[sugarbee]

Snap.Do and Snap.Do.Engine will not uninstall from Control Panel.

For Snap.Do the Windows Installer dialog box appears:

The feature you are trying to use is on a network resource that is unavailable.
Use source:C:\Users\Kim\AppData\Local\Temp\smartbar\
Another Windows Installer dialog box states: The installation source for this product is not
available. Verify that the source exists and that you can access it.

For Snap.Do.Engine, there is no response from Control Panel.

I have deleted Mozalla Firefox and deleted extensions in Google Chrome.

I downloaded RogueKiller and also Farber Recovery Scan Tool.

Thanks.

[Advertisements]

Hello, sugarbee and welcome to GeeksToGo!

You can call me Phel and this time I will try to help you with your trouble.

Please, spend some time to read these instructions carefully before we start. They contain very useful information.

• Please, stay with us until the end. I know, Malware Removal isn't very fast procedure, it usually has multiple steps, but you should stay here till your computer will be absolutely clean from malware. If your main problem is solved, that doesn't mean that another malware isn't left in your computer. Your patience will be rewarded with absolutely clean computer.
  
• Please, let me know, if you don't understand something. It is really important to understand every instruction. If you are in doubt, how to follow one or another instruction - feel free to ask me, how to do that. I am always glad to help you with that.
  
• Please, don't fix anything by yourself. Please, don't run any tools unless they are required. Trying multiple tools in hope that one of them will help can lead to unrecoverable consequences. Sometimes malware removal tools, used without supervision, can harm your computer more than malware itself.
  
• Please, feel free to notify me about changes in your PC's behavior. It's really interesting for me to know, how your computer is running after each portion of fixes.
  
• Finally, let's go!

I don't know, where you downloaded RogueKiller and FRST, so these tools could be outdated. Let's download another tool, OTL, from trusted source.

• Download OTL to your Desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Click on Scan All Users checkbox, which is located near Quick Scan button.
• Under the Custom Scans/Fixes box at the bottom, paste in the following:
  
  

  BASESERVICES
  set /c

• Then click the Run Scan button at the top.
• Let the program run unhindered.
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic.

[Phel]

Hello, sugarbee and welcome to GeeksToGo!

You can call me Phel and this time I will try to help you with your trouble.

Please, spend some time to read these instructions carefully before we start. They contain very useful information.

• Please, stay with us until the end. I know, Malware Removal isn't very fast procedure, it usually has multiple steps, but you should stay here till your computer will be absolutely clean from malware. If your main problem is solved, that doesn't mean that another malware isn't left in your computer. Your patience will be rewarded with absolutely clean computer.
  
• Please, let me know, if you don't understand something. It is really important to understand every instruction. If you are in doubt, how to follow one or another instruction - feel free to ask me, how to do that. I am always glad to help you with that.
  
• Please, don't fix anything by yourself. Please, don't run any tools unless they are required. Trying multiple tools in hope that one of them will help can lead to unrecoverable consequences. Sometimes malware removal tools, used without supervision, can harm your computer more than malware itself.
  
• Please, feel free to notify me about changes in your PC's behavior. It's really interesting for me to know, how your computer is running after each portion of fixes.
  
• Finally, let's go!

I don't know, where you downloaded RogueKiller and FRST, so these tools could be outdated. Let's download another tool, OTL, from trusted source.

• Download OTL to your Desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Click on Scan All Users checkbox, which is located near Quick Scan button.
• Under the Custom Scans/Fixes box at the bottom, paste in the following:
  
  

  BASESERVICES
  set /c

• Then click the Run Scan button at the top.
• Let the program run unhindered.
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic.

[sugarbee]

OTL logfile created on: 3/19/2014 6:03:59 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Kim\Downloads
64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16521)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.19 Gb Total Physical Memory | 1.93 Gb Available Physical Memory | 60.43% Memory free
5.69 Gb Paging File | 3.46 Gb Available in Paging File | 60.69% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 678.14 Gb Total Space | 635.01 Gb Free Space | 93.64% Space Free | Partition Type: NTFS
Drive D: | 19.73 Gb Total Space | 2.02 Gb Free Space | 10.25% Space Free | Partition Type: NTFS

Computer Name: KIMSHIP | User Name: Kim | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014/03/19 17:57:31 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Kim\Downloads\OTL.exe
PRC - [2014/03/19 00:41:12 | 000,078,576 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE
PRC - [2014/03/19 00:40:28 | 000,194,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE
PRC - [2014/03/09 20:04:57 | 000,765,528 | ---- | M] (Webroot) -- C:\Program Files\Webroot\WRSA.exe
PRC - [2014/03/07 16:39:48 | 003,168,576 | ---- | M] () -- C:\Users\Kim\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
PRC - [2014/01/31 19:16:26 | 032,179,440 | ---- | M] (Dropbox, Inc.) -- C:\Users\Kim\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2014/01/15 10:00:12 | 035,256,640 | ---- | M] (SlimWare Utilities, Inc.) -- C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe
PRC - [2013/10/08 14:41:36 | 001,045,304 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe
PRC - [2013/10/08 14:41:28 | 001,039,160 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
PRC - [2013/09/10 20:18:46 | 001,344,312 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
PRC - [2013/09/05 01:44:18 | 000,298,760 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
PRC - [2013/09/05 01:44:16 | 000,077,576 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
PRC - [2013/09/01 22:18:24 | 000,267,224 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
PRC - [2013/08/05 03:49:42 | 000,111,576 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
PRC - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013/04/04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe


========== Modules (No Company Name) ==========

MOD - [2014/03/19 14:08:04 | 000,041,984 | ---- | M] () -- c:\users\kim\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp019cn8.dll
MOD - [2014/03/07 16:39:48 | 003,168,576 | ---- | M] () -- C:\Users\Kim\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
MOD - [2014/02/20 21:20:10 | 000,316,584 | ---- | M] () -- C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
MOD - [2014/02/20 21:15:10 | 000,316,584 | ---- | M] () -- C:\Program Files\Microsoft Office 15\root\office15\appvisvstream32.dll
MOD - [2014/01/02 23:42:50 | 003,610,624 | ---- | M] () -- C:\Users\Kim\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll
MOD - [2013/10/18 19:55:02 | 025,100,288 | ---- | M] () -- C:\Users\Kim\AppData\Roaming\Dropbox\bin\libcef.dll
MOD - [2013/08/05 19:48:08 | 000,016,856 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
MOD - [2013/08/05 03:49:47 | 000,627,672 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll


========== Services (SafeList) ==========

SRV:64bit: - File not found [Disabled | Stopped] -- C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe /McCoreSvc -- (McOobeSv2)
SRV:64bit: - [2014/03/09 20:04:57 | 000,765,528 | ---- | M] (Webroot) [Auto | Running] -- C:\Program Files\Webroot\WRSA.exe -- (WRSVC)
SRV:64bit: - [2014/03/01 04:16:08 | 002,169,016 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe -- (ClickToRunSvc)
SRV:64bit: - [2014/02/06 06:48:45 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:64bit: - [2013/11/27 11:36:30 | 003,395,920 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\WSService.dll -- (WSService)
SRV:64bit: - [2013/11/27 05:17:40 | 000,263,168 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\bisrv.dll -- (BrokerInfrastructure)
SRV:64bit: - [2013/11/23 00:50:00 | 000,282,112 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\SystemEventsBrokerServer.dll -- (SystemEventsBroker)
SRV:64bit: - [2013/11/07 23:41:17 | 001,302,528 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AppXDeploymentServer.dll -- (AppXSvc)
SRV:64bit: - [2013/10/30 20:29:53 | 000,348,392 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\NisSrv.exe -- (WdNisSvc)
SRV:64bit: - [2013/10/30 20:29:53 | 000,023,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)
SRV:64bit: - [2013/10/21 21:53:47 | 001,584,128 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\workfolderssvc.dll -- (workfolderssvc)
SRV:64bit: - [2013/10/18 13:48:01 | 001,555,456 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wlidsvc.dll -- (wlidsvc)
SRV:64bit: - [2013/10/18 13:48:01 | 000,491,520 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\GeofenceMonitorService.dll -- (lfsvc)
SRV:64bit: - [2013/10/18 13:48:01 | 000,365,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wcmsvc.dll -- (Wcmsvc)
SRV:64bit: - [2013/10/04 04:10:59 | 000,533,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AppReadiness.dll -- (AppReadiness)
SRV:64bit: - [2013/09/26 14:32:44 | 000,087,552 | ---- | M] (Softex Inc.) [Auto | Running] -- C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe -- (omniserv)
SRV:64bit: - [2013/09/26 14:26:54 | 000,109,568 | ---- | M] () [Auto | Running] -- C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe -- (Cachedrv server)
SRV:64bit: - [2013/09/25 22:06:56 | 000,239,616 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2013/09/25 10:48:00 | 000,344,064 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2013/08/26 02:13:24 | 000,076,800 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\inetsrv\w3logsvc.dll -- (w3logsvc)
SRV:64bit: - [2013/08/22 08:31:56 | 002,899,968 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)
SRV:64bit: - [2013/08/22 07:32:02 | 000,024,576 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wephostsvc.dll -- (WEPHOSTSVC)
SRV:64bit: - [2013/08/22 07:31:43 | 000,040,448 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\efssvc.dll -- (EFS)
SRV:64bit: - [2013/08/22 07:22:45 | 000,066,048 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wiarpc.dll -- (WiaRpc)
SRV:64bit: - [2013/08/22 07:21:15 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\svsvc.dll -- (svsvc)
SRV:64bit: - [2013/08/22 07:16:57 | 000,118,272 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\fhsvc.dll -- (fhsvc)
SRV:64bit: - [2013/08/22 06:25:28 | 000,164,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\NcaSvc.dll -- (NcaSvc)
SRV:64bit: - [2013/08/22 06:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicvss)
SRV:64bit: - [2013/08/22 06:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmictimesync)
SRV:64bit: - [2013/08/22 06:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicshutdown)
SRV:64bit: - [2013/08/22 06:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicrdv)
SRV:64bit: - [2013/08/22 06:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmickvpexchange)
SRV:64bit: - [2013/08/22 06:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicheartbeat)
SRV:64bit: - [2013/08/22 06:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicguestinterface)
SRV:64bit: - [2013/08/22 06:04:53 | 000,716,288 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsm.dll -- (LSM)
SRV:64bit: - [2013/08/22 06:02:47 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\smphost.dll -- (smphost)
SRV:64bit: - [2013/08/22 05:59:26 | 000,832,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\netlogon.dll -- (Netlogon)
SRV:64bit: - [2013/08/22 05:57:25 | 000,130,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\ScDeviceEnum.dll -- (ScDeviceEnum)
SRV:64bit: - [2013/08/22 05:54:59 | 000,059,392 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\keyiso.dll -- (KeyIso)
SRV:64bit: - [2013/08/22 05:50:59 | 000,245,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\TimeBrokerServer.dll -- (TimeBroker)
SRV:64bit: - [2013/08/22 05:50:00 | 000,525,312 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofmsvc.dll -- (netprofm)
SRV:64bit: - [2013/08/22 05:45:59 | 000,151,040 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\ncbservice.dll -- (NcbService)
SRV:64bit: - [2013/08/22 05:40:49 | 000,248,832 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\vaultsvc.dll -- (VaultSvc)
SRV:64bit: - [2013/08/22 05:40:14 | 000,398,848 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\das.dll -- (DeviceAssociationService)
SRV:64bit: - [2013/08/22 05:39:33 | 000,198,656 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\AudioEndpointBuilder.dll -- (AudioEndpointBuilder)
SRV:64bit: - [2013/08/22 05:31:03 | 000,201,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\DeviceSetupManager.dll -- (DsmSvc)
SRV:64bit: - [2013/08/22 05:15:54 | 000,073,728 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\NcdAutoSetup.dll -- (NcdAutoSetup)
SRV:64bit: - [2013/07/24 22:21:46 | 000,334,608 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- c:\Program Files\Common Files\mcafee\ActWiz\McAWFwk.exe -- (McAWFwk)
SRV:64bit: - [2013/07/23 15:28:56 | 000,043,320 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\hpservice.exe -- (hpsrv)
SRV:64bit: - [2013/06/18 23:18:38 | 000,246,488 | ---- | M] (Realtek Semiconductor) [Auto | Running] -- C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE -- (RtkAudioService)
SRV - [2014/03/14 21:53:40 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/11/04 19:31:56 | 000,092,160 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe -- (HP Support Assistant Service)
SRV - [2013/10/18 13:48:00 | 000,357,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GeofenceMonitorService.dll -- (lfsvc)
SRV - [2013/10/08 14:41:28 | 001,039,160 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe -- (HPWMISVC)
SRV - [2013/09/05 01:44:18 | 000,298,760 | ---- | M] (CyberLink) [Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe -- (CyberLink PowerDVD 12 Media Server Service)
SRV - [2013/09/05 01:44:16 | 000,077,576 | ---- | M] (CyberLink) [Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe -- (CyberLink PowerDVD 12 Media Server Monitor Service)
SRV - [2013/08/26 02:13:24 | 000,475,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2013/08/26 02:13:24 | 000,066,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\inetsrv\w3logsvc.dll -- (w3logsvc)
SRV - [2013/08/26 02:13:24 | 000,062,464 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2013/08/22 08:31:56 | 002,899,968 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)
SRV - [2013/08/21 23:55:35 | 000,018,944 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\StorSvc.dll -- (StorSvc)
SRV - [2013/08/21 22:53:34 | 000,011,776 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\smphost.dll -- (smphost)
SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2010/10/12 13:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2014/03/19 14:07:21 | 000,016,152 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SWDUMon.sys -- (SWDUMon)
DRV:64bit: - [2014/03/09 20:04:59 | 000,115,168 | ---- | M] (Webroot) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\WRkrn.sys -- (WRkrn)
DRV:64bit: - [2014/01/07 21:46:27 | 000,325,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\USBXHCI.SYS -- (USBXHCI)
DRV:64bit: - [2013/12/17 17:04:08 | 000,046,232 | ---- | M] (NetFilterSDK.com) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\netfilter64.sys -- (netfilter64)
DRV:64bit: - [2013/11/10 22:48:41 | 000,039,768 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\intelpep.sys -- (intelpep)
DRV:64bit: - [2013/11/01 07:39:53 | 000,086,872 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\pdc.sys -- (pdc)
DRV:64bit: - [2013/10/30 20:58:59 | 000,372,568 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\spaceport.sys -- (spaceport)
DRV:64bit: - [2013/10/30 20:29:36 | 000,236,888 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WdFilter.sys -- (WdFilter)
DRV:64bit: - [2013/10/30 20:29:36 | 000,124,760 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WdNisDrv.sys -- (WdNisDrv)
DRV:64bit: - [2013/10/30 20:28:47 | 000,035,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WdBoot.sys -- (WdBoot)
DRV:64bit: - [2013/10/25 21:54:32 | 000,146,776 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SerCx2.sys -- (SerCx2)
DRV:64bit: - [2013/10/18 13:48:00 | 000,467,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\USBHUB3.SYS -- (USBHUB3)
DRV:64bit: - [2013/10/18 13:48:00 | 000,236,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2013/10/18 13:48:00 | 000,175,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VerifierExt.sys -- (VerifierExt)
DRV:64bit: - [2013/10/12 22:48:34 | 000,136,536 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\wfplwfs.sys -- (WFPLWFS)
DRV:64bit: - [2013/10/05 11:25:54 | 000,057,176 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\stornvme.sys -- (stornvme)
DRV:64bit: - [2013/09/25 23:10:44 | 012,533,760 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2013/09/25 21:41:10 | 000,619,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2013/09/12 06:17:00 | 002,945,240 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtwlane.sys -- (RTWlanE)
DRV:64bit: - [2013/08/22 15:12:11 | 000,027,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2013/08/22 15:12:07 | 000,037,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\terminpt.sys -- (terminpt)
DRV:64bit: - [2013/08/22 09:25:40 | 000,043,008 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\condrv.sys -- (condrv)
DRV:64bit: - [2013/08/22 09:25:40 | 000,030,048 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2013/08/22 08:50:19 | 000,057,696 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\dam.sys -- (dam)
DRV:64bit: - [2013/08/22 08:49:54 | 000,079,712 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\acpiex.sys -- (acpiex)
DRV:64bit: - [2013/08/22 08:49:33 | 000,159,584 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)
DRV:64bit: - [2013/08/22 08:43:49 | 000,063,840 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\mvumis.sys -- (mvumis)
DRV:64bit: - [2013/08/22 08:43:48 | 000,146,272 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msgpioclx.sys -- (GPIOClx0101)
DRV:64bit: - [2013/08/22 08:43:48 | 000,041,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msgpiowin32.sys -- (msgpiowin32)
DRV:64bit: - [2013/08/22 08:43:45 | 003,357,024 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2013/08/22 08:43:45 | 000,093,536 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2013/08/22 08:43:45 | 000,082,784 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sss.sys -- (LSI_SSS)
DRV:64bit: - [2013/08/22 08:43:45 | 000,064,352 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2013/08/22 08:43:44 | 000,081,760 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas3.sys -- (LSI_SAS3)
DRV:64bit: - [2013/08/22 08:43:41 | 000,782,176 | ---- | M] (PMC-Sierra) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\adp80xx.sys -- (ADP80XX)
DRV:64bit: - [2013/08/22 08:43:41 | 000,531,296 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2013/08/22 08:43:41 | 000,259,424 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2013/08/22 08:43:41 | 000,108,896 | ---- | M] (LSI) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\3ware.sys -- (3ware)
DRV:64bit: - [2013/08/22 08:43:41 | 000,079,200 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2013/08/22 08:43:40 | 000,114,016 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\EhStorTcgDrv.sys -- (EhStorTcgDrv)
DRV:64bit: - [2013/08/22 08:43:40 | 000,082,784 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\EhStorClass.sys -- (EhStorClass)
DRV:64bit: - [2013/08/22 08:43:40 | 000,025,952 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2013/08/22 08:43:34 | 000,305,504 | ---- | M] (VIA Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\VSTXRAID.SYS -- (VSTXRAID)
DRV:64bit: - [2013/08/22 08:43:33 | 000,189,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UCX01000.SYS -- (UCX01000)
DRV:64bit: - [2013/08/22 08:43:33 | 000,074,080 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\uaspstor.sys -- (UASPStor)
DRV:64bit: - [2013/08/22 08:43:32 | 000,078,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdstor.sys -- (sdstor)
DRV:64bit: - [2013/08/22 08:43:32 | 000,031,072 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2013/08/22 08:43:31 | 000,107,872 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\storahci.sys -- (storahci)
DRV:64bit: - [2013/08/22 08:43:31 | 000,072,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SpbCx.sys -- (SpbCx)
DRV:64bit: - [2013/08/22 08:43:31 | 000,069,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SerCx.sys -- (SerCx)
DRV:64bit: - [2013/08/22 08:41:08 | 000,054,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wpcfltr.sys -- (wpcfltr)
DRV:64bit: - [2013/08/22 08:39:44 | 000,377,696 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\clfs.sys -- (CLFS)
DRV:64bit: - [2013/08/22 08:39:15 | 000,924,512 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\refs.sys -- (ReFS)
DRV:64bit: - [2013/08/22 08:39:15 | 000,026,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\uefi.sys -- (UEFI)
DRV:64bit: - [2013/08/22 08:37:27 | 000,069,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpci.sys -- (vpci)
DRV:64bit: - [2013/08/22 08:36:12 | 000,026,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WpdUpFltr.sys -- (WpdUpFltr)
DRV:64bit: - [2013/08/22 07:39:54 | 000,076,800 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ahcache.sys -- (ahcache)
DRV:64bit: - [2013/08/22 07:39:31 | 000,050,688 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BasicDisplay.sys -- (BasicDisplay)
DRV:64bit: - [2013/08/22 07:39:28 | 000,033,792 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BasicRender.sys -- (BasicRender)
DRV:64bit: - [2013/08/22 07:39:20 | 000,022,016 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HyperVideo.sys -- (HyperVideo)
DRV:64bit: - [2013/08/22 07:39:06 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mshidumdf.sys -- (mshidumdf)
DRV:64bit: - [2013/08/22 07:38:58 | 000,010,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acpitime.sys -- (acpitime)
DRV:64bit: - [2013/08/22 07:38:48 | 000,010,240 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acpipagr.sys -- (acpipagr)
DRV:64bit: - [2013/08/22 07:38:39 | 000,036,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BthAvrcpTg.sys -- (BthAvrcpTg)
DRV:64bit: - [2013/08/22 07:38:26 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kdnic.sys -- (kdnic)
DRV:64bit: - [2013/08/22 07:38:23 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmgencounter.sys -- (gencounter)
DRV:64bit: - [2013/08/22 07:38:22 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\npsvctrig.sys -- (npsvctrig)
DRV:64bit: - [2013/08/22 07:38:16 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BthhfHid.sys -- (bthhfhid)
DRV:64bit: - [2013/08/22 07:37:49 | 000,013,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hyperkbd.sys -- (hyperkbd)
DRV:64bit: - [2013/08/22 07:37:46 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2013/08/22 07:37:42 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bthhfenum.sys -- (BthHFEnum)
DRV:64bit: - [2013/08/22 07:37:28 | 000,056,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2013/08/22 07:37:28 | 000,041,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hidi2c.sys -- (hidi2c)
DRV:64bit: - [2013/08/22 07:37:14 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2013/08/22 07:36:43 | 000,087,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netvsc63.sys -- (netvsc)
DRV:64bit: - [2013/08/22 07:36:25 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NdisVirtualBus.sys -- (NdisVirtualBus)
DRV:64bit: - [2013/08/22 07:36:17 | 000,124,928 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NdisImPlatform.sys -- (NdisImPlatform)
DRV:64bit: - [2013/08/22 07:36:07 | 000,066,560 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mslldp.sys -- (MsLldp)
DRV:64bit: - [2013/08/22 07:35:42 | 000,103,424 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\Ndu.sys -- (Ndu)
DRV:64bit: - [2013/08/22 04:46:33 | 000,027,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fxppm.sys -- (FxPPM)
DRV:64bit: - [2013/08/15 18:28:42 | 000,830,680 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt630x64.sys -- (RTL8168)
DRV:64bit: - [2013/08/12 19:25:46 | 000,017,624 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bcmfn2.sys -- (bcmfn2)
DRV:64bit: - [2013/08/09 20:39:30 | 000,651,248 | ---- | M] (Intel Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\iaStorAV.sys -- (iaStorAV)
DRV:64bit: - [2013/07/30 14:47:35 | 000,024,568 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iaLPSSi_GPIO.sys -- (iaLPSSi_GPIO)
DRV:64bit: - [2013/07/26 17:10:50 | 000,524,016 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2013/07/26 17:10:50 | 000,034,544 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Smb_driver_Intel.sys -- (SmbDrvI)
DRV:64bit: - [2013/07/26 17:10:50 | 000,030,448 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Smb_driver_AMDASF.sys -- (SmbDrv)
DRV:64bit: - [2013/07/25 15:05:39 | 000,099,320 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iaLPSSi_I2C.sys -- (iaLPSSi_I2C)
DRV:64bit: - [2013/07/23 15:28:56 | 000,043,320 | ---- | M] (Hewlett-Packard) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelerometer.sys -- (Accelerometer)
DRV:64bit: - [2013/07/23 15:28:56 | 000,030,520 | ---- | M] (Hewlett-Packard) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpdskflt.sys -- (hpdskflt)
DRV:64bit: - [2013/07/22 20:45:58 | 000,020,800 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WirelessButtonDriver64.sys -- (WirelessButtonDriver)
DRV:64bit: - [2013/07/05 15:01:36 | 000,290,008 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsP2Stor.sys -- (RSP2STOR)
DRV:64bit: - [2013/06/23 04:49:50 | 000,138,240 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdWB6.sys -- (AtiHDAudioService)
DRV:64bit: - [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2013/03/08 20:47:50 | 000,058,536 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV:64bit: - [2013/03/05 16:01:42 | 000,091,712 | ---- | M] (CyberLink) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\CLVirtualDrive.sys -- (CLVirtualDrive)
DRV:64bit: - [2013/03/05 02:22:20 | 000,041,408 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\clwvd.sys -- (clwvd)
DRV:64bit: - [2012/11/20 17:55:42 | 000,057,512 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.2)
DRV - [2013/09/12 06:17:00 | 002,945,240 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\rtwlane.sys -- (RTWlanE)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT14/1
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...0TR&pc=HPNTDFJS
IE:64bit: - HKLM\..\SearchScopes\{3070F4D1-6940-4415-8D6D-1A3EB548A74D}: "URL" = http://www.amazon.co...s={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.co...54371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT14/1
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...q={searchTerms}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...0TR&pc=HPNTDFJS


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snapdo.c...q={searchTerms}
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.snapdo.c...q={searchTerms}
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://feed.snapdo.c...4RX8MGQrcXUlX98,
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snapdo.c...q={searchTerms}
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snapdo.c...q={searchTerms}
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\.DEFAULT\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...q={searchTerms}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snapdo.c...q={searchTerms}
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.snapdo.c...q={searchTerms}
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://feed.snapdo.c...4RX8MGQrcXUlX98,
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snapdo.c...q={searchTerms}
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snapdo.c...q={searchTerms}
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\S-1-5-18\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...q={searchTerms}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1
IE - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com
IE - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com
IE - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com
IE - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...q={searchTerms}
IE - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3508.0205: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\ProgramData\WRData\PKG\FIREFOX\WebrootSecure_SocketServer [2014/03/07 20:03:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Users\Kim\AppData\Roaming\BaseFlash\Firefox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins


