Sorry, no luck. In fact, as soon as I clicked 'download' the security message popped up.
I have noticed that the computer seems to be running better.
Here's the fix log that I ran first today:
All processes killed
========== COMMANDS ==========
System Restore Service not available.
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\DusutIfazz deleted successfully.
File move failed. C:\Windows\SysWOW64\regsvr32.exe scheduled to be moved on reboot.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Faigxevyirnu deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\fwcflu32 deleted successfully.
C:\Users\Judy\AppData\Local\Temp\DHCPprxy.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ivijios deleted successfully.
C:\Users\Judy\AppData\Local\ivijios.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Rsugiwopzzep deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Svc2dll deleted successfully.
C:\Users\Judy\AppData\Local\svcxdcl32.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\UujfaVojaf deleted successfully.
File move failed. C:\Windows\SysWOW64\regsvr32.exe scheduled to be moved on reboot.
========== FILES ==========
C:\Users\Judy\AppData\Roaming\PictureMover\Log folder moved successfully.
C:\Users\Judy\AppData\Roaming\PictureMover\Bin folder moved successfully.
C:\Users\Judy\AppData\Roaming\PictureMover folder moved successfully.
C:\Users\Judy\AppData\Roaming\MyFamily.com\FTW\13 folder moved successfully.
C:\Users\Judy\AppData\Roaming\MyFamily.com\FTW folder moved successfully.
C:\Users\Judy\AppData\Roaming\MyFamily.com folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\{6ED5EACF-F59D-D096-EF82-F90493D63D78} folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Windows\Themes folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Windows\PrivacIE folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Windows\IETldCache folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Windows\IEDownloadHistory folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Windows\iecompatuaCache folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Windows\IECompatCache folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Windows\DNTException folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Windows folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\SystemCertificates\My folder moved successfully.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft\SystemCertificates scheduled to be moved on reboot.
C:\Users\Judy\AppData\Roaming\Microsoft\Spelling\en-US folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Spelling folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Protect\S-1-5-21-977744973-2552835015-2244764293-1001 folder moved successfully.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft\Protect scheduled to be moved on reboot.
C:\Users\Judy\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Network\Connections\Pbk folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Network\Connections folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Network folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Internet Explorer\UserData folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Internet Explorer folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-977744973-2552835015-2244764293-1001 folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Crypto\RSA folder moved successfully.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft\Crypto scheduled to be moved on reboot.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft\Credentials scheduled to be moved on reboot.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft scheduled to be moved on reboot.
C:\Users\Judy\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s.ytimg.com folder moved successfully.
C:\Users\Judy\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#foodplanet.thesyndicationserver.co.uk folder moved successfully.
C:\Users\Judy\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys folder moved successfully.
C:\Users\Judy\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer folder moved successfully.
C:\Users\Judy\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support folder moved successfully.
C:\Users\Judy\AppData\Roaming\Macromedia\Flash Player\macromedia.com folder moved successfully.
C:\Users\Judy\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\DKJLSA6E\vox-static.liverail.com folder moved successfully.
C:\Users\Judy\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\DKJLSA6E\s.ytimg.com folder moved successfully.
C:\Users\Judy\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\DKJLSA6E\foodplanet.thesyndicationserver.co.uk\SyndPlugins\flowplayer.unlimited-3.2.16_thesyndicationserver.co.uk.swf folder moved successfully.
C:\Users\Judy\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\DKJLSA6E\foodplanet.thesyndicationserver.co.uk\SyndPlugins folder moved successfully.
C:\Users\Judy\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\DKJLSA6E\foodplanet.thesyndicationserver.co.uk folder moved successfully.
C:\Users\Judy\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\DKJLSA6E\cdn-static.liverail.com folder moved successfully.
C:\Users\Judy\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\DKJLSA6E folder moved successfully.
C:\Users\Judy\AppData\Roaming\Macromedia\Flash Player\#SharedObjects folder moved successfully.
C:\Users\Judy\AppData\Roaming\Macromedia\Flash Player folder moved successfully.
C:\Users\Judy\AppData\Roaming\Macromedia folder moved successfully.
C:\Users\Judy\AppData\Roaming\Intuit\Quicken\Log folder moved successfully.
C:\Users\Judy\AppData\Roaming\Intuit\Quicken\Data folder moved successfully.
C:\Users\Judy\AppData\Roaming\Intuit\Quicken\Config folder moved successfully.
C:\Users\Judy\AppData\Roaming\Intuit\Quicken folder moved successfully.
