66BCB0E2102}" = TOSHIBA Sleep Utility
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER
"{6DDE8071-E4BA-461B-8A96-990DFAA0EBD1}" = SavingsBull
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7BB2EF8A-5376-4BAE-96D0-38BE49501F40}" = Rosetta Stone Ltd Services
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows 7
"{8A1FEA5E-8DB8-AD80-5C14-AEF33D16EF5A}" = Rosetta Stone TOTALe
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{913D0409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Standard for Students and Teachers
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}" = TOSHIBA Application Installer
"{983CD6FE-8320-4B80-A8F6-0D0366E0AA22}" = TOSHIBA Media Controller
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC6569FA-6919-442A-8552-073BE69E247A}" = TOSHIBA Service Station
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.06)
"{AD9E6AC8-27B4-326A-69D1-C8A3549DAC22}" = Bamboo Dock
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B3FF1CD9-B2F0-4D71-BB55-5F580401C48E}" = TOSHIBA eco Utility
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime
"{BB51B753-9A0C-4D1D-B3EF-A1B936F55796}" = Toshiba Book Place
"{C31337DE-0CDC-45A9-9A32-F099AC78D557}" = Toshiba Book Place
"{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}" = Toshiba Online Backup
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DA84ECBF-4B79-47F2-B34C-95C38484C058}" = Skype Launcher
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E69992ED-A7F6-406C-9280-1C156417BC49}" = TOSHIBA Quality Application
"{ED3CBA78-488F-4E8C-B33F-8E3BF4DDB4D2}" = Toshiba App Place
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Graphics Media Accelerator Driver
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}" = TOSHIBA Media Controller Plug-in
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"00212D92-C5D8-4ff4-AE50-B20F0F85C40A_Systweak_Ad~B9F029BF_is1" = Advanced System Protector
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 12 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 12 Plugin
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.10
"avast" = avast! Free Antivirus
"Bamboo Dock" = Bamboo Dock 3.3
"com.rosettastone.rosettastonetotale" = Rosetta Stone TOTALe
"EPSON Scanner" = EPSON Scan
"IDMSQ" = Internet Download Manager² 1.0
"InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"InstallShield_{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver
"InstallShield_{24811C12-F4A9-4D0F-8494-A7B8FE46123C}" = TOSHIBA ReelTime
"InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
"InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility
"InstallShield_{63DA1F6A-2E65-4367-99B9-9E39FADEC446}" = HDMI Control Manager
"InstallShield_{B3FF1CD9-B2F0-4D71-BB55-5F580401C48E}" = TOSHIBA eco Utility
"InstallShield_{C14518AF-1A0F-4D39-8011-69BAA01CD380}" = TOSHIBA Bulletin Board
"InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}" = TOSHIBA Face Recognition
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Mozilla Firefox 27.0.1 (x86 en-US)" = Mozilla Firefox 27.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Pen Tablet Driver" = Bamboo
"Wacom WebTabletPlugin for IE" = WebTablet IE Plugin
"Wacom WebTabletPlugin for Netscape" = WebTablet Netscape Plugin
"wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1" = Bamboo Dock
"WinLiveSuite" = Windows Live Essentials
"WriteItNow Novel Writing Software 3.1.0" = WriteItNow Novel Writing Software 3.1.0
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 2/21/2012 6:36:07 PM | Computer Name = Sara-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 6037

Error - 2/21/2012 6:36:07 PM | Computer Name = Sara-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6037

Error - 2/21/2012 6:36:08 PM | Computer Name = Sara-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 2/21/2012 6:36:08 PM | Computer Name = Sara-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7036

Error - 2/21/2012 6:36:08 PM | Computer Name = Sara-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7036

Error - 2/21/2012 6:36:09 PM | Computer Name = Sara-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 2/21/2012 6:36:09 PM | Computer Name = Sara-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8034

Error - 2/21/2012 6:36:09 PM | Computer Name = Sara-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8034

Error - 2/21/2012 6:36:10 PM | Computer Name = Sara-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 2/21/2012 6:36:10 PM | Computer Name = Sara-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9220

[ System Events ]
Error - 2/20/2014 8:37:30 PM | Computer Name = Sara-PC | Source = ACPI | ID = 327693
Description = : The embedded controller (EC) did not respond within the specified
timeout period. This may indicate that there is an error in the EC hardware or
firmware or that the BIOS is accessing the EC incorrectly. You should check with
your computer manufacturer for an upgraded BIOS. In some situations, this error
may cause the computer to function incorrectly.

Error - 2/22/2014 10:41:46 AM | Computer Name = Sara-PC | Source = ACPI | ID = 327693
Description = : The embedded controller (EC) did not respond within the specified
timeout period. This may indicate that there is an error in the EC hardware or
firmware or that the BIOS is accessing the EC incorrectly. You should check with
your computer manufacturer for an upgraded BIOS. In some situations, this error
may cause the computer to function incorrectly.

Error - 2/22/2014 4:54:39 PM | Computer Name = Sara-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the TouchServicePen service.

Error - 2/27/2014 8:35:29 PM | Computer Name = Sara-PC | Source = Service Control Manager | ID = 7031
Description = The Windows Installer service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 120000 milliseconds:
Restart the service.

Error - 2/27/2014 8:37:29 PM | Computer Name = Sara-PC | Source = Service Control Manager | ID = 7032
Description = The Service Control Manager tried to take a corrective action (Restart
the service) after the unexpected termination of the Windows Installer service,
but this action failed with the following error: %%1056

Error - 2/27/2014 8:57:38 PM | Computer Name = Sara-PC | Source = ACPI | ID = 327693
Description = : The embedded controller (EC) did not respond within the specified
timeout period. This may indicate that there is an error in the EC hardware or
firmware or that the BIOS is accessing the EC incorrectly. You should check with
your computer manufacturer for an upgraded BIOS. In some situations, this error
may cause the computer to function incorrectly.

Error - 2/27/2014 9:44:40 PM | Computer Name = Sara-PC | Source = Service Control Manager | ID = 7034
Description = The Computer Backup (MyPC Backup) service terminated unexpectedly.
It has done this 1 time(s).

Error - 2/27/2014 9:57:31 PM | Computer Name = Sara-PC | Source = cdrom | ID = 262155
Description = The driver detected a controller error on \Device\CdRom2.

Error - 3/3/2014 12:22:22 PM | Computer Name = Sara-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the TouchServicePen service.

Error - 3/4/2014 9:05:38 AM | Computer Name = Sara-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Definition Update for Windows Defender - KB915597 (Definition
1.167.1095.0).


< End of report >

[Advertisements]

Hello lantis33

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.


Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

• Please do not run any tools unless instructed to do so.
  
  • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
• Please do not attach logs or use code boxes, just copy and paste the text.
  
  • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
• Please read every post completely before doing anything.
  
  • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
• Please provide feedback about your experience as we go.
  
  • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.


These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click on Scan.
• After the scan is complete click on "Clean"
• Confirm each time with Ok.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next answer.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.

-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

When they are complete let me have the two reports and let me know how things are running.

Gringo

[gringo_pr]

Hello lantis33

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.


Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

• Please do not run any tools unless instructed to do so.
  
  • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
• Please do not attach logs or use code boxes, just copy and paste the text.
  
  • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
• Please read every post completely before doing anything.
  
  • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
• Please provide feedback about your experience as we go.
  
  • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.


These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click on Scan.
• After the scan is complete click on "Clean"
• Confirm each time with Ok.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next answer.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.

-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

When they are complete let me have the two reports and let me know how things are running.

Gringo

[lantis33]

Thank you for your help!!

When I came back on the internet, I did still get the same savingsbul pop-ups.



# AdwCleaner v3.020 - Report created 04/03/2014 at 13:09:56
# Updated 27/02/2014 by Xplode
# Operating System : Windows 7 Home Premium (64 bits)
# Username : Sara - SARA-PC
# Running from : C:\Users\Sara\Downloads\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Partner
Folder Deleted : C:\Program Files (x86)\Mobogenie
Folder Deleted : C:\Program Files\Level Quality Watcher
Folder Deleted : C:\Users\Sara\AppData\Local\genienext
Folder Deleted : C:\Users\Sara\AppData\Local\Temp\boost_interprocess
Folder Deleted : C:\Users\Sara\AppData\Roaming\Systweak
Folder Deleted : C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
File Deleted : C:\windows\System32\roboot64.exe
File Deleted : C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\searchplugins\bingp.xml
File Deleted : C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\searchplugins\conduit-search.xml
File Deleted : C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\user.js

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Mobogenie_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Mobogenie_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasmancs
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mobilegeni daemon]
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Key Deleted : HKCU\Software\systweak
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKLM\Software\systweak

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.7600.17267


-\\ Mozilla Firefox v27.0.1 (en-US)

[ File : C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\prefs.js ]

Line Deleted : user_pref("browser.newtab.url", "hxxp://search.conduit.com/?ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=4&UP=SPD2E18849-DF6A-4C5B-9BBE-301948FB1045");
Line Deleted : user_pref("extensions.bootstrappedAddons", "{\"[email protected]\":{\"version\":\"4.24\",\"type\":\"extension\",\"descriptor\":\"C:\\\\Users\\\\Sara\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\[...]
Line Deleted : user_pref("pagetweak.pref.hxxp://www.geekstogo.com/forum/index.php?app=forums&module=post&section=post&do=new_post&f=37;ed-0_textarea", "%0AHello%20and%20thank%20you%20in%20advance%20for%20any%20help%[...]

-\\ Google Chrome v

[ File : C:\Users\Sara\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [4906 octets] - [04/03/2014 13:09:01]
AdwCleaner[S0].txt - [4715 octets] - [04/03/2014 13:09:56]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4775 octets] ##########