========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: http://google.com/
CHR - plugin: Error reading preferences file
CHR - Extension: Google Drive = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: AdBlock = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.23_0\
CHR - Extension: Google Wallet = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
CHR - Extension: Gmail = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2013/08/22 09:25:41 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Webroot Vault) - {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} - C:\ProgramData\WRData\PKG\LPBar64.dll (Webroot)
O2:64bit: - BHO: (Webroot Filtering Extension) - {C9C42510-9B41-42c1-9DCD-7282A2D07C61} - C:\Program Files\Webroot\WRData\PKG\Vistax64\wrflt.dll (Webroot)
O2:64bit: - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Webroot Vault) - {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} - C:\ProgramData\WRData\PKG\LPBar.dll (Webroot)
O2 - BHO: (Webroot Filtering Extension) - {C9C42510-9B41-42c1-9DCD-7282A2D07C61} - C:\Program Files\Webroot\WRData\PKG\Vistax86\wrflt.dll (Webroot)
O2 - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
O3:64bit: - HKLM\..\Toolbar: (Webroot Toolbar) - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\PKG\LPBar64.dll (Webroot)
O3 - HKLM\..\Toolbar: (Webroot Toolbar) - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\PKG\LPBar.dll (Webroot)
O4:64bit: - HKLM..\Run: [OPBHOBroker] C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe (Hewlett-Packard)
O4:64bit: - HKLM..\Run: [OPBHOBrokerDesktop] C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe (Hewlett-Packard)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [SimplePass] C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe (Hewlett-Packard)
O4 - HKLM..\Run: [AccelerometerSysTrayApplet] C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [HPMessageService] C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [WRSVC] C:\Program Files\Webroot\WRSA.exe (Webroot)
O4 - HKLM..\Run: [YouCam Service] C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe (CyberLink Corp.)
O4 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002..\Run: [Amazon Cloud Player] C:\Users\Kim\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe ()
O4 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002..\Run: [SkyDrive] C:\Users\Kim\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [NCPluginUpdater] C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe (Hewlett-Packard)
O4 - Startup: C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Kim\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk = C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRun = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRunOnce = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRun = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRunOnce = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoShellSearchButton = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFile = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayContextMenu = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetFolders = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDevMgrUpdate = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDeletePrinter = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDFSTab = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoEncryptOnMove = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRunasInstallPrompt = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoHardwareTab = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuSubFolders = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispAppearancePage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRun = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRunOnce = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRun = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRunOnce = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoShellSearchButton = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFile = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayContextMenu = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetFolders = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDevMgrUpdate = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDeletePrinter = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDFSTab = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoEncryptOnMove = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRunasInstallPrompt = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoHardwareTab = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuSubFolders = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispAppearancePage = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRun = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRunOnce = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRun = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRunOnce = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoShellSearchButton = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFile = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayContextMenu = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetFolders = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDevMgrUpdate = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDeletePrinter = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDFSTab = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoEncryptOnMove = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRunasInstallPrompt = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoHardwareTab = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuSubFolders = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispAppearancePage = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRun = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRunOnce = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRun = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRunOnce = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoShellSearchButton = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFile = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayContextMenu = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetFolders = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDevMgrUpdate = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDeletePrinter = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDFSTab = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoEncryptOnMove = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRunasInstallPrompt = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoHardwareTab = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuSubFolders = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispAppearancePage = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRun = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRunOnce = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRun = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRunOnce = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoShellSearchButton = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFile = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayContextMenu = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetFolders = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDevMgrUpdate = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDeletePrinter = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDFSTab = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoEncryptOnMove = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRunasInstallPrompt = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoHardwareTab = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuSubFolders = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispAppearancePage = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRun = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRunOnce = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRun = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRunOnce = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoShellSearchButton = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFile = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayContextMenu = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetFolders = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDevMgrUpdate = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDeletePrinter = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDFSTab = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoEncryptOnMove = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRunasInstallPrompt = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoHardwareTab = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuSubFolders = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispAppearancePage = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0
O7 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE (Microsoft Corporation)
O8:64bit: - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9:64bit: - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Webroot - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\ProgramData\WRData\PKG\LPBar64.dll (Webroot)
O9:64bit: - Extra 'Tools' menuitem : Webroot - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\ProgramData\WRData\PKG\LPBar64.dll (Webroot)
O9:64bit: - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Webroot - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\ProgramData\WRData\PKG\LPBar.dll (Webroot)
O9 - Extra 'Tools' menuitem : Webroot - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\ProgramData\WRData\PKG\LPBar.dll (Webroot)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{079C28FA-3376-4CE7-A4EE-9D62AEC39AC8}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6BFB7138-8444-49C2-9617-FC4304DB3A76}: DhcpNameServer = 40.22.1.201 40.22.1.203
O18:64bit: - Protocol\Handler\osf - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\.DEFAULT\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-18\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2014/03/19 15:55:23 | 000,000,000 | ---D | C] -- C:\Users\Kim\Desktop\RK_Quarantine
[2014/03/19 15:14:52 | 000,000,000 | ---D | C] -- C:\FRST
[2014/03/19 15:14:29 | 002,157,056 | ---- | C] (Farbar) -- C:\Users\Kim\Desktop\FRST64.exe
[2014/03/19 00:56:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2014/03/19 00:56:07 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2014/03/18 22:02:04 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Malwarebytes
[2014/03/18 22:01:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2014/03/18 22:01:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2014/03/18 22:01:57 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2014/03/18 22:01:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2014/03/18 14:09:23 | 018,576,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Windows.UI.Xaml.dll
[2014/03/18 14:09:20 | 013,949,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Windows.UI.Xaml.dll
[2014/03/18 14:09:11 | 000,960,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MFMediaEngine.dll
[2014/03/18 14:09:11 | 000,628,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SettingSyncHost.exe
[2014/03/18 14:09:11 | 000,481,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfsvr.dll
[2014/03/18 14:09:10 | 000,802,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MFMediaEngine.dll
[2014/03/18 14:09:10 | 000,749,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SettingSyncCore.dll
[2014/03/18 14:09:10 | 000,478,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SettingSyncHost.exe
[2014/03/18 14:09:10 | 000,381,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfsvr.dll
[2014/03/18 14:09:09 | 000,914,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ReAgent.dll
[2014/03/18 14:09:09 | 000,842,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.dll
[2014/03/18 14:09:09 | 000,770,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ReAgent.dll
[2014/03/18 14:09:09 | 000,588,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SettingSyncCore.dll
[2014/03/18 14:09:09 | 000,461,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll
[2014/03/18 14:09:09 | 000,419,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\hal.dll
[2014/03/18 14:09:09 | 000,382,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\dxgmms1.sys
[2014/03/18 14:09:08 | 000,947,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\reseteng.dll
[2014/03/18 14:09:08 | 000,630,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MsSpellCheckingFacility.dll
[2014/03/18 14:09:08 | 000,336,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll
[2014/03/18 14:09:08 | 000,206,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WSClient.dll
[2014/03/18 14:09:08 | 000,174,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WSClient.dll
[2014/03/18 14:09:07 | 001,720,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
[2014/03/18 14:09:07 | 000,303,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sti.dll
[2014/03/18 14:09:07 | 000,131,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\easinvoker.exe
[2014/03/18 14:09:06 | 000,325,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\USBXHCI.SYS
[2014/03/18 14:09:06 | 000,178,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\easwrt.dll
[2014/03/18 14:09:06 | 000,140,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\easwrt.dll
[2014/03/18 11:23:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2014/03/18 11:02:33 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\SlimWare Utilities Inc
[2014/03/18 11:02:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverUpdate
[2014/03/18 11:02:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DriverUpdate
[2014/03/18 11:02:27 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Downloaded Installers
[2014/03/16 20:32:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft OneDrive
[2014/03/16 20:31:42 | 000,693,240 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2014/03/16 20:31:42 | 000,105,464 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2014/03/13 20:05:44 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Cloud Player
[2014/03/13 20:05:37 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Amazon Cloud Player
[2014/03/13 13:10:20 | 000,000,000 | R--D | C] -- C:\Users\Kim\Documents\Notes
[2014/03/13 13:08:01 | 000,000,000 | ---D | C] -- C:\Users\Kim\Documents\OneNote Notebooks
[2014/03/12 16:37:19 | 000,000,000 | ---D | C] -- C:\Users\Kim\Documents\Custom Office Templates
[2014/03/11 21:32:40 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2014/03/11 21:32:39 | 005,768,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2014/03/11 21:32:38 | 000,817,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2014/03/11 21:32:38 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2014/03/11 21:32:38 | 000,627,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2014/03/11 21:18:48 | 001,643,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.efi
[2014/03/11 21:18:48 | 001,507,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.exe
[2014/03/11 21:13:50 | 002,133,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfcore.dll
[2014/03/11 21:13:50 | 001,928,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\combase.dll
[2014/03/11 21:13:49 | 006,640,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll
[2014/03/11 21:13:49 | 002,143,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfcore.dll
[2014/03/11 21:13:49 | 001,371,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\combase.dll
[2014/03/11 21:13:49 | 001,287,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2014/03/11 21:13:49 | 000,764,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfmpeg2srcsnk.dll
[2014/03/11 21:13:49 | 000,669,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfmpeg2srcsnk.dll
[2014/03/11 21:13:48 | 005,770,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstscax.dll
[2014/03/11 21:13:48 | 004,175,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dbgeng.dll
[2014/03/11 21:13:48 | 002,873,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dbgeng.dll
[2014/03/11 21:13:48 | 001,486,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dbghelp.dll
[2014/03/11 21:13:48 | 000,407,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Faultrep.dll
[2014/03/11 21:13:47 | 001,238,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dbghelp.dll
[2014/03/11 21:13:47 | 001,057,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdvidcrl.dll
[2014/03/11 21:13:47 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdvidcrl.dll
[2014/03/11 21:13:47 | 000,458,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WerFault.exe
[2014/03/11 21:13:47 | 000,447,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sppcomapi.dll
[2014/03/11 21:13:47 | 000,408,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WerFault.exe
[2014/03/11 21:13:47 | 000,369,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Faultrep.dll
[2014/03/11 21:13:47 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpencom.dll
[2014/03/11 21:13:47 | 000,233,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfps.dll
[2014/03/11 21:13:47 | 000,208,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpencom.dll
[2014/03/11 21:13:47 | 000,160,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWWIN.EXE
[2014/03/11 21:13:47 | 000,138,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\DWWIN.EXE
[2014/03/11 21:13:47 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsgqec.dll
[2014/03/11 21:13:47 | 000,053,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tsgqec.dll
[2014/03/11 21:13:40 | 000,236,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\WdFilter.sys
[2014/03/11 21:13:39 | 000,124,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\WdNisDrv.sys
[2014/03/11 21:13:39 | 000,035,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\WdBoot.sys
[2014/03/11 21:13:13 | 000,586,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qedit.dll
[2014/03/11 21:13:13 | 000,488,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qedit.dll
[2014/03/10 18:59:32 | 000,000,000 | ---D | C] -- C:\ProgramData\.mono
[2014/03/10 18:59:31 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\.mono
[2014/03/10 18:59:27 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Unity
[2014/03/01 21:58:17 | 000,000,000 | ---D | C] -- C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F}
[2014/02/26 21:18:29 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Unity
[2014/02/26 13:58:55 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Adobe
[2014/02/25 20:33:12 | 000,000,000 | ---D | C] -- C:\Users\Kim\Documents\Avatar
[2014/02/25 20:25:16 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\CyberLink
[2014/02/25 14:32:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2014/02/25 14:32:24 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Google
[2014/02/25 13:38:53 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\MRT
[2014/02/25 12:59:53 | 002,328,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2014/02/25 12:59:51 | 002,065,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\explorer.exe
[2014/02/25 12:59:50 | 001,584,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\workfolderssvc.dll
[2014/02/25 12:59:50 | 001,067,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfasfsrcsnk.dll
[2014/02/25 12:59:48 | 000,883,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfasfsrcsnk.dll
[2014/02/25 12:59:45 | 002,134,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d9.dll
[2014/02/25 12:59:41 | 001,160,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Windows.Web.Http.dll
[2014/02/25 12:59:39 | 001,011,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TSWorkspace.dll
[2014/02/25 12:59:39 | 000,708,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iuilp.dll
[2014/02/25 12:59:35 | 000,656,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dnsapi.dll
[2014/02/25 12:59:34 | 000,920,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAutomationCore.dll
[2014/02/25 12:59:33 | 001,231,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Windows.Media.dll
[2014/02/25 12:59:33 | 000,533,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\AppReadiness.dll
[2014/02/25 12:59:31 | 001,147,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\UIAutomationCore.dll
[2014/02/25 12:59:27 | 000,699,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2014/02/25 12:59:25 | 000,631,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WWAHost.exe
[2014/02/25 12:59:24 | 000,761,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WorkfoldersControl.dll
[2014/02/25 12:59:22 | 000,578,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Windows.Networking.BackgroundTransfer.dll
[2014/02/25 12:59:21 | 000,331,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\eapphost.dll
[2014/02/25 12:59:20 | 000,518,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WWAHost.exe
[2014/02/25 12:59:18 | 000,411,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Windows.Networking.BackgroundTransfer.dll
[2014/02/25 12:59:18 | 000,171,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kd_02_8086.dll
[2014/02/25 12:59:17 | 000,888,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Windows.Media.dll
[2014/02/25 12:59:17 | 000,465,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\AudioSes.dll
[2014/02/25 12:59:16 | 000,391,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsmf.dll
[2014/02/25 12:59:15 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\comdlg32.dll
[2014/02/25 12:59:14 | 000,795,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\TSWorkspace.dll
[2014/02/25 12:59:14 | 000,558,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\apphelp.dll
[2014/02/25 12:59:14 | 000,325,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\eapp3hst.dll
[2014/02/25 12:59:13 | 000,345,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tsmf.dll
[2014/02/25 12:59:13 | 000,317,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2014/02/25 12:59:11 | 000,286,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\pcsvDevice.dll
[2014/02/25 12:59:11 | 000,104,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncryptsslp.dll
[2014/02/25 12:59:11 | 000,088,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ncryptsslp.dll
[2014/02/25 12:59:10 | 000,132,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msched.dll
[2014/02/25 12:59:09 | 000,762,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Windows.Web.Http.dll
[2014/02/25 12:59:09 | 000,262,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\eapphost.dll
[2014/02/25 12:59:08 | 000,830,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\samsrv.dll
[2014/02/25 12:59:05 | 000,044,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wldp.dll
[2014/02/25 12:59:04 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TSWbPrxy.exe
[2014/02/25 12:59:04 | 000,057,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\stornvme.sys
[2014/02/25 12:59:03 | 000,092,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dafBth.dll
[2014/02/25 12:59:02 | 000,184,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dafWfdProvider.dll
[2014/02/25 12:59:01 | 000,113,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\shsetup.dll
[2014/02/25 12:59:01 | 000,054,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2014/02/25 12:59:00 | 000,381,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUSettingsProvider.dll
[2014/02/25 12:58:59 | 000,335,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\eappcfg.dll
[2014/02/25 12:58:59 | 000,094,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\shsetup.dll
[2014/02/25 12:58:58 | 000,103,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WiFiDisplay.dll
[2014/02/25 12:58:57 | 000,272,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\eappcfg.dll
[2014/02/25 12:58:57 | 000,245,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\eapp3hst.dll
[2014/02/25 12:58:57 | 000,093,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\eappgnui.dll
[2014/02/25 12:58:56 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\eappgnui.dll
[2014/02/25 12:58:54 | 000,186,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WorkFoldersShell.dll
[2014/02/25 12:58:54 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ftp.exe
[2014/02/25 12:58:53 | 001,704,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2014/02/25 12:58:50 | 000,338,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpclip.exe
[2014/02/25 12:58:50 | 000,053,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ftp.exe
[2014/02/25 12:58:49 | 000,226,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\miutils.dll
[2014/02/25 12:58:48 | 000,180,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\miutils.dll
[2014/02/25 12:22:08 | 003,210,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll
[2014/02/25 12:22:05 | 002,804,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll
[2014/02/25 12:21:42 | 001,399,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winmde.dll
[2014/02/25 12:21:41 | 002,617,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\authui.dll
[2014/02/25 12:21:39 | 001,374,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmpmde.dll
[2014/02/25 12:21:39 | 000,282,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SystemEventsBrokerServer.dll
[2014/02/25 12:21:37 | 000,202,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ubpm.dll
[2014/02/25 12:21:35 | 002,295,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\authui.dll
[2014/02/25 12:21:33 | 001,204,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\winmde.dll
[2014/02/25 12:21:33 | 000,263,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\bisrv.dll
[2014/02/25 12:21:30 | 000,809,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfmp4srcsnk.dll
[2014/02/25 12:21:30 | 000,032,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ploptin.dll
[2014/02/25 12:21:29 | 000,745,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll
[2014/02/25 12:21:29 | 000,470,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfds.dll
[2014/02/25 12:21:28 | 000,663,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfmp4srcsnk.dll
[2014/02/25 12:21:27 | 001,415,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
[2014/02/25 12:21:27 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psmsrv.dll
[2014/02/25 12:21:26 | 000,273,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Windows.Graphics.dll
[2014/02/25 12:21:25 | 000,433,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfds.dll
[2014/02/25 12:21:23 | 000,589,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rastls.dll
[2014/02/25 12:21:23 | 000,218,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Windows.Graphics.dll
[2014/02/25 12:21:20 | 000,306,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msieftp.dll
[2014/02/25 12:21:19 | 001,227,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mispace.dll
[2014/02/25 12:21:18 | 000,980,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mispace.dll
[2014/02/25 12:21:18 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\bi.dll
[2014/02/25 12:21:17 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\BtaMPM.sys
[2014/02/25 12:21:16 | 000,513,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rastls.dll
[2014/02/25 12:21:16 | 000,273,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msieftp.dll
[2014/02/25 12:21:14 | 000,207,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\deviceregistration.dll
[2014/02/25 12:16:39 | 001,302,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\AppXDeploymentServer.dll
[2014/02/25 12:16:38 | 007,399,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2014/02/25 12:16:37 | 002,143,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dwmcore.dll
[2014/02/25 12:16:34 | 002,570,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SettingsHandlers.dll
[2014/02/25 12:16:34 | 001,765,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dwmcore.dll
[2014/02/25 12:16:32 | 000,358,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dcomp.dll
[2014/02/25 12:16:30 | 002,896,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msftedit.dll
[2014/02/25 12:16:29 | 000,747,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wlidcli.dll
[2014/02/25 12:16:27 | 001,756,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMPDMC.exe
[2014/02/25 12:16:26 | 000,139,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\AppxAllUserStore.dll
[2014/02/25 12:16:25 | 000,225,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dcomp.dll
[2014/02/25 12:16:25 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\AppxAllUserStore.dll
[2014/02/25 12:16:24 | 001,345,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.exe
[2014/02/25 12:16:21 | 001,476,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.efi
[2014/02/25 12:16:20 | 002,266,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msftedit.dll
[2014/02/25 12:16:19 | 000,372,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\spaceport.sys
[2014/02/25 12:16:19 | 000,254,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\AppXDeploymentClient.dll
[2014/02/25 12:16:18 | 000,566,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wpncore.dll
[2014/02/25 12:16:18 | 000,198,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\AppXDeploymentClient.dll
[2014/02/25 12:16:17 | 001,391,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPDMC.exe
[2014/02/25 12:16:16 | 000,146,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\SerCx2.sys
[2014/02/25 12:16:16 | 000,039,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\intelpep.sys
[2014/02/25 12:16:15 | 000,922,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\AppXDeploymentExtensions.dll
[2014/02/25 12:16:14 | 000,086,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\pdc.sys
[2014/02/25 12:16:13 | 002,140,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll
[2014/02/25 12:16:12 | 001,765,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2014/02/25 12:16:11 | 001,843,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Display.dll
[2014/02/25 12:16:11 | 000,516,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll
[2014/02/25 12:16:11 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\CredentialMigrationHandler.dll
[2014/02/25 12:16:10 | 001,816,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Display.dll
[2014/02/25 12:16:10 | 000,027,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\CredentialMigrationHandler.dll
[2014/02/25 12:16:09 | 000,544,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wlidcli.dll
[2014/02/25 12:13:56 | 001,085,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\twinui.appcore.dll
[2014/02/25 12:13:56 | 000,869,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\twinui.appcore.dll
[2014/02/25 12:03:10 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll
[2014/02/25 12:03:08 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll
[2014/02/25 12:03:06 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll
[2014/02/25 12:03:06 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2014/02/25 12:02:59 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2014/02/25 12:02:59 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2014/02/25 12:02:58 | 001,964,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2014/02/25 12:02:57 | 000,553,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll
[2014/02/25 12:02:55 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe
[2014/02/25 12:02:50 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2014/02/25 12:02:48 | 002,041,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2014/02/25 12:02:47 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2014/02/25 12:02:45 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2014/02/25 12:02:40 | 000,708,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll
[2014/02/25 12:02:40 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2014/02/25 12:02:37 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2014/02/25 11:56:50 | 000,075,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll
[2014/02/25 11:56:49 | 000,872,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfplat.dll
[2014/02/25 11:56:48 | 000,698,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfplat.dll
[2014/02/25 11:56:46 | 001,341,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gdi32.dll
[2014/02/25 11:56:41 | 000,570,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msdrm.dll
[2014/02/25 11:56:33 | 000,136,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\wfplwfs.sys
[2014/02/25 11:56:29 | 000,393,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll
[2014/02/25 11:56:28 | 000,348,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll
[2014/02/25 11:56:15 | 004,604,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll
[2014/02/25 11:56:14 | 002,397,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll
[2014/02/25 11:51:49 | 000,548,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2014/02/25 11:51:47 | 003,395,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WSService.dll
[2014/02/25 11:51:45 | 000,848,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WSShared.dll
[2014/02/25 11:51:45 | 000,695,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WSShared.dll
[2014/02/25 11:51:43 | 000,084,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WSCollect.exe
[2014/02/25 11:51:42 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Windows.ApplicationModel.Store.TestingFramework.dll
[2014/02/25 11:51:41 | 000,189,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Windows.ApplicationModel.Store.TestingFramework.dll
[2014/02/25 11:51:39 | 007,416,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Windows.UI.Search.dll
[2014/02/25 11:51:37 | 013,209,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\twinui.dll
[2014/02/25 11:51:35 | 011,702,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\twinui.dll
[2014/02/25 11:51:33 | 004,961,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Windows.UI.Search.dll
[2014/02/25 11:51:32 | 001,105,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SearchFolder.dll
[2014/02/25 11:51:31 | 001,462,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\propsys.dll
[2014/02/25 11:51:03 | 001,113,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2014/02/25 11:50:49 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\scrrun.dll
[2014/02/25 11:50:48 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\scrrun.dll
[2014/02/25 11:50:48 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\pcaui.exe
[2014/02/25 11:50:47 | 000,787,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\uDWM.dll
[2014/02/25 11:50:47 | 000,017,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\pcaui.exe
[2014/02/25 11:50:46 | 000,287,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mdmregistration.dll
[2014/02/25 11:50:45 | 000,615,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MDMAgent.exe
[2014/02/25 11:50:45 | 000,240,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mdmregistration.dll
[2014/02/25 11:50:25 | 001,943,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2014/02/25 11:45:37 | 004,217,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SyncEngine.dll
[2014/02/25 11:45:35 | 000,870,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SkyDrive.exe
[2014/02/25 11:45:33 | 002,804,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\actxprxy.dll
[2014/02/25 11:45:32 | 000,919,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MrmCoreR.dll
[2014/02/25 11:45:32 | 000,720,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SkyDriveTelemetry.dll
[2014/02/25 11:45:31 | 000,628,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MrmCoreR.dll
[2014/02/25 11:45:31 | 000,121,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SkyDriveShell.dll
[2014/02/25 11:45:31 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SkyDriveShell.dll
[2014/02/25 11:45:27 | 000,115,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winbici.dll
[2014/02/20 20:01:48 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Macromedia
[2014/02/20 19:52:56 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\HPConnectedMusic
[2014/02/20 19:24:20 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\hpqlog
[2014/02/20 19:19:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SkyDrive
[2014/02/20 19:19:05 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2014/02/20 19:18:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft SkyDrive
[2014/02/20 19:17:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2014/02/20 19:14:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
[2014/02/20 19:13:34 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office 15
[2014/02/20 18:58:00 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\lptmp1138749348
[2014/02/20 18:57:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Webroot SecureAnywhere
[2014/02/20 18:57:24 | 000,154,248 | ---- | C] (Webroot) -- C:\Windows\SysWow64\WRusr.dll
[2014/02/20 18:57:24 | 000,115,168 | ---- | C] (Webroot) -- C:\Windows\SysNative\drivers\WRkrn.sys
[2014/02/20 18:57:24 | 000,105,320 | ---- | C] (Webroot) -- C:\Windows\SysNative\WRusr.dll
[2014/02/20 18:57:22 | 000,000,000 | ---D | C] -- C:\Program Files\Webroot
[2014/02/20 18:57:11 | 000,000,000 | ---D | C] -- C:\ProgramData\WRData
[2014/02/20 18:47:52 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2014/02/20 18:47:52 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\MFAData
[2014/02/20 18:47:52 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2014/02/20 18:47:52 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Avg2014
[2014/02/20 18:40:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector
[2014/02/20 18:40:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Systweak
[2014/02/20 18:40:07 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Systweak
[2014/02/20 18:40:05 | 000,020,312 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\Windows\SysNative\roboot64.exe
[2014/02/20 18:40:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro
[2014/02/20 18:39:56 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Programs
[2014/02/20 18:39:52 | 000,000,000 | ---D | C] -- C:\temp
[2014/02/20 18:39:44 | 000,000,000 | ---D | C] -- C:\Program Files\Level Quality Watcher
[2014/02/20 18:39:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BrowserSafeguard
[2014/02/20 18:30:33 | 000,000,000 | R--D | C] -- C:\Users\Kim\Dropbox
[2014/02/20 18:28:58 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\DropboxMaster
[2014/02/20 18:28:41 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[2014/02/20 18:27:30 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Dropbox
[2014/02/20 17:23:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2014/02/20 17:20:56 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Hewlett-Packard
[2014/02/20 17:19:35 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Macromedia
[2014/02/20 17:18:43 | 000,000,000 | R--D | C] -- C:\Users\Kim\SkyDrive
[2014/02/20 17:18:23 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\AMD
[2014/02/20 17:17:59 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\ATI
[2014/02/20 17:17:59 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\ATI
[2014/02/20 17:17:47 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Hewlett-Packard
[2014/02/20 17:17:41 | 000,000,000 | ---D | C] -- C:\Users\Kim\Documents\Youcam
[2014/02/20 17:17:39 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\CyberLink
[2014/02/20 17:17:21 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Power2Go8
[2014/02/20 17:17:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Synaptics
[2014/02/20 17:16:50 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Synaptics
[2014/02/20 17:16:23 | 000,000,000 | R--D | C] -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2014/02/20 17:16:23 | 000,000,000 | R--D | C] -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2014/02/20 17:16:22 | 000,000,000 | R--D | C] -- C:\Users\Kim\Searches
[2014/02/20 17:16:22 | 000,000,000 | R--D | C] -- C:\Users\Kim\Contacts
[2014/02/20 17:16:22 | 000,000,000 | -H-D | C] -- C:\Users\Kim\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2014/02/20 17:16:19 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\VirtualStore
[2014/02/20 17:16:19 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Adobe
[2014/02/20 17:16:15 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shopping and Services
[2014/02/20 17:15:58 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Packages
[2014/02/20 17:15:37 | 000,000,000 | --SD | C] -- C:\Users\Kim\AppData\Roaming\Microsoft
[2014/02/20 17:15:37 | 000,000,000 | R--D | C] -- C:\Users\Kim\Videos
[2014/02/20 17:15:37 | 000,000,000 | R--D | C] -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
[2014/02/20 17:15:37 | 000,000,000 | R--D | C] -- C:\Users\Kim\Saved Games
[2014/02/20 17:15:37 | 000,000,000 | R--D | C] -- C:\Users\Kim\Pictures
[2014/02/20 17:15:37 | 000,000,000 | R--D | C] -- C:\Users\Kim\Music
[2014/02/20 17:15:37 | 000,000,000 | R--D | C] -- C:\Users\Kim\Links
[2014/02/20 17:15:37 | 000,000,000 | R--D | C] -- C:\Users\Kim\Favorites
[2014/02/20 17:15:37 | 000,000,000 | R--D | C] -- C:\Users\Kim\Downloads
[2014/02/20 17:15:37 | 000,000,000 | R--D | C] -- C:\Users\Kim\Documents
[2014/02/20 17:15:37 | 000,000,000 | R--D | C] -- C:\Users\Kim\Desktop
[2014/02/20 17:15:37 | 000,000,000 | R--D | C] -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2014/02/20 17:15:37 | 000,000,000 | R--D | C] -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
[2014/02/20 17:15:37 | 000,000,000 | -HSD | C] -- C:\Users\Kim\AppData\Local\Temporary Internet Files
[2014/02/20 17:15:37 | 000,000,000 | -HSD | C] -- C:\Users\Kim\Templates
[2014/02/20 17:15:37 | 000,000,000 | -HSD | C] -- C:\Users\Kim\Start Menu
[2014/02/20 17:15:37 | 000,000,000 | -HSD | C] -- C:\Users\Kim\SendTo
[2014/02/20 17:15:37 | 000,000,000 | -HSD | C] -- C:\Users\Kim\Recent
[2014/02/20 17:15:37 | 000,000,000 | -HSD | C] -- C:\Users\Kim\PrintHood
[2014/02/20 17:15:37 | 000,000,000 | -HSD | C] -- C:\Users\Kim\NetHood
[2014/02/20 17:15:37 | 000,000,000 | -HSD | C] -- C:\Users\Kim\Documents\My Videos
[2014/02/20 17:15:37 | 000,000,000 | -HSD | C] -- C:\Users\Kim\Documents\My Pictures
[2014/02/20 17:15:37 | 000,000,000 | -HSD | C] -- C:\Users\Kim\Documents\My Music
[2014/02/20 17:15:37 | 000,000,000 | -HSD | C] -- C:\Users\Kim\My Documents
[2014/02/20 17:15:37 | 000,000,000 | -HSD | C] -- C:\Users\Kim\Local Settings
[2014/02/20 17:15:37 | 000,000,000 | -HSD | C] -- C:\Users\Kim\AppData\Local\History
[2014/02/20 17:15:37 | 000,000,000 | -HSD | C] -- C:\Users\Kim\Cookies
[2014/02/20 17:15:37 | 000,000,000 | -HSD | C] -- C:\Users\Kim\Application Data
[2014/02/20 17:15:37 | 000,000,000 | -HSD | C] -- C:\Users\Kim\AppData\Local\Application Data
[2014/02/20 17:15:37 | 000,000,000 | -H-D | C] -- C:\Users\Kim\Documents\hp.system.package.metadata
[2014/02/20 17:15:37 | 000,000,000 | -H-D | C] -- C:\Users\Kim\Documents\hp.applications.package.appdata
[2014/02/20 17:15:37 | 000,000,000 | -H-D | C] -- C:\Users\Kim\AppData
[2014/02/20 17:15:37 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Temp
[2014/02/20 17:15:37 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Microsoft
[2014/02/20 17:15:37 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2014/02/20 17:07:32 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution

========== Files - Modified Within 30 Days ==========

[2014/03/19 17:47:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014/03/19 17:27:00 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014/03/19 15:55:17 | 004,497,920 | ---- | M] () -- C:\Users\Kim\Desktop\RogueKillerX64.exe
[2014/03/19 15:14:33 | 002,157,056 | ---- | M] (Farbar) -- C:\Users\Kim\Desktop\FRST64.exe
[2014/03/19 14:12:12 | 000,956,476 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2014/03/19 14:12:12 | 000,796,126 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2014/03/19 14:12:12 | 000,161,346 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2014/03/19 14:08:58 | 000,002,210 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2014/03/19 14:08:35 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014/03/19 14:08:02 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014/03/19 14:07:48 | 000,000,430 | ---- | M] () -- C:\Windows\tasks\DriverUpdate Startup.job
[2014/03/19 14:07:21 | 000,016,152 | ---- | M] () -- C:\Windows\SysNative\drivers\SWDUMon.sys
[2014/03/19 14:06:33 | 268,435,456 | -HS- | M] () -- C:\swapfile.sys
[2014/03/19 14:06:30 | 2743,287,808 | -HS- | M] () -- C:\hiberfil.sys
[2014/03/19 13:40:59 | 000,001,255 | ---- | M] () -- C:\Users\Kim\Desktop\Amazon Cloud Player.lnk
[2014/03/19 00:56:08 | 000,000,841 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2014/03/19 00:23:40 | 000,002,310 | ---- | M] () -- C:\Users\Kim\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2014/03/18 21:14:01 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2014/03/18 11:10:30 | 000,000,998 | ---- | M] () -- C:\Users\Public\Desktop\Advanced System Protector.lnk
[2014/03/18 11:02:28 | 000,002,485 | ---- | M] () -- C:\Users\Public\Desktop\DriverUpdate.lnk
[2014/03/17 16:11:42 | 000,001,122 | ---- | M] () -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk
[2014/03/16 20:30:45 | 000,382,424 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2014/03/09 20:04:59 | 000,154,248 | ---- | M] (Webroot) -- C:\Windows\SysWow64\WRusr.dll
[2014/03/09 20:04:59 | 000,115,168 | ---- | M] (Webroot) -- C:\Windows\SysNative\drivers\WRkrn.sys
[2014/03/09 20:04:59 | 000,105,320 | ---- | M] (Webroot) -- C:\Windows\SysNative\WRusr.dll
[2014/03/04 18:53:05 | 000,105,464 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2014/03/04 18:53:04 | 000,693,240 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2014/03/04 16:07:06 | 000,000,426 | ---- | M] () -- C:\AVScanner.ini
[2014/03/01 00:17:43 | 000,218,624 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2014/02/28 23:54:33 | 005,768,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2014/02/28 23:42:12 | 000,627,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2014/02/28 22:25:42 | 000,703,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2014/02/28 22:25:22 | 000,817,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2014/02/26 05:19:26 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_LocationProvider_01_11_00.Wdf
[2014/02/20 18:58:14 | 000,002,223 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install Webroot FF RunOnce.lnk
[2014/02/20 18:58:12 | 000,002,223 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install Webroot IE RunOnce.lnk
[2014/02/20 18:29:12 | 000,001,100 | ---- | M] () -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2014/02/20 17:19:19 | 000,001,447 | ---- | M] () -- C:\Users\Kim\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

========== Files Created - No Company Name ==========

[2014/03/19 15:55:15 | 004,497,920 | ---- | C] () -- C:\Users\Kim\Desktop\RogueKillerX64.exe
[2014/03/19 13:40:59 | 000,001,255 | ---- | C] () -- C:\Users\Kim\Desktop\Amazon Cloud Player.lnk
[2014/03/19 00:56:08 | 000,000,841 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2014/03/18 14:09:06 | 000,138,240 | ---- | C] () -- C:\Windows\SysNative\OEMLicense.dll
[2014/03/18 14:09:06 | 000,103,936 | ---- | C] () -- C:\Windows\SysWow64\OEMLicense.dll
[2014/03/18 11:23:31 | 000,002,310 | ---- | C] () -- C:\Users\Kim\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2014/03/18 11:23:31 | 000,002,210 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2014/03/18 11:22:53 | 000,000,908 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014/03/18 11:22:51 | 000,000,904 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014/03/18 11:02:41 | 000,000,430 | ---- | C] () -- C:\Windows\tasks\DriverUpdate Startup.job
[2014/03/18 11:02:35 | 000,016,152 | ---- | C] () -- C:\Windows\SysNative\drivers\SWDUMon.sys
[2014/03/18 11:02:28 | 000,002,485 | ---- | C] () -- C:\Users\Public\Desktop\DriverUpdate.lnk
[2014/03/18 10:20:42 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2014/03/18 09:51:02 | 000,000,998 | ---- | C] () -- C:\Users\Public\Desktop\Advanced System Protector.lnk
[2014/03/17 15:29:54 | 000,000,426 | ---- | C] () -- C:\AVScanner.ini
[2014/03/13 13:08:14 | 000,001,122 | ---- | C] () -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk
[2014/03/11 21:13:47 | 000,386,722 | ---- | C] () -- C:\Windows\SysNative\ApnDatabase.xml
[2014/02/26 05:19:26 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_LocationProvider_01_11_00.Wdf
[2014/02/25 20:08:17 | 000,000,299 | ---- | C] () -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Recycle Bin.lnk
[2014/02/25 11:51:30 | 000,009,701 | ---- | C] () -- C:\Windows\SysWow64\connectedsearch-results.searchconnector-ms
[2014/02/25 11:51:30 | 000,009,701 | ---- | C] () -- C:\Windows\SysNative\connectedsearch-results.searchconnector-ms
[2014/02/20 20:01:37 | 000,000,830 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014/02/20 18:58:14 | 000,002,223 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install Webroot FF RunOnce.lnk
[2014/02/20 18:58:12 | 000,002,223 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install Webroot IE RunOnce.lnk
[2014/02/20 18:40:27 | 000,016,896 | ---- | C] () -- C:\Windows\SysNative\sasnative64.exe
[2014/02/20 18:29:12 | 000,001,100 | ---- | C] () -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2014/02/20 17:19:19 | 000,001,447 | ---- | C] () -- C:\Users\Kim\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2014/02/20 17:16:19 | 000,001,453 | ---- | C] () -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2014/02/20 17:15:37 | 000,000,352 | ---- | C] () -- C:\Users\Kim\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2014/02/20 17:15:37 | 000,000,334 | ---- | C] () -- C:\Users\Kim\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2013/11/27 12:51:18 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe
[2013/11/27 12:46:27 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013/09/25 22:49:40 | 000,995,342 | ---- | C] () -- C:\Windows\SysWow64\amdocl_as32.exe
[2013/09/25 22:49:40 | 000,798,734 | ---- | C] () -- C:\Windows\SysWow64\amdocl_ld32.exe
[2013/09/25 22:07:28 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2013/09/25 22:07:28 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2013/09/25 21:36:12 | 000,123,392 | ---- | C] () -- C:\Windows\SysWow64\amdhdl32.dll
[2013/09/25 10:55:32 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2013/08/26 02:13:37 | 000,931,872 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013/08/22 11:36:43 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2013/08/22 11:36:42 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2013/08/22 10:46:23 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2013/08/22 03:01:23 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2013/08/21 23:32:36 | 000,046,080 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2013/08/21 19:55:20 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2013/08/21 19:52:39 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

========== ZeroAccess Check ==========

[2013/10/18 13:51:08 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/12/09 04:05:24 | 021,199,256 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/12/09 00:51:04 | 018,643,560 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2013/08/22 05:49:49 | 000,921,088 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2013/08/21 22:45:10 | 000,691,712 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2013/08/22 05:45:17 | 000,483,840 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== Custom Scans ==========

========== Base Services ==========
SRV:64bit: - [2013/08/22 07:31:58 | 000,207,360 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\aelupsvc.dll -- (AeLookupSvc)
SRV:64bit: - [2013/08/22 07:34:22 | 000,109,568 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\appinfo.dll -- (Appinfo)
SRV:64bit: - [2013/08/22 05:53:13 | 000,092,672 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\alg.exe -- (ALG)
SRV:64bit: - [2013/08/22 06:19:14 | 001,017,856 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\qmgr.dll -- (BITS)
SRV:64bit: - [2013/10/12 17:48:42 | 000,828,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\BFE.DLL -- (BFE)
SRV:64bit: - [2013/08/22 05:54:59 | 000,059,392 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\keyiso.dll -- (KeyIso)
SRV - [2013/08/21 22:48:12 | 000,044,032 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\keyiso.dll -- (KeyIso)
SRV:64bit: - [2013/08/22 05:40:30 | 000,468,992 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\es.dll -- (EventSystem)
SRV - [2013/08/21 22:38:29 | 000,329,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\es.dll -- (EventSystem)
SRV:64bit: - [2013/08/22 06:00:58 | 000,134,144 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\browser.dll -- (Browser)
SRV:64bit: - [2013/08/22 06:01:39 | 000,129,536 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\cryptsvc.dll -- (CryptSvc)
SRV:64bit: - [2013/08/22 05:50:00 | 000,761,344 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (DcomLaunch)
SRV:64bit: - [2013/10/18 13:48:00 | 000,353,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dhcpcore.dll -- (Dhcp)
SRV - [2013/10/18 13:48:07 | 000,285,696 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\dhcpcore.dll -- (Dhcp)
SRV:64bit: - [2013/10/08 01:48:10 | 000,255,488 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dnsrslvr.dll -- (Dnscache)
SRV:64bit: - [2013/08/22 05:44:18 | 000,107,008 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\eapsvc.dll -- (Eaphost)
SRV:64bit: - [2013/08/22 07:34:06 | 000,032,256 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\hidserv.dll -- (hidserv)
SRV - [2013/08/22 00:05:54 | 000,029,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\hidserv.dll -- (hidserv)
SRV:64bit: - [2013/09/14 05:11:03 | 000,433,664 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\ipnathlp.dll -- (SharedAccess)
SRV:64bit: - [2013/08/22 05:35:27 | 000,403,456 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\IPSECSVC.DLL -- (PolicyAgent)
No service found with a name of MsMpSvc
No service found with a name of NisSrv
SRV:64bit: - [2014/01/31 05:06:05 | 000,716,288 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\swprv.dll -- (swprv)
SRV:64bit: - [2013/08/22 05:54:27 | 000,070,656 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\mmcss.dll -- (MMCSS)
SRV:64bit: - [2013/08/22 05:05:22 | 000,254,976 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\netman.dll -- (Netman)
SRV:64bit: - [2013/08/22 05:50:00 | 000,525,312 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofmsvc.dll -- (netprofm)
SRV:64bit: - [2013/08/22 05:35:48 | 000,387,584 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\nlasvc.dll -- (NlaSvc)
SRV:64bit: - [2013/08/22 09:25:35 | 000,029,184 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\nsisvc.dll -- (nsi)
SRV:64bit: - [2013/08/22 07:35:42 | 000,124,928 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\umpnpmgr.dll -- (PlugPlay)
SRV:64bit: - [2013/08/22 05:10:12 | 000,798,208 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\spoolsv.exe -- (Spooler)
No service found with a name of ProtectedStorage
No service found with a name of EMDMgmt
SRV:64bit: - [2013/08/22 07:22:30 | 000,101,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\rasauto.dll -- (RasAuto)
SRV:64bit: - [2013/08/22 05:18:58 | 000,534,016 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\rasmans.dll -- (RasMan)
SRV:64bit: - [2013/08/22 05:50:00 | 000,761,344 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (RpcSs)
SRV:64bit: - [2013/08/22 07:32:16 | 000,030,720 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\seclogon.dll -- (seclogon)
SRV:64bit: - [2013/08/22 09:25:35 | 000,045,008 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsass.exe -- (SamSs)
SRV:64bit: - [2013/08/22 05:12:56 | 000,133,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wscsvc.dll -- (wscsvc)
SRV:64bit: - [2013/08/22 05:48:09 | 000,324,608 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\srvsvc.dll -- (LanmanServer)
SRV:64bit: - [2013/08/22 05:24:27 | 000,629,760 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\shsvcs.dll -- (ShellHWDetection)
SRV - [2013/08/21 22:27:04 | 000,564,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\shsvcs.dll -- (ShellHWDetection)
No service found with a name of slsvc
SRV:64bit: - [2013/12/31 19:57:55 | 001,214,976 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\schedsvc.dll -- (Schedule)
SRV:64bit: - [2013/08/22 06:55:30 | 000,306,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\tapisrv.dll -- (TapiSrv)
SRV - [2013/08/21 23:33:38 | 000,248,320 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\tapisrv.dll -- (TapiSrv)
SRV:64bit: - [2013/08/22 06:00:18 | 000,050,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\themeservice.dll -- (Themes)
SRV:64bit: - [2013/10/10 07:38:48 | 000,221,184 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\profsvc.dll -- (ProfSvc)
SRV:64bit: - [2013/08/22 05:19:19 | 001,436,160 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\VSSVC.exe -- (VSS)
SRV:64bit: - [2013/11/15 09:24:22 | 000,834,048 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\audiosrv.dll -- (Audiosrv)
SRV:64bit: - [2013/08/22 05:39:33 | 000,198,656 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\AudioEndpointBuilder.dll -- (AudioEndpointBuilder)
No service found with a name of SDRSVC
SRV:64bit: - [2013/10/30 20:29:53 | 000,023,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)
SRV:64bit: - [2013/08/22 05:44:27 | 001,669,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wevtsvc.dll -- (EventLog)
SRV:64bit: - [2013/08/22 05:23:55 | 000,878,080 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\MPSSVC.dll -- (MpsSvc)
SRV:64bit: - [2013/08/22 06:39:20 | 000,634,368 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wiaservc.dll -- (stisvc)
SRV:64bit: - [2013/08/22 07:23:10 | 000,062,464 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\msiexec.exe -- (msiserver)
SRV - [2013/08/21 23:56:51 | 000,055,808 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWow64\msiexec.exe -- (msiserver)
SRV:64bit: - [2013/08/22 05:48:04 | 000,220,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wbem\WMIsvc.dll -- (Winmgmt)
SRV:64bit: - [2013/10/06 22:13:16 | 003,532,288 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wuaueng.dll -- (wuauserv)
SRV:64bit: - [2013/08/22 06:30:45 | 000,258,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\dot3svc.dll -- (dot3svc)
SRV:64bit: - [2013/11/27 04:58:05 | 001,503,232 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wlansvc.dll -- (WlanSvc)
SRV:64bit: - [2013/08/22 05:54:22 | 000,284,160 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wkssvc.dll -- (LanmanWorkstation)

< set /c >
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Kim\AppData\Roaming
CommonProgramFiles=C:\Program Files (x86)\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=KIMSHIP
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Kim
LOCALAPPDATA=C:\Users\Kim\AppData\Local
LOGONSERVER=\\MicrosoftAccount
NUMBER_OF_PROCESSORS=4
OnlineServices=Online Services
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Hewlett-Packard\SimplePass\;C:\Program Files (x86)\Windows Live\Shared;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\Users\Kim\AppData\Local\Smartbar\Application\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PCBRAND=Pavilion
Platform=MCD
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=AMD64 Family 21 Model 16 Stepping 1, AuthenticAMD
PROCESSOR_LEVEL=21
PROCESSOR_REVISION=1001
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files (x86)
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PROMPT=$P$G
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Kim\AppData\Local\Temp
TMP=C:\Users\Kim\AppData\Local\Temp
USERDOMAIN=KIMSHIP
USERDOMAIN_ROAMINGPROFILE=KIMSHIP
USERNAME=Kim
USERPROFILE=C:\Users\Kim
windir=C:\Windows
__COMPAT_LAYER=Installer

========== Alternate Data Streams ==========

@Alternate Data Stream - 195 bytes -> C:\Users\Kim\SkyDrive:ms-properties

< End of report >

[sugarbee]

There was no Extras.txt

Thanks Phel.

[sugarbee]

Sorry! I find the Extras.txt

OTL Extras logfile created on: 3/19/2014 6:03:59 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Kim\Downloads
64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16521)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.19 Gb Total Physical Memory | 1.93 Gb Available Physical Memory | 60.43% Memory free
5.69 Gb Paging File | 3.46 Gb Available in Paging File | 60.69% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 678.14 Gb Total Space | 635.01 Gb Free Space | 93.64% Space Free | Partition Type: NTFS
Drive D: | 19.73 Gb Total Space | 2.02 Gb Free Space | 10.25% Space Free | Partition Type: NTFS

Computer Name: KIMSHIP | User Name: Kim | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = internetshortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_USERS\.DEFAULT\SOFTWARE\Classes\<extension>]

[HKEY_USERS\S-1-5-18\SOFTWARE\Classes\<extension>]

[HKEY_USERS\S-1-5-19\SOFTWARE\Classes\<extension>]

[HKEY_USERS\S-1-5-20\SOFTWARE\Classes\<extension>]

[HKEY_USERS\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- C:\Program Files (x86)\Advanced System Protector\filetypehelper.exe -scanunknown "%1"
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- C:\Program Files (x86)\Advanced System Protector\filetypehelper.exe -scanunknown "%1"
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = AC 1C AE C5 46 9F CE 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Upgrade]
"UpgradeTime" = [binary data]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"FirewallOverride" = 0
"AntivirusOverride" = 0
"UacDisableNotify" = 0
"AntiSpywareDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Upgrade]
"UpgradeTime" = Reg Error: Unknown registry data type -- File not found

