API tools faq
paste
silentcommit

new otl log

silentcommit
Sep 14th, 2013
222
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 195.46 KB | None | 0 0
raw download clone embed print report
  1. OTL logfile created on: 9/14/2013 10:40:20 AM - Run 4
  2. OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Carrie\Desktop
  3. 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
  4. Internet Explorer (Version = 9.0.8112.16421)
  5. Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
  6.  
  7. 2.60 Gb Total Physical Memory | 1.65 Gb Available Physical Memory | 63.36% Memory free
  8. 5.20 Gb Paging File | 4.15 Gb Available in Paging File | 79.81% Paging File free
  9. Paging file location(s): ?:\pagefile.sys [binary data]
  10.  
  11. %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
  12. Drive C: | 285.29 Gb Total Space | 223.58 Gb Free Space | 78.37% Space Free | Partition Type: NTFS
  13.  
  14. Computer Name: CARRIE-PC | User Name: Carrie | Logged in as Administrator.
  15. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
  16. Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
  17.  
  18. [color=#E56717]========== Processes (SafeList) ==========[/color]
  19.  
  20. PRC - [2013/09/10 19:31:03 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Carrie\Desktop\OTL.scr
  21. PRC - [2013/05/09 03:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
  22. PRC - [2013/05/09 03:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
  23. PRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
  24. PRC - [2013/03/22 06:07:18 | 000,093,072 | ---- | M] (TomTom) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
  25. PRC - [2011/12/07 07:13:32 | 000,135,608 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.10.26\SymcPCCULaunchSvc.exe
  26. PRC - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
  27.  
  28.  
  29. [color=#E56717]========== Modules (No Company Name) ==========[/color]
  30.  
  31.  
  32. [color=#E56717]========== Services (SafeList) ==========[/color]
  33.  
  34. SRV:[b]64bit:[/b] - [2013/06/09 16:05:18 | 001,900,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe -- (OfficeSvc)
  35. SRV:[b]64bit:[/b] - [2013/05/09 03:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
  36. SRV:[b]64bit:[/b] - [2011/02/10 14:52:04 | 000,203,776 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
  37. SRV:[b]64bit:[/b] - [2010/10/20 16:41:50 | 000,138,656 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
  38. SRV:[b]64bit:[/b] - [2010/09/28 14:30:28 | 000,489,384 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
  39. SRV:[b]64bit:[/b] - [2010/09/22 20:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
  40. SRV:[b]64bit:[/b] - [2010/02/05 19:44:48 | 000,137,560 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
  41. SRV:[b]64bit:[/b] - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
  42. SRV:[b]64bit:[/b] - [2009/04/28 09:58:54 | 000,029,184 | ---- | M] () [Auto | Stopped] -- C:\windows\SysNative\spool\DRIVERS\x64\3\\lxdqserv.exe -- (lxdqCATSCustConnectService)
  43. SRV:[b]64bit:[/b] - [2007/11/28 15:51:42 | 001,039,872 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxdqcoms.exe -- (lxdq_device)
  44. SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
  45. SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
  46. SRV - [2013/03/22 06:07:18 | 000,093,072 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
  47. SRV - [2013/01/08 13:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
  48. SRV - [2011/12/07 07:13:32 | 000,135,608 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.10.26\SymcPCCULaunchSvc.exe -- (Norton PC Checkup Application Launcher)
  49. SRV - [2011/02/03 14:50:10 | 000,126,392 | R--- | M] (Symantec Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.10.26\ccSvcHst.exe -- (PCCUJobMgr)
  50. SRV - [2010/10/12 12:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
  51. SRV - [2010/07/01 12:59:02 | 000,051,576 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
  52. SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
  53. SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
  54. SRV - [2009/04/28 09:58:54 | 000,029,184 | ---- | M] () [Auto | Stopped] -- C:\windows\system32\spool\DRIVERS\x64\3\\lxdqserv.exe -- (lxdqCATSCustConnectService)
  55.  
  56.  
  57. [color=#E56717]========== Driver Services (SafeList) ==========[/color]
  58.  
  59. DRV:[b]64bit:[/b] - [2013/08/31 18:58:58 | 001,030,952 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
  60. DRV:[b]64bit:[/b] - [2013/08/31 18:58:58 | 000,378,944 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\windows\SysNative\drivers\aswSP.sys -- (aswSP)
  61. DRV:[b]64bit:[/b] - [2013/08/31 18:58:58 | 000,189,936 | ---- | M] () [Kernel | Boot | Running] -- C:\windows\SysNative\drivers\aswVmm.sys -- (aswVmm)
  62. DRV:[b]64bit:[/b] - [2013/05/09 03:59:07 | 000,072,016 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
  63. DRV:[b]64bit:[/b] - [2013/05/09 03:59:07 | 000,065,336 | ---- | M] () [Kernel | Boot | Running] -- C:\windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)
  64. DRV:[b]64bit:[/b] - [2013/05/09 03:59:07 | 000,064,288 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
  65. DRV:[b]64bit:[/b] - [2013/05/09 03:59:06 | 000,080,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
  66. DRV:[b]64bit:[/b] - [2013/05/09 03:59:06 | 000,033,400 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
  67. DRV:[b]64bit:[/b] - [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
  68. DRV:[b]64bit:[/b] - [2012/03/01 01:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
  69. DRV:[b]64bit:[/b] - [2011/03/11 01:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
  70. DRV:[b]64bit:[/b] - [2011/03/11 01:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
  71. DRV:[b]64bit:[/b] - [2011/02/14 14:43:00 | 001,581,184 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
  72. DRV:[b]64bit:[/b] - [2011/02/10 15:22:00 | 008,283,136 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
  73. DRV:[b]64bit:[/b] - [2011/02/10 14:15:08 | 000,294,400 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
  74. DRV:[b]64bit:[/b] - [2011/02/08 21:07:00 | 000,038,096 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)
  75. DRV:[b]64bit:[/b] - [2011/01/05 03:08:58 | 001,109,096 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192ce.sys -- (RTL8192Ce)
  76. DRV:[b]64bit:[/b] - [2010/11/20 22:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
  77. DRV:[b]64bit:[/b] - [2010/11/20 22:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
  78. DRV:[b]64bit:[/b] - [2010/11/20 22:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
  79. DRV:[b]64bit:[/b] - [2010/11/05 09:52:54 | 000,038,016 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_xata.sys -- (amd_xata)
  80. DRV:[b]64bit:[/b] - [2010/11/05 09:52:52 | 000,075,904 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_sata.sys -- (amd_sata)
  81. DRV:[b]64bit:[/b] - [2010/10/08 13:49:08 | 000,243,712 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
  82. DRV:[b]64bit:[/b] - [2010/09/27 17:24:42 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)
  83. DRV:[b]64bit:[/b] - [2010/06/14 10:32:54 | 000,016,448 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TFsExDisk.sys -- (TFsExDisk)
  84. DRV:[b]64bit:[/b] - [2010/04/26 21:25:14 | 000,161,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_mdm.sys -- (ss_mdm)
  85. DRV:[b]64bit:[/b] - [2010/04/26 21:25:14 | 000,127,488 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bus.sys -- (ss_bus)
  86. DRV:[b]64bit:[/b] - [2010/04/26 21:25:14 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_mdfl.sys -- (ss_mdfl)
  87. DRV:[b]64bit:[/b] - [2009/07/30 22:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)
  88. DRV:[b]64bit:[/b] - [2009/07/14 17:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)
  89. DRV:[b]64bit:[/b] - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
  90. DRV:[b]64bit:[/b] - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
  91. DRV:[b]64bit:[/b] - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
  92. DRV:[b]64bit:[/b] - [2009/07/13 19:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
  93. DRV:[b]64bit:[/b] - [2009/07/13 19:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
  94. DRV:[b]64bit:[/b] - [2009/07/07 11:51:42 | 000,009,216 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\FwLnk.sys -- (FwLnk)
  95. DRV:[b]64bit:[/b] - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
  96. DRV:[b]64bit:[/b] - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
  97. DRV:[b]64bit:[/b] - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
  98. DRV:[b]64bit:[/b] - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
  99. DRV - [2010/06/14 10:32:54 | 000,016,448 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys -- (TFsExDisk)
  100. DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
  101.  
  102.  
  103. [color=#E56717]========== Standard Registry (All) ==========[/color]
  104.  
  105.  
  106. [color=#E56717]========== Internet Explorer ==========[/color]
  107.  
  108. IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  109. IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  110. IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
  111. IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
  112. IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
  113. IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  114. IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
  115. IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  116. IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {5E366834-ABF8-446B-829F-DD1CF5202D05}
  117. IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{5E366834-ABF8-446B-829F-DD1CF5202D05}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNF
  118. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  119. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  120. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
  121. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
  122. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
  123. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  124. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
  125. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  126. IE - HKLM\..\SearchScopes,DefaultScope =
  127. IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  128. IE - HKLM\..\SearchScopes\{167330B3-1CB8-4C46-93DD-3F2603B0E8E1}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNF
  129.  
  130.  
  131. IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
  132. IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  133.  
  134. IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
  135. IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  136.  
  137. IE - HKU\S-1-5-19\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
  138. IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
  139.  
  140. IE - HKU\S-1-5-20\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
  141. IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
  142. IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  143.  
  144. IE - HKU\S-1-5-21-3547224266-3633241506-1922221131-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.toshiba.com/g/
  145. IE - HKU\S-1-5-21-3547224266-3633241506-1922221131-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
  146. IE - HKU\S-1-5-21-3547224266-3633241506-1922221131-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  147. IE - HKU\S-1-5-21-3547224266-3633241506-1922221131-1001\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
  148. IE - HKU\S-1-5-21-3547224266-3633241506-1922221131-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.facebook.com/
  149. IE - HKU\S-1-5-21-3547224266-3633241506-1922221131-1001\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
  150. IE - HKU\S-1-5-21-3547224266-3633241506-1922221131-1001\..\SearchScopes,DefaultScope = {B85D1BC5-CDED-488B-8008-BF6DCB837424}
  151. IE - HKU\S-1-5-21-3547224266-3633241506-1922221131-1001\..\SearchScopes\{B85D1BC5-CDED-488B-8008-BF6DCB837424}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNF_en
  152. IE - HKU\S-1-5-21-3547224266-3633241506-1922221131-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  153. IE - HKU\S-1-5-21-3547224266-3633241506-1922221131-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
  154.  
  155.  
  156. [color=#E56717]========== FireFox ==========[/color]
  157.  
  158. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
  159. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
  160. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
  161. FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
  162. FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
  163. FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
  164. FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
  165. FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
  166. FF - HKLM\Software\MozillaPlugins\@microsoft.com/Lync,version=15.0: C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
  167. FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
  168. FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\NPSPWRAP.DLL (Microsoft Corporation)
  169. FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
  170. FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
  171. FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
  172. FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
  173. FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
  174. FF - HKCU\Software\MozillaPlugins\@nsroblox.roblox.com/launcher: C:\Program Files (x86)\Roblox\Versions\version-60f3df0d5a16441e\\NPRobloxProxy.dll ()
  175. FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Carrie\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
  176.  
  177.  
  178. [2013/04/03 21:28:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Carrie\AppData\Roaming\Mozilla\Extensions
  179. [2013/04/03 21:28:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Carrie\AppData\Roaming\Mozilla\Extensions\[email protected]
  180.  
  181. [color=#E56717]========== Chrome ==========[/color]
  182.  
  183. CHR - default_search_provider: Google (Enabled)
  184. CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
  185. CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
  186. CHR - homepage: http://mysearch.avg.com/?cid={8B748D9D-EED4-47E8-B212-6FB598386A83}&mid=696c9b3edd7647d3926ad16f2a2053e5-a05584d13206e4493aa386783604a1f5d423f1e9&lang=en&ds=am011&pr=sa&d=2013-07-12 22:29:42&v=15.3.0.11&pid=safeguard&sg=0&sap=hp
  187. CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.60\PepperFlash\pepflashplayer.dll
  188. CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\gcswf32.dll
  189. CHR - plugin: Shockwave Flash (Enabled) = C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll
  190. CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
  191. CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll
  192. CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\pdf.dll
  193. CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
  194. CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
  195. CHR - plugin: Java(TM) Platform SE 6 U20 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
  196. CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
  197. CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
  198. CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
  199. CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
  200. CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
  201. CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
  202. CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
  203. CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL
  204. CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll
  205. CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
  206. CHR - plugin: Unity Player (Enabled) = C:\Users\Carrie\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
  207. CHR - plugin: Shockwave for Director (Enabled) = C:\windows\SysWOW64\Adobe\Director\np32dsw.dll
  208. CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
  209. CHR - Extension: Chrome In-App Payments service = C:\Users\Carrie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0\
  210.  
  211. O1 HOSTS File: ([2012/07/28 21:08:45 | 000,443,881 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
  212. O1 - Hosts: 127.0.0.1 www.007guard.com
  213. O1 - Hosts: 127.0.0.1 007guard.com
  214. O1 - Hosts: 127.0.0.1 008i.com
  215. O1 - Hosts: 127.0.0.1 www.008k.com
  216. O1 - Hosts: 127.0.0.1 008k.com
  217. O1 - Hosts: 127.0.0.1 www.00hq.com
  218. O1 - Hosts: 127.0.0.1 00hq.com
  219. O1 - Hosts: 127.0.0.1 010402.com
  220. O1 - Hosts: 127.0.0.1 www.032439.com
  221. O1 - Hosts: 127.0.0.1 032439.com
  222. O1 - Hosts: 127.0.0.1 www.0scan.com
  223. O1 - Hosts: 127.0.0.1 0scan.com
  224. O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
  225. O1 - Hosts: 127.0.0.1 1000gratisproben.com
  226. O1 - Hosts: 127.0.0.1 1001namen.com
  227. O1 - Hosts: 127.0.0.1 www.1001namen.com
  228. O1 - Hosts: 127.0.0.1 100888290cs.com
  229. O1 - Hosts: 127.0.0.1 www.100888290cs.com
  230. O1 - Hosts: 127.0.0.1 www.100sexlinks.com
  231. O1 - Hosts: 127.0.0.1 100sexlinks.com
  232. O1 - Hosts: 127.0.0.1 www.10sek.com
  233. O1 - Hosts: 127.0.0.1 10sek.com
  234. O1 - Hosts: 127.0.0.1 www.1-2005-search.com
  235. O1 - Hosts: 127.0.0.1 1-2005-search.com
  236. O1 - Hosts: 127.0.0.1 www.123fporn.info
  237. O1 - Hosts: 15244 more lines...
  238. O2:[b]64bit:[/b] - BHO: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
  239. O2:[b]64bit:[/b] - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\OCHelper.dll (Microsoft Corporation)
  240. O2:[b]64bit:[/b] - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
  241. O2:[b]64bit:[/b] - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL (Microsoft Corporation)
  242. O2:[b]64bit:[/b] - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\office15\GROOVEEX.DLL (Microsoft Corporation)
  243. O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
  244. O2 - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
  245. O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
  246. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
  247. O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
  248. O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
  249. O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
  250. O2 - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
  251. O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
  252. O3:[b]64bit:[/b] - HKLM\..\Toolbar: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
  253. O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
  254. O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
  255. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
  256. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceActiveDesktopOn = 0
  257. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
  258. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
  259. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
  260. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
  261. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
  262. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
  263. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
  264. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
  265. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
  266. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
  267. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
  268. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
  269. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
  270. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
  271. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
  272. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
  273. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
  274. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
  275. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
  276. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
  277. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
  278. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
  279. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
  280. O7 - HKU\S-1-5-21-3547224266-3633241506-1922221131-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
  281. O8:[b]64bit:[/b] - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE (Microsoft Corporation)
  282. O8:[b]64bit:[/b] - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll (Microsoft Corporation)
  283. O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE (Microsoft Corporation)
  284. O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll (Microsoft Corporation)
  285. O9:[b]64bit:[/b] - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll (Microsoft Corporation)
  286. O9:[b]64bit:[/b] - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll (Microsoft Corporation)
  287. O9:[b]64bit:[/b] - Extra Button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\OCHelper.dll (Microsoft Corporation)
  288. O9:[b]64bit:[/b] - Extra 'Tools' menuitem : Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\OCHelper.dll (Microsoft Corporation)
  289. O9:[b]64bit:[/b] - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
  290. O9:[b]64bit:[/b] - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
  291. O9 - Extra Button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
  292. O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
  293. O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
  294. O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
  295. O9 - Extra Button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
  296. O9 - Extra 'Tools' menuitem : Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
  297. O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
  298. O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
  299. O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
  300. O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000001 [] - C:\Windows\SysNative\nlaapi.dll (Microsoft Corporation)
  301. O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000002 [] - C:\Windows\SysNative\NapiNSP.dll (Microsoft Corporation)
  302. O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000003 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
  303. O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000004 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
  304. O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
  305. O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Windows\SysNative\winrnr.dll (Microsoft Corporation)
  306. O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
  307. O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
  308. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
  309. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
  310. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
  311. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
  312. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
  313. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
  314. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
  315. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
  316. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000009 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
  317. O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000010 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
  318. O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\SysWOW64\nlaapi.dll (Microsoft Corporation)
  319. O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\SysWOW64\NapiNSP.dll (Microsoft Corporation)
  320. O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
  321. O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
  322. O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
  323. O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\SysWOW64\winrnr.dll (Microsoft Corporation)
  324. O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
  325. O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
  326. O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
  327. O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
  328. O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
  329. O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
  330. O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
  331. O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
  332. O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
  333. O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
  334. O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
  335. O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
  336. O13[b]64bit:[/b] - gopher Prefix: missing
  337. O13 - gopher Prefix: missing
  338. O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
  339. O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 10.25.2)
  340. O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} http://www.cvsphoto.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab (Photo Upload Plugin Class)
  341. O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
  342. O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 10.25.2)
  343. O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
  344. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{84C12B02-1015-4B74-9541-2E439C66FB89}: DhcpNameServer = 192.168.1.254
  345. O18:[b]64bit:[/b] - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
  346. O18:[b]64bit:[/b] - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
  347. O18:[b]64bit:[/b] - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
  348. O18:[b]64bit:[/b] - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
  349. O18:[b]64bit:[/b] - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
  350. O18:[b]64bit:[/b] - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
  351. O18:[b]64bit:[/b] - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
  352. O18:[b]64bit:[/b] - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
  353. O18:[b]64bit:[/b] - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
  354. O18:[b]64bit:[/b] - Protocol\Handler\livecall - No CLSID value found
  355. O18:[b]64bit:[/b] - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
  356. O18:[b]64bit:[/b] - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
  357. O18:[b]64bit:[/b] - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysNative\inetcomm.dll (Microsoft Corporation)
  358. O18:[b]64bit:[/b] - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
  359. O18:[b]64bit:[/b] - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
  360. O18:[b]64bit:[/b] - Protocol\Handler\msnim - No CLSID value found
  361. O18:[b]64bit:[/b] - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)
  362. O18:[b]64bit:[/b] - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
  363. O18:[b]64bit:[/b] - Protocol\Handler\skype4com - No CLSID value found
  364. O18:[b]64bit:[/b] - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
  365. O18:[b]64bit:[/b] - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
  366. O18:[b]64bit:[/b] - Protocol\Handler\wlmailhtml - No CLSID value found
  367. O18:[b]64bit:[/b] - Protocol\Handler\wlpg - No CLSID value found
  368. O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
  369. O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
  370. O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
  371. O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
  372. O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
  373. O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
  374. O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
  375. O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
  376. O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
  377. O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
  378. O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
  379. O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
  380. O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysWOW64\inetcomm.dll (Microsoft Corporation)
  381. O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
  382. O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
  383. O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
  384. O18 - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
  385. O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
  386. O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
  387. O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
  388. O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
  389. O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
  390. O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
  391. O18:[b]64bit:[/b] - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\windows\SysNative\mscoree.dll (Microsoft Corporation)
  392. O18:[b]64bit:[/b] - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\windows\SysNative\mscoree.dll (Microsoft Corporation)
  393. O18:[b]64bit:[/b] - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\windows\SysNative\mscoree.dll (Microsoft Corporation)
  394. O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\windows\SysWow64\mscoree.dll (Microsoft Corporation)
  395. O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\windows\SysWow64\mscoree.dll (Microsoft Corporation)
  396. O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\windows\SysWow64\mscoree.dll (Microsoft Corporation)
  397. O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
  398. O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
  399. O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
  400. O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
  401. O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
  402. O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
  403. O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  404. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  405. O29:[b]64bit:[/b] - HKLM SecurityProviders - (credssp.dll) - C:\windows\SysWow64\credssp.dll (Microsoft Corporation)
  406. O29 - HKLM SecurityProviders - (credssp.dll) - C:\windows\SysWow64\credssp.dll (Microsoft Corporation)
  407. O30:[b]64bit:[/b] - LSA: Authentication Packages - (msv1_0) - C:\windows\SysNative\msv1_0.dll (Microsoft Corporation)
  408. O30 - LSA: Authentication Packages - (msv1_0) - C:\windows\SysWow64\msv1_0.dll (Microsoft Corporation)
  409. O30:[b]64bit:[/b] - LSA: Security Packages - (kerberos) - C:\windows\SysNative\kerberos.dll (Microsoft Corporation)
  410. O30:[b]64bit:[/b] - LSA: Security Packages - (msv1_0) - C:\windows\SysNative\msv1_0.dll (Microsoft Corporation)
  411. O30:[b]64bit:[/b] - LSA: Security Packages - (schannel) - C:\windows\SysNative\schannel.dll (Microsoft Corporation)
  412. O30:[b]64bit:[/b] - LSA: Security Packages - (wdigest) - C:\windows\SysNative\wdigest.dll (Microsoft Corporation)
  413. O30:[b]64bit:[/b] - LSA: Security Packages - (tspkg) - C:\windows\SysNative\tspkg.dll (Microsoft Corporation)
  414. O30:[b]64bit:[/b] - LSA: Security Packages - (pku2u) - C:\windows\SysNative\pku2u.dll (Microsoft Corporation)
  415. O30:[b]64bit:[/b] - LSA: Security Packages - (livessp) - C:\windows\SysNative\livessp.dll (Microsoft Corp.)
  416. O30 - LSA: Security Packages - (kerberos) - C:\windows\SysWow64\kerberos.dll (Microsoft Corporation)
  417. O30 - LSA: Security Packages - (msv1_0) - C:\windows\SysWow64\msv1_0.dll (Microsoft Corporation)
  418. O30 - LSA: Security Packages - (schannel) - C:\windows\SysWow64\schannel.dll (Microsoft Corporation)
  419. O30 - LSA: Security Packages - (wdigest) - C:\windows\SysWow64\wdigest.dll (Microsoft Corporation)
  420. O30 - LSA: Security Packages - (tspkg) - C:\windows\SysWow64\tspkg.dll (Microsoft Corporation)
  421. O30 - LSA: Security Packages - (pku2u) - C:\windows\SysWow64\pku2u.dll (Microsoft Corporation)
  422. O30 - LSA: Security Packages - (livessp) - C:\windows\SysWow64\livessp.dll (Microsoft Corp.)
  423. O31 - SafeBoot: AlternateShell - cmd.exe
  424. O32 - HKLM CDRom: AutoRun - 1
  425. O33 - MountPoints2\{0b373d41-b926-11e0-a679-00266cc4ba16}\Shell - "" = AutoRun
  426. O33 - MountPoints2\{0b373d41-b926-11e0-a679-00266cc4ba16}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
  427. O34 - HKLM BootExecute: (autocheck autochk *)
  428. O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
  429. O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
  430. O35 - HKLM\..comfile [open] -- "%1" %*
  431. O35 - HKLM\..exefile [open] -- "%1" %*
  432. O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
  433. O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
  434. O37 - HKLM\...com [@ = comfile] -- "%1" %*
  435. O37 - HKLM\...exe [@ = exefile] -- "%1" %*
  436. O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
  437. O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
  438. O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
  439.  