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Home Premium x64
Ran by Sara on Tue 03/04/2014 at 13:18:14.36
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\yt.ytnavassistplugin
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\yt.ytnavassistplugin.1



~~~ Files



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{007AEB96-E4F5-4C57-A1F2-00F455939FDF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{00A511F7-3934-4416-8E0E-4ABBD4B51741}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{00EA0666-530D-43D9-84A9-8496C56F678B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{01103D9D-69C8-4B5D-B7E2-7EED7D88C36A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{01579D6A-6F10-4F2E-BEBC-10DCC86D15AE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{01853818-238D-47F5-867F-6BFD7294B879}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{022EEE7B-0870-4070-92A1-573A06EC172C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{022F7BAC-4BB7-4DEB-92B1-38CBA08054AB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0282449B-FC6E-4B49-B7F4-C61E7A7A0758}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{02A5C2ED-2B38-4047-9AB7-529F028EF7AE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{02AD1244-4ABF-4ACC-9FC1-2CE0B7ADAE20}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{02B28E32-F5C6-49EB-A2F1-F25C57DA7C14}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{03199089-730B-4628-8DB1-16C9D05D3EEB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{034DD521-648C-4D1F-9F53-514AB06064AC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{036B7ED1-DE1D-4594-9FE8-4DDF538B388A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{03A683DA-0FB2-4FBF-A245-745A1C40CB7C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{03CF84B1-5C12-4E86-82F3-A0E185DA7B31}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{03DBD363-6EB0-417D-925B-EE9D29F169E9}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{04732F2E-0154-4C38-B2BC-9C7F52643DB9}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0479381C-851A-4A34-B384-101828679C4A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{04FDC96B-36A5-4DDD-A56F-98D55BF739C4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0500B147-976D-4ADC-9903-C6A8CF732043}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{05B0914E-FF35-4D4B-82D3-9BBECD197DF2}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{060103BB-FA69-48DE-816D-16030874B5AF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0690B70D-14EF-4D06-89FE-DE3DB4F17482}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{06AC6FE8-87A3-4DDC-B133-2E979D4A728D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{06C72CCE-FF09-4E2C-8189-91E28497F267}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{06C73ED1-57E9-42DD-A286-2181084E14EA}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{06CF939D-19D1-4AA5-B299-8838DD38ACB9}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{07FF52F0-5B01-447E-AFA5-A81296A2C607}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{090C616A-D4B8-41BE-9941-FED049396CED}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{09A950F5-100B-4F73-BA1D-F4188EF29D9F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0A192B01-07E6-4E44-BAF8-DD9E084525AD}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0A922A14-33AC-402A-A230-78C326CE8556}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0AD2700B-B88E-4D35-BBD9-A2CD19C3EEEB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0AD49391-0F36-4CF5-B3C1-A15E3D943832}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0AD4B06D-EACC-4EFF-8C7F-FA2B69E76C04}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0B0555D6-D25A-47AA-9572-171EA0A6493C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0B1B3735-E57B-4C98-8912-6FB0F9CF9450}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0B30F099-6D5E-4501-837B-FC6864A9CA68}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0B7EF355-3DB5-443A-815E-78E438487C12}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0BA86C05-8B29-4EC7-A401-416575F5978E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0C1D128F-98E3-4222-B44D-82A9B09A4B86}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0C4047E2-45E9-4D13-BB77-7F0D8E605589}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0C5D5C40-1D3A-497F-B3DE-B93BC369E649}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0C69DDDB-F89B-4DEC-A6C4-F979A84B01F6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0C8A7A13-C622-4395-A8DA-677EBEF8C976}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0C9BCACA-19F9-4BC4-A6A1-87F7EBDBD0A3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0CB42254-2AAD-4E6A-99F0-817DFB0D4E89}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0D12870B-8608-49E0-B72B-DC62C55587A9}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0D26187E-FD60-43EF-BFEE-D6A86EDD2A5A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0D70C2FB-22FB-4460-8136-37EFBDFFC735}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0E1C0C2E-7708-4A1A-816C-0719446CAEA4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0E2BA3BE-43A9-4286-B74D-9216FC5FF36F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0EE2B047-08DC-4671-813F-74F5B2ED93F8}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{0F38AED8-C6AA-405E-8C39-EBBF09D3D571}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1017A78A-9506-439F-A144-09EC2318A057}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{10F496E5-6B1F-46FA-BB5D-FC358FE5C229}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{10F4F6D7-7BA2-4B44-84BC-CFA0E9175B80}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1137A2C5-B2C1-46A9-879B-538FA3A14F06}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{121C77E4-2548-4F85-9FF3-133122C6813D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{124E9080-FCED-4964-A955-5CC8B4F12C1A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1258645B-9AB9-42EC-9651-1B6A63A5B652}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{127EBF7B-8568-49A4-85E1-39936B526F4A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1348E08B-F8B1-46F8-BBB6-303403E18EF7}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{13BA92CD-159B-4D3D-81F4-DFF74D9F02B0}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{13BF6E88-B170-4BA3-BD1C-B92BC5F5B1E3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{13D85579-C47C-40ED-9F09-8194EF0F8A83}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1441DC81-21D1-4C49-A55A-1095BC0A1415}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{146472A4-4430-4185-9F72-A17CB6C822A5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{14944E4A-2970-4066-82C3-E25B4659B696}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{149D1CC3-844A-45A9-8D2A-634A338C3F87}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{14CB6B12-C172-4864-921C-65F8AA495244}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{16353273-4ED4-489E-A99F-49E926C88AF4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{16831434-8A29-43B8-B61F-15325285A53F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{16D5564C-5F22-4AFA-A3B5-5B50B57FCE8A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{16DC6DE7-E47F-4433-9D03-17D3648DC887}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{172A2727-BB45-4528-A2CB-C844301875F6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{17B30596-E274-4CEB-A871-96626F877F86}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1855D89D-1B57-48B5-B3E8-DE6E9D56C71E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{18623A90-10D7-4E3E-A5F3-7522FB269EC0}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{19828ADB-8E39-46C7-B277-B9655D6EAC9B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{19DD8295-0984-47AF-B122-1DDCFF414B8F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1AB228AC-B006-4E8D-A88C-331A5971B80E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1B62BDF7-C537-4128-BCA4-AE06D5EB007E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1B64B3B1-9491-4AB6-8484-0C6882E29AA1}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1B6C9AC5-0B9D-4AD7-96D6-A0A8973822A1}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1C21A8C0-9608-44B7-A0E6-D289E82EB8C3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1C5D2D4C-CAC6-4DBF-BD4C-94AA4E18648E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1C9A5E3B-E42B-4421-AFCD-379F3DF36225}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1CBB7C9A-ECEF-4B7E-A0EE-1632792CD24D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1D253099-8B5A-4241-AF88-A8C239692AD1}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1DADAF60-F95A-4FD4-BF00-508A003104C9}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1DD64483-62EC-4D99-8E47-9FBC18DF535A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1DD8A912-149C-4E13-9D33-54C44C55C678}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1E76F607-9CEA-49AE-AD63-2D7ECA3A4F43}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1EA2C158-C975-4E7D-A4AD-1D09F8FF299B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1F592E92-CDA2-4882-B272-E7620522ED58}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1F82586E-182F-4C4B-B378-7C2EC5C1992E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{1FFAAF6C-16C1-4A8B-8125-E4B00892F7DE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{201D719E-A09E-4B4E-879F-31212672B388}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2029FFB9-AD31-406B-827C-DF53942FCC92}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2030405C-3A27-43A7-8BFF-4482CD0833D6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{20F83CAA-FF06-47B7-AC0B-21054BE6C9E5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{210FFEAD-6748-446F-BED2-241180BE51BF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{212F9DAF-67B8-4E60-A94B-729F771AA298}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2133D433-DF30-437A-822B-793355FDA4FC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{21D31393-032E-487B-8EF2-9BD9E9B7D1B8}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2201F2AF-7C34-47C1-98AA-97309B7E362E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{222A7A10-061F-4918-95FA-02B07ACC6D89}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2278E47E-4B6F-4786-82F7-60C0C1CE5603}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{227F702E-D1BD-42AE-A09C-3E6DADD0D07B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{228B3D9E-81D6-44FA-BD0B-CF6635DD637A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{23468F46-3948-406C-8E5C-3CBB24E635F0}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{234F4F59-0888-49C6-AD45-3CDFE13B55F8}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{236C455B-A021-4307-BC11-EB55E75AA77B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{238837EE-BE83-4208-8424-2D2CA5F9FDBF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{23B2D085-6CF2-4528-A1A0-1F3369460C89}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2439FE65-5784-4E9A-97E5-79E5659F70A5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{248C0B38-3617-4841-AA07-48E6E9FED01C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{25441BAB-424B-44D2-9534-99D6D78C62FA}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{25617CBC-EFD6-4E8A-A687-2A998D418C89}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{257B0179-A57F-46F7-A49D-06300BF75A7F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{25A8FB2A-B64A-4D5B-BA3A-0B0F86F76E7B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2614C7E2-5991-4797-9BB0-5A568175A92D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{26230C56-E514-4F59-9BC1-2442BE0C9D3A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2662C28D-0D45-454A-81EB-2E6FDD97A074}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{269309B9-BAA0-4A37-AEF4-CFA43E904B24}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{26AE825C-9E19-4F4F-A838-5CD92DC38FB5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{28487413-323B-4880-B45A-51EEF551A5EF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{289FF3DB-1EF2-49EF-AB13-218B2B5205D5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{28E930EE-4495-4D95-8785-62CE658DD19A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{290679CB-8E23-4DEF-B1B3-6DCF76B40AE4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{293919EF-01CF-402C-AB64-1A5F365086EA}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2A061D6C-E6B0-496D-BB4F-13D0E8FB5B14}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2ABBB076-1C6C-45DF-9CA6-6C734FC87787}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2AECD6E0-C803-4E49-A07B-1BE7A225D710}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2B23E51C-9D96-42D6-A76A-7E58655D6981}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2B6D4895-0EE6-43F6-9EB8-D39B4E6E36DC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2B78D0F5-7077-4092-AF13-CC109FCF564A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2BD3F577-520F-46EE-85BD-4A26300D1BA6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2BE40B96-9DF1-4423-B126-28A100AACB86}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2BF2EB03-1878-4C44-872F-0EE69DDE560A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2BF3FAA8-2F9B-44E6-8483-A6570C14969C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2C602DF5-90EA-41F9-BB8B-0E25B8C3EA91}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2C79CA83-36E4-4AE8-938E-A804D724C8CB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2C7B9717-0686-4775-B040-D85D284CCF7C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2CAA8FBD-D643-4078-98C4-3A898ECBD02F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2CFBEB2F-C36D-4D41-847E-BBEBA5387165}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2D11380D-F839-4B71-B3B1-4131EE998E59}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2DB40786-B51F-45B3-9EBF-5DBEBF2D056E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2DEE0362-B65C-44EC-9849-AD58A19B5F65}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2E05EFDF-0317-48D2-9E57-9784890C89E5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2E7731B8-A517-4164-85B3-36657A96D56B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2EB93B86-8868-41E0-A505-326ED0C5B772}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2EF6C88E-FEB2-4FB6-9038-F643FE0BE374}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2EFF9CA2-D22E-40C2-AA99-1900DE38F598}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2F08842E-C95B-4A0A-8F82-E259F013B637}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2F50165A-C065-4511-B578-C107899A44AA}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{2F536F62-E547-43A4-8ED2-AEC179352125}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3049A978-4A65-4288-A04E-C8E8D342C8AA}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{31542CD8-3216-4D74-8697-5C6805091DD3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{33005AF5-A64C-4703-8216-E85DFCD7B3E3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3301CFF6-6F15-4F8C-8897-8060ECDBFDE8}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{330F4B92-6EDC-4B4A-8CA0-ED59BC6815C4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{33626497-4F0A-47DE-AE43-0CD4997D4870}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{33E97745-6795-432E-B2BF-BF092E1E1F27}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{344CF1BF-BE5A-4235-94F3-4E67FF00A321}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{347DD2B8-6A59-4807-B214-26B63E785596}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3521BD2A-5AE0-4DAF-B1E7-985EBD235043}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{35395A89-89AC-46F6-A8B8-5D20CA9E6E4E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{35E12632-FBEC-436A-AF41-244EE973F708}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{35ECD892-2B9D-41F3-BC18-6489A9086866}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{362F88FF-124D-4038-87BF-65039F6EBDA1}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3639E001-9DAB-46B7-A802-504B1D29388A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3684EB81-70D7-4D56-A912-3B71CD178097}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{36DD6335-3CF4-4017-83F7-4CBD78AE32FB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3762289F-2CA8-4CB5-B2AE-CE5EBB67AF5D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3789823A-DD05-4990-B474-78C3BDEF1A36}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{37AEDA79-56EC-45FC-9A83-8350CD6DDC78}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{37C1878E-B56A-42D8-81EB-184C303107D0}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{38B1FC3A-122E-472B-A2F1-13A165FA446A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{38D65D88-4494-4DAB-A975-754AB391EF5B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{38F2D682-F365-43AB-B31E-DA5E35A2A81E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{39066077-F184-4F08-8462-156807130B42}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{39398C23-8F78-484F-A8C3-67D08AA20552}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{39A4569B-27CF-4362-9C60-EF6170C8329B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{39B8AD17-C099-45BF-B3AD-13D6673E335D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3A266288-35BF-4D4A-8018-86281FDEEA63}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3A85B219-5CBC-4374-ABAD-35D7D389288F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3A8B89C5-3417-48E5-B6A2-04223B83DB8B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3AD5D7D2-DA04-4D82-9CB0-8A4B92C84B4F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3AEE5BBF-4E32-4475-B41F-57E919004CB5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3B237D72-D727-4F63-B0ED-B6B922EC6679}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3B533D6E-BE02-497F-B89D-48C36028D652}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3B95A30A-2608-4A32-9F66-77F9966EE9B1}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3BA1DD8E-7DEE-4CE6-A791-DDE83245A4CB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3BAE94D4-B1AA-47C7-81EB-C8CC487CE981}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3BB3872B-6B21-408C-8EB8-FFD07A5C9340}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3C0A293E-89FF-4A4A-B769-BC7E899A6A34}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3C847C8A-44F8-4385-9B82-3CC00FC0E9DA}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3CAE0EB9-6CBB-46CD-9265-EC9497A45138}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3CAF0EF8-94DB-491F-BCB7-9B8CAB7CEBC0}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3CFADAA6-C728-4A6D-83EC-47DE75FF2336}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3D9590F5-6123-4465-81F7-1AF1C913DEDC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3DD4A654-00A5-4E49-A8B4-44E4F73C6C93}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3E10A0B1-44D6-4BA0-80BC-19B3F38BCEFB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3E2D7672-0A1B-4444-B2CC-20A074961095}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3E4EA69F-1280-4DDD-989C-6EBB7895BD80}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3F0AA6DA-0B55-4E57-BBD1-58C6A1A766D0}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3F128EEB-C858-47F0-B1F2-2243048D894E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3F2D5B2F-74EC-4D0A-A16C-A1A29781B2BC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3F5580F4-404F-496E-8921-3605F450B117}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3FC1E842-6B81-403B-9D53-558C836837B3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{3FFE1789-8858-432B-AE11-F5073043A125}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{405655DC-939E-4FAE-B6C6-34D3B83750D0}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{40D8E12B-AA58-4ACC-8CEF-FC3557458BB8}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{415199A5-C292-421C-8E89-6ECF54F0ADAD}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{41DB6472-04F5-4FCC-94AB-83E61BCF47F4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{421E2F74-1C3C-47D6-8EC4-4408F20ADB10}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{42560711-181F-44D4-85B7-17507CF92F57}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{42A8B664-30AA-4D90-9F7E-8AAEDA593C01}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{42BFA457-6309-4D3D-AFE2-8C3DE97E99A2}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{42D1E035-B305-4845-B00C-27E52882C51B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{430CCE7F-A495-4D2F-96C4-EAC73EBC7D5F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{43941879-E142-4CF2-887F-01E09D66D223}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4450FB38-01C4-4986-90E0-07ADE8B6F462}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{449C3D66-4823-406E-9F53-24E78973D50B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{44A893B8-171F-46DC-9F11-FB4C7140836C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4510C6E8-51FC-4E47-BDF5-AE4FE6CDE898}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{454D3888-ED9B-428E-ADF5-2B9C5849EB80}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4601E4A9-0F5E-494B-B50C-01625437F155}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{47116286-A251-466F-AB31-B38058E6D0F7}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4728953B-071A-41CB-ABB9-A8E42AAB177F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{478C2C26-B36B-4B8E-8243-9C0F4959DE9A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{484873F0-2ACC-4B6B-B1D1-6C2DE41A6A1F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{485C40BA-D41E-40CA-BCEF-DCC3EE117D52}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{48A0B07A-B152-497B-8576-60377A34D400}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{494BE5AC-A53A-4398-B589-19D3C018D1E3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{494C0A71-D1CB-4005-BFC3-E410ABE11724}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{49AE096B-CED3-458E-AEA7-1D1D56E7F1AC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{49C97CFE-703C-400F-A765-D0E242F8498E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4A07A781-A882-48DF-B55C-2514A1DC8500}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4A7DBE42-E37D-4753-9464-838CE90279C7}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4AAB6173-DFBB-4877-B2C6-BF028ACA8D27}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4AC0A745-8C0E-4E43-9381-42C4B1A39442}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4ADCCA02-1554-4B56-9555-03006AC68697}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4B1859D6-CBF3-442D-9B21-3883A30E2B36}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4B6DD072-BA81-42A7-A13C-79E7F389E103}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4BDC5747-8694-41F5-87D3-C2F6CEB4B083}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4C26FB41-6A27-4A5F-A835-E04A350EC06F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4C3F5B42-12BA-43D0-B5A1-FDF2F8FC74CE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4CA42F55-A65F-4DE0-87EA-8BC336A5AD56}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4CE25C11-800F-42CB-A552-131EBB1F2C9B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4DBE05BD-954A-4794-84FD-AACE2E103521}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4E756524-4D14-4EED-976B-E692DD8740C6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4F141F7E-0293-4A53-B12C-21C5880CF245}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4F544376-5DCC-4AB5-BF46-ACDEB3067CDF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4F622240-C0B5-4480-854D-9D725790DFA8}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4F677217-CBE8-45AF-9ED0-F1C83376A015}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{4FA7CCB0-CD58-4DAA-9AF2-B17F51DFD7BF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{503DF2CE-BF88-4E37-B4A0-6F082F6A3AD6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{50C7EE99-8472-45B0-920F-211F9EA51C39}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{50E3E438-999D-417A-9AF7-F7DA5B0BEBA3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{51057FF3-FBDB-495D-9553-8546375D8901}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5157B490-8C00-4DE5-B0A5-48077BB69513}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{51C316C3-6C1E-41B6-9186-1C0D362A71B4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