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03EC5718-67DF-4680-910D-0BA1B1F380FA}" = rport=138 | protocol=17 | dir=out | app=system |
"{1738956D-3846-49DB-BB0A-767B1AE40E4B}" = lport=139 | protocol=6 | dir=in | app=system |
"{4EF31DF6-244F-4186-9A84-6AA1D69D7B25}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |
"{540C58B6-7AEC-4761-9B8B-F5C771892FC3}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{64773F18-866A-4A41-B889-30BBD64B0BD9}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6CF3F39D-980D-4348-ADCD-CB45F540734B}" = lport=138 | protocol=17 | dir=in | app=system |
"{79A4529D-9240-4BD8-A1EB-AD4233CF7438}" = lport=2869 | protocol=6 | dir=in | app=system |
"{8B18A297-86AF-42AC-87FA-2D5C76187091}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8F4B2368-258E-484D-B715-1724F6777C08}" = rport=137 | protocol=17 | dir=out | app=system |
"{927F1272-0038-4328-9A39-4D242A73983A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{95B37189-0DC0-483C-B1C1-A56C62214F16}" = lport=10243 | protocol=6 | dir=in | app=system |
"{97E544E1-E4A4-4F46-A24B-E2762F18BFD6}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A960D66A-BCE0-4A2B-871E-7A674D6389B5}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AA51FC8B-7989-4E48-B13C-539CB81E14F5}" = rport=10243 | protocol=6 | dir=out | app=system |
"{BA5D8533-1F6C-4066-AE18-125C70BA5B20}" = rport=445 | protocol=6 | dir=out | app=system |
"{C205D852-6D09-4B4B-83B1-F870ED22F989}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{CB82A929-4283-409B-A82D-1B6095A75177}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CD3F3103-DD7F-4F83-8EE9-9CA8AB54759F}" = rport=139 | protocol=6 | dir=out | app=system |
"{D1956DCD-173B-4A6D-991B-2180DC4BA221}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D3834BB4-8BE4-4572-B247-4A2901A5A50F}" = lport=445 | protocol=6 | dir=in | app=system |
"{D5C74A28-CFF0-4AA7-97DF-0E0C9B8C1687}" = lport=137 | protocol=17 | dir=in | app=system |
"{F5839933-7D60-4E80-A5AD-87395DF8BBEE}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FC07E070-9749-42BD-8E2E-1A6946387A55}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00B435C3-D8F5-49E2-A54A-C86DDF1A7740}" = dir=out | name=@{microsoft.windowscommunicationsapps_17.5.9600.20413_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
"{01C86499-0426-44DD-8CB6-19EB27AC749C}" = protocol=6 | dir=out | app=system |
"{02520380-4188-4D82-A2B2-ACDA85BBAD6F}" = dir=out | name=netflix |
"{05A5B647-F609-423B-AD7E-44BE5380C8C2}" = dir=out | name=box |
"{07953E41-10E5-46EB-97EE-78C86DB23E08}" = dir=out | name=ebay |
"{07FFDC02-CC1F-468B-B22A-7184D67A1DBF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{084DC84C-5331-44BD-93C2-319C7021C529}" = protocol=17 | dir=in | app=c:\users\kim\appdata\roaming\dropbox\bin\dropbox.exe |
"{0D33B17D-C2C9-4EBD-ACCF-520B88B6D1A4}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{0EC4B122-2054-4CE7-BB28-5D7EBE8C0136}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{17D39B0B-0398-46A9-9D45-349D2A2F93D5}" = protocol=58 | dir=out | [email protected],-28546 |
"{1A4B1A6B-FD06-4426-BE84-220046B6C52B}" = dir=out | name=@{microsoft.xboxlivegames_2.0.139.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxlivegames/resources/34150} |
"{1BBB1104-CBD1-400F-A97D-69524012D900}" = dir=out | name=@{microsoft.bingmaps_2.0.2530.2317_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingmaps/resources/appdisplayname} |
"{244EBA3B-39FF-4EB9-B38C-C49B62FA6A02}" = protocol=1 | dir=in | [email protected],-28543 |
"{25F3A35C-AF1E-4CCC-9862-01389A922BE6}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe |
"{2629B549-58FA-4DEC-9E05-A5148E493E41}" = dir=out | name=windows_ie_ac_001 |
"{2A49305B-BA97-4776-A002-52C3F8A661E2}" = protocol=58 | dir=in | [email protected],-28545 |
"{2B8EE735-FE86-4764-941C-79B3FA45BD67}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\kernel\dmr\powerdvd12dmrengine.exe |
"{2BA738CA-A2EC-4D00-BECD-82AFEBDDEB37}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector10\pdr10.exe |
"{2DDC8FCA-7EC7-4BA8-BBB1-C3C96687C1D1}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{338E4A94-8313-4566-BC8E-4C2099DBD346}" = dir=out | app=c:\program files (x86)\hpconnectedmusic\hpconnectedmusic.exe |
"{39E5EAC3-CAD0-48F4-8E89-25C5EC1B12A7}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe |
"{3A6CA381-4463-403B-8012-3D31C0F953BB}" = dir=out | app=%localappdata%\hpconnectedmusic\application\hpconnectedmusic.exe |
"{3A7D3D74-8DFA-4021-8771-3C66007A547B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{4282FE99-8560-4BC7-9576-5F3ED84E263F}" = dir=in | name=checkpoint.vpn |
"{4392BAB6-7FD1-45F7-98C6-043813755011}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{466AF95C-8E5A-4071-B147-8EE1293854EE}" = dir=in | name=hp connected drive |
"{49FD3E80-8EB0-4650-86CF-B8F7FBB9F208}" = dir=in | name=getting started with windows 8 |
"{4C6A8676-7ACA-4D2E-B2D6-EB6F64D8B2C5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{4D21E721-4926-444B-B06F-F194625FF444}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{4F8C79FD-16B3-4C8F-A7BF-786536016B94}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{50B9BB81-15DD-435B-A643-881FB326847C}" = dir=out | name=skype |
"{52434FEC-C2D5-4E2C-B552-B93DBB085189}" = dir=out | name=@{microsoft.bingfoodanddrink_3.0.2.236_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingfoodanddrink/resources/apptitlewithbranding} |
"{548DCF8C-BFF2-4BA4-AA88-FBAF9AC8BCC6}" = dir=in | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
"{560448D6-095C-4907-B046-AC7F710701A7}" = dir=in | name=sonicwall.mobileconnect |
"{560D807E-DD64-4F5A-AFFA-CCE0CDDDFF0E}" = dir=in | name=hp connected photo |
"{5654807F-B99C-4CA9-AE8F-C2B0F93D4D87}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\kernel\dms\clmsserverpdvd12.exe |
"{5C7F2418-CEF4-4998-BCAF-AB6466069FB7}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\powerdvd12ml.exe |
"{5F4632C0-D5B1-40C3-B0D9-E3A759C81B9E}" = dir=out | name=sonicwall.mobileconnect |
"{64966C50-2D97-4C99-88C2-AB69DE5D91B0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{69321B68-F6F7-4A78-81C8-1205EC4D4FF8}" = dir=in | name=box |
"{6CDACDD9-9028-44FD-AB48-934D26200CFD}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6E479253-0217-4584-8B84-C91AAF007248}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{75D0D385-D431-43AD-9C41-E97A357DAFE3}" = dir=out | name=getting started with windows 8 |
"{77F9248B-D54B-426B-BF85-4A46BD418D2F}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe |
"{7BCAEB16-DD19-4E9F-BBFA-93CB4D17D2AD}" = dir=out | app=%localappdata%\hpconnectedmusic\application\spotify_helper.exe |
"{80EE4EE8-57E5-4288-8176-C1F3A567BAF0}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{85251B09-5706-4F59-8F94-A58B7146B44A}" = dir=out | name=@{microsoft.bingfinance_3.0.2.234_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingfinance/resources/brandedapptitle} |
"{85A3FC65-11C4-4B0B-885A-55DB41C761CA}" = dir=in | name=skype |
"{8D1C6F77-A6FD-4102-B33E-4ECAE5398DE3}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\movie\powerdvd.exe |
"{9123F3BE-9B03-48CE-AA42-8C6A8A22AF8B}" = dir=out | name=hp connected drive |
"{93716735-B3E2-4097-8BEB-AC224829D0DB}" = dir=out | name=kindle |
"{99C98E18-C8DA-455C-A2CD-AF73391E00E0}" = dir=out | name=youcam for hp |
"{9E3D57FC-7C37-4424-9352-4831E97D029D}" = dir=out | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
"{9F93B13E-BCC4-4AAC-BE2D-F157B6B2EDBC}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{A04F0A85-9609-4D1D-8512-6C9F0813F5D3}" = dir=out | name=@{microsoft.windowsreadinglist_6.3.9654.20349_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsreadinglist/resources/apppackagename} |
"{A85E2B6D-2F14-4B5A-9B96-69D37D4BF825}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{AA54297E-7AB2-46C2-9674-245D23ABECDF}" = dir=out | name=@{microsoft.binghealthandfitness_3.0.2.233_x64__8wekyb3d8bbwe?ms-resource://microsoft.binghealthandfitness/resources/apptitle} |
"{AF5210C0-07DD-4622-A7CB-D03452547241}" = dir=out | name=@{microsoft.zunevideo_2.2.767.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/ids_manifest_video_app_name} |
"{AFF70F25-60BE-4E0C-A3D1-421E7028BA4E}" = dir=in | app=c:\users\kim\appdata\local\microsoft\skydrive\skydrive.exe |
"{B13D9176-A755-4821-A126-85C1C0377FCD}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\powerdvd12.exe |
"{B66CC660-2D82-473D-9618-5FB25127FEB1}" = protocol=6 | dir=in | app=c:\users\kim\appdata\roaming\dropbox\bin\dropbox.exe |
"{BDD68A9E-47FD-4FC6-8067-3C817F3CA9BC}" = protocol=1 | dir=out | [email protected],-28544 |
"{C1899FCB-DD87-460B-85D8-4E13A698FD82}" = dir=in | app=%localappdata%\hpconnectedmusic\application\spotify_helper.exe |
"{C2C59221-1A2F-46B3-B216-612D0E54E835}" = dir=out | name=facebook |
"{C3614BC6-917C-4FE2-9D45-EBBF0947E02A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{C3F96D42-2809-47F9-8006-701CFCF042F6}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\powerdvd12agent.exe |
"{C9C892C6-E860-4F85-B561-A8CB3D6B7DE5}" = dir=out | name=@{microsoft.bingnews_3.0.2.233_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingnews/resources/brandedapptitle} |
"{CDA6CBA5-B0B2-4AA4-91CD-FAFBE594217C}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{CEF387D3-7302-41BC-A69D-A7B8397AAF8A}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{CF5CA64F-3C8E-48B9-BC4F-75771D8D5D19}" = dir=in | app=c:\program files (x86)\hewlett-packard\hp support framework\resources\hpwarrantycheck\hpdevicedetection3.exe |
"{D312F9FE-3B4F-4F4F-83B3-AA88C086E779}" = dir=out | name=- games app - |
"{D52240ED-3332-4527-A3C7-849E84F33569}" = dir=out | name=@{microsoft.bingtravel_3.0.2.233_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingtravel/resources/brandedapptitle} |
"{D673D916-9054-4779-85E2-76B3646252CD}" = dir=out | name=@{microsoft.bingsports_3.0.2.233_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingsports/resources/brandedapptitle} |
"{D6980480-941A-4DF6-AB81-3734ECD3D779}" = dir=out | name=junipernetworks.junospulsevpn |
"{D9A64485-6A73-42E5-BAF9-1C5F95C01D93}" = dir=in | name=@{microsoft.windowsreadinglist_6.3.9654.20349_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsreadinglist/resources/apppackagename} |
"{DB59588E-ED90-4C47-A7B5-7929DD0C0BD2}" = dir=out | name=checkpoint.vpn |
"{E120052A-57F6-48A3-956A-BDC7AE12CDB2}" = dir=in | app=c:\program files (x86)\hpconnectedmusic\hpconnectedmusic.exe |
"{E56E2C70-9847-46CE-B06A-3D102F03913F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E926DDB7-A98A-4260-BCB1-6EF90310AAC0}" = dir=out | name=@{microsoft.bingweather_3.0.2.233_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/apptitle} |
"{EC799E33-72BA-42D7-9127-DEFE68F9799D}" = dir=in | name=junipernetworks.junospulsevpn |
"{ED663641-C6B3-4CF2-B7DD-BC194227DA75}" = dir=in | app=%localappdata%\hpconnectedmusic\application\hpconnectedmusic.exe |
"{F64300AD-D559-4000-BD45-0997BCC8E70A}" = dir=out | name=f5.vpn.client |
"{F77E5446-4378-4E99-8B7A-7061AAAEA193}" = dir=in | name=f5.vpn.client |
"{F90A70F3-AE8B-44E8-9C36-295090D1096B}" = dir=in | name=@{microsoft.windowscommunicationsapps_17.5.9600.20413_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
"{FA8A4AED-D805-4858-B86B-F8498E0C278B}" = dir=out | name=@{microsoft.zunemusic_2.2.767.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/resources/ids_manifest_music_app_name} |
"{FB587E02-3084-4A6B-A59C-2C3107BDDBEB}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe |
"{FF72EE4A-08ED-46AF-9A04-FEC47B586106}" = dir=out | name=hp connected photo |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0895F77B-D446-411A-A5FD-49018A3199D7}" = AMD Fuel
"{0A644ECD-8C41-E206-8262-E5EC90848EB5}" = AMD Accelerated Video Transcoding
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{2DE6247C-7077-451B-8BA7-FFD1A2ABBB47}" = Inst5675
"{314FAD12-F785-4471-BCE8-AB506642B9A1}" = HP SimplePass
"{5BB304EB-8E5B-0F2D-66FA-6603D9BB3232}" = AMD Catalyst Install Manager
"{6E14E6D6-3175-4E1A-B934-CAB5A86367CD}" = HP Postscript Converter
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{74FE39A0-FB76-47CD-84BA-91E2BBB17EF2}" = DisableMSDefender
"{7A75E042-0D30-43C2-BD2A-684F4BE38FF7}" = HP Utility Center
"{813BA625-B0FA-48D8-9B75-59759C88C219}" = SavingsbullFilter
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{878F6913-7421-4713-97F7-0A736EE2A188}" = Inst5676
"{90150000-008F-0000-1000-0000000FF1CE}" = Office 15 Click-to-Run Licensing Component
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A09F5616-4BAD-64DA-C6F6-F96E0351218D}" = ccc-utility64
"{A2CB1ACB-94A2-32BA-A15E-7D80319F7589}" = Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727
"{AC53FC8B-EE18-3F9C-9B59-60937D0B182C}" = Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727
"{D1E8F2D7-7794-4245-B286-87ED86C1893C}" = HP Registration Service
"{E9FA781F-3E80-4399-825A-AD3E11C28C77}" = MSVCRT110_amd64
"CCleaner" = CCleaner
"HomeStudentRetail - en-us" = Microsoft Office Home and Student 2013 - en-us
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{03D562B5-C4E2-4846-A920-33178788BE00}" = Windows Live Communications Platform
"{04371603-5A0B-ED04-1091-E6DCDFC3DF20}" = CCC Help Chinese Traditional
"{07F6DC37-0857-4B68-A675-4E35989E85E3}" = HP 3D DriveGuard
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{0D598E62-73FD-6B12-E1A8-7FA65699B5FC}" = CCC Help Japanese
"{0F929651-F516-4956-90F2-FFBD2CD5D30E}" = Photo Gallery
"{0FF9CC94-EF23-401E-BDBD-37403D1A2B38}" = Windows Live SOXE Definitions
"{118DD9F0-49FE-498E-A2EE-F33423C1394C}" = Catalyst Control Center - Branding
"{12BE7C93-741C-54D8-910A-8BB00BB4A09C}" = CCC Help Swedish
"{15134cb0-b767-4960-a911-f2d16ae54797}" = Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}" = CyberLink Media Suite 10
"{22154f09-719a-4619-bb71-5b3356999fbf}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727
"{277BD99E-D0B2-3598-BE46-7CD5170F3970}" = Catalyst Control Center Graphics Previews Common
"{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}" = CyberLink Power2Go 8
"{2AC01935-3774-4981-98C8-14E93C14372C}" = Windows Live UX Platform Language Pack
"{2B353DA2-A8FD-4238-B207-62A1921158D7}" = DriverUpdate
"{2F73A7B2-E50E-39A6-9ABC-EF89E4C62E36}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727
"{2F966EDD-BA18-0F75-456F-648FF1329CEE}" = Catalyst Control Center InstallProxy
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{30B2D1D8-0A07-4B71-9553-0710C5D31E35}" = HP Wireless Button Driver
"{39337565-330E-4ab6-A9AE-AC81E0720B10}" = Cyberlink PhotoDirector
"{394B14EA-B072-4440-9510-87797CB12371}" = HP CoolSense
"{399EA8F8-5231-510D-070E-A5602C6CA3CD}" = CCC Help Polish
"{41126AED-2C61-0E5B-F127-49B97E606B9D}" = CCC Help Turkish
"{417A142E-10AF-EE44-E54A-361F11B15D56}" = CCC Help Dutch
"{4525FF56-E096-42F4-BB64-52AAA8B3D893}" = HP Documentation
"{45898170-E68C-4F02-AA35-C2186BF347A3}" = Movie Maker
"{5A0EE0F0-E909-4F3B-B437-AAD9252427CB}" = Windows Live Installer
"{5B92F54D-1C27-04A8-7F0A-609BB651C7BA}" = CCC Help English
"{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}" = Realtek Card Reader
"{5E094C92-6288-4F43-AA9A-D452D0218F3F}" = Windows Live Essentials
"{5FD07E0A-ACC7-6565-7E38-4A8A4FC996B8}" = CCC Help Thai
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{61655124-8C4E-59D5-88D2-455EFE5BEF3B}" = AMD Catalyst Control Center
"{6AA65072-66B9-89E7-EB89-BB8FE5C78D0E}" = CCC Help Spanish
"{6B6923B9-8719-425B-916C-CD2908F31AAF}" = Windows Live SOXE
"{6DDE8071-E4BA-461B-8A96-990DFAA0EBD1}" = SavingsBull
"{6E58A192-7CCD-83DF-E1D7-BF6A1372C7D8}" = CCC Help Chinese Standard
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.2.2.3
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp" = WildTangent Games App (HP Games)
"{70D5F822-F4C4-33D9-7EEC-2A4AF4EA7BDC}" = OEM Application Profile
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74088822-660F-0CD4-0ECA-0BE6E6C2AF4C}" = CCC Help Portuguese
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{89C7E0A7-4D9D-4DCC-8834-A9A2B92D7EBB}" = Photo Gallery
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110
"{90150000-008C-0000-0000-0000000FF1CE}" = Office 15 Click-to-Run Extensibility Component
"{90150000-008C-0409-0000-0000000FF1CE}" = Office 15 Click-to-Run Localization Component
"{919C7688-8F7D-0DB7-B79D-5B3571CB8E2C}" = CCC Help Czech
"{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}" = Visual Studio 2012 x86 Redistributables
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B56B031-A6C0-4BB7-8F61-938548C1B759}" = Pinger
"{A5107464-AA9B-4177-8129-5FF2F42DD322}" = REALTEK Wireless LAN Driver
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}" = CyberLink PowerDirector 10
"{B39A6825-EA20-43EA-AB2D-A6BC0298D9A1}" = Movie Maker
"{B46BEA36-0B71-4A4E-AE41-87241643FA0A}" = CyberLink PowerDVD 12
"{BC0BF363-63AB-4FF7-8EF1-AE0D7F711B24}" = LPT System Updater Service
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{C6B0EE9E-2128-4448-B7AE-5E2B46E0F0E7}" = Windows Live Photo Common
"{C78E8F51-3EAD-4F0C-83F0-EF371075E0B4}" = HP System Event Utility
"{C803F720-6EFF-F346-DCA6-14318EB9922C}" = Catalyst Control Center Localization All
"{CB479001-71F1-D133-DB45-97F40F99EAC1}" = CCC Help Danish
"{CC7BB4E8-0F61-48A9-DF4D-20E43DA3C3AB}" = CCC Help Norwegian
"{D1319840-A113-DCA8-F938-A3468A7FA862}" = CCC Help Korean
"{D3992AF4-D2EB-183A-41B6-9401855AEED9}" = CCC Help Russian
"{D95C92C8-4670-3122-71BF-C4F27B2228BF}" = CCC Help Greek
"{DD7C5FC1-DCA5-487A-AF23-658B1C00243F}" = Photo Common
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3445598-4424-4EE2-B71C-C23325F7FB71}" = Windows Live PIMT Platform
"{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}" = HP Support Assistant
"{E4CDF12A-3203-DCEE-6C02-4F311F89AF16}" = CCC Help Hungarian
"{E6E135B9-2211-683C-1E52-D5E0C244B36A}" = CCC Help German
"{E8C68176-FE8A-FE9A-4544-781F8CD611A8}" = CCC Help Italian
"{ED3EECB1-03EA-55A2-BB44-C7911868D2AC}" = CCC Help French
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E58739-2B4C-498F-9B0D-FF0F2FD52B61}" = Windows Live UX Platform
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F3295B87-FA7F-F1F1-5F07-EACB752B669F}" = CCC Help Finnish
"{FB385922-2E32-4462-A7DC-27159614A660}" = Snap.Do
"{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}" = Energy Star
"{FD49537C-C3A6-4F8D-93E6-68C778A1E192}" = HP Recovery Manager
"{FDB30193-FDA0-3DAA-ACCA-A75EEFE53607}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727
"Adobe Flash Player Plugin" = Adobe Flash Player 12 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 12.0
"Google Chrome" = Google Chrome
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}" = CyberLink Media Suite 10
"InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}" = CyberLink Power2Go 8
"InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}" = HP SimplePass
"InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}" = Cyberlink PhotoDirector
"InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}" = CyberLink PowerDirector 10
"InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}" = CyberLink PowerDVD 12
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Pinger 1.4.0.1" = Pinger
"StartHPConnectedMusic" = HP Connected Music (Meridian - installer)
"WildTangent wildgames Master Uninstall" = WildTangent Games
"WinLiveSuite" = Windows Live Essentials
"WRUNINST" = Webroot SecureAnywhere
"WTA-02731f74-eef9-49f0-9e49-b6e8c5890582" = Youda Jewel Shop
"WTA-12994157-f75f-4bf3-95a6-9f80e5625e3e" = Build-a-lot
"WTA-14380d67-6f50-4280-af08-a7d0dfd787a2" = Luxor Evolved
"WTA-1687b6a3-2f77-4bbc-bae2-98c6973c2fe5" = King Oddball
"WTA-17e4838e-c690-4af5-bd30-15bdda345941" = Tales of Lagoona
"WTA-1b591a9c-031b-453a-b336-f8d04cfa5a2f" = Governor of Poker 2 Premium Edition
"WTA-2f8b3fd3-454a-41b5-910f-065d632d411f" = Mahjongg Dimensions Deluxe
"WTA-393aa941-1358-4641-b8a2-f637da8d1fef" = Azkend 2: The World Beneath
"WTA-44fc4272-dc82-4594-af0a-ecc03e31347f" = Plants vs. Zombies - Game of the Year
"WTA-4a00ccad-206d-4289-a832-4d76c74eea03" = Delicious: Emily's Childhood Memories Premium Edition
"WTA-4b039ff6-b07a-406f-b2ef-42607c274be7" = Peggle Nights
"WTA-4dcb586b-23e4-4014-97c0-e773c6256a8f" = Vacation Quest™ - Australia
"WTA-57bb1524-df97-4fb3-a58d-b6c5c1cd1267" = Curse at Twilight
"WTA-66a32e31-a102-4a5b-ba0d-a82481da578b" = Bounce Symphony
"WTA-6fba1754-5c31-41d7-8357-3390b8c9ca4b" = House of 1000 Doors: Family Secrets
"WTA-76c1430a-b631-4ddc-a7c6-d880a7524bee" = Cradle of Rome 2
"WTA-8ab9fd4d-19d4-4c1b-a932-d212b740d9d6" = Cradle Of Egypt Collector's Edition
"WTA-8b00b443-3ed1-4f98-9e5c-fd4bd623925b" = Roads of Rome 3
"WTA-92da0979-76da-4598-aa58-16e4d93e7a56" = Jewel Match 3
"WTA-94747bd2-9db8-4783-bf53-7fc572f01c6c" = Penguins!
"WTA-99e7820b-1887-48d1-ac6a-4489d16e86a4" = Mystery P.I. - Curious Case of Counterfeit Cove
"WTA-9a76ab38-a5d8-43ab-a3af-5fefbeb4449e" = Airport Mania
"WTA-a19ed313-c752-48d1-97ba-d9759df135c9" = Farm Frenzy
"WTA-a3fcf0b0-3d44-4d2b-aed3-ee1f587cdf19" = 4 Elements II
"WTA-b0fe64d1-80e2-4928-8a86-914979a109c9" = John Deere Drive Green
"WTA-cd7cb784-7c07-4baa-acd3-ced4570fa9c0" = Bejeweled 3
"WTA-d2fe7e80-f59c-46ce-bbad-855ae94e288e" = Polar Bowler
"WTA-dbb5e02a-d88a-412f-b7e7-41604a495a9b" = Fishdom 3: Collector's Edition
"WTA-f71766fb-ae3d-4ff2-b67a-b7147e0c87bd" = Zuma's Revenge

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02224593-ec78-49e5-a1ac-c3964a6e3f72}" = Snap.Do Engine
"Amazon Amazon Cloud Player" = Amazon Cloud Player
"Dropbox" = Dropbox
"HPConnectedMusic" = HP Connected Music (Meridian - player)
"OneDriveSetup.exe" = Microsoft OneDrive

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 3/18/2014 11:18:53 AM | Computer Name = KimShip | Source = .NET Runtime | ID = 1023
Description =

Error - 3/18/2014 11:18:55 AM | Computer Name = KimShip | Source = Application Error | ID = 1000
Error - 3/18/2014 11:24:25 AM | Computer Name = KimShip | Source = Application Error
| ID = 1000

Description = Faulting application name: 40b9Installer.exe, version: 0.0.0.0, time stamp: 0x4b1ae41c
Faulting module name: ExecDos.dll_unloaded, version: 0.0.0.0, time stamp: 0x4d35cf84
Exception code: 0xc0000005
Fault offset: 0x00001510
Faulting process id: 0x1b90
Faulting application start time: 0x01cf42bd3c911ef8
Faulting application path: C:\Users\Kim\AppData\Local\temp\40b9Installer.exe
Faulting module path: ExecDos.dll
Report Id: 630ac581-aeb1-11e3-8269-a01d48d9a556
Faulting package full name:
Faulting package-relative application ID:
Error - 3/18/2014 11:31:52 AM | Computer Name = KimShip | Source = Application Error
| ID = 1000

Description = Faulting application name: chrome.exe, version: 33.0.1750.154, time stamp: 0x5323921f
Faulting module name: webplayer_win.dll, version: 4.2.4.12952, time stamp: 0x52ef9531
Exception code: 0xc0000005
Fault offset: 0x00229bb9
Faulting process id: 0x171c
Faulting application start time: 0x01cf42bf2b1f72e8
Faulting application path: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Faulting module path: C:\Users\Kim\AppData\LocalLow\Unity\WebPlayer\player\Stable3.x.x\webplayer_win.dll
Report Id: 6d6138cc-aeb2-11e3-8269-a01d48d9a556
Faulting package full name:
Faulting package-relative application ID:
Error - 3/18/2014 11:34:34 AM | Computer Name = KimShip | Source = Application Error
| ID = 1000

Description = Faulting application name: chrome.exe, version: 33.0.1750.154, time stamp: 0x5323921f
Faulting module name: webplayer_win.dll, version: 4.2.4.12952, time stamp: 0x52ef9531
Exception code: 0xc0000005
Fault offset: 0x00229bb9
Faulting process id: 0x171c
Faulting application start time: 0x01cf42bf2b1f72e8
Faulting application path: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Faulting module path: C:\Users\Kim\AppData\LocalLow\Unity\WebPlayer\player\Stable3.x.x\webplayer_win.dll
Report Id: ce0311ad-aeb2-11e3-8269-a01d48d9a556
Faulting package full name:
Faulting package-relative application ID:
Error - 3/18/2014 3:01:01 PM | Computer Name = KimShip | Source = Application Error
| ID = 1000

Description = Faulting application name: RegCleanPro.exe, version: 6.21.65.2763, time stamp: 0x52160cb9
Faulting module name: KERNELBASE.dll, version: 6.3.9600.16496, time stamp: 0x52b3e015
Exception code: 0xc06d007e
Fault offset: 0x00012eec
Faulting process id: 0x13600
Faulting application start time: 0x01cf42dc66d972b1
Faulting application path: C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
Faulting module path: C:\Windows\SYSTEM32\KERNELBASE.dll
Report Id: a532effe-aecf-11e3-8269-a01d48d9a556
Faulting package full name:
Faulting package-relative application ID:
Error - 3/18/2014 9:11:01 PM | Computer Name = KimShip | Source = Bonjour Service
| ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second
Error - 3/18/2014 9:11:01 PM | Computer Name = KimShip | Source = Bonjour Service
| ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 8994891
Error - 3/18/2014 9:11:01 PM | Computer Name = KimShip | Source = Bonjour Service
| ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 8994891
Error - 3/19/2014 12:28:10 PM | Computer Name = KimShip | Source = Bonjour Service
| ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second
Error - 3/19/2014 12:28:10 PM | Computer Name = KimShip | Source = Bonjour Service
| ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 30480297
Error - 3/19/2014 12:28:10 PM | Computer Name = KimShip | Source = Bonjour Service
| ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 30480297

Error encountered while reading event logs.

< End of report >

[Phel]

Sorry for delay.

Okay, let's try to remove Snap.do using AdwCleaner and OTL first.

Please, follow these steps:

Step 1. OTL fix.

• Run OTL.
• Under the Custom Scans/Fixes box at the bottom, paste in the following:
  
  

  :Commands
  [CREATERESTOREPOINT]
  
  :OTL
  IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
  IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...q={searchTerms}
  IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snapdo.c...q={searchTerms}
  IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.snapdo.c...q={searchTerms}
  IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://feed.snapdo.c...4RX8MGQrcXUlX98,
  IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snapdo.c...q={searchTerms}
  IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snapdo.c...q={searchTerms}
  IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
  IE - HKU\.DEFAULT\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...q={searchTerms}
  IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snapdo.c...q={searchTerms}
  IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.snapdo.c...q={searchTerms}
  IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://feed.snapdo.c...4RX8MGQrcXUlX98,
  IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snapdo.c...q={searchTerms}
  IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snapdo.c...q={searchTerms}
  IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
  IE - HKU\S-1-5-18\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...q={searchTerms}
  IE - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...q={searchTerms}
  FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Users\Kim\AppData\Roaming\BaseFlash\Firefox
  
  :Files
  C:\Users\Kim\AppData\Roaming\BaseFlash
  
  :Commands
  [RESETHOSTS]
  [EMPTYTEMP]

• Then click the Run Fix button at the top.
• Let the program run unhindered, reboot the PC when it is done.

Step 2. AdwCleaner scan.

• Please, download AdwCleaner from here to your Desktop.
• Right click on adwcleaner.exe file on your Desktop->Run as Administrator.
• Adwcleaner window should appear.
• Click on Scan button. Scan could take some time to proceed.
• Click on the Clean button.
• Click on OK.
• Computer will be rebooted automatically, when program will finish it's job.
• After fix Notepad window with report should appear. Post the contents of the report in your next message.

Step 3. OTL scan.

• Run OTL.
• Click on Scan All Users checkbox, which is located near Quick Scan button.
• Find in the OTL window Extra Registry section and change radiobutton there to the Use SafeList.
• Then click the Run Scan button at the top.
• Let the program run unhindered.
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic.

So, please, don't forget to post in your next message:

• AdwCleaner log
• OTL.txt
• Extras.txt

[sugarbee]

HERE IS THE ADWARE TEXT FIRST.

 

# AdwCleaner v3.022 - Report created 26/03/2014 at 19:15:15

# Updated 13/03/2014 by Xplode

# Operating System : Windows 8.1  (64 bits)

# Username : Kim - KIMSHIP

# Running from : C:\Users\Kim\Downloads\adwcleaner.exe

# Option : Clean

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

Folder Deleted : C:\ProgramData\Systweak

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BrowserSafeguard

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro

Folder Deleted : C:\Windows\Installer\{6DDE8071-E4BA-461B-8A96-990DFAA0EBD1}

Folder Deleted : C:\Windows\Installer\{813BA625-B0FA-48D8-9B75-59759C88C219}

Folder Deleted : C:\Program Files\Level Quality Watcher

Folder Deleted : C:\Users\Kim\AppData\Roaming\Systweak

File Deleted : C:\Users\Public\Desktop\Advanced System Protector.lnk

File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk

File Deleted : C:\Windows\System32\roboot64.exe

File Deleted : C:\Windows\System32\Tasks\Advanced System Protector

File Deleted : C:\Windows\System32\Tasks\Advanced System Protector_startup

File Deleted : C:\Windows\System32\Tasks\RegClean Pro

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}

Key Deleted : HKCU\Software\SmartBar

Key Deleted : HKCU\Software\systweak

Key Deleted : HKCU\Software\AppDataLow\Software\PassWidget

Key Deleted : HKLM\Software\PerformerSoft

Key Deleted : HKLM\Software\SoftwareUpdater

Key Deleted : HKLM\Software\systweak

Key Deleted : HKLM\Software\Vittalia

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DDE8071-E4BA-461B-8A96-990DFAA0EBD1}

Key Deleted : [x64] HKLM\SOFTWARE\Savings Bull

Key Deleted : [x64] HKLM\SOFTWARE\SavingsBull Filter

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{813BA625-B0FA-48D8-9B75-59759C88C219}

Key Deleted : HKLM\Software\Classes\Installer\Features\1708EDD6AB4EB164A86999D0AF0ABE1D

Key Deleted : HKLM\Software\Classes\Installer\Features\526AB318AF0B8D84B9579557C9882C91

Key Deleted : HKLM\Software\Classes\Installer\Products\1708EDD6AB4EB164A86999D0AF0ABE1D

Key Deleted : HKLM\Software\Classes\Installer\Products\526AB318AF0B8D84B9579557C9882C91

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v11.0.9600.16518

 

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]

Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]

 

-\\ Google Chrome v33.0.1750.154

 

[ File : C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\preferences ]

 

 

*************************

 

AdwCleaner[R0].txt - [5381 octets] - [26/03/2014 18:38:14]

AdwCleaner[S0].txt - [4762 octets] - [26/03/2014 19:15:15]

 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4822 octets] ##########

 

[sugarbee]

HERE IS THE OTL TEXT.

 

# AdwCleaner v3.022 - Report created 26/03/2014 at 19:15:15

# Updated 13/03/2014 by Xplode

# Operating System : Windows 8.1  (64 bits)

# Username : Kim - KIMSHIP

# Running from : C:\Users\Kim\Downloads\adwcleaner.exe

# Option : Clean

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

Folder Deleted : C:\ProgramData\Systweak

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BrowserSafeguard

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro

Folder Deleted : C:\Windows\Installer\{6DDE8071-E4BA-461B-8A96-990DFAA0EBD1}

Folder Deleted : C:\Windows\Installer\{813BA625-B0FA-48D8-9B75-59759C88C219}

Folder Deleted : C:\Program Files\Level Quality Watcher

Folder Deleted : C:\Users\Kim\AppData\Roaming\Systweak

File Deleted : C:\Users\Public\Desktop\Advanced System Protector.lnk

File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk

File Deleted : C:\Windows\System32\roboot64.exe

File Deleted : C:\Windows\System32\Tasks\Advanced System Protector

File Deleted : C:\Windows\System32\Tasks\Advanced System Protector_startup

File Deleted : C:\Windows\System32\Tasks\RegClean Pro

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate

Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}

Key Deleted : HKCU\Software\SmartBar

Key Deleted : HKCU\Software\systweak

Key Deleted : HKCU\Software\AppDataLow\Software\PassWidget

Key Deleted : HKLM\Software\PerformerSoft

Key Deleted : HKLM\Software\SoftwareUpdater

Key Deleted : HKLM\Software\systweak

Key Deleted : HKLM\Software\Vittalia

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DDE8071-E4BA-461B-8A96-990DFAA0EBD1}

Key Deleted : [x64] HKLM\SOFTWARE\Savings Bull

Key Deleted : [x64] HKLM\SOFTWARE\SavingsBull Filter

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{813BA625-B0FA-48D8-9B75-59759C88C219}

Key Deleted : HKLM\Software\Classes\Installer\Features\1708EDD6AB4EB164A86999D0AF0ABE1D

Key Deleted : HKLM\Software\Classes\Installer\Features\526AB318AF0B8D84B9579557C9882C91

Key Deleted : HKLM\Software\Classes\Installer\Products\1708EDD6AB4EB164A86999D0AF0ABE1D

Key Deleted : HKLM\Software\Classes\Installer\Products\526AB318AF0B8D84B9579557C9882C91

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v11.0.9600.16518

 

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]

Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]

 

-\\ Google Chrome v33.0.1750.154

 

[ File : C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\preferences ]

 

 

*************************

 

AdwCleaner[R0].txt - [5381 octets] - [26/03/2014 18:38:14]

AdwCleaner[S0].txt - [4762 octets] - [26/03/2014 19:15:15]

 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4822 octets] ##########

 

[sugarbee]

HERE IS THE OTL EXTRAS.