  440.  
  441. MsConfig:64bit - StartUpReg: [b]00TCrdMain[/b] - hkey= - key= - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
  442. MsConfig:64bit - StartUpReg: [b]Allmyapps[/b] - hkey= - key= - C:\Users\Carrie\AppData\Roaming\Allmyapps\Allmyapps.exe ()
  443. MsConfig:64bit - StartUpReg: [b]Allmyapps Update[/b] - hkey= - key= - C:\Users\Carrie\AppData\Roaming\Allmyapps\AllmyappsUpdater.exe ()
  444. MsConfig:64bit - StartUpReg: [b]AutoStartNPSAgent[/b] - hkey= - key= - C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
  445. MsConfig:64bit - StartUpReg: [b]ETDCtrl[/b] - hkey= - key= - File not found
  446. MsConfig:64bit - StartUpReg: [b]HP Software Update[/b] - hkey= - key= - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Hewlett-Packard)
  447. MsConfig:64bit - StartUpReg: [b]Malwarebytes' Anti-Malware[/b] - hkey= - key= - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
  448. MsConfig:64bit - StartUpReg: [b]NortonOnlineBackupReminder[/b] - hkey= - key= - C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe (Toshiba)
  449. MsConfig:64bit - StartUpReg: [b]QuickTime Task[/b] - hkey= - key= - C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
  450. MsConfig:64bit - StartUpReg: [b]SmartAudio[/b] - hkey= - key= - C:\Program Files\CONEXANT\SAII\SAIICpl.exe (Conexant systems, Inc.)
  451. MsConfig:64bit - StartUpReg: [b]SmartFaceVWatcher[/b] - hkey= - key= - C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe (TOSHIBA Corporation)
  452. MsConfig:64bit - StartUpReg: [b]SmoothView[/b] - hkey= - key= - C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
  453. MsConfig:64bit - StartUpReg: [b]SpybotSD TeaTimer[/b] - hkey= - key= - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
  454. MsConfig:64bit - StartUpReg: [b]StartCCC[/b] - hkey= - key= - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
  455. MsConfig:64bit - StartUpReg: [b]SunJavaUpdateSched[/b] - hkey= - key= - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Oracle Corporation)
  456. MsConfig:64bit - StartUpReg: [b]swg[/b] - hkey= - key= - File not found
  457. MsConfig:64bit - StartUpReg: [b]TomTomHOME.exe[/b] - hkey= - key= - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
  458. MsConfig:64bit - StartUpReg: [b]ToshibaAppPlace[/b] - hkey= - key= - C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe (Toshiba)
  459. MsConfig:64bit - StartUpReg: [b]ToshibaServiceStation[/b] - hkey= - key= - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
  460. MsConfig:64bit - StartUpReg: [b]TosNC[/b] - hkey= - key= - C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)
  461. MsConfig:64bit - StartUpReg: [b]TosReelTimeMonitor[/b] - hkey= - key= - C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
  462. MsConfig:64bit - StartUpReg: [b]TosSENotify[/b] - hkey= - key= - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
  463. MsConfig:64bit - StartUpReg: [b]TosVolRegulator[/b] - hkey= - key= - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
  464. MsConfig:64bit - StartUpReg: [b]TPwrMain[/b] - hkey= - key= - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
  465. MsConfig:64bit - State: "services" - Reg Error: Key error.
  466. MsConfig:64bit - State: "startup" - Reg Error: Key error.
  467.  
  468. SafeBootMin:[b]64bit:[/b] 28440918.sys - Driver
  469. SafeBootMin:[b]64bit:[/b] 54436810.sys - Driver
  470. SafeBootMin:[b]64bit:[/b] Base - Driver Group
  471. SafeBootMin:[b]64bit:[/b] Boot Bus Extender - Driver Group
  472. SafeBootMin:[b]64bit:[/b] Boot file system - Driver Group
  473. SafeBootMin:[b]64bit:[/b] File system - Driver Group
  474. SafeBootMin:[b]64bit:[/b] Filter - Driver Group
  475. SafeBootMin:[b]64bit:[/b] HelpSvc - Service
  476. SafeBootMin:[b]64bit:[/b] PCI Configuration - Driver Group
  477. SafeBootMin:[b]64bit:[/b] PEVSystemStart - Service
  478. SafeBootMin:[b]64bit:[/b] PNP Filter - Driver Group
  479. SafeBootMin:[b]64bit:[/b] Primary disk - Driver Group
  480. SafeBootMin:[b]64bit:[/b] procexp90.Sys - Driver
  481. SafeBootMin:[b]64bit:[/b] sacsvr - Service
  482. SafeBootMin:[b]64bit:[/b] SCSI Class - Driver Group
  483. SafeBootMin:[b]64bit:[/b] System Bus Extender - Driver Group
  484. SafeBootMin:[b]64bit:[/b] vmms - Service
  485. SafeBootMin:[b]64bit:[/b] WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
  486. SafeBootMin:[b]64bit:[/b] {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
  487. SafeBootMin:[b]64bit:[/b] {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
  488. SafeBootMin:[b]64bit:[/b] {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
  489. SafeBootMin:[b]64bit:[/b] {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
  490. SafeBootMin:[b]64bit:[/b] {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
  491. SafeBootMin:[b]64bit:[/b] {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
  492. SafeBootMin:[b]64bit:[/b] {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
  493. SafeBootMin:[b]64bit:[/b] {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
  494. SafeBootMin:[b]64bit:[/b] {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
  495. SafeBootMin:[b]64bit:[/b] {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
  496. SafeBootMin:[b]64bit:[/b] {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
  497. SafeBootMin:[b]64bit:[/b] {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
  498. SafeBootMin:[b]64bit:[/b] {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
  499. SafeBootMin:[b]64bit:[/b] {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
  500. SafeBootMin:[b]64bit:[/b] {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
  501. SafeBootMin:[b]64bit:[/b] {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
  502. SafeBootMin:[b]64bit:[/b] {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
  503. SafeBootMin: 28440918.sys - Driver
  504. SafeBootMin: 54436810.sys - Driver
  505. SafeBootMin: Base - Driver Group
  506. SafeBootMin: Boot Bus Extender - Driver Group
  507. SafeBootMin: Boot file system - Driver Group
  508. SafeBootMin: File system - Driver Group
  509. SafeBootMin: Filter - Driver Group
  510. SafeBootMin: HelpSvc - Service
  511. SafeBootMin: PCI Configuration - Driver Group
  512. SafeBootMin: PEVSystemStart - Service
  513. SafeBootMin: PNP Filter - Driver Group
  514. SafeBootMin: Primary disk - Driver Group
  515. SafeBootMin: procexp90.Sys - Driver
  516. SafeBootMin: sacsvr - Service
  517. SafeBootMin: SCSI Class - Driver Group
  518. SafeBootMin: System Bus Extender - Driver Group
  519. SafeBootMin: vmms - Service
  520. SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
  521. SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
  522. SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
  523. SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
  524. SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
  525. SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
  526. SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
  527. SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
  528. SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
  529. SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
  530. SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
  531. SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
  532. SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
  533. SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
  534. SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
  535. SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
  536. SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
  537.  
  538. SafeBootNet:[b]64bit:[/b] 28440918.sys - Driver
  539. SafeBootNet:[b]64bit:[/b] 54436810.sys - Driver
  540. SafeBootNet:[b]64bit:[/b] Base - Driver Group
  541. SafeBootNet:[b]64bit:[/b] Boot Bus Extender - Driver Group
  542. SafeBootNet:[b]64bit:[/b] Boot file system - Driver Group
  543. SafeBootNet:[b]64bit:[/b] File system - Driver Group
  544. SafeBootNet:[b]64bit:[/b] Filter - Driver Group
  545. SafeBootNet:[b]64bit:[/b] HelpSvc - Service
  546. SafeBootNet:[b]64bit:[/b] Messenger - Service
  547. SafeBootNet:[b]64bit:[/b] NDIS Wrapper - Driver Group
  548. SafeBootNet:[b]64bit:[/b] NetBIOSGroup - Driver Group
  549. SafeBootNet:[b]64bit:[/b] NetDDEGroup - Driver Group
  550. SafeBootNet:[b]64bit:[/b] Network - Driver Group
  551. SafeBootNet:[b]64bit:[/b] NetworkProvider - Driver Group
  552. SafeBootNet:[b]64bit:[/b] PCI Configuration - Driver Group
  553. SafeBootNet:[b]64bit:[/b] PEVSystemStart - Service
  554. SafeBootNet:[b]64bit:[/b] PNP Filter - Driver Group
  555. SafeBootNet:[b]64bit:[/b] PNP_TDI - Driver Group
  556. SafeBootNet:[b]64bit:[/b] Primary disk - Driver Group
  557. SafeBootNet:[b]64bit:[/b] procexp90.Sys - Driver
  558. SafeBootNet:[b]64bit:[/b] rdsessmgr - Service
  559. SafeBootNet:[b]64bit:[/b] sacsvr - Service
  560. SafeBootNet:[b]64bit:[/b] SCSI Class - Driver Group
  561. SafeBootNet:[b]64bit:[/b] Streams Drivers - Driver Group
  562. SafeBootNet:[b]64bit:[/b] System Bus Extender - Driver Group
  563. SafeBootNet:[b]64bit:[/b] TDI - Driver Group
  564. SafeBootNet:[b]64bit:[/b] vmms - Service
  565. SafeBootNet:[b]64bit:[/b] WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
  566. SafeBootNet:[b]64bit:[/b] WudfUsbccidDriver - Driver
  567. SafeBootNet:[b]64bit:[/b] {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
  568. SafeBootNet:[b]64bit:[/b] {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
  569. SafeBootNet:[b]64bit:[/b] {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
  570. SafeBootNet:[b]64bit:[/b] {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
  571. SafeBootNet:[b]64bit:[/b] {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
  572. SafeBootNet:[b]64bit:[/b] {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
  573. SafeBootNet:[b]64bit:[/b] {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
  574. SafeBootNet:[b]64bit:[/b] {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
  575. SafeBootNet:[b]64bit:[/b] {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
  576. SafeBootNet:[b]64bit:[/b] {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
  577. SafeBootNet:[b]64bit:[/b] {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
  578. SafeBootNet:[b]64bit:[/b] {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
  579. SafeBootNet:[b]64bit:[/b] {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
  580. SafeBootNet:[b]64bit:[/b] {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
  581. SafeBootNet:[b]64bit:[/b] {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
  582. SafeBootNet:[b]64bit:[/b] {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
  583. SafeBootNet:[b]64bit:[/b] {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
  584. SafeBootNet:[b]64bit:[/b] {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
  585. SafeBootNet:[b]64bit:[/b] {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
  586. SafeBootNet:[b]64bit:[/b] {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
  587. SafeBootNet:[b]64bit:[/b] {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
  588. SafeBootNet:[b]64bit:[/b] {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
  589. SafeBootNet: 28440918.sys - Driver
  590. SafeBootNet: 54436810.sys - Driver
  591. SafeBootNet: Base - Driver Group
  592. SafeBootNet: Boot Bus Extender - Driver Group
  593. SafeBootNet: Boot file system - Driver Group
  594. SafeBootNet: File system - Driver Group
  595. SafeBootNet: Filter - Driver Group
  596. SafeBootNet: HelpSvc - Service
  597. SafeBootNet: Messenger - Service
  598. SafeBootNet: NDIS Wrapper - Driver Group
  599. SafeBootNet: NetBIOSGroup - Driver Group
  600. SafeBootNet: NetDDEGroup - Driver Group
  601. SafeBootNet: Network - Driver Group
  602. SafeBootNet: NetworkProvider - Driver Group
  603. SafeBootNet: PCI Configuration - Driver Group
  604. SafeBootNet: PEVSystemStart - Service
  605. SafeBootNet: PNP Filter - Driver Group
  606. SafeBootNet: PNP_TDI - Driver Group
  607. SafeBootNet: Primary disk - Driver Group
  608. SafeBootNet: procexp90.Sys - Driver
  609. SafeBootNet: rdsessmgr - Service
  610. SafeBootNet: sacsvr - Service
  611. SafeBootNet: SCSI Class - Driver Group
  612. SafeBootNet: Streams Drivers - Driver Group
  613. SafeBootNet: System Bus Extender - Driver Group
  614. SafeBootNet: TDI - Driver Group
  615. SafeBootNet: vmms - Service
  616. SafeBootNet: WudfUsbccidDriver - Driver
  617. SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
  618. SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
  619. SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
  620. SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
  621. SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
  622. SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
  623. SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
  624. SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
  625. SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
  626. SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
  627. SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
  628. SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
  629. SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
  630. SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
  631. SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
  632. SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
  633. SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
  634. SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
  635. SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
  636. SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
  637. SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
  638. SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
  639.  
  640. ActiveX:[b]64bit:[/b] {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
  641. ActiveX:[b]64bit:[/b] {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
  642. ActiveX:[b]64bit:[/b] {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
  643. ActiveX:[b]64bit:[/b] {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
  644. ActiveX:[b]64bit:[/b] {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
  645. ActiveX:[b]64bit:[/b] {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
  646. ActiveX:[b]64bit:[/b] {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
  647. ActiveX:[b]64bit:[/b] {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
  648. ActiveX:[b]64bit:[/b] {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
  649. ActiveX:[b]64bit:[/b] {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
  650. ActiveX:[b]64bit:[/b] {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
  651. ActiveX:[b]64bit:[/b] {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
  652. ActiveX:[b]64bit:[/b] {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
  653. ActiveX:[b]64bit:[/b] {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
  654. ActiveX:[b]64bit:[/b] {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
  655. ActiveX:[b]64bit:[/b] {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
  656. ActiveX:[b]64bit:[/b] {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
  657. ActiveX:[b]64bit:[/b] {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
  658. ActiveX:[b]64bit:[/b] {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
  659. ActiveX:[b]64bit:[/b] {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
  660. ActiveX:[b]64bit:[/b] {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
  661. ActiveX:[b]64bit:[/b] >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
  662. ActiveX:[b]64bit:[/b] >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
  663. ActiveX:[b]64bit:[/b] >{60B49E34-C7CC-11D0-8953-00A0C90347FF} -
  664. ActiveX:[b]64bit:[/b] >{A8B3E642-EA35-4CC8-A655-ACF7385EFF5E} - RunDLL32 IEDKCS32.DLL,BrandIE4 CUSTOM
  665. ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
  666. ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
  667. ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
  668. ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
  669. ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
  670. ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
  671. ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
  672. ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
  673. ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
  674. ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
  675. ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
  676. ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
  677. ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
  678. ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
  679. ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
  680. ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
  681. ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
  682. ActiveX: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
  683. ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
  684. ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
  685. ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
  686. ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
  687. ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
  688. ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
  689. ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
  690. ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
  691.  
  692. Drivers32:[b]64bit:[/b] msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
  693. Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
  694. Drivers32: vidc.cvid - C:\windows\SysWow64\iccvid.dll (Radius Inc.)
  695.  
  696. [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
  697.  