{51CCF42F-4D68-4761-890C-F79C8DD4E605}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{51DD2AD7-78AA-4BDB-806A-04013F1085DB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{52346668-13A3-4FD7-8784-60623741EA22}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{52FEF8AB-74A2-40F9-AE5F-1F56BA277F8D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{538519D0-4A85-4BEE-955E-BAD303186AA8}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{53ACE78A-7A67-439E-A431-3A0635B8C34C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{542D3D5F-6069-4EB9-98A4-D3C62CB8B735}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{54B04985-0B5E-47CC-8191-68469904494E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{54EFD3C9-DF83-4D54-B972-3A2EFE45D182}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5503573D-827F-48B5-904C-BA82E590C5E1}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{557676ED-79E5-467E-8783-A6564B4CAE67}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{55D27526-562D-4695-9CE8-6466A1F8A127}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{56B50DD3-E69F-4C0E-A08A-BF3CD71DAB1F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{56E6B873-F05F-4A91-93B0-75649284C5F8}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{56EE0D65-B803-4549-B147-E14704230F6E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{57012E9A-DC18-472A-B4F8-EC526A074F87}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{57064B94-5452-486C-83FD-E71E9870C0AA}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5710DB39-C0D7-4DB6-9670-C186EB8B8777}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{57150B85-F3D6-4E3A-B7E9-0B890881097A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5738A37B-963D-4931-9353-246E8CD131C8}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{579CD53D-1745-443F-84FB-CE18AFCD4A9B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{57A8061E-A454-4B67-9D2F-DDF56DF34D49}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{57CB86D7-817D-4DB2-98D8-30EFFAD84A68}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{581EE612-9881-41FC-AC3A-FB0A7FBCF198}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{586BC073-4904-4AA0-BD23-C5C0B3A3E13A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5919B8C0-1E79-4E79-95C8-FB7589EA0ED4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5922E11F-E0DF-4982-B561-FA67B50AD16A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5941C382-8C4B-4A1C-BB28-1C1163E99A0A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{594404DE-06C4-489B-8BF3-0D4934879873}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{59F35920-347E-4DF3-8270-5E74B414A1D7}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5A23AABF-7D45-4B9F-83B5-1CD115F79432}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5A3BAB2B-1EC7-4790-9C05-A0055A95BAA8}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5B14BC86-DB83-465F-979D-D0BE11325EDD}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5B536D3A-EB8B-4A61-B80D-ABE824DC06AA}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5BE7BC1B-F1D1-4156-84BE-B90ABA64043D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5BF9B77A-4132-47A5-B865-78E6F8135914}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5C1F31A5-B625-4D69-B0DD-D8B21CEB8D16}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5C3A4D84-99C6-4A6B-B11A-A5536AE884EA}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5C822136-3D05-4D39-81E2-382DA95B83F0}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5D3E94F8-1E61-40DF-846B-4309A9E8F162}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5D4EB37A-5E77-4A3C-80BF-F609A138A2C4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5DDDD818-0AF3-49F6-8620-E55E94019FD9}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5E22D85A-7144-4755-B31B-C470AE0AFD1E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5E24AC4D-AD1C-4B4B-9D8A-7D5E2B554C6E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5E2666CF-8C66-4B92-B5B3-1B9507102F1F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5E41C9E0-578C-417A-8018-4B56E77176A4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5E54603D-7EE8-4546-8E65-F0D46E2E78C0}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5E6257AB-7AD8-4C08-A770-4E8E63FF68FC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5EA03947-4D1D-41E9-8148-5341983BFB99}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5ECD1502-E952-46FE-8D8E-429450A3952F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5EE2867C-E5EF-4886-9CC2-1B72C5A8A355}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5EF983B0-CB5D-4D30-81F0-0E0AAF0413F2}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5FB0763D-7AA0-4287-92A4-FA04D7819479}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5FBEE23F-A1ED-445E-8BD7-9467E8B287C3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{5FF175C7-8995-401B-BA7C-00174F430E8D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{601A71A9-5747-444B-B786-D5D71D4EA556}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{6022279C-1BEB-465F-8289-22AC0E0B28C6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{604F78E6-E143-4E9C-9D2E-E17161A65456}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{605EC7E7-1246-4B06-AFF6-0361C501EEA9}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{60FA2BFD-74B0-4F69-823C-9E3C51373833}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{60FCC1B6-C6D5-4681-8D40-B2CCB8A34D26}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{61119BFB-A91D-46BD-B13F-F80FB444C226}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{61751A00-0D1D-46C4-A45C-3BC715306799}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{61D16E5F-7FC1-45C4-868B-8B9247A5183F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{626530EB-CC19-4B9D-8000-85570DF045E7}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{62D259C9-AF08-4759-8E33-E3DB84327DD3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{632EED5A-E8F5-43C7-8D89-1EFBC92A6937}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{63483770-092B-4C09-8142-61DCBF40886F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{63AB985D-97C6-4253-9F52-76585A82A730}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{63C4B18E-83BD-482B-A7CC-BE78651FD5B9}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{642A40B7-9081-4E76-A38F-6BA720D8A3D9}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{64A826DA-35D8-451F-8C33-E6C5763A229A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{64FD7E38-93D1-480B-A889-FA133372AFBE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{653120AE-1564-4572-9F5E-67334C787AC5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{654C9D1A-4F2F-4EAB-B97F-0712534E8996}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{659EE82D-0634-4FBB-8B2E-694A2637036C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{65BB55E6-E577-498B-877A-7065BE9CB8F4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{65DC5C6C-7E01-4579-9905-0D8F85E94A9A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{66A8EAB1-108B-4559-95D0-BC4AC5D4FD62}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{670733AA-B1C3-4C8D-8D9C-EF4679B27E95}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{674D4266-74C1-44C9-87EB-EC4282D57C44}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{681E031B-FD8A-407A-8B2C-295D0483F4A4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{6868D43D-9D4E-4200-9BB3-289601F3ECA4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{68EEF573-22FC-4ECB-9A3E-DA044DEE8053}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{694579D6-1B51-4AF9-880D-9CEE89399C10}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{6954C02C-82D6-42F9-9F3A-09C1C0953E87}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{69796870-52F2-4824-8B1C-22D444BCF860}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{69AF7950-4B26-4182-9807-942382B7CA83}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{6AAE0C5F-5BA7-404C-BD1D-CFB32B0A050D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{6BE95DE7-6507-454D-8821-3002124CC968}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{6D528E87-11EF-4488-B951-958C63A35A78}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{6D95F98F-0A18-40F4-8668-D93FCAE7BA2D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{6E8AAF8B-8960-40BE-94D1-3B0F65D44935}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{6ED0BB63-5FB0-4DE4-937D-DFE6188171C6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{6ED96BFA-8044-4844-AC60-0D0D885217AF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{6EE66E0A-3900-4090-8FBA-0A4E893B89BF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{6F013F38-3DF1-4570-8F2A-51BB50C7F2CF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{6F952D81-0CEF-42C6-9C29-AC9B20D71558}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{70726512-8CAC-404B-984E-ECAB86DBF66C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{70A1D0A5-30E3-45B5-8E2A-D5A217045715}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{70BC2012-AB08-49DB-AE3B-A6FE05D42792}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{70D2F383-5CDC-4842-BE65-9C280D7B2B85}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{70DB2E50-B318-489D-9E5B-339A7DC1DF41}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{71AEACBE-D660-4ACA-96A0-DC2DCDD466A6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{725AB27D-6322-4956-9523-1E5E7F0F529E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{72B91805-797A-4D0F-B5C6-6FAD701D069B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{72CC765F-D615-4338-B58B-C4B62EF71984}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{730C1E46-FFB1-46D6-8C6E-307BB34BDCCD}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{7383F248-616F-4DB7-8768-515C82F73A74}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{73CC56F8-A9CA-438F-AA13-A3E01BE38E75}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{73FE13FC-E768-4436-98EC-C91EFB2D896B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{74426809-2AF7-4C53-809D-54DB0BD6DEEC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{747FB42A-FF89-4960-8016-8E12556AC829}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{748A5079-4799-49D2-B4B5-4B693DFA9E9D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{749FBD85-0F28-4DE4-A181-0E42B2FC4859}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{74AF4385-2FA4-4772-8F45-F64E2D8F9C81}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{752EAE9C-B89F-4C55-90D5-FBC896335688}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{75437AC9-C09B-4268-BA4C-E990305209CD}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{75D4B79A-FAB4-45DA-8FAC-1DA3E468AC94}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{7615E41E-8F73-4993-8FF9-DD539EC76296}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{762BDF43-3AA2-4748-B8B2-12FC28100A04}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{76ACB834-27AA-4BB5-AAA6-F2522B0804BC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{774AD1DC-410E-46B2-BEDD-02336C8B7755}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{777CC71D-18BE-4637-A1FD-6F4BA857E531}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{7851DFEB-79F7-43CF-B0D2-5F7C542EB79E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{794E1D2D-04A1-4FD4-94D0-DA8963464DB0}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{798829FA-812D-4574-AF89-F19742D310AC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{79C0762C-5CF7-4AFD-BE37-B07FEE766581}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{7A838B3E-A217-4946-9B99-BE862AD4DDC0}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{7AF147B1-9493-4BF8-B7C2-E285FF2A7FE0}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{7B19FC26-8BFA-4F61-99E0-F8F52047C819}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{7B96F9F1-77F8-466C-9201-F53B4485D656}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{7BDEEAEF-2BBF-4C94-84A1-CFF52CFF63AE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{7C1B3441-B9F5-4654-96C7-A8587646529C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{7C858422-11A7-4875-80A4-5A0A30950914}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{7C98B8BD-E567-4FAF-9682-10E630C6A66B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{7CBBAE72-2343-40BE-9257-9842282FE5D6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{7D1B7735-B1E3-48C3-9974-A57E0E9F09E5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{7DEB2753-EAB0-4262-B754-E236C7456823}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{7E196FEC-CDA4-4222-8A72-001843B6B57D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{7EBB246E-1630-4BA0-AF69-9D1B72FA0802}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{7F50A306-82E7-4BA8-8264-8B1BBAB0DEAE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{801616C4-823F-4951-84EB-DFDB5ABDDDEB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{80480ED4-15A4-4E61-ADD1-ACE1FFD4A04C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{81074167-5906-43D2-AA7A-A65A528B3F80}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8144DFC1-5377-4A39-9008-0E4BE305586C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{816C86C0-2CEF-4A4D-98E7-49FC5BCA1472}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{81A3346B-A4EF-4080-8323-DEB775D5D9CB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{81A3D20B-780E-461C-B164-96B418483F43}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{81F7B4EB-5CCE-42D9-BF48-D1E5AD9B53DE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8242A2AE-A284-4782-895A-05A4106BFF88}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{82441B10-2AC9-4B33-9177-7636D6915170}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{82D23E3D-0D1E-42EA-9895-A5C3F1A2C79B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{83042E0A-9E5E-4B79-AE13-656457AE7829}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8369C4E4-71CF-4AE8-AC18-213FDB326468}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{839BFA21-8E76-4EB6-97D3-789CAFF998F3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{83CE0331-7CB3-4D50-8672-824A5A764E81}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{849E5028-F7AC-4800-ACDD-23D3BB4CE16F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{84B497DD-1762-42E3-85E7-2D131E206792}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{85A02817-9653-4029-A7B9-D55C10E3A15E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{85CE0CCA-EE3D-4F9C-B9F8-6C82668A7A18}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{860FC18B-37D1-4899-B709-223805ADECBB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{867FFF17-503A-40D7-B44B-8ED171DDE242}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8695F56F-0B53-48C8-9D9C-3188BEAF4104}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{86D8CDEF-4176-404B-82CD-D1A999656919}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{86D9C67D-BA05-480C-A16F-008F1E0CD592}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{86F9481C-7E9A-464E-AC18-8D844961CD34}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{871A9A1F-7BA3-40F4-8CE3-81D6699BF85B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{87ECEDA0-9CEE-44C0-8E3B-90A98699E471}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{87F47445-31ED-45C1-8813-666CCF7A0A81}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{88849F4F-EE59-4A6D-A168-DEBEBF23B87E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{88D16383-E298-47E6-8AB2-5DC1EC03AE49}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{88D2627B-7B91-43BB-8EFF-7F07377C93CF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8911186A-CD32-44DB-9B1B-042C71EE4AB4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{895F6110-9820-4099-AC05-775C859973D5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8969B988-24CA-45F2-9FCB-65DD58ED883A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{89DE5B4B-5D6D-42B1-933C-631C22283BDB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{89E3511E-9074-4976-8C2B-A70A64C639CD}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8A2C8497-1D91-44AE-9D9E-D51BD3AF2223}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8B541D73-FBF7-4661-B416-9EAB17B5F240}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8BDB2A14-F5AC-4B7F-8B7C-08451247E5D8}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8BF63536-7DDE-4048-9025-0890582C5C92}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8BFFA736-CCAC-4735-A7ED-DD31C0F6811C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8C03E110-F000-494C-B9A1-B0169DDD1882}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8C06A71D-2E6B-40C4-8D86-C1C59F5C95EC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8C5FB426-A16A-41BB-8AA7-1247A1B0D3C7}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8CB26936-6450-4DE1-82C3-F4E5B2FB709C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8CDB8D36-22F6-43E3-B35F-F197179F0508}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8D388A8E-C0D3-4811-A98D-8F993E3611EB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8F53065F-0D0A-4218-BF04-E672BC44AEFC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{8FBF5D85-BDAF-4BE3-9095-B8FCE5CD856B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{900C2023-62E5-4D7D-A885-0E89E721CCD8}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{901B1E4B-1623-4E2A-91C0-7AB0C4A653D3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{90518C97-4F44-45C7-BD1C-B7ED5905E4BA}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{907D0455-3027-4C46-9F33-77ACBEBCEE8C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9151535E-BE9A-4472-A400-98642A75317F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{91A03905-BCFC-44C8-9011-9C7F382EDFF7}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{92AF9E94-46F3-40DC-8001-EFD3884E220E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9365E05E-DE33-4C05-AA3E-6F17E55D3A22}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{93786777-DB64-4364-90FB-0320D8B817E4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{940D76BE-3184-49A6-8A99-264A7483E496}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{941DFC49-ACF7-430D-AC12-0B787E1215B2}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{94BD779F-4A6E-4955-9196-8616C843BF11}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{954AF3E0-1CC0-4435-B479-CBE76DE588AB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{959666F9-AA12-4580-A8F7-D539E2211877}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{95D53B48-E6EA-436F-A48F-7CE57CBDAC35}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9610A60B-3D57-4163-BC14-0ACB6C017682}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{962D365B-EF15-471B-BD5A-726C15968B05}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{964BC8F1-ECA7-4FBE-8AE7-271695DC60B0}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9670EEE7-2998-462B-BD50-5BAC77EDC6B0}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{969B9BAD-D188-4479-AE05-66E9F921B7CA}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9715E460-AC7D-43BD-A074-BF43DD185799}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{97485600-DD67-4733-A16D-75B1807E4500}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{974C3902-F7F6-4419-A763-F5614D055B35}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{978621BC-C7BE-489E-A754-3B2C737FC10F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{978D8D5F-8E28-405D-9ED8-310037AE4524}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{97906D4D-DEA1-4B59-BB07-5140816E8DED}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{97C42AA6-3023-4B2C-A505-6D82A187119A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{987CCD66-D4D6-4B13-B4A1-27211AAFB691}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9884EBF1-AFA2-4246-BBA0-74C23625A2ED}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{98AFD70C-C5DD-46D9-859F-6982860FAD18}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9A1ADE63-F0B8-4F4A-9CA2-CE92F8BEF6B7}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9A49A4ED-EF1E-4AFE-9DDB-D8C09BFE3BAC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9A7CAE0D-D09F-4853-9E42-2E412479BFEE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9B47AE38-BC8D-4830-847E-425AB7504848}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9B49EE54-DCDB-41D9-AB4A-314A324BE5CF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9B9C5FC5-1FB4-495D-8EB3-E3E9A4CE8E31}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9BF3D5A8-32A1-402D-AAF0-11476353632B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9C5C6F57-3CB3-4E07-8403-F3EE4D39F18B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9C67B488-AA8C-4D3C-A0ED-155B659D857E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9C73905D-B167-442D-B2C0-FB9AA82BC53B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9C8E9249-FF3B-49CE-AA1B-8AD4D6E734DE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9CF3EA26-5E68-4EDF-9A53-BFB5BC243F01}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9D5ED59E-FAE1-4E20-9286-DFDA9A26C945}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9DC22ECD-BD25-41D1-9742-4D45EB0CC58D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9DF99F8B-1C36-4434-B506-EE5C3C225FBD}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9EC634EE-F12C-4AE2-B53A-B2DD3DC121CB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9EEEA333-1FAC-4237-B52D-9F26BCABD63B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9F843446-9BB3-4D01-B3E2-ACCFF87301E2}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{9FA7C149-4921-48E5-BFA1-7F208D417265}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A02293C3-51A2-4283-BC78-4BC23C5C99D6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A0D47115-952C-46E2-882E-D8E789E69E2B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A0E178CC-0B68-47BA-8077-7975583290D3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A158E023-21F5-4BD5-B99D-B53B69F4DF09}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A15B572A-B07C-4884-A993-CEE38A6DDD89}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A18C9EB8-473D-4DA7-9078-B04B7D5AAF4F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A192A5E7-7CD8-4F18-A85E-91BF17E54D46}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A195AE63-289E-43FE-94E5-AAC1594B9F94}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A1BCE155-1E38-4822-92C0-3FACE41BECCB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A1DC36CB-E84F-4964-8AD0-6C02D323FCD9}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A2CC2961-2923-4D24-8E3F-4A96BF05F537}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A34B0195-445B-4D92-9BC0-34D34837892F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A43B030B-2BCD-4715-A567-92AEACA06801}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A4D39DFC-4A3F-4992-AF25-52B831485A78}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A50AA736-6405-45EF-9015-079220A6A6FE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A53EE0E1-F79B-43EB-AD49-3397ED9C3E4A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A581AC8C-D1F7-4273-A68C-63BC7BACA5FE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A5B9E1F1-0C40-449D-8BDF-CF37863B1972}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A5D800F1-9E0C-42D1-AC60-CFE6F3492414}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A5F9AAAC-F2AB-435C-A2B9-A404017379E9}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A645EEA7-334B-4B5D-802A-ED89B989C9C6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A6D15825-DE24-4914-949E-7E6ECF1124C2}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A71B00D2-D3AD-45BC-96D4-DA177786F597}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A7356539-610A-41EA-8D66-3109E2A51B89}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A78FD21D-DED4-4E5E-948C-37A36663F92C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A791E9D7-9ED2-4AA7-B07D-3E0690716F30}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A7B030C3-DB61-4943-A415-A46959C11D78}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A85F9E72-C9ED-405D-A2C6-C27154262C79}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A8F573B5-0249-4F34-B6F4-39B010DDA828}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A95A10B6-8C11-4C5D-87E6-75AB031ADBEF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A972CF19-C496