[Inactive] Trying to run scans, but keep getting locked out....

Printable View

Show 40 post(s) from this thread on one page

June 3rd, 2013, 11:01 PM
rollie

[Inactive] Trying to run scans, but keep getting locked out....

Hi. Think my laptop has an infection of some kind. Had similar problems before; blank screen, locked out etc. and it turned out to be Malware. (that was last July) I had to reinstall Firefox yesterday, and earlier today everything was fine and then--OMG, it's happening again. that's the only thing I can think of that might have messed things up. My Windows Firewall is on, I downloaded Avast and have tried 3 times to run a full scan, but I get about 15% through the scan and then the screen goes blank or, it tells me it's locking my computer. So the only way to get back in is to restart. We went into Control Panel and removed the timing option on the screensaver (it was set at 15 minutes) and also changed the Power Options so they wouldn't be timed. The Avast scan is running right now, but I'm afraid I'll have to start all over. This scan is probably going to take a few hours. Any
advice? Also, I'm running in safe-mode right now.
June 3rd, 2013, 11:52 PM
Broni
Please, observe following rules:
- Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
- If you're stuck, or you're not sure about certain step, always ask before doing anything else.
- Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
- Never run more than one scan at a time.
- Keep updating me regarding your computer behavior, good, or bad.
- The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
- If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
- I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
==============================

If it happens again skip Avast scan and complete other steps from our preliminaries.
June 4th, 2013, 10:47 AM
rollie

It did happen again, so I'm skipping Avast scan and going on to the next step.
June 4th, 2013, 11:10 AM
rollie

Malwarebytes Anti-Malware (PRO) 1.70.0.1100
www.malwarebytes.org

Database version: v2013.06.04.05

Windows Vista Service Pack 2 x86 NTFS (Safe Mode/Networking)
Internet Explorer 9.0.8112.16421
Janette :: JANETTE-LAPTOP [administrator]

Protection: Disabled

6/4/2013 7:52:49 AM
mbam-log-2013-06-04 (07-52-49).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 226877
Time elapsed: 4 minute(s), 55 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

DDS (Ver_2012-11-20.01) - NTFS_x86 NETWORK
Internet Explorer: 9.0.8112.16483 BrowserJavaVersion: 1.6.0_33
Run by Janette at 8:03:03 on 2013-06-04
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3061.2159 [GMT -7:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Firewall *Enabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\mfevtps.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\PWMUIAux.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\notepad.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k swprv
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\program files\mcafee\siteadvisor\McIEPlg.dll
BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: MSS+ Identifier: {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - c:\program files\mcafee security scan\3.0.318\McAfeeMSS_IE.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll
BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\program files\mcafee\siteadvisor\McIEPlg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: CPwmIEBrowserHelper Object: {F040E541-A427-4CF7-85D8-75E3E0F476C5} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll
BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\program files\mcafee\siteadvisor\McIEPlg.dll
TB: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [TVT Scheduler Proxy] c:\program files\common files\lenovo\scheduler\scheduler_proxy.exe
mRun: [TpShocks] TpShocks.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [MWLExe] c:\progra~1\mcafee\mwl\MWLGuiSt.exe
mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [LPManager] c:\progra~1\lenovo\lenovo~1\LPMGR.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [IaNvSrv] c:\program files\intel\intel matrix storage manager\orom\ianvsrv\IaNvSrv.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [EZEJMNAP] c:\progra~1\thinkpad\utilit~1\EzEjMnAp.Exe
mRun: [EEventManager] c:\program files\epson\creativity suite\event manager\EEventManager.exe
mRun: [DiskeeperSystray] "c:\program files\diskeeper corporation\diskeeper\DkIcon.exe"
mRun: [cssauth] "c:\program files\lenovo\client security solution\cssauth.exe" silent
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [ACWLIcon] c:\program files\thinkpad\connectutilities\ACWLIcon.exe
mRun: [ACTray] c:\program files\thinkpad\connectutilities\ACTray.exe
mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop elements 4.0\apdproxy.exe"
mRun: [mcpltui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [McAfeeWrapperApplication] "c:\program files\mcafeemobk\WrapperTrayIcon.exe"
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\exifla~1.lnk - c:\program files\finepixviewer\QuickDCF2.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\3.0.318\SSScheduler.exe
uPolicies-Explorer: NoDrives = dword:0
uPolicies-Explorer: NoDriveTypeAutoRun = dword:157
mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {0045D4BC-5189-4b67-969C-83BB1906C421} - {0FE81B52-73FA-425F-8F06-3F32451AC73F} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TCP: NameServer = 192.168.2.1
TCP: Interfaces\{CD82E2A3-614C-43A1-8DFA-9601575D6D8B} : DHCPNameServer = 192.168.2.1
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\program files\mcafee\msc\McSnIePl.dll
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor\McIEPlg.dll
Notify: igfxcui - igfxdev.dll
LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\27.0.1453.94\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\janette\appdata\roaming\mozilla\firefox\profiles\s430s5mi.default-1343318037566\
FF - prefs.js: browser.startup.homepage - hxxp://www.stilescollection.com/
FF - plugin: c:\progra~1\mcafee\msc\npMcSnFFPl.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\amazon\mp3 downloader\npAmazonMP3DownloaderPlugin101752.dll
FF - plugin: c:\program files\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\mcafee security scan\3.0.318\npMcAfeeMSS.dll
FF - plugin: c:\program files\mcafee\siteadvisor\NPMcFFPlg32.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.20125.0\npctrlui.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_7_700_202.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
FF - plugin: c:\windows\system32\NPSWF32.dll
FF - ExtSQL: 2013-06-03 07:56; {4ED1F68A-5463-4931-9384-8FFF5ED91D92}; c:\program files\mcafee\SiteAdvisor
FF - ExtSQL: 2013-06-03 15:27; [email protected]; c:\program files\avast software\avast\webrep\FF
.
============= SERVICES / DRIVERS ===============
.
R0 DozeHDD;DozeHDD;c:\windows\system32\drivers\DOZEHDD.SYS [2012-7-11 25416]
R0 iaNvStor;Intel(R) Turbo Memory Controller;c:\windows\system32\drivers\iaNvStor.sys [2008-2-1 220696]
R0 McPvDrv;McPvDrv Driver;c:\windows\system32\drivers\McPvDrv.sys [2013-5-15 66296]
R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2012-11-9 565416]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [2007-10-16 19504]
R1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2012-11-9 210168]
R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\common files\mcafee\platform\mcsvchost\McSvHost.exe [2013-1-10 184728]
R2 mcpltsvc;McAfee Platform Services;c:\program files\common files\mcafee\platform\mcsvchost\McSvHost.exe [2013-1-10 184728]
R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2013-1-10 168880]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2013-1-10 171976]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2012-11-9 60480]
R3 LenovoRd;LenovoRd;c:\windows\system32\drivers\LenovoRd.sys [2008-2-1 81280]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2012-11-9 362640]
S0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [2013-6-3 49376]
S0 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [2013-6-3 174664]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2013-6-3 765736]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2013-6-3 368944]
S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\drivers\smiif32.sys [2012-7-11 13680]
S1 MOBKFilter;MOBKFilter;c:\windows\system32\drivers\MOBK.sys [2011-12-10 54776]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2013-6-3 29816]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-6-3 66336]
S2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2013-6-3 46808]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 DDNIService;DDNIService;c:\program files\ddni\dibs\DDNIService.exe [2012-4-14 166376]
S2 DozeSvc;Lenovo Doze Mode Service;c:\program files\thinkpad\utilities\DOZESVC.EXE [2012-7-11 280640]
S2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-6-13 21504]
S2 HomeNetSvc;McAfee Home Network;c:\program files\common files\mcafee\platform\mcsvchost\McSvHost.exe [2013-1-10 184728]
S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\lenovo\hotkey\micmute.exe [2012-7-11 101736]
S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\lenovo\virtscrl\lvvsst.exe [2012-7-11 127336]
S2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-9-11 398184]
S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-7-11 682344]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-3-17 167784]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\common files\mcafee\platform\mcsvchost\McSvHost.exe [2013-1-10 184728]
S2 McProxy;McAfee Proxy Service;c:\program files\common files\mcafee\platform\mcsvchost\McSvHost.exe [2013-1-10 184728]
S2 mfecore;McAfee Anti-Malware Core;c:\program files\common files\mcafee\amcore\mcshield.exe [2013-1-10 632344]
S2 MOBKbackup;McAfee Online Backup;c:\program files\mcafee online backup\MOBKbackup.exe [2010-4-13 229688]
S2 Power Manager DBC Service;Power Manager DBC Service;c:\program files\thinkpad\utilities\PWMDBSVC.exe [2012-7-11 1662560]
S2 psqlWGE;Pervasive PSQL Workgroup Engine;c:\program files\pervasive software\psql\bin\w3dbsmgr.exe [2008-6-6 435496]
S2 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files\thinkpad\utilities\PWMEWSVC.exe [2012-7-11 1665120]
S2 Seagate-Replica-Service;Seagate-Replica-Service;c:\program files\seagate replica\bin\Seagate-Replica-Service.exe [2012-7-31 1818624]
S2 Seagate-Replica-SysMon;Seagate-Replica-SysMon;c:\program files\seagate replica\bin\Seagate-Replica-SysMon.exe [2012-7-31 78288]
S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\lenovo\hotkey\tphkload.exe [2012-7-11 131432]
S2 TPHKSVC;On Screen Display;c:\program files\lenovo\hotkey\TPHKSVC.exe [2007-7-8 142696]
S2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\lenovo\rescue and recovery\rrpservice.exe [2007-1-8 569344]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2006-11-2 167936]
S3 HipShieldK;McAfee Inc. HipShieldK;c:\windows\system32\drivers\HipShieldK.sys [2013-4-22 147472]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-7-11 21104]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2013-6-4 40776]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\3.0.318\McCHSvc.exe [2013-2-5 235216]
S3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2012-11-9 234824]
S3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2012-11-9 65488]
S3 mfencbdc;McAfee Inc. mfencbdc;c:\windows\system32\drivers\mfencbdc.sys [2012-11-2 252200]
S3 mfencrk;McAfee Inc. mfencrk;c:\windows\system32\drivers\mfencrk.sys [2012-11-2 81456]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2008-2-6 34248]
S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2008-2-6 40552]
S3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [2007-5-22 30336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2013-06-04 14:50:41 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2013-06-03 22:28:09 765736 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-06-03 22:28:09 49376 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-06-03 22:28:09 174664 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-06-03 22:28:08 66336 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-06-03 22:27:36 41664 ----a-w- c:\windows\avastSS.scr
2013-06-03 22:27:17 -------- d-----w- c:\program files\AVAST Software
2013-06-03 22:27:00 -------- d-----w- c:\programdata\AVAST Software
2013-05-15 15:20:41 66296 ------w- c:\windows\system32\drivers\McPvDrv.sys
2013-05-15 10:16:09 2382848 ------w- c:\windows\system32\mshtml.tlb
2013-05-15 10:02:00 768512 ------w- c:\program files\common files\microsoft shared\vgx\VGX.dll
2013-05-15 10:02:00 420864 ------w- c:\windows\system32\vbscript.dll
2013-05-15 10:02:00 149632 ------w- c:\program files\internet explorer\sqmapi.dll
2013-05-15 08:25:20 638328 ------w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-15 08:25:19 37376 ------w- c:\windows\system32\cdd.dll
2013-05-15 08:24:42 2049024 ------w- c:\windows\system32\win32k.sys
2013-05-10 07:57:26 187456 ------w- c:\program files\internet explorer\plugins\nppdf32.dll
.
==================== Find3M ====================
.
2013-05-15 02:17:37 71048 ------w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-15 02:17:37 692104 ------w- c:\windows\system32\FlashPlayerApp.exe
2013-05-02 09:06:08 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-04-04 22:11:34 1800704 ------w- c:\windows\system32\jscript9.dll
2013-04-04 22:02:59 1427968 ------w- c:\windows\system32\inetcpl.cpl
2013-04-04 22:02:17 1129472 ------w- c:\windows\system32\wininet.dll
2013-04-04 21:58:51 142848 ------w- c:\windows\system32\ieUnatt.exe
2013-03-11 10:38:36 3606904 ------w- c:\windows\system32\ntkrnlpa.exe
2013-03-11 10:38:36 3555192 ------w- c:\windows\system32\ntoskrnl.exe
2013-03-09 03:45:04 49152 ------w- c:\windows\system32\csrsrv.dll
2013-03-09 01:28:08 64000 ------w- c:\windows\system32\smss.exe
2013-03-08 03:53:50 376320 ------w- c:\windows\system32\winsrv.dll
2013-03-08 03:52:22 2067968 ------w- c:\windows\system32\mstscax.dll
.
============= FINISH: 8:04:21.56 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume3
Install Date: 2/1/2008 1:04:04 AM
System Uptime: 6/4/2013 7:35:44 AM (1 hours ago)
.
Motherboard: LENOVO | | 7732CTO
Processor: Intel(R) Core(TM)2 Duo CPU T8300 @ 2.40GHz | None | 2394/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 226 GiB total, 92.388 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft ISATAP Adapter
Device ID: ROOT\*ISATAP\0005
Manufacturer: Microsoft
Name: isatap.{CD82E2A3-614C-43A1-8DFA-9601575D6D8B}
PNP Device ID: ROOT\*ISATAP\0005
Service: tunnel
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft ISATAP Adapter
Device ID: ROOT\*ISATAP\0007
Manufacturer: Microsoft
Name: isatap.Belkin
PNP Device ID: ROOT\*ISATAP\0007
Service: tunnel
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft Tun Miniport Adapter
Device ID: ROOT\*TUNMP\0001
Manufacturer: Microsoft
Name: Teredo Tunneling Pseudo-Interface
PNP Device ID: ROOT\*TUNMP\0001
Service: tunmp
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft Tun Miniport Adapter
Device ID: ROOT\*TUNMP\0002
Manufacturer: Microsoft
Name: Teredo Tunneling Pseudo-Interface
PNP Device ID: ROOT\*TUNMP\0002
Service: tunmp
.
Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
Description: Officejet 6000 E609n
Device ID: ROOT\MULTIFUNCTION\0000
Manufacturer: HP
Name: Officejet 6000 E609n
PNP Device ID: ROOT\MULTIFUNCTION\0000
Service:
.
Class GUID:
Description:
Device ID: ROOT\PORTS\0000
Manufacturer:
Name: COM4
PNP Device ID: ROOT\PORTS\0000
Service:
.
==== System Restore Points ===================
.
RP1638: 5/30/2013 12:00:06 AM - Scheduled Checkpoint
RP1639: 5/31/2013 12:00:13 AM - Scheduled Checkpoint
RP1640: 5/31/2013 12:21:13 PM - Windows Update
RP1641: 6/1/2013 9:39:20 PM - Scheduled Checkpoint
RP1642: 6/2/2013 5:49:21 PM - Scheduled Checkpoint
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
2007 Microsoft Office system
32 Bit HP CIO Components Installer
6000E609_eDocs
6000E609_Help
6000E609n
ABBYY FineReader 6.0 Sprint
Access Help
Activation Assistant for the 2007 Microsoft Office suites
Adobe AIR
Adobe Community Help
Adobe Download Assistant
Adobe Flash Player 11 Plugin
Adobe Flash Player 9 ActiveX
Adobe Help Center 2.0
Adobe Photoshop Elements 4.0
Adobe Reader X (10.1.7)
Amazon MP3 Downloader 1.0.17
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
avast! Free Antivirus
Big Fish Games: Game Manager
Bonjour
BPDSoftware
BPDSoftware_Ini
BufferChm
Business Contact Manager for Outlook 2007 SP2
CDBurnerXP
Client Security Solution
ConvertHelper 2.2
Crystal Reports 2008 Runtime SP1
DeviceDiscovery
DIBS
Diskeeper Home
Drag-to-Disc
EPSON Attach To Email
EPSON Copy Utility 3
EPSON Event Manager
EPSON Perfection V500 Photo Scanner Driver Update
EPSON Perfection V500P User's Guide
EPSON Printer Software
EPSON Scan
EPSON Scan Assistant
FastStone Image Viewer 4.2
FinePix Studio
FinePixViewer Resource
FinePixViewer Ver.5.5
Google Chrome
GPBaseService2
Help Center
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Customer Participation Program 12.0
HP Imaging Device Functions 12.0
HP Officejet 6000 E609 Series
HP Smart Web Printing 4.60
HP Solution Center 13.0
HP Update
HPDiagnosticAlert
HPProductAssistant
Ink Monitor
Integrated Camera
Intel(R) Graphics Media Accelerator Driver
Intel(R) PRO Network Connections Drivers
Intel® Turbo Memory and Intel® Matrix Storage Manager
InterVideo Register Manager
InterVideo WinDVD
Java Auto Updater
Java(TM) 6 Update 33
Lenovo Auto Scroll Utility
Lenovo Care
Lenovo Care Supplement
Lenovo News-Shop
Lenovo Patch Utility
Lenovo Registration
Lenovo System Interface Driver
Malwarebytes Anti-Malware version 1.70.0.1100
Mandala Painter 3.0 Professional
MarketResearch
McAfee Online Backup
McAfee Security Scan Plus
McAfee SecurityCenter
Message Center
Message Center Plus
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2698023)
Microsoft .NET Framework 1.1 Security Update (KB2742597)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Hybrid 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Small Business Connectivity Components
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
Microsoft_VC90_MFCLOC_x86
Mozilla Firefox 21.0 (x86 en-US)
Mozilla Thunderbird 17.0.6 (x86 en-US)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Multimedia Center For Think Offerings
Network
OGA Notifier 2.0.0048.0
On Screen Display
OpenOffice.org Installer 1.0
Peachtree Accounting 2010
PeachTree Signature Ready Forms
Pervasive PSQL v10.10 Workgroup (32-bit)
Power Manager
Presentation Director
ProductContext
Productivity Center Supplement for ThinkPad
QuickTime
Registry patch for Windows Vista USB S3 PM Enablement
Registry patch of Changing Timing of IDLE IRP by Finger Print Driver for Windows Vista
Registry Patch of Enabling Device Initiated Power Management(DIPM) on SATA for Windows Vista
Registry patch to improve USB device detection on resume from sleep for Windows Vista
Rescue and Recovery
Rhapsody Player Engine
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.52.02
Roads of Rome III
Sage Message Center
Seagate Replica v3.0.768.5345
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2597971) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition
Shared C Run-time for x86
Smart Audio Converter
SmartWebPrinting
SolutionCenter
Sonic Icons for Lenovo
SoundMAX
Status
Support.com Toolbar Updater
Switch Sound File Converter
swMSM
System Migration Assistant
System Requirements Lab
System Update
ThinkPad EasyEject Utility
ThinkPad FullScreen Magnifier
ThinkPad Keyboard Customizer Utility
ThinkPad Mobility Center Customization
ThinkPad Modem
ThinkPad Power Management Driver
ThinkPad UltraNav Driver
ThinkPad UltraNav Utility
Thinkpad Wireless LAN Adapters Software (11a/b/g/n)
ThinkVantage Access Connections
ThinkVantage Active Protection System
ThinkVantage Productivity Center
ThinkVantage Technologies Welcome Message
Toolbox
TrayApp
Uniblue DriverScanner 2009
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817359) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VOB2MPG v3
Wallpapers
WebReg
Windows Driver Package - Intel (e1express) Net (04/26/2007 9.7.240.0)
Windows Driver Package - Intel (iaStor) hdc (02/12/2007 7.0.0.1020)
Windows Driver Package - Intel hdc (11/15/2006 8.2.0.1011)
Windows Driver Package - Intel hdc (12/06/2006 6.8.0.3002)
Windows Driver Package - Intel System (09/15/2006 7.0.0.1011)
Windows Driver Package - Intel System (09/15/2006 8.0.0.1008)
Windows Driver Package - Intel System (09/15/2006 8.0.0.1010)
Windows Driver Package - Intel System (09/15/2006 8.2.0.1000)
Windows Driver Package - Intel USB (09/15/2006 8.0.0.1008)
Windows Driver Package - Lenovo (IBMPMDRV) System (05/31/2007 1.43)
Windows Media Player Firefox Plugin
Worldjongg
Yahoo! SiteBuilder
.
==== End Of File ===========================
June 4th, 2013, 07:32 PM
Broni
http://dev.discussions.virtualdr.forums.relay.cool/ Uninstall McAfee Security Scan Plus and McAfee SecurityCenter typical foistware.
If you don't use McAfee Online Backup uninstall it as well.

http://dev.discussions.virtualdr.forums.relay.cool/ Download RogueKiller for 32bit or Roguekiller for 64bit to your Desktop.
- Close all the running programs
- Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator
- Otherwise just double-click on RogueKiller.exe
- Pre-scan will start. Let it finish.
- Click on SCAN button.
- Wait until the Status box shows Scan Finished
- Click on Delete.
- Wait until the Status box shows Deleting Finished.
- Click on Report and copy/paste the content of the Notepad into your next reply.
- RKreport.txt could also be found on your desktop.
- If more than one log is produced post all logs.
- If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again
http://dev.discussions.virtualdr.forums.relay.cool/ Download Malwarebytes Anti-Rootkit (MBAR) from HERE
- Unzip downloaded file.
- Open the folder where the contents were unzipped and run mbar.exe
- Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
- Click on the Cleanup button to remove any threats and reboot if prompted to do so.
- Wait while the system shuts down and the cleanup process is performed.
- Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
- When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt
June 4th, 2013, 10:20 PM
rollie

Okay, I uninstalled McAfee and downloaded RogueKiller. Tried several times to run the scan but it would get about 85% done and the window would go white. I renamed the file winlogon.exe and same thing happened--about 85% of the scan was done and the window went white. There was an icon on the desktop RK Quarantine with a "debug" text document which I can post here, but it's 2698 KB. Is that too big to post?
June 4th, 2013, 10:28 PM
Broni

Try to re-run it from safe mode.

If still no go continue with MBAR.
June 4th, 2013, 11:32 PM
rollie

MBAR found a bug, so I cleaned and ran another scan--there were a total of 3 reports so here they are:

Malwarebytes Anti-Rootkit BETA 1.06.0.1003
www.malwarebytes.org

Database version: v2013.06.05.01

Windows Vista Service Pack 2 x86 NTFS (Safe Mode/Networking)
Internet Explorer 9.0.8112.16421
Janette :: JANETTE-LAPTOP [administrator]

6/4/2013 7:52:29 PM
mbar-log-2013-06-04 (19-52-29).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: Deep Anti-Rootkit Scan | PUP
Objects scanned: 229712
Time elapsed: 13 minute(s), 14 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{11111111-1111-1111-1111-110011221158} (Adware.GamePlayLab) -> Delete on reboot.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
Malwarebytes Anti-Rootkit BETA 1.06.0.1003
www.malwarebytes.org

Database version: v2013.06.05.01

Windows Vista Service Pack 2 x86 NTFS (Safe Mode/Networking)
Internet Explorer 9.0.8112.16421
Janette :: JANETTE-LAPTOP [administrator]

6/4/2013 8:08:25 PM
mbar-log-2013-06-04 (20-08-25).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: Deep Anti-Rootkit Scan | PUP
Objects scanned: 229486
Time elapsed: 13 minute(s), 20 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.06.0.1003

(c) Malwarebytes Corporation 2011-2012

OS version: 6.0.6002 Windows Vista Service Pack 2 x86

System is currently in a safe mode

Account is Administrative

Internet Explorer version: 9.0.8112.16421

Java version: 1.6.0_33

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 2.394000 GHz
Memory total: 3210051584, free: 2471325696

Downloaded database version: v2013.06.05.01
Downloaded database version: v2013.05.22.01
Initializing...
------------ Kernel report ------------
06/04/2013 19:52:25
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\acpi.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\intelide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\DRIVERS\pcmcia.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\DRIVERS\iaStor.sys
\SystemRoot\system32\DRIVERS\iaNvStor.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\DRVMCDB.SYS
\SystemRoot\System32\Drivers\PxHelp20.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\DRIVERS\DozeHDD.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\msrpc.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\DRIVERS\ApsHM86.sys
\SystemRoot\System32\DRIVERS\Apsx86.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\ecache.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\drivers\crcdisk.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\tunmp.sys
\SystemRoot\system32\DRIVERS\e1e6032.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\athr.sys
\SystemRoot\system32\DRIVERS\ohci1394.sys
\SystemRoot\system32\DRIVERS\1394BUS.SYS
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\drivers\tpm.sys
\SystemRoot\system32\DRIVERS\ibmpmdrv.sys
\SystemRoot\System32\Drivers\DLACDBHM.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\msiscsi.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\Drivers\DLARTL_M.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\DRIVERS\rasacd.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\smb.sys
\SystemRoot\system32\DRIVERS\NuidFltr.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\Drivers\AswRdr.SYS
\SystemRoot\system32\drivers\ws2ifsl.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\System32\Drivers\LenovoRd.sys
\SystemRoot\System32\Drivers\SMCLIB.SYS
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_iaStor.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\framebuf.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xffffffff8766dac8
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\RobsonImd-0\
Lower Device Object: 0xffffffff84b3d028
Lower Device Driver Name: \Driver\iaNvStor\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff8766a250
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-0\
Lower Device Object: 0xffffffff84f82028
Lower Device Driver Name: \Driver\iaStor\
<<<2>>>
Device number: 0, partition: 2
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff8766a250, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8766d030, DeviceName: \Device\DozeHDD0\, DriverName: \Driver\DozeHDD\
DevicePointer: 0xffffffff8766b618, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff8766b988, DeviceName: Unknown, DriverName: \Driver\Shockprf\
DevicePointer: 0xffffffff8766a250, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff8595b598, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff84f82028, DeviceName: \Device\Ide\IAAStorageDevice-0\, DriverName: \Driver\iaStor\
------------ End ----------
Alternate DeviceName: Unknown, DriverName: \Driver\partmgr\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\Windows\system32\drivers...
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2FFA1D60

Partition information:

Partition 0 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 14182400

Partition 1 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 14184448 Numsec = 474210304
Partition file system is NTFS
Partition is bootable

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 250059350016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-488377168-488397168)...
Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffffff8766dac8, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8766d7b0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff8766dac8, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff84b3d028, DeviceName: \Device\RobsonImd-0\, DriverName: \Driver\iaNvStor\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: D49470DA

Partition information:

Partition 0 type is Other (0xb)
Partition is NOT ACTIVE.
Partition starts at LBA: 63 Numsec = 1049809

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 538583040 bytes
Sector size: 512 bytes

Done!
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{11111111-1111-1111-1111-110011221158} --> [Adware.GamePlayLab]
Scan finished
Creating System Restore point...
Could not create restore point...
Cleaning up...
Removal successful. No system shutdown is required.
=======================================

Removal queue found; removal started
Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_0_i.mbam...
Removing c:\programdata\malwarebytes' anti-malware (portable)\bootstrap_0_1_14184448_i.mbam...
Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_0_r.mbam...
Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_1_i.mbam...
Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_1_r.mbam...
Removal finished
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.06.0.1003

(c) Malwarebytes Corporation 2011-2012

OS version: 6.0.6002 Windows Vista Service Pack 2 x86

System is currently in a safe mode

Account is Administrative

Internet Explorer version: 9.0.8112.16421

Java version: 1.6.0_33

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 2.394000 GHz
Memory total: 3210051584, free: 2606874624

=======================================

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.06.0.1003

(c) Malwarebytes Corporation 2011-2012

OS version: 6.0.6002 Windows Vista Service Pack 2 x86

System is currently in a safe mode

Account is Administrative

Internet Explorer version: 9.0.8112.16421

Java version: 1.6.0_33

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 2.394000 GHz
Memory total: 3210051584, free: 2609999872

Initializing...
------------ Kernel report ------------
06/04/2013 20:08:20
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\acpi.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\intelide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\DRIVERS\pcmcia.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\DRIVERS\iaStor.sys
\SystemRoot\system32\DRIVERS\iaNvStor.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\DRVMCDB.SYS
\SystemRoot\System32\Drivers\PxHelp20.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\DRIVERS\DozeHDD.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\msrpc.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\DRIVERS\ApsHM86.sys
\SystemRoot\System32\DRIVERS\Apsx86.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\ecache.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\drivers\crcdisk.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\tunmp.sys
\SystemRoot\system32\DRIVERS\e1e6032.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\athr.sys
\SystemRoot\system32\DRIVERS\ohci1394.sys
\SystemRoot\system32\DRIVERS\1394BUS.SYS
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\drivers\tpm.sys
\SystemRoot\system32\DRIVERS\ibmpmdrv.sys
\SystemRoot\System32\Drivers\DLACDBHM.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\msiscsi.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\Drivers\DLARTL_M.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\DRIVERS\rasacd.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\smb.sys
\SystemRoot\system32\DRIVERS\NuidFltr.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\Drivers\AswRdr.SYS
\SystemRoot\system32\drivers\ws2ifsl.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\System32\Drivers\LenovoRd.sys
\SystemRoot\System32\Drivers\SMCLIB.SYS
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_iaStor.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\framebuf.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xffffffff8766dac8
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\RobsonImd-0\
Lower Device Object: 0xffffffff84b3d028
Lower Device Driver Name: \Driver\iaNvStor\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff8766a250
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-0\
Lower Device Object: 0xffffffff84f82028
Lower Device Driver Name: \Driver\iaStor\
<<<2>>>
Device number: 0, partition: 2
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff8766a250, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8766d030, DeviceName: \Device\DozeHDD0\, DriverName: \Driver\DozeHDD\
DevicePointer: 0xffffffff8766b618, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff8766b988, DeviceName: Unknown, DriverName: \Driver\Shockprf\
DevicePointer: 0xffffffff8766a250, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff8595b598, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff84f82028, DeviceName: \Device\Ide\IAAStorageDevice-0\, DriverName: \Driver\iaStor\
------------ End ----------
Alternate DeviceName: Unknown, DriverName: \Driver\partmgr\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\Windows\system32\drivers...
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2FFA1D60

Partition information:

Partition 0 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 14182400

Partition 1 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 14184448 Numsec = 474210304
Partition file system is NTFS
Partition is bootable

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 250059350016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-488377168-488397168)...
Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffffff8766dac8, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8766d7b0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff8766dac8, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff84b3d028, DeviceName: \Device\RobsonImd-0\, DriverName: \Driver\iaNvStor\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: D49470DA

Partition information:

Partition 0 type is Other (0xb)
Partition is NOT ACTIVE.
Partition starts at LBA: 63 Numsec = 1049809

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 538583040 bytes
Sector size: 512 bytes

Done!
Scan finished
=======================================

Removal queue found; removal started
Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_0_i.mbam...
Removing c:\programdata\malwarebytes' anti-malware (portable)\bootstrap_0_1_14184448_i.mbam...
Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_0_r.mbam...
Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_1_i.mbam...
Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_1_r.mbam...
Removal finished
June 4th, 2013, 11:34 PM
Broni
http://dev.discussions.virtualdr.forums.relay.cool/ Create new restore point before proceeding with the next step....
How to:
- Windows 8: http://www.vikitech.com/11302/system-restore-windows-8
- Windows 7: http://www.howtogeek.com/howto/3195/...-in-windows-7/
- Vista: http://www.howtogeek.com/howto/windo...ystem-restore/
- XP: http://support.microsoft.com/kb/948247

http://dev.discussions.virtualdr.forums.relay.cool/ Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
- Never rename Combofix unless instructed.
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  If the connection is not there use restore point you created prior to running Combofix.
- Double click on combofix.exe & follow the prompts.
- NOTE1. If Combofix asks you to install Recovery Console, please allow it.
  NOTE 2. If Combofix asks you to update the program, always do so.
- When finished, it will produce a report for you.
- Please post the "C:\ComboFix.txt"
**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try the following...

Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Restart computer in safe mode
- Double-click on the Rkill desktop icon to run the tool.
- If using Vista or Windows 7 right-click on it and choose Run As Administrator.
- A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
- If not, delete the file, then download and use the one provided in Link 2.
- Do not reboot until instructed.
- If the tool does not run from any of the links provided, please let me know.
When the scan is done Notepad will open with rKill.txt log.
NOTE. rKill.txt log will also be present on your desktop.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
June 5th, 2013, 01:34 AM
rollie

I created a restore point, the computer restarted and gave me a blank screen. Shut down and tried open in Safe Mode with Networking and still the blank screen. Then I tried just Safe Mode and still the blank screen. Managed to get into the Thinkpad Rescue and Recovery windows and the computer is processing the restoration right now, but I think it's going to take awhile. I'm on my husband's computer posting this, while hopefully mine will be able to continue on with the clean up.
June 5th, 2013, 01:09 PM
rollie

Well things are messed up now. THinkPad Rescue and Recovery completed creating the Restore Point and restarted to a blank screen. Tried to start up in Safe Mode but have been unable to after many attempts. Pushed F8 at start up and could not get to the screen for Safe Mode. A few times it said on the screen, "Error 0210: Stuck Key 42, Press F1 to Set -UP." Thought maybe that was the F8 key and I was holding it down too long, but I've tried pushing it once and letting up, pushing it many times, and still not working. Been trying for a couple of hours and no luck. I've been able to get the BIOS screen, but have no idea what it all means, and I don't want to do something wrong and make it worse. So I'm stuck for now.
June 5th, 2013, 03:18 PM
rollie

Okay, things are a little better. Succeeded in starting up in Safe Mode, download Combofix, ran it and generated a report:

ComboFix 13-06-05.04 - Janette 06/05/2013 12:00:39.2.2 - x86 NETWORK
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3061.2305 [GMT -7:00]
Running from: c:\users\Janette\Downloads\ComboFix.exe
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
FW: McAfee Firewall *Disabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\TPAPSLOG.LOG
c:\windows\system32\TPHDLOG0.LOG
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\regtlib.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-05-05 to 2013-06-05 )))))))))))))))))))))))))))))))
.
.
2013-06-05 17:14 . 2013-06-05 17:14 -------- d-----w- C:\E
2013-06-05 14:12 . 2013-06-05 14:12 -------- d-----w- C:\D
2013-06-05 12:11 . 2013-06-05 12:11 -------- d-----w- c:\users\Administrator
2013-06-03 22:27 . 2013-06-03 22:27 -------- d-----w- c:\program files\AVAST Software
2013-06-03 22:27 . 2013-06-03 22:27 -------- d-----w- c:\programdata\AVAST Software
2013-05-15 15:20 . 2013-04-22 22:46 66296 ----a-w- c:\windows\system32\drivers\McPvDrv.sys
2013-05-15 10:16 . 2013-05-05 19:12 2382848 ------w- c:\windows\system32\mshtml.tlb
2013-05-15 10:02 . 2013-04-04 22:47 149632 ------w- c:\program files\Internet Explorer\sqmapi.dll
2013-05-15 10:02 . 2013-04-04 22:00 768512 ------w- c:\program files\Common Files\Microsoft Shared\vgx\VGX.dll
2013-05-15 10:02 . 2013-04-04 21:57 420864 ------w- c:\windows\system32\vbscript.dll
2013-05-15 08:25 . 2013-04-15 14:20 638328 ------w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-15 08:25 . 2013-04-13 10:56 37376 ------w- c:\windows\system32\cdd.dll
2013-05-15 08:24 . 2013-04-09 01:36 2049024 ------w- c:\windows\system32\win32k.sys
2013-05-14 23:37 . 2013-06-05 10:48 -------- d-----w- c:\program files\Mozilla Thunderbird
2013-05-10 07:57 . 2013-05-10 07:57 187456 ------w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2013-05-10 07:57 . 2013-05-10 07:57 187456 ------w- c:\program files\Internet Explorer\plugins\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-15 02:17 . 2012-09-05 02:30 71048 ------w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-15 02:17 . 2012-09-05 02:30 692104 ------w- c:\windows\system32\FlashPlayerApp.exe
2013-05-02 09:06 . 2010-03-18 18:11 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-03-11 10:38 . 2013-04-10 11:20 3606904 ------w- c:\windows\system32\ntkrnlpa.exe
2013-03-11 10:38 . 2013-04-10 11:20 3555192 ------w- c:\windows\system32\ntoskrnl.exe
2013-03-09 03:45 . 2013-04-10 11:20 49152 ------w- c:\windows\system32\csrsrv.dll
2013-03-09 01:28 . 2013-04-10 11:20 64000 ------w- c:\windows\system32\smss.exe
2013-03-08 03:53 . 2013-04-10 11:20 376320 ------w- c:\windows\system32\winsrv.dll
2013-03-08 03:52 . 2013-04-10 11:20 2067968 ------w- c:\windows\system32\mstscax.dll
2013-04-12 16:59 . 2013-04-12 16:59 263064 ------w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
.
[-] 2012-09-28 . DC3105CC925A0D47F61B54E66AB730FC . 892928 . . [6.0.6001.18000] . . c:\windows\System32\kernel32.dll
[-] 2012-09-28 . DC3105CC925A0D47F61B54E66AB730FC . 892928 . . [6.0.6002.18704] . . c:\windows\winsxs\x86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6002.18704_none_95a86b4d536e26b4\kernel32.dll
[-] 2012-09-28 . A9204E65A74AF0E801EA46F5A92C87A2 . 893440 . . [6.0.6002.22942] . . c:\windows\winsxs\x86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6002.22942_none_9604c9ba6cae00bb\kernel32.dll
[7] 2011-04-12 . 574B473FACAA0E91702B86578440B525 . 892416 . . [6.0.6002.18449] . . c:\windows\erdnt\cache\kernel32.dll
[7] 2011-04-12 . 574B473FACAA0E91702B86578440B525 . 892416 . . [6.0.6002.18449] . . c:\windows\winsxs\x86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6002.18449_none_9582275d538a1db6\kernel32.dll
[7] 2011-04-12 . 7062DEB220FA1CCB1B65FC40D6E7D807 . 893440 . . [6.0.6002.22625] . . c:\windows\winsxs\x86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6002.22625_none_961d64be6c9b1d69\kernel32.dll
[7] 2011-04-12 . 306835D4E74E49A5D10F0FCA0B422EB1 . 890368 . . [6.0.6001.18631] . . c:\windows\winsxs\x86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6001.18631_none_939e812b5662e4c2\kernel32.dll
[7] 2011-04-12 . 497A2DA8181560B3E2F8FFE0092FD1E6 . 892928 . . [6.0.6001.22898] . . c:\windows\winsxs\x86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6001.22898_none_93ee425a6faadaba\kernel32.dll
[7] 2009-04-11 . BB8509089E7DF514310814E1B2593FFC . 891392 . . [6.0.6002.18005] . . c:\windows\winsxs\x86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6002.18005_none_95a95e4d536d53fa\kernel32.dll
[7] 2009-02-13 . DB6E3731E6F5C8AE2843F80B5787F7C6 . 888832 . . [6.0.6001.18215] . . c:\windows\winsxs\x86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6001.18215_none_93b81a93564f1da0\kernel32.dll
[7] 2009-02-13 . 1987D817D08F5EAF0B7F334026FDDB79 . 890880 . . [6.0.6001.22376] . . c:\windows\winsxs\x86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6001.22376_none_9401d8206f9c7e67\kernel32.dll
[7] 2009-02-13 . B82C7AC1D559F0FD088792171D64C7F3 . 875520 . . [6.0.6000.16820] . . c:\windows\winsxs\x86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6000.16820_none_91c20a8f593529ed\kernel32.dll
[7] 2009-02-13 . BB792054BD990EC05D9E260D50FEAD39 . 875520 . . [6.0.6000.21010] . . c:\windows\winsxs\x86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6000.21010_none_92564f68724ae108\kernel32.dll
[7] 2008-01-19 . DC2338093F91BA4E0512208E60206DDD . 888320 . . [6.0.6001.18000] . . c:\windows\winsxs\x86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6001.18000_none_93bde541564b88ae\kernel32.dll
[7] 2006-11-02 . 1E36AE445E4DA83B82D51FEB2D4F8772 . 874496 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6000.16386_none_91872345596077da\kernel32.dll
.
[-] 2013-05-05 . 1152DE9D7FE16EC92A12165D1CBE8406 . 12325888 . . [9.00.8112.20594] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.20594_none_d3773bc179617094\mshtml.dll
[-] 2013-05-05 . 26F30066B9FA78C97A0E92803D496211 . 12324864 . . [9.00.8112.16421] . . c:\windows\System32\mshtml.dll
[-] 2013-05-05 . 26F30066B9FA78C97A0E92803D496211 . 12324864 . . [9.00.8112.16484] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16484_none_d2f86ee2603bb4d9\mshtml.dll
[-] 2013-04-04 . 79B0D843B26BEA808EA89BA2D8A026F2 . 12324864 . . [9.00.8112.16483] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16483_none_d2f76e98603c9b82\mshtml.dll
[-] 2013-04-04 . 4EBF337D1F52EA9202072348BA41CA95 . 12325376 . . [9.00.8112.20593] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.20593_none_d3763b777962573d\mshtml.dll
[-] 2013-02-22 . 474D43D76E2A33FEE21C6F4BB7C4A3B7 . 12324864 . . [9.00.8112.20586] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.20586_none_d3840c4179578751\mshtml.dll
[-] 2013-02-22 . 658EBC74BD38D16805648C4775F7FA82 . 12324352 . . [9.00.8112.16476] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16476_none_d3053f626031cb96\mshtml.dll
[-] 2013-02-02 . 88C27474E61271B49677F22CEE76FB3E . 12322304 . . [9.00.8112.20580] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.20580_none_d37e0a85795cef47\mshtml.dll
[-] 2013-02-02 . 263963D93A3CA8F685EFA5966F1E6581 . 12321792 . . [9.00.8112.16470] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16470_none_d2ff3da66037338c\mshtml.dll
[-] 2013-01-08 . C97434C851C4821BD92D2831FDF1ECBE . 12321280 . . [9.00.8112.16464] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16464_none_d30e0eba602b7cf7\mshtml.dll
[-] 2013-01-08 . B6AD225B3BCC07332FBB2C2824315534 . 12322304 . . [9.00.8112.20573] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.20573_none_d38bdb4f79521f5b\mshtml.dll
[-] 2012-11-14 . 07F649CD36F266BBE33B814FA678AA43 . 12320256 . . [9.00.8112.16457] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16457_none_d31bdf846020ad0b\mshtml.dll
[-] 2012-11-14 . 8021EF27048F9ECE5286EA8C8EED23B8 . 12321280 . . [9.00.8112.20565] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.20565_none_d398abcf79483618\mshtml.dll
[-] 2012-10-08 . 8D1BB1E5A033E8817EF94A9047630165 . 12320768 . . [9.00.8112.16455] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16455_none_d319def060227a5d\mshtml.dll
[-] 2012-10-08 . F7B251DA2FA89933771289793DCAA08B . 12321280 . . [9.00.8112.20562] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.20562_none_d395aaf1794aea13\mshtml.dll
[-] 2012-08-24 . 975D1EA99A0FE8104B72440995B3C20B . 12319744 . . [9.00.8112.20557] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.20557_none_d3a57c4f793e4cd5\mshtml.dll
[-] 2012-08-24 . BB197F54A8F69EEA8356B7F70E6D3A20 . 12319744 . . [9.00.8112.16450] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16450_none_d314dd7e6026fbaa\mshtml.dll
[-] 2012-06-29 . 5E8E869E1342308752A37A2C90CCA79D . 12317184 . . [9.00.8112.16448] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16448_none_d327afba6017aa71\mshtml.dll
[-] 2012-06-28 . AEC51857AEC2F5CE4520366240AFC671 . 12317184 . . [9.00.8112.20554] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.20554_none_d3a27b71794100d0\mshtml.dll
[-] 2012-06-02 . 6820A9E91AFF7CB3A510360D8CCD9BDD . 12314624 . . [9.00.8112.16447] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16447_none_d326af706018911a\mshtml.dll
[-] 2012-06-02 . 1ABF770552EA9D4FE90F654468FAF4CE . 12314624 . . [9.00.8112.20553] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.20553_none_d3a17b277941e779\mshtml.dll
[-] 2012-05-17 . 9FB58F71104107D44540AF1195F7A14D . 12314624 . . [9.00.8112.16446] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16446_none_d325af26601977c3\mshtml.dll
[-] 2012-05-17 . 761D9111F5A2619CB5060661D36FBFFF . 12314624 . . [9.00.8112.20551] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.20551_none_d39f7a937943b4cb\mshtml.dll
[-] 2012-03-04 . 497C9C3DB953A60EC4F43A097E15F75E . 12282368 . . [9.00.8112.16441] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16441_none_d320adb4601df910\mshtml.dll
[-] 2012-02-28 . F82BF2CB075B49E9FAB5FF213C45C020 . 12281856 . . [9.00.8112.16443] . . c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.1.8112.16443_none_d322ae48601c2bbe\mshtml.dll
.
[-] 2011-12-14 . 17AF64D727545F2804F6E6D998327E3F . 680448 . . [7.0.6002.18551] . . c:\windows\System32\msvcrt.dll
[-] 2011-12-14 . 17AF64D727545F2804F6E6D998327E3F . 680448 . . [7.0.6002.18551] . . c:\windows\winsxs\x86_microsoft-windows-msvcrt_31bf3856ad364e35_6.0.6002.18551_none_d306a7e69c340115\msvcrt.dll
[-] 2011-12-14 . A807F65718C263442F0C3613F9BFD267 . 680448 . . [7.0.6002.22755] . . c:\windows\winsxs\x86_microsoft-windows-msvcrt_31bf3856ad364e35_6.0.6002.22755_none_d39447bfb54e0362\msvcrt.dll
[7] 2009-04-11 . F5E991236960137B1F5449C5E5DF4656 . 679936 . . [7.0.6002.18005] . . c:\windows\winsxs\x86_microsoft-windows-msvcrt_31bf3856ad364e35_6.0.6002.18005_none_d340af2c9c07e8f9\msvcrt.dll
[7] 2008-01-19 . 04CBEAA089B6A752B3EB660BEE8C4964 . 680448 . . [7.0.6001.18000] . . c:\windows\winsxs\x86_microsoft-windows-msvcrt_31bf3856ad364e35_6.0.6001.18000_none_d15536209ee61dad\msvcrt.dll
[7] 2006-11-02 . 75287677BB8BC9A16C32CE8A72F485A0 . 681472 . . [7.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-msvcrt_31bf3856ad364e35_6.0.6000.16386_none_cf1e7424a1fb0cd9\msvcrt.dll
.
[-] 2013-04-04 . 2C96B3921B4CDE10DBAED5AAD760DB67 . 1129472 . . [9.00.8112.16421] . . c:\windows\System32\wininet.dll
[-] 2013-04-04 . 2C96B3921B4CDE10DBAED5AAD760DB67 . 1129472 . . [9.00.8112.16483] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.16483_none_c19d4f79dfe6324c\wininet.dll
[-] 2013-04-04 . 28B2DD8DBAEE306290A74ED03DB3768F . 1129984 . . [9.00.8112.20593] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.20593_none_c21c1c58f90bee07\wininet.dll
[-] 2013-02-22 . C5B6468422DB1C8AA36C32CBB0197E5E . 1129472 . . [9.00.8112.16476] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.16476_none_c1ab2043dfdb6260\wininet.dll
[-] 2013-02-22 . 490E24D5E427DFA55B1C1182F0DB861C . 1129984 . . [9.00.8112.20586] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.20586_none_c229ed22f9011e1b\wininet.dll
[-] 2013-02-02 . 1284D72C04B553ED5382EA14303D66DB . 1129472 . . [9.00.8112.20580] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.20580_none_c223eb66f9068611\wininet.dll
[-] 2013-02-02 . 03728C624D05C2F157BBD46F6B7F6EA0 . 1129472 . . [9.00.8112.16470] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.16470_none_c1a51e87dfe0ca56\wininet.dll
[-] 2013-01-08 . B49B56B64F57699A1A663D2CF7D0A56F . 1129472 . . [9.00.8112.16464] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.16464_none_c1b3ef9bdfd513c1\wininet.dll
[-] 2013-01-08 . 16C45E6881449C6330567E51C13920FA . 1129472 . . [9.00.8112.20573] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.20573_none_c231bc30f8fbb625\wininet.dll
[-] 2012-11-14 . 7FA3A810F383588D46220967DE8B64FF . 1129472 . . [9.00.8112.16457] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.16457_none_c1c1c065dfca43d5\wininet.dll
[-] 2012-11-14 . 0635D714351F842D43EA184E75C4A3FF . 1129472 . . [9.00.8112.20565] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.20565_none_c23e8cb0f8f1cce2\wininet.dll
[-] 2012-10-08 . 9CB0D2A9A77D91D9614355EE9FF00519 . 1129472 . . [9.00.8112.16455] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.16455_none_c1bfbfd1dfcc1127\wininet.dll
[-] 2012-10-08 . 6E3AC8A54A1881806BA2B58539483788 . 1129472 . . [9.00.8112.20562] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.20562_none_c23b8bd2f8f480dd\wininet.dll
[-] 2012-08-24 . 2895E29EFCFC0B1BCF8AEE1A0C67913C . 1129472 . . [9.00.8112.20557] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.20557_none_c24b5d30f8e7e39f\wininet.dll
[-] 2012-08-24 . 5553611E2F9EA6F613079177F1233068 . 1129472 . . [9.00.8112.16450] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.16450_none_c1babe5fdfd09274\wininet.dll
[-] 2012-06-29 . 75A97A2C060E72AB49E071E08C7DD2BA . 1129472 . . [9.00.8112.16448] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.16448_none_c1cd909bdfc1413b\wininet.dll
[-] 2012-06-28 . 54C30A4066A28F9A017E095E283B2762 . 1129472 . . [9.00.8112.20554] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.20554_none_c2485c52f8ea979a\wininet.dll
[-] 2012-06-02 . 8E87270C4704CF2951E1E7820D6C8A2B . 1129472 . . [9.00.8112.16447] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.16447_none_c1cc9051dfc227e4\wininet.dll
[-] 2012-06-02 . E430161A632F9A8FE512DE0CA5685559 . 1129472 . . [9.00.8112.20553] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.20553_none_c2475c08f8eb7e43\wininet.dll
[-] 2012-05-17 . 1C191A4F0960F21B5D58C8A65BAF5427 . 1129472 . . [9.00.8112.16446] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.16446_none_c1cb9007dfc30e8d\wininet.dll
[-] 2012-05-17 . 43BAC67996D8765A5F1B3A4EA6231E21 . 1129472 . . [9.00.8112.20551] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.20551_none_c2455b74f8ed4b95\wininet.dll
[-] 2012-03-04 . 1D94FA7C81D2FFE494AF094619BA706F . 1127424 . . [9.00.8112.16441] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.16441_none_c1c68e95dfc78fda\wininet.dll
[-] 2012-02-28 . 44465367256D1C72B58F5ABAA19E7016 . 1127424 . . [9.00.8112.16443] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.16443_none_c1c88f29dfc5c288\wininet.dll
[-] 2012-02-28 . 11A34DCA08EB2A586246F2D6C2A81D58 . 1127424 . . [9.00.8112.20548] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.1.8112.20548_none_c2572d66f8dee105\wininet.dll
[-] 2011-12-15 . 2F56B044E8ED4FAA812A19A8DF2115EE . 919552 . . [8.00.6001.23286] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.6001.23286_none_e50b123ed0f991a8\wininet.dll
[-] 2011-12-15 . DA7C58952F082AECABF775C83F913C6F . 916992 . . [8.00.6001.19190] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.6001.19190_none_e470a3cbb7e975c5\wininet.dll
[7] 2011-11-03 . 406EEBC1B3FE188DE9D6B3AFB3834E84 . 919552 . . [8.00.6001.23266] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.6001.23266_none_e520b216d0e959c6\wininet.dll
[7] 2011-11-03 . 4E45F092670EEE0563AA9E1A7C8A1217 . 916992 . . [8.00.6001.19170] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.6001.19170_none_e48643a3b7d93de3\wininet.dll
[7] 2011-09-30 . DA000DE8EB63D54DCC206AA0699B9A52 . 919552 . . [8.00.6001.23250] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.6001.23250_none_e5258046d0e6a5cb\wininet.dll
[7] 2011-09-30 . 18F17E90657528C232B1944DEB4EC160 . 916480 . . [8.00.6001.19154] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.6001.19154_none_e49fe4a3b7c56b5d\wininet.dll
[7] 2011-07-23 . D2BA28C2B3CB7F2DBB5A5F92851B3F3F . 919552 . . [8.00.6001.23216] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.6001.23216_none_e556c1b2d0c0ce11\wininet.dll
[7] 2011-07-23 . 8419DAE7205374F2CAA4C9CDBD0999E6 . 916480 . . [8.00.6001.19120] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.6001.19120_none_e4bc533fb7b0b22e\wininet.dll
[7] 2011-06-21 . D4E2D56E76A2D981262CCD68EFCCEF44 . 834048 . . [7.00.6002.18486] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.18486_none_037ef50b9f34caad\wininet.dll
[7] 2011-06-21 . BC20A28B25C7E2F4E6F84E1CFF742539 . 842240 . . [7.00.6002.22664] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.22664_none_041c3300b843fd0e\wininet.dll
[7] 2011-04-21 . 17413EF7D95632D892B4C914CD7E66F9 . 834048 . . [7.00.6002.18457] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.18457_none_03a065199f1b9031\wininet.dll
[7] 2011-04-21 . 3790936B00FBA6EC2053C3E81B42AFCE . 842240 . . [7.00.6002.22629] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.22629_none_044c7422b81f0bfd\wininet.dll
[7] 2011-04-21 . DA5A72211661C7F162B332FEA4F09A69 . 833024 . . [7.00.6001.18639] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18639_none_01d191b7a1e338b2\wininet.dll
[7] 2011-04-21 . D53D34CA16BE45211F7A13532D181A1A . 841728 . . [7.00.6001.22905] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22905_none_0277a0eabaec199b\wininet.dll
[7] 2011-02-18 . E9839CDBD10ED7E7E2D3A3E51C23B168 . 842240 . . [7.00.6002.22592] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.22592_none_03f9c0c2b85e210c\wininet.dll
[7] 2011-02-18 . A7A07D223862A0C661DB225E27058248 . 834048 . . [7.00.6002.18407] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.18407_none_03d674b59ef3047c\wininet.dll
[7] 2011-02-18 . B1DB3E0B0E6CB66DC31629EC26FB0048 . 833024 . . [7.00.6001.18602] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18602_none_01eaff75a1d1337e\wininet.dll
[7] 2011-02-18 . E5B46DD994C4AB72C8BD666B3026E812 . 841728 . . [7.00.6001.22857] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22857_none_02438ffcbb12dad7\wininet.dll
[7] 2010-12-20 . AC0D9A507894509CF6D23F1CE876BA4F . 842240 . . [7.00.6002.22551] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.22551_none_04240028b83e97f1\wininet.dll
[7] 2010-12-20 . 072213E1604D843D3230EE61663466A4 . 834048 . . [7.00.6002.18357] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.18357_none_03a063339f1b930a\wininet.dll
[7] 2010-12-20 . 97CFAF0C9083BF808F5B3B609C055205 . 833024 . . [7.00.6001.18565] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18565_none_01ad1ee5a1ff2a02\wininet.dll
[7] 2010-12-20 . 0A2382C16E9F1D607CDF05C62810212F . 841728 . . [7.00.6001.22816] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22816_none_026dcf62baf351bc\wininet.dll
[7] 2010-12-18 . 7D6AACE6BF60B5A1D572E082DEC9F0F0 . 919552 . . [8.00.6001.23111] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.6001.23111_none_e551be5ad0c55237\wininet.dll
[7] 2010-12-18 . 74BCC23D622F32DA0450D164735ACAB1 . 916480 . . [8.00.6001.19019] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.6001.19019_none_e4d023dfb7a07d25\wininet.dll
[7] 2010-10-21 . E637895D078330743D75A8D28A46D18F . 834048 . . [7.00.6002.18332] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.18332_none_03b101999f0fdc75\wininet.dll
[7] 2010-10-21 . 848AA8D077770D10C3776F2D03796FBC . 842240 . . [7.00.6002.22511] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.22511_none_044f3fd8b81e282d\wininet.dll
[7] 2010-10-21 . F0F4CA08C394F080EC6718249621AC2A . 841728 . . [7.00.6001.22784] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22784_none_02201d74bb2de57e\wininet.dll
[7] 2010-10-20 . CE49BFFF3DA6448331606B78F9CDB484 . 833024 . . [7.00.6001.18542] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18542_none_01bfbddfa1f1a61b\wininet.dll
[7] 2010-09-09 . 48E9D41DED106BB5B57C194002940862 . 842240 . . [7.00.6002.22484] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.22484_none_04068f5cb8543aa2\wininet.dll
[7] 2010-09-09 . E51398091D9467C369AE5B72A0729398 . 841728 . . [7.00.6001.22760] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22760_none_0231bc24bb214840\wininet.dll
[7] 2010-09-08 . 7079877D59D128E9AB45F5370C0B4AD2 . 833024 . . [7.00.6001.18527] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18527_none_01da5f29a1dcecec\wininet.dll
[7] 2010-09-08 . C7BCDC2D355271AE2B87A93A1E24AEAF . 834048 . . [7.00.6002.18309] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.18309_none_03d873639ef13a03\wininet.dll
[7] 2010-06-29 . C25CA4544D5716FDD9C2D3C942A2D0C9 . 834560 . . [7.00.6002.22434] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.22434_none_043c9ef8b82baeed\wininet.dll
[7] 2010-06-29 . B3FC2F131B72F22857A342039328CF5D . 834048 . . [7.00.6002.18278] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.18278_none_038bc1bf9f2ae71c\wininet.dll
[7] 2010-06-28 . 56802F604444B085DB3FD5BE6B9A08A9 . 834048 . . [7.00.6001.22720] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22720_none_025cfbd4bb00d87c\wininet.dll
[7] 2010-06-28 . A66BCE6FFA302A0DD75D54B708A554AA . 833024 . . [7.00.6001.18498] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18498_none_018fae19a214ccb3\wininet.dll
[7] 2010-05-04 . 42534A33F524671A160AAC4456B2BB4C . 834560 . . [7.00.6002.22398] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.22398_none_03ffbeb2b858bec8\wininet.dll
[7] 2010-05-04 . 4C4F5080682BF9B1100D5938C12B55F9 . 834048 . . [7.00.6002.18255] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.18255_none_039e60b99f1d6335\wininet.dll
[7] 2010-05-04 . F12FBAF1DA549CBB79E6D89AD3A57ED0 . 833024 . . [7.00.6001.18470] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18470_none_019d4ba1a20bca19\wininet.dll
[7] 2010-05-04 . 0DC7A1B98FE22C894DB7505F1B5303B7 . 834048 . . [7.00.6001.22685] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22685_none_02211bd8bb2d01ae\wininet.dll
[7] 2010-03-11 . C5EC0879DF48AB8846FFFC21F707A504 . 834560 . . [7.00.6002.22360] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.22360_none_04182c26b847a03d\wininet.dll
[7] 2010-03-11 . 2744014FD9E9069E73CBC7797ACEDCDD . 834048 . . [7.00.6001.22653] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22653_none_023f8b08bb167b2d\wininet.dll
[7] 2010-03-09 . 0F340B61FA7221DDF8B8375BC0217B71 . 832512 . . [7.00.6000.17037] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.17037_none_ffe924eda4beb0e0\wininet.dll
[7] 2010-03-09 . F245376BFFED63999B0290601128A72A . 841216 . . [7.00.6000.21242] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.21242_none_0062f240bde8eb0f\wininet.dll
[7] 2010-03-09 . 76C9A358D176DD7904C8A72BB7235608 . 833024 . . [7.00.6001.18444] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18444_none_01c1bc8da1efdba2\wininet.dll
[7] 2010-03-09 . 1846CD5B8EE042DB00DEB0A50ABF6737 . 834048 . . [7.00.6002.18226] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.18226_none_03bfd0c79f0428b9\wininet.dll
[7] 2009-12-18 . 27DFDEA0533477C8923FC874F6439CF0 . 833024 . . [7.00.6001.18385] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18385_none_01977b41a20f6796\wininet.dll
[7] 2009-12-18 . C7A318E74FEF945EBFF855C1513CD96C . 832512 . . [7.00.6000.16982] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16982_none_ffae3bbda4eb8aa0\wininet.dll
[7] 2009-12-18 . 6F837BD5085F73A8FF0425AA6705A8D1 . 841216 . . [7.00.6000.21184] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.21184_none_0039b13ebe07905a\wininet.dll
[7] 2009-12-18 . 4D36519B1212659127A4CFCC19E33049 . 834048 . . [7.00.6001.22585] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22585_none_022119f2bb2d0487\wininet.dll
[7] 2009-12-17 . C86BBCF0DA44F2B36C9AA59032916EF0 . 834048 . . [7.00.6002.22290] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.22290_none_03f7ba7cb85ff6e9\wininet.dll
[7] 2009-12-16 . 565B8A25FB59E8E1F5ED59C95F72B7D7 . 834048 . . [7.00.6002.18167] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.18167_none_03958f7b9f23b4ad\wininet.dll
[7] 2009-10-27 . BA95D134FE1A3577A174D9A85D6ED1F1 . 832512 . . [7.00.6000.16945] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16945_none_ffdc7c4ba4c866e1\wininet.dll
[7] 2009-10-27 . 3F564B34F047885934DA5D3479ED0716 . 834048 . . [7.00.6002.18130] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.18130_none_03aefd399f11af79\wininet.dll
[7] 2009-10-27 . 8C8A7E47DBB25EB94C29152BD08CF436 . 833024 . . [7.00.6001.18349] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18349_none_01c6bc19a1eb5d2e\wininet.dll
[7] 2009-10-27 . 0F34E919E086E834052850B6E57050F3 . 841216 . . [7.00.6000.21148] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.21148_none_0068f216bde385f2\wininet.dll
[7] 2009-10-27 . F1D8D50E054ADDF05D708A8676868763 . 834048 . . [7.00.6001.22550] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22550_none_023c8844bb193201\wininet.dll
[7] 2009-10-27 . C50C20FB2B5B5F228F7B1BA8925107B0 . 834048 . . [7.00.6002.22252] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.22252_none_0424fac0b83db9d3\wininet.dll
[7] 2009-08-27 . 2BD22AA29893876347BA1BE62487748A . 832512 . . [7.00.6000.16916] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16916_none_fffdec59a4af2c65\wininet.dll
[7] 2009-08-27 . D5709010F06FEC697CCB2831D0821E0B . 840704 . . [7.00.6000.21116] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.21116_none_00876146bdccff71\wininet.dll
[7] 2009-08-27 . 604E16194F1E60084B948ACAE8334E0F . 833024 . . [7.00.6001.18319] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18319_none_01e72bdda1d3095b\wininet.dll
[7] 2009-08-27 . C628812EA5016B1C3E13E082940D5AF6 . 834048 . . [7.00.6001.22508] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22508_none_027a9a30bae97104\wininet.dll
[7] 2009-08-27 . 5E382486BCCCF4C50A810E2DF18C8CDB . 834048 . . [7.00.6002.22212] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.22212_none_04503a70b81d4a0f\wininet.dll
[7] 2009-08-27 . D88D19604AACE2101B13260322FB4A3A . 834048 . . [7.00.6002.18100] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.18100_none_03cf6cfd9ef95ba6\wininet.dll
[7] 2009-07-18 . FCB4E3234667317905333B6A4CDF85FC . 827904 . . [7.00.6001.18294] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18294_none_018ba925a2186d09\wininet.dll
[7] 2009-07-18 . 87D84C48693EB949350FA938D63512D8 . 827392 . . [7.00.6000.16890] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16890_none_ffa16957a4f576bc\wininet.dll
[7] 2009-07-18 . D1E1447C4E2077BDFFDD547972FEBDEB . 828928 . . [7.00.6000.21089] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.21089_none_003eb0cabe0311e6\wininet.dll
[7] 2009-07-18 . 7FCA93009963EE8A7AF1740661412F1E . 828416 . . [7.00.6001.22475] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22475_none_022be7f8bb24eb6f\wininet.dll
[7] 2009-07-18 . 387B0601FCA64AF5117C321E46C4C4E2 . 828928 . . [7.00.6002.22180] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.22180_none_04028882b857ddd1\wininet.dll
[7] 2009-07-18 . 408A0A6E83333F98D564D95CDBB6D3C6 . 828416 . . [7.00.6002.18071] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.18071_none_0384bbed9f313b6d\wininet.dll
[7] 2009-04-24 . D94BDEEF2E47EB4A46B957253C697F01 . 827392 . . [7.00.6000.16851] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16851_none_ffcda951a4d4204f\wininet.dll
[7] 2009-04-24 . 64EAF7CF461A15DB4EAEB1D50A10E88E . 827904 . . [7.00.6001.18248] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18248_none_01c5b9e9a1ec46b0\wininet.dll
[7] 2009-04-24 . E7D90AF9B0C7FA98DF353E022EE1C63E . 828928 . . [7.00.6000.21046] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.21046_none_0066ef9cbde5561d\wininet.dll
[7] 2009-04-24 . 77C60DD61D21777734B1C945540473A4 . 828416 . . [7.00.6001.22418] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22418_none_026fc85ebaf18fce\wininet.dll
[7] 2009-04-24 . 07DBFC0759F61E95901AF2B2D4E83451 . 828416 . . [7.00.6002.22121] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.22121_none_04446854b8264f82\wininet.dll
[7] 2009-04-23 . 24CBE22F35941FBFD6144A5C011EA999 . 828416 . . [7.00.6002.18024] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.18024_none_03bdcc679f05fbbd\wininet.dll
[7] 2009-04-11 . 8777B44511D8BCCF47B5A7CBDC02DE11 . 828416 . . [7.00.6002.18005] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.18005_none_03d46c899ef4dd32\wininet.dll
[7] 2009-03-08 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.6001.18702_none_e4d415d7b79e8243\wininet.dll
[7] 2009-03-03 . 6E115E2D3FAE5077A361A5BCE78FF170 . 827392 . . [7.00.6001.18226] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18226_none_01d9592da1dddc20\wininet.dll
[7] 2009-03-03 . 3ED9859939928CA568F487AB42175A33 . 827904 . . [7.00.6001.22389] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22389_none_0225174ebb296f95\wininet.dll
[7] 2009-03-03 . BA68744F8FE1BAAC35362F18774972A3 . 826368 . . [7.00.6000.16830] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16830_none_ffe248dfa4c4cf16\wininet.dll
[7] 2009-03-03 . 88B57405AC5B2BF513069086F8963635 . 828416 . . [7.00.6000.21023] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.21023_none_00798e96bdd7d236\wininet.dll
[7] 2009-01-16 . 6A986C2CD30633447DAB21A4852E40D6 . 827904 . . [7.00.6001.22355] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22355_none_024185eabb14b666\wininet.dll
[7] 2009-01-15 . FB79A2AA5E92653B9A394FE26D799BF8 . 827392 . . [7.00.6001.18203] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18203_none_01ebf827a1d05839\wininet.dll
[7] 2009-01-15 . 65647F41CEC0C8EEC9DF5BC1168EC76C . 827904 . . [7.00.6000.20996] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.20996_none_003107debe0dae90\wininet.dll
[7] 2009-01-15 . FF35D495AC08549154D1D96990513CD9 . 826368 . . [7.00.6000.16809] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16809_none_000bbb3da4a45f52\wininet.dll
[7] 2008-10-16 . 8F89FFECF6989DD7D9ECCEC6D95D7419 . 827392 . . [7.00.6001.18157] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18157_none_01b9e7cda1f54c23\wininet.dll
[7] 2008-10-16 . F18C1B151A0B18C35BF0919A9BA0FA0F . 826368 . . [7.00.6000.16764] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16764_none_ffc5d85da4d98b1e\wininet.dll
[7] 2008-10-16 . 4944C9FFE8903A276590D4215F74B937 . 827904 . . [7.00.6001.22288] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22288_none_0224151ebb2a5917\wininet.dll
[7] 2008-10-16 . 622FE627D15DD920238A993021F0A4D1 . 827904 . . [7.00.6000.20937] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.20937_none_0072e7b0bddc2041\wininet.dll
[7] 2008-10-02 . C373C19F10601C1AFE7E40907AE48694 . 827392 . . [7.00.6001.18148] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18148_none_01c5b803a1ec4989\wininet.dll
[7] 2008-10-02 . 8BF7D225505A4ADA25D9444E91811CEA . 826368 . . [7.00.6000.16757] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16757_none_ffd3a927a4cebb32\wininet.dll
[7] 2008-10-02 . 6B2591CDCEFEB8451594288426677CBB . 827904 . . [7.00.6001.22278] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22278_none_022ee50abb223d26\wininet.dll
[7] 2008-10-02 . C85EF7DE97ABBF00B16AD11EDFEAC637 . 827904 . . [7.00.6000.20927] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.20927_none_007db79cbdd40450\wininet.dll
[7] 2008-06-27 . 618A51B5FB9DD5810960F6044C0E9289 . 827392 . . [7.00.6001.18099] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18099_none_0190a6cba213f16e\wininet.dll
[7] 2008-06-27 . E74D932CA7B3DA8CDB7A5F11F5A03ABC . 826368 . . [7.00.6000.16711] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16711_none_fff8e71ba4b3b364\wininet.dll
[7] 2008-06-27 . EDF59D63DDBC8BE0BB4836EFFFC04BDC . 827904 . . [7.00.6001.22212] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22212_none_0269c2d6baf6fd76\wininet.dll
[7] 2008-06-27 . AE7150C0696C656D02FDD48259F4EFF5 . 827904 . . [7.00.6000.20868] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.20868_none_00537650bdf39044\wininet.dll
[7] 2008-04-25 . 44FD3968AD885026D94450832A78DE8A . 826880 . . [7.00.6001.18063] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18063_none_01ab14d3a2010591\wininet.dll
[7] 2008-04-25 . 9191790BF02A8D759EC2B4E4FA868407 . 826368 . . [7.00.6000.16681] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16681_none_ffad35c1a4ec79d4\wininet.dll
[7] 2008-04-25 . A86218059C228E7691A13E4CB63C4CDF . 826880 . . [7.00.6001.22167] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22167_none_0238b2c6bb1b0ab7\wininet.dll
[7] 2008-04-25 . F40594128A6BFDA6C3F0900796895078 . 827392 . . [7.00.6000.20823] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.20823_none_0079b48ebdd7a1cd\wininet.dll
[7] 2008-02-22 . 482BCCBF1FCBB3378100FF97081438C1 . 826880 . . [7.00.6001.18023] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18023_none_01d65483a1e095cd\wininet.dll
[7] 2008-02-22 . 4E962B645608E6EDB7D31B75921D07FA . 826880 . . [7.00.6001.22120] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.22120_none_025cf070bb00e992\wininet.dll
[7] 2008-02-22 . F7FF1E0D443788D6AE4CBCA593530099 . 827392 . . [7.00.6000.20777] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.20777_none_0047a434bdfc95b7\wininet.dll
[7] 2008-02-21 . DAEED2799D4D19F955C3E90B22A1E91E . 826368 . . [7.00.6000.16643] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16643_none_ffda7605a4ca3cbe\wininet.dll
[7] 2008-02-14 . 0AD9BE4F82F0389EC9B8A58F2FD16442 . 824832 . . [7.00.6000.16609] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16609_none_000bb771a4a46504\wininet.dll
[7] 2008-02-14 . 39FBDEC53D5F7C5F4B7C35B9B1926A0F . 825344 . . [7.00.6000.20734] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.20734_none_006fe306bdded9ee\wininet.dll
[7] 2008-02-05 . F3B7B70B789056994406377CA8B06829 . 824832 . . [7.00.6000.16575] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16575_none_ffbc04efa4e0c618\wininet.dll
[7] 2008-02-05 . 0683CBA27E3111CB87B682CA66475C0C . 825344 . . [7.00.6000.20697] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.20697_none_00320276be0cd072\wininet.dll
[7] 2008-02-01 . 38F6BA60380A45EFB07CDAAECDC394F2 . 825344 . . [7.00.6000.20663] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.20663_none_004e7112bdf81743\wininet.dll
[7] 2008-02-01 . 5AED372CFC645834DA3DD287CEF21473 . 824832 . . [7.00.6000.16546] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16546_none_ffdd74fda4c78b9c\wininet.dll
[7] 2008-01-19 . 455D715A840579BDC1CF8E5C1DA76849 . 825856 . . [7.00.6001.18000] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18000_none_01e8f37da1d311e6\wininet.dll
[7] 2006-11-02 . 214A456AADCC7DD1B36E2287BA71A9CA . 822272 . . [7.00.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6000.16386_none_ffb23181a4e80112\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK]
@="{3c3f3c1a-9153-7c05-f938-622e7003894d}"
[HKEY_CLASSES_ROOT\CLSID\{3c3f3c1a-9153-7c05-f938-622e7003894d}]
2010-04-14 04:11 2872120 ------w- c:\program files\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK2]
@="{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}"
[HKEY_CLASSES_ROOT\CLSID\{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}]
2010-04-14 04:11 2872120 ------w- c:\program files\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK3]
@="{b4caf489-1eec-c617-49ad-8d7088598c06}"
[HKEY_CLASSES_ROOT\CLSID\{b4caf489-1eec-c617-49ad-8d7088598c06}]
2010-04-14 04:11 2872120 ------w- c:\program files\McAfee Online Backup\MOBKshell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-03-04 487424]
"TpShocks"="TpShocks.exe" [2007-11-22 181536]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-04-23 1725736]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-07-09 1282048]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-10-07 154136]
"MWLExe"="c:\progra~1\Mcafee\MWL\MWLGuiSt.exe" [2007-07-28 206184]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2013-02-28 515888]
"LPManager"="c:\progra~1\Lenovo\LENOVO~1\LPMGR.exe" [2007-07-13 124256]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-10-07 150040]
"IaNvSrv"="c:\program files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [2007-10-24 33304]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-10-07 178712]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2009-12-01 256576]
"EEventManager"="c:\program files\EPSON\Creativity Suite\Event Manager\EEventManager.exe" [2006-10-12 102400]
"DiskeeperSystray"="c:\program files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2006-11-16 217176]
"cssauth"="c:\program files\Lenovo\Client Security Solution\cssauth.exe" [2007-08-09 2630968]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-12 59280]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2007-07-05 124200]
"ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2007-07-05 419112]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [2005-09-16 57344]
"mcpltui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2013-02-28 515888]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-2-1 50688]
ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2012-11-22 303104]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ink Monitor]
2001-12-07 09:48 258118 ------w- c:\program files\epson\Ink Monitor\InkMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PeachtreePrefetcher.exe]
2011-02-16 20:30 28488 ------r- c:\progra~1\SAGESO~1\PEACHT~1\PeachtreePrefetcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-05 02:17]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Janette\AppData\Roaming\Mozilla\Firefox\Profiles\s430s5mi.default-1343318037566\
FF - prefs.js: browser.startup.homepage - hxxp://www.stilescollection.com/
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-RunOnce-<NO NAME> - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre7\bin\jusched.exe
AddRemove-{79A765E1-C399-405B-85AF-466F52E918B0} - c:\program files\Ask.com\Updater\Updater.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-06-05 12:06
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Seagate-Replica-Service]
"ImagePath"="c:\program files\Seagate Replica\bin\Seagate-Replica-Service.exe /startedbyscm:FE2355B7-40E2EE35-RebitSvcModule"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'lsass.exe'(696)
c:\program files\Bonjour\mdnsNSP.dll
.
Completion time: 2013-06-05 12:11:19
ComboFix-quarantined-files.txt 2013-06-05 19:11
.
Pre-Run: 129,371,336,704 bytes free
Post-Run: 129,854,603,264 bytes free
.
- - End Of File - - 314940E766E538FA9710B6386FDE1EEC
June 5th, 2013, 05:56 PM
Broni