  698. [2013/09/12 07:19:18 | 000,000,000 | ---D | C] -- C:\_OTL
  699. [2013/09/12 06:50:26 | 000,000,000 | ---D | C] -- C:\Users\Carrie\Desktop\next reply
  700. [2013/09/12 06:41:20 | 001,898,112 | ---- | C] (Bleeping Computer, LLC) -- C:\Users\Carrie\Desktop\iExplore.exe
  701. [2013/09/12 06:14:02 | 000,000,000 | ---D | C] -- C:\Users\Public\Desktop\CC Support
  702. [2013/09/10 19:31:03 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Carrie\Desktop\OTL.scr
  703. [2013/09/10 19:30:28 | 000,000,000 | ---D | C] -- C:\AdwCleaner
  704. [2013/09/10 15:32:05 | 000,358,609 | ---- | C] (Farbar) -- C:\Users\Carrie\Desktop\FSS.exe
  705. [2013/09/10 12:16:35 | 000,000,000 | ---D | C] -- C:\Users\Carrie\Desktop\repairideas
  706. [2013/09/10 12:15:15 | 000,000,000 | ---D | C] -- C:\Users\Carrie\Desktop\RK_Quarantine
  707. [2013/09/10 11:04:55 | 000,000,000 | ---D | C] -- C:\Users\Carrie\Desktop\rkill
  708. [2013/09/09 12:00:52 | 000,000,000 | ---D | C] -- C:\FRST
  709. [2013/09/09 07:00:42 | 000,000,000 | ---D | C] -- C:\Users\Carrie\Desktop\FRST
  710. [2013/09/09 07:00:24 | 000,000,000 | -HSD | C] -- C:\Config.Msi
  711. [2013/09/07 07:40:43 | 000,181,064 | ---- | C] (Sysinternals) -- C:\windows\PSEXESVC.EXE
  712. [2013/09/07 07:34:47 | 000,468,592 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\windows\SysNative\pskill.exe
  713. [2013/09/07 07:34:47 | 000,232,232 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\windows\SysNative\pslist.exe
  714. [2013/09/07 07:34:47 | 000,207,664 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\windows\SysNative\psshutdown.exe
  715. [2013/09/07 07:34:47 | 000,187,184 | ---- | C] (Sysinternals) -- C:\windows\SysNative\pssuspend.exe
  716. [2013/09/07 07:34:47 | 000,183,160 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\windows\SysNative\PsLoggedon.exe
  717. [2013/09/07 07:34:47 | 000,178,040 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\windows\SysNative\psloglist.exe
  718. [2013/09/07 07:34:47 | 000,171,608 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\windows\SysNative\pspasswd.exe
  719. [2013/09/07 07:34:47 | 000,169,848 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\windows\SysNative\PsService.exe
  720. [2013/09/07 07:34:47 | 000,167,048 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\windows\SysNative\psping.exe
  721. [2013/09/07 07:34:46 | 000,390,520 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\windows\SysNative\PsInfo.exe
  722. [2013/09/07 07:34:46 | 000,381,816 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\windows\SysNative\PsExec.exe
  723. [2013/09/07 07:34:46 | 000,333,176 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\windows\SysNative\PsGetsid.exe
  724. [2013/09/07 07:34:46 | 000,105,264 | ---- | C] (Sysinternals) -- C:\windows\SysNative\psfile.exe
  725. [2013/09/07 00:58:06 | 000,000,000 | ---D | C] -- C:\windows\SysNative\MRT
  726. [2013/09/07 00:13:32 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\mshtmled.dll
  727. [2013/09/07 00:13:32 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\mshtmled.dll
  728. [2013/09/07 00:13:28 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ieui.dll
  729. [2013/09/07 00:13:28 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\ieui.dll
  730. [2013/09/07 00:13:27 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\url.dll
  731. [2013/09/07 00:13:27 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\url.dll
  732. [2013/09/07 00:13:27 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ieUnatt.exe
  733. [2013/09/07 00:13:27 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\ieUnatt.exe
  734. [2013/09/07 00:13:23 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\inetcpl.cpl
  735. [2013/09/07 00:13:23 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\inetcpl.cpl
  736. [2013/09/07 00:13:22 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\jscript9.dll
  737. [2013/09/07 00:13:22 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\msfeeds.dll
  738. [2013/09/07 00:13:19 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\jscript.dll
  739. [2013/09/07 00:13:19 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\vbscript.dll
  740. [2013/09/07 00:13:18 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\jscript.dll
  741. [2013/09/07 00:10:33 | 000,046,592 | ---- | C] (Microsoft) -- C:\windows\SysWow64\fpb.rs
  742. [2013/09/07 00:10:33 | 000,046,592 | ---- | C] (Microsoft) -- C:\windows\SysNative\fpb.rs
  743. [2013/09/07 00:10:33 | 000,045,568 | ---- | C] (Microsoft) -- C:\windows\SysWow64\oflc-nz.rs
  744. [2013/09/07 00:10:33 | 000,045,568 | ---- | C] (Microsoft) -- C:\windows\SysNative\oflc-nz.rs
  745. [2013/09/07 00:10:33 | 000,044,544 | ---- | C] (Microsoft) -- C:\windows\SysWow64\pegibbfc.rs
  746. [2013/09/07 00:10:33 | 000,044,544 | ---- | C] (Microsoft) -- C:\windows\SysNative\pegibbfc.rs
  747. [2013/09/07 00:10:33 | 000,043,520 | ---- | C] (Microsoft) -- C:\windows\SysWow64\csrr.rs
  748. [2013/09/07 00:10:33 | 000,043,520 | ---- | C] (Microsoft) -- C:\windows\SysNative\csrr.rs
  749. [2013/09/07 00:10:33 | 000,040,960 | ---- | C] (Microsoft) -- C:\windows\SysWow64\cob-au.rs
  750. [2013/09/07 00:10:33 | 000,040,960 | ---- | C] (Microsoft) -- C:\windows\SysNative\cob-au.rs
  751. [2013/09/07 00:10:33 | 000,030,720 | ---- | C] (Microsoft) -- C:\windows\SysWow64\usk.rs
  752. [2013/09/07 00:10:33 | 000,030,720 | ---- | C] (Microsoft) -- C:\windows\SysNative\usk.rs
  753. [2013/09/07 00:10:33 | 000,021,504 | ---- | C] (Microsoft) -- C:\windows\SysWow64\grb.rs
  754. [2013/09/07 00:10:33 | 000,021,504 | ---- | C] (Microsoft) -- C:\windows\SysNative\grb.rs
  755. [2013/09/07 00:10:33 | 000,020,480 | ---- | C] (Microsoft) -- C:\windows\SysNative\pegi-pt.rs
  756. [2013/09/07 00:10:33 | 000,020,480 | ---- | C] (Microsoft) -- C:\windows\SysWow64\pegi.rs
  757. [2013/09/07 00:10:33 | 000,020,480 | ---- | C] (Microsoft) -- C:\windows\SysNative\pegi.rs
  758. [2013/09/07 00:10:33 | 000,015,360 | ---- | C] (Microsoft) -- C:\windows\SysWow64\djctq.rs
  759. [2013/09/07 00:10:33 | 000,015,360 | ---- | C] (Microsoft) -- C:\windows\SysNative\djctq.rs
  760. [2013/09/07 00:10:32 | 002,746,368 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\gameux.dll
  761. [2013/09/07 00:10:32 | 002,576,384 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\gameux.dll
  762. [2013/09/07 00:10:32 | 000,441,856 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\Wpc.dll
  763. [2013/09/07 00:10:32 | 000,020,480 | ---- | C] (Microsoft) -- C:\windows\SysWow64\pegi-pt.rs
  764. [2013/09/07 00:10:31 | 000,308,736 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\Wpc.dll
  765. [2013/09/07 00:10:31 | 000,055,296 | ---- | C] (Microsoft) -- C:\windows\SysWow64\cero.rs
  766. [2013/09/07 00:10:31 | 000,055,296 | ---- | C] (Microsoft) -- C:\windows\SysNative\cero.rs
  767. [2013/09/07 00:10:31 | 000,051,712 | ---- | C] (Microsoft) -- C:\windows\SysWow64\esrb.rs
  768. [2013/09/07 00:10:31 | 000,051,712 | ---- | C] (Microsoft) -- C:\windows\SysNative\esrb.rs
  769. [2013/09/07 00:10:31 | 000,023,552 | ---- | C] (Microsoft) -- C:\windows\SysWow64\oflc.rs
  770. [2013/09/07 00:10:31 | 000,023,552 | ---- | C] (Microsoft) -- C:\windows\SysNative\oflc.rs
  771. [2013/09/07 00:10:31 | 000,020,480 | ---- | C] (Microsoft) -- C:\windows\SysWow64\pegi-fi.rs
  772. [2013/09/07 00:10:31 | 000,020,480 | ---- | C] (Microsoft) -- C:\windows\SysNative\pegi-fi.rs
  773. [2013/09/07 00:09:30 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\cryptdlg.dll
  774. [2013/09/07 00:09:30 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\cryptdlg.dll
  775. [2013/09/07 00:07:11 | 001,161,216 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\kernel32.dll
  776. [2013/09/07 00:07:11 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\KernelBase.dll
  777. [2013/09/07 00:07:10 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\wow64win.dll
  778. [2013/09/07 00:07:10 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\conhost.exe
  779. [2013/09/07 00:07:10 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\wow64.dll
  780. [2013/09/07 00:07:10 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\winsrv.dll
  781. [2013/09/07 00:07:10 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ntvdm64.dll
  782. [2013/09/07 00:07:10 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\wow64cpu.dll
  783. [2013/09/07 00:07:09 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\ntvdm64.dll
  784. [2013/09/07 00:07:09 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-security-base-l1-1-0.dll
  785. [2013/09/07 00:07:09 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
  786. [2013/09/07 00:07:09 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-file-l1-1-0.dll
  787. [2013/09/07 00:07:09 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\wow32.dll
  788. [2013/09/07 00:07:09 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
  789. [2013/09/07 00:07:09 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
  790. [2013/09/07 00:07:09 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
  791. [2013/09/07 00:07:09 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
  792. [2013/09/07 00:07:09 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
  793. [2013/09/07 00:07:09 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
  794. [2013/09/07 00:07:09 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
  795. [2013/09/07 00:07:09 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
  796. [2013/09/07 00:07:09 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
  797. [2013/09/07 00:07:09 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
  798. [2013/09/07 00:07:09 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
  799. [2013/09/07 00:07:09 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
  800. [2013/09/07 00:07:09 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
  801. [2013/09/07 00:07:09 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
  802. [2013/09/07 00:07:09 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
  803. [2013/09/07 00:07:09 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
  804. [2013/09/07 00:07:09 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
  805. [2013/09/07 00:07:09 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
  806. [2013/09/07 00:07:09 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
  807. [2013/09/07 00:07:09 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
  808. [2013/09/07 00:07:09 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-util-l1-1-0.dll
  809. [2013/09/07 00:07:09 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
  810. [2013/09/07 00:07:09 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-string-l1-1-0.dll
  811. [2013/09/07 00:07:09 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
  812. [2013/09/07 00:07:09 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
  813. [2013/09/07 00:07:09 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
  814. [2013/09/07 00:07:09 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
  815. [2013/09/07 00:07:09 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
  816. [2013/09/07 00:07:08 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\setup16.exe
  817. [2013/09/07 00:07:08 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\instnm.exe
  818. [2013/09/07 00:07:08 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
  819. [2013/09/07 00:07:08 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
  820. [2013/09/07 00:07:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
  821. [2013/09/07 00:07:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
  822. [2013/09/07 00:07:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
  823. [2013/09/07 00:07:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
  824. [2013/09/07 00:07:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
  825. [2013/09/07 00:07:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
  826. [2013/09/07 00:07:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
  827. [2013/09/07 00:07:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
  828. [2013/09/07 00:07:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
  829. [2013/09/07 00:07:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
  830. [2013/09/07 00:07:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-io-l1-1-0.dll
  831. [2013/09/07 00:07:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
  832. [2013/09/07 00:07:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
  833. [2013/09/07 00:07:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
  834. [2013/09/07 00:07:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
  835. [2013/09/07 00:07:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
  836. [2013/09/07 00:07:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
  837. [2013/09/07 00:07:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
  838. [2013/09/07 00:07:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
  839. [2013/09/07 00:07:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
  840. [2013/09/07 00:07:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
  841. [2013/09/07 00:07:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
  842. [2013/09/07 00:07:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\SysNative\api-ms-win-core-console-l1-1-0.dll
  843. [2013/09/07 00:07:07 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\user.exe
  844. [2013/09/07 00:06:20 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\win32spl.dll
  845. [2013/09/07 00:06:20 | 000,492,544 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\win32spl.dll
  846. [2013/09/07 00:04:06 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\usp10.dll
  847. [2013/09/07 00:03:35 | 000,288,088 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\drivers\FWPKCLNT.SYS
  848. [2013/09/06 23:55:25 | 001,545,728 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\DWrite.dll
  849. [2013/09/06 23:55:22 | 005,550,424 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ntoskrnl.exe
  850. [2013/09/06 23:55:21 | 003,968,856 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\ntkrnlpa.exe
  851. [2013/09/06 23:55:21 | 003,913,560 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\ntoskrnl.exe
  852. [2013/09/06 23:55:20 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\smss.exe
  853. [2013/09/06 23:55:20 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\csrsrv.dll
  854. [2013/09/06 23:55:20 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\apisetschema.dll
  855. [2013/09/06 23:55:12 | 001,192,448 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\certutil.exe
  856. [2013/09/06 23:55:11 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\crypt32.dll
  857. [2013/09/06 23:55:11 | 000,903,168 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\certutil.exe
  858. [2013/09/06 23:55:11 | 000,139,776 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\cryptnet.dll
  859. [2013/09/06 23:55:10 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\certenc.dll
  860. [2013/09/06 23:55:10 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\certenc.dll
  861. [2013/09/06 23:54:05 | 000,068,608 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\taskhost.exe
  862. [2013/08/31 18:58:31 | 000,033,400 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswFsBlk.sys
  863. [2013/08/31 18:58:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
  864. [2013/08/31 18:58:30 | 000,378,944 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswSP.sys
  865. [2013/08/31 18:58:28 | 000,072,016 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswRdr2.sys
  866. [2013/08/31 18:58:28 | 000,064,288 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswTdi.sys
  867. [2013/08/31 18:58:27 | 001,030,952 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswSnx.sys
  868. [2013/08/31 18:58:23 | 000,080,816 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswMonFlt.sys
  869. [2013/08/31 18:57:30 | 000,041,664 | ---- | C] (AVAST Software) -- C:\windows\avastSS.scr
  870. [2013/08/30 23:03:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
  871. [2013/08/30 23:03:28 | 000,867,240 | ---- | C] (Oracle Corporation) -- C:\windows\SysWow64\npDeployJava1.dll
  872. [2013/08/30 23:03:28 | 000,263,592 | ---- | C] (Oracle Corporation) -- C:\windows\SysWow64\javaws.exe
  873. [2013/08/30 23:03:12 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\windows\SysWow64\javaw.exe
  874. [2013/08/30 23:03:12 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\windows\SysWow64\java.exe
  875. [2013/08/30 23:03:12 | 000,096,168 | ---- | C] (Oracle Corporation) -- C:\windows\SysWow64\WindowsAccessBridge-32.dll
  876. [2013/08/30 23:01:15 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
  877. [1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
  878.  
  879. [color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
  880.  
  881. [2013/09/14 10:44:45 | 000,024,608 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  882. [2013/09/14 10:44:45 | 000,024,608 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  883. [2013/09/14 10:44:32 | 000,726,444 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
  884. [2013/09/14 10:44:32 | 000,624,412 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
  885. [2013/09/14 10:44:32 | 000,106,756 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
  886. [2013/09/14 10:37:19 | 000,000,908 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
  887. [2013/09/14 10:37:01 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
  888. [2013/09/14 10:36:55 | 2094,161,920 | -HS- | M] () -- C:\hiberfil.sys
  889. [2013/09/14 10:34:20 | 000,000,912 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
  890. [2013/09/13 09:27:51 | 000,074,595 | ---- | M] () -- C:\Users\Carrie\Desktop\Capture.PNG
  891. [2013/09/12 06:58:40 | 003,787,776 | ---- | M] () -- C:\Users\Carrie\Desktop\RogueKillerX64.exe
  892. [2013/09/12 06:41:25 | 001,898,112 | ---- | M] (Bleeping Computer, LLC) -- C:\Users\Carrie\Desktop\iExplore.exe
  893. [2013/09/12 05:47:38 | 004,009,167 | ---- | M] () -- C:\Users\Carrie\Desktop\ServicesRepair.exe
  894. [2013/09/12 05:40:54 | 000,005,256 | ---- | M] () -- C:\Users\Carrie\Desktop\wscsvc.reg
  895. [2013/09/12 05:40:52 | 000,362,882 | ---- | M] () -- C:\Users\Carrie\Desktop\SharedAccess.reg
  896. [2013/09/12 05:40:41 | 000,006,296 | ---- | M] () -- C:\Users\Carrie\Desktop\iphlpsvc.reg
  897. [2013/09/12 05:40:32 | 000,007,586 | ---- | M] () -- C:\Users\Carrie\Desktop\WinDefend.reg
  898. [2013/09/10 19:31:03 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Carrie\Desktop\OTL.scr
  899. [2013/09/10 19:30:06 | 001,037,278 | ---- | M] () -- C:\Users\Carrie\Desktop\AdwCleaner.exe
  900. [2013/09/10 15:32:06 | 000,358,609 | ---- | M] (Farbar) -- C:\Users\Carrie\Desktop\FSS.exe
  901. [2013/09/10 15:01:16 | 000,001,124 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
  902. [2013/09/09 07:01:15 | 000,001,945 | ---- | M] () -- C:\windows\epplauncher.mif
  903. [2013/09/09 06:16:48 | 000,436,072 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT
  904. [2013/09/07 07:40:43 | 000,181,064 | ---- | M] (Sysinternals) -- C:\windows\PSEXESVC.EXE
  905. [2013/09/06 23:34:07 | 000,006,288 | ---- | M] () -- C:\Users\Carrie\Desktop\BITS.reg
  906. [2013/09/06 23:32:26 | 000,006,176 | ---- | M] () -- C:\Users\Carrie\Desktop\wuauserv.reg
  907. [2013/09/06 23:12:42 | 000,014,086 | ---- | M] () -- C:\Users\Carrie\Desktop\Seven.zip
  908. [2013/08/31 18:58:58 | 001,030,952 | ---- | M] (AVAST Software) -- C:\windows\SysNative\drivers\aswSnx.sys
  909. [2013/08/31 18:58:58 | 000,378,944 | ---- | M] (AVAST Software) -- C:\windows\SysNative\drivers\aswSP.sys
  910. [2013/08/31 18:58:58 | 000,189,936 | ---- | M] () -- C:\windows\SysNative\drivers\aswVmm.sys
  911. [2013/08/31 18:58:58 | 000,000,175 | ---- | M] () -- C:\windows\SysNative\drivers\aswVmm.sys.sum
  912. [2013/08/31 18:58:58 | 000,000,175 | ---- | M] () -- C:\windows\SysNative\drivers\aswSP.sys.sum
  913. [2013/08/31 18:58:58 | 000,000,175 | ---- | M] () -- C:\windows\SysNative\drivers\aswSnx.sys.sum
  914. [2013/08/31 18:58:23 | 000,000,000 | ---- | M] () -- C:\windows\SysWow64\config.nt
  915. [2013/08/30 23:02:58 | 000,096,168 | ---- | M] (Oracle Corporation) -- C:\windows\SysWow64\WindowsAccessBridge-32.dll
  916. [2013/08/30 23:02:57 | 000,867,240 | ---- | M] (Oracle Corporation) -- C:\windows\SysWow64\npDeployJava1.dll
  917. [2013/08/30 23:02:57 | 000,789,416 | ---- | M] (Oracle Corporation) -- C:\windows\SysWow64\deployJava1.dll
  918. [2013/08/30 23:02:57 | 000,263,592 | ---- | M] (Oracle Corporation) -- C:\windows\SysWow64\javaws.exe
  919. [2013/08/30 23:02:57 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\windows\SysWow64\javaw.exe
  920. [2013/08/30 23:02:57 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\windows\SysWow64\java.exe
  921. [2013/08/15 18:19:59 | 000,001,149 | ---- | M] () -- C:\Users\Carrie\Desktop\ROBLOX Studio 2013.lnk
  922. [2013/08/15 18:19:51 | 000,001,330 | ---- | M] () -- C:\Users\Carrie\Desktop\ROBLOX Player.lnk
  923. [1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
  924.  
  925. [color=#E56717]========== Files Created - No Company Name ==========[/color]
  926.  
  927. [2013/09/12 06:58:10 | 003,787,776 | ---- | C] () -- C:\Users\Carrie\Desktop\RogueKillerX64.exe
  928. [2013/09/12 05:47:25 | 004,009,167 | ---- | C] () -- C:\Users\Carrie\Desktop\ServicesRepair.exe
  929. [2013/09/12 05:40:54 | 000,005,256 | ---- | C] () -- C:\Users\Carrie\Desktop\wscsvc.reg
  930. [2013/09/12 05:40:52 | 000,362,882 | ---- | C] () -- C:\Users\Carrie\Desktop\SharedAccess.reg
  931. [2013/09/12 05:40:41 | 000,006,296 | ---- | C] () -- C:\Users\Carrie\Desktop\iphlpsvc.reg
  932. [2013/09/12 05:40:32 | 000,007,586 | ---- | C] () -- C:\Users\Carrie\Desktop\WinDefend.reg
  933. [2013/09/10 21:00:46 | 000,074,595 | ---- | C] () -- C:\Users\Carrie\Desktop\Capture.PNG
  934. [2013/09/10 19:30:06 | 001,037,278 | ---- | C] () -- C:\Users\Carrie\Desktop\AdwCleaner.exe
  935. [2013/09/10 15:01:16 | 000,001,124 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
  936. [2013/09/07 07:34:47 | 000,066,582 | ---- | C] () -- C:\windows\SysNative\Pstools.chm
  937. [2013/09/07 07:32:44 | 000,001,945 | ---- | C] () -- C:\windows\epplauncher.mif
  938. [2013/09/06 23:33:57 | 000,006,288 | ---- | C] () -- C:\Users\Carrie\Desktop\BITS.reg
  939. [2013/09/06 23:32:01 | 000,006,176 | ---- | C] () -- C:\Users\Carrie\Desktop\wuauserv.reg
  940. [2013/09/06 23:12:41 | 000,014,086 | ---- | C] () -- C:\Users\Carrie\Desktop\Seven.zip
  941. [2013/08/31 18:58:58 | 000,000,175 | ---- | C] () -- C:\windows\SysNative\drivers\aswVmm.sys.sum
  942. [2013/08/31 18:58:58 | 000,000,175 | ---- | C] () -- C:\windows\SysNative\drivers\aswSP.sys.sum
  943. [2013/08/31 18:58:58 | 000,000,175 | ---- | C] () -- C:\windows\SysNative\drivers\aswSnx.sys.sum
  944. [2013/08/31 18:58:27 | 000,189,936 | ---- | C] () -- C:\windows\SysNative\drivers\aswVmm.sys
  945. [2013/08/31 18:58:25 | 000,065,336 | ---- | C] () -- C:\windows\SysNative\drivers\aswRvrt.sys
  946. [2013/05/10 09:59:36 | 000,074,703 | ---- | C] () -- C:\windows\SysWow64\mfc45.dat
  947. [2012/12/10 21:55:39 | 000,000,000 | ---- | C] () -- C:\windows\ToDisc.INI
  948. [2012/08/09 12:16:26 | 000,000,017 | ---- | C] () -- C:\Users\Carrie\AppData\Local\resmon.resmoncfg
  949. [2012/05/05 20:53:25 | 000,000,056 | -H-- | C] () -- C:\windows\SysWow64\ezsidmv.dat
  950. [2011/12/26 21:53:43 | 009,374,906 | ---- | C] () -- C:\Users\Carrie\ATT_SGH-A817_SolsticeII_English_User_Manual.pdf
  951. [2011/12/22 14:03:35 | 000,660,676 | ---- | C] () -- C:\Users\Carrie\Cell Phone Customer Service Summary.pdf
  952.  
  953. [color=#E56717]========== ZeroAccess Check ==========[/color]
  954.  
  955. [2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini
  956.  
  957. [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
  958.  
  959. [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  960.  
  961. [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
  962.  
  963. [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
  964.  
  965. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
  966. "" = C:\Windows\SysNative\shell32.dll -- [2012/06/09 00:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
  967. "ThreadingModel" = Apartment
  968.  
  969. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  970. "" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 23:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
  971. "ThreadingModel" = Apartment
  972.  
  973. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
  974. "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 20:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
  975. "ThreadingModel" = Free
  976.  
  977. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
  978. "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 22:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
  979. "ThreadingModel" = Free
  980.  
  981. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
  982. "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 20:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
  983. "ThreadingModel" = Both
  984.  
  985. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
  986.  
  987. [color=#E56717]========== LOP Check ==========[/color]
  988.  
  989. [2013/08/30 23:06:52 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\.minecraft
  990. [2013/09/11 16:51:19 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Allmyapps
  991. [2011/08/01 09:41:35 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Book Place
  992. [2012/08/14 21:58:33 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\com.Shutterfly.ExpressUploader
  993. [2011/12/26 22:06:06 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Samsung
  994. [2013/07/03 22:33:36 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\SoftGrid Client
  995. [2011/07/28 09:14:18 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Tific
  996. [2013/04/03 21:28:42 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\TomTom
  997. [2011/07/14 18:21:25 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Toshiba
  998. [2011/07/20 22:05:08 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\TP
  999. [2011/09/02 21:23:16 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Unity
  1000. [2011/07/14 15:16:29 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\WinBatch
  1001. [2012/06/16 09:21:02 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Windows Live Writer
  1002.  
  1003. [color=#E56717]========== Purity Check ==========[/color]
  1004.  
  1005.  
  1006.  
  1007. [color=#E56717]========== Custom Scans ==========[/color]
  1008.  
