[blue_mike]

I am currently in Malware Training here, and a BB code editor was not working correctly.  After attempting to locate the problem, we tried to repair the computer by using the Windows 7 disk, and by hitting F8 during boot up and going to the system repair using SFC /Scannow, but both times i got the following message(There is a system repair pending which require reboot to complete.)  We then attempted to remove the image by running dism.exe /image:C:\ /cleanup-image /revertpendingactions, which resulted in a message saying Error 2, Unable to access the image.  Make sure that the image path and windows directory for the image exist and you have read permissions on the folder.  The Dism log file can be found at x:\windows\logs\DISM\dism.log.  Below is the original error message that started me on the path of me trying to find the answer.  Every time i try to open the program, I have to hit retry multiple times to get the program to open.

 

Error number: 1961
Error message: A subdirectory or file c:\users\mike\appdata\local\temp\ already exists.
Line of code with error: DO "c:\program files (x86)\aztools\blueline.exe"

Line number of error: 0
Files
 1 --> VERSIONINFO
 2 --> XTAGS
 3 --> BBBTNS
 4 --> USERBTNS
Selected --> BBBTNS
table --> BBBTNS
records         20
BBBTN               -->  Pgfbtn10  
TOOLTIP             -->  User buttons page 10
C:\PROGRAM FILES (X86)\AZTOOLS\BLUELINE.EXE
PROCEDURE BLUELINE.OBT.INIT
CTL32.FXP
CTL32_VFP2C32.FXP
ON...
PROCEDURE ERRHANDLER C:\PROGRAM FILES (X86)\AZTOOLS\BLUELINE.EXE
Program with error: CTL32_VFP2C32

[Advertisements]

Hi,
 
Did you run chkdsk on the C: drive?
 
If not from a Command Prompt running as Administrator type:

chkdsk C: /f /x

Answer Yes to schedule the scan on next reboot and restart the system.
 
 
Run TFC...

• download TFC - Temp File Cleaner by OldTimer and save the file to the Desktop
  The program will close all programs when run, so make sure you have saved all your work before you begin
• right click the TFC icon and choose Run as Administrator
• click Start and let the program run uninterrupted

 

Notes:

• Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two
• When TFC runs it can shut down all running processes and you may lose the desktop and icons, but they will return on reboot
• Once the cleaning process finished it could ask to reboot the machine. If it does not, please manually reboot the computer yourself to ensure a complete clean.

 

Run chkdsk again to make sure there are no errors.

[SleepyDude]

Hi,
 
Did you run chkdsk on the C: drive?
 
If not from a Command Prompt running as Administrator type:

chkdsk C: /f /x

Answer Yes to schedule the scan on next reboot and restart the system.
 
 
Run TFC...

• download TFC - Temp File Cleaner by OldTimer and save the file to the Desktop
  The program will close all programs when run, so make sure you have saved all your work before you begin
• right click the TFC icon and choose Run as Administrator
• click Start and let the program run uninterrupted

 

Notes:

• Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two
• When TFC runs it can shut down all running processes and you may lose the desktop and icons, but they will return on reboot
• Once the cleaning process finished it could ask to reboot the machine. If it does not, please manually reboot the computer yourself to ensure a complete clean.

 

Run chkdsk again to make sure there are no errors.

[blue_mike]

Hello Sleepy thank you for your help.  I ran chkdsk and this is the only error that I see in the event list, when I go back and review the log.

 

Log Name:      Application
Source:        Microsoft-Windows-WMI
Date:          9/9/2014 2:20:46 PM
Event ID:      10
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Mike-PC
Description:
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Event Xml:
<Event xmlns="http://schemas.micro.../events/event">
  <System>
    <Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
    <EventID Qualifiers="49152">10</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-09-09T18:20:46.000000000Z" />
    <EventRecordID>75780</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>Mike-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>//./root/CIMV2</Data>
    <Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage &gt; 99</Data>
    <Data>0x80041003</Data>
  </EventData>
</Event>

[blue_mike]

CHKDSK is verifying files (stage 1 of 3)...
  227072 file records processed.
File verification completed.
  472 large file records processed.
  0 bad file records processed.
  0 EA records processed.
  75 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)...
  277244 index entries processed.
Index verification completed.
  0 unindexed files scanned.
  0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 3)...
  227072 file SDs/SIDs processed.
Security descriptor verification completed.
  25087 data files processed.
CHKDSK is verifying Usn Journal...
  36068344 USN bytes processed.
Usn Journal verification completed.
Windows has checked the file system and found no problems.

 488282111 KB total disk space.
 147029924 KB in 139796 files.
     99200 KB in 25088 indexes.
         0 KB in bad sectors.
    345239 KB in use by the system.
     65536 KB occupied by the log file.
 340807748 KB available on disk.