What happens when you try to start in normal mode?

You still have some McAfee leftovers.
Please run this tool to remove them: http://www.majorgeeks.com/files/deta...oval_tool.html
June 10th, 2013, 12:55 AM
rollie

What happens when I try to start in normal mode is the computer powers up, but all I have is a blank screen. I can move the mouse around and that's all.
I downloaded the removal tool from majorgeeks and tried to remove all of the McAfee files but the "McAfee Internet Security" failed to remove. It asked me if I wanted to run the virtual technician, but I'd have to pay. This log came up after running the removal tool:
I don't even know what any of this means...

MCAFEE CLEANUP
June 09, 2013 21:35:40
INFO Silent mode activated.
INFO Cleanup will be scheduled and run.
INFO Product MFP to be removed from system.
INFO Product APPSTATS to be removed from system.
INFO Product Auth to be removed from system.
INFO Product EMproxy to be removed from system.
INFO Product FWdiver to be removed from system.
INFO Product McSvcHost to be removed from system.
INFO Product HW to be removed from system.
INFO Product MAS to be removed from system.
INFO Product MAT to be removed from system.
INFO Product MBK to be removed from system.
INFO Product MCPR to be removed from system.
INFO Product McProxy to be removed from system.
INFO Product VUL to be removed from system.
INFO Product MHN to be removed from system.
INFO Product MNA to be removed from system.
INFO Product MOBK to be removed from system.
INFO Product MPFP to be removed from system.
INFO Product MPFPCU to be removed from system.
INFO Product MPS to be removed from system.
INFO Product SHRED to be removed from system.
INFO Product MPSCU to be removed from system.
INFO Product MQC to be removed from system.
INFO Product MQCCU to be removed from system.
INFO Product MSAD to be removed from system.
INFO Product MSHR to be removed from system.
INFO Product MSK to be removed from system.
INFO Product MSKCU to be removed from system.
June 10th, 2013, 01:00 AM
Broni
Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
- Double-click to run it. When the tool opens click Yes to disclaimer.
- Press Scan button.
- It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
- The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
June 10th, 2013, 01:59 AM
rollie

Tried to copy and paste the FRST.txt file, an error occurred saying I had 59,749 characters and needed to shorten it to 50,000 and the Addition.txt--I'm sorry but I don't know how to attach to the reply. Do you want the FRST.txt file split up between 2 posts? If you tell me how to attach a file to a post I can do that...
June 10th, 2013, 02:24 AM
rollie

2 Attachment(s)

I hope I did this right...

Attachment 11433 Attachment 11435
June 10th, 2013, 07:32 PM
Broni

Quote:

Do you want the FRST.txt file split up between 2 posts?

Exactly.
June 10th, 2013, 07:40 PM
rollie

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 09-06-2013
Ran by Janette (administrator) on 09-06-2013 22:38:06
Running from C:\Users\Janette\Downloads
Windows Vista (TM) Home Premium Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Safe Mode (with Networking)

==================== Processes (Whitelisted) ===================

(Lenovo Group Limited) C:\PROGRA~1\ThinkPad\UTILIT~1\PWMUIAux.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
(McAfee, Inc.) C:\Program Files\McAfee\MAT\McPvTray.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe [487424 2008-03-04] (Lenovo Group Limited)
HKLM\...\Run: [TpShocks] TpShocks.exe [x]
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1725736 2010-04-23] (Synaptics Incorporated)
HKLM\...\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe [1282048 2007-07-09] (Analog Devices, Inc.)
HKLM\...\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey [x]
HKLM\...\Run: [LPManager] C:\PROGRA~1\Lenovo\LENOVO~1\LPMGR.exe [124256 2007-07-13] (Lenovo Group Limited)
HKLM\...\Run: [IaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe [33304 2007-10-23] (Intel Corporation)
HKLM\...\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM\...\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe [256576 2009-12-01] (Lenovo Group Ltd.)
HKLM\...\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe [102400 2006-10-12] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [217176 2006-11-15] (Diskeeper Corporation)
HKLM\...\Run: [cssauth] "C:\Program Files\Lenovo\Client Security Solution\cssauth.exe" silent [2630968 2007-08-09] (Lenovo Group Limited)
HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-10-11] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe [124200 2007-07-05] (Lenovo)
HKLM\...\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe [419112 2007-07-05] (Lenovo)
HKLM\...\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [57344 2005-09-16] (Adobe Systems Incorporated)
HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)
HKLM\...\Runonce: [] [x]
HKLM\...\Runonce: [GrpConv] grpconv -o [x]
HKCU\...\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
Startup: C:\ProgramData\Start Menu\Programs\Startup\Digital Line Detect.lnk
ShortcutTarget: Digital Line Detect.lnk -> C:\Program Files\Digital Line Detect\DLG.exe (Avanquest Software )
Startup: C:\ProgramData\Start Menu\Programs\Startup\ExifLauncher2.lnk
ShortcutTarget: ExifLauncher2.lnk -> C:\Program Files\FinePixViewer\QuickDCF2.exe (FUJIFILM Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
HKLM SearchScopes: DefaultScope {56256A51-B582-467e-B8D4-7786EDA79AE0} URL =
SearchScopes: HKLM - {8EA3020D-938C-4106-9E80-31B3115264CE} URL = http://search.live.com/results.aspx?q={searchTerms}&entrypoint={referrer:source?}&FORM=LENIE
HKCU SearchScopes: DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={C96D4DF8-59CE-4206-B7C5-D03F29772532}&mid=28de95e7bab447d0bac8d157716ebc84-3d0a17156c5f9c0cb85bd1076241fe91f64e4dc1&lang=en&ds=ft011&pr=sa&d=2012-07-12 09:52:45&v=11.1.0.12&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {45DA25B3-EC74-4933-8E1F-4FF592449C30} URL = http://search.yahoo.com/search?fr=mcafee&p={SearchTerms}
SearchScopes: HKCU - {8EA3020D-938C-4106-9E80-31B3115264CE} URL = http://search.live.com/results.aspx?q={searchTerms}&entrypoint={referrer:source?}&FORM=LENIE
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={C96D4DF8-59CE-4206-B7C5-D03F29772532}&mid=28de95e7bab447d0bac8d157716ebc84-3d0a17156c5f9c0cb85bd1076241fe91f64e4dc1&lang=en&ds=ft011&pr=sa&d=2012-07-12 09:52:45&v=11.1.0.12&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = http://search.yahoo.com/search?fr=mcafee&p={searchTerms}
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: CPwmIEBrowserHelper Object - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [147456] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Janette\AppData\Roaming\Mozilla\Firefox\Profiles\61h3obro.default-1370213703050
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin: @java.com/DTPlugin,version=10.5.1 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/RhapsodyPlayerEngine,version=1.0 - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll (RealNetworks, Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\27.0.1453.94\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft\u00AE Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Windows Genuine Advantage) - C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll (Microsoft Corporation)
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (AmazonMP3DownloaderPlugin) - C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101752.dll (Amazon.com, Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U33) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll No File
CHR Plugin: (RealNetworks Rhapsody Player Engine) - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll (RealNetworks, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
CHR Plugin: (Java Deployment Toolkit 7.0.50.255) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (McAfee SecurityCenter) - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Docs) - C:\Users\Janette\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Janette\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Janette\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Janette\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (SiteAdvisor) - C:\Users\Janette\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.61.113.2_0
CHR Extension: (Gmail) - C:\Users\Janette\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