  1009. [color=#A23BEC]< %SYSTEMDRIVE%\*.* >[/color]
  1010. [2013/08/31 21:58:13 | 000,000,232 | ---- | M] () -- C:\aswBoot.log
  1011. [2010/11/20 22:23:51 | 000,383,786 | RHS- | M] () -- C:\bootmgr
  1012. [2011/03/29 22:11:41 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
  1013. [2013/09/14 10:36:55 | 2094,161,920 | -HS- | M] () -- C:\hiberfil.sys
  1014. [2011/08/05 10:53:32 | 000,000,386 | -H-- | M] () -- C:\IPH.PH
  1015. [2013/09/14 10:36:56 | 2792,218,624 | -HS- | M] () -- C:\pagefile.sys
  1016. [2013/09/10 12:34:42 | 000,003,602 | ---- | M] () -- C:\TDSSKiller.2.9.2.0_10.09.2013_12.33.27_log.txt
  1017. [2013/09/10 12:38:06 | 000,063,876 | ---- | M] () -- C:\TDSSKiller.2.9.2.0_10.09.2013_12.36.50_log.txt
  1018. [2013/09/10 19:16:17 | 000,003,602 | ---- | M] () -- C:\TDSSKiller.2.9.2.0_10.09.2013_19.15.33_log.txt
  1019. [2013/09/10 19:23:53 | 000,409,284 | ---- | M] () -- C:\TDSSKiller.2.9.2.0_10.09.2013_19.19.12_log.txt
  1020.  
  1021. [color=#A23BEC]< %USERPROFILE%\*.* >[/color]
  1022. [2011/12/26 21:53:44 | 009,374,906 | ---- | M] () -- C:\Users\Carrie\ATT_SGH-A817_SolsticeII_English_User_Manual.pdf
  1023. [2011/12/22 14:03:36 | 000,660,676 | ---- | M] () -- C:\Users\Carrie\Cell Phone Customer Service Summary.pdf
  1024. [2013/09/14 10:56:04 | 007,864,320 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat
  1025. [2013/09/14 10:56:04 | 000,262,144 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat.LOG1
  1026. [2011/07/14 15:14:58 | 000,000,000 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat.LOG2
  1027. [2011/07/19 18:53:52 | 000,065,536 | -HS- | M] () -- C:\Users\Carrie\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
  1028. [2011/07/19 18:53:52 | 000,524,288 | -HS- | M] () -- C:\Users\Carrie\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
  1029. [2011/07/19 18:53:52 | 000,524,288 | -HS- | M] () -- C:\Users\Carrie\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
  1030. [2012/03/23 20:23:24 | 000,065,536 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{02341b47-74d9-11e1-96b8-00266cc4ba16}.TM.blf
  1031. [2012/03/23 20:23:24 | 000,524,288 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{02341b47-74d9-11e1-96b8-00266cc4ba16}.TMContainer00000000000000000001.regtrans-ms
  1032. [2012/03/23 20:23:24 | 000,524,288 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{02341b47-74d9-11e1-96b8-00266cc4ba16}.TMContainer00000000000000000002.regtrans-ms
  1033. [2012/04/06 22:54:05 | 000,065,536 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{253bc422-7c05-11e1-b844-00266cc4ba16}.TM.blf
  1034. [2012/04/06 22:54:05 | 000,524,288 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{253bc422-7c05-11e1-b844-00266cc4ba16}.TMContainer00000000000000000001.regtrans-ms
  1035. [2012/04/06 22:54:05 | 000,524,288 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{253bc422-7c05-11e1-b844-00266cc4ba16}.TMContainer00000000000000000002.regtrans-ms
  1036. [2012/03/22 06:36:15 | 000,065,536 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{26c35e66-7413-11e1-be34-00266cc4ba16}.TM.blf
  1037. [2012/03/22 06:36:15 | 000,524,288 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{26c35e66-7413-11e1-be34-00266cc4ba16}.TMContainer00000000000000000001.regtrans-ms
  1038. [2012/03/22 06:36:15 | 000,524,288 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{26c35e66-7413-11e1-be34-00266cc4ba16}.TMContainer00000000000000000002.regtrans-ms
  1039. [2012/03/21 11:53:13 | 000,065,536 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{3d4b1763-7376-11e1-9b7c-00266cc4ba16}.TM.blf
  1040. [2012/03/21 11:53:14 | 000,524,288 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{3d4b1763-7376-11e1-9b7c-00266cc4ba16}.TMContainer00000000000000000001.regtrans-ms
  1041. [2012/03/21 11:53:14 | 000,524,288 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{3d4b1763-7376-11e1-9b7c-00266cc4ba16}.TMContainer00000000000000000002.regtrans-ms
  1042. [2012/03/24 08:23:14 | 000,065,536 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{8c05ab87-75ac-11e1-9b91-00266cc4ba16}.TM.blf
  1043. [2012/03/24 08:23:14 | 000,524,288 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{8c05ab87-75ac-11e1-9b91-00266cc4ba16}.TMContainer00000000000000000001.regtrans-ms
  1044. [2012/03/24 08:23:14 | 000,524,288 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{8c05ab87-75ac-11e1-9b91-00266cc4ba16}.TMContainer00000000000000000002.regtrans-ms
  1045. [2011/11/15 21:18:35 | 000,065,536 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{9e1c7ff6-0ff7-11e1-82e3-00266cc4ba16}.TM.blf
  1046. [2011/11/15 21:18:35 | 000,524,288 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{9e1c7ff6-0ff7-11e1-82e3-00266cc4ba16}.TMContainer00000000000000000001.regtrans-ms
  1047. [2011/11/15 21:18:35 | 000,524,288 | -HS- | M] () -- C:\Users\Carrie\ntuser.dat{9e1c7ff6-0ff7-11e1-82e3-00266cc4ba16}.TMContainer00000000000000000002.regtrans-ms
  1048. [2011/07/14 15:14:59 | 000,000,020 | -HS- | M] () -- C:\Users\Carrie\ntuser.ini
  1049. [2012/01/23 21:37:36 | 000,017,920 | -HS- | M] () -- C:\Users\Carrie\Thumbs.db
  1050.  
  1051. [color=#A23BEC]< %USERPROFILE%\AppData\Local\*.* >[/color]
  1052. [2013/07/09 21:46:12 | 000,111,448 | ---- | M] () -- C:\Users\Carrie\AppData\Local\GDIPFONTCACHEV1.DAT
  1053. [2013/09/14 10:35:42 | 001,483,458 | -H-- | M] () -- C:\Users\Carrie\AppData\Local\IconCache.db
  1054. [2012/08/09 12:16:26 | 000,000,017 | ---- | M] () -- C:\Users\Carrie\AppData\Local\resmon.resmoncfg
  1055.  
  1056. [color=#A23BEC]< %USERPROFILE%\AppData\Local\*. >[/color]
  1057. [2012/08/14 21:57:53 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Adobe
  1058. [2011/08/25 20:08:22 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Apple
  1059. [2011/08/25 20:15:40 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Apple Computer
  1060. [2011/07/14 15:14:59 | 000,000,000 | -HSD | M] -- C:\Users\Carrie\AppData\Local\Application Data
  1061. [2012/08/09 10:11:40 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Apps
  1062. [2011/07/14 18:19:17 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\ATI
  1063. [2013/09/07 09:24:53 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\CrashDumps
  1064. [2013/07/12 22:28:34 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\CrashRpt
  1065. [2012/08/09 10:14:26 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Deployment
  1066. [2012/08/26 09:36:02 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Diagnostics
  1067. [2013/04/03 21:26:05 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Downloaded Installations
  1068. [2013/09/10 12:23:23 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\ElevatedDiagnostics
  1069. [2012/11/02 21:43:42 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Google
  1070. [2011/07/14 15:14:59 | 000,000,000 | -HSD | M] -- C:\Users\Carrie\AppData\Local\History
  1071. [2011/12/04 18:54:37 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\HP
  1072. [2013/07/05 20:53:29 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft
  1073. [2011/09/05 21:30:09 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft Games
  1074. [2012/09/14 08:06:29 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft Help
  1075. [2012/02/06 23:19:24 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\PhotoChannel
  1076. [2013/05/10 10:08:49 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Programs
  1077. [2013/03/17 09:40:04 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Roblox
  1078. [2011/07/20 22:04:36 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\SoftGrid Client
  1079. [2011/07/28 09:14:15 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Symantec
  1080. [2013/09/14 10:50:25 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Temp
  1081. [2011/07/14 15:14:59 | 000,000,000 | -HSD | M] -- C:\Users\Carrie\AppData\Local\Temporary Internet Files
  1082. [2011/09/19 21:24:08 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Tific
  1083. [2013/04/03 21:28:42 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\TomTom
  1084. [2011/07/14 18:19:20 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Toshiba
  1085. [2011/07/19 18:53:44 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\TOSHIBA_Corporation
  1086. [2011/08/18 17:58:40 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Unity
  1087. [2011/07/14 18:17:25 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\VirtualStore
  1088. [2012/02/06 22:56:40 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Windows Live
  1089. [2012/06/16 09:21:09 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Windows Live Writer
  1090. [2011/12/25 11:23:26 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{1B462DBD-C500-40A4-A068-80090AB79DC4}
  1091. [2011/10/22 11:23:20 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{22DF985A-E6FC-43BE-9577-A08E5F50FA4E}
  1092. [2011/10/22 10:14:36 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{25DA3A74-DA1E-46B4-B085-D0EE19EE58B0}
  1093. [2011/08/21 18:27:32 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{299F4515-B33C-4D54-A710-30D696BFB87B}
  1094. [2012/06/16 09:21:16 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{316B0FCC-D4E5-4636-AFD5-9E630D53C243}
  1095. [2011/12/25 11:23:40 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{36267C15-DC14-406D-8FE3-28863A07EAA0}
  1096. [2011/08/21 18:27:58 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{38BE3427-4CBA-41CF-AC85-DE6FFD675492}
  1097. [2012/03/23 20:52:52 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{3E45B5D1-6406-4DBE-8DBE-69EE6B870429}
  1098. [2012/03/23 20:52:31 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{46DFD749-5E0F-49E2-A4CD-C9D4F4AFCC06}
  1099. [2011/12/25 11:22:29 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{48C5ABF1-26AF-4F10-A1A9-6D1FC996D3E6}
  1100. [2013/03/20 21:23:09 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{4FEA63F7-334F-4A07-B436-17826B36F2E7}
  1101. [2012/08/20 21:57:39 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{57709B9A-23DB-4374-A099-4B434D9355D4}
  1102. [2012/08/20 22:00:56 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{57EC8797-AC61-4511-B0DE-A056CBC78CD8}
  1103. [2011/10/22 10:31:46 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{6F7239FB-3B3A-4F6A-B9E6-C68845D71AAB}
  1104. [2011/08/21 18:29:41 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{72D56388-8C2F-4352-8AB7-4EDBD9A84FF0}
  1105. [2012/03/19 20:45:41 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{788D339A-F649-4C8C-973B-99B240156387}
  1106. [2011/10/22 10:31:12 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{7D1363CA-A2A6-4E0F-BEAD-4FBBE79925DC}
  1107. [2011/08/01 21:16:57 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{7EF3C8D6-7C27-4059-8643-D67C1CB27B16}
  1108. [2011/10/22 10:30:45 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{81D2329B-822D-439C-9F9A-7F2059B2EAE3}
  1109. [2012/03/19 20:45:58 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{8BA448A1-DE20-4768-AE84-DD4421EF3937}
  1110. [2012/10/20 20:13:25 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{8C71BFF7-5C3E-4058-BD4B-331F620459FB}
  1111. [2011/12/25 11:22:16 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{9897D002-BB25-45CA-A715-8529E8177AD8}
  1112. [2013/02/03 21:42:37 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{A4E247EE-A3AA-4636-B555-60A8876BDB80}
  1113. [2011/12/06 21:37:12 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{D84B50DE-7E54-432B-9AC8-9059ACE7BA82}
  1114. [2011/12/06 21:37:24 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{DE738832-90CF-4584-A1F0-871DF112D936}
  1115. [2012/08/12 19:53:25 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\{F3377663-CBA1-49E3-B979-DEE85788169D}
  1116.  
  1117. [color=#A23BEC]< %USERPROFILE%\AppData\Local\temp\*.exe >[/color]
  1118.  
  1119. [color=#A23BEC]< %USERPROFILE%\AppData\Roaming\*.* >[/color]
  1120.  
  1121. [color=#A23BEC]< %USERPROFILE%\AppData\Roaming\*. >[/color]
  1122. [2013/08/30 23:06:52 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\.minecraft
  1123. [2012/08/14 21:58:03 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Adobe
  1124. [2013/09/11 16:51:19 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Allmyapps
  1125. [2011/08/25 20:15:23 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Apple Computer
  1126. [2011/07/14 18:19:17 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\ATI
  1127. [2011/08/01 09:41:35 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Book Place
  1128. [2012/08/14 21:58:33 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\com.Shutterfly.ExpressUploader
  1129. [2011/07/14 18:35:55 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Google
  1130. [2011/11/15 22:08:45 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\HpUpdate
  1131. [2011/07/14 18:17:35 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Identities
  1132. [2011/03/29 21:54:33 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Macromedia
  1133. [2011/08/01 22:00:15 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Malwarebytes
  1134. [2010/11/21 02:16:41 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Media Center Programs
  1135. [2013/07/05 21:01:38 | 000,000,000 | --SD | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft
  1136. [2013/04/03 21:28:43 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Mozilla
  1137. [2011/12/26 22:06:06 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Samsung
  1138. [2013/01/26 23:13:04 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Skype
  1139. [2012/05/05 20:53:15 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\skypePM
  1140. [2013/07/03 22:33:36 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\SoftGrid Client
  1141. [2011/07/28 09:14:18 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Tific
  1142. [2013/04/03 21:28:42 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\TomTom
  1143. [2011/07/14 18:21:25 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Toshiba
  1144. [2011/07/20 22:05:08 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\TP
  1145. [2011/09/02 21:23:16 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Unity
  1146. [2011/07/14 15:16:29 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\WinBatch
  1147. [2012/06/16 09:21:02 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Windows Live Writer
  1148. [2012/07/19 22:05:00 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\WinRAR
  1149.  
  1150. [color=#A23BEC]< %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Templates\*.* >[/color]
  1151. [2012/08/11 21:37:35 | 000,000,439 | ---- | M] () -- C:\Users\Carrie\AppData\Roaming\Microsoft\Windows\Templates\serverInfo.xml
  1152.  
  1153. [color=#A23BEC]< %USERPROFILE%\AppData\Local\Microsoft\*.* >[/color]
  1154.  
  1155. [color=#A23BEC]< >[/color]
  1156. [2009/07/14 00:08:49 | 000,000,006 | -H-- | C] () -- C:\windows\Tasks\SA.DAT
  1157. [2009/07/14 00:08:49 | 000,032,540 | ---- | C] () -- C:\windows\Tasks\SCHEDLGU.TXT
  1158. [2011/06/08 21:14:04 | 000,000,908 | ---- | C] () -- C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
  1159. [2011/06/08 21:14:04 | 000,000,912 | ---- | C] () -- C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
  1160.  
  1161. [color=#A23BEC]< %USERPROFILE%\AppData\Local\Microsoft\*. >[/color]
  1162. [2011/08/02 07:44:34 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Assistance
  1163. [2013/09/12 07:25:03 | 000,000,000 | --SD | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Credentials
  1164. [2013/08/05 21:22:36 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Device Metadata
  1165. [2011/11/15 22:20:36 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Device Stage
  1166. [2011/10/22 10:23:52 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\ehome
  1167. [2011/08/02 13:41:48 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Event Viewer
  1168. [2011/07/14 18:19:07 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Feeds
  1169. [2011/07/14 18:18:32 | 000,000,000 | -HSD | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Feeds Cache
  1170. [2011/07/21 21:14:27 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\IME12
  1171. [2011/07/21 21:14:27 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\IMJP12
  1172. [2011/07/21 21:14:27 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\IMJP8_1
  1173. [2011/07/21 21:14:27 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\IMJP9_0
  1174. [2012/08/09 11:32:44 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Internet Explorer
  1175. [2013/07/23 08:18:54 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Media Player
  1176. [2011/08/01 21:16:49 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Messenger
  1177. [2011/11/15 22:09:25 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\MSN Suite
  1178. [2013/07/05 20:53:29 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\MSOIdentityCRL
  1179. [2012/07/20 22:17:54 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\NetTraces
  1180. [2013/07/09 22:01:23 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Office
  1181. [2011/08/01 21:11:16 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Photo Acquisition
  1182. [2013/09/01 12:49:28 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Portable Devices
  1183. [2011/11/15 22:53:22 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Toolbar
  1184. [2011/08/01 21:11:03 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\UserScanProfiles
  1185. [2012/07/08 18:33:02 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Windows
  1186. [2011/08/01 21:16:50 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Windows Live
  1187. [2011/08/21 18:27:17 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Windows Live Movie Maker
  1188. [2011/10/22 10:31:11 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Windows Live Photo Acquisition
  1189. [2011/08/01 21:18:36 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Windows Live Photo Gallery
  1190. [2011/07/14 18:18:38 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Windows Mail
  1191. [2011/07/14 18:17:43 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Windows Media
  1192. [2011/08/01 21:18:23 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Windows Photo Gallery
  1193. [2011/07/14 18:19:06 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\Windows Sidebar
  1194. [2013/05/30 21:54:52 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Local\Microsoft\WLSetup
  1195.  
  1196. [color=#A23BEC]< >[/color]
  1197.  
  1198. [color=#A23BEC]< %USERPROFILE%\AppData\Roaming\Microsoft\*.* >[/color]
  1199.  
  1200. [color=#A23BEC]< >[/color]
  1201.  
  1202. [color=#A23BEC]< %USERPROFILE%\AppData\Roaming\Microsoft\*. >[/color]
  1203. [2013/07/05 20:52:06 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\AddIns
  1204. [2013/07/05 21:01:38 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\Bibliography
  1205. [2011/07/15 18:11:27 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\CLR Security Config
  1206. [2012/09/14 08:06:33 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\CLView
  1207. [2011/07/14 15:15:01 | 000,000,000 | --SD | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\Credentials
  1208. [2011/07/14 15:15:11 | 000,000,000 | --SD | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\Crypto
  1209. [2011/07/21 06:17:06 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\Document Building Blocks
  1210. [2011/10/22 11:24:21 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\eHome
  1211. [2013/09/11 21:56:47 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\Excel
  1212. [2011/08/04 11:06:42 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\HTML Help
  1213. [2011/07/21 21:14:27 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\IME12
  1214. [2011/07/21 21:14:27 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\IMJP12
  1215. [2011/07/21 21:14:27 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\IMJP8_1
  1216. [2011/07/21 21:14:27 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\IMJP9_0
  1217. [2011/07/14 18:36:01 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\Internet Explorer
  1218. [2011/08/02 13:41:48 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\MMC
  1219. [2011/07/14 18:18:44 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\Network
  1220. [2013/08/26 21:46:09 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\Office
  1221. [2011/07/21 04:35:06 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\Proof
  1222. [2013/06/04 19:52:22 | 000,000,000 | --SD | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\Protect
  1223. [2011/07/15 21:59:07 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\Speech
  1224. [2011/08/15 21:28:37 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\Sticky Notes
  1225. [2011/07/14 15:15:05 | 000,000,000 | --SD | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\SystemCertificates
  1226. [2013/07/05 21:13:26 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\Templates
  1227. [2013/08/26 21:44:14 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\UProof
  1228. [2012/03/10 09:11:49 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\Windows
  1229. [2013/04/05 19:57:26 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\Windows Live Photo Gallery
  1230. [2011/08/21 18:31:56 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\Windows Photo Viewer
  1231. [2013/08/26 21:36:32 | 000,000,000 | ---D | M] -- C:\Users\Carrie\AppData\Roaming\Microsoft\Word
  1232.  
  1233. [color=#A23BEC]< >[/color]
  1234.  
  1235. [color=#A23BEC]< %windir%\AppPatch\*.* >[/color]
  1236. [2013/02/11 23:48:26 | 002,176,512 | ---- | M] (Microsoft Corporation) -- C:\windows\AppPatch\AcGenral.dll
  1237. [2012/10/16 02:39:52 | 000,561,664 | ---- | M] (Microsoft Corporation) -- C:\windows\AppPatch\AcLayers.dll
  1238. [2009/07/13 20:03:47 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\windows\AppPatch\AcRes.dll
  1239. [2013/02/11 23:48:31 | 000,474,112 | ---- | M] (Microsoft Corporation) -- C:\windows\AppPatch\AcSpecfc.dll
  1240. [2012/11/29 23:45:10 | 000,044,032 | ---- | M] (Microsoft Corporation) -- C:\windows\AppPatch\acwow64.dll
  1241. [2009/07/13 20:14:52 | 000,211,968 | ---- | M] (Microsoft Corporation) -- C:\windows\AppPatch\AcXtrnal.dll
  1242. [2009/07/13 20:14:53 | 000,041,984 | ---- | M] (Microsoft Corporation) -- C:\windows\AppPatch\apihex86.dll
  1243. [2013/02/11 18:34:34 | 000,151,630 | ---- | M] () -- C:\windows\AppPatch\drvmain.sdb
  1244. [2011/03/03 19:02:15 | 001,826,582 | ---- | M] () -- C:\windows\AppPatch\msimain.sdb
  1245. [2011/03/03 18:56:14 | 000,044,930 | ---- | M] () -- C:\windows\AppPatch\pcamain.sdb
  1246. [2013/02/11 18:34:31 | 004,077,954 | ---- | M] () -- C:\windows\AppPatch\sysmain.sdb
  1247.  
  1248. [color=#A23BEC]< >[/color]
  1249.  
  1250. [color=#A23BEC]< %windir%\AppPatch\*. >[/color]
  1251. [2013/09/09 06:14:51 | 000,000,000 | ---D | M] -- C:\windows\AppPatch\AppPatch64
  1252. [2009/07/13 22:20:08 | 000,000,000 | ---D | M] -- C:\windows\AppPatch\Custom
  1253. [2010/11/21 02:06:49 | 000,000,000 | ---D | M] -- C:\windows\AppPatch\en-US
  1254.  
  1255. [color=#A23BEC]< %Public%\Documents\*.* >[/color]
  1256. [2009/07/13 23:54:24 | 000,000,278 | -HS- | M] () -- C:\Users\Public\Documents\desktop.ini
  1257.  