-46AB-822A-D0DAF03B39EB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{A9CEF0F6-E24F-4531-AF34-843D4663A93E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{AABDC7CE-897C-434B-BD82-402BD71AE49C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{AB189C5D-C12A-435A-9C6A-06432A1443B7}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{AB261C86-A766-480A-8EA9-0BC8FD44E2E9}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{ABBE8431-DFBD-4814-B9DC-5BB2BD249B36}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{AC501AFA-F18B-4DBD-A31A-16FE0FEC7BB3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{AD041551-F070-4616-A3AF-DD376797993E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{AD7E061E-9046-49F8-BFBB-1106D21439CE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{ADD47670-E6B4-4AB8-9131-89BF00BA30EF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{AE201531-E163-4CA5-8917-A91207D8F9C8}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{AE3C1B87-3727-4D51-9E80-0A1435B360A3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{AE4EF10D-5D7A-41A4-A70B-0AD091CE31B4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{AE88B54D-94C5-42CC-AE84-88452BA03290}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{AE8AFF44-81A8-4D15-A420-1FFF835016DA}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{AEF3623C-ED3A-4058-A5A9-5A0C49A7503B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{AFD5AEA2-4515-4C8E-AF9A-45007C35A59F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{AFF996C9-D9AD-455E-B477-2D89B42F72AF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B00FE327-143A-48E3-BCDA-F5D16DADA213}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B04DCB0D-40A3-4B4B-AAD1-3BCE09E04E7A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B06C57C3-F498-4154-8FD2-B0F06EB2B00B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B0EB76C5-9265-4F3A-9E8A-AD1B3E20E785}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B142966E-CF93-4CE5-8131-A25A7549B415}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B30237BA-D8DB-4105-8A5F-DD6FB3418A1F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B3721A7A-DFCE-47E5-9A94-F4E5E0DEFC66}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B43E3596-1FE9-4E0C-9CDA-DCF706F490C4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B4744C6E-6545-419B-81D1-A5357D50F111}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B4D33E9F-BF4B-4C85-9D6D-A88D1DF15CE1}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B50D4E83-9B4B-4A1C-BCC6-7FCC71265B72}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B57E34EC-9B77-47C4-A776-87DD7AE90828}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B6402D5F-B81F-4E11-BE53-A0CB9AD9391F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B70894B0-2350-46B7-9764-454409152B99}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B72E2C91-1A95-4150-8B0F-069275922330}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B7B5F8B1-40BE-4C48-916C-F34641CEEAA6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B8D38F6E-4854-4BE1-9815-FC744166DBE3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B8F2706B-5AC1-489F-BFF5-DF37C3F9B626}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B8FB9496-2BAE-4F74-BF00-E55DBC23EEC9}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{B9E6BCA1-8748-47D9-9A7D-9EA785253725}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{BA8F8A2C-2D7A-4DFC-9F39-5DD136E608B1}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{BB538600-665B-4E86-A0F3-4D9992A5411E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{BC18D2BB-76A1-44EB-B168-4B6E947640DD}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{BC2930FB-4A93-45F1-81C0-9776898750B4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{BD3784B1-2471-4D97-9BBB-F9F4D83857E2}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{BD797EB2-B09E-4E75-9547-11A58AFB6ACA}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{BD87C7E3-0B50-4627-A816-01F09C1D4549}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{BDC99822-109A-41D7-BB58-B34FFAC9A99C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{BDE9454C-1725-46D6-B356-FACFCE7D7945}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{BE2AE1EB-9CE6-44F4-9A4A-7236A7FAA78E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{BF1EB0D3-BE83-4676-9EE9-837DF71683CC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{BF243732-C0AD-4B9E-B666-36D5435C5F37}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{BF9DBF9D-3D45-4BF6-B6A6-2F2764F086AC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{BFD321D0-01E0-4692-BD38-7E95141CF4F2}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C0516E5E-E4F9-4E03-AEE0-8F2274FE40E4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C068CD7B-B01C-4443-B9E1-C095CB6373AA}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C078527D-4FDD-42E3-9F27-D228A558E9C0}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C0A5FF72-503C-46B7-BBA4-5DBFF66EAF1C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C0ABCB2F-5B03-4F4D-94DE-B7AEE79CC7D6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C0AEEE27-CD2E-4CE2-B8BB-AD5C3D87B000}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C0DDF689-093F-42C6-B3FE-B9504DAAE537}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C10533DE-BB22-412E-A846-95B63058A153}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C13B2225-B65F-4013-B2BE-488A0BA3B660}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C2B32522-16BC-4A78-AA5E-7665D0DFD7E8}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C35334F8-014F-4907-8533-66F4F82075AE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C365642A-15D0-4FD1-843D-B1BD3C9E3829}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C3D58275-2473-40CA-B2FB-E7006B80CD62}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C3E4B7EC-7149-418F-AC6E-3EE6AEF9D6F3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C3ED306C-CFD0-4FAB-80B4-9F9D2C262927}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C439A68B-C536-4905-A9AC-6A7AA1C9CA31}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C459447C-DED4-4670-BC13-9A24004A2B96}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C4F4F0DB-5B34-4313-9DAA-E930C5451B33}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C56FB88F-CDDE-4E01-BB95-C942896A5DFF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C5A8F5F0-6E0C-4405-BC5C-3A0BF7EB2782}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C698B0FC-B4CF-47C8-9CA6-9CD20843BE70}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C6F3A8D3-B857-459E-9650-D45CC755DBAE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C703AA70-DD6B-400A-9DB6-AFD4A26E6AEE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C7186E7F-4945-4964-90A7-812C8F0E15AC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C7556AAD-2B74-48F1-8DB1-0FCAFB24332A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C7795795-2C30-418D-80EF-D7D0345F6DCD}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C798DE0B-3046-4796-9972-DE8588CF43ED}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C7A33FC8-AD67-41F0-9444-CB9686B19EB9}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C808BA2B-A904-4721-B851-88724093FAD5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C81A4924-5CB2-467A-9979-FC563F2F6C25}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C87270D3-29E7-40B3-9FB1-FBAC06ADF583}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C87D5313-3BE8-493D-865E-4551FE42055A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C8D23677-5A23-4EAD-ABC2-71A56CE791C5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C8E9354B-7DB1-43B0-B86E-E51903D87074}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{C9D9A771-2700-4AA5-BD59-294B1FDDAD0E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CA57B0BB-2588-4D4B-87C2-B129013214E7}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CA918394-93B7-47A2-9830-7388E73046A4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CAC9C4DF-06CC-412F-B890-00E96102EC30}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CB210924-1EA5-483B-A4E1-92A2F3049C08}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CB335AFD-A83B-4466-BEC1-2CA0481CC8B6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CBD51E26-1D1B-4AC4-9F01-BDAFE0A61980}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CC1E3B75-0C40-4422-848B-7160221D9406}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CC430206-9C57-4242-BE1B-A7D0AF81EB21}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CC9EC1E1-234F-40C0-8CA3-ACB948067CD6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CCB1B2E2-8894-42B2-819E-9C1338AF1A51}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CCF9F8B0-1D49-4850-99B8-198CB6263704}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CDE34592-8D62-4DAC-A946-7A3E74443A01}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CE1DFDBD-22F3-4454-A6AC-B47F1E13E3C0}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CE505198-37DA-47E9-923C-BBE3A2C5EB13}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CEEDC0FB-1E5B-4F54-A7FB-0DF915FEDE88}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CEFD89D2-E0CB-432B-98A8-84DD0D9258D8}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CF20E3D5-ABCC-495E-9247-F0CC756E82A6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CF68581B-FD91-4CBB-B948-117410A614A5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{CFF1F32A-9372-452B-888C-7DC14D240EA2}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D0555DB7-C17D-4BE9-BA93-E0B06AF22376}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D0698DD5-036A-4C1E-BD31-55FA3D4079D4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D09AB620-89CA-4D42-8252-3EEB06A87E27}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D0F62DBB-B37C-4857-AA2E-6EE323C7A012}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D1513313-459A-458B-AEE3-5405C27E177A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D1673F0D-BF60-4A76-B4B1-0A59C37BCBB2}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D1742F98-B475-46AB-9422-E158C43122C2}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D18CB948-3399-45D5-9835-2F40846CEB54}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D1AD81E2-4E72-41AC-827F-58FFA61F5558}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D1CB92AC-EB68-448A-9128-BFA7FC57660B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D2497962-9475-462E-946F-0754AC9F1D59}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D251B9A6-3CAF-4864-BB13-3EE092DC48C9}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D26C0C53-33C8-488A-827B-4216EE465056}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D27A6B08-4562-4F7B-A521-B17A1F7DF072}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D2C1DCDB-5483-4A0F-A81D-60E90C569FA3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D302E0B3-0238-45FE-B231-F104E1111375}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D30EFBA2-83E3-4AE1-9F40-5369D9612D53}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D32370A5-3A25-4B3E-845C-E6DC912449C4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D38EB11D-163E-47CE-96B7-7C33CCA9933E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D3D21408-A0F8-421C-80A1-A08B2F8642D3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D4339B98-5B25-40E1-8508-315F12421003}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D48F7A5F-A2C5-40D1-8A96-30D9C7D4A66E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D5F11C7A-4AC1-4113-83E3-18E7246B7443}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D648D10E-E4CD-4652-B1FA-0206DAE15F2F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D656DED7-63ED-405F-8A65-6C43EF312695}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D66B60FA-75F5-4C28-BC3A-F99599EA554C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D6C07D49-B57C-4DE9-993F-75ABC84E0FDF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D708C445-FDD9-4A0B-9053-908B20409609}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D74F0F59-B89C-4466-8B7A-C2E7A80D9CBD}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D78F5E8F-5C27-4F3A-A4B3-0AE5B22EB585}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D7BB7593-F098-4CC8-8C00-EBED0E0B0DCF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D80B0DCE-051F-4344-AE10-EC06ECB37817}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D87BB143-EC5F-4345-B1D5-C2089E53A3A5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D8AD980F-D7BD-4DB7-B124-3B5255519BBA}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D8FA38E8-EA06-4508-8659-2E1071CCB7EB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D923CBA7-14DF-440A-9A3F-B0B2BE15E4BC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D9587A5E-D0EA-4FD0-990F-53EC3BBC98F4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D974BC2C-4CE8-4516-906E-6AEFB2573B51}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{D9EE7045-BD06-4505-8210-47309D414BA5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DA060B76-7779-4DDF-8066-76F10DCB20C4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DA0DBFA1-23AE-4DF0-8139-8ED94A77DA38}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DA1EB1E0-A184-4F2E-A99F-82E56819E414}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DA588AAE-27DC-4974-BB25-DDD2D7B6F968}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DA645F3A-99E2-42F6-97DD-A41F39A278EB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DA876973-62FD-420D-A29D-45B968A0FE82}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DAB4421D-97A2-4707-96CB-73DCE0B31FC7}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DB1FBC93-74EB-4A7A-8BAA-BFEDF50A427D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DB49EAF3-459F-4D5E-8F8F-ED9350695149}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DB7E7131-B21A-4704-A062-44B04A9B1D9F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DC9CDAA5-E67C-4276-B5CC-6B69F9CC1485}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DCCB5A19-BEB0-4070-A937-0BB847850317}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DD3A0C0B-E164-4D88-A93E-A7BA7D9A3BBB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DD6638B3-299E-476D-98F5-C8929547058C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DD93F932-F878-474F-AFFC-92D33E7D754F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DDB82A57-1057-40A4-B25D-C6459497AABE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DDE2B104-15CA-42CD-9661-151E795BA008}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DE04697A-9D49-4955-A4E9-252A32979B5A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DEBCB569-D0A6-46FB-8FD4-C33A468163A2}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DEFF4754-70D9-45C1-B0EE-797D45BF5243}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DF540DE8-BF98-4CF7-90AA-F6E4C5E46593}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DFA75EA3-8A2A-4DCD-AC72-868205143019}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{DFB7044E-4B8B-4DCD-B9AF-F9F81419DB0F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E02B7CF9-1EE5-472B-B78A-DACC7E13A1CB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E073EA2F-6CE8-4228-8CE5-7F6BE84A073B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E0CD54BD-A0ED-4ECE-B561-D64E58616E3D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E1AB142B-BC36-4594-B9AB-DC011A6DE74F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E20D18D4-91BB-4B01-B59C-71CC9D19E232}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E214B958-1687-4609-B24B-FAA251F03712}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E2705265-1DBC-4817-8707-2C5D154421A4}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E2BEE100-EB73-4AEF-A3B8-49A483976699}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E2FA35E6-631D-485B-AAFB-5575A949691C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E303E80E-A8DF-42AD-B195-5E9670928586}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E323EB56-98C7-4614-B743-E873C27BCABF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E365C682-C81F-47EB-AA84-7C95AC343E69}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E3780571-F1C5-4C41-93DA-E4A64120E568}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E3AAA002-BC98-4694-B2E9-159AE39C0AC9}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E46931D8-05E8-4676-9B63-FE99CE4D1D7E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E4B2214D-7315-4FE6-905B-601E86313C51}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E4C8CCB0-9E0B-45C7-ACBC-645D6D87E7AE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E511DD61-4BCE-451F-BA2A-99145EB2305A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E512D59A-F7E3-45DC-A523-FED96749F95B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E557ED70-51F1-470B-AA60-08194D4C46B8}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E646B938-81C2-4836-98EF-11BD6591F30D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E6673988-BE77-459E-920A-CCC0438F40AA}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E6968EA6-DB84-4CF1-A386-90E37D4ED028}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E6B59A71-AE48-4CDF-83A8-DE2604A4D0D3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E6F1FED3-CF34-4752-A5FF-06737D27EE62}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E6FB5D3C-F865-4C43-91FC-10811EAAFA9E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E739ACB6-3537-4122-B92F-DF352229E991}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E786F299-89F2-40DB-B1F5-4F96D683EA09}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E7E2859B-1F55-44CA-82DB-B606BF028BA7}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E82A0E96-89D0-4D78-84BD-C0814C9B8534}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E83FA681-47D5-4C7F-9A3A-3DD7199A9CA7}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E871C80F-C56D-46AD-995F-486A64690D48}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E9371B92-732A-4772-A6E9-16430CE51740}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E941DFF1-09DA-45EC-991F-8F1ED17B0F41}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{E98C53E3-C9B0-4761-95DA-CAA3DEF65C54}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EA126D5F-BF36-431E-BB19-E1EF801645C2}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EA1AEA36-6E4B-4E98-8565-C833C6961659}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EA8F6CC3-5F00-4AC2-9F7D-4B5BEBEDFA30}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EAC2F6F1-509A-40C7-B127-8DC62D3729A2}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EAFE17DC-559A-4730-BC73-CB932C2C3B7D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EB22CA5F-095B-46CF-93FB-FC9E15406BEC}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EB49FCC0-9739-4443-AA55-331BAD5F6802}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EB869793-C527-438B-977C-187BAE89E696}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EBC2E5A5-499E-481B-812B-193AED577C74}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EC519767-6FBC-4BA1-8D9E-4AE43D89EE54}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EC84CC56-1618-4E4F-A8B5-49EADC29C04A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{ECF558DD-8DA9-46FF-8C27-D7759778E6C7}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{ED1D763C-5102-453C-8229-EB545F64EB4C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{ED40F17B-8EDB-4A83-A236-5D2646E1DEFB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EDD1A5B8-0876-4FFA-8FF8-E589F15803EE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EDEBFDAF-1C84-4787-9AB6-F229846B3DBE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EE4561B5-C819-4DBB-B144-E128DF877096}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EE8D951E-4CA8-4C00-95C8-77A4E0F9D8A3}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EE9A2D73-C71E-4DC8-AFAD-15B5AE8CAB91}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EEB1B227-2557-47B8-9372-C470C024F663}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EF800EEF-A6C1-4576-AD8A-0B404B8F34DD}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{EFE3FB72-C379-4B67-BBF1-E2A3E96BD748}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F0334247-9E91-4A23-B46F-1D945F212ECB}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F0418ED0-78FA-4359-891E-76E0B6B89402}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F1721EA5-D1F0-43B3-B3F7-0CBA7300ACF0}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F2339B04-7DA8-4965-8390-25538C8EF26C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F255A906-EA18-440B-AE3B-05AAE70622FF}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F2DC0145-789D-4D61-9243-1D12687F0C00}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F3111117-7460-4A5B-B154-B1FAADCCF57F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F39E8DE1-AFE1-4E42-AA43-A47609741528}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F4D5084F-297A-4E46-AD2E-D488C2EA962B}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F525B81A-1C5E-46E0-9CC2-83910D4E1482}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F5528C18-9CC7-42AB-A02F-BA1941E0079F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F55E1B61-42ED-42F6-BB08-79E2A8DDA636}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F5F5C6A1-E91C-4197-A226-EE4E878F0D2E}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F637F01E-7A88-453E-8023-69D8F0B35723}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F6528233-F0F6-4F22-AADA-FF5F8D92721D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F68C962C-2E53-4A63-B142-E7A902E96374}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F6BC419E-76D1-4259-8069-737F11484B3F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F6BF5A06-1D90-41A3-B0D6-3C16418B870C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F704BFEA-4FFE-4497-BCAC-89155EBAF9A5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F7A8D061-89CA-4161-9F61-1E4388B80886}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F8B695F1-85C0-4400-9AAD-3E4DB7184F48}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F928207B-01B5-4E05-B01D-FCEACAA23BD5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F958B4AC-85F2-4FE9-8BC5-25FD19A9304A}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F999BF84-B4C8-4FDB-8514-6B1A6167EB39}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{F9C8C52C-148D-48AE-80D2-F2529323D6FE}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FABD5718-7548-4567-ABB5-8B86EC4B5470}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FAD06169-D8B1-418A-8B54-552815AD83AA}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FB013E73-A085-4678-9780-D1CF8EE0B34D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FB04F9EB-03C2-452E-B9B8-C39CB8489743}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FB28863B-6A37-4F12-B89A-C7AE7231D203}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FB348BF4-E969-41B9-B98E-6E52A27822F5}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FB8D73E3-997A-43DF-BEEE-0677E476BF1C}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FBF3EEA1-5A47-4E46-B51C-BAD429FD5BB1}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FBF973D3-B366-40E7-91DB-E5E06CA094D6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FC1AEA17-4344-41CB-B30D-54498B6825D1}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FC251D8F-3090-4908-8318-910B058D1FC1}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FC8B43E1-DA9E-4E13-803C-EA68543E7571}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FCB510D4-F357-4158-9EFE-999516CEFA33}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FD48E8B3-73F8-4BF6-A296-35877543B883}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FE12B966-75A3-484A-AEB7-D657F4996B0D}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FE589538-1C60-4B07-A37F-E329FD6D0DF7}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FE5BCC01-AA27-4DC7-8C22-4EC9408F5976}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FEF38BD0-CB0D-487E-B26D-A773A23F7C72}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FF3B97C9-B183-4615-86DD-C7DC46CF0CD6}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FF805AD0-A480-486A-A9CE-F6502F200321}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FFB12271-5A7F-461B-818E-F162AF6C382F}
Successfully deleted: [Empty Folder] C:\Users\Sara\appdata\local\{FFC08A39-24D3-4EC5-A40C-25E4CF8610D3}