========================== Services (Whitelisted) =================

S2 0164701370839192mcinstcleanup; C:\Users\Janette\AppData\Local\Temp\016470~1.EXE [833616 2013-01-30] (McAfee, Inc.)
S2 AdobeActiveFileMonitor4.0; C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe [102400 2005-10-03] ()
S2 Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [116040 2008-09-10] (Apple Inc.)
S2 DDNIService; C:\Program Files\DDNI\DIBS\DDNIService.exe [166376 2008-04-07] (Digital Delivery Networks, Inc.)
S2 Diskeeper; C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe [634988 2006-11-15] (Diskeeper Corporation)
S2 LENOVO.MICMUTE; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [101736 2011-07-12] (Lenovo Group Limited)
S2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [127336 2011-07-12] (Lenovo Group Limited)
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation)
S2 MOBCleanup; C:\Users\Janette\AppData\Local\temp\MOBCleanup.exe [210272 2011-04-04] (McAfee, Inc.)
S3 MSSQL$MSSMLBIZ; c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S2 psqlWGE; C:\Program Files\Pervasive Software\PSQL\bin\w3dbsmgr.exe [435496 2009-04-06] (Pervasive Software Inc.)
S2 PwmEWSvc; C:\Program Files\ThinkPad\Utilities\PWMEWSVC.EXE [1665120 2012-05-16] (Lenovo Group Limited)
S2 Seagate-Replica-Service; C:\Program Files\Seagate Replica\bin\Seagate-Replica-Service.exe [1818624 2009-04-10] ()
S2 Seagate-Replica-SysMon; C:\Program Files\Seagate Replica\bin\Seagate-Replica-SysMon.exe [78288 2009-04-10] ()
S2 SUService; c:\program files\lenovo\system update\suservice.exe [28672 2011-07-26] (Lenovo Group Limited)
S2 TPHKLOAD; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [131432 2011-07-12] (Lenovo Group Limited)
S2 TSSCoreService; C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe [722232 2007-08-09] (IBM)
S2 TVT Backup Protection Service; C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe [569344 2007-01-08] ()
S2 TVT Scheduler; c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe [1122304 2008-04-06] (Lenovo Group Limited)
S3 GameConsoleService;
S2 helpsvc; %WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll [x]
S4 mfefire; "C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe" [x]
S2 mfevtp; "C:\Windows\system32\mfevtps.exe" [x]
S2 MOBKbackup; "C:\Program Files\McAfee Online Backup\MOBKbackup.exe" [x]

==================== Drivers (Whitelisted) ====================

S3 Eplpdx02; C:\Windows\system32\Drivers\EPLPDX02.SYS [70084 2001-08-09] (MK Systems CO., LTD.)
R3 LenovoRd; C:\Windows\System32\Drivers\LenovoRd.sys [81280 2007-06-07] (Lenovo)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [21104 2012-12-14] (Malwarebytes Corporation)
S3 mferkdk; C:\Windows\System32\drivers\mferkdk.sys [34248 2009-09-16] (McAfee, Inc.)
S3 mfesmfk; C:\Windows\System32\drivers\mfesmfk.sys [40552 2009-09-16] (McAfee, Inc.)
S1 MOBKFilter; C:\Windows\System32\DRIVERS\MOBK.sys [54776 2010-04-13] (Mozy, Inc.)
R3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
U3 TrueSight; c:\windows\system32\drivers\TrueSight.sys [14080 2012-07-12] ()
S3 TvtDrv; C:\Program Files\Common Files\Lenovo\InvAgent\TvtDrv.sys [3712 2007-01-08] ()
S4 blbdrive; No ImagePath
S3 catchme; \??\C:\Users\Janette\AppData\Local\Temp\catchme.sys [x]
S0 cfwids; system32\drivers\cfwids.sys [x]
S3 IpInIp; No ImagePath
S2 MCSTRM; No ImagePath
S0 mfeapfk; system32\drivers\mfeapfk.sys [x]
S0 mfeavfk; system32\drivers\mfeavfk.sys [x]
S0 mfebopk; system32\drivers\mfebopk.sys [x]
S0 mfefirek; system32\drivers\mfefirek.sys [x]
R0 mfehidk; system32\drivers\mfehidk.sys [x]
R1 mfewfpk; system32\drivers\mfewfpk.sys [x]
S3 NwlnkFlt; No ImagePath
S3 NwlnkFwd; No ImagePath
S3 UIUSys; No ImagePath

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-06-09 22:37 - 2013-06-09 22:37 - 01358931 ____A (Farbar) C:\Users\Janette\Downloads\FRST.exe
2013-06-09 21:35 - 2013-06-09 22:32 - 00000686 ____A C:\Windows\Tasks\McAfee Cleanup.job
2013-06-09 21:34 - 2013-06-09 21:34 - 03191888 ____A (McAfee, Inc.) C:\Users\Janette\Downloads\MCPR.exe
2013-06-09 21:21 - 2013-06-09 21:21 - 00000000 ____D C:\F
2013-06-09 21:20 - 2013-06-09 21:20 - 00000064 ____A C:\Windows\System32\TPAPSLOG.LOG
2013-06-05 12:11 - 2013-06-05 12:11 - 00049935 ____A C:\ComboFix.txt
2013-06-05 11:58 - 2011-06-25 23:45 - 00256000 ____A C:\Windows\PEV.exe
2013-06-05 11:58 - 2010-11-07 10:20 - 00208896 ____A C:\Windows\MBR.exe
2013-06-05 11:58 - 2009-04-19 21:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-06-05 11:58 - 2000-08-30 17:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-06-05 11:58 - 2000-08-30 17:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-06-05 11:58 - 2000-08-30 17:00 - 00098816 ____A C:\Windows\sed.exe
2013-06-05 11:58 - 2000-08-30 17:00 - 00080412 ____A C:\Windows\grep.exe
2013-06-05 11:58 - 2000-08-30 17:00 - 00068096 ____A C:\Windows\zip.exe
2013-06-05 11:42 - 2013-06-05 11:57 - 00001257 ____A C:\Users\Janette\Desktop\usersJanettedownloadsComboFix.exe - Shortcut.lnk
2013-06-05 10:14 - 2013-06-05 10:14 - 00000000 ____D C:\E
2013-06-05 09:23 - 2013-06-05 12:11 - 00000000 ____D C:\Qoobox
2013-06-05 09:22 - 2013-06-05 11:57 - 05077652 ____R (Swearware) C:\Users\Janette\Downloads\ComboFix.exe
2013-06-05 07:12 - 2013-06-05 07:12 - 00000000 ____D C:\D
2013-06-05 05:12 - 2013-06-05 05:12 - 00000116 ____A C:\tvttemp.txt
2013-06-05 05:11 - 2013-06-09 22:38 - 00000000 ____D C:\users\Administrator
2013-06-05 05:11 - 2013-06-05 05:11 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Lenovo
2013-06-04 19:51 - 2013-06-04 19:51 - 00000000 ____D C:\Users\Janette\Documents\mbar-1.06.0.1003
2013-06-04 18:42 - 2013-06-04 18:42 - 02708759 ____A C:\Users\Janette\Desktop\debug.log
2013-06-04 18:19 - 2013-06-04 19:41 - 00000000 ____D C:\Users\Janette\Desktop\RK_Quarantine
2013-06-04 08:04 - 2013-06-04 08:05 - 00017139 ____A C:\Users\Janette\Desktop\dds.txt
2013-06-04 08:04 - 2013-06-04 08:05 - 00013829 ____A C:\Users\Janette\Desktop\attach.txt
2013-06-03 15:27 - 2013-06-03 15:27 - 00000000 ____D C:\ProgramData\AVAST Software
2013-06-03 15:27 - 2013-06-03 15:27 - 00000000 ____D C:\Program Files\AVAST Software
2013-05-31 19:20 - 2013-06-04 08:57 - 00109056 ____A C:\Users\Janette\Documents\8.5x11 blank template.pub
2013-05-24 20:20 - 2013-06-05 01:03 - 00000000 ____D C:\Users\Janette\Documents\Tacoma film Festival
2013-05-24 20:20 - 2013-06-05 01:03 - 00000000 ____D C:\Users\Janette\Documents\Cartoons
2013-05-15 03:16 - 2013-05-05 12:25 - 12324864 ____N (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-15 03:16 - 2013-05-05 12:12 - 02382848 ____N (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-15 03:02 - 2013-04-04 14:57 - 00420864 ____N (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-05-15 03:02 - 2013-04-04 14:54 - 00073216 ____N (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-05-15 03:01 - 2013-04-04 15:11 - 01800704 ____N (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-15 03:01 - 2013-04-04 15:09 - 09738752 ____N (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-15 03:01 - 2013-04-04 15:02 - 01427968 ____N (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-05-15 03:01 - 2013-04-04 15:02 - 01129472 ____N (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-15 03:01 - 2013-04-04 15:02 - 01104384 ____N (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-15 03:01 - 2013-04-04 15:01 - 00231936 ____N (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-15 03:01 - 2013-04-04 14:59 - 00065024 ____N (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-15 03:01 - 2013-04-04 14:58 - 00717824 ____N (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-15 03:01 - 2013-04-04 14:58 - 00142848 ____N (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-05-15 03:01 - 2013-04-04 14:56 - 00607744 ____N (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-15 03:01 - 2013-04-04 14:55 - 01796096 ____N (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-15 03:01 - 2013-04-04 14:50 - 00176640 ____N (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-15 01:25 - 2013-04-15 07:20 - 00638328 ____N (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-15 01:25 - 2013-04-13 03:56 - 00037376 ____N (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-05-15 01:24 - 2013-04-08 18:36 - 02049024 ____N (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-14 16:37 - 2013-05-14 17:57 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-05-13 09:24 - 2013-05-13 09:24 - 03097600 ____N C:\Users\Janette\Documents\Out of the stall frame comp.pub
2013-05-11 14:42 - 2013-05-11 14:42 - 00235080 ____N (Big Fish Games) C:\Users\Janette\Downloads\bigfishgames_p30278468_s1_l1(6).exe

==================== One Month Modified Files and Folders ========

2013-06-09 22:38 - 2013-06-05 05:11 - 00000000 ____D C:\users\Administrator
2013-06-09 22:37 - 2013-06-09 22:37 - 01358931 ____A (Farbar) C:\Users\Janette\Downloads\FRST.exe
2013-06-09 22:32 - 2013-06-09 21:35 - 00000686 ____A C:\Windows\Tasks\McAfee Cleanup.job
2013-06-09 22:19 - 2011-12-10 10:44 - 00000000 ____D C:\Program Files\McAfee Online Backup
2013-06-09 22:17 - 2013-04-23 16:00 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-09 22:15 - 2008-02-05 15:34 - 00000000 ____D C:\Program Files\McAfee
2013-06-09 21:39 - 2008-02-05 15:34 - 00000000 ____D C:\Program Files\Common Files\McAfee
2013-06-09 21:35 - 2006-11-02 06:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-09 21:34 - 2013-06-09 21:34 - 03191888 ____A (McAfee, Inc.) C:\Users\Janette\Downloads\MCPR.exe
2013-06-09 21:25 - 2008-02-05 10:40 - 00002032 ____A C:\Users\Janette\AppData\Local\d3d9caps.dat
2013-06-09 21:21 - 2013-06-09 21:21 - 00000000 ____D C:\F
2013-06-09 21:20 - 2013-06-09 21:20 - 00000064 ____A C:\Windows\System32\TPAPSLOG.LOG
2013-06-09 21:20 - 2012-02-09 14:09 - 00096026 ____A C:\Windows\PFRO.log
2013-06-09 21:20 - 2006-11-02 05:47 - 00003696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-09 21:20 - 2006-11-02 05:47 - 00003696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-05 12:11 - 2013-06-05 12:11 - 00049935 ____A C:\ComboFix.txt
2013-06-05 12:11 - 2013-06-05 09:23 - 00000000 ____D C:\Qoobox
2013-06-05 11:59 - 2006-11-02 04:18 - 00000000 ___RD C:\users\Public
2013-06-05 11:57 - 2013-06-05 11:42 - 00001257 ____A C:\Users\Janette\Desktop\usersJanettedownloadsComboFix.exe - Shortcut.lnk
2013-06-05 11:57 - 2013-06-05 09:22 - 05077652 ____R (Swearware) C:\Users\Janette\Downloads\ComboFix.exe
2013-06-05 10:45 - 2008-02-01 02:31 - 00000000 ____D C:\SWSHARE
2013-06-05 10:33 - 2006-11-02 03:33 - 00841748 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-05 10:14 - 2013-06-05 10:14 - 00000000 ____D C:\E
2013-06-05 07:12 - 2013-06-05 07:12 - 00000000 ____D C:\D
2013-06-05 05:15 - 2006-11-02 05:47 - 03882520 ____A C:\Windows\System32\FNTCACHE.DAT
2013-06-05 05:12 - 2013-06-05 05:12 - 00000116 ____A C:\tvttemp.txt
2013-06-05 05:11 - 2013-06-05 05:11 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Lenovo
2013-06-05 05:06 - 2006-11-02 05:37 - 00000000 ____D C:\Windows\System32\XPSViewer
2013-06-05 05:06 - 2006-11-02 05:37 - 00000000 ____D C:\Windows\System32\restore
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\tapi
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\zh-TW
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\zh-HK
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\zh-CN
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\uk-UA
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\tr-TR
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\th-TH
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\sv-SE
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\sr-Latn-CS
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\SLUI
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\sl-SI
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\sk-SK
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\ru-RU
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\ras
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\pt-PT
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\pt-BR
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\pl-PL
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\nl-NL
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\nb-NO
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\Msdtc
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\lv-LV
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\lt-LT
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\ko-KR
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\ja-JP
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\it-IT
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\icsxml
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\hu-HU
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\hr-HR
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\he-IL
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\fr-FR
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\fi-FI
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\et-EE
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\el-GR
2013-06-05 05:04 - 2008-02-01 02:43 - 00000000 ____D C:\Windows\System32\DLA
2013-06-05 05:04 - 2008-02-01 02:34 - 00000000 ___HD C:\Windows\System32\(null)
2013-06-05 05:04 - 2006-11-02 05:37 - 00000000 ____D C:\Windows\ShellNew
2013-06-05 05:04 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-05 05:04 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\com
2013-06-05 05:04 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\bg-BG
2013-06-05 05:04 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\ar-SA
2013-06-05 05:03 - 2006-11-09 18:04 - 00000000 ____D C:\Windows\Panther
2013-06-05 05:03 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\registration
2013-06-05 05:03 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\MSAgent
2013-06-05 05:03 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\L2Schemas
2013-06-05 05:03 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\Help
2013-06-05 05:02 - 2008-02-05 13:56 - 00000000 ___HD C:\Users\Janette\Documents\Stiles Collection Misc. Forms and Business Cards
2013-06-05 05:02 - 2008-02-05 12:16 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Thunderbird
2013-06-05 05:02 - 2008-02-05 10:40 - 00000000 ____D C:\users\Janette
2013-06-05 05:02 - 2008-02-01 01:28 - 00000000 ____D C:\WAUUPGRD
2013-06-05 05:02 - 2006-11-09 12:54 - 00000000 ____D C:\SWTOOLS
2013-06-05 05:02 - 2006-11-02 04:18 - 00000000 __RHD C:\users\Default
2013-06-05 05:02 - 2006-11-02 04:18 - 00000000 ____D
June 10th, 2013, 07:43 PM
rollie