 

OTL Extras logfile created on: 3/26/2014 7:21:21 PM - Run 2

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Kim\Desktop

64bit- An unknown product  (Version = 6.2.9200) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.16521)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

3.19 Gb Total Physical Memory | 1.54 Gb Available Physical Memory | 48.30% Memory free

5.44 Gb Paging File | 3.28 Gb Available in Paging File | 60.32% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 678.14 Gb Total Space | 634.40 Gb Free Space | 93.55% Space Free | Partition Type: NTFS

Drive D: | 19.73 Gb Total Space | 2.02 Gb Free Space | 10.25% Space Free | Partition Type: NTFS

 

Computer Name: KIMSHIP | User Name: Kim | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Extra Registry (SafeList) ==========

 

 

========== File Associations ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

.url[@ = internetshortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

 

[HKEY_USERS\.DEFAULT\SOFTWARE\Classes\<extension>]

 

[HKEY_USERS\S-1-5-18\SOFTWARE\Classes\<extension>]

 

[HKEY_USERS\S-1-5-19\SOFTWARE\Classes\<extension>]

 

[HKEY_USERS\S-1-5-20\SOFTWARE\Classes\<extension>]

 

[HKEY_USERS\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

 

========== Shell Spawning ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- C:\Program Files (x86)\Advanced System Protector\filetypehelper.exe -scanunknown "%1"

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- C:\Program Files (x86)\Advanced System Protector\filetypehelper.exe -scanunknown "%1"

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

 

========== Security Center Settings ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = AC 1C AE C5 46 9F CE 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Upgrade]

"UpgradeTime" =  [binary data]

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"FirewallOverride" = 0

"AntivirusOverride" = 0

"UacDisableNotify" = 0

"AntiSpywareDisableNotify" = 0

"AutoUpdateDisableNotify" = 0

"InternetSettingsDisableNotify" = 0

"UpdatesDisableNotify" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

"DisableMonitoring" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

"DisableMonitoring" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Upgrade]

"UpgradeTime" = Reg Error: Unknown registry data type -- File not found

 

========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

 

========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

========== Authorized Applications List ==========

 

 

========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{03EC5718-67DF-4680-910D-0BA1B1F380FA}" = rport=138 | protocol=17 | dir=out | app=system | 

"{1738956D-3846-49DB-BB0A-767B1AE40E4B}" = lport=139 | protocol=6 | dir=in | app=system | 

"{4EF31DF6-244F-4186-9A84-6AA1D69D7B25}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 | 

"{540C58B6-7AEC-4761-9B8B-F5C771892FC3}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 

"{64773F18-866A-4A41-B889-30BBD64B0BD9}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{6CF3F39D-980D-4348-ADCD-CB45F540734B}" = lport=138 | protocol=17 | dir=in | app=system | 

"{79A4529D-9240-4BD8-A1EB-AD4233CF7438}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{8B18A297-86AF-42AC-87FA-2D5C76187091}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{8F4B2368-258E-484D-B715-1724F6777C08}" = rport=137 | protocol=17 | dir=out | app=system | 

"{927F1272-0038-4328-9A39-4D242A73983A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{95B37189-0DC0-483C-B1C1-A56C62214F16}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{97E544E1-E4A4-4F46-A24B-E2762F18BFD6}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{A960D66A-BCE0-4A2B-871E-7A674D6389B5}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{AA51FC8B-7989-4E48-B13C-539CB81E14F5}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{BA5D8533-1F6C-4066-AE18-125C70BA5B20}" = rport=445 | protocol=6 | dir=out | app=system | 

"{C205D852-6D09-4B4B-83B1-F870ED22F989}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{CB82A929-4283-409B-A82D-1B6095A75177}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{CD3F3103-DD7F-4F83-8EE9-9CA8AB54759F}" = rport=139 | protocol=6 | dir=out | app=system | 

"{D1956DCD-173B-4A6D-991B-2180DC4BA221}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{D3834BB4-8BE4-4572-B247-4A2901A5A50F}" = lport=445 | protocol=6 | dir=in | app=system | 

"{D5C74A28-CFF0-4AA7-97DF-0E0C9B8C1687}" = lport=137 | protocol=17 | dir=in | app=system | 

"{F5839933-7D60-4E80-A5AD-87395DF8BBEE}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{FC07E070-9749-42BD-8E2E-1A6946387A55}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 

 

========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{00B435C3-D8F5-49E2-A54A-C86DDF1A7740}" = dir=out | name=@{microsoft.windowscommunicationsapps_17.5.9600.20413_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} | 

"{01C86499-0426-44DD-8CB6-19EB27AC749C}" = protocol=6 | dir=out | app=system | 

"{05A5B647-F609-423B-AD7E-44BE5380C8C2}" = dir=out | name=box | 

"{07953E41-10E5-46EB-97EE-78C86DB23E08}" = dir=out | name=ebay | 

"{07FFDC02-CC1F-468B-B22A-7184D67A1DBF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{084DC84C-5331-44BD-93C2-319C7021C529}" = protocol=17 | dir=in | app=c:\users\kim\appdata\roaming\dropbox\bin\dropbox.exe | 

"{0D33B17D-C2C9-4EBD-ACCF-520B88B6D1A4}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{0EC4B122-2054-4CE7-BB28-5D7EBE8C0136}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{17D39B0B-0398-46A9-9D45-349D2A2F93D5}" = protocol=58 | dir=out | [email protected],-28546 | 

"{1A4B1A6B-FD06-4426-BE84-220046B6C52B}" = dir=out | name=@{microsoft.xboxlivegames_2.0.139.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxlivegames/resources/34150} | 

"{1BBB1104-CBD1-400F-A97D-69524012D900}" = dir=out | name=@{microsoft.bingmaps_2.0.2530.2317_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingmaps/resources/appdisplayname} | 

"{244EBA3B-39FF-4EB9-B38C-C49B62FA6A02}" = protocol=1 | dir=in | [email protected],-28543 | 

"{25F3A35C-AF1E-4CCC-9862-01389A922BE6}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe | 

"{2629B549-58FA-4DEC-9E05-A5148E493E41}" = dir=out | name=windows_ie_ac_001 | 

"{2A49305B-BA97-4776-A002-52C3F8A661E2}" = protocol=58 | dir=in | [email protected],-28545 | 

"{2B8EE735-FE86-4764-941C-79B3FA45BD67}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\kernel\dmr\powerdvd12dmrengine.exe | 

"{2BA738CA-A2EC-4D00-BECD-82AFEBDDEB37}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector10\pdr10.exe | 

"{2DDC8FCA-7EC7-4BA8-BBB1-C3C96687C1D1}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{338E4A94-8313-4566-BC8E-4C2099DBD346}" = dir=out | app=c:\program files (x86)\hpconnectedmusic\hpconnectedmusic.exe | 

"{39E5EAC3-CAD0-48F4-8E89-25C5EC1B12A7}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe | 

"{3A6CA381-4463-403B-8012-3D31C0F953BB}" = dir=out | app=%localappdata%\hpconnectedmusic\application\hpconnectedmusic.exe | 

"{3A7D3D74-8DFA-4021-8771-3C66007A547B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{4282FE99-8560-4BC7-9576-5F3ED84E263F}" = dir=in | name=checkpoint.vpn | 

"{4392BAB6-7FD1-45F7-98C6-043813755011}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{466AF95C-8E5A-4071-B147-8EE1293854EE}" = dir=in | name=hp connected drive | 

"{49FD3E80-8EB0-4650-86CF-B8F7FBB9F208}" = dir=in | name=getting started with windows 8 | 

"{4C6A8676-7ACA-4D2E-B2D6-EB6F64D8B2C5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{4D21E721-4926-444B-B06F-F194625FF444}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{4F8C79FD-16B3-4C8F-A7BF-786536016B94}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{50B9BB81-15DD-435B-A643-881FB326847C}" = dir=out | name=skype | 

"{52434FEC-C2D5-4E2C-B552-B93DBB085189}" = dir=out | name=@{microsoft.bingfoodanddrink_3.0.2.236_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingfoodanddrink/resources/apptitlewithbranding} | 

"{54282971-ECCB-43AC-B3E2-2392EDDBD4C8}" = dir=in | app=c:\program files (x86)\hewlett-packard\hp support framework\resources\hpwarrantycheck\hpdevicedetection3.exe | 

"{548DCF8C-BFF2-4BA4-AA88-FBAF9AC8BCC6}" = dir=in | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} | 

"{560448D6-095C-4907-B046-AC7F710701A7}" = dir=in | name=sonicwall.mobileconnect | 

"{560D807E-DD64-4F5A-AFFA-CCE0CDDDFF0E}" = dir=in | name=hp connected photo | 

"{5654807F-B99C-4CA9-AE8F-C2B0F93D4D87}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\kernel\dms\clmsserverpdvd12.exe | 

"{5C7F2418-CEF4-4998-BCAF-AB6466069FB7}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\powerdvd12ml.exe | 

"{5F4632C0-D5B1-40C3-B0D9-E3A759C81B9E}" = dir=out | name=sonicwall.mobileconnect | 

"{64966C50-2D97-4C99-88C2-AB69DE5D91B0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{69321B68-F6F7-4A78-81C8-1205EC4D4FF8}" = dir=in | name=box | 

"{6CDACDD9-9028-44FD-AB48-934D26200CFD}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{6E479253-0217-4584-8B84-C91AAF007248}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{75D0D385-D431-43AD-9C41-E97A357DAFE3}" = dir=out | name=getting started with windows 8 | 

"{77F9248B-D54B-426B-BF85-4A46BD418D2F}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe | 

"{7BCAEB16-DD19-4E9F-BBFA-93CB4D17D2AD}" = dir=out | app=%localappdata%\hpconnectedmusic\application\spotify_helper.exe | 

"{80EE4EE8-57E5-4288-8176-C1F3A567BAF0}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{85251B09-5706-4F59-8F94-A58B7146B44A}" = dir=out | name=@{microsoft.bingfinance_3.0.2.234_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingfinance/resources/brandedapptitle} | 

"{85A3FC65-11C4-4B0B-885A-55DB41C761CA}" = dir=in | name=skype | 

"{8D1C6F77-A6FD-4102-B33E-4ECAE5398DE3}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\movie\powerdvd.exe | 

"{9123F3BE-9B03-48CE-AA42-8C6A8A22AF8B}" = dir=out | name=hp connected drive | 

"{93716735-B3E2-4097-8BEB-AC224829D0DB}" = dir=out | name=kindle | 

"{99C98E18-C8DA-455C-A2CD-AF73391E00E0}" = dir=out | name=youcam for hp | 

"{9E3D57FC-7C37-4424-9352-4831E97D029D}" = dir=out | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} | 

"{9F93B13E-BCC4-4AAC-BE2D-F157B6B2EDBC}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{A04F0A85-9609-4D1D-8512-6C9F0813F5D3}" = dir=out | name=@{microsoft.windowsreadinglist_6.3.9654.20349_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsreadinglist/resources/apppackagename} | 

"{A85E2B6D-2F14-4B5A-9B96-69D37D4BF825}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{AA54297E-7AB2-46C2-9674-245D23ABECDF}" = dir=out | name=@{microsoft.binghealthandfitness_3.0.2.233_x64__8wekyb3d8bbwe?ms-resource://microsoft.binghealthandfitness/resources/apptitle} | 

"{AF5210C0-07DD-4622-A7CB-D03452547241}" = dir=out | name=@{microsoft.zunevideo_2.2.767.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/ids_manifest_video_app_name} | 

"{AFF70F25-60BE-4E0C-A3D1-421E7028BA4E}" = dir=in | app=c:\users\kim\appdata\local\microsoft\skydrive\skydrive.exe | 

"{B13D9176-A755-4821-A126-85C1C0377FCD}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\powerdvd12.exe | 

"{B66CC660-2D82-473D-9618-5FB25127FEB1}" = protocol=6 | dir=in | app=c:\users\kim\appdata\roaming\dropbox\bin\dropbox.exe | 

"{BDD68A9E-47FD-4FC6-8067-3C817F3CA9BC}" = protocol=1 | dir=out | [email protected],-28544 | 

"{C1899FCB-DD87-460B-85D8-4E13A698FD82}" = dir=in | app=%localappdata%\hpconnectedmusic\application\spotify_helper.exe | 

"{C1DEA93E-8EFD-4548-9619-E9E626447766}" = dir=out | name=netflix | 

"{C2C59221-1A2F-46B3-B216-612D0E54E835}" = dir=out | name=facebook | 

"{C3614BC6-917C-4FE2-9D45-EBBF0947E02A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{C3F96D42-2809-47F9-8006-701CFCF042F6}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\powerdvd12agent.exe | 

"{C9C892C6-E860-4F85-B561-A8CB3D6B7DE5}" = dir=out | name=@{microsoft.bingnews_3.0.2.233_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingnews/resources/brandedapptitle} | 

"{CDA6CBA5-B0B2-4AA4-91CD-FAFBE594217C}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{CEF387D3-7302-41BC-A69D-A7B8397AAF8A}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 

"{D312F9FE-3B4F-4F4F-83B3-AA88C086E779}" = dir=out | name=- games app - | 

"{D52240ED-3332-4527-A3C7-849E84F33569}" = dir=out | name=@{microsoft.bingtravel_3.0.2.233_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingtravel/resources/brandedapptitle} | 

"{D673D916-9054-4779-85E2-76B3646252CD}" = dir=out | name=@{microsoft.bingsports_3.0.2.233_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingsports/resources/brandedapptitle} | 

"{D6980480-941A-4DF6-AB81-3734ECD3D779}" = dir=out | name=junipernetworks.junospulsevpn | 

"{D9A64485-6A73-42E5-BAF9-1C5F95C01D93}" = dir=in | name=@{microsoft.windowsreadinglist_6.3.9654.20349_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsreadinglist/resources/apppackagename} | 

"{DB59588E-ED90-4C47-A7B5-7929DD0C0BD2}" = dir=out | name=checkpoint.vpn | 

"{E120052A-57F6-48A3-956A-BDC7AE12CDB2}" = dir=in | app=c:\program files (x86)\hpconnectedmusic\hpconnectedmusic.exe | 

"{E56E2C70-9847-46CE-B06A-3D102F03913F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{E926DDB7-A98A-4260-BCB1-6EF90310AAC0}" = dir=out | name=@{microsoft.bingweather_3.0.2.233_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/apptitle} | 

"{EC799E33-72BA-42D7-9127-DEFE68F9799D}" = dir=in | name=junipernetworks.junospulsevpn | 

"{ED663641-C6B3-4CF2-B7DD-BC194227DA75}" = dir=in | app=%localappdata%\hpconnectedmusic\application\hpconnectedmusic.exe | 

"{F64300AD-D559-4000-BD45-0997BCC8E70A}" = dir=out | name=f5.vpn.client | 

"{F77E5446-4378-4E99-8B7A-7061AAAEA193}" = dir=in | name=f5.vpn.client | 

"{F90A70F3-AE8B-44E8-9C36-295090D1096B}" = dir=in | name=@{microsoft.windowscommunicationsapps_17.5.9600.20413_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} | 

"{FA8A4AED-D805-4858-B86B-F8498E0C278B}" = dir=out | name=@{microsoft.zunemusic_2.2.767.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/resources/ids_manifest_music_app_name} | 

"{FB587E02-3084-4A6B-A59C-2C3107BDDBEB}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe | 

"{FF72EE4A-08ED-46AF-9A04-FEC47B586106}" = dir=out | name=hp connected photo | 

 

========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0895F77B-D446-411A-A5FD-49018A3199D7}" = AMD Fuel

"{0A644ECD-8C41-E206-8262-E5EC90848EB5}" = AMD Accelerated Video Transcoding

"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219

"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)

"{2DE6247C-7077-451B-8BA7-FFD1A2ABBB47}" = Inst5675

"{314FAD12-F785-4471-BCE8-AB506642B9A1}" = HP SimplePass

"{5BB304EB-8E5B-0F2D-66FA-6603D9BB3232}" = AMD Catalyst Install Manager

"{6E14E6D6-3175-4E1A-B934-CAB5A86367CD}" = HP Postscript Converter

"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour

"{74FE39A0-FB76-47CD-84BA-91E2BBB17EF2}" = DisableMSDefender

"{7A75E042-0D30-43C2-BD2A-684F4BE38FF7}" = HP Utility Center

"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

"{878F6913-7421-4713-97F7-0A736EE2A188}" = Inst5676

"{90150000-008F-0000-1000-0000000FF1CE}" = Office 15 Click-to-Run Licensing Component

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{A09F5616-4BAD-64DA-C6F6-F96E0351218D}" = ccc-utility64

"{A2CB1ACB-94A2-32BA-A15E-7D80319F7589}" = Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727

"{AC53FC8B-EE18-3F9C-9B59-60937D0B182C}" = Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727

"{D1E8F2D7-7794-4245-B286-87ED86C1893C}" = HP Registration Service

"{E9FA781F-3E80-4399-825A-AD3E11C28C77}" = MSVCRT110_amd64

"CCleaner" = CCleaner

"HomeStudentRetail - en-us" = Microsoft Office Home and Student 2013 - en-us

"SynTPDeinstKey" = Synaptics Pointing Device Driver

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam

"{03D562B5-C4E2-4846-A920-33178788BE00}" = Windows Live Communications Platform

"{04371603-5A0B-ED04-1091-E6DCDFC3DF20}" = CCC Help Chinese Traditional

"{07F6DC37-0857-4B68-A675-4E35989E85E3}" = HP 3D DriveGuard

"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements

"{0D598E62-73FD-6B12-E1A8-7FA65699B5FC}" = CCC Help Japanese

"{0F929651-F516-4956-90F2-FFBD2CD5D30E}" = Photo Gallery

"{0FF9CC94-EF23-401E-BDBD-37403D1A2B38}" = Windows Live SOXE Definitions

"{118DD9F0-49FE-498E-A2EE-F33423C1394C}" = Catalyst Control Center - Branding

"{12BE7C93-741C-54D8-910A-8BB00BB4A09C}" = CCC Help Swedish

"{15134cb0-b767-4960-a911-f2d16ae54797}" = Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}" = CyberLink Media Suite 10

"{22154f09-719a-4619-bb71-5b3356999fbf}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727

"{277BD99E-D0B2-3598-BE46-7CD5170F3970}" = Catalyst Control Center Graphics Previews Common

"{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}" = CyberLink Power2Go 8

"{2AC01935-3774-4981-98C8-14E93C14372C}" = Windows Live UX Platform Language Pack

"{2B353DA2-A8FD-4238-B207-62A1921158D7}" = DriverUpdate

"{2F73A7B2-E50E-39A6-9ABC-EF89E4C62E36}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727

"{2F966EDD-BA18-0F75-456F-648FF1329CEE}" = Catalyst Control Center InstallProxy

"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App

"{30B2D1D8-0A07-4B71-9553-0710C5D31E35}" = HP Wireless Button Driver

"{39337565-330E-4ab6-A9AE-AC81E0720B10}" = Cyberlink PhotoDirector

"{394B14EA-B072-4440-9510-87797CB12371}" = HP CoolSense

"{399EA8F8-5231-510D-070E-A5602C6CA3CD}" = CCC Help Polish

"{41126AED-2C61-0E5B-F127-49B97E606B9D}" = CCC Help Turkish

"{417A142E-10AF-EE44-E54A-361F11B15D56}" = CCC Help Dutch

"{4525FF56-E096-42F4-BB64-52AAA8B3D893}" = HP Documentation

"{45898170-E68C-4F02-AA35-C2186BF347A3}" = Movie Maker

"{5A0EE0F0-E909-4F3B-B437-AAD9252427CB}" = Windows Live Installer

"{5B92F54D-1C27-04A8-7F0A-609BB651C7BA}" = CCC Help English

"{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}" = Realtek Card Reader

"{5E094C92-6288-4F43-AA9A-D452D0218F3F}" = Windows Live Essentials

"{5FD07E0A-ACC7-6565-7E38-4A8A4FC996B8}" = CCC Help Thai

"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM

"{61655124-8C4E-59D5-88D2-455EFE5BEF3B}" = AMD Catalyst Control Center

"{6AA65072-66B9-89E7-EB89-BB8FE5C78D0E}" = CCC Help Spanish

"{6B6923B9-8719-425B-916C-CD2908F31AAF}" = Windows Live SOXE

"{6E58A192-7CCD-83DF-E1D7-BF6A1372C7D8}" = CCC Help Chinese Standard

"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.2.2.3

"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp" = WildTangent Games App (HP Games)

"{70D5F822-F4C4-33D9-7EEC-2A4AF4EA7BDC}" = OEM Application Profile

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{74088822-660F-0CD4-0ECA-0BE6E6C2AF4C}" = CCC Help Portuguese

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver

"{89C7E0A7-4D9D-4DCC-8834-A9A2B92D7EBB}" = Photo Gallery

"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT

"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110

"{90150000-008C-0000-0000-0000000FF1CE}" = Office 15 Click-to-Run Extensibility Component

"{90150000-008C-0409-0000-0000000FF1CE}" = Office 15 Click-to-Run Localization Component

"{919C7688-8F7D-0DB7-B79D-5B3571CB8E2C}" = CCC Help Czech

"{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}" = Visual Studio 2012 x86 Redistributables

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9B56B031-A6C0-4BB7-8F61-938548C1B759}" = Pinger

"{A5107464-AA9B-4177-8129-5FF2F42DD322}" = REALTEK Wireless LAN Driver

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}" = CyberLink PowerDirector 10

"{B39A6825-EA20-43EA-AB2D-A6BC0298D9A1}" = Movie Maker

"{B46BEA36-0B71-4A4E-AE41-87241643FA0A}" = CyberLink PowerDVD 12

"{BC0BF363-63AB-4FF7-8EF1-AE0D7F711B24}" = LPT System Updater Service

"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint

"{C6B0EE9E-2128-4448-B7AE-5E2B46E0F0E7}" = Windows Live Photo Common

"{C78E8F51-3EAD-4F0C-83F0-EF371075E0B4}" = HP System Event Utility

"{C803F720-6EFF-F346-DCA6-14318EB9922C}" = Catalyst Control Center Localization All

"{CB479001-71F1-D133-DB45-97F40F99EAC1}" = CCC Help Danish

"{CC7BB4E8-0F61-48A9-DF4D-20E43DA3C3AB}" = CCC Help Norwegian

"{D1319840-A113-DCA8-F938-A3468A7FA862}" = CCC Help Korean

"{D3992AF4-D2EB-183A-41B6-9401855AEED9}" = CCC Help Russian

"{D95C92C8-4670-3122-71BF-C4F27B2228BF}" = CCC Help Greek

"{DD7C5FC1-DCA5-487A-AF23-658B1C00243F}" = Photo Common

"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10

"{E3445598-4424-4EE2-B71C-C23325F7FB71}" = Windows Live PIMT Platform

"{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}" = HP Support Assistant

"{E4CDF12A-3203-DCEE-6C02-4F311F89AF16}" = CCC Help Hungarian

"{E6E135B9-2211-683C-1E52-D5E0C244B36A}" = CCC Help German

"{E8C68176-FE8A-FE9A-4544-781F8CD611A8}" = CCC Help Italian

"{ED3EECB1-03EA-55A2-BB44-C7911868D2AC}" = CCC Help French

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F0E58739-2B4C-498F-9B0D-FF0F2FD52B61}" = Windows Live UX Platform

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F3295B87-FA7F-F1F1-5F07-EACB752B669F}" = CCC Help Finnish

"{FB385922-2E32-4462-A7DC-27159614A660}" = Snap.Do

"{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}" = Energy Star

"{FD49537C-C3A6-4F8D-93E6-68C778A1E192}" = HP Recovery Manager

"{FDB30193-FDA0-3DAA-ACCA-A75EEFE53607}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727

"Adobe Flash Player Plugin" = Adobe Flash Player 12 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 12.0

"Google Chrome" = Google Chrome

"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam

"InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}" = CyberLink Media Suite 10

"InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}" = CyberLink Power2Go 8

"InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}" = HP SimplePass

"InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}" = Cyberlink PhotoDirector

"InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}" = CyberLink PowerDirector 10

"InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}" = CyberLink PowerDVD 12

"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300

"Pinger 1.4.0.1" = Pinger

"StartHPConnectedMusic" = HP Connected Music (Meridian - installer)

"WildTangent wildgames Master Uninstall" = WildTangent Games

"WinLiveSuite" = Windows Live Essentials

"WRUNINST" = Webroot SecureAnywhere

"WTA-02731f74-eef9-49f0-9e49-b6e8c5890582" = Youda Jewel Shop

"WTA-12994157-f75f-4bf3-95a6-9f80e5625e3e" = Build-a-lot

"WTA-14380d67-6f50-4280-af08-a7d0dfd787a2" = Luxor Evolved

"WTA-1687b6a3-2f77-4bbc-bae2-98c6973c2fe5" = King Oddball

"WTA-17e4838e-c690-4af5-bd30-15bdda345941" = Tales of Lagoona

"WTA-1b591a9c-031b-453a-b336-f8d04cfa5a2f" = Governor of Poker 2 Premium Edition

"WTA-2f8b3fd3-454a-41b5-910f-065d632d411f" = Mahjongg Dimensions Deluxe

"WTA-393aa941-1358-4641-b8a2-f637da8d1fef" = Azkend 2: The World Beneath

"WTA-44fc4272-dc82-4594-af0a-ecc03e31347f" = Plants vs. Zombies - Game of the Year

"WTA-4a00ccad-206d-4289-a832-4d76c74eea03" = Delicious: Emily's Childhood Memories Premium Edition

"WTA-4b039ff6-b07a-406f-b2ef-42607c274be7" = Peggle Nights

"WTA-4dcb586b-23e4-4014-97c0-e773c6256a8f" = Vacation Quest™ - Australia

"WTA-57bb1524-df97-4fb3-a58d-b6c5c1cd1267" = Curse at Twilight

"WTA-66a32e31-a102-4a5b-ba0d-a82481da578b" = Bounce Symphony

"WTA-6fba1754-5c31-41d7-8357-3390b8c9ca4b" = House of 1000 Doors: Family Secrets

"WTA-76c1430a-b631-4ddc-a7c6-d880a7524bee" = Cradle of Rome 2

"WTA-8ab9fd4d-19d4-4c1b-a932-d212b740d9d6" = Cradle Of Egypt Collector's Edition

"WTA-8b00b443-3ed1-4f98-9e5c-fd4bd623925b" = Roads of Rome 3

"WTA-92da0979-76da-4598-aa58-16e4d93e7a56" = Jewel Match 3

"WTA-94747bd2-9db8-4783-bf53-7fc572f01c6c" = Penguins!

"WTA-99e7820b-1887-48d1-ac6a-4489d16e86a4" = Mystery P.I. - Curious Case of Counterfeit Cove

"WTA-9a76ab38-a5d8-43ab-a3af-5fefbeb4449e" = Airport Mania

"WTA-a19ed313-c752-48d1-97ba-d9759df135c9" = Farm Frenzy

"WTA-a3fcf0b0-3d44-4d2b-aed3-ee1f587cdf19" = 4 Elements II

"WTA-b0fe64d1-80e2-4928-8a86-914979a109c9" = John Deere Drive Green

"WTA-cd7cb784-7c07-4baa-acd3-ced4570fa9c0" = Bejeweled 3

"WTA-d2fe7e80-f59c-46ce-bbad-855ae94e288e" = Polar Bowler

"WTA-dbb5e02a-d88a-412f-b7e7-41604a495a9b" = Fishdom 3: Collector's Edition

"WTA-f71766fb-ae3d-4ff2-b67a-b7147e0c87bd" = Zuma's Revenge

 

========== HKEY_USERS Uninstall List ==========

 

[HKEY_USERS\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{02224593-ec78-49e5-a1ac-c3964a6e3f72}" = Snap.Do Engine

"Amazon Amazon Cloud Player" = Amazon Cloud Player

"Dropbox" = Dropbox

"HPConnectedMusic" = HP Connected Music (Meridian - player)

"OneDriveSetup.exe" = Microsoft OneDrive

 

========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 3/24/2014 5:05:40 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 3/24/2014 5:05:40 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 51439203

 

Error - 3/24/2014 5:05:40 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 51439203

 

Error - 3/25/2014 1:42:52 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 3/25/2014 1:42:53 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 32497297

 

Error - 3/25/2014 1:42:53 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 32497297

 

Error - 3/25/2014 10:07:44 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 3/25/2014 10:07:44 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 17983766

 

Error - 3/25/2014 10:07:44 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 17983766

 

Error - 3/26/2014 3:56:53 AM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 3/26/2014 3:56:53 AM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 15234

 

Error - 3/26/2014 3:56:53 AM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 15234

 

[ System Events ]

Error - 3/8/2014 4:26:51 AM | Computer Name = Kim | Source = Service Control Manager | ID = 7034

Description = The CyberLink PowerDVD 12 Media Server Service service terminated 

unexpectedly.  It has done this 1 time(s).

 

Error - 3/8/2014 2:01:28 PM | Computer Name = Kim | Source = Service Control Manager | ID = 7034

Description = The CyberLink PowerDVD 12 Media Server Service service terminated 

unexpectedly.  It has done this 2 time(s).

 

Error - 3/10/2014 1:59:45 AM | Computer Name = Kim | Source = Service Control Manager | ID = 7034

Description = The CyberLink PowerDVD 12 Media Server Service service terminated 

unexpectedly.  It has done this 3 time(s).

 

Error - 3/11/2014 4:29:30 AM | Computer Name = Kim | Source = DCOM | ID = 10010

Description = 

 

Error - 3/11/2014 4:29:30 AM | Computer Name = Kim | Source = DCOM | ID = 10010

Description = 

 

Error - 3/11/2014 4:29:30 AM | Computer Name = Kim | Source = DCOM | ID = 10010

Description = 

 

Error - 3/11/2014 4:29:30 AM | Computer Name = Kim | Source = DCOM | ID = 10010

Description = 

 

Error - 3/11/2014 4:29:35 AM | Computer Name = Kim | Source = Service Control Manager | ID = 7034

Description = The CyberLink PowerDVD 12 Media Server Service service terminated 

unexpectedly.  It has done this 4 time(s).

 

Error - 3/11/2014 3:11:09 PM | Computer Name = Kim | Source = Service Control Manager | ID = 7034

Description = The CyberLink PowerDVD 12 Media Server Service service terminated 

unexpectedly.  It has done this 5 time(s).

 

Error - 3/12/2014 2:45:14 AM | Computer Name = Kim | Source = Service Control Manager | ID = 7034

Description = The CyberLink PowerDVD 12 Media Server Service service terminated 

unexpectedly.  It has done this 6 time(s).

 

 

< End of report >

[sugarbee]

  WELL, SOMEHOW, SOME WAY, I MESSED UP WHEN COPYING THE OTL TEXT AFTER I DID THE "RUN FIX." SO, AFTER POSTING THE THREE FILES, THAT'S WHEN I NOTICED THE "OTL TEXT" MESSAGE I WROTE, SHOW'S THE ADWCLEAN INFO. THAT FILE IS PROBABLY GONE. HERE IS THE "RUN FIX" ...

 

All processes killed

========== COMMANDS ==========

========== OTL ==========

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ not found.

HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Bar| /E : value set successfully!

HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page| /E : value set successfully!

HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Search\\Default_Search_URL| /E : value set successfully!

HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ not found.

HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Bar| /E : value set successfully!

HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page| /E : value set successfully!

HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Search\\Default_Search_URL| /E : value set successfully!

HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!

HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ not found.

Registry key HKEY_USERS\S-1-5-21-2908134658-2290076565-1563918488-1002\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ not found.

Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected] not found.

File C:\Users\Kim\AppData\Roaming\BaseFlash\Firefox not found.

========== FILES ==========

File\Folder C:\Users\Kim\AppData\Roaming\BaseFlash not found.

========== COMMANDS ==========

File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.

Error: Unble to create default HOSTS file!

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Kim

->Temp folder emptied: 1110716 bytes

->Temporary Internet Files folder emptied: 247429 bytes

->Google Chrome cache emptied: 9020814 bytes

->Flash cache emptied: 0 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 120140 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 10.00 mb

 

 

OTL by OldTimer - Version 3.2.69.0 log created on 03262014_201217

 

Files\Folders moved on Reboot...

File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.

C:\Users\Kim\AppData\Local\Microsoft\Windows\INetCache\counters.dat moved successfully.

C:\Windows\temp\CLDigitalHome\CLMS_AGENT_LOG1.txt moved successfully.

C:\Windows\temp\KIMSHIP-20140326-1917.log moved successfully.

C:\Windows\temp\officeclicktorun.exe_c2ruidll(20140326191758780).log moved successfully.

C:\Windows\temp\officeclicktorun.exe_streamserver(20140326191758780).log moved successfully.

File move failed. C:\Windows\temp\ood_stream.x86.en-us.dat scheduled to be moved on reboot.

File move failed. C:\Windows\temp\ood_stream.x86.x-none.dat scheduled to be moved on reboot.

 

PendingFileRenameOperations files...