~~~ FireFox

Emptied folder: C:\Users\Sara\AppData\Roaming\mozilla\firefox\profiles\kfgyinw6.default\minidumps [136 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 03/04/2014 at 13:25:36.46
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[gringo_pr]

Hello lantis33

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

• In your next post I need the following
  
• Log from Combofix
• let me know of any problems you may have had
  
• How is the computer doing now?

Gringo

[lantis33]

Thank you again for your help, Gringo.



I am still having pop-ups with nearly everything I click on in the internet. This time, two pop-up ads appeared with clicking on my mail link in yahoo. There are still smaller pop-up windows in the bottom right corner.

I did not have any problems running combofix.

Below is my combofix log report.




ComboFix 14-03-05.01 - Sara 03/05/2014 17:04:28.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3891.2092 [GMT -5:00]
Running from: c:\users\Sara\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Sara\Documents\~WRL0005.tmp
c:\users\Sara\Documents\~WRL0078.tmp
c:\users\Sara\Documents\~WRL0105.tmp
c:\users\Sara\Documents\~WRL0129.tmp
c:\users\Sara\Documents\~WRL0215.tmp
c:\users\Sara\Documents\~WRL0335.tmp
c:\users\Sara\Documents\~WRL0404.tmp
c:\users\Sara\Documents\~WRL0407.tmp
c:\users\Sara\Documents\~WRL0435.tmp
c:\users\Sara\Documents\~WRL0737.tmp
c:\users\Sara\Documents\~WRL0756.tmp
c:\users\Sara\Documents\~WRL0782.tmp
c:\users\Sara\Documents\~WRL0937.tmp
c:\users\Sara\Documents\~WRL0939.tmp
c:\users\Sara\Documents\~WRL0940.tmp
c:\users\Sara\Documents\~WRL0945.tmp
c:\users\Sara\Documents\~WRL1077.tmp
c:\users\Sara\Documents\~WRL1116.tmp
c:\users\Sara\Documents\~WRL1134.tmp
c:\users\Sara\Documents\~WRL1176.tmp
c:\users\Sara\Documents\~WRL1321.tmp
c:\users\Sara\Documents\~WRL1421.tmp
c:\users\Sara\Documents\~WRL1466.tmp
c:\users\Sara\Documents\~WRL1478.tmp
c:\users\Sara\Documents\~WRL1481.tmp
c:\users\Sara\Documents\~WRL1546.tmp
c:\users\Sara\Documents\~WRL1586.tmp
c:\users\Sara\Documents\~WRL1731.tmp
c:\users\Sara\Documents\~WRL1850.tmp
c:\users\Sara\Documents\~WRL1874.tmp
c:\users\Sara\Documents\~WRL1941.tmp
c:\users\Sara\Documents\~WRL1974.tmp
c:\users\Sara\Documents\~WRL2289.tmp
c:\users\Sara\Documents\~WRL2360.tmp
c:\users\Sara\Documents\~WRL2370.tmp
c:\users\Sara\Documents\~WRL2387.tmp
c:\users\Sara\Documents\~WRL2635.tmp
c:\users\Sara\Documents\~WRL2669.tmp
c:\users\Sara\Documents\~WRL2747.tmp
c:\users\Sara\Documents\~WRL2982.tmp
c:\users\Sara\Documents\~WRL2992.tmp
c:\users\Sara\Documents\~WRL3106.tmp
c:\users\Sara\Documents\~WRL3211.tmp
c:\users\Sara\Documents\~WRL3292.tmp
c:\users\Sara\Documents\~WRL3399.tmp
c:\users\Sara\Documents\~WRL3561.tmp
c:\users\Sara\Documents\~WRL3610.tmp
c:\users\Sara\Documents\~WRL3789.tmp
c:\users\Sara\Documents\~WRL3855.tmp
c:\users\Sara\Documents\~WRL3860.tmp
c:\users\Sara\Documents\~WRL3879.tmp
c:\users\Sara\Documents\~WRL3982.tmp
c:\users\Sara\Documents\~WRL4084.tmp
.
.
((((((((((((((((((((((((( Files Created from 2014-02-05 to 2014-03-05 )))))))))))))))))))))))))))))))
.
.
2014-03-05 22:12 . 2014-03-05 22:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-03-05 22:07 . 2014-03-05 22:07 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B972DAC4-26E3-4072-82AA-245A3AA827FA}\offreg.dll
2014-03-04 18:18 . 2014-03-04 18:18 -------- d-----w- c:\windows\ERUNT
2014-03-04 18:08 . 2014-03-04 18:10 -------- d-----w- C:\AdwCleaner
2014-03-04 14:31 . 2014-03-04 14:31 -------- d-----w- c:\programdata\OEM Links
2014-03-04 14:31 . 2014-03-04 14:31 -------- d-----w- C:\MININT
2014-03-04 13:39 . 2014-03-04 13:39 -------- d-----w- C:\SUPERDelete
2014-03-04 13:14 . 2014-02-06 09:01 10536864 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B972DAC4-26E3-4072-82AA-245A3AA827FA}\mpengine.dll
2014-03-04 13:08 . 2014-03-04 13:08 -------- d-----w- c:\program files (x86)\Common Files\Skype
2014-03-04 13:08 . 2014-03-04 13:08 -------- d-----r- c:\program files (x86)\Skype
2014-03-04 01:04 . 2014-03-04 01:04 -------- d-----w- c:\users\Sara\AppData\Roaming\SUPERAntiSpyware.com
2014-03-04 01:04 . 2014-03-04 16:07 -------- d-----w- c:\program files\SUPERAntiSpyware
2014-03-04 01:04 . 2014-03-04 01:04 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2014-03-04 01:01 . 2013-12-19 02:09 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-02-28 01:01 . 2014-02-28 01:01 -------- d-----w- c:\program files (x86)\Coolmuster
2014-02-28 00:35 . 2014-02-28 00:35 -------- d-----w- C:\temp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-21 22:05 . 2012-04-21 11:49 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-02-21 22:05 . 2011-11-07 14:04 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-17 21:36 . 2011-02-07 02:46 88567024 ----a-w- c:\windows\system32\MRT.exe
2013-12-18 11:13 . 2010-12-25 19:48 270496 ------w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2014-01-06 6563608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2013-08-30 4858968]
"20131121"="c:\program files\Alwil Software\Avast5\setup\emupdate\aa55e97b-63d7-4411-8a34-c4f538d94a41.exe" [2013-11-23 180184]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 acpials;ALS Sensor Filter;c:\windows\system32\DRIVERS\acpials.sys;c:\windows\SYSNATIVE\DRIVERS\acpials.sys [x]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [x]
R3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys;c:\windows\SYSNATIVE\DRIVERS\wacmoumonitor.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys;c:\windows\SYSNATIVE\DRIVERS\thpdrv.sys [x]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS;c:\windows\SYSNATIVE\DRIVERS\Thpevm.SYS [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys;c:\windows\SYSNATIVE\DRIVERS\tos_sps64.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 RosettaStoneDaemon;RosettaStoneDaemon;c:\program files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe;c:\program files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe [x]
S2 TabletServicePen;TabletServicePen;c:\program files\Tablet\Pen\Pen_Tablet.exe;c:\program files\Tablet\Pen\Pen_Tablet.exe [x]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe;c:\program files\TOSHIBA\TECO\TecoService.exe [x]
S2 TouchServicePen;Wacom Consumer Touch Service;c:\program files\Tablet\Pen\Pen_TouchService.exe;c:\program files\Tablet\Pen\Pen_TouchService.exe [x]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys;c:\windows\SYSNATIVE\DRIVERS\TVALZFL.sys [x]
S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]
S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys;c:\windows\SYSNATIVE\DRIVERS\pgeffect.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys;c:\windows\SYSNATIVE\DRIVERS\WDKMD.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2014-03-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 22:05]
.
2014-03-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-30 04:44]
.
2014-03-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-30 04:44]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-08-30 07:47 133840 ----a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-26 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-26 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-26 413208]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-03-22 10134560]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-03-22 896032]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-03-05 1928976]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSND&bmod=TSND
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSND&bmod=TSND
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>;*.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.254.254
FF - ProfilePath - c:\users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\kfgyinw6.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://www.yahoo.com/
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
HKLM-Run-HSON - c:\program files (x86)\TOSHIBA\TBS\HSON.exe
AddRemove-_{53A908D4-99C6-469B-BC13-F4189F260742} - c:\program files (x86)\Corel\Corel Painter Essentials 4\MSILauncher {53A908D4-99C6-469B-BC13-F4189F260742}
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-2759181842-1691398999-954640366-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-2759181842-1691398999-954640366-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_70_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_70_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_70_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_70_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.12"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-03-05 17:15:30
ComboFix-quarantined-files.txt 2014-03-05 22:15
.
Pre-Run: 404,140,941,312 bytes free
Post-Run: 403,932,065,792 bytes free
.
- - End Of File - - DC0A94B4AE75B78767796D35F63CA036

[gringo_pr]

which browser is it happening in ?

gringo

[lantis33]

This is happening in firefox. I'm having savingsbul and other pop-ups happening with everything I click on in firefox now.