2013-06-05 05:02 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\Cursors
2013-06-05 05:01 - 2008-02-06 12:39 - 00000000 ___HD C:\ProgramData\SiteAdvisor
2013-06-05 05:01 - 2008-02-01 03:26 - 00000000 ____D C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
2013-06-05 05:01 - 2008-02-01 03:20 - 00000000 ____D C:\Program Files\Sonic Icons for Lenovo
2013-06-05 05:01 - 2008-02-01 02:42 - 00000000 ___HD C:\ProgramData\Sonic
2013-06-05 05:01 - 2008-02-01 02:42 - 00000000 ____D C:\Program Files\Roxio
2013-06-05 05:01 - 2006-11-02 05:37 - 00000000 ____D C:\Program Files\Windows Defender
2013-06-05 05:00 - 2008-02-06 12:10 - 00000000 ____D C:\Program Files\Microsoft CAPICOM 2.1.0.2
2013-06-05 05:00 - 2008-02-01 03:24 - 00000000 ____D C:\Program Files\Microsoft Works
2013-06-05 05:00 - 2008-02-01 02:43 - 00000000 ____D C:\Program Files\Common Files\SureThing Shared
2013-06-05 05:00 - 2008-02-01 02:42 - 00000000 ____D C:\Program Files\Common Files\Sonic Shared
2013-06-05 05:00 - 2008-02-01 02:23 - 00000000 ____D C:\Program Files\Common Files\snp2uvc
2013-06-05 05:00 - 2008-02-01 02:19 - 00000000 ____D C:\Program Files\Digital Line Detect
2013-06-05 05:00 - 2008-02-01 02:14 - 00000000 ____D C:\Program Files\Lenovo
2013-06-05 05:00 - 2006-11-02 04:18 - 00000000 ____D C:\Program Files\Common Files\Services
2013-06-05 04:59 - 2008-02-01 03:24 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2013-06-05 04:59 - 2008-02-01 02:42 - 00000000 ____D C:\Program Files\Common Files\PX Storage Engine
2013-06-05 04:59 - 2008-02-01 02:34 - 00000000 ____D C:\Program Files\Common Files\Lenovo
2013-06-05 04:43 - 2009-07-09 13:57 - 00000000 ____D C:\Windows\System32\vi-VN
2013-06-05 04:43 - 2009-07-09 13:57 - 00000000 ____D C:\Windows\System32\eu-ES
2013-06-05 04:43 - 2009-07-09 13:29 - 00000000 ____D C:\Windows\System32\EventProviders
2013-06-05 04:43 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\ro-RO
2013-06-05 04:43 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\ias
2013-06-05 04:42 - 2012-07-11 10:45 - 00000000 ____D C:\Windows\System32\config\RCCBakup
2013-06-05 04:42 - 2006-11-02 04:18 - 00000000 ___HD C:\Windows\System32\config\Journal
2013-06-05 04:41 - 2012-07-10 15:26 - 00000000 ____D C:\Windows\pss
2013-06-05 04:41 - 2011-06-17 20:11 - 00000000 ____D C:\Windows\PeachInst
2013-06-05 04:41 - 2009-10-15 09:15 - 00000000 ____D C:\Windows\SQL9_KB970892_ENU
2013-06-05 04:41 - 2009-07-09 13:57 - 00000000 ____D C:\Windows\System32\ca-ES
2013-06-05 04:41 - 2009-02-12 08:41 - 00000000 ____D C:\Windows\SQL9_KB960089_ENU
2013-06-05 04:41 - 2008-07-09 03:01 - 00000000 ____D C:\Windows\SQL9_KB948109_ENU
2013-06-05 04:41 - 2006-11-02 04:18 - 00000000 ___RD C:\Windows\Offline Web Pages
2013-06-05 04:41 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\AdvancedInstallers
2013-06-05 04:41 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\rescache
2013-06-05 04:41 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-06-05 04:34 - 2010-06-24 19:16 - 00000000 ____D C:\Windows\hpoj6000e609
2013-06-05 04:34 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\IME
2013-06-05 04:33 - 2006-11-02 05:37 - 00000000 ____D C:\Windows\DigitalLocker
2013-06-05 04:29 - 2008-09-12 13:26 - 00000000 ____D C:\Users\Janette\{f606a019-4024-4ff7-8989-d0a2c7e4ed9f}
2013-06-05 04:29 - 2006-11-02 05:37 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-06-05 04:25 - 2012-07-19 09:10 - 00000000 ___HD C:\Users\Janette\Downloads\Rebit
2013-06-05 04:25 - 2011-03-01 09:07 - 00000000 ___HD C:\Users\Janette\Downloads\__MACOSX
2013-06-05 04:24 - 2013-04-10 12:56 - 00000000 ____D C:\Users\Janette\Documents\Out of the stall comps and stuff
2013-06-05 04:24 - 2013-03-21 13:21 - 00000000 ____D C:\Users\Janette\Documents\Ocean Shores entries
2013-06-05 04:24 - 2013-03-03 09:56 - 00000000 ____D C:\Users\Janette\Documents\Puyallup Fair projects
2013-06-05 04:24 - 2013-02-11 20:00 - 00000000 ____D C:\Users\Janette\Documents\Neighborhood Crap
2013-06-05 04:24 - 2013-01-20 12:17 - 00000000 ____D C:\Users\Janette\Documents\Rollie Photos only used in video January 2013
2013-06-05 04:24 - 2013-01-15 19:32 - 00000000 ____D C:\Users\Janette\Documents\Rollie
2013-06-05 04:24 - 2013-01-11 21:34 - 00000000 ____D C:\Users\Janette\Documents\Proctor Arts Fest 2013
2013-06-05 04:24 - 2012-12-08 16:17 - 00000000 ____D C:\Users\Janette\Documents\TAC Awards Projects
2013-06-05 04:24 - 2010-05-24 19:00 - 00000000 ___HD C:\Users\Janette\Documents\Stiles, Phyllis info and legal
2013-06-05 04:24 - 2009-02-05 15:40 - 00000000 ___HD C:\Users\Janette\Documents\Rollie's Radios
2013-06-05 04:24 - 2008-02-10 13:48 - 00000000 ___RD C:\Users\Janette\Documents\Stiles Collection Catalog of Art
2013-06-05 04:24 - 2008-02-09 14:32 - 00000000 ___HD C:\Users\Janette\Documents\Stiles Collection Work Sheets
2013-06-05 04:24 - 2008-02-09 14:31 - 00000000 ___HD C:\Users\Janette\Documents\Stiles Collection Paintings 2013
2013-06-05 04:23 - 2013-01-30 12:09 - 00000000 ____D C:\Users\Janette\Documents\Artwork New in 2013
2013-06-05 04:23 - 2013-01-10 15:09 - 00000000 ____D C:\Users\Janette\Documents\Light painting photos coverted
2013-06-05 04:23 - 2013-01-07 20:36 - 00000000 ____D C:\Users\Janette\Documents\Mandala project 2013
2013-06-05 04:23 - 2012-11-21 12:58 - 00000000 ____D C:\Users\Janette\Documents\Artwork for GLOBAL COLORS Video
2013-06-05 04:23 - 2012-11-04 11:42 - 00000000 ____D C:\Users\Janette\Documents\Facebook
2013-06-05 04:23 - 2012-08-03 20:07 - 00000000 ____D C:\Users\Janette\Documents\Joe's e-mails
2013-06-05 04:23 - 2011-12-13 14:17 - 00000000 ___HD C:\Users\Janette\Documents\BookSmartData
2013-06-05 04:23 - 2010-12-29 12:12 - 00000000 ___HD C:\Users\Janette\Documents\HCG info
2013-06-05 04:23 - 2010-10-08 15:52 - 00000000 ____D C:\Users\Janette\Documents\Joe Misc and Medical
2013-06-05 04:23 - 2009-07-08 15:50 - 00000000 ___HD C:\Users\Janette\Documents\Janette Correspondence and self portraits
2013-06-05 04:22 - 2013-04-23 15:52 - 00000000 ____D C:\Users\Janette\Documents\Art Show Photos
2013-06-05 04:22 - 2012-07-18 12:35 - 00000000 ____D C:\Users\Janette\Documents\Artists Resume and Statement
2013-06-05 04:22 - 2009-05-21 10:11 - 00000000 ___HD C:\Users\Janette\Documents\Anne Bray Correspondence
2013-06-05 04:21 - 2012-07-12 21:22 - 00000000 ____D C:\Users\Janette\AppData\Roaming\PwrMgr
2013-06-05 04:21 - 2011-10-22 18:41 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\PeaceCraft2
2013-06-05 04:21 - 2011-10-22 17:36 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Peace Craft
2013-06-05 04:21 - 2011-10-03 20:28 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Realore_Whiterra Roads Of Rome 3
2013-06-05 04:21 - 2011-06-13 10:10 - 00000000 ____D C:\Users\Janette\Citrix
2013-06-05 04:21 - 2010-12-21 21:32 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Realore_Whiterra Roads Of Rome 2
2013-06-05 04:21 - 2010-11-06 17:31 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Realore_Whiterra Roads Of Rome
2013-06-05 04:21 - 2009-06-16 20:03 - 00000000 ____D C:\Users\Janette\AppData\Roaming\SystemRequirementsLab
2013-06-05 04:21 - 2008-12-20 12:37 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Real
2013-06-05 04:21 - 2008-12-01 15:31 - 00000000 ___HD C:\Users\Janette\Documents\Address Labels
2013-06-05 04:21 - 2008-06-06 19:31 - 00000000 ____D C:\Users\Janette\AppData\Roaming\SpinTop
2013-06-05 04:16 - 2012-07-21 14:39 - 00000000 ____D C:\Users\Janette\AppData\Roaming\DriverCure
2013-06-05 04:16 - 2010-09-05 15:02 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Enlightenus2SE_BFG
2013-06-05 04:16 - 2010-07-02 09:35 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\HpUpdate
2013-06-05 04:16 - 2010-01-17 19:09 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Enlightenus
2013-06-05 04:16 - 2009-12-30 20:46 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\GhostFleet
2013-06-05 04:16 - 2009-03-15 19:04 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Lost in the City
2013-06-05 04:16 - 2009-02-15 21:47 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Coyotes Tale
2013-06-05 04:16 - 2009-01-18 19:19 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Ancient Quest of Saqqarah__bfg
2013-06-05 04:16 - 2008-08-03 19:30 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\ForgottenRiddles2
2013-06-05 04:16 - 2008-06-15 18:30 - 00000000 ____D C:\Users\Janette\AppData\Roaming\GameHouse
2013-06-05 04:16 - 2008-02-09 14:44 - 00000000 ____D C:\Users\Janette\AppData\Roaming\FUJIFILM
2013-06-05 04:14 - 2008-02-05 10:45 - 00000000 ___HD C:\Users\Janette\AppData\Local\Roxio
2013-06-05 04:13 - 2011-12-13 14:17 - 00000000 ____D C:\Users\Janette\.blurb
2013-06-05 04:13 - 2011-05-23 13:48 - 00000000 ___HD C:\Users\Janette\AppData\Local\Help
2013-06-05 04:13 - 2010-03-26 15:54 - 00000000 ___HD C:\Users\Janette\AppData\Local\Brain Games Mahjongg Files
2013-06-05 04:13 - 2008-11-14 22:28 - 00000000 ___HD C:\Users\Janette\AppData\Local\Game Mill Files
2013-06-05 04:13 - 2008-02-16 13:12 - 00000000 ____D C:\Users\Janette\AppData\Local\Microsoft Help
2013-06-05 04:10 - 2011-09-04 12:05 - 00000000 ___HD C:\ProgramData\regid.1986-12.com.adobe
2013-06-05 04:10 - 2010-06-24 19:20 - 00000000 ___HD C:\ProgramData\WEBREG
2013-06-05 04:10 - 2009-12-27 14:00 - 00000000 ___HD C:\ProgramData\The Mirror Mysteries
2013-06-05 04:10 - 2009-06-20 13:08 - 00000000 __HDC C:\ProgramData\{66E2F539-12B6-4870-A500-7689CDE75C5E}
2013-06-05 04:10 - 2008-02-09 13:31 - 00000000 ___HD C:\ProgramData\QuickTime
2013-06-05 04:09 - 2009-02-10 16:01 - 00000000 ___HD C:\ProgramData\MysteryChronicles
2013-06-05 04:09 - 2008-07-30 15:48 - 00000000 ___HD C:\ProgramData\MonteCristo
2013-06-05 04:09 - 2008-06-15 18:43 - 00000000 ____D C:\ProgramData\n7-89-o9-3r-4t-r9
2013-06-05 04:09 - 2008-02-01 03:22 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-05 04:08 - 2008-02-05 11:09 - 00000000 ____D C:\ProgramData\McAfee
2013-06-05 04:07 - 2010-07-02 09:33 - 00000000 ____D C:\ProgramData\HP Product Assistant
2013-06-05 04:07 - 2009-06-20 13:03 - 00000000 ___HD C:\ProgramData\DriverScanner
2013-06-05 04:07 - 2008-07-27 18:43 - 00000000 ___HD C:\ProgramData\Arcade Lab
2013-06-05 04:06 - 2012-07-31 21:06 - 00000000 ____D C:\Program Files\Seagate Replica
2013-06-05 04:06 - 2009-10-31 03:09 - 00000000 ____D C:\Program Files\Windows Portable Devices
2013-06-05 04:06 - 2009-06-16 20:04 - 00000000 ____D C:\Program Files\SystemRequirementsLab
2013-06-05 04:06 - 2008-02-05 10:40 - 00000000 ____D C:\Program Files\Windows Live Toolbar
2013-06-05 04:06 - 2006-11-02 05:37 - 00000000 ____D C:\Program Files\Windows Calendar
2013-06-05 04:05 - 2013-04-18 20:52 - 00000000 ____D C:\Program Files\QuickTime
2013-06-05 04:05 - 2008-12-20 12:37 - 00000000 ____D C:\Program Files\Rhapsody
2013-06-05 04:04 - 2013-04-12 09:59 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-06-05 04:03 - 2006-11-02 05:42 - 00000000 ____D C:\Windows\WindowsMobile
2013-06-05 04:02 - 2012-07-11 14:36 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-05 04:02 - 2011-02-24 04:03 - 00000000 ____D C:\Windows\System32\WindowsPowerShell
2013-06-05 04:02 - 2006-11-02 05:42 - 00000000 ____D C:\Windows\System32\winrm
2013-06-05 04:02 - 2006-11-02 05:42 - 00000000 ____D C:\Windows\System32\WCN
2013-06-05 04:02 - 2006-11-02 04:18 - 00000000 ___HD C:\Windows\System32\winevt
2013-06-05 04:02 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\Web
2013-06-05 04:01 - 2006-11-02 05:42 - 00000000 ____D C:\Windows\System32\slmgr
2013-06-05 04:01 - 2006-11-02 05:42 - 00000000 ____D C:\Windows\System32\Printing_Admin_Scripts
2013-06-05 04:01 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\SMI
2013-06-05 04:01 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\RemInst
2013-06-05 04:00 - 2008-02-01 02:27 - 00000000 ____D C:\Windows\System32\Lang
2013-06-05 04:00 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\networklist
2013-06-05 04:00 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\MUI
2013-06-05 04:00 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\LogFiles
2013-06-05 04:00 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\licensing
2013-06-05 03:59 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\IME
2013-06-05 03:58 - 2012-07-14 15:41 - 00000000 ____D C:\Program Files\Free Download Manager
2013-06-05 03:58 - 2011-02-23 19:34 - 00000000 ____D C:\Program Files\FinePixViewer
2013-06-05 03:58 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\DriverStore
2013-06-05 03:57 - 2012-11-14 15:02 - 00000000 ____D C:\Program Files\ConvertHelper
2013-06-05 03:57 - 2011-06-17 21:03 - 00000000 ____D C:\Program Files\Common Files\Peach
2013-06-05 03:56 - 2011-09-04 11:05 - 00000000 ____D C:\Program Files\Common Files\Adobe AIR
2013-06-05 03:54 - 2012-03-26 19:02 - 00000000 ____D C:\Program Files\Adobe Download Assistant
2013-06-05 03:54 - 2012-02-14 16:14 - 00000000 ____D C:\Program Files\Bonjour
2013-06-05 03:52 - 2012-07-12 21:14 - 00000000 ____D C:\FRST
2013-06-05 03:52 - 2008-02-08 16:55 - 00000000 ____D C:\EPSONREG
2013-06-05 03:52 - 2008-02-01 02:35 - 00000000 ____D C:\Icons
2013-06-05 03:50 - 2006-11-02 04:18 - 00000000 ___HD C:\Windows\System32\wfp
2013-06-05 03:50 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\spool
2013-06-05 03:48 - 2012-07-21 12:33 - 00000000 ____D C:\Windows\Sun
2013-06-05 03:48 - 2008-07-11 13:06 - 00000000 ____D C:\Windows\System32\Adobe
2013-06-05 03:48 - 2006-11-02 05:42 - 00000000 ___HD C:\Windows\System32\Branding
2013-06-05 03:43 - 2008-02-01 03:24 - 00000000 ____D C:\Windows\PCHEALTH
2013-06-05 03:43 - 2006-11-02 05:37 - 00000000 ____D C:\Windows\Performance
2013-06-05 03:43 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\security
2013-06-05 03:43 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\schemas
2013-06-05 03:43 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\Resources
2013-06-05 03:43 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\Provisioning
2013-06-05 03:43 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\PLA
2013-06-05 03:43 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\nap
2013-06-05 03:41 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\LiveKernelReports
2013-06-05 03:39 - 2010-07-02 09:35 - 00000000 ____D C:\Windows\Hewlett-Packard
2013-06-05 03:38 - 2008-02-01 02:58 - 00000000 ____D C:\Windows\Downloaded Installations
2013-06-05 03:38 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\Branding
2013-06-05 03:37 - 2012-07-25 09:25 - 00000000 ____D C:\Users\Janette\Yahoo SiteBuilder
2013-06-05 03:37 - 2012-04-03 20:20 - 00000000 ____D C:\Users\Public\Documents\Downloaded Installers
2013-06-05 03:37 - 2010-01-18 20:59 - 00000000 ___HD C:\Users\Public\Documents\bigfish
2013-06-05 03:37 - 2009-05-16 15:02 - 00000000 ___HD C:\Users\Public\Documents\Slapdash Games
2013-06-05 03:35 - 2012-07-25 09:12 - 00000000 ____D C:\Users\Janette\sitebuilder
2013-06-05 03:35 - 2012-04-13 16:56 - 00000000 ___HD C:\Users\Janette\Downloads\Driver Tool
2013-06-05 03:34 - 2012-07-21 14:39 - 00000000 ____D C:\Users\Janette\AppData\Roaming\SpeedyPC Software
2013-06-05 03:34 - 2011-12-28 16:23 - 00000000 ___HD C:\Users\Janette\Documents\Amazon MP3
2013-06-05 03:34 - 2011-10-22 19:56 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\YoudaGames
2013-06-05 03:34 - 2011-09-04 12:11 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\PDAppFlex
2013-06-05 03:34 - 2011-06-19 19:27 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\WendigoStudios
2013-06-05 03:34 - 2011-06-17 21:13 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Peachtree
2013-06-05 03:34 - 2011-05-16 12:48 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\POV-Ray
2013-06-05 03:34 - 2010-09-16 14:04 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Vogat Interactive
2013-06-05 03:34 - 2010-07-31 16:16 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Vast Studios
2013-06-05 03:34 - 2010-06-18 07:12 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Update
2013-06-05 03:34 - 2010-01-29 19:44 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\SevenSails
2013-06-05 03:34 - 2010-01-01 12:56 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Skunk Studios
2013-06-05 03:34 - 2009-12-22 16:44 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Scholastic
2013-06-05 03:34 - 2009-06-20 13:03 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Uniblue
2013-06-05 03:34 - 2009-02-28 19:17 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\SerpentOfIsis
2013-06-05 03:34 - 2008-06-23 20:44 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\WildTangent
2013-06-05 03:34 - 2008-06-23 19:24 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\VeniceMysteryData
2013-06-05 03:34 - 2008-06-07 11:53 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\PlayFirst
2013-06-05 03:34 - 2008-02-05 12:07 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Talkback
2013-06-05 03:33 - 2012-04-15 10:38 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\PCDr
2013-06-05 03:33 - 2009-11-30 19:45 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Orneon
2013-06-05 03:33 - 2009-11-20 16:29 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\MysteryStudio
2013-06-05 03:33 - 2009-06-22 18:18 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\NCH Swift Sound
2013-06-05 03:05 - 2010-12-03 23:47 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\FastStone
2013-06-05 03:05 - 2010-09-18 12:13 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Freeze Tag
2013-06-05 03:05 - 2010-01-20 11:40 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Flood Light Games
2013-06-05 03:05 - 2009-10-11 17:49 - 00000000 ____D C:\Users\Janette\AppData\Roaming\ERS G-Studio
2013-06-05 03:05 - 2009-01-18 15:18 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Meridian93
2013-06-05 03:05 - 2008-11-22 20:12 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\iWinArcade
2013-06-05 03:05 - 2008-11-05 13:40 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\InterVideo
2013-06-05 03:05 - 2008-08-30 14:36 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Google
2013-06-05 03:05 - 2008-06-17 19:33 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\iWin
2013-06-05 03:05 - 2008-02-23 12:04 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Macromedia
2013-06-05 03:05 - 2008-02-08 17:08 - 00000000 ____D C:\Users\Janette\AppData\Roaming\EPSON
2013-06-05 03:05 - 2008-02-08 16:49 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\InstallShield
2013-06-05 03:05 - 2008-02-05 12:39 - 00000000 ____D C:\Users\Janette\AppData\Roaming\McAfee
2013-06-05 03:05 - 2008-02-05 11:16 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Leadertech
2013-06-05 03:05 - 2008-02-05 10:45 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Lenovo
2013-06-05 03:04 - 2012-12-02 18:05 - 00000000 ____D C:\Users\Janette\AppData\Local\Xenocode
2013-06-05 03:04 - 2012-02-09 16:08 - 00000000 ____D C:\Users\Janette\AppData\Local\VS Revo Group
2013-06-05 03:04 - 2011-09-04 14:31 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2013-06-05 03:04 - 2011-09-04 11:06 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
2013-06-05 03:04 - 2011-06-19 19:18 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Elephant Games
2013-06-05 03:04 - 2010-10-09 15:11 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Artifex Mundi
2013-06-05 03:04 - 2010-03-19 18:21 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\AzuazGames
2013-06-05 03:04 - 2010-01-26 20:12 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\BigFishGames
2013-06-05 03:04 - 2009-10-17 16:09 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Awem
2013-06-05 03:04 - 2009-07-01 14:08 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Downloaded Installations
2013-06-05 03:04 - 2009-06-22 16:03 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Amazon
2013-06-05 03:04 - 2009-02-14 10:26 - 00000000 ____D C:\Users\Janette\AppData\Roaming\CatmoonGames
2013-06-05 03:04 - 2008-10-09 09:32 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Canneverbe_Limited
2013-06-05 03:04 - 2008-09-13 12:34 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Apple Computer
2013-06-05 03:04 - 2008-08-12 12:21 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Big Fish Games
2013-06-05 03:04 - 2008-06-18 19:02 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\AlwaysNeat
2013-06-05 03:04 - 2008-06-14 12:56 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\cerasus.media
2013-06-05 03:04 - 2008-02-05 10:45 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Adobe
2013-06-05 03:04 - 2008-02-05 10:40 - 00000000 ____D C:\Users\Janette\AppData\Local\VirtualStore
2013-06-05 03:03 - 2008-02-05 12:16 - 00000000 ___HD C:\Users\Janette\AppData\Local\Thunderbird
2013-06-05 03:02 - 2009-05-16 15:02 - 00000000 ___HD C:\Users\Janette\AppData\Local\Slapdash Games
2013-06-05 03:02 - 2009-03-20 19:37 - 00000000 ___HD C:\Users\Janette\AppData\Local\Ph03nixNewMedia
2013-06-05 03:01 - 2012-12-02 18:13 - 00000000 ____D C:\Users\Janette\AppData\Local\Badger I.T
2013-06-05 03:01 - 2012-07-11 21:38 - 00000000 ____D C:\Users\Janette\AppData\Local\Lenovo
2013-06-05 03:01 - 2012-06-28 10:15 - 00000000 ___HD C:\Users\Janette\AppData\Local\Macromedia
2013-06-05 03:01 - 2012-02-08 12:18 - 00000000 ____D C:\Users\Janette\AppData\Local\BVRP Software
2013-06-05 03:01 - 2011-09-04 11:05 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2013-06-05 03:01 - 2011-09-04 11:05 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2013-06-05 03:01 - 2011-07-07 11:15 - 00000000 ___HD C:\Users\Janette\AppData\Local\IsolatedStorage
2013-06-05 03:01 - 2008-09-13 12:34 - 00000000 ___HD C:\Users\Janette\AppData\Local\Apple Computer
2013-06-05 03:01 - 2008-09-13 12:32 - 00000000 ___HD C:\Users\Janette\AppData\Local\Apple
2013-06-05 03:01 - 2008-08-29 19:52 - 00000000 ___HD C:\Users\Janette\AppData\Local\Google
2013-06-05 03:01 - 2008-06-06 19:31 - 00000000 ____D C:\Users\Janette\AppData\Local\JollyBear
2013-06-05 03:01 - 2008-05-09 19:49 - 00000000 ____D C:\Users\Janette\AppData\Local\Microsoft Games
2013-06-05 03:01 - 2008-02-05 13:59 - 00000000 ____D C:\Users\Janette\AppData\Local\Adobe
2013-06-05 02:55 - 2011-04-06 13:21 - 00000000 ___HD C:\ProgramData\WindowsSearch
2013-06-05 02:55 - 2008-08-09 21:47 - 00000000 ___HD C:\ProgramData\Zylom
2013-06-05 02:55 - 2008-06-23 20:44 - 00000000 ____D C:\ProgramData\WildTangent
2013-06-05 02:55 - 2008-02-07 14:47 - 00000000 ___HD C:\ProgramData\Xerox
2013-06-05 02:53 - 2012-07-21 14:38 - 00000000 ____D C:\ProgramData\SpeedyPC Software
2013-06-05 02:53 - 2010-03-30 09:40 - 00000000 ___HD C:\ProgramData\Sun
2013-06-05 02:53 - 2009-11-23 14:50 - 00000000 ____D C:\ProgramData\PCDr
2013-06-05 02:53 - 2009-07-06 20:03 - 00000000 ___HD C:\ProgramData\Trymedia
2013-06-05 02:53 - 2009-05-16 15:02 - 00000000 ___HD C:\ProgramData\Slapdash Games
2013-06-05 02:53 - 2009-01-07 16:24 - 00000000 ___HD C:\ProgramData\SpecialBit
2013-06-05 02:53 - 2008-12-24 14:07 - 00000000 ___HD C:\ProgramData\PlayPond
2013-06-05 02:53 - 2008-06-10 15:17 - 00000000 ___HD C:\ProgramData\VirtualFarm
2013-06-05 02:53 - 2008-06-09 20:23 - 00000000 ___HD C:\ProgramData\Playrix Entertainment
2013-06-05 02:53 - 2008-06-07 11:53 - 00000000 ___HD C:\ProgramData\PlayFirst
2013-06-05 02:53 - 2008-06-06 20:41 - 00000000 ____D C:\ProgramData\SpinTopV1005
2013-06-05 02:53 - 2008-02-01 03:15 - 00000000 ___HD C:\ProgramData\Symantec
2013-06-05 02:49 - 2012-04-13 19:55 - 00000000 ____D C:\ProgramData\Norton
2013-06-05 02:49 - 2010-09-07 19:56 - 00000000 ___HD C:\ProgramData\MumboJumbo
2013-06-05 02:49 - 2010-01-22 04:24 - 00000000 ___HD C:\ProgramData\Office Genuine Advantage
2013-06-05 02:49 - 2009-06-22 18:18 - 00000000 ___HD C:\ProgramData\NCH Swift Sound
2013-06-05 02:49 - 2009-06-20 13:23 - 00000000 ____D C:\ProgramData\PC Drivers HeadQuarters
2013-06-05 02:48 - 2009-01-18 15:19 - 00000000 ___HD C:\ProgramData\Meridian93
2013-06-05 02:48 - 2008-06-22 13:51 - 00000000 ___HD C:\ProgramData\Media Art
2013-06-05 02:46 - 2012-04-13 16:55 - 00000000 ____D C:\ProgramData\Driver Tool
2013-06-05 02:46 - 2011-06-19 19:18 - 00000000 ___HD C:\ProgramData\Elephant Games
2013-06-05 02:46 - 2010-06-30 19:24 - 00000000 ___HD C:\ProgramData\Google
2013-06-05 02:46 - 2010-06-24 18:38 - 00000000 ____D C:\ProgramData\HP
2013-06-05 02:46 - 2010-01-20 11:40 - 00000000 ___HD C:\ProgramData\Flood Light Games
2013-06-05 02:46 - 2009-12-30 20:46 - 00000000 ___HD C:\ProgramData\GhostFleet
2013-06-05 02:46 - 2008-11-22 20:12 - 00000000 ____D C:\ProgramData\iWin Games
2013-06-05 02:46 - 2008-06-24 20:34 - 00000000 ____D C:\ProgramData\HipSoft
2013-06-05 02:46 - 2008-06-06 19:31 - 00000000 ___HD C:\ProgramData\JollyBear
2013-06-05 02:46 - 2008-02-01 02:39 - 00000000 ____D C:\ProgramData\Lenovo
2013-06-05 02:45 - 2012-04-14 10:25 - 00000000 ___HD C:\ProgramData\DDNI
2013-06-05 02:45 - 2012-04-12 09:17 - 00000000 ____D C:\ProgramData\Driver Manager
2013-06-05 02:45 - 2011-09-21 15:24 - 00000000 ____D C:\ProgramData\Cateia Games
2013-06-05 02:45 - 2010-12-20 15:55 - 00000000 ____D C:\ProgramData\Big Fish Games
2013-06-05 02:45 - 2009-04-01 14:35 - 00000000 ___HD C:\ProgramData\Black Blob Studios
2013-06-05 02:45 - 2008-06-14 12:56 - 00000000 ___HD C:\ProgramData\cerasus.media
2013-06-05 02:44 - 2013-04-18 20:52 - 00000000 ____D C:\ProgramData\Apple Computer
2013-06-05 02:44 - 2011-06-17 21:04 - 00000000 ___HD C:\ProgramData\Aatrix Software
2013-06-05 02:44 - 2009-01-17 18:44 - 00000000 ___HD C:\ProgramData\Awem
2013-06-05 02:44 - 2008-12-28 10:47 - 00000000 ___HD C:\ProgramData\Alawar Stargaze
2013-06-05 02:44 - 2008-09-13 12:31 - 00000000 ____D C:\ProgramData\Apple
2013-06-05 02:44 - 2008-02-01 02:36 - 00000000 ____D C:\ProgramData\Adobe
2013-06-05 02:43 - 2012-12-29 16:47 - 00000000 ____D C:\Program Files\ValuSoft
2013-06-05 02:43 - 2012-02-09 16:08 - 00000000 ____D C:\Program Files\VS Revo Group
2013-06-05 02:43 - 2008-02-01 02:35 - 00000000 ____D C:\Program Files\ThinkVantage
2013-06-05 02:43 - 2006-11-02 04:18 - 00000000 ____D C:\Program Files\Windows NT
2013-06-05 02:42 - 2012-04-13 09:09 - 00000000 ____D C:\Program Files\Seagate
2013-06-05 02:42 - 2008-12-20 16:28 - 00000000 ____D C:\Program Files\SanDisk
2013-06-05 02:42 - 2008-02-01 02:20 - 00000000 ____D C:\Program Files\Synaptics
2013-06-05 02:42 - 2008-02-01 02:16 - 00000000 ____D C:\Program Files\ThinkPad
2013-06-05 02:41 - 2008-12-20 12:38 - 00000000 ____D C:\Program Files\Real
2013-06-05 02:41 - 2006-11-02 05:37 - 00000000 ____D C:\Program Files\Reference Assemblies
2013-06-05 02:40 - 2011-06-17 20:28 - 00000000 ____D C:\Program Files\Pervasive Software
2013-06-05 02:40 - 2009-06-22 18:18 - 00000000 ____D C:\Program Files\NCH Software
2013-06-05 02:40 - 2008-02-01 03:26 - 00000000 ____D C:\Program Files\Microsoft SQL Server
2013-06-05 02:40 - 2008-02-01 03:24 - 00000000 ____D C:\Program Files\Microsoft.NET
2013-06-05 02:40 - 2008-02-01 03:24 - 00000000 ____D C:\Program Files\Microsoft Visual Studio
2013-06-05 02:40 - 2006-11-02 05:37 - 00000000 ____D C:\Program Files\MSBuild
2013-06-05 02:39 - 2008-02-01 03:28 - 00000000 ____D C:\Program Files\Microsoft Small Business
2013-06-05 02:39 - 2008-02-01 03:22 - 00000000 ____D C:\Program Files\Microsoft Office
2013-06-05 02:37 - 2006-11-02 05:37 - 00000000 ____D C:\Program Files\Microsoft Games
2013-06-05 02:36 - 2008-02-01 02:32 - 00000000 ____D C:\Program Files\Lenovo Group Limited
2013-06-05 02:32 - 2010-06-24 18:47 - 00000000 ____D C:\Program Files\HP
2013-06-05 02:32 - 2008-02-01 03:14 - 00000000 ____D C:\Program Files\Intel
2013-06-05 02:32 - 2008-02-01 03:01 - 00000000 ____D C:\Program Files\Google
2013-06-05 02:31 - 2012-07-13 22:55 - 00000000 ____D C:\Program Files\ESET
2013-06-05 02:29 - 2012-04-14 10:25 - 00000000 ____D C:\Program Files\DDNI
2013-06-05 02:29 - 2008-02-01 02:14 - 00000000 ____D C:\Program Files\DIFX
2013-06-05 02:28 - 2008-02-01 03:15 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared
2013-06-05 02:28 - 2008-02-01 02:42 - 00000000 ____D C:\Program Files\Common Files\Roxio Shared
2013-06-05 02:28 - 2008-02-01 02:18 - 00000000 ____D C:\Program Files\CONEXANT
2013-06-05 02:28 - 2006-11-02 04:18 - 00000000 ____D C:\Program Files\Common Files\SpeechEngines
2013-06-05 02:27 - 2008-12-20 12:50 - 00000000 ____D C:\Program Files\Common Files\Real
2013-06-05 02:27 - 2006-11-02 04:18 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-06-05 02:25 - 2010-05-19 17:21 - 00000000 ____D C:\Program Files\Common Files\Canon
2013-06-05 02:25 - 2008-09-13 12:31 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-06-05 02:25 - 2008-02-01 02:46 - 00000000 ____D C:\Program Files\Common Files\Java
2013-06-05 02:25 - 2008-02-01 02:44 - 00000000 ____D C:\Program Files\Common Files\InterVideo
2013-06-05 02:24 - 2008-02-01 02:36 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-06-05 02:22 - 2012-12-02 18:00 - 00000000 ____D C:\Program Files\BadgerIT
2013-06-05 02:22 - 2008-02-01 02:26 - 00000000 ____D C:\Program Files\Analog Devices
2013-06-05 02:21 - 2008-02-01 02:36 - 00000000 ____D C:\Program Files\Adobe
2013-06-05 02:17 - 2012-08-18 16:32 - 00000000 ____D C:\BigFishGamesCache
2013-06-05 02:17 - 2008-02-08 17:04 - 00000000 ____D C:\EPSON
2013-06-05 02:17 - 2008-02-01 02:27 - 00000000 ____D C:\Intel
2013-06-05 01:03 - 2013-05-24 20:20 - 00000000 ____D C:\Users\Janette\Documents\Tacoma film Festival
2013-06-05 01:03 - 2013-05-24 20:20 - 00000000 ____D C:\Users\Janette\Documents\Cartoons
2013-06-04 21:02 - 2006-11-02 03:22 - 61865984 ____A C:\Windows\System32\config\software_previous
2013-06-04 21:02 - 2006-11-02 03:22 - 24641536 ____A C:\Windows\System32\config\system_previous
2013-06-04 21:02 - 2006-11-02 03:22 - 00061440 ____A C:\Windows\System32\config\sam_previous
2013-06-04 21:02 - 2006-11-02 03:22 - 00028672 ____A C:\Windows\System32\config\security_previous
2013-06-04 20:58 - 2008-02-01 01:57 - 01356986 ____A C:\Windows\WindowsUpdate.log
2013-06-04 19:51 - 2013-06-04 19:51 - 00000000 ____D C:\Users\Janette\Documents\mbar-1.06.0.1003
2013-06-04 19:41 - 2013-06-04 18:19 - 00000000 ____D C:\Users\Janette\Desktop\RK_Quarantine
2013-06-04 18:42 - 2013-06-04 18:42 - 02708759 ____A C:\Users\Janette\Desktop\debug.log
2013-06-04 08:57 - 2013-05-31 19:20 - 00109056 ____A C:\Users\Janette\Documents\8.5x11 blank template.pub
2013-06-04 08:05 - 2013-06-04 08:04 - 00017139 ____A C:\Users\Janette\Desktop\dds.txt
2013-06-04 08:05 - 2013-06-04 08:04 - 00013829 ____A C:\Users\Janette\Desktop\attach.txt
2013-06-03 19:53 - 2006-11-02 03:22 - 01048576 ____A C:\Windows\System32\config\default_previous
2013-06-03 19:52 - 2006-11-02 03:22 - 45613056 ____A C:\Windows\System32\config\components_previous
2013-06-03 15:27 - 2013-06-03 15:27 - 00000000 ____D C:\ProgramData\AVAST Software
2013-06-03 15:27 - 2013-06-03 15:27 - 00000000 ____D C:\Program Files\AVAST Software
2013-06-02 15:16 - 2010-06-24 18:40 - 00005191 ____A C:\ProgramData\hpzinstall.log
2013-05-30 20:07 - 2012-02-10 18:38 - 00000091 ____A C:\Windows\win.ini
2013-05-25 21:33 - 2012-07-14 14:00 - 00154704 ____A C:\Windows\System32\GDIPFONTCACHEV1.DAT
2013-05-17 08:49 - 2012-11-23 15:36 - 00002555 ____N C:\Users\Janette\Desktop\Microsoft Office Publisher 2007.lnk
2013-05-15 03:35 - 2006-11-02 06:01 - 00032612 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-05-15 03:04 - 2006-11-02 03:24 - 72607752 ____N (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-05-14 19:19 - 2013-02-20 11:24 - 00000000 ____D C:\Users\Janette\Documents\Light Space Time contests
2013-05-14 19:17 - 2012-09-04 19:30 - 00692104 ____N (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-05-14 19:17 - 2012-09-04 19:30 - 00071048 ____N (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-05-14 17:57 - 2013-05-14 16:37 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-05-13 09:24 - 2013-05-13 09:24 - 03097600 ____N C:\Users\Janette\Documents\Out of the stall frame comp.pub
2013-05-11 14:42 - 2013-05-11 14:42 - 00235080 ____N (Big Fish Games) C:\Users\Janette\Downloads\bigfishgames_p30278468_s1_l1(6).exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2013-06-09 21:40

==================== End Of Log ============================
June 10th, 2013, 08:02 PM
Broni

I still need Addition.txt
June 10th, 2013, 09:11 PM
rollie

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 09-06-2013
Ran by Janette at 2013-06-09 22:38:56 Run:
Running from C:\Users\Janette\Downloads
Boot Mode: Safe Mode (with Networking)
==========================================================