 

Registry entries deleted on Reboot...

 

 

 

[Phel]

Sorry, but how about OTL.txt log? It should be on your Desktop.

[sugarbee]

Okay. I did find this.

 

OTL logfile created on: 3/26/2014 8:04:22 PM - Run 3

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Kim\Desktop

64bit- An unknown product  (Version = 6.2.9200) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.16521)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

3.19 Gb Total Physical Memory | 1.68 Gb Available Physical Memory | 52.53% Memory free

5.44 Gb Paging File | 3.06 Gb Available in Paging File | 56.16% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 678.14 Gb Total Space | 634.39 Gb Free Space | 93.55% Space Free | Partition Type: NTFS

Drive D: | 19.73 Gb Total Space | 2.02 Gb Free Space | 10.25% Space Free | Partition Type: NTFS

 

Computer Name: KIMSHIP | User Name: Kim | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Processes (SafeList) ==========

 

PRC - [2014/03/26 18:28:15 | 000,763,512 | ---- | M] (Webroot) -- C:\Program Files\Webroot\WRSA.exe

PRC - [2014/03/19 17:57:31 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Kim\Desktop\OTL.exe

PRC - [2014/03/19 00:41:12 | 000,078,576 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE

PRC - [2014/03/19 00:40:51 | 000,449,216 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE

PRC - [2014/03/19 00:40:28 | 000,194,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE

PRC - [2014/03/14 20:50:42 | 000,859,976 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

PRC - [2014/03/07 16:39:48 | 003,168,576 | ---- | M] () -- C:\Users\Kim\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe

PRC - [2014/01/31 19:16:26 | 032,179,440 | ---- | M] (Dropbox, Inc.) -- C:\Users\Kim\AppData\Roaming\Dropbox\bin\Dropbox.exe

PRC - [2014/01/15 10:00:12 | 035,256,640 | ---- | M] (SlimWare Utilities, Inc.) -- C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe

PRC - [2013/10/08 14:41:36 | 001,045,304 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe

PRC - [2013/10/08 14:41:28 | 001,039,160 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe

PRC - [2013/09/10 20:18:46 | 001,344,312 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe

PRC - [2013/09/05 01:44:18 | 000,298,760 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe

PRC - [2013/09/05 01:44:16 | 000,077,576 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe

PRC - [2013/09/01 22:18:24 | 000,267,224 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe

PRC - [2013/08/05 03:49:42 | 000,111,576 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe

PRC - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2013/04/04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

 

 

========== Modules (No Company Name) ==========

 

MOD - [2014/03/26 19:19:15 | 000,041,984 | ---- | M] () -- c:\users\kim\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpopf6np.dll

MOD - [2014/03/14 20:50:40 | 000,394,568 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ppgooglenaclpluginchrome.dll

MOD - [2014/03/14 20:50:38 | 004,061,000 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\pdf.dll

MOD - [2014/03/14 20:50:35 | 000,716,616 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\libglesv2.dll

MOD - [2014/03/14 20:50:34 | 000,100,168 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\libegl.dll

MOD - [2014/03/14 20:50:32 | 001,647,432 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ffmpegsumo.dll

MOD - [2014/03/14 20:50:30 | 000,051,016 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\chrome_elf.dll

MOD - [2014/03/07 16:39:48 | 003,168,576 | ---- | M] () -- C:\Users\Kim\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe

MOD - [2014/02/20 21:20:10 | 000,316,584 | ---- | M] () -- C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll

MOD - [2014/02/20 21:15:10 | 000,316,584 | ---- | M] () -- C:\Program Files\Microsoft Office 15\root\office15\appvisvstream32.dll

MOD - [2014/01/02 23:42:50 | 003,610,624 | ---- | M] () -- C:\Users\Kim\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll

MOD - [2013/10/18 19:55:02 | 025,100,288 | ---- | M] () -- C:\Users\Kim\AppData\Roaming\Dropbox\bin\libcef.dll

MOD - [2013/08/05 19:48:08 | 000,016,856 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll

MOD - [2013/08/05 03:49:47 | 000,627,672 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll

 

 

========== Services (SafeList) ==========

 

SRV:64bit: - File not found [Disabled | Stopped] -- C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe /McCoreSvc -- (McOobeSv2)

SRV:64bit: - [2014/03/26 18:28:15 | 000,763,512 | ---- | M] (Webroot) [Auto | Running] -- C:\Program Files\Webroot\WRSA.exe -- (WRSVC)

SRV:64bit: - [2014/03/01 04:16:08 | 002,169,016 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe -- (ClickToRunSvc)

SRV:64bit: - [2014/02/06 06:48:45 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)

SRV:64bit: - [2013/11/27 11:36:30 | 003,395,920 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\WSService.dll -- (WSService)

SRV:64bit: - [2013/11/27 05:17:40 | 000,263,168 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\bisrv.dll -- (BrokerInfrastructure)

SRV:64bit: - [2013/11/23 00:50:00 | 000,282,112 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\SystemEventsBrokerServer.dll -- (SystemEventsBroker)

SRV:64bit: - [2013/11/07 23:41:17 | 001,302,528 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AppXDeploymentServer.dll -- (AppXSvc)

SRV:64bit: - [2013/10/30 20:29:53 | 000,348,392 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\NisSrv.exe -- (WdNisSvc)

SRV:64bit: - [2013/10/30 20:29:53 | 000,023,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)

SRV:64bit: - [2013/10/21 21:53:47 | 001,584,128 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\workfolderssvc.dll -- (workfolderssvc)

SRV:64bit: - [2013/10/18 13:48:01 | 001,555,456 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wlidsvc.dll -- (wlidsvc)

SRV:64bit: - [2013/10/18 13:48:01 | 000,491,520 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\GeofenceMonitorService.dll -- (lfsvc)

SRV:64bit: - [2013/10/18 13:48:01 | 000,365,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wcmsvc.dll -- (Wcmsvc)

SRV:64bit: - [2013/10/04 04:10:59 | 000,533,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AppReadiness.dll -- (AppReadiness)

SRV:64bit: - [2013/09/26 14:32:44 | 000,087,552 | ---- | M] (Softex Inc.) [Auto | Running] -- C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe -- (omniserv)

SRV:64bit: - [2013/09/26 14:26:54 | 000,109,568 | ---- | M] () [Auto | Running] -- C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe -- (Cachedrv server)

SRV:64bit: - [2013/09/25 22:06:56 | 000,239,616 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2013/09/25 10:48:00 | 000,344,064 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)

SRV:64bit: - [2013/08/26 02:13:24 | 000,076,800 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\inetsrv\w3logsvc.dll -- (w3logsvc)

SRV:64bit: - [2013/08/22 08:31:56 | 002,899,968 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)

SRV:64bit: - [2013/08/22 07:32:02 | 000,024,576 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wephostsvc.dll -- (WEPHOSTSVC)

SRV:64bit: - [2013/08/22 07:31:43 | 000,040,448 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\efssvc.dll -- (EFS)

SRV:64bit: - [2013/08/22 07:22:45 | 000,066,048 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wiarpc.dll -- (WiaRpc)

SRV:64bit: - [2013/08/22 07:21:15 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\svsvc.dll -- (svsvc)

SRV:64bit: - [2013/08/22 07:16:57 | 000,118,272 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\fhsvc.dll -- (fhsvc)

SRV:64bit: - [2013/08/22 06:25:28 | 000,164,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\NcaSvc.dll -- (NcaSvc)

SRV:64bit: - [2013/08/22 06:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicvss)

SRV:64bit: - [2013/08/22 06:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmictimesync)

SRV:64bit: - [2013/08/22 06:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicshutdown)

SRV:64bit: - [2013/08/22 06:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicrdv)

SRV:64bit: - [2013/08/22 06:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmickvpexchange)

SRV:64bit: - [2013/08/22 06:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicheartbeat)

SRV:64bit: - [2013/08/22 06:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicguestinterface)

SRV:64bit: - [2013/08/22 06:04:53 | 000,716,288 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsm.dll -- (LSM)

SRV:64bit: - [2013/08/22 06:02:47 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\smphost.dll -- (smphost)

SRV:64bit: - [2013/08/22 05:59:26 | 000,832,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\netlogon.dll -- (Netlogon)

SRV:64bit: - [2013/08/22 05:57:25 | 000,130,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\ScDeviceEnum.dll -- (ScDeviceEnum)

SRV:64bit: - [2013/08/22 05:54:59 | 000,059,392 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\keyiso.dll -- (KeyIso)

SRV:64bit: - [2013/08/22 05:50:59 | 000,245,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\TimeBrokerServer.dll -- (TimeBroker)

SRV:64bit: - [2013/08/22 05:50:00 | 000,525,312 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofmsvc.dll -- (netprofm)

SRV:64bit: - [2013/08/22 05:45:59 | 000,151,040 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\ncbservice.dll -- (NcbService)

SRV:64bit: - [2013/08/22 05:40:49 | 000,248,832 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\vaultsvc.dll -- (VaultSvc)

SRV:64bit: - [2013/08/22 05:40:14 | 000,398,848 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\das.dll -- (DeviceAssociationService)

SRV:64bit: - [2013/08/22 05:39:33 | 000,198,656 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\AudioEndpointBuilder.dll -- (AudioEndpointBuilder)

SRV:64bit: - [2013/08/22 05:31:03 | 000,201,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\DeviceSetupManager.dll -- (DsmSvc)

SRV:64bit: - [2013/08/22 05:15:54 | 000,073,728 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\NcdAutoSetup.dll -- (NcdAutoSetup)

SRV:64bit: - [2013/07/24 22:21:46 | 000,334,608 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- c:\Program Files\Common Files\mcafee\ActWiz\McAWFwk.exe -- (McAWFwk)

SRV:64bit: - [2013/07/23 15:28:56 | 000,043,320 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\hpservice.exe -- (hpsrv)

SRV:64bit: - [2013/06/18 23:18:38 | 000,246,488 | ---- | M] (Realtek Semiconductor) [Auto | Running] -- C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE -- (RtkAudioService)

SRV - [2014/03/14 21:53:40 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2013/11/04 19:31:56 | 000,092,160 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe -- (HP Support Assistant Service)

SRV - [2013/10/18 13:48:00 | 000,357,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GeofenceMonitorService.dll -- (lfsvc)

SRV - [2013/10/08 14:41:28 | 001,039,160 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe -- (HPWMISVC)

SRV - [2013/09/05 01:44:18 | 000,298,760 | ---- | M] (CyberLink) [Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe -- (CyberLink PowerDVD 12 Media Server Service)

SRV - [2013/09/05 01:44:16 | 000,077,576 | ---- | M] (CyberLink) [Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe -- (CyberLink PowerDVD 12 Media Server Monitor Service)

SRV - [2013/08/26 02:13:24 | 000,475,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS)

SRV - [2013/08/26 02:13:24 | 000,066,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\inetsrv\w3logsvc.dll -- (w3logsvc)

SRV - [2013/08/26 02:13:24 | 000,062,464 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc)

SRV - [2013/08/22 08:31:56 | 002,899,968 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)

SRV - [2013/08/21 23:55:35 | 000,018,944 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\StorSvc.dll -- (StorSvc)

SRV - [2013/08/21 22:53:34 | 000,011,776 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\smphost.dll -- (smphost)

SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)

SRV - [2010/10/12 13:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)

 

 

========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2014/03/26 19:18:29 | 000,016,152 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SWDUMon.sys -- (SWDUMon)

DRV:64bit: - [2014/03/26 18:28:15 | 000,113,664 | ---- | M] (Webroot) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\WRkrn.sys -- (WRkrn)

DRV:64bit: - [2014/01/07 21:46:27 | 000,325,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\USBXHCI.SYS -- (USBXHCI)

DRV:64bit: - [2013/12/17 17:04:08 | 000,046,232 | ---- | M] (NetFilterSDK.com) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\netfilter64.sys -- (netfilter64)

DRV:64bit: - [2013/11/10 22:48:41 | 000,039,768 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\intelpep.sys -- (intelpep)

DRV:64bit: - [2013/11/01 07:39:53 | 000,086,872 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\pdc.sys -- (pdc)

DRV:64bit: - [2013/10/30 20:58:59 | 000,372,568 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\spaceport.sys -- (spaceport)

DRV:64bit: - [2013/10/30 20:29:36 | 000,236,888 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WdFilter.sys -- (WdFilter)

DRV:64bit: - [2013/10/30 20:29:36 | 000,124,760 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WdNisDrv.sys -- (WdNisDrv)

DRV:64bit: - [2013/10/30 20:28:47 | 000,035,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WdBoot.sys -- (WdBoot)

DRV:64bit: - [2013/10/25 21:54:32 | 000,146,776 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SerCx2.sys -- (SerCx2)

DRV:64bit: - [2013/10/18 13:48:00 | 000,467,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\USBHUB3.SYS -- (USBHUB3)

DRV:64bit: - [2013/10/18 13:48:00 | 000,236,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)

DRV:64bit: - [2013/10/18 13:48:00 | 000,175,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VerifierExt.sys -- (VerifierExt)

DRV:64bit: - [2013/10/12 22:48:34 | 000,136,536 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\wfplwfs.sys -- (WFPLWFS)

DRV:64bit: - [2013/10/05 11:25:54 | 000,057,176 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\stornvme.sys -- (stornvme)

DRV:64bit: - [2013/09/25 23:10:44 | 012,533,760 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)

DRV:64bit: - [2013/09/25 21:41:10 | 000,619,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2013/09/12 06:17:00 | 002,945,240 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtwlane.sys -- (RTWlanE)

DRV:64bit: - [2013/08/22 15:12:11 | 000,027,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2013/08/22 15:12:07 | 000,037,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\terminpt.sys -- (terminpt)

DRV:64bit: - [2013/08/22 09:25:40 | 000,043,008 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\condrv.sys -- (condrv)

DRV:64bit: - [2013/08/22 09:25:40 | 000,030,048 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2013/08/22 08:50:19 | 000,057,696 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\dam.sys -- (dam)

DRV:64bit: - [2013/08/22 08:49:54 | 000,079,712 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\acpiex.sys -- (acpiex)

DRV:64bit: - [2013/08/22 08:49:33 | 000,159,584 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)

DRV:64bit: - [2013/08/22 08:43:49 | 000,063,840 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\mvumis.sys -- (mvumis)

DRV:64bit: - [2013/08/22 08:43:48 | 000,146,272 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msgpioclx.sys -- (GPIOClx0101)

DRV:64bit: - [2013/08/22 08:43:48 | 000,041,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msgpiowin32.sys -- (msgpiowin32)

DRV:64bit: - [2013/08/22 08:43:45 | 003,357,024 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2013/08/22 08:43:45 | 000,093,536 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2013/08/22 08:43:45 | 000,082,784 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sss.sys -- (LSI_SSS)

DRV:64bit: - [2013/08/22 08:43:45 | 000,064,352 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2013/08/22 08:43:44 | 000,081,760 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas3.sys -- (LSI_SAS3)

DRV:64bit: - [2013/08/22 08:43:41 | 000,782,176 | ---- | M] (PMC-Sierra) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\adp80xx.sys -- (ADP80XX)

DRV:64bit: - [2013/08/22 08:43:41 | 000,531,296 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2013/08/22 08:43:41 | 000,259,424 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2013/08/22 08:43:41 | 000,108,896 | ---- | M] (LSI) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\3ware.sys -- (3ware)

DRV:64bit: - [2013/08/22 08:43:41 | 000,079,200 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2013/08/22 08:43:40 | 000,114,016 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\EhStorTcgDrv.sys -- (EhStorTcgDrv)

DRV:64bit: - [2013/08/22 08:43:40 | 000,082,784 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\EhStorClass.sys -- (EhStorClass)

DRV:64bit: - [2013/08/22 08:43:40 | 000,025,952 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2013/08/22 08:43:34 | 000,305,504 | ---- | M] (VIA Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\VSTXRAID.SYS -- (VSTXRAID)

DRV:64bit: - [2013/08/22 08:43:33 | 000,189,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UCX01000.SYS -- (UCX01000)

DRV:64bit: - [2013/08/22 08:43:33 | 000,074,080 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\uaspstor.sys -- (UASPStor)

DRV:64bit: - [2013/08/22 08:43:32 | 000,078,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdstor.sys -- (sdstor)

DRV:64bit: - [2013/08/22 08:43:32 | 000,031,072 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2013/08/22 08:43:31 | 000,107,872 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\storahci.sys -- (storahci)

DRV:64bit: - [2013/08/22 08:43:31 | 000,072,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SpbCx.sys -- (SpbCx)

DRV:64bit: - [2013/08/22 08:43:31 | 000,069,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SerCx.sys -- (SerCx)

DRV:64bit: - [2013/08/22 08:41:08 | 000,054,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wpcfltr.sys -- (wpcfltr)

DRV:64bit: - [2013/08/22 08:39:44 | 000,377,696 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\clfs.sys -- (CLFS)

DRV:64bit: - [2013/08/22 08:39:15 | 000,924,512 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\refs.sys -- (ReFS)

DRV:64bit: - [2013/08/22 08:39:15 | 000,026,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\uefi.sys -- (UEFI)

DRV:64bit: - [2013/08/22 08:37:27 | 000,069,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpci.sys -- (vpci)

DRV:64bit: - [2013/08/22 08:36:12 | 000,026,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WpdUpFltr.sys -- (WpdUpFltr)

DRV:64bit: - [2013/08/22 07:39:54 | 000,076,800 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ahcache.sys -- (ahcache)

DRV:64bit: - [2013/08/22 07:39:31 | 000,050,688 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BasicDisplay.sys -- (BasicDisplay)

DRV:64bit: - [2013/08/22 07:39:28 | 000,033,792 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BasicRender.sys -- (BasicRender)

DRV:64bit: - [2013/08/22 07:39:20 | 000,022,016 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HyperVideo.sys -- (HyperVideo)

DRV:64bit: - [2013/08/22 07:39:06 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mshidumdf.sys -- (mshidumdf)

DRV:64bit: - [2013/08/22 07:38:58 | 000,010,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acpitime.sys -- (acpitime)

DRV:64bit: - [2013/08/22 07:38:48 | 000,010,240 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acpipagr.sys -- (acpipagr)

DRV:64bit: - [2013/08/22 07:38:39 | 000,036,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BthAvrcpTg.sys -- (BthAvrcpTg)

DRV:64bit: - [2013/08/22 07:38:26 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kdnic.sys -- (kdnic)

DRV:64bit: - [2013/08/22 07:38:23 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmgencounter.sys -- (gencounter)

DRV:64bit: - [2013/08/22 07:38:22 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\npsvctrig.sys -- (npsvctrig)

DRV:64bit: - [2013/08/22 07:38:16 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BthhfHid.sys -- (bthhfhid)

DRV:64bit: - [2013/08/22 07:37:49 | 000,013,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hyperkbd.sys -- (hyperkbd)

DRV:64bit: - [2013/08/22 07:37:46 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

DRV:64bit: - [2013/08/22 07:37:42 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bthhfenum.sys -- (BthHFEnum)

DRV:64bit: - [2013/08/22 07:37:28 | 000,056,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2013/08/22 07:37:28 | 000,041,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hidi2c.sys -- (hidi2c)

DRV:64bit: - [2013/08/22 07:37:14 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)

DRV:64bit: - [2013/08/22 07:36:43 | 000,087,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netvsc63.sys -- (netvsc)

DRV:64bit: - [2013/08/22 07:36:25 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NdisVirtualBus.sys -- (NdisVirtualBus)

DRV:64bit: - [2013/08/22 07:36:17 | 000,124,928 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NdisImPlatform.sys -- (NdisImPlatform)

DRV:64bit: - [2013/08/22 07:36:07 | 000,066,560 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mslldp.sys -- (MsLldp)

DRV:64bit: - [2013/08/22 07:35:42 | 000,103,424 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\Ndu.sys -- (Ndu)

DRV:64bit: - [2013/08/22 04:46:33 | 000,027,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fxppm.sys -- (FxPPM)

DRV:64bit: - [2013/08/15 18:28:42 | 000,830,680 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt630x64.sys -- (RTL8168)

DRV:64bit: - [2013/08/12 19:25:46 | 000,017,624 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bcmfn2.sys -- (bcmfn2)

DRV:64bit: - [2013/08/09 20:39:30 | 000,651,248 | ---- | M] (Intel Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\iaStorAV.sys -- (iaStorAV)

DRV:64bit: - [2013/07/30 14:47:35 | 000,024,568 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iaLPSSi_GPIO.sys -- (iaLPSSi_GPIO)

DRV:64bit: - [2013/07/26 17:10:50 | 000,524,016 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

DRV:64bit: - [2013/07/26 17:10:50 | 000,034,544 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Smb_driver_Intel.sys -- (SmbDrvI)

DRV:64bit: - [2013/07/26 17:10:50 | 000,030,448 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Smb_driver_AMDASF.sys -- (SmbDrv)

DRV:64bit: - [2013/07/25 15:05:39 | 000,099,320 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iaLPSSi_I2C.sys -- (iaLPSSi_I2C)

DRV:64bit: - [2013/07/23 15:28:56 | 000,043,320 | ---- | M] (Hewlett-Packard) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelerometer.sys -- (Accelerometer)

DRV:64bit: - [2013/07/23 15:28:56 | 000,030,520 | ---- | M] (Hewlett-Packard) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpdskflt.sys -- (hpdskflt)

DRV:64bit: - [2013/07/22 20:45:58 | 000,020,800 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WirelessButtonDriver64.sys -- (WirelessButtonDriver)

DRV:64bit: - [2013/07/05 15:01:36 | 000,290,008 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsP2Stor.sys -- (RSP2STOR)

DRV:64bit: - [2013/06/23 04:49:50 | 000,138,240 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdWB6.sys -- (AtiHDAudioService)

DRV:64bit: - [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2013/03/08 20:47:50 | 000,058,536 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)

DRV:64bit: - [2013/03/05 16:01:42 | 000,091,712 | ---- | M] (CyberLink) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\CLVirtualDrive.sys -- (CLVirtualDrive)

DRV:64bit: - [2013/03/05 02:22:20 | 000,041,408 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\clwvd.sys -- (clwvd)

DRV:64bit: - [2012/11/20 17:55:42 | 000,057,512 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.2)

DRV - [2013/09/12 06:17:00 | 002,945,240 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\rtwlane.sys -- (RTWlanE)

 

 

========== Standard Registry (SafeList) ==========

 

 

========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT14/1

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...0TR&pc=HPNTDFJS

IE:64bit: - HKLM\..\SearchScopes\{3070F4D1-6940-4415-8D6D-1A3EB548A74D}: "URL" = http://www.amazon.co...s={searchTerms}

IE:64bit: - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.co...54371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT14/1

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com

IE - HKCU\..\SearchScopes,DefaultScope = 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

========== FireFox ==========

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3508.0205: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\ProgramData\WRData\PKG\FIREFOX\WebrootSecure_SocketServer [2014/03/07 20:03:19 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

 

========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},

CHR - homepage: http://google.com/

CHR - plugin: Error reading preferences file

CHR - Extension: Google Drive = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\

CHR - Extension: YouTube = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\

CHR - Extension: Google Search = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\

CHR - Extension: AdBlock = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.23_0\

CHR - Extension: Google Wallet = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\

CHR - Extension: Gmail = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

 

O1 HOSTS File: ([2013/08/22 09:25:41 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

O2:64bit: - BHO: (Webroot Vault) - {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} - C:\ProgramData\WRData\PKG\LPBar64.dll (Webroot)

O2:64bit: - BHO: (Webroot Filtering Extension) - {C9C42510-9B41-42c1-9DCD-7282A2D07C61} - C:\Program Files\Webroot\WRData\PKG\Vistax64\wrflt.dll (Webroot)

O2:64bit: - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

O2:64bit: - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (Webroot Vault) - {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} - C:\ProgramData\WRData\PKG\LPBar.dll (Webroot)

O2 - BHO: (Webroot Filtering Extension) - {C9C42510-9B41-42c1-9DCD-7282A2D07C61} - C:\Program Files\Webroot\WRData\PKG\Vistax86\wrflt.dll (Webroot)

O2 - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

O3:64bit: - HKLM\..\Toolbar: (Webroot Toolbar) - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\PKG\LPBar64.dll (Webroot)

O3 - HKLM\..\Toolbar: (Webroot Toolbar) - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\PKG\LPBar.dll (Webroot)

O4:64bit: - HKLM..\Run: [OPBHOBroker] C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe (Hewlett-Packard)

O4:64bit: - HKLM..\Run: [OPBHOBrokerDesktop] C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe (Hewlett-Packard)

O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [SimplePass] C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe (Hewlett-Packard)

O4 - HKLM..\Run: [AccelerometerSysTrayApplet] C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe (Hewlett-Packard Company)

O4 - HKLM..\Run: [HPMessageService] C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [WRSVC] C:\Program Files\Webroot\WRSA.exe (Webroot)

O4 - HKLM..\Run: [YouCam Service] C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe (CyberLink Corp.)