  1258. [color=#A23BEC]< >[/color]
  1259.  
  1260. [color=#A23BEC]< %Public%\Documents\*. >[/color]
  1261. [2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- C:\Users\Public\Documents\My Music
  1262. [2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- C:\Users\Public\Documents\My Pictures
  1263. [2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- C:\Users\Public\Documents\My Videos
  1264.  
  1265. [color=#A23BEC]< >[/color]
  1266.  
  1267. [color=#A23BEC]< %ProgramData%\*.* >[/color]
  1268.  
  1269. [color=#A23BEC]< %ProgramData%\*. >[/color]
  1270. [2011/07/21 21:15:54 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe
  1271. [2011/08/05 10:52:26 | 000,000,000 | ---D | M] -- C:\ProgramData\AOL Downloads
  1272. [2011/08/25 20:08:17 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple
  1273. [2011/08/25 20:09:49 | 000,000,000 | ---D | M] -- C:\ProgramData\Apple Computer
  1274. [2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
  1275. [2011/06/08 20:34:40 | 000,000,000 | ---D | M] -- C:\ProgramData\ATI
  1276. [2013/08/31 18:56:53 | 000,000,000 | ---D | M] -- C:\ProgramData\AVAST Software
  1277. [2013/07/12 22:28:05 | 000,000,000 | -H-D | M] -- C:\ProgramData\Common Files
  1278. [2009/07/14 00:08:56 | 000,000,000 | --SD | M] -- C:\ProgramData\Desktop
  1279. [2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
  1280. [2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
  1281. [2011/06/08 21:13:21 | 000,000,000 | ---D | M] -- C:\ProgramData\Google
  1282. [2011/11/15 22:20:22 | 000,000,000 | ---D | M] -- C:\ProgramData\HP
  1283. [2011/11/15 22:20:30 | 000,000,000 | ---D | M] -- C:\ProgramData\HP Photo Creations
  1284. [2013/05/10 09:59:30 | 000,000,000 | ---D | M] -- C:\ProgramData\iolo
  1285. [2013/08/05 21:21:32 | 000,000,000 | ---D | M] -- C:\ProgramData\lx_Cats
  1286. [2011/08/01 22:00:03 | 000,000,000 | ---D | M] -- C:\ProgramData\Malwarebytes
  1287. [2013/08/30 23:01:15 | 000,000,000 | ---D | M] -- C:\ProgramData\McAfee
  1288. [2013/09/07 07:31:27 | 000,000,000 | --SD | M] -- C:\ProgramData\Microsoft
  1289. [2013/09/04 22:11:13 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft Help
  1290. [2011/08/02 07:57:31 | 000,000,000 | ---D | M] -- C:\ProgramData\Norton
  1291. [2011/06/08 21:16:52 | 000,000,000 | ---D | M] -- C:\ProgramData\NortonInstaller
  1292. [2013/07/04 01:14:28 | 000,000,000 | ---D | M] -- C:\ProgramData\regid.1991-06.com.microsoft
  1293. [2013/03/17 09:03:48 | 000,000,000 | ---D | M] -- C:\ProgramData\Roblox
  1294. [2011/12/26 22:07:21 | 000,000,000 | ---D | M] -- C:\ProgramData\Samsung
  1295. [2013/01/26 21:48:11 | 000,000,000 | ---D | M] -- C:\ProgramData\Skype
  1296. [2012/05/05 21:03:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Skype Extras
  1297. [2012/07/28 21:06:22 | 000,000,000 | ---D | M] -- C:\ProgramData\Spybot - Search & Destroy
  1298. [2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
  1299. [2011/03/29 21:48:20 | 000,000,000 | ---D | M] -- C:\ProgramData\Sun
  1300. [2011/09/30 21:34:09 | 000,000,000 | ---D | M] -- C:\ProgramData\Symantec
  1301. [2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
  1302. [2013/04/03 21:41:16 | 000,000,000 | ---D | M] -- C:\ProgramData\TomTom
  1303. [2011/06/08 21:16:03 | 000,000,000 | ---D | M] -- C:\ProgramData\Toshiba
  1304. [2011/08/01 09:41:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Toshiba Book Place
  1305. [2012/10/28 20:05:13 | 000,000,000 | ---D | M] -- C:\ProgramData\VirtualizedApplications
  1306. [2011/06/08 21:12:42 | 000,000,000 | ---D | M] -- C:\ProgramData\WildTangent
  1307.  
  1308. [color=#A23BEC]< %CommonProgramFiles%\*.* >[/color]
  1309.  
  1310. [color=#A23BEC]< >[/color]
  1311.  
  1312. [color=#A23BEC]< %CommonProgramFiles%\*. >[/color]
  1313. [2011/03/29 21:53:56 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Common Files\Adobe
  1314. [2012/08/14 22:04:23 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Common Files\Adobe AIR
  1315. [2011/08/25 20:08:42 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Common Files\Apple
  1316. [2011/06/08 20:33:09 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Common Files\ATI Technologies
  1317. [2011/03/29 21:54:43 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Common Files\InstallShield
  1318. [2013/08/30 23:03:42 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Common Files\Java
  1319. [2013/07/04 01:14:23 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Common Files\microsoft shared
  1320. [2009/07/13 22:20:08 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Common Files\Services
  1321. [2013/01/26 21:47:59 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Common Files\Skype
  1322. [2009/07/13 22:20:08 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Common Files\SpeechEngines
  1323. [2012/01/11 23:30:02 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Common Files\Symantec Shared
  1324. [2011/11/10 19:37:20 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Common Files\System
  1325. [2011/06/08 20:46:14 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Common Files\Ulead Systems
  1326. [2011/03/29 21:55:40 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Common Files\Windows Live
  1327.  
  1328. [color=#A23BEC]< %CommonProgramFiles%\ComObjects\*.exe >[/color]
  1329.  
  1330. [color=#A23BEC]< %ProgramFiles%\*.* >[/color]
  1331. [2009/07/13 23:54:24 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini
  1332.  
  1333. [color=#A23BEC]< %ProgramFiles%\*. >[/color]
  1334. [2011/03/29 21:54:33 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Adobe
  1335. [2011/08/25 20:08:18 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Apple Software Update
  1336. [2011/06/08 20:32:50 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\ATI Technologies
  1337. [2013/08/30 23:03:42 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Common Files
  1338. [2011/06/08 20:46:11 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Corel
  1339. [2013/01/14 23:06:22 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Coupons
  1340. [2012/06/17 18:47:14 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Dora's World Adventure
  1341. [2012/11/02 21:48:04 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Google
  1342. [2011/11/15 22:08:47 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\HP
  1343. [2011/11/15 22:08:55 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\HP Photo Creations
  1344. [2012/11/02 21:42:49 | 000,000,000 | -H-D | M] -- C:\Program Files (x86)\InstallShield Installation Information
  1345. [2013/09/09 06:14:29 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Internet Explorer
  1346. [2013/05/10 09:59:24 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\iolo
  1347. [2013/08/30 23:02:53 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Java
  1348. [2011/08/13 11:42:19 | 000,000,000 | -H-D | M] -- C:\Program Files (x86)\KidLogger
  1349. [2013/09/10 15:01:18 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
  1350. [2011/12/26 22:04:53 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\MarkAny
  1351. [2012/07/29 07:43:54 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Microsoft
  1352. [2013/09/07 06:37:07 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Microsoft Silverlight
  1353. [2011/03/29 21:58:39 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
  1354. [2013/07/04 01:14:23 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Microsoft.NET
  1355. [2013/07/12 22:29:20 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Minecraft
  1356. [2009/07/14 00:32:38 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\MSBuild
  1357. [2012/08/07 21:16:35 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\MSECache
  1358. [2011/12/28 07:38:20 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\MSXML 4.0
  1359. [2011/06/08 21:16:57 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Norton PC Checkup
  1360. [2011/07/28 09:30:02 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\NortonInstaller
  1361. [2011/03/29 21:53:10 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\PlayReady
  1362. [2011/08/25 20:10:26 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\QuickTime
  1363. [2011/06/08 20:38:40 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Realtek
  1364. [2011/06/08 20:41:30 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Realtek WLAN Driver
  1365. [2009/07/14 00:32:38 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Reference Assemblies
  1366. [2013/05/10 16:03:01 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\rkfree
  1367. [2013/03/17 09:03:39 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Roblox
  1368. [2011/12/26 22:07:46 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Samsung
  1369. [2012/08/14 21:58:23 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Shutterfly
  1370. [2013/01/26 21:47:59 | 000,000,000 | R--D | M] -- C:\Program Files (x86)\Skype
  1371. [2012/12/11 12:36:29 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\SpeedFan
  1372. [2012/07/28 21:03:27 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Spybot - Search & Destroy
  1373. [2013/04/03 21:28:16 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\TomTom HOME 2
  1374. [2013/04/03 21:26:43 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\TomTom International B.V
  1375. [2012/11/02 21:42:49 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Toshiba
  1376. [2011/06/08 21:18:08 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\TOSHIBA Games
  1377. [2011/06/08 21:16:04 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Toshiba Online Backup
  1378. [2009/07/13 23:57:06 | 000,000,000 | -H-D | M] -- C:\Program Files (x86)\Uninstall Information
  1379. [2011/06/08 21:09:14 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\WildTangent Games
  1380. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Defender
  1381. [2011/03/29 21:59:57 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Live
  1382. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Mail
  1383. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Media Player
  1384. [2009/07/14 00:32:38 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows NT
  1385. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Photo Viewer
  1386. [2010/11/20 22:31:38 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Portable Devices
  1387. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Sidebar
  1388.  
  1389. [color=#A23BEC]< >[/color]
  1390.  
  1391. [color=#A23BEC]< %programdata%\Microsoft\Windows\DRM\*.tmp >[/color]
  1392.  
  1393. [color=#A23BEC]< %programdata%\Microsoft\DRM\*.tmp >[/color]
  1394.  
  1395. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\AppData\Local\*.* >[/color]
  1396.  
  1397. [color=#A23BEC]< >[/color]
  1398.  
  1399. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\AppData\Local\*. >[/color]
  1400. [2012/03/21 16:46:37 | 000,000,000 | ---D | M] -- C:\windows\system32\config\systemprofile\AppData\Local\Adobe
  1401. [2011/07/20 18:45:52 | 000,000,000 | ---D | M] -- C:\windows\system32\config\systemprofile\AppData\Local\CrashDumps
  1402. [2011/07/29 06:17:36 | 000,000,000 | ---D | M] -- C:\windows\system32\config\systemprofile\AppData\Local\Google
  1403. [2012/03/22 06:42:31 | 000,000,000 | ---D | M] -- C:\windows\system32\config\systemprofile\AppData\Local\Microsoft
  1404. [2013/02/02 21:03:11 | 000,000,000 | ---D | M] -- C:\windows\system32\config\systemprofile\AppData\Local\SoftGrid Client
  1405. [2012/03/21 16:46:37 | 000,000,000 | ---D | M] -- C:\windows\system32\config\systemprofile\AppData\Local\Temp
  1406.  
  1407. [color=#A23BEC]< >[/color]
  1408.  
  1409. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\AppData\Roaming\*.* >[/color]
  1410.  
  1411. [color=#A23BEC]< >[/color]
  1412.  
  1413. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\AppData\Roaming\*. >[/color]
  1414. [2012/03/21 16:46:37 | 000,000,000 | ---D | M] -- C:\windows\system32\config\systemprofile\AppData\Roaming\Adobe
  1415. [2012/03/21 11:57:39 | 000,000,000 | ---D | M] -- C:\windows\system32\config\systemprofile\AppData\Roaming\Macromedia
  1416. [2012/03/24 09:50:04 | 000,000,000 | ---D | M] -- C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft
  1417. [2013/07/03 22:34:13 | 000,000,000 | ---D | M] -- C:\windows\system32\config\systemprofile\AppData\Roaming\SoftGrid Client
  1418.  
  1419. [color=#A23BEC]< >[/color]
  1420.  
  1421. [color=#A23BEC]< %windir%\SysWOW64\config\systemprofile\AppData\Local\*.* >[/color]
  1422.  
  1423. [color=#A23BEC]< >[/color]
  1424.  
  1425. [color=#A23BEC]< %windir%\SysWOW64\config\systemprofile\AppData\Local\*. >[/color]
  1426. [2012/03/21 16:46:37 | 000,000,000 | ---D | M] -- C:\windows\SysWOW64\config\systemprofile\AppData\Local\Adobe
  1427. [2011/07/20 18:45:52 | 000,000,000 | ---D | M] -- C:\windows\SysWOW64\config\systemprofile\AppData\Local\CrashDumps
  1428. [2011/07/29 06:17:36 | 000,000,000 | ---D | M] -- C:\windows\SysWOW64\config\systemprofile\AppData\Local\Google
  1429. [2012/03/22 06:42:31 | 000,000,000 | ---D | M] -- C:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft
  1430. [2013/02/02 21:03:11 | 000,000,000 | ---D | M] -- C:\windows\SysWOW64\config\systemprofile\AppData\Local\SoftGrid Client
  1431. [2012/03/21 16:46:37 | 000,000,000 | ---D | M] -- C:\windows\SysWOW64\config\systemprofile\AppData\Local\Temp
  1432.  
  1433. [color=#A23BEC]< >[/color]
  1434.  
  1435. [color=#A23BEC]< %windir%\SysWOW64\config\systemprofile\AppData\Roaming\*.* >[/color]
  1436.  
  1437. [color=#A23BEC]< >[/color]
  1438.  
  1439. [color=#A23BEC]< %windir%\SysWOW64\config\systemprofile\AppData\Roaming\*. >[/color]
  1440. [2012/03/21 16:46:37 | 000,000,000 | ---D | M] -- C:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Adobe
  1441. [2012/03/21 11:57:39 | 000,000,000 | ---D | M] -- C:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Macromedia
  1442. [2012/03/24 09:50:04 | 000,000,000 | ---D | M] -- C:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft
  1443. [2013/07/03 22:34:13 | 000,000,000 | ---D | M] -- C:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SoftGrid Client
  1444.  
  1445. [color=#A23BEC]< >[/color]
  1446.  
  1447. [color=#A23BEC]< %windir%\ServiceProfiles\LocalService\AppData\Local\Temp\*.tlb >[/color]
  1448.  
  1449. [color=#A23BEC]< %windir%\ServiceProfiles\NetworkService\AppData\Local\Temp\*.tlb >[/color]
  1450.  
  1451. [color=#A23BEC]< %windir%\temp\*.exe >[/color]
  1452.  
  1453. [color=#A23BEC]< %windir%\*. >[/color]
  1454. [2009/07/14 00:32:39 | 000,000,000 | ---D | M] -- C:\windows\addins
  1455. [2009/07/13 22:20:08 | 000,000,000 | ---D | M] -- C:\windows\AppCompat
  1456. [2013/09/09 06:14:50 | 000,000,000 | ---D | M] -- C:\windows\AppPatch
  1457. [2013/09/09 12:22:55 | 000,000,000 | R-SD | M] -- C:\windows\assembly
  1458. [2009/07/14 00:32:38 | 000,000,000 | ---D | M] -- C:\windows\Boot
  1459. [2009/07/14 00:32:38 | 000,000,000 | ---D | M] -- C:\windows\Branding
  1460. [2009/07/14 00:32:39 | 000,000,000 | ---D | M] -- C:\windows\Cursors
  1461. [2012/08/09 11:25:29 | 000,000,000 | ---D | M] -- C:\windows\debug
  1462. [2009/07/14 00:32:38 | 000,000,000 | ---D | M] -- C:\windows\diagnostics
  1463. [2009/07/14 00:37:46 | 000,000,000 | ---D | M] -- C:\windows\DigitalLocker
  1464. [2011/03/29 21:48:48 | 000,000,000 | ---D | M] -- C:\windows\Downloaded Installations
  1465. [2012/06/09 09:55:08 | 000,000,000 | ---D | M] -- C:\windows\Downloaded Program Files
  1466. [2012/01/11 22:54:17 | 000,000,000 | ---D | M] -- C:\windows\ehome
  1467. [2011/03/29 21:59:47 | 000,000,000 | ---D | M] -- C:\windows\en
  1468. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\en-US
  1469. [2012/07/19 21:17:54 | 000,000,000 | ---D | M] -- C:\windows\erdnt
  1470. [2013/07/09 19:29:41 | 000,000,000 | R-SD | M] -- C:\windows\Fonts
  1471. [2012/06/17 18:47:37 | 000,000,000 | -HSD | M] -- C:\windows\ftpcache
  1472. [2010/11/21 02:19:27 | 000,000,000 | ---D | M] -- C:\windows\Globalization
  1473. [2010/11/21 02:06:49 | 000,000,000 | ---D | M] -- C:\windows\Help
  1474. [2009/07/14 00:37:46 | 000,000,000 | ---D | M] -- C:\windows\IME
  1475. [2013/09/14 10:44:32 | 000,000,000 | ---D | M] -- C:\windows\inf
  1476. [2013/09/09 07:00:44 | 000,000,000 | -HSD | M] -- C:\windows\Installer
  1477. [2009/07/14 00:32:39 | 000,000,000 | ---D | M] -- C:\windows\L2Schemas
  1478. [2011/08/25 19:22:14 | 000,000,000 | ---D | M] -- C:\windows\LiveKernelReports
  1479. [2012/03/10 08:05:33 | 000,000,000 | ---D | M] -- C:\windows\Logs
  1480. [2009/07/14 00:32:40 | 000,000,000 | R-SD | M] -- C:\windows\Media
  1481. [2013/09/09 12:24:16 | 000,000,000 | ---D | M] -- C:\windows\Microsoft.NET
  1482. [2011/10/23 13:25:04 | 000,000,000 | ---D | M] -- C:\windows\Minidump
  1483. [2009/07/13 21:34:34 | 000,000,000 | ---D | M] -- C:\windows\ModemLogs
  1484. [2009/07/14 00:32:40 | 000,000,000 | ---D | M] -- C:\windows\Offline Web Pages
  1485. [2011/07/14 15:17:45 | 000,000,000 | ---D | M] -- C:\windows\Panther
  1486. [2009/07/14 00:32:38 | 000,000,000 | ---D | M] -- C:\windows\Performance
  1487. [2009/07/13 22:20:10 | 000,000,000 | ---D | M] -- C:\windows\PLA
  1488. [2013/09/07 06:49:31 | 000,000,000 | ---D | M] -- C:\windows\PolicyDefinitions
  1489. [2013/09/13 17:46:01 | 000,000,000 | ---D | M] -- C:\windows\Prefetch
  1490. [2013/09/06 23:29:51 | 000,000,000 | ---D | M] -- C:\windows\registration
  1491. [2013/09/09 12:41:32 | 000,000,000 | ---D | M] -- C:\windows\rescache
  1492. [2012/08/17 11:40:21 | 000,000,000 | ---D | M] -- C:\windows\Resources
  1493. [2009/07/13 21:35:47 | 000,000,000 | ---D | M] -- C:\windows\SchCache
  1494. [2009/07/14 00:32:38 | 000,000,000 | ---D | M] -- C:\windows\schemas
  1495. [2009/07/13 22:20:10 | 000,000,000 | ---D | M] -- C:\windows\security
  1496. [2009/07/13 23:45:47 | 000,000,000 | ---D | M] -- C:\windows\ServiceProfiles
  1497. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\servicing
  1498. [2011/03/29 22:12:00 | 000,000,000 | ---D | M] -- C:\windows\Setup
  1499. [2010/11/21 02:16:47 | 000,000,000 | ---D | M] -- C:\windows\ShellNew
  1500. [2013/09/06 23:37:59 | 000,000,000 | ---D | M] -- C:\windows\SoftwareDistribution
  1501. [2010/11/21 02:06:49 | 000,000,000 | ---D | M] -- C:\windows\Speech
  1502. [2012/01/07 22:51:14 | 000,000,000 | ---D | M] -- C:\windows\Sun
  1503. [2009/07/13 21:36:55 | 000,000,000 | ---D | M] -- C:\windows\system
  1504. [2013/09/14 10:44:32 | 000,000,000 | ---D | M] -- C:\windows\System32
  1505. [2013/09/12 07:22:54 | 000,000,000 | ---D | M] -- C:\windows\SysWOW64
  1506. [2009/07/13 23:57:13 | 000,000,000 | ---D | M] -- C:\windows\TAPI
  1507. [2013/09/12 07:06:55 | 000,000,000 | ---D | M] -- C:\windows\Tasks
  1508. [2013/09/14 10:53:03 | 000,000,000 | ---D | M] -- C:\windows\Temp
  1509. [2009/07/13 21:34:33 | 000,000,000 | ---D | M] -- C:\windows\tracing
  1510. [2011/11/15 22:08:12 | 000,000,000 | ---D | M] -- C:\windows\twain_32
  1511. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\Vss
  1512. [2009/07/14 00:32:38 | 000,000,000 | ---D | M] -- C:\windows\Web
  1513. [2013/09/09 06:17:32 | 000,000,000 | ---D | M] -- C:\windows\winsxs
  1514.  
  1515. [color=#A23BEC]< %windir%\ShellNew\*.* >[/color]
  1516. [2009/06/10 15:44:28 | 000,004,544 | ---- | M] () -- C:\windows\ShellNew\Journal.jnt
  1517.  