==================== Installed Programs =======================

Update for Microsoft Office 2007 (KB2508958)
2007 Microsoft Office system (Version: 12.0.4518.1014)
32 Bit HP CIO Components Installer (Version: 7.1.8)
6000E609_eDocs (Version: 1.00.0000)
6000E609_Help (Version: 1.00.0000)
6000E609n (Version: 50.0.165.000)
ABBYY FineReader 6.0 Sprint (Version: 6.00.1395.4512)
Access Help (Version: 2.02)
Activation Assistant for the 2007 Microsoft Office suites
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0)
Adobe AIR (Version: 2.7.1.19610)
Adobe Community Help (Version: 3.4.980)
Adobe Download Assistant (Version: 1.0.6)
Adobe Flash Player 11 Plugin (Version: 11.7.700.202)
Adobe Flash Player 9 ActiveX (Version: 9.0.16.0)
Adobe Help Center 2.0 (Version: 2.0.0)
Adobe Photoshop Elements 4.0 (Version: 4.0)
Adobe Reader X (10.1.7) (Version: 10.1.7)
Amazon MP3 Downloader 1.0.17 (Version: 1.0.17)
Apple Application Support (Version: 2.3)
Apple Mobile Device Support (Version: 2.1.0.25)
Apple Software Update (Version: 2.1.3.127)
Ask Toolbar (Version: 1.15.4.0)
Big Fish Games: Game Manager (Version: 3.0.1.60)
Bonjour (Version: 1.0.106)
BPDSoftware (Version: 50.0.165.000)
BPDSoftware_Ini (Version: 1.00.0000)
BufferChm (Version: 120.0.194.000)
Business Contact Manager for Outlook 2007 SP2 (Version: 3.0.8619.1)
CDBurnerXP (Version: 4.2.2.984)
Client Security Solution (Version: 8.0.0311.00)
ConvertHelper 2.2
Crystal Reports 2008 Runtime SP1 (Version: 12.1.0.882)
DeviceDiscovery (Version: 120.0.194.000)
DIBS (Version: 1.0.0)
Diskeeper Home (Version: 9.0.545)
Drag-to-Disc (Version: 9.05)
EPSON Attach To Email (Version: 1.01.0000)
EPSON Copy Utility 3 (Version: 3.3.0.0)
EPSON Event Manager (Version: 1.80.00)
EPSON Perfection V500 Photo Scanner Driver Update
EPSON Perfection V500P User's Guide
EPSON Printer Software
EPSON Scan
EPSON Scan Assistant (Version: 1.11.00)
FastStone Image Viewer 4.2 (Version: 4.2)
FinePix Studio
FinePixViewer Resource (Version: 1.2)
FinePixViewer Ver.5.5 (Version: 5.5)
GPBaseService2 (Version: 130.0.371.000)
Help Center (Version: 2.00c)
HP Customer Participation Program 12.0 (Version: 12.0)
HP Imaging Device Functions 12.0 (Version: 12.0)
HP Officejet 6000 E609 Series (Version: 12.0)
HP Smart Web Printing 4.60 (Version: 4.60)
HP Solution Center 13.0 (Version: 13.0)
HP Update (Version: 5.003.001.001)
HPDiagnosticAlert (Version: 1.00.0000)
HPProductAssistant (Version: 130.0.371.000)
Ink Monitor
Integrated Camera (Version: 5.8.8.012)
Intel(R) Graphics Media Accelerator Driver
Intel(R) PRO Network Connections Drivers
Intel® Turbo Memory and Intel® Matrix Storage Manager
InterVideo Register Manager (Version: 1.0.4.0)
InterVideo WinDVD (Version: 5.0-B11.1167)
Java Auto Updater (Version: 2.0.7.1)
Java(TM) 6 Update 33 (Version: 6.0.330)
Lenovo Auto Scroll Utility (Version: 1.11)
Lenovo Care (Version: 2.11)
Lenovo Care Supplement (Version: 2.01)
Lenovo News-Shop (Version: 2.0.3.0)
Lenovo Patch Utility (Version: 1.3.0.9)
Lenovo Registration
Lenovo System Interface Driver (Version: 1.05)
Malwarebytes Anti-Malware version 1.70.0.1100 (Version: 1.70.0.1100)
Mandala Painter 3.0 Professional
MarketResearch (Version: 120.0.226.000)
McAfee Online Backup
McAfee Online Backup (Version: 1.16.4.0)
Message Center (Version: 2.01b)
Message Center Plus (Version: 2.0.0012.00)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 1.1 Security Update (KB2698023)
Microsoft .NET Framework 1.1 Security Update (KB2742597)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Professional Hybrid 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Small Business Connectivity Components (Version: 2.0.7024.0)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) (Version: 9.4.5000.00)
Microsoft SQL Server Native Client (Version: 9.00.5000.00)
Microsoft SQL Server Setup Support Files (English) (Version: 9.00.5000.00)
Microsoft SQL Server VSS Writer (Version: 9.00.5000.00)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (Version: 10.0.30319)
Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053)
Microsoft_VC90_ATL_x86 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (Version: 1.00.0000)
Microsoft_VC90_MFCLOC_x86 (Version: 1.00.0000)
Mozilla Firefox 21.0 (x86 en-US) (Version: 21.0)
Mozilla Thunderbird 17.0.6 (x86 en-US) (Version: 17.0.6)
MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0)
MSXML 4.0 SP2 (KB941833) (Version: 4.20.9849.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Multimedia Center For Think Offerings (Version: 9.0.629)
Network (Version: 120.0.194.000)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0)
On Screen Display (Version: 6.60.03)
OpenOffice.org Installer 1.0 (Version: 1.0.9221)
Peachtree Accounting 2010 (Version: 17.00.00)
PeachTree Signature Ready Forms (Version: 6.7.4)
Pervasive PSQL v10.10 Workgroup (32-bit) (Version: 10.10.126)
Pervasive PSQL v10.10 Workgroup (32-bit) (Version: 10.12.025)
Power Manager (Version: 6.32)
Presentation Director (Version: 4.08)
ProductContext (Version: 50.0.165.000)
Productivity Center Supplement for ThinkPad (Version: 2.00)
QuickTime (Version: 7.73.80.64)
Registry patch for Windows Vista USB S3 PM Enablement (Version: 1.00)
Registry patch of Changing Timing of IDLE IRP by Finger Print Driver for Windows Vista (Version: 1.01)
Registry Patch of Enabling Device Initiated Power Management(DIPM) on SATA for Windows Vista (Version: 1.01)
Registry patch to improve USB device detection on resume from sleep for Windows Vista (Version: 1.01.0000)
Rescue and Recovery (Version: 4.00.0117.00)
Rhapsody Player Engine (Version: 1.0.604)
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.52.02 (Version: 3.52.02)
Roads of Rome III
Sage Message Center (Version: 2.00.0000)
Seagate Replica v3.0.768.5345
Shared C Run-time for x86 (Version: 10.0.0)
Smart Audio Converter (Version: 3.3)
SmartWebPrinting (Version: 140.0.186.000)
SolutionCenter (Version: 130.0.373.000)
Sonic Icons for Lenovo (Version: 1.0.2)
SoundMAX (Version: 6.10.1.5500)
Status (Version: 120.0.194.000)
Switch Sound File Converter
swMSM (Version: 12.0.0.1)
System Migration Assistant (Version: 5.20.0033)
System Requirements Lab
System Update (Version: 3.15.0017)
ThinkPad EasyEject Utility (Version: 2.39)
ThinkPad FullScreen Magnifier (Version: 2.40)
ThinkPad Keyboard Customizer Utility (Version: 1.0.01)
ThinkPad Mobility Center Customization (Version: 1.20.0000)
ThinkPad Modem (Version: 7.62.00)
ThinkPad Power Management Driver (Version: 1.43)
ThinkPad UltraNav Driver (Version: 15.0.18.0)
ThinkPad UltraNav Utility (Version: 2.13.0)
Thinkpad Wireless LAN Adapters Software (11a/b/g/n) (Version: 7.3.1.127)
ThinkVantage Access Connections (Version: 4.42)
ThinkVantage Active Protection System (Version: 1.54)
ThinkVantage Productivity Center (Version: 2.10)
ThinkVantage Technologies Welcome Message (Version: 1.18)
Toolbox (Version: 120.0.194.000)
TrayApp (Version: 120.0.194.000)
Uniblue DriverScanner 2009
Uniblue DriverScanner 2009 (Version: 2.0.0.1)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817359) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VOB2MPG v3 (Version: 3.2.2000)
Wallpapers
WebReg (Version: 120.0.194.000)
Windows Driver Package - Intel (e1express) Net (04/26/2007 9.7.240.0) (Version: 04/26/2007 9.7.240.0)
Windows Driver Package - Intel (iaStor) hdc (02/12/2007 7.0.0.1020) (Version: 02/12/2007 7.0.0.1020)
Windows Driver Package - Intel hdc (11/15/2006 8.2.0.1011) (Version: 11/15/2006 8.2.0.1011)
Windows Driver Package - Intel hdc (12/06/2006 6.8.0.3002) (Version: 12/06/2006 6.8.0.3002)
Windows Driver Package - Intel System (09/15/2006 7.0.0.1011) (Version: 09/15/2006 7.0.0.1011)
Windows Driver Package - Intel System (09/15/2006 8.0.0.1008) (Version: 09/15/2006 8.0.0.1008)
Windows Driver Package - Intel System (09/15/2006 8.0.0.1010) (Version: 09/15/2006 8.0.0.1010)
Windows Driver Package - Intel System (09/15/2006 8.2.0.1000) (Version: 09/15/2006 8.2.0.1000)
Windows Driver Package - Intel USB (09/15/2006 8.0.0.1008) (Version: 09/15/2006 8.0.0.1008)
Windows Driver Package - Lenovo (IBMPMDRV) System (05/31/2007 1.43) (Version: 05/31/2007 1.43)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
Worldjongg (Version: 1.00.000)
Yahoo! SiteBuilder (Version: 2.4.0)

==================== Restore Points =========================

==================== Faulty Device Manager Devices =============

Name: isatap.{CD82E2A3-614C-43A1-8DFA-9601575D6D8B}
Description: Microsoft ISATAP Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: isatap.Belkin
Description: Microsoft ISATAP Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft Tun Miniport Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunmp
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft Tun Miniport Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunmp
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Officejet 6000 E609n
Description: Officejet 6000 E609n
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: COM4
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Application errors:
==================
Error: (06/09/2013 09:48:41 PM) (Source: EventSystem) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (06/09/2013 09:25:14 PM) (Source: EventSystem) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (06/05/2013 00:11:28 PM) (Source: EventSystem) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (06/05/2013 11:58:40 AM) (Source: System Restore) (User: )
Description: Failed to create restore point on volume (Process = C:\Windows\system32\wbem\wmiprvse.exe; Descripton = ComboFix created restore point; Hr = 0x8007043c).

Error: (06/05/2013 11:58:40 AM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x8007043c.

Operation:
Instantiating VSS server

Error: (06/05/2013 11:58:40 AM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: The COM Server with CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} and name Coordinator cannot be started during Safe Mode.
The Volume Shadow Copy service cannot start while in safe mode. [0x8007043c]

Operation:
Instantiating VSS server

Error: (06/05/2013 10:29:37 AM) (Source: EventSystem) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (06/05/2013 10:14:36 AM) (Source: AVLogEvent) (User: NT AUTHORITY)
Description: a7f42014

Error: (06/05/2013 09:14:21 AM) (Source: EventSystem) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (06/05/2013 05:46:55 AM) (Source: AVLogEvent) (User: NT AUTHORITY)
Description: a7f42014

System errors:
=============

Microsoft Office Sessions:
=========================
Error: (05/30/2013 08:07:57 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 8, Application Name: Microsoft Office Publisher, Application Version: 12.0.6676.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 174 seconds with 0 seconds of active time. This session ended with a crash.

Error: (05/28/2013 04:27:01 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 8, Application Name: Microsoft Office Publisher, Application Version: 12.0.6676.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 65 seconds with 60 seconds of active time. This session ended with a crash.

Error: (05/28/2013 04:24:14 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 8, Application Name: Microsoft Office Publisher, Application Version: 12.0.6676.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 19430 seconds with 5280 seconds of active time. This session ended with a crash.

Error: (05/26/2013 08:11:10 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 8, Application Name: Microsoft Office Publisher, Application Version: 12.0.6676.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 10 seconds with 0 seconds of active time. This session ended with a crash.

Error: (05/25/2013 09:20:26 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 8, Application Name: Microsoft Office Publisher, Application Version: 12.0.6676.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 455 seconds with 120 seconds of active time. This session ended with a crash.

Error: (05/25/2013 09:12:20 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 51 seconds with 0 seconds of active time. This session ended with a crash.

Error: (05/25/2013 09:11:15 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 8, Application Name: Microsoft Office Publisher, Application Version: 12.0.6676.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 58 seconds with 0 seconds of active time. This session ended with a crash.

Error: (05/25/2013 09:10:09 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 8, Application Name: Microsoft Office Publisher, Application Version: 12.0.6676.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 149 seconds with 120 seconds of active time. This session ended with a crash.

Error: (05/25/2013 09:03:38 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 57 seconds with 0 seconds of active time. This session ended with a crash.

Error: (05/25/2013 09:02:23 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 23 seconds with 0 seconds of active time. This session ended with a crash.

CodeIntegrity Errors:
===================================
Date: 2013-06-03 14:04:23.178
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-06-03 14:04:22.975
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-06-03 14:04:22.757
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-06-03 14:04:22.554
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-06-03 14:04:22.351
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-06-03 14:04:22.117
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-02-21 14:12:40.411
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\igdumdx32.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-02-21 14:12:40.145
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\igdumdx32.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-02-21 14:12:39.889
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\PROGRA~1\McAfee\SITEAD~1\sahook.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-02-21 14:12:39.881
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\PROGRA~1\McAfee\SITEAD~1\sahook.dll because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Percentage of memory in use: 28%
Total physical RAM: 3061.34 MB
Available physical RAM: 2192.77 MB
Total Pagefile: 6337.7 MB
Available Pagefile: 5589.95 MB
Total Virtual: 2047.88 MB
Available Virtual: 1941.5 MB

==================== Drives ================================

Drive c: (SW_Preload) (Fixed) (Total:226.12 GB) (Free:120.87 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 233 GB) (Disk ID: 2FFA1D60)
Partition 1: (Not Active) - (Size=7 GB) - (Type=27)
Partition 2: (Active) - (Size=226 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 514 MB) (Disk ID: D49470DA)
Partition 1: (Not Active) - (Size=513 MB) - (Type=0B)

==================== End Of Log ============================
June 10th, 2013, 09:15 PM
Broni

1 Attachment(s)

Download attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

See if you can boot normally.
June 10th, 2013, 10:27 PM
rollie

Having a problem with this. Downloaded the attached fixlist.txt and saved it to the desktop. Ran FRST and pushed Fix and waited. It closed and there is no Fixlog.txt on the desktop. Ran again and pushed Fix, it did the same thing. Just closed and that was it. Do you think it could do this because FRST is a shortcut on the desktop? I didn't save it there to begin with--I created a shortcut from the download file to the desktop.
June 10th, 2013, 11:06 PM
rollie

That must have been the problem because I downloaded FRST directly to the desktop and voila it worked. The computer restarted afterwards in normal mode and the same blank screen came up. Had to go back into Safe Mode

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 11-06-2013
Ran by Janette at 2013-06-10 19:54:34 Run:1
Running from C:\Users\Janette\Desktop
Boot Mode: Safe Mode (with Networking)

==============================================

[4056] C:\Program Files\McAfee\MAT\McPvTray.exe => Process closed successfully.
C:\Program Files\McAfee => Moved successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\ => Value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\GrpConv => Value deleted successfully.
0164701370839192mcinstcleanup => Service deleted successfully.
MOBCleanup => Service deleted successfully.
mfefire => Service deleted successfully.
mfevtp => Service deleted successfully.
MOBKbackup => Service deleted successfully.
mferkdk => Service deleted successfully.
mfesmfk => Service deleted successfully.
blbdrive => Service deleted successfully.
catchme => Service deleted successfully.
cfwids => Service deleted successfully.
IpInIp => Service deleted successfully.
MCSTRM => Service deleted successfully.
mfeapfk => Service deleted successfully.
mfeavfk => Service deleted successfully.
mfebopk => Service deleted successfully.
mfefirek => Service deleted successfully.
mfehidk => Service deleted successfully.
mfewfpk => Service deleted successfully.
NwlnkFlt => Service deleted successfully.
NwlnkFwd => Service deleted successfully.
UIUSys => Service deleted successfully.
C:\Windows\Tasks\McAfee Cleanup.job => Moved successfully.
C:\Users\Janette\Downloads\MCPR.exe => Moved successfully.
C:\Windows\Tasks\McAfee Cleanup.job => File/Directory not found.

"C:\Program Files\McAfee Online Backup" directory move:

C:\Program Files\McAfee Online Backup\MOBKshell.dll => Moved successfully.
C:\Program Files\McAfee Online Backup\oem.dll => Moved successfully.
Could not move C:\Program Files\McAfee Online Backup\Data\manifest.dat. => Scheduled to move on reboot.
Could not move C:\Program Files\McAfee Online Backup\Data\MOBK.log. => Scheduled to move on reboot.
Could not move "C:\Program Files\McAfee Online Backup" directory. => Scheduled to move on reboot.

C:\Program Files\McAfee => File/Directory not found.
C:\Program Files\Common Files\McAfee => Moved successfully.
C:\Users\Janette\Downloads\MCPR.exe => File/Directory not found.
C:\Users\Janette\AppData\Roaming\McAfee => Moved successfully.
June 10th, 2013, 11:52 PM
Broni
Quote:

I downloaded FRST directly to the desktop

This is what my instructions said.

In any case let's try something else...

For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

Plug the flashdrive into the infected PC.

If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt.

If you are using Vista or Windows 7 enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
- Restart the computer.
- As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
- Use the arrow keys to select the Repair your computer menu item.
- Select US as the keyboard language settings, and then click Next.
- Select the operating system you want to repair, and then click Next.
- Select your user account an click Next.
To enter System Recovery Options by using Windows installation disc:
- Insert the installation disc.
- Restart your computer.
- If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
- Click Repair your computer.
- Select US as the keyboard language settings, and then click Next.
- Select the operating system you want to repair, and then click Next.
- Select your user account and click Next.
On the System Recovery Options menu you will get the following options:
- Startup Repair
- System Restore
- Windows Complete PC Restore
- Windows Memory Diagnostic Tool
- Command Prompt
- Select Command Prompt
- In the command window type in notepad and press Enter.
- The notepad opens. Under File menu select Open.
- Select "Computer" and find your flash drive letter and close the notepad.
- In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
- The tool will start to run.
- When the tool opens click Yes to disclaimer.
- Press Scan button.
- It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
June 11th, 2013, 12:43 AM
rollie

=========== Result of Scheduled Files to move ===========
C:\Program Files\McAfee Online Backup\Data\manifest.dat => Moved successfully.
C:\Program Files\McAfee Online Backup\Data\MOBK.log => Moved successfully.
C:\Program Files\McAfee Online Backup => Moved successfully.

==== End of Fixlog ====
June 11th, 2013, 11:54 AM
rollie

Things are getting better. The laptop is running lots faster than yesterday and the day before. I restarted in normal mode this morning and my screen-saver picture is back along with the bottom tray, although there are minimal icons in the tray. But the cursor spun for 10 minutes and there were no icons on the desktop. So I restarted in safe-mode to post this.
June 11th, 2013, 07:27 PM
Broni

That's better news...

Restart in normal mode, go Start and in "Start search" type:
explorer.exe
Press Enter.
Will it bring your desktop icons back?
June 11th, 2013, 07:53 PM
rollie

Nope. Start is not there. A Windows logo is where Start should be. If I move the cursor over it the cursor arrow becomes a spinning circle. Also, the picture I had up for a screen-saver is gone again.
June 11th, 2013, 08:19 PM
Broni

Windows logo is your Start button.
What happens when you click on it?

If nothing....

Hold CTRL and ALT keys, press DEL key.
Does it bring Task Manager window up?
June 12th, 2013, 04:42 PM
rollie

No, nothing. In fact the bottom tray and Windows logo are completely gone now. It's just a pink screen because that was the background color I selected when I put a screen saver picture on the desktop. When I did move the cursor over the Windows logo, it just spun.
June 12th, 2013, 07:08 PM
Broni

Let's go with instructions from my post #26.
June 12th, 2013, 09:36 PM
rollie

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-06-2013 04
Ran by Janette (administrator) on 12-06-2013 18:30:12
Running from E:\
Windows Vista (TM) Home Premium Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Safe Mode (with Networking)

==================== Processes (Whitelisted) ===================

(Lenovo Group Limited) C:\PROGRA~1\ThinkPad\UTILIT~1\PWMUIAux.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe [487424 2008-03-04] (Lenovo Group Limited)
HKLM\...\Run: [TpShocks] TpShocks.exe [x]
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1725736 2010-04-23] (Synaptics Incorporated)
HKLM\...\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe [1282048 2007-07-09] (Analog Devices, Inc.)
HKLM\...\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey [x]
HKLM\...\Run: [LPManager] C:\PROGRA~1\Lenovo\LENOVO~1\LPMGR.exe [124256 2007-07-13] (Lenovo Group Limited)
HKLM\...\Run: [IaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe [33304 2007-10-23] (Intel Corporation)
HKLM\...\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM\...\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe [256576 2009-12-01] (Lenovo Group Ltd.)
HKLM\...\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe [102400 2006-10-12] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [217176 2006-11-15] (Diskeeper Corporation)
HKLM\...\Run: [cssauth] "C:\Program Files\Lenovo\Client Security Solution\cssauth.exe" silent [2630968 2007-08-09] (Lenovo Group Limited)
HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-10-11] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe [124200 2007-07-05] (Lenovo)
HKLM\...\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe [419112 2007-07-05] (Lenovo)
HKLM\...\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [57344 2005-09-16] (Adobe Systems Incorporated)
HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)
HKCU\...\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
HKCU\...\RunOnce: [FRST] "C:\Users\Janette\Desktop\FRST.exe" [1358933 2013-06-10] (Farbar)
HKCU\...\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil32_11_7_700_202_Plugin.exe -update plugin [813448 2013-05-14] (Adobe Systems Incorporated)
Startup: C:\ProgramData\Start Menu\Programs\Startup\Digital Line Detect.lnk
ShortcutTarget: Digital Line Detect.lnk -> C:\Program Files\Digital Line Detect\DLG.exe (Avanquest Software )
Startup: C:\ProgramData\Start Menu\Programs\Startup\ExifLauncher2.lnk
ShortcutTarget: ExifLauncher2.lnk -> C:\Program Files\FinePixViewer\QuickDCF2.exe (FUJIFILM Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
HKLM SearchScopes: DefaultScope {56256A51-B582-467e-B8D4-7786EDA79AE0} URL =
SearchScopes: HKLM - {8EA3020D-938C-4106-9E80-31B3115264CE} URL = http://search.live.com/results.aspx?q={searchTerms}&entrypoint={referrer:source?}&FORM=LENIE
HKCU SearchScopes: DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={C96D4DF8-59CE-4206-B7C5-D03F29772532}&mid=28de95e7bab447d0bac8d157716ebc84-3d0a17156c5f9c0cb85bd1076241fe91f64e4dc1&lang=en&ds=ft011&pr=sa&d=2012-07-12 09:52:45&v=11.1.0.12&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {45DA25B3-EC74-4933-8E1F-4FF592449C30} URL = http://search.yahoo.com/search?fr=mcafee&p={SearchTerms}
SearchScopes: HKCU - {8EA3020D-938C-4106-9E80-31B3115264CE} URL = http://search.live.com/results.aspx?q={searchTerms}&entrypoint={referrer:source?}&FORM=LENIE
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={C96D4DF8-59CE-4206-B7C5-D03F29772532}&mid=28de95e7bab447d0bac8d157716ebc84-3d0a17156c5f9c0cb85bd1076241fe91f64e4dc1&lang=en&ds=ft011&pr=sa&d=2012-07-12 09:52:45&v=11.1.0.12&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = http://search.yahoo.com/search?fr=mcafee&p={searchTerms}
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: CPwmIEBrowserHelper Object - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [147456] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Janette\AppData\Roaming\Mozilla\Firefox\Profiles\61h3obro.default-1370213703050
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin: @java.com/DTPlugin,version=10.5.1 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/RhapsodyPlayerEngine,version=1.0 - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll (RealNetworks, Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\27.0.1453.94\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft\u00AE Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Windows Genuine Advantage) - C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll (Microsoft Corporation)
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (AmazonMP3DownloaderPlugin) - C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101752.dll (Amazon.com, Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U33) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll No File
CHR Plugin: (RealNetworks Rhapsody Player Engine) - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll (RealNetworks, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
CHR Plugin: (Java Deployment Toolkit 7.0.50.255) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (McAfee SecurityCenter) - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Docs) - C:\Users\Janette\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Janette\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Janette\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Janette\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (SiteAdvisor) - C:\Users\Janette\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.61.113.2_0
CHR Extension: (Gmail) - C:\Users\Janette\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

========================== Services (Whitelisted) =================

S2 AdobeActiveFileMonitor4.0; C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe [102400 2005-10-03] ()
S2 Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [116040 2008-09-10] (Apple Inc.)
S2 DDNIService; C:\Program Files\DDNI\DIBS\DDNIService.exe [166376 2008-04-07] (Digital Delivery Networks, Inc.)
S2 Diskeeper; C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe [634988 2006-11-15] (Diskeeper Corporation)
S2 LENOVO.MICMUTE; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [101736 2011-07-12] (Lenovo Group Limited)
S2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [127336 2011-07-12] (Lenovo Group Limited)
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation)
S3 MSSQL$MSSMLBIZ; c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S2 psqlWGE; C:\Program Files\Pervasive Software\PSQL\bin\w3dbsmgr.exe [435496 2009-04-06] (Pervasive Software Inc.)
S2 PwmEWSvc; C:\Program Files\ThinkPad\Utilities\PWMEWSVC.EXE [1665120 2012-05-16] (Lenovo Group Limited)
S2 Seagate-Replica-Service; C:\Program Files\Seagate Replica\bin\Seagate-Replica-Service.exe [1818624 2009-04-10] ()
S2 Seagate-Replica-SysMon; C:\Program Files\Seagate Replica\bin\Seagate-Replica-SysMon.exe [78288 2009-04-10] ()
S2 SUService; c:\program files\lenovo\system update\suservice.exe [28672 2011-07-26] (Lenovo Group Limited)
S2 TPHKLOAD; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [131432 2011-07-12] (Lenovo Group Limited)
S2 TSSCoreService; C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe [722232 2007-08-09] (IBM)
S2 TVT Backup Protection Service; C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe [569344 2007-01-08] ()
S2 TVT Scheduler; c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe [1122304 2008-04-06] (Lenovo Group Limited)
S3 GameConsoleService;
S2 helpsvc; %WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll [x]

==================== Drivers (Whitelisted) ====================

S3 Eplpdx02; C:\Windows\system32\Drivers\EPLPDX02.SYS [70084 2001-08-09] (MK Systems CO., LTD.)
R3 LenovoRd; C:\Windows\System32\Drivers\LenovoRd.sys [81280 2007-06-07] (Lenovo)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [21104 2012-12-14] (Malwarebytes Corporation)
S1 MOBKFilter; C:\Windows\System32\DRIVERS\MOBK.sys [54776 2010-04-13] (Mozy, Inc.)
R3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
U3 TrueSight; c:\windows\system32\drivers\TrueSight.sys [14080 2012-07-12] ()
S3 TvtDrv; C:\Program Files\Common Files\Lenovo\InvAgent\TvtDrv.sys [3712 2007-01-08] ()