O4 - HKCU..\Run: [Amazon Cloud Player] C:\Users\Kim\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe ()

O4 - HKCU..\Run: [SkyDrive] C:\Users\Kim\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)

O4:64bit: - HKLM..\RunOnce: [NCPluginUpdater] C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe (Hewlett-Packard)

O4 - Startup: C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Kim\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O4 - Startup: C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk = C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRun = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRunOnce = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRun = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRunOnce = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoShellSearchButton = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFile = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayContextMenu = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetFolders = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDevMgrUpdate = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDeletePrinter = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDFSTab = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoEncryptOnMove = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRunasInstallPrompt = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoHardwareTab = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuSubFolders = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispAppearancePage = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRun = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRunOnce = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRun = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRunOnce = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoShellSearchButton = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFile = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayContextMenu = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetFolders = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDevMgrUpdate = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDeletePrinter = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDFSTab = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoEncryptOnMove = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRunasInstallPrompt = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoHardwareTab = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuSubFolders = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispAppearancePage = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0

O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE (Microsoft Corporation)

O8:64bit: - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll (Microsoft Corporation)

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)

O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)

O9:64bit: - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra Button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

O9:64bit: - Extra Button: Webroot - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\ProgramData\WRData\PKG\LPBar64.dll (Webroot)

O9:64bit: - Extra 'Tools' menuitem : Webroot - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\ProgramData\WRData\PKG\LPBar64.dll (Webroot)

O9:64bit: - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)

O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)

O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Webroot - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\ProgramData\WRData\PKG\LPBar.dll (Webroot)

O9 - Extra 'Tools' menuitem : Webroot - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\ProgramData\WRData\PKG\LPBar.dll (Webroot)

O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{079C28FA-3376-4CE7-A4EE-9D62AEC39AC8}: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6BFB7138-8444-49C2-9617-FC4304DB3A76}: DhcpNameServer = 40.22.1.201 40.22.1.203

O18:64bit: - Protocol\Handler\osf - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O35 - HKCU\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKCU\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

[CREATERESTOREPOINT]

Restore point Set: OTL Restore Point

 

========== Files/Folders - Created Within 30 Days ==========

 

[2014/03/26 18:36:57 | 000,000,000 | ---D | C] -- C:\AdwCleaner

[2014/03/26 18:17:38 | 000,000,000 | ---D | C] -- C:\_OTL

[2014/03/19 17:57:30 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Kim\Desktop\OTL.exe

[2014/03/19 15:14:52 | 000,000,000 | ---D | C] -- C:\FRST

[2014/03/19 00:56:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2014/03/19 00:56:07 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2014/03/18 22:02:04 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Malwarebytes

[2014/03/18 22:01:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2014/03/18 22:01:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2014/03/18 22:01:57 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2014/03/18 22:01:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2014/03/18 14:09:23 | 018,576,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Windows.UI.Xaml.dll

[2014/03/18 14:09:20 | 013,949,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Windows.UI.Xaml.dll

[2014/03/18 14:09:11 | 000,960,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MFMediaEngine.dll

[2014/03/18 14:09:11 | 000,628,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SettingSyncHost.exe

[2014/03/18 14:09:11 | 000,481,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfsvr.dll

[2014/03/18 14:09:10 | 000,802,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MFMediaEngine.dll

[2014/03/18 14:09:10 | 000,749,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SettingSyncCore.dll

[2014/03/18 14:09:10 | 000,478,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SettingSyncHost.exe

[2014/03/18 14:09:10 | 000,381,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfsvr.dll

[2014/03/18 14:09:09 | 000,914,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ReAgent.dll

[2014/03/18 14:09:09 | 000,842,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.dll

[2014/03/18 14:09:09 | 000,770,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ReAgent.dll

[2014/03/18 14:09:09 | 000,588,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SettingSyncCore.dll

[2014/03/18 14:09:09 | 000,461,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll

[2014/03/18 14:09:09 | 000,419,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\hal.dll

[2014/03/18 14:09:09 | 000,382,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\dxgmms1.sys

[2014/03/18 14:09:08 | 000,947,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\reseteng.dll

[2014/03/18 14:09:08 | 000,630,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MsSpellCheckingFacility.dll

[2014/03/18 14:09:08 | 000,336,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll

[2014/03/18 14:09:08 | 000,206,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WSClient.dll

[2014/03/18 14:09:08 | 000,174,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WSClient.dll

[2014/03/18 14:09:07 | 001,720,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll

[2014/03/18 14:09:07 | 000,303,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sti.dll

[2014/03/18 14:09:07 | 000,131,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\easinvoker.exe

[2014/03/18 14:09:06 | 000,325,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\USBXHCI.SYS

[2014/03/18 14:09:06 | 000,178,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\easwrt.dll

[2014/03/18 14:09:06 | 000,140,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\easwrt.dll

[2014/03/18 11:23:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

[2014/03/18 11:02:33 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\SlimWare Utilities Inc

[2014/03/18 11:02:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverUpdate

[2014/03/18 11:02:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DriverUpdate

[2014/03/18 11:02:27 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Downloaded Installers

[2014/03/16 20:32:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft OneDrive

[2014/03/16 20:31:42 | 000,693,240 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe

[2014/03/16 20:31:42 | 000,105,464 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2014/03/13 20:05:44 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Cloud Player

[2014/03/13 20:05:37 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Amazon Cloud Player

[2014/03/13 13:10:20 | 000,000,000 | R--D | C] -- C:\Users\Kim\Documents\Notes

[2014/03/13 13:08:01 | 000,000,000 | ---D | C] -- C:\Users\Kim\Documents\OneNote Notebooks

[2014/03/12 16:37:19 | 000,000,000 | ---D | C] -- C:\Users\Kim\Documents\Custom Office Templates

[2014/03/11 21:32:40 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe

[2014/03/11 21:32:39 | 005,768,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll

[2014/03/11 21:32:38 | 000,817,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll

[2014/03/11 21:32:38 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll

[2014/03/11 21:32:38 | 000,627,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2014/03/11 21:18:48 | 001,643,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.efi

[2014/03/11 21:18:48 | 001,507,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.exe

[2014/03/11 21:13:50 | 002,133,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfcore.dll

[2014/03/11 21:13:50 | 001,928,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\combase.dll

[2014/03/11 21:13:49 | 006,640,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll

[2014/03/11 21:13:49 | 002,143,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfcore.dll

[2014/03/11 21:13:49 | 001,371,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\combase.dll

[2014/03/11 21:13:49 | 001,287,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll

[2014/03/11 21:13:49 | 000,764,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfmpeg2srcsnk.dll

[2014/03/11 21:13:49 | 000,669,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfmpeg2srcsnk.dll

[2014/03/11 21:13:48 | 005,770,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstscax.dll

[2014/03/11 21:13:48 | 004,175,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dbgeng.dll

[2014/03/11 21:13:48 | 002,873,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dbgeng.dll

[2014/03/11 21:13:48 | 001,486,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dbghelp.dll

[2014/03/11 21:13:48 | 000,407,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Faultrep.dll

[2014/03/11 21:13:47 | 001,238,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dbghelp.dll

[2014/03/11 21:13:47 | 001,057,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdvidcrl.dll

[2014/03/11 21:13:47 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdvidcrl.dll

[2014/03/11 21:13:47 | 000,458,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WerFault.exe

[2014/03/11 21:13:47 | 000,447,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sppcomapi.dll

[2014/03/11 21:13:47 | 000,408,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WerFault.exe

[2014/03/11 21:13:47 | 000,369,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Faultrep.dll

[2014/03/11 21:13:47 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpencom.dll

[2014/03/11 21:13:47 | 000,233,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfps.dll

[2014/03/11 21:13:47 | 000,208,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpencom.dll

[2014/03/11 21:13:47 | 000,160,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWWIN.EXE

[2014/03/11 21:13:47 | 000,138,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\DWWIN.EXE

[2014/03/11 21:13:47 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsgqec.dll

[2014/03/11 21:13:47 | 000,053,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tsgqec.dll

[2014/03/11 21:13:40 | 000,236,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\WdFilter.sys

[2014/03/11 21:13:39 | 000,124,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\WdNisDrv.sys

[2014/03/11 21:13:39 | 000,035,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\WdBoot.sys

[2014/03/11 21:13:13 | 000,586,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qedit.dll

[2014/03/11 21:13:13 | 000,488,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qedit.dll

[2014/03/10 18:59:32 | 000,000,000 | ---D | C] -- C:\ProgramData\.mono

[2014/03/10 18:59:31 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\.mono

[2014/03/10 18:59:27 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Unity

[2014/03/01 21:58:17 | 000,000,000 | ---D | C] -- C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F}

[2014/02/26 21:18:29 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Unity

[2014/02/26 13:58:55 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Adobe

[2014/02/25 20:33:12 | 000,000,000 | ---D | C] -- C:\Users\Kim\Documents\Avatar

[2014/02/25 20:25:16 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\CyberLink

[2014/02/25 14:32:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google

[2014/02/25 14:32:24 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Google

[2014/02/25 13:38:53 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\MRT

[2014/02/25 12:59:53 | 002,328,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe

[2014/02/25 12:59:51 | 002,065,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\explorer.exe

[2014/02/25 12:59:50 | 001,584,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\workfolderssvc.dll

[2014/02/25 12:59:50 | 001,067,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfasfsrcsnk.dll

[2014/02/25 12:59:48 | 000,883,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfasfsrcsnk.dll

[2014/02/25 12:59:45 | 002,134,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d9.dll

[2014/02/25 12:59:41 | 001,160,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Windows.Web.Http.dll

[2014/02/25 12:59:39 | 001,011,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TSWorkspace.dll

[2014/02/25 12:59:39 | 000,708,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iuilp.dll

[2014/02/25 12:59:35 | 000,656,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dnsapi.dll

[2014/02/25 12:59:34 | 000,920,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAutomationCore.dll

[2014/02/25 12:59:33 | 001,231,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Windows.Media.dll

[2014/02/25 12:59:33 | 000,533,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\AppReadiness.dll

[2014/02/25 12:59:31 | 001,147,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\UIAutomationCore.dll

[2014/02/25 12:59:27 | 000,699,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll

[2014/02/25 12:59:25 | 000,631,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WWAHost.exe

[2014/02/25 12:59:24 | 000,761,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WorkfoldersControl.dll

[2014/02/25 12:59:22 | 000,578,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Windows.Networking.BackgroundTransfer.dll

[2014/02/25 12:59:21 | 000,331,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\eapphost.dll

[2014/02/25 12:59:20 | 000,518,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WWAHost.exe

[2014/02/25 12:59:18 | 000,411,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Windows.Networking.BackgroundTransfer.dll

[2014/02/25 12:59:18 | 000,171,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kd_02_8086.dll

[2014/02/25 12:59:17 | 000,888,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Windows.Media.dll

[2014/02/25 12:59:17 | 000,465,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\AudioSes.dll

[2014/02/25 12:59:16 | 000,391,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsmf.dll

[2014/02/25 12:59:15 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\comdlg32.dll

[2014/02/25 12:59:14 | 000,795,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\TSWorkspace.dll

[2014/02/25 12:59:14 | 000,558,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\apphelp.dll

[2014/02/25 12:59:14 | 000,325,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\eapp3hst.dll

[2014/02/25 12:59:13 | 000,345,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tsmf.dll

[2014/02/25 12:59:13 | 000,317,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll

[2014/02/25 12:59:11 | 000,286,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\pcsvDevice.dll

[2014/02/25 12:59:11 | 000,104,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncryptsslp.dll

[2014/02/25 12:59:11 | 000,088,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ncryptsslp.dll

[2014/02/25 12:59:10 | 000,132,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msched.dll

[2014/02/25 12:59:09 | 000,762,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Windows.Web.Http.dll

[2014/02/25 12:59:09 | 000,262,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\eapphost.dll

[2014/02/25 12:59:08 | 000,830,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\samsrv.dll

[2014/02/25 12:59:05 | 000,044,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wldp.dll

[2014/02/25 12:59:04 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TSWbPrxy.exe

[2014/02/25 12:59:04 | 000,057,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\stornvme.sys

[2014/02/25 12:59:03 | 000,092,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dafBth.dll

[2014/02/25 12:59:02 | 000,184,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dafWfdProvider.dll

[2014/02/25 12:59:01 | 000,113,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\shsetup.dll

[2014/02/25 12:59:01 | 000,054,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe

[2014/02/25 12:59:00 | 000,381,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUSettingsProvider.dll

[2014/02/25 12:58:59 | 000,335,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\eappcfg.dll

[2014/02/25 12:58:59 | 000,094,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\shsetup.dll

[2014/02/25 12:58:58 | 000,103,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WiFiDisplay.dll

[2014/02/25 12:58:57 | 000,272,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\eappcfg.dll

[2014/02/25 12:58:57 | 000,245,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\eapp3hst.dll

[2014/02/25 12:58:57 | 000,093,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\eappgnui.dll

[2014/02/25 12:58:56 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\eappgnui.dll

[2014/02/25 12:58:54 | 000,186,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WorkFoldersShell.dll

[2014/02/25 12:58:54 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ftp.exe

[2014/02/25 12:58:53 | 001,704,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll

[2014/02/25 12:58:50 | 000,338,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpclip.exe

[2014/02/25 12:58:50 | 000,053,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ftp.exe

[2014/02/25 12:58:49 | 000,226,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\miutils.dll

[2014/02/25 12:58:48 | 000,180,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\miutils.dll

[2014/02/25 12:22:08 | 003,210,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll

[2014/02/25 12:22:05 | 002,804,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll

[2014/02/25 12:21:42 | 001,399,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winmde.dll

[2014/02/25 12:21:41 | 002,617,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\authui.dll

[2014/02/25 12:21:39 | 001,374,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmpmde.dll

[2014/02/25 12:21:39 | 000,282,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SystemEventsBrokerServer.dll

[2014/02/25 12:21:37 | 000,202,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ubpm.dll

[2014/02/25 12:21:35 | 002,295,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\authui.dll

[2014/02/25 12:21:33 | 001,204,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\winmde.dll

[2014/02/25 12:21:33 | 000,263,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\bisrv.dll

[2014/02/25 12:21:30 | 000,809,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfmp4srcsnk.dll

[2014/02/25 12:21:30 | 000,032,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ploptin.dll

[2014/02/25 12:21:29 | 000,745,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll

[2014/02/25 12:21:29 | 000,470,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfds.dll

[2014/02/25 12:21:28 | 000,663,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfmp4srcsnk.dll

[2014/02/25 12:21:27 | 001,415,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll

[2014/02/25 12:21:27 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psmsrv.dll

[2014/02/25 12:21:26 | 000,273,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Windows.Graphics.dll

[2014/02/25 12:21:25 | 000,433,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfds.dll

[2014/02/25 12:21:23 | 000,589,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rastls.dll

[2014/02/25 12:21:23 | 000,218,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Windows.Graphics.dll

[2014/02/25 12:21:20 | 000,306,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msieftp.dll

[2014/02/25 12:21:19 | 001,227,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mispace.dll

[2014/02/25 12:21:18 | 000,980,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mispace.dll

[2014/02/25 12:21:18 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\bi.dll

[2014/02/25 12:21:17 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\BtaMPM.sys

[2014/02/25 12:21:16 | 000,513,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rastls.dll

[2014/02/25 12:21:16 | 000,273,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msieftp.dll

[2014/02/25 12:21:14 | 000,207,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\deviceregistration.dll

[2014/02/25 12:16:39 | 001,302,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\AppXDeploymentServer.dll

[2014/02/25 12:16:38 | 007,399,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2014/02/25 12:16:37 | 002,143,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dwmcore.dll

[2014/02/25 12:16:34 | 002,570,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SettingsHandlers.dll

[2014/02/25 12:16:34 | 001,765,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dwmcore.dll

[2014/02/25 12:16:32 | 000,358,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dcomp.dll

[2014/02/25 12:16:30 | 002,896,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msftedit.dll

[2014/02/25 12:16:29 | 000,747,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wlidcli.dll

[2014/02/25 12:16:27 | 001,756,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMPDMC.exe

[2014/02/25 12:16:26 | 000,139,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\AppxAllUserStore.dll

[2014/02/25 12:16:25 | 000,225,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dcomp.dll

[2014/02/25 12:16:25 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\AppxAllUserStore.dll

[2014/02/25 12:16:24 | 001,345,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.exe

[2014/02/25 12:16:21 | 001,476,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.efi

[2014/02/25 12:16:20 | 002,266,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msftedit.dll

[2014/02/25 12:16:19 | 000,372,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\spaceport.sys

[2014/02/25 12:16:19 | 000,254,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\AppXDeploymentClient.dll

[2014/02/25 12:16:18 | 000,566,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wpncore.dll

[2014/02/25 12:16:18 | 000,198,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\AppXDeploymentClient.dll

[2014/02/25 12:16:17 | 001,391,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPDMC.exe

[2014/02/25 12:16:16 | 000,146,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\SerCx2.sys

[2014/02/25 12:16:16 | 000,039,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\intelpep.sys

[2014/02/25 12:16:15 | 000,922,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\AppXDeploymentExtensions.dll

[2014/02/25 12:16:14 | 000,086,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\pdc.sys

[2014/02/25 12:16:13 | 002,140,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll

[2014/02/25 12:16:12 | 001,765,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll

[2014/02/25 12:16:11 | 001,843,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Display.dll

[2014/02/25 12:16:11 | 000,516,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll

[2014/02/25 12:16:11 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\CredentialMigrationHandler.dll

[2014/02/25 12:16:10 | 001,816,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Display.dll

[2014/02/25 12:16:10 | 000,027,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\CredentialMigrationHandler.dll

[2014/02/25 12:16:09 | 000,544,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wlidcli.dll

[2014/02/25 12:13:56 | 001,085,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\twinui.appcore.dll

[2014/02/25 12:13:56 | 000,869,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\twinui.appcore.dll

[2014/02/25 12:03:10 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll

[2014/02/25 12:03:08 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll

[2014/02/25 12:03:06 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll

[2014/02/25 12:03:06 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll

[2014/02/25 12:02:59 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll

[2014/02/25 12:02:59 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll

[2014/02/25 12:02:58 | 001,964,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl

[2014/02/25 12:02:57 | 000,553,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll

[2014/02/25 12:02:55 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe

[2014/02/25 12:02:50 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll

[2014/02/25 12:02:48 | 002,041,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl

[2014/02/25 12:02:47 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe

[2014/02/25 12:02:45 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll

[2014/02/25 12:02:40 | 000,708,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll

[2014/02/25 12:02:40 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe

[2014/02/25 12:02:37 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll

[2014/02/25 11:56:50 | 000,075,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll

[2014/02/25 11:56:49 | 000,872,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfplat.dll

[2014/02/25 11:56:48 | 000,698,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfplat.dll

[2014/02/25 11:56:46 | 001,341,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gdi32.dll

[2014/02/25 11:56:41 | 000,570,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msdrm.dll

[2014/02/25 11:56:33 | 000,136,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\wfplwfs.sys

[2014/02/25 11:56:29 | 000,393,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll

[2014/02/25 11:56:28 | 000,348,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll

[2014/02/25 11:56:15 | 004,604,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll

[2014/02/25 11:56:14 | 002,397,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll

[2014/02/25 11:51:49 | 000,548,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll

[2014/02/25 11:51:47 | 003,395,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WSService.dll

[2014/02/25 11:51:45 | 000,848,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WSShared.dll

[2014/02/25 11:51:45 | 000,695,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WSShared.dll

[2014/02/25 11:51:43 | 000,084,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WSCollect.exe

[2014/02/25 11:51:42 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Windows.ApplicationModel.Store.TestingFramework.dll

[2014/02/25 11:51:41 | 000,189,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Windows.ApplicationModel.Store.TestingFramework.dll

[2014/02/25 11:51:39 | 007,416,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Windows.UI.Search.dll

[2014/02/25 11:51:37 | 013,209,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\twinui.dll

[2014/02/25 11:51:35 | 011,702,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\twinui.dll

[2014/02/25 11:51:33 | 004,961,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Windows.UI.Search.dll

[2014/02/25 11:51:32 | 001,105,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SearchFolder.dll

[2014/02/25 11:51:31 | 001,462,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\propsys.dll

[2014/02/25 11:51:03 | 001,113,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll

[2014/02/25 11:50:49 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\scrrun.dll

[2014/02/25 11:50:48 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\scrrun.dll

[2014/02/25 11:50:48 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\pcaui.exe

[2014/02/25 11:50:47 | 000,787,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\uDWM.dll

[2014/02/25 11:50:47 | 000,017,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\pcaui.exe

[2014/02/25 11:50:46 | 000,287,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mdmregistration.dll

[2014/02/25 11:50:45 | 000,615,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MDMAgent.exe

[2014/02/25 11:50:45 | 000,240,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mdmregistration.dll

[2014/02/25 11:50:25 | 001,943,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll

[2014/02/25 11:45:37 | 004,217,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SyncEngine.dll

[2014/02/25 11:45:35 | 000,870,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SkyDrive.exe

[2014/02/25 11:45:33 | 002,804,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\actxprxy.dll

[2014/02/25 11:45:32 | 000,919,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MrmCoreR.dll

[2014/02/25 11:45:32 | 000,720,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SkyDriveTelemetry.dll

[2014/02/25 11:45:31 | 000,628,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MrmCoreR.dll

[2014/02/25 11:45:31 | 000,121,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SkyDriveShell.dll

[2014/02/25 11:45:31 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SkyDriveShell.dll

[2014/02/25 11:45:27 | 000,115,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winbici.dll

 

========== Files - Modified Within 30 Days ==========

 

[2014/03/26 19:47:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2014/03/26 19:27:01 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2014/03/26 19:23:22 | 000,956,476 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2014/03/26 19:23:22 | 000,796,126 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2014/03/26 19:23:22 | 000,161,346 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2014/03/26 19:20:19 | 000,002,210 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2014/03/26 19:19:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2014/03/26 19:19:01 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2014/03/26 19:18:50 | 000,000,430 | ---- | M] () -- C:\Windows\tasks\DriverUpdate Startup.job

[2014/03/26 19:18:29 | 000,016,152 | ---- | M] () -- C:\Windows\SysNative\drivers\SWDUMon.sys

[2014/03/26 19:17:45 | 268,435,456 | -HS- | M] () -- C:\swapfile.sys

[2014/03/26 19:17:42 | 2743,287,808 | -HS- | M] () -- C:\hiberfil.sys

[2014/03/26 18:28:15 | 000,152,744 | ---- | M] (Webroot) -- C:\Windows\SysWow64\WRusr.dll

[2014/03/26 18:28:15 | 000,113,664 | ---- | M] (Webroot) -- C:\Windows\SysNative\drivers\WRkrn.sys

[2014/03/26 18:28:15 | 000,103,816 | ---- | M] (Webroot) -- C:\Windows\SysNative\WRusr.dll

[2014/03/21 13:45:27 | 000,103,802 | ---- | M] () -- C:\Users\Kim\Desktop\Quarterly Forbearance Statement 9-2-13.pdf

[2014/03/21 13:41:17 | 000,108,429 | ---- | M] () -- C:\Users\Kim\Desktop\Quarterly Forbearance Statement 3-20-14.pdf

[2014/03/21 13:38:14 | 000,068,506 | ---- | M] () -- C:\Users\Kim\Desktop\Litigation LETTER - FDCPA 3-20-14.pdf

[2014/03/19 17:57:31 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Kim\Desktop\OTL.exe

[2014/03/19 13:40:59 | 000,001,255 | ---- | M] () -- C:\Users\Kim\Desktop\Amazon Cloud Player.lnk

[2014/03/19 00:56:08 | 000,000,841 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2014/03/19 00:23:40 | 000,002,310 | ---- | M] () -- C:\Users\Kim\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

[2014/03/18 21:14:01 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol

[2014/03/18 11:02:28 | 000,002,485 | ---- | M] () -- C:\Users\Public\Desktop\DriverUpdate.lnk

[2014/03/17 16:11:42 | 000,001,122 | ---- | M] () -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk

[2014/03/16 20:30:45 | 000,382,424 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2014/03/04 18:53:05 | 000,105,464 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2014/03/04 18:53:04 | 000,693,240 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe

[2014/03/04 16:07:06 | 000,000,426 | ---- | M] () -- C:\AVScanner.ini

[2014/03/01 00:17:43 | 000,218,624 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe

[2014/02/28 23:54:33 | 005,768,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll

[2014/02/28 23:42:12 | 000,627,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2014/02/28 22:25:42 | 000,703,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll

[2014/02/28 22:25:22 | 000,817,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll

[2014/02/26 05:19:26 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_LocationProvider_01_11_00.Wdf

 

========== Files Created - No Company Name ==========

 

[2014/03/21 13:45:26 | 000,103,802 | ---- | C] () -- C:\Users\Kim\Desktop\Quarterly Forbearance Statement 9-2-13.pdf

[2014/03/21 13:41:16 | 000,108,429 | ---- | C] () -- C:\Users\Kim\Desktop\Quarterly Forbearance Statement 3-20-14.pdf

[2014/03/21 13:38:13 | 000,068,506 | ---- | C] () -- C:\Users\Kim\Desktop\Litigation LETTER - FDCPA 3-20-14.pdf

[2014/03/19 13:40:59 | 000,001,255 | ---- | C] () -- C:\Users\Kim\Desktop\Amazon Cloud Player.lnk

[2014/03/19 00:56:08 | 000,000,841 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2014/03/18 14:09:06 | 000,138,240 | ---- | C] () -- C:\Windows\SysNative\OEMLicense.dll

[2014/03/18 14:09:06 | 000,103,936 | ---- | C] () -- C:\Windows\SysWow64\OEMLicense.dll

[2014/03/18 11:23:31 | 000,002,310 | ---- | C] () -- C:\Users\Kim\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

[2014/03/18 11:23:31 | 000,002,210 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2014/03/18 11:22:53 | 000,000,908 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2014/03/18 11:22:51 | 000,000,904 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2014/03/18 11:02:41 | 000,000,430 | ---- | C] () -- C:\Windows\tasks\DriverUpdate Startup.job

[2014/03/18 11:02:35 | 000,016,152 | ---- | C] () -- C:\Windows\SysNative\drivers\SWDUMon.sys

[2014/03/18 11:02:28 | 000,002,485 | ---- | C] () -- C:\Users\Public\Desktop\DriverUpdate.lnk

[2014/03/18 10:20:42 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol

[2014/03/17 15:29:54 | 000,000,426 | ---- | C] () -- C:\AVScanner.ini

[2014/03/13 13:08:14 | 000,001,122 | ---- | C] () -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk

[2014/03/11 21:13:47 | 000,386,722 | ---- | C] () -- C:\Windows\SysNative\ApnDatabase.xml

[2014/02/26 05:19:26 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_LocationProvider_01_11_00.Wdf

[2014/02/25 20:08:17 | 000,000,299 | ---- | C] () -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Recycle Bin.lnk

[2014/02/25 11:51:30 | 000,009,701 | ---- | C] () -- C:\Windows\SysWow64\connectedsearch-results.searchconnector-ms

[2014/02/25 11:51:30 | 000,009,701 | ---- | C] () -- C:\Windows\SysNative\connectedsearch-results.searchconnector-ms

[2013/11/27 12:51:18 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe

[2013/11/27 12:46:27 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2013/09/25 22:49:40 | 000,995,342 | ---- | C] () -- C:\Windows\SysWow64\amdocl_as32.exe

[2013/09/25 22:49:40 | 000,798,734 | ---- | C] () -- C:\Windows\SysWow64\amdocl_ld32.exe

[2013/09/25 22:07:28 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat

[2013/09/25 22:07:28 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat

[2013/09/25 21:36:12 | 000,123,392 | ---- | C] () -- C:\Windows\SysWow64\amdhdl32.dll

[2013/09/25 10:55:32 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll

[2013/08/26 02:13:37 | 000,931,872 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2013/08/22 11:36:43 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat

[2013/08/22 11:36:42 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT

[2013/08/22 10:46:23 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2013/08/22 03:01:23 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2013/08/21 23:32:36 | 000,046,080 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll

[2013/08/21 19:55:20 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll

[2013/08/21 19:52:39 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

 

========== ZeroAccess Check ==========

 

[2013/10/18 13:51:08 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2013/12/09 04:05:24 | 021,199,256 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2013/12/09 00:51:04 | 018,643,560 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2013/08/22 05:49:49 | 000,921,088 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2013/08/21 22:45:10 | 000,691,712 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2013/08/22 05:45:17 | 000,483,840 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 

========== Custom Scans ==========

 

< :Commands >

 

<  >

 

< :OTL >

 

< IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} >

 

< IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...q={searchTerms} >

 

< IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snapdo.c...q={searchTerms} >

Invalid Switch: feed.snapdo.c...q={searchTerms}

 

< IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.snapdo.c...q={searchTerms} >

Invalid Switch: feed.snapdo.c...q={searchTerms}

 

< IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://feed.snapdo.c...4RX8MGQrcXUlX98, >

Invalid Switch: feed.snapdo.c...4RX8MGQrcXUlX98,

 

< IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snapdo.c...q={searchTerms} >

Invalid Switch: feed.snapdo.c...q={searchTerms}

 

< IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snapdo.c...q={searchTerms} >

Invalid Switch: feed.snapdo.c...q={searchTerms}

 

< IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} >

 

< IE - HKU\.DEFAULT\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...q={searchTerms} >

 

< IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snapdo.c...q={searchTerms} >

Invalid Switch: feed.snapdo.c...q={searchTerms}

 

< IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.snapdo.c...q={searchTerms} >

Invalid Switch: feed.snapdo.c...q={searchTerms}

 

< IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://feed.snapdo.c...4RX8MGQrcXUlX98, >

Invalid Switch: feed.snapdo.c...4RX8MGQrcXUlX98,

 

< IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snapdo.c...q={searchTerms} >

Invalid Switch: feed.snapdo.c...q={searchTerms}

 

< IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snapdo.c...q={searchTerms} >

Invalid Switch: feed.snapdo.c...q={searchTerms}

 

< IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} >

 

< IE - HKU\S-1-5-18\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...q={searchTerms} >

 

< IE - HKU\S-1-5-21-2908134658-2290076565-1563918488-1002\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...q={searchTerms} >

 

< FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Users\Kim\AppData\Roaming\BaseFlash\Firefox >

 

<  >

 

< :Files >

 

< C:\Users\Kim\AppData\Roaming\BaseFlash >

 

<  >

 

< :Commands >

 

< [RESETHOSTS] >

 

< [EMPTYTEMP] >

 

========== Alternate Data Streams ==========

 

@Alternate Data Stream - 195 bytes -> C:\Users\Kim\SkyDrive:ms-properties

 

< End of report >

 

[Phel]

OTL.txt looks nice. Let's remove Snap.do from uninstall list:
 
Step 1. OTL fix.

• Run OTL.
• Under the Custom Scans/Fixes box at the bottom, paste in the following:
  
  

  :Commands
  [CREATERESTOREPOINT]
  
  :Reg
  [-HKEY_USERS\S-1-5-21-2908134658-2290076565-1563918488-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{02224593-ec78-49e5-a1ac-c3964a6e3f72}]
  
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FB385922-2E32-4462-A7DC-27159614A660}]
  
  :Commands
  [REBOOT]
  

• Then click the Run Fix button at the top.
• Let the program run unhindered, reboot the PC when it is done.

Step 2. OTL scan.

• Open OTL again.
• Click None button.
• Find in the OTL window Extra Registry section and change radiobutton there to the Use SafeList.
• Click on the Run Scan button.
• When the scan completes, it will open a notepad window - Extras.Txt. It's saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of this file and post them in your topic.

[sugarbee]

I WILL DO MY BEST TO BE BACK ON THIS SUNDAY NIGHT. IF NOT, I WILL BE BACK ON THIS MONDAY OR TUESDAY. THANK YOU. FYI. 

 

HERE IS THE EXTRAS FILE.