  1518. [color=#A23BEC]< %windir%\installer\*. >[/color]
  1519. [2011/03/29 21:55:56 | 000,000,000 | -HSD | M] -- C:\windows\installer\$PatchCache$
  1520. [2011/06/08 20:32:17 | 000,000,000 | ---D | M] -- C:\windows\installer\{04259F13-626E-814E-A80C-4601DFF3CE95}
  1521. [2011/06/08 20:32:39 | 000,000,000 | ---D | M] -- C:\windows\installer\{04D90620-2973-6F93-6E6C-C833F39C50C1}
  1522. [2011/06/08 20:54:48 | 000,000,000 | ---D | M] -- C:\windows\installer\{066CFFF8-12BF-4390-A673-75F95EFF188E}
  1523. [2011/06/08 20:46:14 | 000,000,000 | ---D | M] -- C:\windows\installer\{0D795777-9D60-4692-8386-F2B3F2B5E5BF}
  1524. [2011/06/08 20:32:43 | 000,000,000 | ---D | M] -- C:\windows\installer\{0FC61261-B251-C870-C650-8A854F1B4CF0}
  1525. [2011/06/08 20:31:37 | 000,000,000 | ---D | M] -- C:\windows\installer\{1D27E8CF-7546-F200-4CA3-CD2F39909F5A}
  1526. [2011/03/29 21:50:57 | 000,000,000 | ---D | M] -- C:\windows\installer\{24811C12-F4A9-4D0F-8494-A7B8FE46123C}
  1527. [2011/06/08 20:32:07 | 000,000,000 | ---D | M] -- C:\windows\installer\{24C563C0-5569-A3BF-DF26-AAB3F25B5375}
  1528. [2013/09/09 07:00:44 | 000,000,000 | ---D | M] -- C:\windows\installer\{27726449-83B8-428D-92DE-101346C1E15C}
  1529. [2011/06/08 20:32:34 | 000,000,000 | ---D | M] -- C:\windows\installer\{2823D463-54F8-F7B4-818F-B7436FF70658}
  1530. [2011/06/08 20:32:28 | 000,000,000 | ---D | M] -- C:\windows\installer\{32F32D10-5190-7565-DD14-C235FAF81408}
  1531. [2011/06/08 20:32:19 | 000,000,000 | ---D | M] -- C:\windows\installer\{34F971C8-B75F-6B8D-4AFC-5DAB84241AE6}
  1532. [2011/06/08 20:32:30 | 000,000,000 | ---D | M] -- C:\windows\installer\{3798E892-DB93-6BE5-D4AD-8D1C4569F5EF}
  1533. [2011/06/08 20:32:50 | 000,000,000 | ---D | M] -- C:\windows\installer\{3EF6F8CE-BE77-0786-CA40-3CB5BF5EBCC8}
  1534. [2011/06/08 20:31:30 | 000,000,000 | ---D | M] -- C:\windows\installer\{48752121-1E3B-59E4-B765-19F4B8847180}
  1535. [2012/06/17 18:47:19 | 000,000,000 | ---D | M] -- C:\windows\installer\{4DEB87B1-6B92-4E99-AE10-6EA5835917E7}
  1536. [2013/01/26 21:47:59 | 000,000,000 | ---D | M] -- C:\windows\installer\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}
  1537. [2011/06/08 20:33:09 | 000,000,000 | ---D | M] -- C:\windows\installer\{522D5958-FFF0-2849-776B-442BE2A0004C}
  1538. [2011/06/08 20:32:11 | 000,000,000 | ---D | M] -- C:\windows\installer\{52A2A26B-59BE-DE58-67EA-AE33077248A0}
  1539. [2011/06/08 20:32:37 | 000,000,000 | ---D | M] -- C:\windows\installer\{589EB570-9B45-8EF9-7A0F-2A5B3A37BC49}
  1540. [2011/06/08 20:31:32 | 000,000,000 | ---D | M] -- C:\windows\installer\{59F65EE9-3DD6-6944-8222-342A9947D40B}
  1541. [2011/06/08 21:15:05 | 000,000,000 | ---D | M] -- C:\windows\installer\{5DA0E02F-970B-424B-BF41-513A5018E4C0}
  1542. [2011/06/08 20:32:20 | 000,000,000 | ---D | M] -- C:\windows\installer\{60A1C223-4D86-AD1E-FB21-DE75010DABE3}
  1543. [2012/06/09 09:56:07 | 000,000,000 | ---D | M] -- C:\windows\installer\{612C34C7-5E90-47D8-9B5C-0F717DD82726}
  1544. [2011/06/08 20:32:36 | 000,000,000 | ---D | M] -- C:\windows\installer\{618AF7BF-10CD-0118-EE52-ED9BC440487B}
  1545. [2011/08/25 20:08:59 | 000,000,000 | ---D | M] -- C:\windows\installer\{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}
  1546. [2011/06/08 20:32:22 | 000,000,000 | ---D | M] -- C:\windows\installer\{6C313A41-2704-23C5-DA68-05BB34126233}
  1547. [2011/06/08 20:32:45 | 000,000,000 | ---D | M] -- C:\windows\installer\{6C49A7D6-FD97-A573-29C7-87ED1756AC6D}
  1548. [2011/06/08 20:49:38 | 000,000,000 | ---D | M] -- C:\windows\installer\{6F3C8901-EBD3-470D-87F8-AC210F6E5E02}
  1549. [2011/06/08 20:32:26 | 000,000,000 | ---D | M] -- C:\windows\installer\{70B4D913-147C-7084-961A-6728E8F2AC2E}
  1550. [2011/08/25 20:08:18 | 000,000,000 | ---D | M] -- C:\windows\installer\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}
  1551. [2011/11/15 22:08:31 | 000,000,000 | ---D | M] -- C:\windows\installer\{7D220A57-969F-4D09-9297-D48195A8ABDD}
  1552. [2011/12/28 07:38:21 | 000,000,000 | ---D | M] -- C:\windows\installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
  1553. [2013/09/07 00:24:26 | 000,000,000 | ---D | M] -- C:\windows\installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
  1554. [2011/03/29 21:53:17 | 000,000,000 | ---D | M] -- C:\windows\installer\{92C7DC44-DAD3-49FE-B89B-F92C6BA9A331}
  1555. [2011/03/29 21:59:10 | 000,000,000 | ---D | M] -- C:\windows\installer\{A726AE06-AAA3-43D1-87E3-70F510314F04}
  1556. [2011/03/29 21:53:56 | 000,000,000 | ---D | M] -- C:\windows\installer\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}
  1557. [2011/06/08 20:32:03 | 000,000,000 | ---D | M] -- C:\windows\installer\{ACB77FD0-7796-82B5-51B1-3ABAD84932E7}
  1558. [2011/06/08 20:32:56 | 000,000,000 | ---D | M] -- C:\windows\installer\{AE26F217-2100-A52C-2A00-3829358E4930}
  1559. [2011/11/15 22:08:53 | 000,000,000 | ---D | M] -- C:\windows\installer\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}
  1560. [2011/06/08 20:32:32 | 000,000,000 | ---D | M] -- C:\windows\installer\{B35FB627-BB1F-E79D-9512-E7CF549B00AD}
  1561. [2011/03/29 21:50:01 | 000,000,000 | ---D | M] -- C:\windows\installer\{C14518AF-1A0F-4D39-8011-69BAA01CD380}
  1562. [2011/06/08 20:32:13 | 000,000,000 | ---D | M] -- C:\windows\installer\{C4F1B841-0C75-368C-0A54-1BAF7C8B6A91}
  1563. [2011/06/08 21:16:04 | 000,000,000 | ---D | M] -- C:\windows\installer\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}
  1564. [2011/08/25 20:10:07 | 000,000,000 | ---D | M] -- C:\windows\installer\{C9E14402-3631-4182-B377-6B0DFB1C0339}
  1565. [2011/06/08 20:32:41 | 000,000,000 | ---D | M] -- C:\windows\installer\{CE15C07B-32E3-0586-305C-975F0FEE559A}
  1566. [2011/03/29 21:49:05 | 000,000,000 | ---D | M] -- C:\windows\installer\{D4322448-B6AF-4316-B859-D8A0E84DCB38}
  1567. [2011/06/08 20:32:15 | 000,000,000 | ---D | M] -- C:\windows\installer\{DC280F21-4FD6-9D47-6323-7CD5C8712DFB}
  1568. [2011/03/29 21:59:19 | 000,000,000 | ---D | M] -- C:\windows\installer\{DECDCB7C-58CC-4865-91AF-627F9798FE48}
  1569. [2011/03/29 21:58:17 | 000,000,000 | ---D | M] -- C:\windows\installer\{EB4DF488-AAEF-406F-A341-CB2AAA315B90}
  1570. [2013/04/03 21:28:25 | 000,000,000 | ---D | M] -- C:\windows\installer\{EC5F4C1B-F838-4CB7-8561-8F809296428B}
  1571. [2011/06/08 21:16:15 | 000,000,000 | ---D | M] -- C:\windows\installer\{ED3CBA78-488F-4E8C-B33F-8E3BF4DDB4D2}
  1572. [2011/06/08 20:32:09 | 000,000,000 | ---D | M] -- C:\windows\installer\{ED8AB7F6-E885-A8E9-1E97-2218D89FAE8F}
  1573. [2011/06/08 20:32:24 | 000,000,000 | ---D | M] -- C:\windows\installer\{EEE6C8F8-4FDD-A08F-2292-31B34E327C0C}
  1574. [2011/03/29 21:58:39 | 000,000,000 | ---D | M] -- C:\windows\installer\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
  1575. [2011/12/26 22:05:21 | 000,000,000 | ---D | M] -- C:\windows\installer\{F193FC0E-9E18-40FC-A974-509A1BDD240A}
  1576. [2011/06/08 20:32:48 | 000,000,000 | ---D | M] -- C:\windows\installer\{F4C03C2A-E14E-EB7C-AAD7-F4FB6396BEA1}
  1577. [2011/12/28 07:38:41 | 000,000,000 | ---D | M] -- C:\windows\installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
  1578. [2011/06/08 20:52:40 | 000,000,000 | ---D | M] -- C:\windows\installer\{F67FA545-D8E5-4209-86B1-AEE045D1003F}
  1579. [2011/11/15 22:08:43 | 000,000,000 | ---D | M] -- C:\windows\installer\{F7632A9B-661E-4FD9-B1A4-3B86BC99847F}
  1580. [2011/06/08 20:32:05 | 000,000,000 | ---D | M] -- C:\windows\installer\{F9E83908-4502-9B01-6B42-21E449DD2627}
  1581. [2011/06/08 20:32:01 | 000,000,000 | ---D | M] -- C:\windows\installer\{FB90923E-F94F-4343-A084-F0AB39305C8B}
  1582.  
  1583. [color=#A23BEC]< %windir%\system32\*. >[/color]
  1584. [2013/05/25 20:07:33 | 000,000,000 | -HSD | M] -- C:\windows\system32\%APPDATA%
  1585. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\system32\0409
  1586. [2012/06/09 10:00:55 | 000,000,000 | ---D | M] -- C:\windows\system32\Adobe
  1587. [2010/11/20 22:31:14 | 000,000,000 | ---D | M] -- C:\windows\system32\AdvancedInstallers
  1588. [2009/07/13 22:20:16 | 000,000,000 | ---D | M] -- C:\windows\system32\ar-SA
  1589. [2011/06/08 20:57:11 | 000,000,000 | ---D | M] -- C:\windows\system32\Atheros_L1e
  1590. [2009/07/13 22:20:16 | 000,000,000 | ---D | M] -- C:\windows\system32\bg-BG
  1591. [2009/07/13 21:35:36 | 000,000,000 | ---D | M] -- C:\windows\system32\catroot
  1592. [2009/07/13 21:35:36 | 000,000,000 | ---D | M] -- C:\windows\system32\catroot2
  1593. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\system32\com
  1594. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\system32\config
  1595. [2010/11/20 22:31:14 | 000,000,000 | ---D | M] -- C:\windows\system32\cs-CZ
  1596. [2010/11/20 22:31:19 | 000,000,000 | ---D | M] -- C:\windows\system32\da-DK
  1597. [2009/07/13 22:20:16 | 000,000,000 | ---D | M] -- C:\windows\system32\de-DE
  1598. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\system32\Dism
  1599. [2012/07/19 21:31:30 | 000,000,000 | ---D | M] -- C:\windows\system32\drivers
  1600. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\system32\DriverStore
  1601. [2009/07/13 22:20:17 | 000,000,000 | ---D | M] -- C:\windows\system32\el-GR
  1602. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\system32\en
  1603. [2013/09/09 06:14:52 | 000,000,000 | ---D | M] -- C:\windows\system32\en-US
  1604. [2010/11/20 22:31:13 | 000,000,000 | ---D | M] -- C:\windows\system32\es-ES
  1605. [2009/07/13 22:20:17 | 000,000,000 | ---D | M] -- C:\windows\system32\et-EE
  1606. [2009/07/13 22:20:17 | 000,000,000 | ---D | M] -- C:\windows\system32\fi-FI
  1607. [2009/07/13 22:20:17 | 000,000,000 | ---D | M] -- C:\windows\system32\fr-FR
  1608. [2009/07/14 00:32:38 | 000,000,000 | ---D | M] -- C:\windows\system32\FxsTmp
  1609. [2009/07/13 21:34:27 | 000,000,000 | ---D | M] -- C:\windows\system32\GroupPolicy
  1610. [2009/07/13 21:34:27 | 000,000,000 | ---D | M] -- C:\windows\system32\GroupPolicyUsers
  1611. [2009/07/13 22:20:17 | 000,000,000 | ---D | M] -- C:\windows\system32\he-IL
  1612. [2009/07/13 22:20:17 | 000,000,000 | ---D | M] -- C:\windows\system32\hr-HR
  1613. [2009/07/13 22:20:17 | 000,000,000 | ---D | M] -- C:\windows\system32\hu-HU
  1614. [2009/07/13 22:20:17 | 000,000,000 | ---D | M] -- C:\windows\system32\icsxml
  1615. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\system32\IME
  1616. [2009/07/13 21:36:55 | 000,000,000 | ---D | M] -- C:\windows\system32\inetsrv
  1617. [2009/07/13 22:20:17 | 000,000,000 | ---D | M] -- C:\windows\system32\InstallShield
  1618. [2009/07/13 22:20:17 | 000,000,000 | ---D | M] -- C:\windows\system32\it-IT
  1619. [2009/07/13 22:20:17 | 000,000,000 | ---D | M] -- C:\windows\system32\ja-JP
  1620. [2009/07/13 22:20:17 | 000,000,000 | ---D | M] -- C:\windows\system32\ko-KR
  1621. [2009/07/14 00:32:38 | 000,000,000 | ---D | M] -- C:\windows\system32\LogFiles
  1622. [2009/07/13 22:20:17 | 000,000,000 | ---D | M] -- C:\windows\system32\lt-LT
  1623. [2009/07/13 22:20:19 | 000,000,000 | ---D | M] -- C:\windows\system32\lv-LV
  1624. [2012/06/09 09:59:14 | 000,000,000 | ---D | M] -- C:\windows\system32\Macromed
  1625. [2010/11/20 22:31:14 | 000,000,000 | ---D | M] -- C:\windows\system32\manifeststore
  1626. [2013/09/09 06:14:28 | 000,000,000 | ---D | M] -- C:\windows\system32\migration
  1627. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\system32\migwiz
  1628. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\system32\Msdtc
  1629. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\system32\MUI
  1630. [2009/07/13 22:20:19 | 000,000,000 | ---D | M] -- C:\windows\system32\nb-NO
  1631. [2009/07/13 21:34:31 | 000,000,000 | ---D | M] -- C:\windows\system32\NDF
  1632. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\system32\NetworkList
  1633. [2009/07/13 22:20:19 | 000,000,000 | ---D | M] -- C:\windows\system32\nl-NL
  1634. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\system32\oobe
  1635. [2009/07/13 22:20:19 | 000,000,000 | ---D | M] -- C:\windows\system32\pl-PL
  1636. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\system32\Printing_Admin_Scripts
  1637. [2009/07/13 22:20:19 | 000,000,000 | ---D | M] -- C:\windows\system32\pt-BR
  1638. [2009/07/13 22:20:19 | 000,000,000 | ---D | M] -- C:\windows\system32\pt-PT
  1639. [2009/07/13 22:20:19 | 000,000,000 | ---D | M] -- C:\windows\system32\ras
  1640. [2009/07/13 22:20:19 | 000,000,000 | ---D | M] -- C:\windows\system32\Recovery
  1641. [2009/07/14 00:32:38 | 000,000,000 | ---D | M] -- C:\windows\system32\restore
  1642. [2009/07/13 22:20:19 | 000,000,000 | ---D | M] -- C:\windows\system32\ro-RO
  1643. [2009/07/13 22:20:19 | 000,000,000 | ---D | M] -- C:\windows\system32\ru-RU
  1644. [2011/12/22 20:41:45 | 000,000,000 | ---D | M] -- C:\windows\system32\Samsung_USB_Drivers
  1645. [2011/06/08 20:38:52 | 000,000,000 | ---D | M] -- C:\windows\system32\sda
  1646. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\system32\Setup
  1647. [2009/07/13 22:20:19 | 000,000,000 | ---D | M] -- C:\windows\system32\sk-SK
  1648. [2009/07/13 22:20:19 | 000,000,000 | ---D | M] -- C:\windows\system32\sl-SI
  1649. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\system32\slmgr
  1650. [2009/07/14 00:32:38 | 000,000,000 | ---D | M] -- C:\windows\system32\Speech
  1651. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\system32\spp
  1652. [2010/11/20 22:31:13 | 000,000,000 | ---D | M] -- C:\windows\system32\sppui
  1653. [2009/07/13 22:20:19 | 000,000,000 | ---D | M] -- C:\windows\system32\sr-Latn-CS
  1654. [2009/07/13 22:20:19 | 000,000,000 | ---D | M] -- C:\windows\system32\sv-SE
  1655. [2011/07/14 18:18:45 | 000,000,000 | ---D | M] -- C:\windows\system32\sysprep
  1656. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\system32\Tasks
  1657. [2009/07/13 22:20:19 | 000,000,000 | ---D | M] -- C:\windows\system32\th-TH
  1658. [2009/07/13 22:20:19 | 000,000,000 | ---D | M] -- C:\windows\system32\tr-TR
  1659. [2009/07/13 22:20:19 | 000,000,000 | ---D | M] -- C:\windows\system32\uk-UA
  1660. [2011/07/20 18:44:48 | 000,000,000 | ---D | M] -- C:\windows\system32\Wat
  1661. [2013/09/07 06:49:31 | 000,000,000 | ---D | M] -- C:\windows\system32\wbem
  1662. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\system32\WCN
  1663. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\system32\wdi
  1664. [2009/07/14 00:32:38 | 000,000,000 | ---D | M] -- C:\windows\system32\WindowsPowerShell
  1665. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\system32\winrm
  1666. [2009/07/13 22:20:20 | 000,000,000 | ---D | M] -- C:\windows\system32\zh-CN
  1667. [2009/07/13 22:20:20 | 000,000,000 | ---D | M] -- C:\windows\system32\zh-HK
  1668. [2009/07/13 22:20:20 | 000,000,000 | ---D | M] -- C:\windows\system32\zh-TW
  1669.  