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-06-12 13:30 - 2013-06-12 13:30 - 00000000 ____D C:\O
2013-06-12 12:57 - 2013-06-12 12:57 - 00000000 ____D C:\N
2013-06-12 12:31 - 2013-06-12 12:31 - 00000000 ____D C:\M
2013-06-12 12:26 - 2013-06-12 12:26 - 00000000 ____D C:\L
2013-06-11 19:05 - 2013-06-11 19:05 - 00000000 ____D C:\K
2013-06-11 16:41 - 2013-06-11 16:41 - 00000000 ____D C:\J
2013-06-11 08:34 - 2013-06-11 08:34 - 00000000 ____D C:\I
2013-06-10 20:57 - 2013-06-10 20:57 - 00018944 ____A C:\Users\Janette\Documents\IME Janette Notes June 10 2013.wps
2013-06-10 20:23 - 2013-06-10 20:23 - 00000000 ____D C:\H
2013-06-10 19:57 - 2013-06-10 19:57 - 00000000 ____D C:\G
2013-06-10 19:54 - 2013-06-10 19:54 - 01358933 ____A (Farbar) C:\Users\Janette\Desktop\FRST.exe
2013-06-10 19:37 - 2013-06-10 19:37 - 01358933 ____A (Farbar) C:\Users\Janette\Downloads\FRST(2).exe
2013-06-10 19:36 - 2013-06-10 19:36 - 01358933 ____A (Farbar) C:\Users\Janette\Downloads\FRST(1).exe
2013-06-10 18:23 - 2013-06-10 18:23 - 00002044 ____A C:\Users\Janette\Downloads\fixlist.txt
2013-06-09 22:48 - 2013-06-09 22:48 - 00000556 ____A C:\Users\Janette\Desktop\Addition - Shortcut.lnk
2013-06-09 22:48 - 2013-06-09 22:48 - 00000532 ____A C:\Users\Janette\Desktop\FRST - Shortcut (2).lnk
2013-06-09 22:47 - 2013-06-09 22:47 - 00004096 ____A C:\conf.dat
2013-06-09 22:47 - 2013-06-09 22:47 - 00000532 ____A C:\Users\Janette\Desktop\FRST - Shortcut.lnk
2013-06-09 22:39 - 2013-06-09 22:39 - 00060343 ____A C:\Users\Janette\Downloads\FRST.txt
2013-06-09 22:38 - 2013-06-09 22:39 - 00023701 ____A C:\Users\Janette\Downloads\Addition.txt
2013-06-09 22:37 - 2013-06-09 22:37 - 01358931 ____A (Farbar) C:\Users\Janette\Downloads\FRST.exe
2013-06-09 21:21 - 2013-06-09 21:21 - 00000000 ____D C:\F
2013-06-09 21:20 - 2013-06-09 21:20 - 00000064 ____A C:\Windows\System32\TPAPSLOG.LOG
2013-06-05 12:11 - 2013-06-05 12:11 - 00049935 ____A C:\ComboFix.txt
2013-06-05 11:58 - 2011-06-25 23:45 - 00256000 ____A C:\Windows\PEV.exe
2013-06-05 11:58 - 2010-11-07 10:20 - 00208896 ____A C:\Windows\MBR.exe
2013-06-05 11:58 - 2009-04-19 21:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-06-05 11:58 - 2000-08-30 17:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-06-05 11:58 - 2000-08-30 17:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-06-05 11:58 - 2000-08-30 17:00 - 00098816 ____A C:\Windows\sed.exe
2013-06-05 11:58 - 2000-08-30 17:00 - 00080412 ____A C:\Windows\grep.exe
2013-06-05 11:58 - 2000-08-30 17:00 - 00068096 ____A C:\Windows\zip.exe
2013-06-05 11:42 - 2013-06-05 11:57 - 00001257 ____A C:\Users\Janette\Desktop\usersJanettedownloadsComboFix.exe - Shortcut.lnk
2013-06-05 10:14 - 2013-06-05 10:14 - 00000000 ____D C:\E
2013-06-05 09:23 - 2013-06-05 12:11 - 00000000 ____D C:\Qoobox
2013-06-05 09:22 - 2013-06-05 11:57 - 05077652 ____R (Swearware) C:\Users\Janette\Downloads\ComboFix.exe
2013-06-05 07:12 - 2013-06-05 07:12 - 00000000 ____D C:\D
2013-06-05 05:12 - 2013-06-05 05:12 - 00000116 ____A C:\tvttemp.txt
2013-06-05 05:11 - 2013-06-09 22:38 - 00000000 ____D C:\users\Administrator
2013-06-05 05:11 - 2013-06-05 05:11 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Lenovo
2013-06-04 19:51 - 2013-06-04 19:51 - 00000000 ____D C:\Users\Janette\Documents\mbar-1.06.0.1003
2013-06-04 18:42 - 2013-06-04 18:42 - 02708759 ____A C:\Users\Janette\Desktop\debug.log
2013-06-04 18:19 - 2013-06-04 19:41 - 00000000 ____D C:\Users\Janette\Desktop\RK_Quarantine
2013-06-04 08:04 - 2013-06-04 08:05 - 00017139 ____A C:\Users\Janette\Desktop\dds.txt
2013-06-04 08:04 - 2013-06-04 08:05 - 00013829 ____A C:\Users\Janette\Desktop\attach.txt
2013-06-03 15:27 - 2013-06-03 15:27 - 00000000 ____D C:\ProgramData\AVAST Software
2013-06-03 15:27 - 2013-06-03 15:27 - 00000000 ____D C:\Program Files\AVAST Software
2013-05-31 19:20 - 2013-06-10 16:34 - 00115200 ____A C:\Users\Janette\Documents\8.5x11 blank template.pub
2013-05-24 20:20 - 2013-06-05 01:03 - 00000000 ____D C:\Users\Janette\Documents\Tacoma film Festival
2013-05-24 20:20 - 2013-06-05 01:03 - 00000000 ____D C:\Users\Janette\Documents\Cartoons
2013-05-15 03:16 - 2013-05-05 12:25 - 12324864 ____N (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-15 03:16 - 2013-05-05 12:12 - 02382848 ____N (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-15 03:02 - 2013-04-04 14:57 - 00420864 ____N (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-05-15 03:02 - 2013-04-04 14:54 - 00073216 ____N (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-05-15 03:01 - 2013-04-04 15:11 - 01800704 ____N (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-15 03:01 - 2013-04-04 15:09 - 09738752 ____N (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-15 03:01 - 2013-04-04 15:02 - 01427968 ____N (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-05-15 03:01 - 2013-04-04 15:02 - 01129472 ____N (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-15 03:01 - 2013-04-04 15:02 - 01104384 ____N (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-15 03:01 - 2013-04-04 15:01 - 00231936 ____N (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-15 03:01 - 2013-04-04 14:59 - 00065024 ____N (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-15 03:01 - 2013-04-04 14:58 - 00717824 ____N (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-15 03:01 - 2013-04-04 14:58 - 00142848 ____N (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-05-15 03:01 - 2013-04-04 14:56 - 00607744 ____N (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-15 03:01 - 2013-04-04 14:55 - 01796096 ____N (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-15 03:01 - 2013-04-04 14:50 - 00176640 ____N (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-15 01:25 - 2013-04-15 07:20 - 00638328 ____N (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-15 01:25 - 2013-04-13 03:56 - 00037376 ____N (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-05-15 01:24 - 2013-04-08 18:36 - 02049024 ____N (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-14 16:37 - 2013-05-14 17:57 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-05-13 09:24 - 2013-05-13 09:24 - 03097600 ____N C:\Users\Janette\Documents\Out of the stall frame comp.pub

==================== One Month Modified Files and Folders ========

2013-06-12 18:24 - 2008-02-05 10:40 - 00002032 ____A C:\Users\Janette\AppData\Local\d3d9caps.dat
2013-06-12 13:30 - 2013-06-12 13:30 - 00000000 ____D C:\O
2013-06-12 13:30 - 2006-11-02 05:47 - 00003696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-12 13:29 - 2008-02-01 02:31 - 00000000 ____D C:\SWSHARE
2013-06-12 13:29 - 2006-11-02 06:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-12 13:29 - 2006-11-02 05:47 - 00003696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-12 12:57 - 2013-06-12 12:57 - 00000000 ____D C:\N
2013-06-12 12:31 - 2013-06-12 12:31 - 00000000 ____D C:\M
2013-06-12 12:26 - 2013-06-12 12:26 - 00000000 ____D C:\L
2013-06-11 19:05 - 2013-06-11 19:05 - 00000000 ____D C:\K
2013-06-11 16:41 - 2013-06-11 16:41 - 00000000 ____D C:\J
2013-06-11 08:34 - 2013-06-11 08:34 - 00000000 ____D C:\I
2013-06-10 21:36 - 2012-07-12 21:14 - 00000000 ____D C:\FRST
2013-06-10 21:05 - 2006-11-02 03:33 - 00841748 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-10 20:57 - 2013-06-10 20:57 - 00018944 ____A C:\Users\Janette\Documents\IME Janette Notes June 10 2013.wps
2013-06-10 20:23 - 2013-06-10 20:23 - 00000000 ____D C:\H
2013-06-10 19:57 - 2013-06-10 19:57 - 00000000 ____D C:\G
2013-06-10 19:56 - 2012-02-09 14:09 - 00123070 ____A C:\Windows\PFRO.log
2013-06-10 19:54 - 2013-06-10 19:54 - 01358933 ____A (Farbar) C:\Users\Janette\Desktop\FRST.exe
2013-06-10 19:54 - 2006-11-02 06:01 - 00032612 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-10 19:37 - 2013-06-10 19:37 - 01358933 ____A (Farbar) C:\Users\Janette\Downloads\FRST(2).exe
2013-06-10 19:36 - 2013-06-10 19:36 - 01358933 ____A (Farbar) C:\Users\Janette\Downloads\FRST(1).exe
2013-06-10 19:17 - 2013-04-23 16:00 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-10 18:23 - 2013-06-10 18:23 - 00002044 ____A C:\Users\Janette\Downloads\fixlist.txt
2013-06-10 16:34 - 2013-05-31 19:20 - 00115200 ____A C:\Users\Janette\Documents\8.5x11 blank template.pub
2013-06-09 22:48 - 2013-06-09 22:48 - 00000556 ____A C:\Users\Janette\Desktop\Addition - Shortcut.lnk
2013-06-09 22:48 - 2013-06-09 22:48 - 00000532 ____A C:\Users\Janette\Desktop\FRST - Shortcut (2).lnk
2013-06-09 22:47 - 2013-06-09 22:47 - 00004096 ____A C:\conf.dat
2013-06-09 22:47 - 2013-06-09 22:47 - 00000532 ____A C:\Users\Janette\Desktop\FRST - Shortcut.lnk
2013-06-09 22:39 - 2013-06-09 22:39 - 00060343 ____A C:\Users\Janette\Downloads\FRST.txt
2013-06-09 22:39 - 2013-06-09 22:38 - 00023701 ____A C:\Users\Janette\Downloads\Addition.txt
2013-06-09 22:38 - 2013-06-05 05:11 - 00000000 ____D C:\users\Administrator
2013-06-09 22:37 - 2013-06-09 22:37 - 01358931 ____A (Farbar) C:\Users\Janette\Downloads\FRST.exe
2013-06-09 21:21 - 2013-06-09 21:21 - 00000000 ____D C:\F
2013-06-09 21:20 - 2013-06-09 21:20 - 00000064 ____A C:\Windows\System32\TPAPSLOG.LOG
2013-06-05 12:11 - 2013-06-05 12:11 - 00049935 ____A C:\ComboFix.txt
2013-06-05 12:11 - 2013-06-05 09:23 - 00000000 ____D C:\Qoobox
2013-06-05 11:59 - 2006-11-02 04:18 - 00000000 ___RD C:\users\Public
2013-06-05 11:57 - 2013-06-05 11:42 - 00001257 ____A C:\Users\Janette\Desktop\usersJanettedownloadsComboFix.exe - Shortcut.lnk
2013-06-05 11:57 - 2013-06-05 09:22 - 05077652 ____R (Swearware) C:\Users\Janette\Downloads\ComboFix.exe
2013-06-05 10:14 - 2013-06-05 10:14 - 00000000 ____D C:\E
2013-06-05 07:12 - 2013-06-05 07:12 - 00000000 ____D C:\D
2013-06-05 05:15 - 2006-11-02 05:47 - 03882520 ____A C:\Windows\System32\FNTCACHE.DAT
2013-06-05 05:12 - 2013-06-05 05:12 - 00000116 ____A C:\tvttemp.txt
2013-06-05 05:11 - 2013-06-05 05:11 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Lenovo
2013-06-05 05:06 - 2006-11-02 05:37 - 00000000 ____D C:\Windows\System32\XPSViewer
2013-06-05 05:06 - 2006-11-02 05:37 - 00000000 ____D C:\Windows\System32\restore
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\tapi
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\zh-TW
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\zh-HK
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\zh-CN
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\uk-UA
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\tr-TR
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\th-TH
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\sv-SE
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\sr-Latn-CS
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\SLUI
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\sl-SI
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\sk-SK
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\ru-RU
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\ras
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\pt-PT
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\pt-BR
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\pl-PL
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\nl-NL
2013-06-05 05:06 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\nb-NO
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\Msdtc
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\lv-LV
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\lt-LT
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\ko-KR
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\ja-JP
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\it-IT
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\icsxml
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\hu-HU
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\hr-HR
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\he-IL
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\fr-FR
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\fi-FI
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\et-EE
2013-06-05 05:05 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\el-GR
2013-06-05 05:04 - 2008-02-01 02:43 - 00000000 ____D C:\Windows\System32\DLA
2013-06-05 05:04 - 2008-02-01 02:34 - 00000000 ___HD C:\Windows\System32\(null)
2013-06-05 05:04 - 2006-11-02 05:37 - 00000000 ____D C:\Windows\ShellNew
2013-06-05 05:04 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-05 05:04 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\com
2013-06-05 05:04 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\bg-BG
2013-06-05 05:04 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\ar-SA
2013-06-05 05:03 - 2006-11-09 18:04 - 00000000 ____D C:\Windows\Panther
2013-06-05 05:03 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\registration
2013-06-05 05:03 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\MSAgent
2013-06-05 05:03 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\L2Schemas
2013-06-05 05:03 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\Help
2013-06-05 05:02 - 2008-02-05 13:56 - 00000000 ___HD C:\Users\Janette\Documents\Stiles Collection Misc. Forms and Business Cards
2013-06-05 05:02 - 2008-02-05 12:16 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Thunderbird
2013-06-05 05:02 - 2008-02-05 10:40 - 00000000 ____D C:\users\Janette
2013-06-05 05:02 - 2008-02-01 01:28 - 00000000 ____D C:\WAUUPGRD
2013-06-05 05:02 - 2006-11-09 12:54 - 00000000 ____D C:\SWTOOLS
2013-06-05 05:02 - 2006-11-02 04:18 - 00000000 __RHD C:\users\Default
2013-06-05 05:02 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\Cursors
2013-06-05 05:01 - 2008-02-06 12:39 - 00000000 ___HD C:\ProgramData\SiteAdvisor
2013-06-05 05:01 - 2008-02-05 16:35 - 00000000 ____D C:\Program Files\Yahoo SiteBuilder
2013-06-05 05:01 - 2008-02-01 03:26 - 00000000 ____D C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
2013-06-05 05:01 - 2008-02-01 03:20 - 00000000 ____D C:\Program Files\Sonic Icons for Lenovo
2013-06-05 05:01 - 2008-02-01 02:42 - 00000000 ___HD C:\ProgramData\Sonic
2013-06-05 05:01 - 2008-02-01 02:42 - 00000000 ____D C:\Program Files\Roxio
2013-06-05 05:01 - 2006-11-02 05:37 - 00000000 ____D C:\Program Files\Windows Defender
2013-06-05 05:01 - 2006-11-02 05:37 - 00000000 ____D C:\Program Files\Windows Collaboration
2013-06-05 05:00 - 2008-02-06 12:10 - 00000000 ____D C:\Program Files\Microsoft CAPICOM 2.1.0.2
2013-06-05 05:00 - 2008-02-01 03:24 - 00000000 ____D C:\Program Files\Microsoft Works
2013-06-05 05:00 - 2008-02-01 02:43 - 00000000 ____D C:\Program Files\Common Files\SureThing Shared
2013-06-05 05:00 - 2008-02-01 02:42 - 00000000 ____D C:\Program Files\Common Files\Sonic Shared
2013-06-05 05:00 - 2008-02-01 02:39 - 00000000 ____D C:\Program Files\Lenovo Registration
2013-06-05 05:00 - 2008-02-01 02:23 - 00000000 ____D C:\Program Files\Common Files\snp2uvc
2013-06-05 05:00 - 2008-02-01 02:19 - 00000000 ____D C:\Program Files\Digital Line Detect
2013-06-05 05:00 - 2008-02-01 02:14 - 00000000 ____D C:\Program Files\Lenovo
2013-06-05 05:00 - 2006-11-02 05:37 - 00000000 ____D C:\Program Files\Movie Maker
2013-06-05 05:00 - 2006-11-02 04:18 - 00000000 ____D C:\Program Files\Common Files\Services
2013-06-05 04:59 - 2008-02-01 03:24 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2013-06-05 04:59 - 2008-02-01 02:42 - 00000000 ____D C:\Program Files\Common Files\PX Storage Engine
2013-06-05 04:59 - 2008-02-01 02:34 - 00000000 ____D C:\Program Files\Common Files\Lenovo
2013-06-05 04:43 - 2009-07-09 13:57 - 00000000 ____D C:\Windows\System32\vi-VN
2013-06-05 04:43 - 2009-07-09 13:57 - 00000000 ____D C:\Windows\System32\eu-ES
2013-06-05 04:43 - 2009-07-09 13:29 - 00000000 ____D C:\Windows\System32\EventProviders
2013-06-05 04:43 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\ro-RO
2013-06-05 04:43 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\ias
2013-06-05 04:42 - 2012-07-11 10:45 - 00000000 ____D C:\Windows\System32\config\RCCBakup
2013-06-05 04:42 - 2006-11-02 04:18 - 00000000 ___HD C:\Windows\System32\config\Journal
2013-06-05 04:41 - 2012-07-10 15:26 - 00000000 ____D C:\Windows\pss
2013-06-05 04:41 - 2011-06-17 20:11 - 00000000 ____D C:\Windows\PeachInst
2013-06-05 04:41 - 2009-10-15 09:15 - 00000000 ____D C:\Windows\SQL9_KB970892_ENU
2013-06-05 04:41 - 2009-07-09 13:57 - 00000000 ____D C:\Windows\System32\ca-ES
2013-06-05 04:41 - 2009-02-12 08:41 - 00000000 ____D C:\Windows\SQL9_KB960089_ENU
2013-06-05 04:41 - 2008-07-09 03:01 - 00000000 ____D C:\Windows\SQL9_KB948109_ENU
2013-06-05 04:41 - 2006-11-02 04:18 - 00000000 ___RD C:\Windows\Offline Web Pages
2013-06-05 04:41 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\AdvancedInstallers
2013-06-05 04:41 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\rescache
2013-06-05 04:41 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-06-05 04:34 - 2010-06-24 19:16 - 00000000 ____D C:\Windows\hpoj6000e609
2013-06-05 04:34 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\IME
2013-06-05 04:33 - 2006-11-02 05:37 - 00000000 ____D C:\Windows\DigitalLocker
2013-06-05 04:29 - 2008-09-12 13:26 - 00000000 ____D C:\Users\Janette\{f606a019-4024-4ff7-8989-d0a2c7e4ed9f}
2013-06-05 04:29 - 2006-11-02 05:37 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-06-05 04:25 - 2012-07-19 09:10 - 00000000 ___HD C:\Users\Janette\Downloads\Rebit
2013-06-05 04:25 - 2011-03-01 09:07 - 00000000 ___HD C:\Users\Janette\Downloads\__MACOSX
2013-06-05 04:24 - 2013-04-10 12:56 - 00000000 ____D C:\Users\Janette\Documents\Out of the stall comps and stuff
2013-06-05 04:24 - 2013-03-21 13:21 - 00000000 ____D C:\Users\Janette\Documents\Ocean Shores entries
2013-06-05 04:24 - 2013-03-03 09:56 - 00000000 ____D C:\Users\Janette\Documents\Puyallup Fair projects
June 12th, 2013, 09:37 PM
rollie