 

 

OTL Extras logfile created on: 4/3/2014 11:01:42 PM - Run 4

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Kim\Desktop

64bit- An unknown product  (Version = 6.2.9200) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.16521)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

3.19 Gb Total Physical Memory | 1.50 Gb Available Physical Memory | 46.81% Memory free

5.32 Gb Paging File | 3.25 Gb Available in Paging File | 61.16% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 678.14 Gb Total Space | 636.61 Gb Free Space | 93.88% Space Free | Partition Type: NTFS

Drive D: | 19.73 Gb Total Space | 2.02 Gb Free Space | 10.25% Space Free | Partition Type: NTFS

 

Computer Name: KIMSHIP | User Name: Kim | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

 

========== Extra Registry (SafeList) ==========

 

 

========== File Associations ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

.url[@ = internetshortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

 

========== Shell Spawning ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- C:\Program Files (x86)\Advanced System Protector\filetypehelper.exe -scanunknown "%1"

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- C:\Program Files (x86)\Advanced System Protector\filetypehelper.exe -scanunknown "%1"

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

 

========== Security Center Settings ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = AC 1C AE C5 46 9F CE 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Upgrade]

"UpgradeTime" =  [binary data]

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"FirewallOverride" = 0

"AntivirusOverride" = 0

"UacDisableNotify" = 0

"AntiSpywareDisableNotify" = 0

"AutoUpdateDisableNotify" = 0

"InternetSettingsDisableNotify" = 0

"UpdatesDisableNotify" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

"DisableMonitoring" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

"DisableMonitoring" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Upgrade]

"UpgradeTime" = Reg Error: Unknown registry data type -- File not found

 

========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

 

========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

========== Authorized Applications List ==========

 

 

========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{03EC5718-67DF-4680-910D-0BA1B1F380FA}" = rport=138 | protocol=17 | dir=out | app=system | 

"{1738956D-3846-49DB-BB0A-767B1AE40E4B}" = lport=139 | protocol=6 | dir=in | app=system | 

"{4EF31DF6-244F-4186-9A84-6AA1D69D7B25}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 | 

"{540C58B6-7AEC-4761-9B8B-F5C771892FC3}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 

"{64773F18-866A-4A41-B889-30BBD64B0BD9}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{6CF3F39D-980D-4348-ADCD-CB45F540734B}" = lport=138 | protocol=17 | dir=in | app=system | 

"{79A4529D-9240-4BD8-A1EB-AD4233CF7438}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{8B18A297-86AF-42AC-87FA-2D5C76187091}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{8F4B2368-258E-484D-B715-1724F6777C08}" = rport=137 | protocol=17 | dir=out | app=system | 

"{927F1272-0038-4328-9A39-4D242A73983A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{95B37189-0DC0-483C-B1C1-A56C62214F16}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{97E544E1-E4A4-4F46-A24B-E2762F18BFD6}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{A960D66A-BCE0-4A2B-871E-7A674D6389B5}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{AA51FC8B-7989-4E48-B13C-539CB81E14F5}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{BA5D8533-1F6C-4066-AE18-125C70BA5B20}" = rport=445 | protocol=6 | dir=out | app=system | 

"{C205D852-6D09-4B4B-83B1-F870ED22F989}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{CB82A929-4283-409B-A82D-1B6095A75177}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{CD3F3103-DD7F-4F83-8EE9-9CA8AB54759F}" = rport=139 | protocol=6 | dir=out | app=system | 

"{D1956DCD-173B-4A6D-991B-2180DC4BA221}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{D3834BB4-8BE4-4572-B247-4A2901A5A50F}" = lport=445 | protocol=6 | dir=in | app=system | 

"{D5C74A28-CFF0-4AA7-97DF-0E0C9B8C1687}" = lport=137 | protocol=17 | dir=in | app=system | 

"{F5839933-7D60-4E80-A5AD-87395DF8BBEE}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{FC07E070-9749-42BD-8E2E-1A6946387A55}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 

 

========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{00B435C3-D8F5-49E2-A54A-C86DDF1A7740}" = dir=out | name=@{microsoft.windowscommunicationsapps_17.5.9600.20413_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} | 

"{01C86499-0426-44DD-8CB6-19EB27AC749C}" = protocol=6 | dir=out | app=system | 

"{05A5B647-F609-423B-AD7E-44BE5380C8C2}" = dir=out | name=box | 

"{07953E41-10E5-46EB-97EE-78C86DB23E08}" = dir=out | name=ebay | 

"{07FFDC02-CC1F-468B-B22A-7184D67A1DBF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{084DC84C-5331-44BD-93C2-319C7021C529}" = protocol=17 | dir=in | app=c:\users\kim\appdata\roaming\dropbox\bin\dropbox.exe | 

"{0D33B17D-C2C9-4EBD-ACCF-520B88B6D1A4}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{0EC4B122-2054-4CE7-BB28-5D7EBE8C0136}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{17D39B0B-0398-46A9-9D45-349D2A2F93D5}" = protocol=58 | dir=out | [email protected],-28546 | 

"{1A4B1A6B-FD06-4426-BE84-220046B6C52B}" = dir=out | name=@{microsoft.xboxlivegames_2.0.139.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxlivegames/resources/34150} | 

"{1BBB1104-CBD1-400F-A97D-69524012D900}" = dir=out | name=@{microsoft.bingmaps_2.0.2530.2317_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingmaps/resources/appdisplayname} | 

"{1D27D446-A08F-428A-812C-BF1155BD37C2}" = dir=out | name=@{microsoft.bingfinance_3.0.2.243_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingfinance/resources/brandedapptitle} | 

"{244EBA3B-39FF-4EB9-B38C-C49B62FA6A02}" = protocol=1 | dir=in | [email protected],-28543 | 

"{25F3A35C-AF1E-4CCC-9862-01389A922BE6}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe | 

"{2629B549-58FA-4DEC-9E05-A5148E493E41}" = dir=out | name=windows_ie_ac_001 | 

"{2A49305B-BA97-4776-A002-52C3F8A661E2}" = protocol=58 | dir=in | [email protected],-28545 | 

"{2B8EE735-FE86-4764-941C-79B3FA45BD67}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\kernel\dmr\powerdvd12dmrengine.exe | 

"{2BA738CA-A2EC-4D00-BECD-82AFEBDDEB37}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector10\pdr10.exe | 

"{2DDC8FCA-7EC7-4BA8-BBB1-C3C96687C1D1}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{338E4A94-8313-4566-BC8E-4C2099DBD346}" = dir=out | app=c:\program files (x86)\hpconnectedmusic\hpconnectedmusic.exe | 

"{39E5EAC3-CAD0-48F4-8E89-25C5EC1B12A7}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe | 

"{3A6CA381-4463-403B-8012-3D31C0F953BB}" = dir=out | app=%localappdata%\hpconnectedmusic\application\hpconnectedmusic.exe | 

"{3A7D3D74-8DFA-4021-8771-3C66007A547B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{4282FE99-8560-4BC7-9576-5F3ED84E263F}" = dir=in | name=checkpoint.vpn | 

"{4392BAB6-7FD1-45F7-98C6-043813755011}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{466AF95C-8E5A-4071-B147-8EE1293854EE}" = dir=in | name=hp connected drive | 

"{49FD3E80-8EB0-4650-86CF-B8F7FBB9F208}" = dir=in | name=getting started with windows 8 | 

"{4C6A8676-7ACA-4D2E-B2D6-EB6F64D8B2C5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{4D21E721-4926-444B-B06F-F194625FF444}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{4F8C79FD-16B3-4C8F-A7BF-786536016B94}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{50B9BB81-15DD-435B-A643-881FB326847C}" = dir=out | name=skype | 

"{54282971-ECCB-43AC-B3E2-2392EDDBD4C8}" = dir=in | app=c:\program files (x86)\hewlett-packard\hp support framework\resources\hpwarrantycheck\hpdevicedetection3.exe | 

"{548DCF8C-BFF2-4BA4-AA88-FBAF9AC8BCC6}" = dir=in | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} | 

"{560448D6-095C-4907-B046-AC7F710701A7}" = dir=in | name=sonicwall.mobileconnect | 

"{560D807E-DD64-4F5A-AFFA-CCE0CDDDFF0E}" = dir=in | name=hp connected photo | 

"{5654807F-B99C-4CA9-AE8F-C2B0F93D4D87}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\kernel\dms\clmsserverpdvd12.exe | 

"{5C7F2418-CEF4-4998-BCAF-AB6466069FB7}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\powerdvd12ml.exe | 

"{5F4632C0-D5B1-40C3-B0D9-E3A759C81B9E}" = dir=out | name=sonicwall.mobileconnect | 

"{64966C50-2D97-4C99-88C2-AB69DE5D91B0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{69321B68-F6F7-4A78-81C8-1205EC4D4FF8}" = dir=in | name=box | 

"{6CDACDD9-9028-44FD-AB48-934D26200CFD}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{6E479253-0217-4584-8B84-C91AAF007248}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{73A1365D-D8F0-4010-97A3-BA6C8D274DD4}" = dir=out | name=- games app - | 

"{744C8478-774C-46A7-9BBA-04DA51E88576}" = dir=out | name=@{microsoft.bingsports_3.0.2.243_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingsports/resources/brandedapptitle} | 

"{75D0D385-D431-43AD-9C41-E97A357DAFE3}" = dir=out | name=getting started with windows 8 | 

"{77F9248B-D54B-426B-BF85-4A46BD418D2F}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe | 

"{7BCAEB16-DD19-4E9F-BBFA-93CB4D17D2AD}" = dir=out | app=%localappdata%\hpconnectedmusic\application\spotify_helper.exe | 

"{80EE4EE8-57E5-4288-8176-C1F3A567BAF0}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{85A3FC65-11C4-4B0B-885A-55DB41C761CA}" = dir=in | name=skype | 

"{87C1B3CC-2DEE-4FA3-BA44-78B033DFE571}" = dir=out | name=@{microsoft.zunemusic_2.2.800.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/resources/ids_manifest_music_app_name} | 

"{89F4AC8F-C275-4237-8C69-FC76B389161B}" = dir=out | name=@{microsoft.bingfoodanddrink_3.0.2.243_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingfoodanddrink/resources/apptitlewithbranding} | 

"{8D1C6F77-A6FD-4102-B33E-4ECAE5398DE3}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\movie\powerdvd.exe | 

"{9123F3BE-9B03-48CE-AA42-8C6A8A22AF8B}" = dir=out | name=hp connected drive | 

"{93716735-B3E2-4097-8BEB-AC224829D0DB}" = dir=out | name=kindle | 

"{9E3D57FC-7C37-4424-9352-4831E97D029D}" = dir=out | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} | 

"{9F93B13E-BCC4-4AAC-BE2D-F157B6B2EDBC}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{A04F0A85-9609-4D1D-8512-6C9F0813F5D3}" = dir=out | name=@{microsoft.windowsreadinglist_6.3.9654.20349_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsreadinglist/resources/apppackagename} | 

"{A582AB06-8EC1-4C89-AD4B-A1834FC22D6A}" = dir=out | name=youcam for hp | 

"{A85E2B6D-2F14-4B5A-9B96-69D37D4BF825}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{AFF70F25-60BE-4E0C-A3D1-421E7028BA4E}" = dir=in | app=c:\users\kim\appdata\local\microsoft\skydrive\skydrive.exe | 

"{B13D9176-A755-4821-A126-85C1C0377FCD}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\powerdvd12.exe | 

"{B1D1812B-543A-4ED9-92E2-FDBF5C7A26BB}" = dir=out | name=@{microsoft.zunevideo_2.2.802.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/ids_manifest_video_app_name} | 

"{B66CC660-2D82-473D-9618-5FB25127FEB1}" = protocol=6 | dir=in | app=c:\users\kim\appdata\roaming\dropbox\bin\dropbox.exe | 

"{BDD68A9E-47FD-4FC6-8067-3C817F3CA9BC}" = protocol=1 | dir=out | [email protected],-28544 | 

"{C1899FCB-DD87-460B-85D8-4E13A698FD82}" = dir=in | app=%localappdata%\hpconnectedmusic\application\spotify_helper.exe | 

"{C1DEA93E-8EFD-4548-9619-E9E626447766}" = dir=out | name=netflix | 

"{C2C59221-1A2F-46B3-B216-612D0E54E835}" = dir=out | name=facebook | 

"{C3614BC6-917C-4FE2-9D45-EBBF0947E02A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{C3854C11-C072-4FB3-BC9A-B419CA67BE6B}" = dir=out | name=@{microsoft.bingtravel_3.0.2.243_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingtravel/resources/brandedapptitle} | 

"{C3F96D42-2809-47F9-8006-701CFCF042F6}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd12\powerdvd12agent.exe | 

"{C6ABA522-0FDB-4E26-91F9-1FBC6C888D9C}" = dir=out | name=@{microsoft.bingnews_3.0.2.243_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingnews/resources/brandedapptitle} | 

"{CDA6CBA5-B0B2-4AA4-91CD-FAFBE594217C}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{CEF387D3-7302-41BC-A69D-A7B8397AAF8A}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 

"{CF06ACC2-DA33-4ED6-B97A-C9EC5242A813}" = dir=out | name=@{microsoft.bingweather_3.0.2.243_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/apptitle} | 

"{D6980480-941A-4DF6-AB81-3734ECD3D779}" = dir=out | name=junipernetworks.junospulsevpn | 

"{D9A64485-6A73-42E5-BAF9-1C5F95C01D93}" = dir=in | name=@{microsoft.windowsreadinglist_6.3.9654.20349_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsreadinglist/resources/apppackagename} | 

"{DB59588E-ED90-4C47-A7B5-7929DD0C0BD2}" = dir=out | name=checkpoint.vpn | 

"{E120052A-57F6-48A3-956A-BDC7AE12CDB2}" = dir=in | app=c:\program files (x86)\hpconnectedmusic\hpconnectedmusic.exe | 

"{E56E2C70-9847-46CE-B06A-3D102F03913F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{EC799E33-72BA-42D7-9127-DEFE68F9799D}" = dir=in | name=junipernetworks.junospulsevpn | 

"{ED663641-C6B3-4CF2-B7DD-BC194227DA75}" = dir=in | app=%localappdata%\hpconnectedmusic\application\hpconnectedmusic.exe | 

"{F64300AD-D559-4000-BD45-0997BCC8E70A}" = dir=out | name=f5.vpn.client | 

"{F77E5446-4378-4E99-8B7A-7061AAAEA193}" = dir=in | name=f5.vpn.client | 

"{F807FFF8-6ED0-4421-BEAE-CC68561D1BC2}" = dir=out | name=@{microsoft.binghealthandfitness_3.0.2.243_x64__8wekyb3d8bbwe?ms-resource://microsoft.binghealthandfitness/resources/apptitle} | 

"{F90A70F3-AE8B-44E8-9C36-295090D1096B}" = dir=in | name=@{microsoft.windowscommunicationsapps_17.5.9600.20413_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} | 

"{FB587E02-3084-4A6B-A59C-2C3107BDDBEB}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe | 

"{FF72EE4A-08ED-46AF-9A04-FEC47B586106}" = dir=out | name=hp connected photo | 

 

========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0895F77B-D446-411A-A5FD-49018A3199D7}" = AMD Fuel

"{0A644ECD-8C41-E206-8262-E5EC90848EB5}" = AMD Accelerated Video Transcoding

"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219

"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)

"{2DE6247C-7077-451B-8BA7-FFD1A2ABBB47}" = Inst5675

"{314FAD12-F785-4471-BCE8-AB506642B9A1}" = HP SimplePass

"{5BB304EB-8E5B-0F2D-66FA-6603D9BB3232}" = AMD Catalyst Install Manager

"{6E14E6D6-3175-4E1A-B934-CAB5A86367CD}" = HP Postscript Converter

"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour

"{74FE39A0-FB76-47CD-84BA-91E2BBB17EF2}" = DisableMSDefender

"{7A75E042-0D30-43C2-BD2A-684F4BE38FF7}" = HP Utility Center

"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

"{878F6913-7421-4713-97F7-0A736EE2A188}" = Inst5676

"{90150000-008F-0000-1000-0000000FF1CE}" = Office 15 Click-to-Run Licensing Component

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{A09F5616-4BAD-64DA-C6F6-F96E0351218D}" = ccc-utility64

"{A2CB1ACB-94A2-32BA-A15E-7D80319F7589}" = Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727

"{AC53FC8B-EE18-3F9C-9B59-60937D0B182C}" = Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727

"{D1E8F2D7-7794-4245-B286-87ED86C1893C}" = HP Registration Service

"{E9FA781F-3E80-4399-825A-AD3E11C28C77}" = MSVCRT110_amd64

"CCleaner" = CCleaner

"HomeStudentRetail - en-us" = Microsoft Office Home and Student 2013 - en-us

"SynTPDeinstKey" = Synaptics Pointing Device Driver

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam

"{03D562B5-C4E2-4846-A920-33178788BE00}" = Windows Live Communications Platform

"{04371603-5A0B-ED04-1091-E6DCDFC3DF20}" = CCC Help Chinese Traditional

"{07F6DC37-0857-4B68-A675-4E35989E85E3}" = HP 3D DriveGuard

"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements

"{0D598E62-73FD-6B12-E1A8-7FA65699B5FC}" = CCC Help Japanese

"{0F929651-F516-4956-90F2-FFBD2CD5D30E}" = Photo Gallery

"{0FF9CC94-EF23-401E-BDBD-37403D1A2B38}" = Windows Live SOXE Definitions

"{118DD9F0-49FE-498E-A2EE-F33423C1394C}" = Catalyst Control Center - Branding

"{12BE7C93-741C-54D8-910A-8BB00BB4A09C}" = CCC Help Swedish

"{15134cb0-b767-4960-a911-f2d16ae54797}" = Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}" = CyberLink Media Suite 10

"{22154f09-719a-4619-bb71-5b3356999fbf}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727

"{277BD99E-D0B2-3598-BE46-7CD5170F3970}" = Catalyst Control Center Graphics Previews Common

"{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}" = CyberLink Power2Go 8

"{2AC01935-3774-4981-98C8-14E93C14372C}" = Windows Live UX Platform Language Pack

"{2B353DA2-A8FD-4238-B207-62A1921158D7}" = DriverUpdate

"{2F73A7B2-E50E-39A6-9ABC-EF89E4C62E36}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727

"{2F966EDD-BA18-0F75-456F-648FF1329CEE}" = Catalyst Control Center InstallProxy

"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App

"{30B2D1D8-0A07-4B71-9553-0710C5D31E35}" = HP Wireless Button Driver

"{39337565-330E-4ab6-A9AE-AC81E0720B10}" = Cyberlink PhotoDirector

"{394B14EA-B072-4440-9510-87797CB12371}" = HP CoolSense

"{399EA8F8-5231-510D-070E-A5602C6CA3CD}" = CCC Help Polish

"{41126AED-2C61-0E5B-F127-49B97E606B9D}" = CCC Help Turkish

"{417A142E-10AF-EE44-E54A-361F11B15D56}" = CCC Help Dutch

"{4525FF56-E096-42F4-BB64-52AAA8B3D893}" = HP Documentation

"{45898170-E68C-4F02-AA35-C2186BF347A3}" = Movie Maker

"{5A0EE0F0-E909-4F3B-B437-AAD9252427CB}" = Windows Live Installer

"{5B92F54D-1C27-04A8-7F0A-609BB651C7BA}" = CCC Help English

"{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}" = Realtek Card Reader

"{5E094C92-6288-4F43-AA9A-D452D0218F3F}" = Windows Live Essentials

"{5FD07E0A-ACC7-6565-7E38-4A8A4FC996B8}" = CCC Help Thai

"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM

"{61655124-8C4E-59D5-88D2-455EFE5BEF3B}" = AMD Catalyst Control Center

"{6AA65072-66B9-89E7-EB89-BB8FE5C78D0E}" = CCC Help Spanish

"{6B6923B9-8719-425B-916C-CD2908F31AAF}" = Windows Live SOXE

"{6E58A192-7CCD-83DF-E1D7-BF6A1372C7D8}" = CCC Help Chinese Standard

"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.2.2.3

"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp" = WildTangent Games App (HP Games)

"{70D5F822-F4C4-33D9-7EEC-2A4AF4EA7BDC}" = OEM Application Profile

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{74088822-660F-0CD4-0ECA-0BE6E6C2AF4C}" = CCC Help Portuguese

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver

"{89C7E0A7-4D9D-4DCC-8834-A9A2B92D7EBB}" = Photo Gallery

"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT

"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110

"{90150000-008C-0000-0000-0000000FF1CE}" = Office 15 Click-to-Run Extensibility Component

"{90150000-008C-0409-0000-0000000FF1CE}" = Office 15 Click-to-Run Localization Component

"{919C7688-8F7D-0DB7-B79D-5B3571CB8E2C}" = CCC Help Czech

"{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}" = Visual Studio 2012 x86 Redistributables

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9B56B031-A6C0-4BB7-8F61-938548C1B759}" = Pinger

"{A5107464-AA9B-4177-8129-5FF2F42DD322}" = REALTEK Wireless LAN Driver

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}" = CyberLink PowerDirector 10

"{B39A6825-EA20-43EA-AB2D-A6BC0298D9A1}" = Movie Maker

"{B46BEA36-0B71-4A4E-AE41-87241643FA0A}" = CyberLink PowerDVD 12

"{BC0BF363-63AB-4FF7-8EF1-AE0D7F711B24}" = LPT System Updater Service

"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint

"{C6B0EE9E-2128-4448-B7AE-5E2B46E0F0E7}" = Windows Live Photo Common

"{C78E8F51-3EAD-4F0C-83F0-EF371075E0B4}" = HP System Event Utility

"{C803F720-6EFF-F346-DCA6-14318EB9922C}" = Catalyst Control Center Localization All

"{CB479001-71F1-D133-DB45-97F40F99EAC1}" = CCC Help Danish

"{CC7BB4E8-0F61-48A9-DF4D-20E43DA3C3AB}" = CCC Help Norwegian

"{D1319840-A113-DCA8-F938-A3468A7FA862}" = CCC Help Korean

"{D3992AF4-D2EB-183A-41B6-9401855AEED9}" = CCC Help Russian

"{D95C92C8-4670-3122-71BF-C4F27B2228BF}" = CCC Help Greek

"{DD7C5FC1-DCA5-487A-AF23-658B1C00243F}" = Photo Common

"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10

"{E3445598-4424-4EE2-B71C-C23325F7FB71}" = Windows Live PIMT Platform

"{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}" = HP Support Assistant

"{E4CDF12A-3203-DCEE-6C02-4F311F89AF16}" = CCC Help Hungarian

"{E6E135B9-2211-683C-1E52-D5E0C244B36A}" = CCC Help German

"{E8C68176-FE8A-FE9A-4544-781F8CD611A8}" = CCC Help Italian

"{ED3EECB1-03EA-55A2-BB44-C7911868D2AC}" = CCC Help French

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F0E58739-2B4C-498F-9B0D-FF0F2FD52B61}" = Windows Live UX Platform

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F3295B87-FA7F-F1F1-5F07-EACB752B669F}" = CCC Help Finnish

"{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}" = Energy Star

"{FD49537C-C3A6-4F8D-93E6-68C778A1E192}" = HP Recovery Manager

"{FDB30193-FDA0-3DAA-ACCA-A75EEFE53607}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727

"Adobe Flash Player Plugin" = Adobe Flash Player 12 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 12.0

"Google Chrome" = Google Chrome

"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam

"InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}" = CyberLink Media Suite 10

"InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}" = CyberLink Power2Go 8

"InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}" = HP SimplePass

"InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}" = Cyberlink PhotoDirector

"InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}" = CyberLink PowerDirector 10

"InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}" = CyberLink PowerDVD 12

"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300

"Pinger 1.4.0.1" = Pinger

"StartHPConnectedMusic" = HP Connected Music (Meridian - installer)

"WildTangent wildgames Master Uninstall" = WildTangent Games

"WinLiveSuite" = Windows Live Essentials

"WRUNINST" = Webroot SecureAnywhere

"WTA-02731f74-eef9-49f0-9e49-b6e8c5890582" = Youda Jewel Shop

"WTA-12994157-f75f-4bf3-95a6-9f80e5625e3e" = Build-a-lot

"WTA-14380d67-6f50-4280-af08-a7d0dfd787a2" = Luxor Evolved

"WTA-1687b6a3-2f77-4bbc-bae2-98c6973c2fe5" = King Oddball

"WTA-17e4838e-c690-4af5-bd30-15bdda345941" = Tales of Lagoona

"WTA-1b591a9c-031b-453a-b336-f8d04cfa5a2f" = Governor of Poker 2 Premium Edition

"WTA-2f8b3fd3-454a-41b5-910f-065d632d411f" = Mahjongg Dimensions Deluxe

"WTA-393aa941-1358-4641-b8a2-f637da8d1fef" = Azkend 2: The World Beneath

"WTA-44fc4272-dc82-4594-af0a-ecc03e31347f" = Plants vs. Zombies - Game of the Year

"WTA-4a00ccad-206d-4289-a832-4d76c74eea03" = Delicious: Emily's Childhood Memories Premium Edition

"WTA-4b039ff6-b07a-406f-b2ef-42607c274be7" = Peggle Nights

"WTA-4dcb586b-23e4-4014-97c0-e773c6256a8f" = Vacation Quest™ - Australia

"WTA-57bb1524-df97-4fb3-a58d-b6c5c1cd1267" = Curse at Twilight

"WTA-66a32e31-a102-4a5b-ba0d-a82481da578b" = Bounce Symphony

"WTA-6fba1754-5c31-41d7-8357-3390b8c9ca4b" = House of 1000 Doors: Family Secrets

"WTA-76c1430a-b631-4ddc-a7c6-d880a7524bee" = Cradle of Rome 2

"WTA-8ab9fd4d-19d4-4c1b-a932-d212b740d9d6" = Cradle Of Egypt Collector's Edition

"WTA-8b00b443-3ed1-4f98-9e5c-fd4bd623925b" = Roads of Rome 3

"WTA-92da0979-76da-4598-aa58-16e4d93e7a56" = Jewel Match 3

"WTA-94747bd2-9db8-4783-bf53-7fc572f01c6c" = Penguins!

"WTA-99e7820b-1887-48d1-ac6a-4489d16e86a4" = Mystery P.I. - Curious Case of Counterfeit Cove

"WTA-9a76ab38-a5d8-43ab-a3af-5fefbeb4449e" = Airport Mania

"WTA-a19ed313-c752-48d1-97ba-d9759df135c9" = Farm Frenzy

"WTA-a3fcf0b0-3d44-4d2b-aed3-ee1f587cdf19" = 4 Elements II

"WTA-b0fe64d1-80e2-4928-8a86-914979a109c9" = John Deere Drive Green

"WTA-cd7cb784-7c07-4baa-acd3-ced4570fa9c0" = Bejeweled 3

"WTA-d2fe7e80-f59c-46ce-bbad-855ae94e288e" = Polar Bowler

"WTA-dbb5e02a-d88a-412f-b7e7-41604a495a9b" = Fishdom 3: Collector's Edition

"WTA-f71766fb-ae3d-4ff2-b67a-b7147e0c87bd" = Zuma's Revenge

 

========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Amazon Amazon Cloud Player" = Amazon Cloud Player

"Dropbox" = Dropbox

"HPConnectedMusic" = HP Connected Music (Meridian - player)

"OneDriveSetup.exe" = Microsoft OneDrive

 

========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 3/31/2014 8:12:26 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 3/31/2014 8:12:26 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 19081657

 

Error - 3/31/2014 8:12:26 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 19081657

 

Error - 4/1/2014 6:19:43 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 4/1/2014 6:19:43 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 58731750

 

Error - 4/1/2014 6:19:43 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 58731750

 

Error - 4/2/2014 11:48:08 AM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 4/2/2014 11:48:08 AM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 47156281

 

Error - 4/2/2014 11:48:08 AM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 47156281

 

Error - 4/3/2014 1:05:04 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 4/3/2014 1:05:04 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 26981672

 

Error - 4/3/2014 1:05:04 PM | Computer Name = KimShip | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 26981672

 

[ System Events ]

Error - 3/16/2014 8:30:57 PM | Computer Name = KimShip | Source = Service Control Manager | ID = 7000

Description = The McAfee Inc. mfeapfk service failed to start due to the following

 error:   %%1243

 

Error - 3/16/2014 8:41:01 PM | Computer Name = KimShip | Source = DCOM | ID = 10010

Description = 

 

Error - 3/16/2014 8:43:54 PM | Computer Name = KimShip | Source = Service Control Manager | ID = 7034

Description = The SavingsbullFilterService64 service terminated unexpectedly.  It

 has done this 1 time(s).

 

Error - 3/16/2014 8:44:05 PM | Computer Name = KimShip | Source = Service Control Manager | ID = 7031

Description = The HP Support Assistant Service service terminated unexpectedly. 

 It has done this 1 time(s).  The following corrective action will be taken in 60000

 milliseconds: Restart the service.

 

Error - 3/16/2014 8:47:03 PM | Computer Name = KimShip | Source = Service Control Manager | ID = 7000

Description = The Level Quality Watcher service failed to start due to the following

 error:   %%2

 

Error - 3/16/2014 8:47:03 PM | Computer Name = KimShip | Source = Service Control Manager | ID = 7000

Description = The McAfee Inc. mfeapfk service failed to start due to the following

 error:   %%1243

 

Error - 3/16/2014 11:03:57 PM | Computer Name = KimShip | Source = DCOM | ID = 10010

Description = 

 

Error - 3/17/2014 4:38:48 AM | Computer Name = KimShip | Source = Service Control Manager | ID = 7034

Description = The CyberLink PowerDVD 12 Media Server Service service terminated 

unexpectedly.  It has done this 1 time(s).

 

Error - 3/17/2014 3:36:05 PM | Computer Name = KimShip | Source = DCOM | ID = 10010

Description = 

 

Error - 3/17/2014 3:36:35 PM | Computer Name = KimShip | Source = DCOM | ID = 10010

Description = 

 

 

< End of report >

 

[Phel]

Okay, acknowledged. When you will be back, please, write, how your computer is running.