  1670. [color=#A23BEC]< %windir%\sysnative\*. >[/color]
  1671. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\sysnative\0409
  1672. [2010/11/20 22:30:27 | 000,000,000 | ---D | M] -- C:\windows\sysnative\AdvancedInstallers
  1673. [2009/07/13 22:20:11 | 000,000,000 | ---D | M] -- C:\windows\sysnative\ar-SA
  1674. [2009/07/13 22:20:11 | 000,000,000 | ---D | M] -- C:\windows\sysnative\bg-BG
  1675. [2011/07/20 18:44:44 | 000,000,000 | ---D | M] -- C:\windows\sysnative\Boot
  1676. [2013/09/07 07:31:30 | 000,000,000 | ---D | M] -- C:\windows\sysnative\catroot
  1677. [2013/09/08 14:13:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\catroot2
  1678. [2012/03/24 09:51:20 | 000,000,000 | ---D | M] -- C:\windows\sysnative\CodeIntegrity
  1679. [2010/11/21 02:06:49 | 000,000,000 | ---D | M] -- C:\windows\sysnative\com
  1680. [2013/09/14 10:51:41 | 000,000,000 | ---D | M] -- C:\windows\sysnative\config
  1681. [2010/11/20 22:30:27 | 000,000,000 | ---D | M] -- C:\windows\sysnative\cs-CZ
  1682. [2010/11/20 22:30:34 | 000,000,000 | ---D | M] -- C:\windows\sysnative\da-DK
  1683. [2009/07/13 22:20:13 | 000,000,000 | ---D | M] -- C:\windows\sysnative\de-DE
  1684. [2010/11/21 02:06:50 | 000,000,000 | ---D | M] -- C:\windows\sysnative\Dism
  1685. [2013/09/12 07:02:46 | 000,000,000 | ---D | M] -- C:\windows\sysnative\drivers
  1686. [2013/09/07 06:49:24 | 000,000,000 | ---D | M] -- C:\windows\sysnative\DriverStore
  1687. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\el-GR
  1688. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\sysnative\en
  1689. [2013/09/09 06:14:51 | 000,000,000 | ---D | M] -- C:\windows\sysnative\en-US
  1690. [2010/11/20 22:30:26 | 000,000,000 | ---D | M] -- C:\windows\sysnative\es-ES
  1691. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\et-EE
  1692. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\fi-FI
  1693. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\fr-FR
  1694. [2009/07/14 00:09:04 | 000,000,000 | ---D | M] -- C:\windows\sysnative\FxsTmp
  1695. [2009/07/13 21:34:27 | 000,000,000 | ---D | M] -- C:\windows\sysnative\GroupPolicy
  1696. [2009/07/13 21:34:27 | 000,000,000 | ---D | M] -- C:\windows\sysnative\GroupPolicyUsers
  1697. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\he-IL
  1698. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\hr-HR
  1699. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\hu-HU
  1700. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\ias
  1701. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\icsxml
  1702. [2009/07/13 22:20:11 | 000,000,000 | ---D | M] -- C:\windows\sysnative\IME
  1703. [2009/07/13 21:36:55 | 000,000,000 | ---D | M] -- C:\windows\sysnative\inetsrv
  1704. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\it-IT
  1705. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\ja-JP
  1706. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\ko-KR
  1707. [2012/03/21 14:44:22 | 000,000,000 | ---D | M] -- C:\windows\sysnative\LogFiles
  1708. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\lt-LT
  1709. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\lv-LV
  1710. [2012/12/21 09:12:58 | 000,000,000 | ---D | M] -- C:\windows\sysnative\Macromed
  1711. [2010/11/20 22:30:27 | 000,000,000 | ---D | M] -- C:\windows\sysnative\manifeststore
  1712. [2009/07/13 23:45:42 | 000,000,000 | --SD | M] -- C:\windows\sysnative\Microsoft
  1713. [2013/09/09 06:14:27 | 000,000,000 | ---D | M] -- C:\windows\sysnative\migration
  1714. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\sysnative\migwiz
  1715. [2013/09/07 01:03:02 | 000,000,000 | ---D | M] -- C:\windows\sysnative\MRT
  1716. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\Msdtc
  1717. [2010/11/21 02:06:50 | 000,000,000 | ---D | M] -- C:\windows\sysnative\MUI
  1718. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\nb-NO
  1719. [2012/09/28 18:58:00 | 000,000,000 | ---D | M] -- C:\windows\sysnative\NDF
  1720. [2009/07/13 22:20:11 | 000,000,000 | ---D | M] -- C:\windows\sysnative\NetworkList
  1721. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\nl-NL
  1722. [2011/03/29 22:12:05 | 000,000,000 | ---D | M] -- C:\windows\sysnative\oobe
  1723. [2009/07/13 22:20:15 | 000,000,000 | ---D | M] -- C:\windows\sysnative\pl-PL
  1724. [2010/11/21 02:06:50 | 000,000,000 | ---D | M] -- C:\windows\sysnative\Printing_Admin_Scripts
  1725. [2009/07/13 22:20:15 | 000,000,000 | ---D | M] -- C:\windows\sysnative\pt-BR
  1726. [2009/07/13 22:20:15 | 000,000,000 | ---D | M] -- C:\windows\sysnative\pt-PT
  1727. [2009/07/13 22:20:15 | 000,000,000 | ---D | M] -- C:\windows\sysnative\ras
  1728. [2010/11/21 02:08:28 | 000,000,000 | ---D | M] -- C:\windows\sysnative\Recovery
  1729. [2011/07/14 15:15:16 | 000,000,000 | ---D | M] -- C:\windows\sysnative\restore
  1730. [2009/07/13 22:20:15 | 000,000,000 | ---D | M] -- C:\windows\sysnative\ro-RO
  1731. [2009/07/13 22:20:15 | 000,000,000 | ---D | M] -- C:\windows\sysnative\ru-RU
  1732. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\sysnative\Setup
  1733. [2009/07/13 22:20:15 | 000,000,000 | ---D | M] -- C:\windows\sysnative\sk-SK
  1734. [2009/07/13 22:20:15 | 000,000,000 | ---D | M] -- C:\windows\sysnative\sl-SI
  1735. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\sysnative\slmgr
  1736. [2009/07/13 22:20:13 | 000,000,000 | ---D | M] -- C:\windows\sysnative\SMI
  1737. [2009/07/14 00:32:38 | 000,000,000 | ---D | M] -- C:\windows\sysnative\Speech
  1738. [2009/07/13 23:53:31 | 000,000,000 | ---D | M] -- C:\windows\sysnative\spool
  1739. [2009/07/13 22:20:13 | 000,000,000 | ---D | M] -- C:\windows\sysnative\spp
  1740. [2010/11/20 22:30:26 | 000,000,000 | ---D | M] -- C:\windows\sysnative\sppui
  1741. [2009/07/13 22:20:16 | 000,000,000 | ---D | M] -- C:\windows\sysnative\sr-Latn-CS
  1742. [2009/07/13 22:20:16 | 000,000,000 | ---D | M] -- C:\windows\sysnative\sv-SE
  1743. [2011/07/14 15:17:45 | 000,000,000 | ---D | M] -- C:\windows\sysnative\sysprep
  1744. [2013/09/12 07:06:58 | 000,000,000 | ---D | M] -- C:\windows\sysnative\Tasks
  1745. [2009/07/13 22:20:16 | 000,000,000 | ---D | M] -- C:\windows\sysnative\th-TH
  1746. [2009/07/13 22:20:16 | 000,000,000 | ---D | M] -- C:\windows\sysnative\tr-TR
  1747. [2009/07/13 22:20:16 | 000,000,000 | ---D | M] -- C:\windows\sysnative\uk-UA
  1748. [2011/07/20 18:44:48 | 000,000,000 | ---D | M] -- C:\windows\sysnative\Wat
  1749. [2013/09/07 06:49:30 | 000,000,000 | ---D | M] -- C:\windows\sysnative\wbem
  1750. [2010/11/21 02:06:50 | 000,000,000 | ---D | M] -- C:\windows\sysnative\WCN
  1751. [2013/06/04 21:01:39 | 000,000,000 | ---D | M] -- C:\windows\sysnative\wdi
  1752. [2012/04/01 12:14:23 | 000,000,000 | ---D | M] -- C:\windows\sysnative\wfp
  1753. [2009/07/14 00:32:38 | 000,000,000 | ---D | M] -- C:\windows\sysnative\WinBioDatabase
  1754. [2009/07/14 00:37:46 | 000,000,000 | ---D | M] -- C:\windows\sysnative\WinBioPlugIns
  1755. [2009/07/14 00:32:38 | 000,000,000 | ---D | M] -- C:\windows\sysnative\WindowsPowerShell
  1756. [2009/07/13 22:20:14 | 000,000,000 | ---D | M] -- C:\windows\sysnative\winevt
  1757. [2010/11/21 02:06:51 | 000,000,000 | ---D | M] -- C:\windows\sysnative\winrm
  1758. [2009/07/13 22:20:16 | 000,000,000 | ---D | M] -- C:\windows\sysnative\zh-CN
  1759. [2009/07/13 22:20:16 | 000,000,000 | ---D | M] -- C:\windows\sysnative\zh-HK
  1760. [2009/07/13 22:20:16 | 000,000,000 | ---D | M] -- C:\windows\sysnative\zh-TW
  1761.  
  1762. [color=#A23BEC]< %Temp%\smtmp\1\*.* >[/color]
  1763.  
  1764. [color=#A23BEC]< %Temp%\smtmp\2\*.* >[/color]
  1765.  
  1766. [color=#A23BEC]< %Temp%\smtmp\3\*.* >[/color]
  1767.  
  1768. [color=#A23BEC]< %Temp%\smtmp\4\*.* >[/color]
  1769.  
  1770. [color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color]
  1771.  
  1772. [color=#A23BEC]< %systemroot%\syswow64\*.dll /lockedfiles >[/color]
  1773.  
  1774. [color=#A23BEC]< %systemroot%\Tasks\*.job /lockedfiles >[/color]
  1775.  
  1776. [color=#A23BEC]< %systemroot%\system32\drivers\*.sys /90 >[/color]
  1777.  
  1778. [color=#A23BEC]< %systemroot%\system32\drivers\*.sys /lockedfiles >[/color]
  1779.  
  1780. [color=#A23BEC]< %systemroot%\syswow64\drivers\*.sys /90 >[/color]
  1781.  
  1782. [color=#A23BEC]< %systemroot%\syswow64\drivers\*.sys /lockedfiles >[/color]
  1783.  
  1784. [color=#A23BEC]< %SYSTEMDRIVE%\*. /rp /s >[/color]
  1785.  
  1786. [color=#A23BEC]< %systemroot%\assembly\tmp\*.* /S /MD5 >[/color]
  1787. [2011/03/29 21:58:39 | 000,236,392 | ---- | M] () MD5=A200E7209B42BAA18F438695CE45B0B9 -- C:\windows\assembly\tmp\5ZY4HSUI\System.Data.SqlServerCe.dll
  1788.  
  1789. [color=#A23BEC]< %systemroot%\assembly\temp\*.* /S /MD5 >[/color]
  1790. [2013/09/07 00:36:21 | 019,358,208 | ---- | M] () MD5=1625CEDB03B812AE092E7750046B6AA7 -- C:\windows\assembly\temp\E57RCNWDCR\mscorlib.ni.dll
  1791. [2013/09/07 00:38:15 | 014,416,896 | ---- | M] () MD5=F1E223D3295422B459497E48E58B1912 -- C:\windows\assembly\temp\H51VEST3N0\mscorlib.ni.dll
  1792.  
  1793. [color=#A23BEC]< %systemroot%\assembly\GAC\*.ini >[/color]
  1794.  
  1795. [color=#A23BEC]< %systemroot%\assembly\GAC_32\*.ini >[/color]
  1796.  
  1797. [color=#A23BEC]< %systemroot%\assembly\GAC_64\*.ini >[/color]
  1798.  
  1799. [color=#A23BEC]< %SystemRoot%\assembly\GAC_MSIL\*.ini >[/color]
  1800.  
  1801. [color=#A23BEC]< wsSystemRoot|l,n,u,@;True;False;True;$,{ /fn >[/color]
  1802.  
  1803. [color=#A23BEC]< %systemdrive%\$Recycle.Bin|@;true;true;true /fp >[/color]
  1804.  
  1805. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} /s >[/color]
  1806. "" = PSFactoryBuffer
  1807. [HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32]
  1808. "" = %systemroot%\system32\wbem\wbemsvc.dll -- [2009/07/13 20:16:17 | 000,047,616 | ---- | M] (Microsoft Corporation)
  1809. "ThreadingModel" = Both
  1810.  
  1811. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s >[/color]
  1812.  
  1813. [color=#A23BEC]< HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s >[/color]
  1814.  
  1815. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s >[/color]
  1816.  
  1817. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s >[/color]
  1818. "" = MruPidlList
  1819. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  1820. "" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 23:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
  1821. "ThreadingModel" = Apartment
  1822.  
  1823. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} /s >[/color]
  1824. "" = Start Menu Pin
  1825. "ImplementsVerbs" = startpin;startunpin
  1826. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}\InProcServer32]
  1827. "" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 23:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
  1828. "ThreadingModel" = Apartment
  1829.  
  1830. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} /s >[/color]
  1831. "" = PSFactoryBuffer
  1832. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32]
  1833. "" = %systemroot%\system32\wbem\wbemsvc.dll -- [2009/07/13 20:16:17 | 000,047,616 | ---- | M] (Microsoft Corporation)
  1834. "ThreadingModel" = Both
  1835.  
  1836. [color=#A23BEC]< HKEY_CLASSES_ROOT\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s >[/color]
  1837. "" = Microsoft WBEM _WbemFetchRefresherMgr Proxy Helper
  1838. [HKEY_CLASSES_ROOT\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32]
  1839. "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 22:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
  1840. "ThreadingModel" = Free
  1841.  
  1842. [color=#A23BEC]< HKEY_CLASSES_ROOT\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9} /s >[/color]
  1843. "" = ShellFolder for CD Burning
  1844. [HKEY_CLASSES_ROOT\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
  1845. "" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 23:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
  1846. "ThreadingModel" = Apartment
  1847. [HKEY_CLASSES_ROOT\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\MergedFolder]
  1848. "Attributes" = 0x0
  1849. "AttributeMask" = 0xffffffff
  1850. "Location" = @shell32.dll,-12591 -- [2012/06/08 23:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
  1851. "ConflictOverlayIcon" = %SystemRoot%\system32\imageres.dll,-169 -- [2009/07/13 20:06:03 | 020,268,032 | ---- | M] (Microsoft Corporation)
  1852.  
  1853. [color=#A23BEC]< HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9} /s >[/color]
  1854.  
  1855. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s >[/color]
  1856. "" = Microsoft WBEM _WbemFetchRefresherMgr Proxy Helper
  1857. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32]
  1858. "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 22:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
  1859. "ThreadingModel" = Free
  1860.  
  1861. [color=#A23BEC]< >[/color]
  1862.  
  1863. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{118BEDCC-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1864.  
  1865. [color=#A23BEC]< >[/color]
  1866.  
  1867. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{312BED3C-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1868.  
  1869. [color=#A23BEC]< >[/color]
  1870.  
  1871. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{F12BE2CC-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1872.  
  1873. [color=#A23BEC]< >[/color]
  1874.  
  1875. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{312BFDCE-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1876.  
  1877. [color=#A23BEC]< >[/color]
  1878.  
  1879. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{212B3DCC-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1880.  
  1881. [color=#A23BEC]< >[/color]
  1882.  
  1883. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{A12BEDCC-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1884.  
  1885. [color=#A23BEC]< >[/color]
  1886.  
  1887. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D188F} /s >[/color]
  1888.  
  1889. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D188B} /s >[/color]
  1890.  
  1891. [color=#A23BEC]< >[/color]
  1892.  
  1893. [color=#A23BEC]< HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers /s >[/color]
  1894. [HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\FileSystem]
  1895. "" = {217FC9C0-3AEA-1069-A2DB-08002B30309D}
  1896. [HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\Sharing]
  1897. "" = {40dd6e20-7c17-11ce-a804-00aa003ca9f6}
  1898.  
  1899. [color=#A23BEC]< HKEY_CURRENT_USER\Software\Classes\Directory\shellex\CopyHookHandlers /s >[/color]
  1900.  
  1901. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers /s >[/color]
  1902. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\FileSystem]
  1903. "" = {217FC9C0-3AEA-1069-A2DB-08002B30309D}
  1904. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\Sharing]
  1905. "" = {40dd6e20-7c17-11ce-a804-00aa003ca9f6}
  1906.  
  1907. [color=#A23BEC]< >[/color]
  1908.  
  1909. [color=#A23BEC]< HKEY_CURRENT_USER\Software\MSOLoad /s >[/color]
  1910.  
  1911. [color=#A23BEC]< type C:\WINDOWS\system.ini >> test.txt /c >[/color]
  1912. ; for 16-bit app support
  1913. [386Enh]
  1914. woafont=dosapp.fon
  1915. EGA80WOA.FON=EGA80WOA.FON
  1916. EGA40WOA.FON=EGA40WOA.FON
  1917. CGA80WOA.FON=CGA80WOA.FON
  1918. CGA40WOA.FON=CGA40WOA.FON
  1919. [drivers]
  1920. wave=mmdrv.dll
  1921. timer=timer.drv
  1922. [mci]
  1923.  
  1924. [color=#A23BEC]< bcdedit /enum all /v >C:\boot.txt /c >[/color]
  1925.  
  1926. [color=#A23BEC]< type c:\diskreport.txt /c >[/color]
  1927. Microsoft DiskPart version 6.1.7601
  1928. Copyright (C) 1999-2008 Microsoft Corporation.
  1929. On computer: CARRIE-PC
  1930. Volume ### Ltr Label Fs Type Size Status Info
  1931. ---------- --- ----------- ----- ---------- ------- --------- --------
  1932. Volume 0 D DVD-ROM 0 B No Media
  1933. Volume 1 C TI106147W0C NTFS Partition 285 GB Healthy Boot
  1934. Volume 2 System NTFS Partition 1500 MB Healthy Hidden
  1935.  
  1936. [color=#A23BEC]< MD5 for: AFD.SYS >[/color]
  1937. [2011/12/27 22:59:24 | 000,498,688 | ---- | M] (Microsoft Corporation) MD5=1C7857B62DE5994A75B054A9FD4C3825 -- C:\windows\SysNative\drivers\afd.sys
  1938. [2011/12/27 22:59:24 | 000,498,688 | ---- | M] (Microsoft Corporation) MD5=1C7857B62DE5994A75B054A9FD4C3825 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17752_none_35e10b89752ee0f5\afd.sys
  1939. [2011/12/27 23:01:36 | 000,498,176 | ---- | M] (Microsoft Corporation) MD5=36A14FD1A23F57046361733B792CA8DB -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21887_none_364f3a028e605345\afd.sys
  1940. [2010/11/20 22:24:08 | 000,499,712 | ---- | M] (Microsoft Corporation) MD5=D31DC7A16DEA4A9BAF179F3D6FBDB38C -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991\afd.sys
  1941. [2011/04/24 21:34:03 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=D5B031C308A409A0A576BFF4CF083D30 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_3618198975057170\afd.sys
  1942. [2011/04/24 22:09:35 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=F4AD06143EAC303F55D0E86C40802976 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21712_none_3695e61e8e2c13d4\afd.sys
  1943.  
  1944. [color=#A23BEC]< MD5 for: ATAPI.SYS >[/color]
  1945. [2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\windows\SysNative\drivers\atapi.sys
  1946. [2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
  1947. [2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
  1948.  
  1949. [color=#A23BEC]< MD5 for: CNGAUDIT.DLL >[/color]
  1950. [2009/07/13 20:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
  1951. [2009/07/13 20:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
  1952. [2009/07/13 20:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\windows\SysNative\cngaudit.dll
  1953. [2009/07/13 20:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
  1954.  
  1955. [color=#A23BEC]< MD5 for: CSC.SYS >[/color]
  1956. [2010/11/20 22:24:41 | 000,514,560 | ---- | M] (Microsoft Corporation) MD5=54DA3DFD29ED9F1619B6F53F3CE55E49 -- C:\Windows\winsxs\amd64_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.1.7601.17514_none_fc6e4e567286d457\csc.sys
  1957.  
  1958. [color=#A23BEC]< MD5 for: DFSC.SYS >[/color]
  1959. [2010/11/20 22:24:32 | 000,102,400 | ---- | M] (Microsoft Corporation) MD5=9BB2EF44EAA163B29C4A4587887A0FE4 -- C:\windows\SysNative\drivers\dfsc.sys
  1960. [2010/11/20 22:24:32 | 000,102,400 | ---- | M] (Microsoft Corporation) MD5=9BB2EF44EAA163B29C4A4587887A0FE4 -- C:\Windows\winsxs\amd64_microsoft-windows-dfsclient_31bf3856ad364e35_6.1.7601.17514_none_e5c0334cfcbb6f1f\dfsc.sys
  1961.  
  1962. [color=#A23BEC]< MD5 for: DISK.SYS >[/color]
  1963. [2009/07/13 20:47:48 | 000,073,280 | ---- | M] (Microsoft Corporation) MD5=9819EEE8B5EA3784EC4AF3B137A5244C -- C:\windows\SysNative\drivers\disk.sys
  1964. [2009/07/13 20:47:48 | 000,073,280 | ---- | M] (Microsoft Corporation) MD5=9819EEE8B5EA3784EC4AF3B137A5244C -- C:\windows\SysNative\DriverStore\FileRepository\disk.inf_amd64_neutral_10ce25bbc5a9cc43\disk.sys
  1965. [2009/07/13 20:47:48 | 000,073,280 | ---- | M] (Microsoft Corporation) MD5=9819EEE8B5EA3784EC4AF3B137A5244C -- C:\Windows\winsxs\amd64_disk.inf_31bf3856ad364e35_6.1.7600.16385_none_55bb738b8ddd8a01\disk.sys
  1966.  
  1967. [color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color]
  1968. [2011/02/26 00:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
  1969. [2011/02/25 01:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
  1970. [2011/02/25 01:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
  1971. [2011/02/26 01:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
  1972. [2010/11/20 22:24:25 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
  1973. [2011/02/25 00:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
  1974. [2011/02/25 00:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
  1975. [2010/11/20 22:24:11 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
  1976.  
  1977. [color=#A23BEC]< MD5 for: FASTFAT.SYS >[/color]
  1978. [2009/07/13 18:23:29 | 000,204,800 | ---- | M] (Microsoft Corporation) MD5=0ADC83218B66A6DB380C330836F3E36D -- C:\windows\SysNative\drivers\fastfat.sys
  1979. [2009/07/13 18:23:29 | 000,204,800 | ---- | M] (Microsoft Corporation) MD5=0ADC83218B66A6DB380C330836F3E36D -- C:\Windows\winsxs\amd64_microsoft-windows-fat_31bf3856ad364e35_6.1.7600.16385_none_0aa81d2771152f86\fastfat.sys
  1980.  
  1981. [color=#A23BEC]< MD5 for: I8042PRT.SYS >[/color]
  1982. [2009/07/13 18:19:57 | 000,105,472 | ---- | M] (Microsoft Corporation) MD5=FA55C73D4AFFA7EE23AC4BE53B4592D3 -- C:\windows\SysNative\drivers\i8042prt.sys
  1983. [2009/07/13 18:19:57 | 000,105,472 | ---- | M] (Microsoft Corporation) MD5=FA55C73D4AFFA7EE23AC4BE53B4592D3 -- C:\windows\SysNative\DriverStore\FileRepository\keyboard.inf_amd64_neutral_0684fdc43059f486\i8042prt.sys
  1984. [2009/07/13 18:19:57 | 000,105,472 | ---- | M] (Microsoft Corporation) MD5=FA55C73D4AFFA7EE23AC4BE53B4592D3 -- C:\windows\SysNative\DriverStore\FileRepository\msmouse.inf_amd64_neutral_7a5f47d3150cc0eb\i8042prt.sys
  1985. [2009/07/13 18:19:57 | 000,105,472 | ---- | M] (Microsoft Corporation) MD5=FA55C73D4AFFA7EE23AC4BE53B4592D3 -- C:\Windows\winsxs\amd64_keyboard.inf_31bf3856ad364e35_6.1.7601.17514_none_f5747347ef9876bf\i8042prt.sys
  1986. [2009/07/13 18:19:57 | 000,105,472 | ---- | M] (Microsoft Corporation) MD5=FA55C73D4AFFA7EE23AC4BE53B4592D3 -- C:\Windows\winsxs\amd64_msmouse.inf_31bf3856ad364e35_6.1.7600.16385_none_aa28fd23ec0c39f9\i8042prt.sys
  1987.  