[gringo_pr]

Hello lantis33

I want you to reset firefox back to defaults, this will remove everything from Firefox

I will let you keep your bookmarks so to do that you can go here - Export BookMarks

Now to reset firefox do the following.

• At the top of the Firefox window, click the "Firefox" button,
• go over to the "Help" sub-menu
  
  • (on Windows XP, click the Help menu at the top of the Firefox window) and select "Troubleshooting Information".
• Click the "Reset Firefox" button in the upper-right corner of the Troubleshooting Information page.
• click "Reset Firefox" in the confirmation window that opens.
• Firefox will close and be reset. When it's done. Click "Finish" and Firefox will open.

restart the computer and check firefox for me now

Gringo

[lantis33]

I think resetting firefox did it! There haven't been any pop-ups today, from savingsbul or otherwise. Thank you so much!

[gringo_pr]

Hello lantis33

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

• In your next post I need the following
  
  
• report from Combofix
• let me know of any problems you may have had
• How is the computer doing now after running the script?

Gringo

[lantis33]

Thank you again!

I did not run into any errors running combofix again and my computer seems to be working fine--no more pop-ups from savingsbul or extra search bars in google.

Below is my newest log from combofix.



ComboFix 14-03-10.01 - Sara 03/10/2014 19:28:34.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3891.2478 [GMT -4:00]
Running from: c:\users\Sara\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2014-02-10 to 2014-03-10 )))))))))))))))))))))))))))))))
.
.
2014-03-10 23:36 . 2014-03-10 23:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-03-10 23:36 . 2014-03-10 23:36 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2014-03-08 20:32 . 2014-02-06 09:01 10536864 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3B3DCF5D-631E-405C-B8B6-3B96C6D694BA}\mpengine.dll
2014-03-04 18:18 . 2014-03-04 18:18 -------- d-----w- c:\windows\ERUNT
2014-03-04 18:08 . 2014-03-04 18:10 -------- d-----w- C:\AdwCleaner
2014-03-04 14:31 . 2014-03-04 14:31 -------- d-----w- c:\programdata\OEM Links
2014-03-04 14:31 . 2014-03-04 14:31 -------- d-----w- C:\MININT
2014-03-04 13:39 . 2014-03-04 13:39 -------- d-----w- C:\SUPERDelete
2014-03-04 13:08 . 2014-03-04 13:08 -------- d-----w- c:\program files (x86)\Common Files\Skype
2014-03-04 13:08 . 2014-03-04 13:08 -------- d-----r- c:\program files (x86)\Skype
2014-03-04 01:04 . 2014-03-04 01:04 -------- d-----w- c:\users\Sara\AppData\Roaming\SUPERAntiSpyware.com
2014-03-04 01:04 . 2014-03-08 20:29 -------- d-----w- c:\program files\SUPERAntiSpyware
2014-03-04 01:01 . 2013-12-19 02:09 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-02-28 01:01 . 2014-02-28 01:01 -------- d-----w- c:\program files (x86)\Coolmuster
2014-02-28 00:35 . 2014-02-28 00:35 -------- d-----w- C:\temp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-21 22:05 . 2012-04-21 11:49 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-02-21 22:05 . 2011-11-07 14:04 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-17 21:36 . 2011-02-07 02:46 88567024 ----a-w- c:\windows\system32\MRT.exe
2014-02-03 17:20 . 2010-12-25 19:48 270496 ------w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2013-08-30 4858968]
"20131121"="c:\program files\Alwil Software\Avast5\setup\emupdate\aa55e97b-63d7-4411-8a34-c4f538d94a41.exe" [2013-11-23 180184]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 acpials;ALS Sensor Filter;c:\windows\system32\DRIVERS\acpials.sys;c:\windows\SYSNATIVE\DRIVERS\acpials.sys [x]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [x]
R3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys;c:\windows\SYSNATIVE\DRIVERS\wacmoumonitor.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys;c:\windows\SYSNATIVE\DRIVERS\thpdrv.sys [x]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS;c:\windows\SYSNATIVE\DRIVERS\Thpevm.SYS [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys;c:\windows\SYSNATIVE\DRIVERS\tos_sps64.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 RosettaStoneDaemon;RosettaStoneDaemon;c:\program files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe;c:\program files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe [x]
S2 TabletServicePen;TabletServicePen;c:\program files\Tablet\Pen\Pen_Tablet.exe;c:\program files\Tablet\Pen\Pen_Tablet.exe [x]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe;c:\program files\TOSHIBA\TECO\TecoService.exe [x]
S2 TouchServicePen;Wacom Consumer Touch Service;c:\program files\Tablet\Pen\Pen_TouchService.exe;c:\program files\Tablet\Pen\Pen_TouchService.exe [x]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys;c:\windows\SYSNATIVE\DRIVERS\TVALZFL.sys [x]
S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]
S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys;c:\windows\SYSNATIVE\DRIVERS\pgeffect.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys;c:\windows\SYSNATIVE\DRIVERS\WDKMD.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2014-03-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 22:05]
.
2014-03-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-30 04:44]
.
2014-03-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-30 04:44]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-08-30 07:47 133840 ----a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-26 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-26 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-26 413208]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-03-22 10134560]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-03-22 896032]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"TPwrMain"="c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE" [BU]
"HSON"="c:\program files (x86)\TOSHIBA\TBS\HSON.exe" [BU]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-03-05 1928976]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSND&bmod=TSND
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSND&bmod=TSND
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>;*.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.254.254
FF - ProfilePath - c:\users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\lziz3tj1.default-1394310287312\
FF - prefs.js: browser.startup.homepage - hxxps://www.yahoo.com/
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
AddRemove-_{53A908D4-99C6-469B-BC13-F4189F260742} - c:\program files (x86)\Corel\Corel Painter Essentials 4\MSILauncher {53A908D4-99C6-469B-BC13-F4189F260742}
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-2759181842-1691398999-954640366-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-2759181842-1691398999-954640366-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_70_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_70_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_70_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_70_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.12"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-03-10 19:38:35
ComboFix-quarantined-files.txt 2014-03-10 23:38
ComboFix2.txt 2014-03-05 22:15
.
Pre-Run: 404,248,309,760 bytes free
Post-Run: 406,104,653,824 bytes free
.
- - End Of File - - 8BDF9B3ED9D729F7E57E4FF7E1333B46

[gringo_pr]

Hello lantis33

I would like to see a report that combofix makes.

extra combofix report

• push the "windows key" + "R" (between the "Ctrl" button and "Alt" Button)
• please copy and past the following into the box

C:\Qoobox\Add-Remove Programs.txt

• click ok

copy and paste the report into this topic for me to review

Gringo

[lantis33]

Here is the extra report you requested from combofix. I noticed that savingsbull is listed so I'm thinking it may still be on my computer.


Adobe AIR
Adobe Flash Player 12 ActiveX
Adobe Flash Player 12 Plugin
Adobe Reader XI (11.0.06)
Amazon MP3 Downloader 1.0.10
Apple Application Support
Apple Software Update
avast! Free Antivirus
Bamboo
Bamboo Dock
Bamboo Dock 3.3
Compatibility Pack for the 2007 Office system
Corel Paint Shop Pro X
Corel Painter Essentials 4
D3DX10
EPSON Scan
Google Talk (remove only)
Google Update Helper
HDMI Control Manager
Intel® Graphics Media Accelerator Driver
Intel® Management Engine Components
Intel® Rapid Storage Technology
Java 7 Update 51
Java Auto Updater
Java™ 6 Update 24
JMicron Flash Media Controller Driver
Junk Mail filter update
Label@Once 1.0
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft Office XP Standard for Students and Teachers
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Mozilla Firefox 27.0.1 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
PlayReady PC Runtime x86
QuickTime
Realtek Ethernet Controller Driver For Windows 7
Realtek High Definition Audio Driver
Rosetta Stone Ltd Services
Rosetta Stone TOTALe
SavingsBull
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Skype Launcher
Skype™ 6.11
Spybot - Search & Destroy
Toshiba App Place
TOSHIBA Application Installer
TOSHIBA Assist
Toshiba Book Place
TOSHIBA Bulletin Board
TOSHIBA DVD PLAYER
TOSHIBA eco Utility
TOSHIBA Face Recognition
TOSHIBA Flash Cards Support Utility
TOSHIBA Hardware Setup
TOSHIBA HDD/SSD Alert
TOSHIBA Media Controller
TOSHIBA Media Controller Plug-in
Toshiba Online Backup
TOSHIBA Quality Application
TOSHIBA ReelTime
TOSHIBA Service Station
TOSHIBA Sleep Utility
TOSHIBA Supervisor Password
TOSHIBA Value Added Package
TOSHIBA Web Camera Application
ToshibaRegistration
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Utility Common Driver
WebTablet IE Plugin
WebTablet Netscape Plugin
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Yahoo! Messenger
Yahoo! Software Update
Yahoo! Toolbar

[gringo_pr]

Hello lantis33

I have an idea that might work - I will need the addition.txt file to be selected

Please download Farbar Recovery Scan Tool and save it to your desktop.


Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Gringo

[lantis33]

Hello Gringo,

Here are the farbar recovery scan log and the addition log that you asked for. I did get a pop-up late last night but it was not like the other savingsbul ads I've gotten. The small pop-up at the bottom right of the screen has not returned.




Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Sara (administrator) on SARA-PC on 13-03-2014 19:35:12
Running from C:\Users\Sara\Desktop
Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingc...can-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingc...can-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchService.exe
(Microsoft Corporation) C:\windows\SYSTEM32\WISPTIS.EXE
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(Microsoft Corporation) C:\windows\SYSTEM32\WISPTIS.EXE
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Rosetta Stone Ltd.) C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(TOSHIBA Corporation) C:\windows\system32\ThpSrv.exe
(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler64.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\windows\system32\wbem\WMIADAP.EXE


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10134560 2010-03-22] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [896032 2010-03-22] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated)
HKLM\...\Run: [ThpSrv] - C:\windows\system32\thpsrv /logon
HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [505768 2010-06-29] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] - C:\Program Files\TOSHIBA\TBS\HSON.exe [52600 2009-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [IntelWireless] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1928976 2010-03-05] (Intel® Corporation)
HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM-x32\...\Run: [avast5] - C:\Program Files\Alwil Software\Avast5\avastUI.exe [4858968 2013-08-30] (AVAST Software)
HKLM-x32\...\Run: [20131121] - C:\Program Files\Alwil Software\Avast5\setup\emupdate\aa55e97b-63d7-4411-8a34-c4f538d94a41.exe [180184 2013-11-23] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://start.toshiba.com/g/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co...=TSND&bmod=TSND
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co...=TSND&bmod=TSND
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {B1B2FE82-E32D-417D-B6E7-1889A538F5A8} URL = http://www.google.co...ng}&rlz=1I7TSND
SearchScopes: HKLM - {B1B2FE82-E32D-417D-B6E7-1889A538F5A8} URL = http://www.google.co...ng}&rlz=1I7TSND
SearchScopes: HKLM-x32 - {8B860874-5AF8-4C63-8430-BDE6C5964CFE} URL = http://www.google.co...ng}&rlz=1I7TSND
SearchScopes: HKCU - 8ECABF36530B433DB35EA82200C91869 URL = http://www.google.co...ng}&rlz=1I7TSND
SearchScopes: HKCU - {FE116612-30A2-4B22-85C2-171E3BD596A2} URL = http://www.google.co...ND_enUS411US411
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.254.254

FireFox:
========
FF ProfilePath: C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\lziz3tj1.default-1394310287312
FF Homepage: https://www.yahoo.com/
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 - C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.5 - C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Extension: Webmail Ad Blocker - C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\lziz3tj1.default-1394310287312\Extensions\[email protected] [2014-03-08]
FF Extension: Ads no more - C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\lziz3tj1.default-1394310287312\Extensions\{a3a5c777-f583-4fef-9380-ab4add1bc2a2}.xpi [2014-03-08]
FF Extension: FirefoxAdKiller - C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\lziz3tj1.default-1394310287312\Extensions\{b1df372d-8b32-4c7d-b6b4-9c5b78cf6fb1}.xpi [2014-03-08]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-11-03]

Chrome:
=======
CHR HomePage: hxxp://www.google.com/ig/redirectdomain?brand=TSND&bmod=TSND
CHR DefaultSearchURL: {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [46808 2013-08-30] (AVAST Software)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-03-05] ()