      4096 bytes in each allocation unit.
 122070527 total allocation units on disk.
  85201937 allocation units available on disk.

[SleepyDude]

Ok, Did you run TFC?

[blue_mike]

I did run TFC.  It ran through quick, since I cleaned up temp files not to long ago.  I check to see if anything changed with Blue Line, and I am still getting the same error.

[SleepyDude]

Can you remove the TEMP folder from c:\users\mike\appdata\local\ and then create a new one?

[blue_mike]

I am still learning when it comes to files and folders, can you give me a brief run down on creating a new temp file please.

[SleepyDude]

I am still learning when it comes to files and folders, can you give me a brief run down on creating a new temp file please.

 
Forget that for now.

• Download GrantPerms choose the 32 or 64 bit's version according to your OS
• extract the zip file to the Desktop and execute GrantPerms/GrantPerms64
• on the empty white box type:
  

  %temp%

• click the List Permissions button
• Notepad will open showing a log Perms.txt also saved on the Desktop
• Copy & Paste the log contents to your post

[blue_mike]

GrantPerms by Farbar
Ran by Mike (administrator) at 2014-09-09 16:58:13

===============================================
\\?\C:\Users\Mike\AppData\Local\Temp

   Owner: Mike-PC\Mike

   DACL(not_protected):
         Mike-PC\Mike   FULL   ALLOW   (PI)(CI)(OI)



================ End Of List ================

[blue_mike]

I wanted to add one more critical piece of the puzzle that I forgot to even mention.  Before I started Malware training here, I was using CC Cleaner, to clean the registry and files.  I now know that was a huge mistake and no longer use and program to clean registry files.  I should of mentioned this earlier and I apologize.

[SleepyDude]

Hi,
 
Registry Cleaners can create all sort of problems...
 
The permissions are OK.
 
Can you ran sfc /scannow from the Command Prompt running as Administrator and tell me if it finds problems?
 
If it doesn't say "No integrity violations found" them do this:

• In the command prompt window, type or Copy & Paste the following:
  

  findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >"%userprofile%\Desktop\sfcdetails.txt"

• Close the command prompt.
• Attach to your post the sfcdetails.txt file that was just placed on your Desktop
• You can safely delete the sfcdetails.txt file afterwards if you like

[blue_mike]

It says no integrity violations were found!.

[SleepyDude]

What are the security programs you have installed?

 

Run Blueline to generate the error then run MiniToolBox.

 

Download MiniToolBox and save the file to the Desktop.
Run the tool, check the following options:

• List last 10 Event Viewer log
• List Installed Programs

Click on Go.

Post the resulting log in your next reply.

 

[blue_mike]

I currently have Microsoft Security Essentials, MalwareBytes(free version), WOT, and Ad Block plus installed.

 

MiniToolBox by Farbar  Version: 21-07-2014
Ran by Mike (administrator) on 10-09-2014 at 19:09:50
Running from "C:\Users\Mike\Downloads"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
***************************************************************************

========================= Event log errors: ===============================

Application errors:
==================
Error: (09/10/2014 01:18:55 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 8081

Error: (09/10/2014 01:18:55 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 8081

Error: (09/10/2014 01:18:55 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/10/2014 01:18:54 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7067

Error: (09/10/2014 01:18:54 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 7067

Error: (09/10/2014 01:18:54 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/10/2014 01:18:53 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6053

Error: (09/10/2014 01:18:53 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6053

Error: (09/10/2014 01:18:53 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/10/2014 01:18:52 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5055


System errors:
=============
Error: (09/09/2014 02:35:08 PM) (Source: Service Control Manager) (User: )
Description: The Adobe Acrobat Update Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (09/08/2014 04:26:03 PM) (Source: DCOM) (User: )
Description: {ED1D0FDF-4414-470A-A56D-CFB68623FC58}

Error: (09/07/2014 08:05:20 PM) (Source: Service Control Manager) (User: )
Description: The Server service terminated with the following error:
%%13

Error: (09/07/2014 08:05:18 PM) (Source: Service Control Manager) (User: )
Description: The WinHTTP Web Proxy Auto-Discovery Service service failed to start due to the following error:
%%1069

Error: (09/07/2014 08:05:18 PM) (Source: Service Control Manager) (User: )
Description: The WinHttpAutoProxySvc service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error:
%%1352

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Error: (09/05/2014 00:17:11 AM) (Source: EventLog) (User: )
Description: The previous system shutdown at 8:02:45 PM on ‎9/‎4/‎2014 was unexpected.

Error: (09/02/2014 08:07:50 PM) (Source: Microsoft Antimalware) (User: )
Description: %%860 Real-Time Protection feature has encountered an error and failed.