C:\Users\Judy\AppData\Roaming\Intuit folder moved successfully.
C:\Users\Judy\AppData\Roaming\Hewlett-Packard\HP Support Framework folder moved successfully.
C:\Users\Judy\AppData\Roaming\Hewlett-Packard folder moved successfully.
C:\Users\Judy\AppData\Roaming\Google\Local Search History folder moved successfully.
C:\Users\Judy\AppData\Roaming\Google folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\WordPerfect Office X4\User Config folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\WordPerfect Office X4\DateTime folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\WordPerfect Office X4 folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\WordPerfect\14\EN\Labels folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\WordPerfect\14\EN folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\WordPerfect\14 folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\WordPerfect folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\PerfectScript\14\EN\WordPerfect folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\PerfectScript\14\EN folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\PerfectScript\14 folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\PerfectScript folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\PerfectExpert\14\EN\Custom WP Templates\XML folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\PerfectExpert\14\EN\Custom WP Templates folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\PerfectExpert\14\EN folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\PerfectExpert\14 folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\PerfectExpert folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\Messages\540232237_807010 folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel\Messages folder moved successfully.
C:\Users\Judy\AppData\Roaming\Corel folder moved successfully.
C:\Users\Judy\AppData\Roaming\Apple Computer\Preferences folder moved successfully.
C:\Users\Judy\AppData\Roaming\Apple Computer\Logs folder moved successfully.
C:\Users\Judy\AppData\Roaming\Apple Computer\iTunes\iTunes Plug-ins folder moved successfully.
C:\Users\Judy\AppData\Roaming\Apple Computer\iTunes\Cookies folder moved successfully.
C:\Users\Judy\AppData\Roaming\Apple Computer\iTunes folder moved successfully.
C:\Users\Judy\AppData\Roaming\Apple Computer folder moved successfully.
C:\Users\Judy\AppData\Roaming\Adobe\Flash Player\NativeCache folder moved successfully.
C:\Users\Judy\AppData\Roaming\Adobe\Flash Player\AssetCache\DBEZKWE9 folder moved successfully.
C:\Users\Judy\AppData\Roaming\Adobe\Flash Player\AssetCache folder moved successfully.
C:\Users\Judy\AppData\Roaming\Adobe\Flash Player folder moved successfully.
C:\Users\Judy\AppData\Roaming\Adobe folder moved successfully.
Folder move failed. C:\Users\Judy\AppData\Roaming scheduled to be moved on reboot.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Judy
->Temp folder emptied: 2886000 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 15650 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 12748 bytes
Total Files Cleaned = 3.00 mb
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
OTL by OldTimer - Version 3.2.69.0 log created on 11062014_181400
Files\Folders moved on Reboot...
File move failed. C:\Windows\SysWOW64\regsvr32.exe scheduled to be moved on reboot.
C:\Users\Judy\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\SystemCertificates\My folder moved successfully.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft\SystemCertificates scheduled to be moved on reboot.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft\Protect scheduled to be moved on reboot.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft\Crypto scheduled to be moved on reboot.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft\Credentials scheduled to be moved on reboot.
C:\Users\Judy\AppData\Roaming\Microsoft\{6ED5EACF-F59D-D096-EF82-F90493D63D78} folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Windows\Themes folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Windows\PrivacIE folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Windows\IETldCache folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Windows\IEDownloadHistory folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Windows\DNTException folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Windows folder moved successfully.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft\SystemCertificates scheduled to be moved on reboot.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft\Protect scheduled to be moved on reboot.
C:\Users\Judy\AppData\Roaming\Microsoft\Internet Explorer\UserData folder moved successfully.
C:\Users\Judy\AppData\Roaming\Microsoft\Internet Explorer folder moved successfully.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft\Crypto scheduled to be moved on reboot.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft\Credentials scheduled to be moved on reboot.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft\SystemCertificates scheduled to be moved on reboot.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft\Protect scheduled to be moved on reboot.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft\Crypto scheduled to be moved on reboot.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft\Credentials scheduled to be moved on reboot.
Folder move failed. C:\Users\Judy\AppData\Roaming\Microsoft scheduled to be moved on reboot.
C:\Users\Judy\AppData\Roaming\Hewlett-Packard\HP Support Framework folder moved successfully.
C:\Users\Judy\AppData\Roaming\Hewlett-Packard folder moved successfully.