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-08-30] (AVAST Software)
R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [80816 2013-08-30] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-08-30] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-08-30] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-08-30] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-08-30] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-08-30] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [204880 2013-08-30] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-13 19:35 - 2014-03-13 19:35 - 00015467 _____ () C:\Users\Sara\Desktop\FRST.txt
2014-03-13 19:35 - 2014-03-13 19:35 - 00000000 ____D () C:\FRST
2014-03-13 19:34 - 2014-03-13 19:34 - 02157056 _____ (Farbar) C:\Users\Sara\Desktop\FRST64.exe
2014-03-10 19:38 - 2014-03-10 19:38 - 00015849 _____ () C:\ComboFix.txt
2014-03-06 17:42 - 2014-03-12 19:06 - 00000000 ____D () C:\Users\Sara\Desktop\spyware
2014-03-05 18:02 - 2011-06-26 02:45 - 00256000 _____ () C:\windows\PEV.exe
2014-03-05 18:02 - 2010-11-07 13:20 - 00208896 _____ () C:\windows\MBR.exe
2014-03-05 18:02 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-03-05 18:02 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-03-05 18:02 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-03-05 18:02 - 2000-08-30 20:00 - 00098816 _____ () C:\windows\sed.exe
2014-03-05 18:02 - 2000-08-30 20:00 - 00080412 _____ () C:\windows\grep.exe
2014-03-05 18:02 - 2000-08-30 20:00 - 00068096 _____ () C:\windows\zip.exe
2014-03-05 17:57 - 2014-03-10 19:38 - 00000000 ____D () C:\Qoobox
2014-03-05 17:57 - 2014-03-05 18:14 - 00000000 ____D () C:\windows\erdnt
2014-03-05 17:56 - 2014-03-05 17:56 - 05187267 ____R (Swearware) C:\Users\Sara\Downloads\ComboFix.exe
2014-03-04 14:18 - 2014-03-04 14:18 - 00000000 ____D () C:\windows\ERUNT
2014-03-04 14:15 - 2014-03-04 14:15 - 01037734 _____ (Thisisu) C:\Users\Sara\Downloads\JRT.exe
2014-03-04 14:08 - 2014-03-04 14:10 - 00000000 ____D () C:\AdwCleaner
2014-03-04 14:07 - 2014-03-04 14:07 - 01244192 _____ () C:\Users\Sara\Downloads\AdwCleaner.exe
2014-03-04 10:53 - 2014-03-04 10:53 - 00058466 _____ () C:\Users\Sara\Downloads\Extras.Txt
2014-03-04 10:52 - 2014-03-04 10:52 - 00096402 _____ () C:\Users\Sara\Downloads\OTL.Txt
2014-03-04 10:38 - 2014-03-04 10:38 - 00602112 _____ (OldTimer Tools) C:\Users\Sara\Downloads\OTL.scr
2014-03-04 10:31 - 2014-03-04 10:31 - 00000000 ____D () C:\MININT
2014-03-04 10:30 - 2014-03-04 10:30 - 01075264 _____ (OR Interactive Ltd) C:\Users\Sara\Downloads\IDM2.exe
2014-03-04 09:39 - 2014-03-04 09:39 - 00000000 ____D () C:\SUPERDelete
2014-03-04 09:08 - 2014-03-04 09:08 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-03 21:04 - 2014-03-08 16:29 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-03-03 21:04 - 2014-03-03 21:04 - 00000000 ____D () C:\Users\Sara\AppData\Roaming\SUPERAntiSpyware.com
2014-03-03 21:03 - 2014-03-03 21:04 - 18146232 _____ (SUPERAntiSpyware) C:\Users\Sara\Downloads\SUPERAntiSpyware.exe
2014-03-03 21:01 - 2014-03-03 21:01 - 00005146 _____ () C:\windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-03 21:01 - 2013-12-18 22:09 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2014-03-03 21:01 - 2013-12-18 22:04 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2014-03-03 21:01 - 2013-12-18 22:04 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2014-03-03 21:01 - 2013-12-18 22:03 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2014-02-27 21:51 - 2014-03-06 17:59 - 00000000 ____D () C:\Users\Sara\Desktop\texts
2014-02-27 21:01 - 2014-02-27 21:01 - 00000000 ____D () C:\Program Files (x86)\Coolmuster
2014-02-27 20:59 - 2014-02-27 21:00 - 06109118 _____ () C:\Users\Sara\Downloads\cool-android-assistant.exe
2014-02-27 20:40 - 2014-02-27 20:40 - 01917440 _____ () C:\Users\Sara\Downloads\XmlNotepad.msi
2014-02-27 20:32 - 2014-02-27 20:32 - 00930952 _____ (CNET Download.com) C:\Users\Sara\Downloads\cbsidlm-cbsi183-XML_Viewer-SEO-10223729.exe
2014-02-15 09:26 - 2014-02-15 09:26 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2014-03-13 19:35 - 2014-03-13 19:35 - 00015467 _____ () C:\Users\Sara\Desktop\FRST.txt
2014-03-13 19:35 - 2014-03-13 19:35 - 00000000 ____D () C:\FRST
2014-03-13 19:34 - 2014-03-13 19:34 - 02157056 _____ (Farbar) C:\Users\Sara\Desktop\FRST64.exe
2014-03-13 19:34 - 2009-07-14 01:13 - 00726444 _____ () C:\windows\system32\PerfStringBackup.INI
2014-03-13 19:33 - 2010-09-25 01:07 - 01265732 _____ () C:\windows\WindowsUpdate.log
2014-03-13 19:30 - 2013-10-05 10:08 - 00004184 _____ () C:\windows\System32\Tasks\avast! Emergency Update
2014-03-13 19:28 - 2013-01-25 20:41 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-13 19:28 - 2013-01-25 20:41 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-03-13 19:28 - 2010-08-30 00:44 - 00000908 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-13 19:28 - 2009-07-14 01:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-03-13 19:28 - 2009-07-14 00:51 - 00098815 _____ () C:\windows\setupact.log
2014-03-12 21:49 - 2012-08-25 10:18 - 00000000 ____D () C:\Users\Sara\Desktop\b
2014-03-12 21:15 - 2012-04-21 07:49 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-03-12 21:02 - 2010-08-30 00:44 - 00000912 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-12 19:55 - 2010-12-26 11:32 - 00000000 ___RD () C:\Users\Sara\Desktop\o
2014-03-12 19:06 - 2014-03-06 17:42 - 00000000 ____D () C:\Users\Sara\Desktop\spyware
2014-03-12 18:15 - 2012-04-21 07:49 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 18:15 - 2012-04-21 07:49 - 00003768 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-03-12 18:15 - 2011-11-07 10:04 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-10 19:51 - 2009-07-14 00:45 - 00016304 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-10 19:51 - 2009-07-14 00:45 - 00016304 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-10 19:43 - 2010-08-30 01:00 - 00267804 _____ () C:\windows\PFRO.log
2014-03-10 19:38 - 2014-03-10 19:38 - 00015849 _____ () C:\ComboFix.txt
2014-03-10 19:38 - 2014-03-05 17:57 - 00000000 ____D () C:\Qoobox
2014-03-10 19:36 - 2009-07-13 22:34 - 00000215 _____ () C:\windows\system.ini
2014-03-09 18:28 - 2011-05-08 18:28 - 00000000 ____D () C:\Users\Sara\Desktop\s
2014-03-08 16:29 - 2014-03-03 21:04 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-03-06 17:59 - 2014-02-27 21:51 - 00000000 ____D () C:\Users\Sara\Desktop\texts
2014-03-05 18:15 - 2009-07-13 23:20 - 00000000 __RHD () C:\Users\Default
2014-03-05 18:14 - 2014-03-05 17:57 - 00000000 ____D () C:\windows\erdnt
2014-03-05 17:56 - 2014-03-05 17:56 - 05187267 ____R (Swearware) C:\Users\Sara\Downloads\ComboFix.exe
2014-03-04 14:18 - 2014-03-04 14:18 - 00000000 ____D () C:\windows\ERUNT
2014-03-04 14:15 - 2014-03-04 14:15 - 01037734 _____ (Thisisu) C:\Users\Sara\Downloads\JRT.exe
2014-03-04 14:11 - 2009-07-14 00:45 - 00309584 _____ () C:\windows\system32\FNTCACHE.DAT
2014-03-04 14:10 - 2014-03-04 14:08 - 00000000 ____D () C:\AdwCleaner
2014-03-04 14:07 - 2014-03-04 14:07 - 01244192 _____ () C:\Users\Sara\Downloads\AdwCleaner.exe
2014-03-04 11:52 - 2010-12-25 08:32 - 00000000 ___RD () C:\Users\Sara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-04 10:53 - 2014-03-04 10:53 - 00058466 _____ () C:\Users\Sara\Downloads\Extras.Txt
2014-03-04 10:52 - 2014-03-04 10:52 - 00096402 _____ () C:\Users\Sara\Downloads\OTL.Txt
2014-03-04 10:38 - 2014-03-04 10:38 - 00602112 _____ (OldTimer Tools) C:\Users\Sara\Downloads\OTL.scr
2014-03-04 10:32 - 2010-12-25 08:35 - 00071752 _____ () C:\Users\Sara\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-04 10:31 - 2014-03-04 10:31 - 00000000 ____D () C:\MININT
2014-03-04 10:31 - 2009-07-13 23:20 - 00000000 ____D () C:\windows\Resources
2014-03-04 10:30 - 2014-03-04 10:30 - 01075264 _____ (OR Interactive Ltd) C:\Users\Sara\Downloads\IDM2.exe
2014-03-04 09:39 - 2014-03-04 09:39 - 00000000 ____D () C:\SUPERDelete
2014-03-04 09:08 - 2014-03-04 09:08 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-04 09:08 - 2012-05-19 16:48 - 00000000 ____D () C:\ProgramData\Skype
2014-03-03 21:04 - 2014-03-03 21:04 - 00000000 ____D () C:\Users\Sara\AppData\Roaming\SUPERAntiSpyware.com
2014-03-03 21:04 - 2014-03-03 21:03 - 18146232 _____ (SUPERAntiSpyware) C:\Users\Sara\Downloads\SUPERAntiSpyware.exe
2014-03-03 21:01 - 2014-03-03 21:01 - 00005146 _____ () C:\windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-03 21:01 - 2013-12-17 17:15 - 00000000 ____D () C:\ProgramData\Oracle
2014-03-03 21:01 - 2010-08-30 00:36 - 00000000 ____D () C:\Program Files (x86)\Java
2014-03-03 20:53 - 2010-08-30 00:44 - 00000000 ____D () C:\Program Files\Google
2014-03-03 20:53 - 2010-08-30 00:43 - 00000000 ____D () C:\Program Files (x86)\Google
2014-03-03 20:42 - 2010-12-25 08:37 - 00000000 ____D () C:\Users\Sara\AppData\Local\Google
2014-03-03 20:40 - 2010-08-30 00:48 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2014-03-03 10:07 - 2010-09-25 01:34 - 00000000 ____D () C:\ProgramData\WildTangent
2014-03-03 10:07 - 2010-09-25 01:34 - 00000000 ____D () C:\Program Files (x86)\TOSHIBA Games
2014-03-03 09:46 - 2010-12-26 11:35 - 00000000 ____D () C:\Users\Sara\Documents\My PSP Files
2014-03-01 18:48 - 2012-05-19 16:48 - 00000000 ____D () C:\Users\Sara\AppData\Roaming\Skype
2014-02-27 21:39 - 2012-05-05 11:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-27 21:01 - 2014-02-27 21:01 - 00000000 ____D () C:\Program Files (x86)\Coolmuster
2014-02-27 21:00 - 2014-02-27 20:59 - 06109118 _____ () C:\Users\Sara\Downloads\cool-android-assistant.exe
2014-02-27 20:40 - 2014-02-27 20:40 - 01917440 _____ () C:\Users\Sara\Downloads\XmlNotepad.msi
2014-02-27 20:32 - 2014-02-27 20:32 - 00930952 _____ (CNET Download.com) C:\Users\Sara\Downloads\cbsidlm-cbsi183-XML_Viewer-SEO-10223729.exe
2014-02-22 10:31 - 2013-08-02 16:01 - 00000000 ____D () C:\Users\Sara\Desktop\Mila
2014-02-22 10:31 - 2013-07-18 14:48 - 00000000 ____D () C:\Users\Sara\Desktop\wonders
2014-02-22 10:31 - 2011-08-10 19:13 - 00000000 ____D () C:\Users\Sara\Desktop\pics
2014-02-17 17:40 - 2013-08-13 16:31 - 00000000 ____D () C:\windows\system32\MRT
2014-02-17 17:36 - 2011-02-06 22:46 - 88567024 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-02-15 09:26 - 2014-02-15 09:26 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-01 18:21