    Feature: %%886

    Error Code: 0x80070002

    Error description: The system cannot find the file specified.

    Reason: %%858

Error: (09/02/2014 03:56:23 PM) (Source: Microsoft Antimalware) (User: )
Description: %%860 Real-Time Protection feature has encountered an error and failed.

    Feature: %%886

    Error Code: 0x80070002

    Error description: The system cannot find the file specified.

    Reason: %%892

Error: (09/01/2014 04:35:40 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Definition Update for Microsoft Security Essentials - KB2310138 (Definition 1.183.1275.0).

Error: (09/01/2014 04:35:28 PM) (Source: Microsoft Antimalware) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.

    New Signature Version:

    Previous Signature Version: 1.183.1275.0

    Update Source: %NT AUTHORITY59

    Update Stage: 4.5.0216.00

    Source Path: 4.5.0216.01

    Signature Type: %NT AUTHORITY602

    Update Type: %NT AUTHORITY604

    User: NT AUTHORITY\SYSTEM

    Current Engine Version: %NT AUTHORITY605

    Previous Engine Version: %NT AUTHORITY606

    Error code: %NT AUTHORITY607

    Error description: %NT AUTHORITY608


Microsoft Office Sessions:
=========================
Error: (09/10/2014 01:18:55 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 8081

Error: (09/10/2014 01:18:55 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 8081

Error: (09/10/2014 01:18:55 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/10/2014 01:18:54 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7067

Error: (09/10/2014 01:18:54 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 7067

Error: (09/10/2014 01:18:54 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/10/2014 01:18:53 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6053

Error: (09/10/2014 01:18:53 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6053

Error: (09/10/2014 01:18:53 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/10/2014 01:18:52 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5055


CodeIntegrity Errors:
===================================
  Date: 2013-04-21 20:53:11.300
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-04-21 20:53:11.249
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.



=========================== Installed Programs ============================
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.179 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
AI Suite II (HKLM-x32\...\{34D3688E-A737-44C5-9E2A-FF73618728E1}) (Version: 1.01.32 - ASUSTeK Computer Inc.)
AMD Accelerated Video Transcoding (Version: 12.5.100.21219 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{20384EBF-4F10-13F0-07C6-7A6C87FD83DF}) (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - ATI Technologies Inc.) Hidden
AMD Fuel (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.71219.1540 - Advanced Micro Devices, Inc.) Hidden
AMD Steady Video Plug-In  (Version: 2.06.0000 - AMD) Hidden
AMD VISION Engine Control Center (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.10.0.0 - Asmedia Technology)
Blueline 1.1.1 (HKLM-x32\...\Blueline_is1) (Version:  - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version:  - )
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.3.5.0 - Canon Inc.)
Canon IJ Network Scan Utility (HKLM-x32\...\Canon_IJ_Network_Scan_UTILITY) (Version:  - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version:  - )
Canon MG5200 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5200_series) (Version:  - )
Canon MG5200 series User Registration (HKLM-x32\...\Canon MG5200 series User Registration) (Version:  - )
Canon MP Navigator EX 4.0 (HKLM-x32\...\MP Navigator EX 4.0) (Version:  - )
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version:  - )
Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version:  - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.10 - Piriform)
CivCity (HKLM-x32\...\{994E24A6-EC47-4201-8D0B-D4563B7AD66B}) (Version: 1.00.0000 - Firefly Studios)
Farming Simulator 2011 (HKLM-x32\...\FarmingSimulator2011EN_is1) (Version: 1.0 - GIANTS Software)
GameShadow (HKLM-x32\...\{5A2F371F-8B5D-46B4-833C-0612B065BEC7}) (Version: 2.02.0000 - GameShadow Ltd)
Hercules Classic Silver Webcam (HKLM-x32\...\{FD4FE0F7-91FC-43A2-9C3A-187553991FFF}) (Version: 2.8.0.0 - Hercules)
iTunes (HKLM\...\{77DE5105-D05E-448C-96CB-7FA381903753}) (Version: 11.3.1.2 - Apple Inc.)
LG USB Modem driver (HKLM-x32\...\{C3ABE126-2BB2-4246-BFE1-6797679B3579}) (Version:  - )
Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office 2000 Premium (HKLM-x32\...\{00000409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable - KB2467175 (HKLM-x32\...\{a0fe116e-9a8a-466f-aee0-625cb7c207e3}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Mozilla Firefox 31.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 en-US)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
Prison Tycoon 3 (HKLM-x32\...\{D835509F-76A1-46ED-8869-D906C82D0780}) (Version: 1.00.0000 - Valusoft)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.46.610.2011 - Realtek)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version:  - )

**** End of log ****