Folder move failed. C:\Users\Judy\AppData\Roaming scheduled to be moved on reboot.
File\Folder C:\Users\Judy\AppData\Local\Temp\etilqs_4F5bENvvvdL9JACdn3ee not found!
File\Folder C:\Users\Judy\AppData\Local\Temp\fla2684.tmp not found!
File\Folder C:\Users\Judy\AppData\Local\Temp\fla2A3C.tmp not found!
File\Folder C:\Users\Judy\AppData\Local\Temp\fla5D6B.tmp not found!
File\Folder C:\Users\Judy\AppData\Local\Temp\fla6805.tmp not found!
File\Folder C:\Users\Judy\AppData\Local\Temp\flaD8E2.tmp not found!
C:\Users\Judy\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Here's the scan log:
OTL logfile created on: 11/6/2014 7:37:34 PM - Run 5
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Judy\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17358)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.99 Gb Total Physical Memory | 2.63 Gb Available Physical Memory | 66.03% Memory free
7.98 Gb Paging File | 6.56 Gb Available in Paging File | 82.23% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 584.24 Gb Total Space | 511.05 Gb Free Space | 87.47% Space Free | Partition Type: NTFS
Drive D: | 11.83 Gb Total Space | 2.16 Gb Free Space | 18.28% Space Free | Partition Type: NTFS
Computer Name: JUDY-PC | User Name: Judy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2014/11/01 10:00:20 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Judy\Downloads\OTL.exe
========== Modules (No Company Name) ==========
========== Services (SafeList) ==========
SRV:64bit: - [2014/09/18 19:25:49 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:64bit: - [2013/05/26 23:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/03/27 12:10:16 | 000,016,896 | ---- | M] (LSI Corporation) [Auto | Running] -- C:\Program Files\LSI SoftModem\agr64svc.exe -- (AgereModemAudio)
SRV - [2014/09/23 17:58:11 | 000,267,440 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2014/09/12 03:43:06 | 000,064,704 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2014/03/20 16:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2013/11/04 17:31:56 | 000,092,160 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe -- (HP Support Assistant Service)
SRV - [2013/09/11 21:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/07/28 15:36:52 | 000,246,520 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2008/11/09 14:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2007/07/24 13:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2014/07/28 13:52:00 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012/08/21 12:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012/03/01 00:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/03/11 00:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 00:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 07:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 05:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2009/07/13 19:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 19:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 19:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 08:31:42 | 000,233,472 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009/07/09 04:38:42 | 001,208,320 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem)
DRV:64bit: - [2009/06/16 05:32:14 | 006,112,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009/06/10 14:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 14:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 14:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 14:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009/07/13 19:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...bestbuy&pf=cndt
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn15\yt.dll (Yahoo! Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IESR02
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/04/30 19:37:31 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/04/30 19:37:31 | 000,000,000 | ---D | M]
O1 HOSTS File: ([2014/11/06 18:18:03 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn15\yt.dll (Yahoo! Inc.)
O2 - BHO: (hpBHO Class) - {ABD3B5E1-B268-407B-A150-2641DAB8D898} - C:\Program Files (x86)\Common Files\Homepage Protection\HomepageProtection.dll (AOL Products)