==================== End Of Log ============================




Here is the addition log:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by Sara at 2014-03-13 19:35:37
Running from C:\Users\Sara\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Disabled - Up to date) {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AS: avast! Antivirus (Disabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.6.0.19140 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 2.6.0.19140 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Amazon MP3 Downloader 1.0.10 (HKLM-x32\...\Amazon MP3 Downloader) (Version: - )
Apple Application Support (HKLM-x32\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}) (Version: 6.0.0.59 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
avast! Free Antivirus (HKLM-x32\...\avast) (Version: 8.0.1497.0 - AVAST Software)
Bamboo (HKLM\...\Pen Tablet Driver) (Version: 5.2.4-6 - Wacom Technology Corp.)
Bamboo (HKLM-x32\...\Pen Tablet Driver) (Version: - )
Bamboo Dock (x32 Version: 3.9.0 - Wacom Europe GmbH) Hidden
Bamboo Dock 3.3 (HKLM-x32\...\Bamboo Dock) (Version: 3.3 - Wacom Co., Ltd.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Corel Paint Shop Pro X (HKLM-x32\...\{1A15507A-8551-4626-915D-3D5FA095CC1B}) (Version: 10.01 - Corel Inc)
Corel Painter Essentials 4 (HKLM-x32\...\_{53A908D4-99C6-469B-BC13-F4189F260742}) (Version: - Corel Corporation)
Corel Painter Essentials 4 (x32 Version: 4.2 - Corel Corporation) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - )
Google Talk (remove only) (HKCU\...\{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk) (Version: - )
Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden
HDMI Control Manager (HKLM-x32\...\InstallShield_{63DA1F6A-2E65-4367-99B9-9E39FADEC446}) (Version: 2.0 - TOSHIBA CORPORATION)
HDMI Control Manager (Version: 2.0 - TOSHIBA CORPORATION) Hidden
HDMI Control Manager (x32 Version: 2.0 - TOSHIBA CORPORATION) Hidden
Intel PROSet Wireless (Version: - ) Hidden
Intel® Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2119 - Intel Corporation)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (HKLM\...\{D16A2127-B927-4379-B153-3DEC091E4EEB}) (Version: 13.02.1000 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.5.7.1002 - Intel Corporation)
Intel® Wireless Display (HKLM\...\{C298FF86-AB23-4B58-AC53-A23383C07B3A}) (Version: 1.2.20.0 - Intel Corporation)
iTunes (HKLM\...\{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}) (Version: 10.7.0.21 - Apple Inc.)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java™ 6 Update 24 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216020FF}) (Version: 6.0.240 - Sun Microsystems, Inc.)
JMicron Flash Media Controller Driver (HKLM-x32\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.44.1 - JMicron Technology Corp.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Label@Once 1.0 (HKLM-x32\...\{0D795777-9D60-4692-8386-F2B3F2B5E5BF}) (Version: 1.0 - Corel)
Malwarebytes Anti-Malware version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office XP Standard for Students and Teachers (HKLM-x32\...\{913D0409-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.6626.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 27.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 en-US)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
PSP Thumbnail Handler (HKLM\...\{2086A549-ED96-4dc9-BBE3-0538AB29ABEC}) (Version: 2.10.49 - Bot Productions)
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.20.503.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6069 - Realtek Semiconductor Corp.)
Rosetta Stone Ltd Services (HKLM-x32\...\{7BB2EF8A-5376-4BAE-96D0-38BE49501F40}) (Version: 3.2.17 - Rosetta Stone Ltd.)
Rosetta Stone TOTALe (HKLM-x32\...\com.rosettastone.rosettastonetotale) (Version: 4.1.15.1 - Rosetta Stone, Ltd)
Rosetta Stone TOTALe (x32 Version: 4.1.1 - Rosetta Stone, Ltd) Hidden
Rosetta Stone TOTALe (x32 Version: 4.1.15.1 - Rosetta Stone, Ltd) Hidden
SavingsBull (x32 Version: 1.0.0.0 - SavingsBull) Hidden <==== ATTENTION
Skype Launcher (HKLM-x32\...\{DA84ECBF-4B79-47F2-B34C-95C38484C058}) (Version: 2.01 - TOSHIBA Corporation)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.8.1 - Synaptics Incorporated)
Toshiba App Place (HKLM-x32\...\{ED3CBA78-488F-4E8C-B33F-8E3BF4DDB4D2}) (Version: 1.0.2.0 - Toshiba)
TOSHIBA Application Installer (HKLM-x32\...\{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}) (Version: 9.0.1.1 - TOSHIBA)
TOSHIBA Assist (HKLM-x32\...\{1B87C40B-A60B-4EF3-9A68-706CF4B69978}) (Version: 3.00.11 - TOSHIBA CORPORATION)
Toshiba Book Place (HKLM-x32\...\{BB51B753-9A0C-4D1D-B3EF-A1B936F55796}) (Version: 2.0.3977.0 - K-NFB Reading Technology, Inc.)
Toshiba Book Place (HKLM-x32\...\{C31337DE-0CDC-45A9-9A32-F099AC78D557}) (Version: 2.1.5889 - K-NFB Reading Technology, Inc.)
TOSHIBA Bulletin Board (HKLM-x32\...\InstallShield_{C14518AF-1A0F-4D39-8011-69BAA01CD380}) (Version: 1.6.08.64 - TOSHIBA Corporation)
TOSHIBA Bulletin Board (Version: 1.6.08.64 - TOSHIBA Corporation) Hidden
TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.1.0.2 for x64 - TOSHIBA Corporation)
TOSHIBA DVD PLAYER (HKLM-x32\...\{6C5F3BDC-0A1B-4436-A696-5939629D5C31}) (Version: 3.01.2.12-A - TOSHIBA Corporation)
TOSHIBA eco Utility (HKLM-x32\...\InstallShield_{B3FF1CD9-B2F0-4D71-BB55-5F580401C48E}) (Version: 1.2.18.64 - TOSHIBA Corporation)
TOSHIBA eco Utility (Version: 1.2.18.64 - TOSHIBA Corporation) Hidden
TOSHIBA eco Utility (x32 Version: 1.2.18.64 - TOSHIBA Corporation) Hidden
TOSHIBA Face Recognition (HKLM-x32\...\InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}) (Version: 3.1.3.64 - TOSHIBA Corporation)
TOSHIBA Face Recognition (Version: 3.1.3.64 - TOSHIBA Corporation) Hidden
TOSHIBA Flash Cards Support Utility (HKLM-x32\...\InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}) (Version: 1.63.0.6C - TOSHIBA CORPORATION)
TOSHIBA Flash Cards Support Utility (x32 Version: 1.63.0.6C - TOSHIBA CORPORATION) Hidden
TOSHIBA Hardware Setup (HKLM-x32\...\InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}) (Version: 1.63.0.26C - TOSHIBA CORPORATION)
TOSHIBA Hardware Setup (x32 Version: 1.63.0.26C - TOSHIBA CORPORATION) Hidden
TOSHIBA HDD Protection (HKLM\...\{94A90C69-71C1-470A-88F5-AA47ECC96B40}) (Version: 2.2.0.4 - TOSHIBA Corporation)
TOSHIBA HDD/SSD Alert (HKLM-x32\...\InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.64.6 - TOSHIBA Corporation)
TOSHIBA HDD/SSD Alert (Version: 3.1.64.6 - TOSHIBA Corporation) Hidden
TOSHIBA HDD/SSD Alert (x32 Version: 3.1.64.6 - TOSHIBA Corporation) Hidden
TOSHIBA Media Controller (HKLM-x32\...\{983CD6FE-8320-4B80-A8F6-0D0366E0AA22}) (Version: 1.0.80.8.64 - TOSHIBA CORPORATION)
TOSHIBA Media Controller Plug-in (HKLM-x32\...\{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}) (Version: 1.0.5.11 - TOSHIBA CORPORATION)
Toshiba Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 2.0.0.24 - Toshiba)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.7.1.64 - TOSHIBA Corporation)
TOSHIBA Quality Application (HKLM-x32\...\{E69992ED-A7F6-406C-9280-1C156417BC49}) (Version: 1.0.3 - TOSHIBA)
TOSHIBA Recovery Media Creator (HKLM\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.0.4 for x64 - TOSHIBA Corporation)
TOSHIBA ReelTime (HKLM-x32\...\InstallShield_{24811C12-F4A9-4D0F-8494-A7B8FE46123C}) (Version: 1.7.16.64 - TOSHIBA Corporation)
TOSHIBA ReelTime (Version: 1.7.16.64 - TOSHIBA Corporation) Hidden
TOSHIBA Service Station (HKLM-x32\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.1.40 - TOSHIBA)
TOSHIBA Sleep Utility (HKLM-x32\...\{654F7484-88C5-46DC-AB32-C66BCB0E2102}) (Version: 1.4.1.2 - TOSHIBA Corporation)
TOSHIBA Supervisor Password (HKLM-x32\...\InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}) (Version: 1.63.0.9C - TOSHIBA CORPORATION)
TOSHIBA Supervisor Password (x32 Version: 1.63.0.9C - TOSHIBA CORPORATION) Hidden
TOSHIBA Value Added Package (HKLM-x32\...\InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}) (Version: 1.3.14.64 - TOSHIBA Corporation)
TOSHIBA Value Added Package (Version: 1.3.14.64 - TOSHIBA Corporation) Hidden
TOSHIBA Value Added Package (x32 Version: 1.3.14.64 - TOSHIBA Corporation) Hidden
TOSHIBA Web Camera Application (HKLM-x32\...\{5E6F6CF3-BACC-4144-868C-E14622C658F3}) (Version: 1.1.1.16 - TOSHIBA Corporation)
ToshibaRegistration (HKLM-x32\...\{5AF550B4-BB67-4E7E-82F1-2C4300279050}) (Version: 1.0.4 - Toshiba)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2473228) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)
Utility Common Driver (x32 Version: 1.0.52.1C - TOSHIBA) Hidden
WebTablet IE Plugin (HKLM-x32\...\Wacom WebTabletPlugin for IE) (Version: 1.1.0.7 - Wacom Technology Corp.)
WebTablet Netscape Plugin (HKLM-x32\...\Wacom WebTabletPlugin for Netscape) (Version: 1.1.0.5 - Wacom Technology Corp.)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WriteItNow Novel Writing Software 3.1.0 (HKLM-x32\...\WriteItNow Novel Writing Software 3.1.0) (Version: - Ravenshead Services Ltd)
Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)
Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version: - )
Yahoo! Toolbar (HKLM-x32\...\Yahoo! Companion) (Version: - Yahoo! Inc.)

==================== Restore Points =========================

25-02-2014 21:58:47 Windows Update
28-02-2014 00:33:24 Installed Xml Viewer
28-02-2014 00:40:53 Installed XML Notepad 2007
28-02-2014 00:41:49 Removed Xml Viewer
01-03-2014 13:02:35 Windows Update
03-03-2014 13:57:19 Removed XML Notepad 2007
04-03-2014 00:40:19 Removed Windows Live Sync
04-03-2014 01:00:24 Installed Java 7 Update 51
04-03-2014 13:07:12 Windows Update
04-03-2014 14:35:58 RegClean Pro Tue, Mar 04, 14 09:35
08-03-2014 20:32:22 Windows Update
10-03-2014 23:27:24 ComboFix created restore point
12-03-2014 21:34:21 Windows Update
13-03-2014 01:50:31 Windows Update

==================== Hosts content: ==========================

2009-07-13 22:34 - 2014-03-05 18:12 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1 localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {1F3F3077-AF81-4C8E-923F-B930D0D5FAB4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-08-30] (Google Inc.)
Task: {84F6F7EA-323F-44AA-B13D-600893678539} - System32\Tasks\avast! Emergency Update => C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe [2013-08-30] (AVAST Software)
Task: {A30FC006-B98F-4BBD-AB85-6E99CA4ABCC8} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-13] (Microsoft Corporation)
Task: {CC211548-7C1D-4F89-992B-D59958AECC0A} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12] (Adobe Systems Incorporated)
Task: {D9E09E95-42E5-45A1-A0C8-AB0959DEECF8} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-08-30] (Google Inc.)
Task: {F9894AE9-1E81-4E7F-AA1B-DD6AAAE63CA4} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2010-03-05 12:21 - 2010-03-05 12:21 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2011-05-26 20:34 - 2010-10-26 17:42 - 01182576 ____N () C:\Program Files\Tablet\Pen\libxml2.dll
2010-03-05 12:21 - 2010-03-05 12:21 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll
2014-03-12 17:24 - 2014-03-12 15:34 - 02283008 _____ () C:\Program Files\Alwil Software\Avast5\defs\14031201\algo.dll
2014-03-13 19:30 - 2014-03-13 13:47 - 02283008 _____ () C:\Program Files\Alwil Software\Avast5\defs\14031301\algo.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 00087328 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 01241888 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk => C:\windows\pss\Microsoft Office.lnk.CommonStartup
MSCONFIG\startupreg: 00TCrdMain => %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: avast5 => "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
MSCONFIG\startupreg: Bamboo Dock => "C:\Program Files (x86)\Bamboo Dock\Bamboo Dock\Bamboo Dock.exe"
MSCONFIG\startupreg: BambooCore => C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
MSCONFIG\startupreg: googletalk => C:\Users\Sara\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
MSCONFIG\startupreg: HDMICtrlMan => %ProgramFiles%\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe
MSCONFIG\startupreg: HWSetup => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: KeNotify => C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
MSCONFIG\startupreg: msnmsgr => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
MSCONFIG\startupreg: NortonOnlineBackupReminder => "C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe" UNATTENDED
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SmartFaceVWatcher => %ProgramFiles%\Toshiba\SmartFaceV\SmartFaceVWatcher.exe
MSCONFIG\startupreg: SmoothView => %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: SVPWUTIL => C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
MSCONFIG\startupreg: swg => "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
MSCONFIG\startupreg: Teco => "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r
MSCONFIG\startupreg: ToshibaAppPlace => "C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe"
MSCONFIG\startupreg: ToshibaServiceStation => "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
MSCONFIG\startupreg: TosNC => %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe
MSCONFIG\startupreg: TosReelTimeMonitor => %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
MSCONFIG\startupreg: TosSENotify => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe
MSCONFIG\startupreg: TosWaitSrv => %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe
MSCONFIG\startupreg: TSleepSrv => %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
MSCONFIG\startupreg: TWebCamera => "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/10/2014 08:19:56 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2153

Error: (03/10/2014 08:19:56 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2153

Error: (03/10/2014 08:19:56 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (03/10/2014 08:19:55 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1077

Error: (03/10/2014 08:19:55 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1077

Error: (03/10/2014 08:19:55 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (03/08/2014 04:32:39 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.


Details:
AddLegacyDriverFiles: Unable to back up image of binary SASKUTIL.

System Error:
The system cannot find the file specified.
.

Error: (03/06/2014 07:52:07 PM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "assemblyIdentity1".Error in manifest or policy file "assemblyIdentity2" on line assemblyIdentity3.
The value "*" of attribute "language" in element "assemblyIdentity" is invalid.


System errors:
=============
Error: (03/10/2014 07:36:32 PM) (Source: Service Control Manager) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (03/10/2014 07:33:28 PM) (Source: Service Control Manager) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (03/08/2014 04:19:50 PM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (03/06/2014 05:36:46 PM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (03/05/2014 06:12:40 PM) (Source: Service Control Manager) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (03/05/2014 06:11:48 PM) (Source: Application Popup) (User: )
Description: \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (03/05/2014 06:09:16 PM) (Source: Service Control Manager) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (03/04/2014 02:28:26 PM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}


Microsoft Office Sessions:
=========================
Error: (03/10/2014 08:19:56 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2153

Error: (03/10/2014 08:19:56 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2153

Error: (03/10/2014 08:19:56 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (03/10/2014 08:19:55 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1077

Error: (03/10/2014 08:19:55 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1077

Error: (03/10/2014 08:19:55 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (03/08/2014 04:32:39 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description:
Details:
AddLegacyDriverFiles: Unable to back up image of binary SASKUTIL.

System Error:
The system cannot find the file specified.

Error: (03/06/2014 07:52:07 PM) (Source: SideBySide)(User: )
Description: assemblyIdentitylanguage*c:\program files (x86)\spybot - search & destroy\DelZip179.dllc:\program files (x86)\spybot - search & destroy\DelZip179.dll8


CodeIntegrity Errors:
===================================
Date: 2014-03-05 17:11:48.337
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-03-05 17:11:48.228
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2012-03-25 18:51:16.149
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2012-03-25 18:51:15.681
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2011-07-06 15:42:50.744
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2011-07-06 15:42:50.588
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2011-07-06 15:42:38.825
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2011-07-06 15:42:38.743
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Percentage of memory in use: 42%
Total physical RAM: 3890.67 MB
Available physical RAM: 2228.94 MB
Total Pagefile: 7779.48 MB
Available Pagefile: 6042.37 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: (TI105957W0F) (Fixed) (Total:452.7 GB) (Free:376.52 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: D0CECDEE)

Partition: GPT Partition Type.

==================== End Of Log ============================