2013-06-05 04:24 - 2013-02-11 20:00 - 00000000 ____D C:\Users\Janette\Documents\Neighborhood Crap
2013-06-05 04:24 - 2013-01-20 12:17 - 00000000 ____D C:\Users\Janette\Documents\Rollie Photos only used in video January 2013
2013-06-05 04:24 - 2013-01-15 19:32 - 00000000 ____D C:\Users\Janette\Documents\Rollie
2013-06-05 04:24 - 2013-01-11 21:34 - 00000000 ____D C:\Users\Janette\Documents\Proctor Arts Fest 2013
2013-06-05 04:24 - 2012-12-08 16:17 - 00000000 ____D C:\Users\Janette\Documents\TAC Awards Projects
2013-06-05 04:24 - 2010-05-24 19:00 - 00000000 ___HD C:\Users\Janette\Documents\Stiles, Phyllis info and legal
2013-06-05 04:24 - 2009-02-05 15:40 - 00000000 ___HD C:\Users\Janette\Documents\Rollie's Radios
2013-06-05 04:24 - 2008-02-10 13:48 - 00000000 ___RD C:\Users\Janette\Documents\Stiles Collection Catalog of Art
2013-06-05 04:24 - 2008-02-09 14:32 - 00000000 ___HD C:\Users\Janette\Documents\Stiles Collection Work Sheets
2013-06-05 04:24 - 2008-02-09 14:31 - 00000000 ___HD C:\Users\Janette\Documents\Stiles Collection Paintings 2013
2013-06-05 04:23 - 2013-01-30 12:09 - 00000000 ____D C:\Users\Janette\Documents\Artwork New in 2013
2013-06-05 04:23 - 2013-01-10 15:09 - 00000000 ____D C:\Users\Janette\Documents\Light painting photos coverted
2013-06-05 04:23 - 2013-01-07 20:36 - 00000000 ____D C:\Users\Janette\Documents\Mandala project 2013
2013-06-05 04:23 - 2012-11-21 12:58 - 00000000 ____D C:\Users\Janette\Documents\Artwork for GLOBAL COLORS Video
2013-06-05 04:23 - 2012-11-04 11:42 - 00000000 ____D C:\Users\Janette\Documents\Facebook
2013-06-05 04:23 - 2012-08-03 20:07 - 00000000 ____D C:\Users\Janette\Documents\Joe's e-mails
2013-06-05 04:23 - 2011-12-13 14:17 - 00000000 ___HD C:\Users\Janette\Documents\BookSmartData
2013-06-05 04:23 - 2010-12-29 12:12 - 00000000 ___HD C:\Users\Janette\Documents\HCG info
2013-06-05 04:23 - 2010-10-08 15:52 - 00000000 ____D C:\Users\Janette\Documents\Joe Misc and Medical
2013-06-05 04:23 - 2009-07-08 15:50 - 00000000 ___HD C:\Users\Janette\Documents\Janette Correspondence and self portraits
2013-06-05 04:22 - 2013-04-23 15:52 - 00000000 ____D C:\Users\Janette\Documents\Art Show Photos
2013-06-05 04:22 - 2012-07-18 12:35 - 00000000 ____D C:\Users\Janette\Documents\Artists Resume and Statement
2013-06-05 04:22 - 2009-05-21 10:11 - 00000000 ___HD C:\Users\Janette\Documents\Anne Bray Correspondence
2013-06-05 04:21 - 2012-07-12 21:22 - 00000000 ____D C:\Users\Janette\AppData\Roaming\PwrMgr
2013-06-05 04:21 - 2011-10-22 18:41 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\PeaceCraft2
2013-06-05 04:21 - 2011-10-22 17:36 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Peace Craft
2013-06-05 04:21 - 2011-10-03 20:28 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Realore_Whiterra Roads Of Rome 3
2013-06-05 04:21 - 2011-06-13 10:10 - 00000000 ____D C:\Users\Janette\Citrix
2013-06-05 04:21 - 2010-12-21 21:32 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Realore_Whiterra Roads Of Rome 2
2013-06-05 04:21 - 2010-11-06 17:31 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Realore_Whiterra Roads Of Rome
2013-06-05 04:21 - 2009-06-16 20:03 - 00000000 ____D C:\Users\Janette\AppData\Roaming\SystemRequirementsLab
2013-06-05 04:21 - 2008-12-20 12:37 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Real
2013-06-05 04:21 - 2008-12-01 15:31 - 00000000 ___HD C:\Users\Janette\Documents\Address Labels
2013-06-05 04:21 - 2008-06-06 19:31 - 00000000 ____D C:\Users\Janette\AppData\Roaming\SpinTop
2013-06-05 04:16 - 2012-07-21 14:39 - 00000000 ____D C:\Users\Janette\AppData\Roaming\DriverCure
2013-06-05 04:16 - 2010-09-05 15:02 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Enlightenus2SE_BFG
2013-06-05 04:16 - 2010-07-02 09:35 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\HpUpdate
2013-06-05 04:16 - 2010-01-17 19:09 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Enlightenus
2013-06-05 04:16 - 2009-12-30 20:46 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\GhostFleet
2013-06-05 04:16 - 2009-03-15 19:04 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Lost in the City
2013-06-05 04:16 - 2009-02-15 21:47 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Coyotes Tale
2013-06-05 04:16 - 2009-01-18 19:19 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Ancient Quest of Saqqarah__bfg
2013-06-05 04:16 - 2008-08-03 19:30 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\ForgottenRiddles2
2013-06-05 04:16 - 2008-06-15 18:30 - 00000000 ____D C:\Users\Janette\AppData\Roaming\GameHouse
2013-06-05 04:16 - 2008-02-09 14:44 - 00000000 ____D C:\Users\Janette\AppData\Roaming\FUJIFILM
2013-06-05 04:14 - 2008-02-05 10:45 - 00000000 ___HD C:\Users\Janette\AppData\Local\Roxio
2013-06-05 04:13 - 2011-12-13 14:17 - 00000000 ____D C:\Users\Janette\.blurb
2013-06-05 04:13 - 2011-05-23 13:48 - 00000000 ___HD C:\Users\Janette\AppData\Local\Help
2013-06-05 04:13 - 2010-03-26 15:54 - 00000000 ___HD C:\Users\Janette\AppData\Local\Brain Games Mahjongg Files
2013-06-05 04:13 - 2008-11-14 22:28 - 00000000 ___HD C:\Users\Janette\AppData\Local\Game Mill Files
2013-06-05 04:13 - 2008-02-16 13:12 - 00000000 ____D C:\Users\Janette\AppData\Local\Microsoft Help
2013-06-05 04:10 - 2011-09-04 12:05 - 00000000 ___HD C:\ProgramData\regid.1986-12.com.adobe
2013-06-05 04:10 - 2010-06-24 19:20 - 00000000 ___HD C:\ProgramData\WEBREG
2013-06-05 04:10 - 2009-12-27 14:00 - 00000000 ___HD C:\ProgramData\The Mirror Mysteries
2013-06-05 04:10 - 2009-06-20 13:08 - 00000000 __HDC C:\ProgramData\{66E2F539-12B6-4870-A500-7689CDE75C5E}
2013-06-05 04:10 - 2008-02-09 13:31 - 00000000 ___HD C:\ProgramData\QuickTime
2013-06-05 04:09 - 2009-02-10 16:01 - 00000000 ___HD C:\ProgramData\MysteryChronicles
2013-06-05 04:09 - 2008-07-30 15:48 - 00000000 ___HD C:\ProgramData\MonteCristo
2013-06-05 04:09 - 2008-06-15 18:43 - 00000000 ____D C:\ProgramData\n7-89-o9-3r-4t-r9
2013-06-05 04:09 - 2008-02-01 03:22 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-05 04:08 - 2008-02-05 11:09 - 00000000 ____D C:\ProgramData\McAfee
2013-06-05 04:07 - 2010-07-02 09:33 - 00000000 ____D C:\ProgramData\HP Product Assistant
2013-06-05 04:07 - 2009-06-20 13:03 - 00000000 ___HD C:\ProgramData\DriverScanner
2013-06-05 04:07 - 2008-07-27 18:43 - 00000000 ___HD C:\ProgramData\Arcade Lab
2013-06-05 04:06 - 2012-07-31 21:06 - 00000000 ____D C:\Program Files\Seagate Replica
2013-06-05 04:06 - 2009-10-31 03:09 - 00000000 ____D C:\Program Files\Windows Portable Devices
2013-06-05 04:06 - 2009-06-16 20:04 - 00000000 ____D C:\Program Files\SystemRequirementsLab
2013-06-05 04:06 - 2008-09-13 12:02 - 00000000 ____D C:\Program Files\SmartAudioConverter
2013-06-05 04:06 - 2008-02-05 10:40 - 00000000 ____D C:\Program Files\Windows Live Toolbar
2013-06-05 04:06 - 2006-11-02 05:37 - 00000000 ____D C:\Program Files\Windows Calendar
2013-06-05 04:05 - 2013-04-18 20:52 - 00000000 ____D C:\Program Files\QuickTime
2013-06-05 04:05 - 2012-05-02 11:24 - 00000000 ____D C:\Program Files\Roads of Rome III
2013-06-05 04:05 - 2008-12-20 12:37 - 00000000 ____D C:\Program Files\Rhapsody
2013-06-05 04:04 - 2013-04-12 09:59 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-06-05 04:03 - 2011-03-07 14:48 - 00000000 ____D C:\Program Files\Mandala Painter 3
2013-06-05 04:03 - 2006-11-02 05:42 - 00000000 ____D C:\Windows\WindowsMobile
2013-06-05 04:02 - 2012-07-11 14:36 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-05 04:02 - 2011-02-24 04:03 - 00000000 ____D C:\Windows\System32\WindowsPowerShell
2013-06-05 04:02 - 2006-11-02 05:42 - 00000000 ____D C:\Windows\System32\winrm
2013-06-05 04:02 - 2006-11-02 05:42 - 00000000 ____D C:\Windows\System32\WCN
2013-06-05 04:02 - 2006-11-02 04:18 - 00000000 ___HD C:\Windows\System32\winevt
2013-06-05 04:02 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\Web
2013-06-05 04:01 - 2006-11-02 05:42 - 00000000 ____D C:\Windows\System32\slmgr
2013-06-05 04:01 - 2006-11-02 05:42 - 00000000 ____D C:\Windows\System32\Printing_Admin_Scripts
2013-06-05 04:01 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\SMI
2013-06-05 04:01 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\RemInst
2013-06-05 04:00 - 2008-02-01 02:27 - 00000000 ____D C:\Windows\System32\Lang
2013-06-05 04:00 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\networklist
2013-06-05 04:00 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\MUI
2013-06-05 04:00 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\LogFiles
2013-06-05 04:00 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\licensing
2013-06-05 03:59 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\IME
2013-06-05 03:58 - 2012-07-14 15:41 - 00000000 ____D C:\Program Files\Free Download Manager
2013-06-05 03:58 - 2011-02-23 19:34 - 00000000 ____D C:\Program Files\FinePixViewer
2013-06-05 03:58 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\DriverStore
2013-06-05 03:57 - 2012-11-14 15:02 - 00000000 ____D C:\Program Files\ConvertHelper
2013-06-05 03:57 - 2011-06-17 21:03 - 00000000 ____D C:\Program Files\Common Files\Peach
2013-06-05 03:56 - 2011-09-04 11:05 - 00000000 ____D C:\Program Files\Common Files\Adobe AIR
2013-06-05 03:54 - 2012-03-26 19:02 - 00000000 ____D C:\Program Files\Adobe Download Assistant
2013-06-05 03:54 - 2012-02-28 14:59 - 00000000 ____D C:\Program Files\bfgclient
2013-06-05 03:54 - 2012-02-14 16:14 - 00000000 ____D C:\Program Files\Bonjour
2013-06-05 03:52 - 2008-02-08 16:55 - 00000000 ____D C:\EPSONREG
2013-06-05 03:52 - 2008-02-01 02:35 - 00000000 ____D C:\Icons
2013-06-05 03:50 - 2006-11-02 04:18 - 00000000 ___HD C:\Windows\System32\wfp
2013-06-05 03:50 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\System32\spool
2013-06-05 03:48 - 2012-07-21 12:33 - 00000000 ____D C:\Windows\Sun
2013-06-05 03:48 - 2008-07-11 13:06 - 00000000 ____D C:\Windows\System32\Adobe
2013-06-05 03:48 - 2006-11-02 05:42 - 00000000 ___HD C:\Windows\System32\Branding
2013-06-05 03:43 - 2008-02-01 03:24 - 00000000 ____D C:\Windows\PCHEALTH
2013-06-05 03:43 - 2006-11-02 05:37 - 00000000 ____D C:\Windows\Performance
2013-06-05 03:43 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\security
2013-06-05 03:43 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\schemas
2013-06-05 03:43 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\Resources
2013-06-05 03:43 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\Provisioning
2013-06-05 03:43 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\PLA
2013-06-05 03:43 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\nap
2013-06-05 03:41 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\LiveKernelReports
2013-06-05 03:39 - 2010-07-02 09:35 - 00000000 ____D C:\Windows\Hewlett-Packard
2013-06-05 03:38 - 2008-02-01 02:58 - 00000000 ____D C:\Windows\Downloaded Installations
2013-06-05 03:38 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\Branding
2013-06-05 03:37 - 2012-07-25 09:25 - 00000000 ____D C:\Users\Janette\Yahoo SiteBuilder
2013-06-05 03:37 - 2012-04-03 20:20 - 00000000 ____D C:\Users\Public\Documents\Downloaded Installers
2013-06-05 03:37 - 2010-01-18 20:59 - 00000000 ___HD C:\Users\Public\Documents\bigfish
2013-06-05 03:37 - 2009-05-16 15:02 - 00000000 ___HD C:\Users\Public\Documents\Slapdash Games
2013-06-05 03:35 - 2012-07-25 09:12 - 00000000 ____D C:\Users\Janette\sitebuilder
2013-06-05 03:35 - 2012-04-13 16:56 - 00000000 ___HD C:\Users\Janette\Downloads\Driver Tool
2013-06-05 03:34 - 2012-07-21 14:39 - 00000000 ____D C:\Users\Janette\AppData\Roaming\SpeedyPC Software
2013-06-05 03:34 - 2011-12-28 16:23 - 00000000 ___HD C:\Users\Janette\Documents\Amazon MP3
2013-06-05 03:34 - 2011-10-22 19:56 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\YoudaGames
2013-06-05 03:34 - 2011-09-04 12:11 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\PDAppFlex
2013-06-05 03:34 - 2011-06-19 19:27 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\WendigoStudios
2013-06-05 03:34 - 2011-06-17 21:13 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Peachtree
2013-06-05 03:34 - 2011-05-16 12:48 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\POV-Ray
2013-06-05 03:34 - 2010-09-16 14:04 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Vogat Interactive
2013-06-05 03:34 - 2010-07-31 16:16 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Vast Studios
2013-06-05 03:34 - 2010-06-18 07:12 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Update
2013-06-05 03:34 - 2010-01-29 19:44 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\SevenSails
2013-06-05 03:34 - 2010-01-01 12:56 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Skunk Studios
2013-06-05 03:34 - 2009-12-22 16:44 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Scholastic
2013-06-05 03:34 - 2009-06-20 13:03 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Uniblue
2013-06-05 03:34 - 2009-02-28 19:17 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\SerpentOfIsis
2013-06-05 03:34 - 2008-06-23 20:44 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\WildTangent
2013-06-05 03:34 - 2008-06-23 19:24 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\VeniceMysteryData
2013-06-05 03:34 - 2008-06-07 11:53 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\PlayFirst
2013-06-05 03:34 - 2008-02-05 12:07 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Talkback
2013-06-05 03:33 - 2012-04-15 10:38 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\PCDr
2013-06-05 03:33 - 2009-11-30 19:45 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Orneon
2013-06-05 03:33 - 2009-11-20 16:29 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\MysteryStudio
2013-06-05 03:33 - 2009-06-22 18:18 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\NCH Swift Sound
2013-06-05 03:05 - 2010-12-03 23:47 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\FastStone
2013-06-05 03:05 - 2010-09-18 12:13 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Freeze Tag
2013-06-05 03:05 - 2010-01-20 11:40 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Flood Light Games
2013-06-05 03:05 - 2009-10-11 17:49 - 00000000 ____D C:\Users\Janette\AppData\Roaming\ERS G-Studio
2013-06-05 03:05 - 2009-01-18 15:18 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Meridian93
2013-06-05 03:05 - 2008-11-22 20:12 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\iWinArcade
2013-06-05 03:05 - 2008-11-05 13:40 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\InterVideo
2013-06-05 03:05 - 2008-08-30 14:36 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Google
2013-06-05 03:05 - 2008-06-17 19:33 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\iWin
2013-06-05 03:05 - 2008-02-23 12:04 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Macromedia
2013-06-05 03:05 - 2008-02-08 17:08 - 00000000 ____D C:\Users\Janette\AppData\Roaming\EPSON
2013-06-05 03:05 - 2008-02-08 16:49 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\InstallShield
2013-06-05 03:05 - 2008-02-05 11:16 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Leadertech
2013-06-05 03:05 - 2008-02-05 10:45 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Lenovo
2013-06-05 03:04 - 2012-12-02 18:05 - 00000000 ____D C:\Users\Janette\AppData\Local\Xenocode
2013-06-05 03:04 - 2012-02-09 16:08 - 00000000 ____D C:\Users\Janette\AppData\Local\VS Revo Group
2013-06-05 03:04 - 2011-09-04 14:31 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2013-06-05 03:04 - 2011-09-04 11:06 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
2013-06-05 03:04 - 2011-06-19 19:18 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Elephant Games
2013-06-05 03:04 - 2010-10-09 15:11 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Artifex Mundi
2013-06-05 03:04 - 2010-03-19 18:21 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\AzuazGames
2013-06-05 03:04 - 2010-01-26 20:12 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\BigFishGames
2013-06-05 03:04 - 2009-10-17 16:09 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Awem
2013-06-05 03:04 - 2009-07-01 14:08 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Downloaded Installations
2013-06-05 03:04 - 2009-06-22 16:03 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Amazon
2013-06-05 03:04 - 2009-02-14 10:26 - 00000000 ____D C:\Users\Janette\AppData\Roaming\CatmoonGames
2013-06-05 03:04 - 2008-10-09 09:32 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Canneverbe_Limited
2013-06-05 03:04 - 2008-09-13 12:34 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\Apple Computer
2013-06-05 03:04 - 2008-08-12 12:21 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Big Fish Games
2013-06-05 03:04 - 2008-06-18 19:02 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\AlwaysNeat
2013-06-05 03:04 - 2008-06-14 12:56 - 00000000 ___HD C:\Users\Janette\AppData\Roaming\cerasus.media
2013-06-05 03:04 - 2008-02-05 10:45 - 00000000 ____D C:\Users\Janette\AppData\Roaming\Adobe
2013-06-05 03:04 - 2008-02-05 10:40 - 00000000 ____D C:\Users\Janette\AppData\Local\VirtualStore
2013-06-05 03:03 - 2008-02-05 12:16 - 00000000 ___HD C:\Users\Janette\AppData\Local\Thunderbird
2013-06-05 03:02 - 2009-05-16 15:02 - 00000000 ___HD C:\Users\Janette\AppData\Local\Slapdash Games
2013-06-05 03:02 - 2009-03-20 19:37 - 00000000 ___HD C:\Users\Janette\AppData\Local\Ph03nixNewMedia
2013-06-05 03:01 - 2012-12-02 18:13 - 00000000 ____D C:\Users\Janette\AppData\Local\Badger I.T
2013-06-05 03:01 - 2012-07-11 21:38 - 00000000 ____D C:\Users\Janette\AppData\Local\Lenovo
2013-06-05 03:01 - 2012-06-28 10:15 - 00000000 ___HD C:\Users\Janette\AppData\Local\Macromedia
2013-06-05 03:01 - 2012-02-08 12:18 - 00000000 ____D C:\Users\Janette\AppData\Local\BVRP Software
2013-06-05 03:01 - 2011-09-04 11:05 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2013-06-05 03:01 - 2011-09-04 11:05 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2013-06-05 03:01 - 2011-07-07 11:15 - 00000000 ___HD C:\Users\Janette\AppData\Local\IsolatedStorage
2013-06-05 03:01 - 2008-09-13 12:34 - 00000000 ___HD C:\Users\Janette\AppData\Local\Apple Computer
2013-06-05 03:01 - 2008-09-13 12:32 - 00000000 ___HD C:\Users\Janette\AppData\Local\Apple
2013-06-05 03:01 - 2008-08-29 19:52 - 00000000 ___HD C:\Users\Janette\AppData\Local\Google
2013-06-05 03:01 - 2008-06-06 19:31 - 00000000 ____D C:\Users\Janette\AppData\Local\JollyBear
2013-06-05 03:01 - 2008-05-09 19:49 - 00000000 ____D C:\Users\Janette\AppData\Local\Microsoft Games
2013-06-05 03:01 - 2008-02-05 13:59 - 00000000 ____D C:\Users\Janette\AppData\Local\Adobe
2013-06-05 02:55 - 2011-04-06 13:21 - 00000000 ___HD C:\ProgramData\WindowsSearch
2013-06-05 02:55 - 2008-08-09 21:47 - 00000000 ___HD C:\ProgramData\Zylom
2013-06-05 02:55 - 2008-06-23 20:44 - 00000000 ____D C:\ProgramData\WildTangent
2013-06-05 02:55 - 2008-02-07 14:47 - 00000000 ___HD C:\ProgramData\Xerox
2013-06-05 02:53 - 2012-07-21 14:38 - 00000000 ____D C:\ProgramData\SpeedyPC Software
2013-06-05 02:53 - 2010-03-30 09:40 - 00000000 ___HD C:\ProgramData\Sun
2013-06-05 02:53 - 2009-11-23 14:50 - 00000000 ____D C:\ProgramData\PCDr
2013-06-05 02:53 - 2009-07-06 20:03 - 00000000 ___HD C:\ProgramData\Trymedia
2013-06-05 02:53 - 2009-05-16 15:02 - 00000000 ___HD C:\ProgramData\Slapdash Games
2013-06-05 02:53 - 2009-01-07 16:24 - 00000000 ___HD C:\ProgramData\SpecialBit
2013-06-05 02:53 - 2008-12-24 14:07 - 00000000 ___HD C:\ProgramData\PlayPond
2013-06-05 02:53 - 2008-06-10 15:17 - 00000000 ___HD C:\ProgramData\VirtualFarm
2013-06-05 02:53 - 2008-06-09 20:23 - 00000000 ___HD C:\ProgramData\Playrix Entertainment
2013-06-05 02:53 - 2008-06-07 11:53 - 00000000 ___HD C:\ProgramData\PlayFirst
2013-06-05 02:53 - 2008-06-06 20:41 - 00000000 ____D C:\ProgramData\SpinTopV1005
2013-06-05 02:53 - 2008-02-01 03:15 - 00000000 ___HD C:\ProgramData\Symantec
2013-06-05 02:49 - 2012-04-13 19:55 - 00000000 ____D C:\ProgramData\Norton
2013-06-05 02:49 - 2010-09-07 19:56 - 00000000 ___HD C:\ProgramData\MumboJumbo
2013-06-05 02:49 - 2010-01-22 04:24 - 00000000 ___HD C:\ProgramData\Office Genuine Advantage
2013-06-05 02:49 - 2009-06-22 18:18 - 00000000 ___HD C:\ProgramData\NCH Swift Sound
2013-06-05 02:49 - 2009-06-20 13:23 - 00000000 ____D C:\ProgramData\PC Drivers HeadQuarters
2013-06-05 02:48 - 2009-01-18 15:19 - 00000000 ___HD C:\ProgramData\Meridian93
2013-06-05 02:48 - 2008-06-22 13:51 - 00000000 ___HD C:\ProgramData\Media Art
2013-06-05 02:46 - 2012-04-13 16:55 - 00000000 ____D C:\ProgramData\Driver Tool
2013-06-05 02:46 - 2011-06-19 19:18 - 00000000 ___HD C:\ProgramData\Elephant Games
2013-06-05 02:46 - 2010-06-30 19:24 - 00000000 ___HD C:\ProgramData\Google
2013-06-05 02:46 - 2010-06-24 18:38 - 00000000 ____D C:\ProgramData\HP
2013-06-05 02:46 - 2010-01-20 11:40 - 00000000 ___HD C:\ProgramData\Flood Light Games
2013-06-05 02:46 - 2009-12-30 20:46 - 00000000 ___HD C:\ProgramData\GhostFleet
2013-06-05 02:46 - 2008-11-22 20:12 - 00000000 ____D C:\ProgramData\iWin Games
2013-06-05 02:46 - 2008-06-24 20:34 - 00000000 ____D C:\ProgramData\HipSoft
2013-06-05 02:46 - 2008-06-06 19:31 - 00000000 ___HD C:\ProgramData\JollyBear
2013-06-05 02:46 - 2008-02-01 02:39 - 00000000 ____D C:\ProgramData\Lenovo
2013-06-05 02:45 - 2012-04-14 10:25 - 00000000 ___HD C:\ProgramData\DDNI
2013-06-05 02:45 - 2012-04-12 09:17 - 00000000 ____D C:\ProgramData\Driver Manager
2013-06-05 02:45 - 2011-09-21 15:24 - 00000000 ____D C:\ProgramData\Cateia Games
2013-06-05 02:45 - 2010-12-20 15:55 - 00000000 ____D C:\ProgramData\Big Fish Games
2013-06-05 02:45 - 2009-04-01 14:35 - 00000000 ___HD C:\ProgramData\Black Blob Studios
2013-06-05 02:45 - 2008-06-14 12:56 - 00000000 ___HD C:\ProgramData\cerasus.media
2013-06-05 02:44 - 2013-04-18 20:52 - 00000000 ____D C:\ProgramData\Apple Computer
2013-06-05 02:44 - 2011-06-17 21:04 - 00000000 ___HD C:\ProgramData\Aatrix Software
2013-06-05 02:44 - 2009-01-17 18:44 - 00000000 ___HD C:\ProgramData\Awem
2013-06-05 02:44 - 2008-12-28 10:47 - 00000000 ___HD C:\ProgramData\Alawar Stargaze
2013-06-05 02:44 - 2008-09-13 12:31 - 00000000 ____D C:\ProgramData\Apple
2013-06-05 02:44 - 2008-02-01 02:36 - 00000000 ____D C:\ProgramData\Adobe
2013-06-05 02:43 - 2012-12-29 16:47 - 00000000 ____D C:\Program Files\ValuSoft
2013-06-05 02:43 - 2012-02-09 16:08 - 00000000 ____D C:\Program Files\VS Revo Group
2013-06-05 02:43 - 2008-02-01 02:35 - 00000000 ____D C:\Program Files\ThinkVantage
2013-06-05 02:43 - 2006-11-02 04:18 - 00000000 ____D C:\Program Files\Windows NT
2013-06-05 02:42 - 2012-04-13 09:09 - 00000000 ____D C:\Program Files\Seagate
2013-06-05 02:42 - 2008-12-20 16:28 - 00000000 ____D C:\Program Files\SanDisk
2013-06-05 02:42 - 2008-09-12 13:29 - 00000000 ____D C:\Program Files\Sun
2013-06-05 02:42 - 2008-02-01 02:20 - 00000000 ____D C:\Program Files\Synaptics
2013-06-05 02:42 - 2008-02-01 02:16 - 00000000 ____D C:\Program Files\ThinkPad
2013-06-05 02:41 - 2011-06-17 20:27 - 00000000 ____D C:\Program Files\Sage Software
2013-06-05 02:41 - 2008-12-20 12:38 - 00000000 ____D C:\Program Files\Real
2013-06-05 02:41 - 2006-11-02 05:37 - 00000000 ____D C:\Program Files\Reference Assemblies
2013-06-05 02:40 - 2011-06-17 20:28 - 00000000 ____D C:\Program Files\Pervasive Software
2013-06-05 02:40 - 2009-06-22 18:18 - 00000000 ____D C:\Program Files\NCH Software
2013-06-05 02:40 - 2008-02-01 03:26 - 00000000 ____D C:\Program Files\Microsoft SQL Server
2013-06-05 02:40 - 2008-02-01 03:24 - 00000000 ____D C:\Program Files\Microsoft.NET
2013-06-05 02:40 - 2008-02-01 03:24 - 00000000 ____D C:\Program Files\Microsoft Visual Studio
2013-06-05 02:40 - 2006-11-02 05:37 - 00000000 ____D C:\Program Files\MSBuild
2013-06-05 02:39 - 2008-02-01 03:28 - 00000000 ____D C:\Program Files\Microsoft Small Business
2013-06-05 02:39 - 2008-02-01 03:22 - 00000000 ____D C:\Program Files\Microsoft Office
2013-06-05 02:37 - 2006-11-02 05:37 - 00000000 ____D C:\Program Files\Microsoft Games
2013-06-05 02:36 - 2008-02-01 02:32 - 00000000 ____D C:\Program Files\Lenovo Group Limited
2013-06-05 02:32 - 2010-06-24 18:47 - 00000000 ____D C:\Program Files\HP
2013-06-05 02:32 - 2008-02-01 03:14 - 00000000 ____D C:\Program Files\Intel
2013-06-05 02:32 - 2008-02-01 03:01 - 00000000 ____D C:\Program Files\Google
2013-06-05 02:31 - 2012-07-13 22:55 - 00000000 ____D C:\Program Files\ESET
2013-06-05 02:29 - 2012-04-14 10:25 - 00000000 ____D C:\Program Files\DDNI
2013-06-05 02:29 - 2008-02-01 02:14 - 00000000 ____D C:\Program Files\DIFX
2013-06-05 02:28 - 2008-02-01 03:15 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared
2013-06-05 02:28 - 2008-02-01 02:42 - 00000000 ____D C:\Program Files\Common Files\Roxio Shared
2013-06-05 02:28 - 2008-02-01 02:18 - 00000000 ____D C:\Program Files\CONEXANT
2013-06-05 02:28 - 2006-11-02 04:18 - 00000000 ____D C:\Program Files\Common Files\SpeechEngines
2013-06-05 02:27 - 2008-12-20 12:50 - 00000000 ____D C:\Program Files\Common Files\Real
2013-06-05 02:27 - 2006-11-02 04:18 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-06-05 02:25 - 2010-05-19 17:21 - 00000000 ____D C:\Program Files\Common Files\Canon
2013-06-05 02:25 - 2008-09-13 12:31 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-06-05 02:25 - 2008-02-01 02:46 - 00000000 ____D C:\Program Files\Common Files\Java
2013-06-05 02:25 - 2008-02-01 02:44 - 00000000 ____D C:\Program Files\Common Files\InterVideo
2013-06-05 02:24 - 2008-02-01 02:36 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-06-05 02:22 - 2012-12-02 18:00 - 00000000 ____D C:\Program Files\BadgerIT
2013-06-05 02:22 - 2008-02-01 02:26 - 00000000 ____D C:\Program Files\Analog Devices
2013-06-05 02:21 - 2008-02-01 02:36 - 00000000 ____D C:\Program Files\Adobe
2013-06-05 02:17 - 2012-08-18 16:32 - 00000000 ____D C:\BigFishGamesCache
2013-06-05 02:17 - 2008-02-08 17:04 - 00000000 ____D C:\EPSON
2013-06-05 02:17 - 2008-02-01 02:27 - 00000000 ____D C:\Intel
2013-06-05 01:03 - 2013-05-24 20:20 - 00000000 ____D C:\Users\Janette\Documents\Tacoma film Festival
2013-06-05 01:03 - 2013-05-24 20:20 - 00000000 ____D C:\Users\Janette\Documents\Cartoons
2013-06-04 21:02 - 2006-11-02 03:22 - 61865984 ____A C:\Windows\System32\config\software_previous
2013-06-04 21:02 - 2006-11-02 03:22 - 24641536 ____A C:\Windows\System32\config\system_previous
2013-06-04 21:02 - 2006-11-02 03:22 - 00061440 ____A C:\Windows\System32\config\sam_previous
2013-06-04 21:02 - 2006-11-02 03:22 - 00028672 ____A C:\Windows\System32\config\security_previous
2013-06-04 20:58 - 2008-02-01 01:57 - 01356986 ____A C:\Windows\WindowsUpdate.log
2013-06-04 19:51 - 2013-06-04 19:51 - 00000000 ____D C:\Users\Janette\Documents\mbar-1.06.0.1003
2013-06-04 19:41 - 2013-06-04 18:19 - 00000000 ____D C:\Users\Janette\Desktop\RK_Quarantine
2013-06-04 18:42 - 2013-06-04 18:42 - 02708759 ____A C:\Users\Janette\Desktop\debug.log
2013-06-04 08:05 - 2013-06-04 08:04 - 00017139 ____A C:\Users\Janette\Desktop\dds.txt
2013-06-04 08:05 - 2013-06-04 08:04 - 00013829 ____A C:\Users\Janette\Desktop\attach.txt
2013-06-03 19:53 - 2006-11-02 03:22 - 01048576 ____A C:\Windows\System32\config\default_previous
2013-06-03 19:52 - 2006-11-02 03:22 - 45613056 ____A C:\Windows\System32\config\components_previous
2013-06-03 15:27 - 2013-06-03 15:27 - 00000000 ____D C:\ProgramData\AVAST Software
2013-06-03 15:27 - 2013-06-03 15:27 - 00000000 ____D C:\Program Files\AVAST Software
2013-06-02 15:16 - 2010-06-24 18:40 - 00005191 ____A C:\ProgramData\hpzinstall.log
2013-05-30 20:07 - 2012-02-10 18:38 - 00000091 ____A C:\Windows\win.ini
2013-05-25 21:33 - 2012-07-14 14:00 - 00154704 ____A C:\Windows\System32\GDIPFONTCACHEV1.DAT
2013-05-15 03:04 - 2006-11-02 03:24 - 72607752 ____N (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-05-14 19:19 - 2013-02-20 11:24 - 00000000 ____D C:\Users\Janette\Documents\Light Space Time contests
2013-05-14 19:17 - 2012-09-04 19:30 - 00692104 ____N (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-05-14 19:17 - 2012-09-04 19:30 - 00071048 ____N (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-05-14 17:57 - 2013-05-14 16:37 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-05-13 09:24 - 2013-05-13 09:24 - 03097600 ____N C:\Users\Janette\Documents\Out of the stall frame comp.pub

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2013-06-12 13:53

==================== End Of Log ============================
June 12th, 2013, 09:42 PM
Broni
Unfortunately I don't see anything what would prevent your computer from booting correctly.

Do you remember when was the last time it booted fine in safe mode?

You will need a USB flash drive.

Download GETxPUD.exe to the desktop of your clean computer
- Run GETxPUD.exe
- A new folder will appear on the desktop.
- Open the GETxPUD folder and click on the get&burn.bat
- The program will download xpud_0.9.2.iso, and upon finished will open BurnCDCC ready to burn the image.
- Click on Start and follow the prompts to burn the image to a CD.
- Next download rst.sh to your USB flash drive
- Remove the USB & CD and insert it in the sick computer
- Boot the Sick computer with the CD you just burned
- The computer must be set to boot from the CD
- Gently tap F12 and choose to boot from the CD
- Follow the prompts
- A Welcome to xPUD screen will appear
- Press File
- Expand mnt
- sda1,2...usually corresponds to your HDD
- sdb1 is likely your USB
- Click on the folder that represents your USB drive (sdb1 ?)
- Confirm that you see rst.sh that you downloaded there
- Press Tool at the top
- Choose Open Terminal
- Type bash rst.sh
- Press Enter
- After it has finished a report will be located on your USB drive named enum.log
- Remove the USB drive and insert it back in your working computer and navigate to enum.log
  
  Please note - all text entries are case sensitive
Copy and paste the enum.log for my review
June 12th, 2013, 10:01 PM
rollie

It's been booting fine in safe mode, but the last time it booted normally was Monday, June 3rd, the day after I uninstalled/reinstalled Firefox. I'm going ahead with the procedure in the above post. It will take awhile as I have to use my husband's PC which I never use, so there will be a small learning curve.
June 12th, 2013, 10:02 PM
Broni

No problem :)
June 12th, 2013, 10:32 PM
rollie

Now I'm on Husbands' PC but I can't download to his desktop, because it's only set up to go to the Downloads file. When the download asks where I want to save the file, it's just the one choice. I went to the Properties window of Desktop, but couldn't figure out what to do....
June 12th, 2013, 10:36 PM
Broni

Download to "Downloads" folder. Cut and paste to to the Desktop.

Show 40 post(s) from this thread on one page