O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0560.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll (Yahoo! Inc)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0560.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn15\yt.dll (Yahoo! Inc.)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [HP Remote Solution] C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe ()
O4 - HKLM..\Run: [hpsysdrv] c:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe (Symantec Corporation)
O4 - HKLM..\Run: [QuickFinder Scheduler] c:\Program Files (x86)\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE (Corel Corporation)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: [Amazon Cloud Player] "C:\Users\Judy\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe" File not found
O4:64bit: - HKLM..\RunOnce: [NCPluginUpdater] C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe (Hewlett-Packard)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8:64bit: - Extra context menu item: Open with WordPerfect - c:\Program Files (x86)\Corel\WordPerfect Office X4\Programs\WPLauncher.hta ()
O8 - Extra context menu item: Open with WordPerfect - c:\Program Files (x86)\Corel\WordPerfect Office X4\Programs\WPLauncher.hta ()
O9:64bit: - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{478427F3-E4A6-4105-A5B2-AD736A740BB3}: DhcpNameServer = 209.18.47.61 209.18.47.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{478427F3-E4A6-4105-A5B2-AD736A740BB3}: NameServer = 8.8.8.8,8.8.8.8
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2014/11/06 19:18:33 | 000,000,000 | ---D | C] -- C:\Users\Judy\AppData\Roaming\Macromedia
[2014/11/06 19:18:15 | 000,000,000 | ---D | C] -- C:\Users\Judy\AppData\Roaming\Google
[2014/11/06 19:18:14 | 000,000,000 | ---D | C] -- C:\Users\Judy\AppData\Roaming\Adobe
[2014/11/06 19:17:33 | 000,000,000 | ---D | C] -- C:\Users\Judy\AppData\Roaming\PictureMover
[2014/11/06 19:17:32 | 000,000,000 | ---D | C] -- C:\Users\Judy\AppData\Roaming\Apple Computer
[2014/11/05 21:45:03 | 000,000,000 | ---D | C] -- C:\Users\Judy\AppData\Local\Apple Computer
[2014/11/05 20:20:24 | 000,000,000 | ---D | C] -- C:\Users\Judy\AppData\Local\Microsoft Games
[2014/11/04 19:27:54 | 000,000,000 | ---D | C] -- C:\ProgramData\DusutIfazz
[2014/11/04 19:27:53 | 000,000,000 | ---D | C] -- C:\ProgramData\UujfaVojaf
[2014/11/04 18:15:29 | 000,000,000 | ---D | C] -- C:\Users\Judy\AppData\Local\Google
[2014/11/04 18:13:01 | 000,000,000 | -HSD | C] -- C:\Users\Judy\AppData\Local\EmieUserList
[2014/11/04 18:13:01 | 000,000,000 | -HSD | C] -- C:\Users\Judy\AppData\Local\EmieSiteList
[2014/11/04 18:12:53 | 000,000,000 | ---D | C] -- C:\Users\Judy\AppData\Local\VirtualStore
[2014/11/04 18:10:51 | 000,000,000 | ---D | C] -- C:\Users\Judy\AppData\Local\Hewlett-Packard
[2014/11/03 17:10:08 | 000,000,000 | ---D | C] -- C:\_OTL
[2014/10/28 19:07:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Windows Genuine Advantage
[2014/10/16 20:18:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2014/10/16 20:18:02 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2014/10/16 20:18:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2014/10/16 20:18:02 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2007/01/03 16:35:00 | 001,077,248 | ---- | C] (Amyuni Technologies
http://www.amyuni.com) -- C:\Program Files (x86)\cdintf210.dll
[2006/12/21 04:00:00 | 001,081,344 | ---- | C] (Amyuni Technologies
http://www.amyuni.com) -- C:\Program Files (x86)\cdintf.dll
[2006/12/21 03:58:00 | 000,191,608 | ---- | C] (AMYUNI Technologies
http://www.amyuni.com) -- C:\Program Files (x86)\acfpdfui.dll
[2006/12/21 03:57:00 | 000,163,789 | ---- | C] (AMYUNI Technologies
http://www.amyuni.com) -- C:\Program Files (x86)\acfpdfu.dll
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2014/11/06 19:18:14 | 000,018,736 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014/11/06 19:18:14 | 000,018,736 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014/11/06 19:11:04 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014/11/06 19:10:56 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014/11/06 19:10:51 | 3212,713,984 | -HS- | M] () -- C:\hiberfil.sys
[2014/11/06 19:00:01 | 000,000,800 | ---- | M] () -- C:\Windows\tasks\Security Center Update - 3835951123.job
[2014/11/06 19:00:01 | 000,000,798 | ---- | M] () -- C:\Windows\tasks\Security Center Update - 2575515691.job
[2014/11/06 18:58:31 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014/11/06 18:54:01 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014/11/06 18:18:03 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts
[2014/11/06 18:09:28 | 000,000,081 | ---- | M] () -- C:\Users\Judy\AppData\Local\svcxdcl32.dat
[2014/11/05 21:52:08 | 000,000,074 | ---- | M] () -- C:\Windows\MPLAYER.INI
[2014/11/05 21:44:32 | 000,000,848 | -HS- | M] () -- C:\ProgramData\KGyGaAvL.sys
[2014/11/04 17:29:33 | 000,001,104 | -H-- | M] () -- C:\ProgramData\@system2.att
[2014/11/04 17:29:17 | 000,001,368 | ---- | M] () -- C:\ProgramData\@system.att
[2014/11/02 16:33:22 | 000,801,092 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2014/11/02 16:33:22 | 000,674,826 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2014/11/02 16:33:22 | 000,128,100 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2014/11/02 14:19:19 | 000,000,160 | -H-- | M] () -- C:\ProgramData\@system3.att
[2014/11/02 14:19:01 | 000,000,424 | ---- | M] () -- C:\ProgramData\@system.temp
[2014/11/01 15:13:41 | 000,000,328 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForJudy.job
[2014/11/01 10:00:54 | 000,001,087 | ---- | M] () -- C:\Users\Judy\Desktop\OTL - Shortcut.lnk
[2014/10/17 15:58:58 | 000,401,464 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2014/10/16 20:18:39 | 000,001,785 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
========== Files Created - No Company Name ==========
[2014/11/05 21:44:32 | 000,000,848 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2014/11/05 21:42:35 | 000,000,074 | ---- | C] () -- C:\Windows\MPLAYER.INI
[2014/11/04 19:28:09 | 000,000,081 | ---- | C] () -- C:\Users\Judy\AppData\Local\svcxdcl32.dat
[2014/11/03 18:07:31 | 000,001,104 | -H-- | C] () -- C:\ProgramData\@system2.att
[2014/11/03 18:07:03 | 000,001,368 | ---- | C] () -- C:\ProgramData\@system.att
[2014/11/01 14:59:33 | 000,000,798 | ---- | C] () -- C:\Windows\tasks\Security Center Update - 2575515691.job
[2014/11/01 14:58:37 | 000,000,800 | ---- | C] () -- C:\Windows\tasks\Security Center Update - 3835951123.job
[2014/11/01 14:55:09 | 000,000,160 | -H-- | C] () -- C:\ProgramData\@system3.att
[2014/11/01 14:54:40 | 000,000,424 | ---- | C] () -- C:\ProgramData\@system.temp
[2014/11/01 10:00:54 | 000,001,087 | ---- | C] () -- C:\Users\Judy\Desktop\OTL - Shortcut.lnk
[2014/10/16 20:18:39 | 000,001,785 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2014/02/25 22:06:40 | 000,793,214 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/03/27 11:47:19 | 002,249,968 | ---- | C] () -- C:\Users\Judy\AppData\Local\tmp001.0
[2011/03/27 11:47:19 | 000,393,296 | ---- | C] () -- C:\Users\Judy\AppData\Local\tmp001.JPG
[2010/12/25 17:05:36 | 001,510,507 | ---- | C] () -- C:\Users\Judy\AppData\Local\tmpPHOTO[1].0
[2010/12/25 17:05:36 | 000,499,408 | ---- | C] () -- C:\Users\Judy\AppData\Local\tmpPHOTO[1].JPG
[2010/12/01 20:55:07 | 002,336,768 | ---- | C] () -- C:\Users\Judy\AppData\Local\tmpTABLES 001.JPG
[2010/11/26 17:46:24 | 000,351,280 | ---- | C] () -- C:\Users\Judy\AppData\Local\tmpPHOTO.JPG
[2010/11/26 17:23:38 | 001,183,836 | ---- | C] () -- C:\Users\Judy\AppData\Local\tmpPHOTO.0
[2010/08/16 18:30:46 | 000,861,925 | ---- | C] () -- C:\Users\Judy\AppData\Local\tmpSCAN0001.1
[2010/08/16 18:30:45 | 001,992,325 | ---- | C] () -- C:\Users\Judy\AppData\Local\tmpSCAN0001.0
[2010/08/16 18:30:45 | 000,858,832 | ---- | C] () -- C:\Users\Judy\AppData\Local\tmpSCAN0001.JPG
[2010/05/10 17:18:24 | 000,117,261 | ---- | C] () -- C:\Users\Judy\AppData\Local\tmpSF-AMY-LEIGH-ANDREWS.0
[2010/05/10 17:18:24 | 000,063,968 | ---- | C] () -- C:\Users\Judy\AppData\Local\tmpSF-AMY-LEIGH-ANDREWS.JPG
========== ZeroAccess Check ==========
[2009/07/13 22:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2014/06/24 20:05:42 | 014,175,744 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2014/06/24 19:41:30 | 012,874,240 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 19:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 06:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 19:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2014/11/06 19:17:34 | 000,000,000 | ---D | M] -- C:\Users\Judy\AppData\Roaming\PictureMover
========== Purity Check ==========
========== Files - Unicode (All) ==========
[2014/10/28 19:08:58 | 000,000,448 | -H-- | M] ()(C:\Users\Judy\AppData\Roaming\????) -- C:\Users\Judy\AppData\Roaming\麽鎒駓覜
[2014/10/28 19:08:58 | 000,000,448 | -H-- | C] ()(C:\Users\Judy\AppData\Roaming\????) -- C:\Users\Judy\AppData\Roaming\麽鎒駓覜
< End of report >