  1988. [color=#A23BEC]< MD5 for: KBDCLASS.SYS >[/color]
  1989. [2009/07/13 20:48:04 | 000,050,768 | ---- | M] (Microsoft Corporation) MD5=BC02336F1CBA7DCC7D1213BB588A68A5 -- C:\windows\SysNative\drivers\kbdclass.sys
  1990. [2009/07/13 20:48:04 | 000,050,768 | ---- | M] (Microsoft Corporation) MD5=BC02336F1CBA7DCC7D1213BB588A68A5 -- C:\windows\SysNative\DriverStore\FileRepository\keyboard.inf_amd64_neutral_0684fdc43059f486\kbdclass.sys
  1991. [2009/07/13 20:48:04 | 000,050,768 | ---- | M] (Microsoft Corporation) MD5=BC02336F1CBA7DCC7D1213BB588A68A5 -- C:\Windows\winsxs\amd64_keyboard.inf_31bf3856ad364e35_6.1.7601.17514_none_f5747347ef9876bf\kbdclass.sys
  1992.  
  1993. [color=#A23BEC]< MD5 for: KBDHID.SYS >[/color]
  1994. [2010/11/20 22:23:47 | 000,033,280 | ---- | M] (Microsoft Corporation) MD5=0705EFF5B42A9DB58548EEC3B26BB484 -- C:\windows\SysNative\drivers\kbdhid.sys
  1995. [2010/11/20 22:23:47 | 000,033,280 | ---- | M] (Microsoft Corporation) MD5=0705EFF5B42A9DB58548EEC3B26BB484 -- C:\windows\SysNative\DriverStore\FileRepository\keyboard.inf_amd64_neutral_0684fdc43059f486\kbdhid.sys
  1996. [2010/11/20 22:23:47 | 000,033,280 | ---- | M] (Microsoft Corporation) MD5=0705EFF5B42A9DB58548EEC3B26BB484 -- C:\Windows\winsxs\amd64_keyboard.inf_31bf3856ad364e35_6.1.7601.17514_none_f5747347ef9876bf\kbdhid.sys
  1997.  
  1998. [color=#A23BEC]< MD5 for: LSASS.EXE >[/color]
  1999. [2009/07/13 20:39:16 | 000,031,232 | ---- | M] (Microsoft Corporation) MD5=0793F40B9B8A1BDD266296409DBD91EA -- C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.17514_none_04709031736ac277\lsass.exe
  2000. [2011/11/17 01:20:34 | 000,031,232 | ---- | M] (Microsoft Corporation) MD5=0A10B74FBB437FF9A23F1D5DE4446A83 -- C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.21861_none_04c1204e8cb39c3f\lsass.exe
  2001. [2012/08/24 12:43:36 | 000,031,232 | ---- | M] (Microsoft Corporation) MD5=77119F1F9B492B260030C34F9BE327FA -- C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.22099_none_04a88ce28cc4eb33\lsass.exe
  2002. [2012/06/04 02:51:10 | 000,031,232 | ---- | M] (Microsoft Corporation) MD5=79C908CAA6F43021EB05F4C733A927D1 -- C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.22010_none_04f609a88c8c279c\lsass.exe
  2003. [2011/11/17 01:33:55 | 000,031,232 | ---- | M] (Microsoft Corporation) MD5=C118A82CD78818C29AB228366EBF81C3 -- C:\windows\SysNative\lsass.exe
  2004. [2011/11/17 01:33:55 | 000,031,232 | ---- | M] (Microsoft Corporation) MD5=C118A82CD78818C29AB228366EBF81C3 -- C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.17725_none_0466c45b7371f20d\lsass.exe
  2005. [2011/11/17 01:33:55 | 000,031,232 | ---- | M] (Microsoft Corporation) MD5=C118A82CD78818C29AB228366EBF81C3 -- C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.17856_none_044756c773895c5e\lsass.exe
  2006. [2011/11/17 01:33:55 | 000,031,232 | ---- | M] (Microsoft Corporation) MD5=C118A82CD78818C29AB228366EBF81C3 -- C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.17940_none_044c26dd7386a58a\lsass.exe
  2007.  
  2008. [color=#A23BEC]< MD5 for: MOUCLASS.SYS >[/color]
  2009. [2009/07/13 20:48:27 | 000,049,216 | ---- | M] (Microsoft Corporation) MD5=7D27EA49F3C1F687D357E77A470AEA99 -- C:\windows\SysNative\drivers\mouclass.sys
  2010. [2009/07/13 20:48:27 | 000,049,216 | ---- | M] (Microsoft Corporation) MD5=7D27EA49F3C1F687D357E77A470AEA99 -- C:\windows\SysNative\DriverStore\FileRepository\msmouse.inf_amd64_neutral_7a5f47d3150cc0eb\mouclass.sys
  2011. [2009/07/13 20:48:27 | 000,049,216 | ---- | M] (Microsoft Corporation) MD5=7D27EA49F3C1F687D357E77A470AEA99 -- C:\Windows\winsxs\amd64_msmouse.inf_31bf3856ad364e35_6.1.7600.16385_none_aa28fd23ec0c39f9\mouclass.sys
  2012.  
  2013. [color=#A23BEC]< MD5 for: MOUHID.SYS >[/color]
  2014. [2009/07/13 19:00:20 | 000,031,232 | ---- | M] (Microsoft Corporation) MD5=D3BF052C40B0C4166D9FD86A4288C1E6 -- C:\windows\SysNative\drivers\mouhid.sys
  2015. [2009/07/13 19:00:20 | 000,031,232 | ---- | M] (Microsoft Corporation) MD5=D3BF052C40B0C4166D9FD86A4288C1E6 -- C:\windows\SysNative\DriverStore\FileRepository\msmouse.inf_amd64_neutral_7a5f47d3150cc0eb\mouhid.sys
  2016. [2009/07/13 19:00:20 | 000,031,232 | ---- | M] (Microsoft Corporation) MD5=D3BF052C40B0C4166D9FD86A4288C1E6 -- C:\Windows\winsxs\amd64_msmouse.inf_31bf3856ad364e35_6.1.7600.16385_none_aa28fd23ec0c39f9\mouhid.sys
  2017.  
  2018. [color=#A23BEC]< MD5 for: NETBT.SYS >[/color]
  2019. [2010/11/20 22:23:51 | 000,261,632 | ---- | M] (Microsoft Corporation) MD5=09594D1089C523423B32A4229263F068 -- C:\windows\SysNative\drivers\netbt.sys
  2020. [2010/11/20 22:23:51 | 000,261,632 | ---- | M] (Microsoft Corporation) MD5=09594D1089C523423B32A4229263F068 -- C:\Windows\winsxs\amd64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_be8acdd10de3b1a6\netbt.sys
  2021.  
  2022. [color=#A23BEC]< MD5 for: NETLOGON.DLL >[/color]
  2023. [2010/11/20 22:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\windows\SysNative\netlogon.dll
  2024. [2010/11/20 22:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
  2025. [2010/11/20 22:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
  2026. [2010/11/20 22:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
  2027.  
  2028. [color=#A23BEC]< MD5 for: SCECLI.DLL >[/color]
  2029. [2010/11/20 22:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
  2030. [2010/11/20 22:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
  2031. [2010/11/20 22:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\windows\SysNative\scecli.dll
  2032. [2010/11/20 22:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
  2033.  
  2034. [color=#A23BEC]< MD5 for: SERIAL.SYS >[/color]
  2035. [2009/07/13 19:00:40 | 000,094,208 | ---- | M] (Microsoft Corporation) MD5=C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 -- C:\windows\SysNative\drivers\serial.sys
  2036. [2009/07/13 19:00:40 | 000,094,208 | ---- | M] (Microsoft Corporation) MD5=C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 -- C:\windows\SysNative\DriverStore\FileRepository\msports.inf_amd64_neutral_fdcfb86ce78678d1\serial.sys
  2037. [2009/07/13 19:00:40 | 000,094,208 | ---- | M] (Microsoft Corporation) MD5=C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 -- C:\Windows\winsxs\amd64_msports.inf_31bf3856ad364e35_6.1.7600.16385_none_548ca258d20f4ada\serial.sys
  2038.  
  2039. [color=#A23BEC]< MD5 for: SERVICES.EXE >[/color]
  2040. [2009/07/13 20:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\windows\SysNative\services.exe
  2041. [2009/07/13 20:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
  2042.  
  2043. [color=#A23BEC]< MD5 for: SPLDR.SYS >[/color]
  2044. [2009/07/13 20:45:55 | 000,019,008 | ---- | M] (Microsoft Corporation) MD5=B9E31E5CACDFE584F34F730A677803F9 -- C:\windows\SysNative\drivers\spldr.sys
  2045. [2009/07/13 20:45:55 | 000,019,008 | ---- | M] (Microsoft Corporation) MD5=B9E31E5CACDFE584F34F730A677803F9 -- C:\Windows\winsxs\amd64_microsoft-windows-s..ive-blackbox-loader_31bf3856ad364e35_6.1.7600.16385_none_c72819e06acceb59\spldr.sys
  2046.  
  2047. [color=#A23BEC]< MD5 for: SVCHOST.EXE >[/color]
  2048. [2009/07/13 20:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\SysWOW64\svchost.exe
  2049. [2009/07/13 20:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
  2050. [2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
  2051. [2009/07/13 20:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\windows\SysNative\svchost.exe
  2052. [2009/07/13 20:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe
  2053.  
  2054. [color=#A23BEC]< MD5 for: TCPIP.SYS >[/color]
  2055. [2012/10/03 12:56:54 | 001,914,248 | ---- | M] (Microsoft Corporation) MD5=37608401DFDB388CAF66917F6B2D6FB0 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.17964_none_110e0fbd7d2e4b88\tcpip.sys
  2056. [2011/09/29 12:41:37 | 001,912,176 | ---- | M] (Microsoft Corporation) MD5=3810F06A4D74A7D62641EE73D6B3C660 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.21828_none_11c6e9949627e69c\tcpip.sys
  2057. [2010/11/20 22:24:08 | 001,924,480 | ---- | M] (Microsoft Corporation) MD5=509383E505C973ED7534A06B3D19688D -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.17514_none_114417c17d05cb37\tcpip.sys
  2058. [2012/08/22 13:06:13 | 001,901,936 | ---- | M] (Microsoft Corporation) MD5=7880A26B7D3B96FDA8EFD9F985036B1D -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.22097_none_117a13de9661c145\tcpip.sys
  2059. [2012/03/30 05:26:36 | 001,901,424 | ---- | M] (Microsoft Corporation) MD5=885B202006EE17AE99B9FBCEC9AF88C9 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.21954_none_11a27a8e9643d23a\tcpip.sys
  2060. [2011/04/25 00:33:51 | 001,923,968 | ---- | M] (Microsoft Corporation) MD5=92CE29D95AC9DD2D0EE9061D551BA250 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.17603_none_114de9497cfe9316\tcpip.sys
  2061. [2011/06/21 01:20:30 | 001,914,752 | ---- | M] (Microsoft Corporation) MD5=A0EB71E0DC047C7CC95CD6AB4036296E -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.21754_none_11a276c29643d7ec\tcpip.sys
  2062. [2012/03/30 06:35:47 | 001,918,320 | ---- | M] (Microsoft Corporation) MD5=ACB82BDA8F46C84F465C1AFA517DC4B9 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.17802_none_114ceccb7cff740d\tcpip.sys
  2063. [2013/07/06 00:20:38 | 001,900,992 | ---- | M] (Microsoft Corporation) MD5=B27F13153343BC37A27EAE01634D94E1 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.22378_none_1190b9b296509a2f\tcpip.sys
  2064. [2011/04/25 01:16:34 | 001,927,552 | ---- | M] (Microsoft Corporation) MD5=B77977AEB2FF159D01DB08A309989C5F -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.21712_none_11cbb5de9625357a\tcpip.sys
  2065. [2012/10/03 12:44:29 | 001,902,472 | ---- | M] (Microsoft Corporation) MD5=D5707FC2300AA5B04B7BFE86D40C0133 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.22124_none_11c2c45a962baed0\tcpip.sys
  2066. [2013/07/06 01:03:53 | 001,910,208 | ---- | M] (Microsoft Corporation) MD5=DB74544B75566C974815E79A62433F29 -- C:\windows\SysNative\drivers\tcpip.sys
  2067. [2013/07/06 01:03:53 | 001,910,208 | ---- | M] (Microsoft Corporation) MD5=DB74544B75566C974815E79A62433F29 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.18203_none_114dcae97cfeb81b\tcpip.sys
  2068. [2011/06/21 01:34:00 | 001,923,968 | ---- | M] (Microsoft Corporation) MD5=F0E98C00A09FDF791525829A1D14240F -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.17638_none_11327af77d12659c\tcpip.sys
  2069. [2012/08/22 13:12:50 | 001,913,200 | ---- | M] (Microsoft Corporation) MD5=F782CAD3CEDBB3F9FFE3BF2775D92DDC -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.17939_none_113380f37d117668\tcpip.sys
  2070. [2011/09/29 11:29:28 | 001,923,952 | ---- | M] (Microsoft Corporation) MD5=FC62769E7BFF2896035AEED399108162 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.17697_none_10f09b257d43f3eb\tcpip.sys
  2071.  
  2072. [color=#A23BEC]< MD5 for: USERINIT.EXE >[/color]
  2073. [2010/11/20 22:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
  2074. [2010/11/20 22:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
  2075. [2010/11/20 22:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\windows\SysNative\userinit.exe
  2076. [2010/11/20 22:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
  2077.  
  2078. [color=#A23BEC]< MD5 for: VOLSNAP.SYS >[/color]
  2079. [2010/11/20 22:23:47 | 000,295,808 | ---- | M] (Microsoft Corporation) MD5=0D08D2F3B3FF84E433346669B5E0F639 -- C:\windows\SysNative\drivers\volsnap.sys
  2080. [2010/11/20 22:23:47 | 000,295,808 | ---- | M] (Microsoft Corporation) MD5=0D08D2F3B3FF84E433346669B5E0F639 -- C:\windows\SysNative\DriverStore\FileRepository\volume.inf_amd64_neutral_df8bea40ac96ca21\volsnap.sys
  2081. [2010/11/20 22:23:47 | 000,295,808 | ---- | M] (Microsoft Corporation) MD5=0D08D2F3B3FF84E433346669B5E0F639 -- C:\Windows\winsxs\amd64_volume.inf_31bf3856ad364e35_6.1.7601.17514_none_73dcbcf012b4850e\volsnap.sys
  2082.  
  2083. [color=#A23BEC]< MD5 for: WININIT.EXE >[/color]
  2084. [2009/07/13 20:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\windows\SysNative\wininit.exe
  2085. [2009/07/13 20:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
  2086. [2009/07/13 20:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
  2087. [2009/07/13 20:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
  2088.  
  2089. [color=#A23BEC]< MD5 for: WINLOGON.EXE >[/color]
  2090. [2010/11/20 22:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\windows\SysNative\winlogon.exe
  2091. [2010/11/20 22:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
  2092. [2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
  2093.  
  2094. [color=#E56717]========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========[/color]
  2095. [C:\Documents and Settings] -> C:\Users -> Junction
  2096. [C:\ProgramData\Application Data] -> C:\ProgramData -> Junction
  2097. [C:\ProgramData\Desktop] -> C:\Users\Public\Desktop -> Junction
  2098. [C:\ProgramData\Documents] -> C:\Users\Public\Documents -> Junction
  2099. [C:\ProgramData\Favorites] -> C:\Users\Public\Favorites -> Junction
  2100. [C:\ProgramData\Start Menu] -> C:\ProgramData\Microsoft\Windows\Start Menu -> Junction
  2101. [C:\ProgramData\Templates] -> C:\ProgramData\Microsoft\Windows\Templates -> Junction
  2102. [C:\Users\All Users\Application Data] -> C:\ProgramData -> Junction
  2103. [C:\Users\All Users\Desktop] -> C:\Users\Public\Desktop -> Junction
  2104. [C:\Users\All Users\Documents] -> C:\Users\Public\Documents -> Junction
  2105. [C:\Users\All Users\Favorites] -> C:\Users\Public\Favorites -> Junction
  2106. [C:\Users\All Users\Start Menu] -> C:\ProgramData\Microsoft\Windows\Start Menu -> Junction
  2107. [C:\Users\All Users\Templates] -> C:\ProgramData\Microsoft\Windows\Templates -> Junction
  2108. [C:\Users\All Users] -> -> Unknown point type
  2109. [C:\Users\Carrie\AppData\Local\Application Data] -> C:\Users\Carrie\AppData\Local -> Junction
  2110. [C:\Users\Carrie\AppData\Local\History] -> C:\Users\Carrie\AppData\Local\Microsoft\Windows\History -> Junction
  2111. [C:\Users\Carrie\AppData\Local\Temporary Internet Files] -> C:\Users\Carrie\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction
  2112. [C:\Users\Carrie\Application Data] -> C:\Users\Carrie\AppData\Roaming -> Junction
  2113. [C:\Users\Carrie\Cookies] -> C:\Users\Carrie\AppData\Roaming\Microsoft\Windows\Cookies -> Junction
  2114. [C:\Users\Carrie\Documents\My Music] -> C:\Users\Carrie\Music -> Junction
  2115. [C:\Users\Carrie\Documents\My Pictures] -> C:\Users\Carrie\Pictures -> Junction
  2116. [C:\Users\Carrie\Documents\My Videos] -> C:\Users\Carrie\Videos -> Junction
  2117. [C:\Users\Carrie\Local Settings] -> C:\Users\Carrie\AppData\Local -> Junction
  2118. [C:\Users\Carrie\My Documents] -> C:\Users\Carrie\Documents -> Junction
  2119. [C:\Users\Carrie\NetHood] -> C:\Users\Carrie\AppData\Roaming\Microsoft\Windows\Network Shortcuts -> Junction
  2120. [C:\Users\Carrie\PrintHood] -> C:\Users\Carrie\AppData\Roaming\Microsoft\Windows\Printer Shortcuts -> Junction
  2121. [C:\Users\Carrie\Recent] -> C:\Users\Carrie\AppData\Roaming\Microsoft\Windows\Recent -> Junction
  2122. [C:\Users\Carrie\SendTo] -> C:\Users\Carrie\AppData\Roaming\Microsoft\Windows\SendTo -> Junction
  2123. [C:\Users\Carrie\Start Menu] -> C:\Users\Carrie\AppData\Roaming\Microsoft\Windows\Start Menu -> Junction
  2124. [C:\Users\Carrie\Templates] -> C:\Users\Carrie\AppData\Roaming\Microsoft\Windows\Templates -> Junction
  2125. [C:\Users\Default User] -> C:\Users\Default -> Junction
  2126. [C:\Users\Default\AppData\Local\Application Data] -> C:\Users\Default\AppData\Local -> Junction
  2127. [C:\Users\Default\AppData\Local\History] -> C:\Users\Default\AppData\Local\Microsoft\Windows\History -> Junction
  2128. [C:\Users\Default\AppData\Local\Temporary Internet Files] -> C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction
  2129. [C:\Users\Default\Application Data] -> C:\Users\Default\AppData\Roaming -> Junction
  2130. [C:\Users\Default\Cookies] -> C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies -> Junction
  2131. [C:\Users\Default\Documents\My Music] -> C:\Users\Default\Music -> Junction
  2132. [C:\Users\Default\Documents\My Pictures] -> C:\Users\Default\Pictures -> Junction
  2133. [C:\Users\Default\Documents\My Videos] -> C:\Users\Default\Videos -> Junction
  2134. [C:\Users\Default\Local Settings] -> C:\Users\Default\AppData\Local -> Junction
  2135. [C:\Users\Default\My Documents] -> C:\Users\Default\Documents -> Junction
  2136. [C:\Users\Default\NetHood] -> C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts -> Junction
  2137. [C:\Users\Default\PrintHood] -> C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts -> Junction
  2138. [C:\Users\Default\Recent] -> C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent -> Junction
  2139. [C:\Users\Default\SendTo] -> C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo -> Junction
  2140. [C:\Users\Default\Start Menu] -> C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu -> Junction
  2141. [C:\Users\Default\Templates] -> C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates -> Junction
  2142. [C:\Users\Guest\AppData\Local\Application Data] -> C:\Users\Guest\AppData\Local -> Junction
  2143. [C:\Users\Guest\AppData\Local\History] -> C:\Users\Guest\AppData\Local\Microsoft\Windows\History -> Junction
  2144. [C:\Users\Guest\AppData\Local\Temporary Internet Files] -> C:\Users\Guest\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction
  2145. [C:\Users\Guest\Application Data] -> C:\Users\Guest\AppData\Roaming -> Junction
  2146. [C:\Users\Guest\Cookies] -> C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies -> Junction
  2147. [C:\Users\Guest\Documents\My Music] -> C:\Users\Guest\Music -> Junction
  2148. [C:\Users\Guest\Documents\My Pictures] -> C:\Users\Guest\Pictures -> Junction
  2149. [C:\Users\Guest\Documents\My Videos] -> C:\Users\Guest\Videos -> Junction
  2150. [C:\Users\Guest\Local Settings] -> C:\Users\Guest\AppData\Local -> Junction
  2151. [C:\Users\Guest\My Documents] -> C:\Users\Guest\Documents -> Junction
  2152. [C:\Users\Guest\NetHood] -> C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Network Shortcuts -> Junction
  2153. [C:\Users\Guest\PrintHood] -> C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Printer Shortcuts -> Junction
  2154. [C:\Users\Guest\Recent] -> C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Recent -> Junction
  2155. [C:\Users\Guest\SendTo] -> C:\Users\Guest\AppData\Roaming\Microsoft\Windows\SendTo -> Junction
  2156. [C:\Users\Guest\Start Menu] -> C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu -> Junction
  2157. [C:\Users\Guest\Templates] -> C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Templates -> Junction
  2158. [C:\Users\Public\Documents\My Music] -> C:\Users\Public\Music -> Junction
  2159. [C:\Users\Public\Documents\My Pictures] -> C:\Users\Public\Pictures -> Junction
  2160. [C:\Users\Public\Documents\My Videos] -> C:\Users\Public\Videos -> Junction
  2161.  
  2162. < End of report >
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!