ejw Posted February 20, 2014 ID:793866 Share Posted February 20, 2014 Gringo Having similar problem. Read your posts. ran Adwcleaner... text below. JRT Text also below. Note I'm running Windows 8.1 not XP # AdwCleaner v3.019 - Report created 19/02/2014 at 18:10:09# Updated 17/02/2014 by Xplode# Operating System : Windows 8.1 Pro (64 bits)# Username : Eric - ALEXSPC# Running from : C:\Users\Eric\Downloads\AdwCleaner.exe# Option : Clean***** [ Services ] ********** [ Files / Folders ] *****Folder Deleted : C:\WINDOWS\SysWOW64\SearchprotectFolder Deleted : C:\Program Files\Level Quality WatcherFolder Deleted : C:\Users\Alex Vincent\AppData\Local\DefineExtFolder Deleted : C:\Users\Alex Vincent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC BackupFolder Deleted : C:\Users\Alex Vincent\Documents\optimizer proFile Deleted : C:\ENDFile Deleted : C:\Users\Alex Vincent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnkFile Deleted : C:\Users\Alex Vincent\Desktop\MyPC Backup.lnk***** [ Shortcuts ] ********** [ Registry ] *****Key Deleted : HKLM\SOFTWARE\Classes\PCProxy.DataContainerKey Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WajamUpdaterKey Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9DC8FA51-B596-4F77-802C-5B295919C205}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3E28F712-0D6C-4EE3-AC8C-8F060F5D7C33}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6CE321DA-DC11-45C6-A0FC-4E8A7D978ABC}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6EEBC7FF-67DA-4B90-9251-C2C5696E4B48}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{74137531-80F7-406F-9543-7D11385FA8C8}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{832599B2-55BF-4437-8F3E-030CF5AEB262}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9B7B034B-944A-4261-B487-862F642F7615}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B1A429DB-FB06-4645-B7C0-0CC405EAD3CD}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DD67706E-819E-4EBD-BF8D-6D6147CC7A49}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F62A4AF9-58B4-4FEC-89CC-D717A547D8E8}Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}Key Deleted : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}Key Deleted : HKLM\Software\caphyon***** [ Browsers ] *****-\\ Internet Explorer v11.0.9600.16518-\\ Mozilla Firefox v27.0.1 (en-US)[ File : C:\Users\Alex Vincent\AppData\Roaming\Mozilla\Firefox\Profiles\1325qnyh.default-1392522069781\prefs.js ][ File : C:\Users\Eric\AppData\Roaming\Mozilla\Firefox\Profiles\1xuf0oti.default\prefs.js ]*************************AdwCleaner[R0].txt - [3523 octets] - [19/02/2014 18:08:49]AdwCleaner[s0].txt - [3508 octets] - [19/02/2014 18:10:09]########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [3568 octets] ########## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Junkware Removal Tool (JRT) by ThisisuVersion: 6.1.1 (02.04.2014:1)OS: Windows 8.1 Pro x64Ran by Eric on Wed 02/19/2014 at 18:36:21.42~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Services~~~ Registry Values~~~ Registry KeysSuccessfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{C5E3F919-B9AA-472F-986A-6B3C88549BCE}~~~ Files~~~ Folders~~~ Event Viewer Logs were cleared~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Scan was completed on Wed 02/19/2014 at 18:44:43.62End of JRT log~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Link to post Share on other sites More sharing options...
ejw Posted February 20, 2014 Author ID:793869 Share Posted February 20, 2014 Gringo, Meant to add that the browser issue I was having seems to be better. Before I was getting error using Firefox to bring up www.google.com, and was receiving a certificate error. I notice that the "savingsbullfilter" entry is still in the programs list in control panel. Link to post Share on other sites More sharing options...
Maniac Posted February 20, 2014 ID:794272 Share Posted February 20, 2014 Hello ejw and ! My name is Borislav and I will be glad to help you solve your malware problem. Please note:If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.Make sure you read all of the instructions and fixes thoroughly before continuing with them.Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.Download OTL to your DesktopDouble click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.Please tick the Scan All users. Next, click the Quick Scan button. The scan wont take long.When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic. Link to post Share on other sites More sharing options...
ejw Posted February 21, 2014 Author ID:794537 Share Posted February 21, 2014 Thanks BorislavHere are the OTL resultsExtras:OTL Extras logfile created on: 2/20/2014 10:30:35 PM - Run 1OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Alex Vincent\Desktop\Eric Temp64bit- Professional (Version = 6.2.9200) - Type = NTWorkstationInternet Explorer (Version = 9.11.9600.16518)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 15.89 Gb Total Physical Memory | 13.54 Gb Available Physical Memory | 85.19% Memory free31.89 Gb Paging File | 29.26 Gb Available in Paging File | 91.73% Paging File freePaging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86)Drive C: | 665.92 Gb Total Space | 569.63 Gb Free Space | 85.54% Space Free | Partition Type: NTFSDrive D: | 31.60 Gb Total Space | 3.62 Gb Free Space | 11.46% Space Free | Partition Type: NTFS Computer Name: ALEXSPC | User Name: Alex Vincent | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit ScansCompany Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].html[@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation).url[@ = InternetShortcut] -- C:\WINDOWS\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].cpl [@ = cplfile] -- C:\WINDOWS\SysWow64\control.exe (Microsoft Corporation).html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) [HKEY_USERS\S-1-5-21-486706304-2225237594-3729880486-1001\SOFTWARE\Classes\<extension>].html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.htmlfile [edit] -- Reg Error: Key error.htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)htmlfile [print] -- "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)InternetShortcut [open] -- "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\ieframe.dll",OpenURL %l (Microsoft Corporation)InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.htmlfile [edit] -- Reg Error: Key error.htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error. ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]"VistaSp1" = AC 1C AE C5 46 9F CE 01 [binary data]"AntiVirusOverride" = 0"AntiSpywareOverride" = 0"FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Upgrade]"UpgradeTime" = [binary data] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Upgrade]"UpgradeTime" = Reg Error: Unknown registry data type -- File not found ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]"EnableFirewall" = 1"DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"EnableFirewall" = 1"DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]"EnableFirewall" = 1"DisableNotifications" = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]"{02C7635B-6EDB-4FC5-A0D5-5D6E1EA42435}" = lport=53000 | protocol=6 | dir=in | name=hpconnectedremoteservice.exe |"{0D1CC831-F2C0-4AF2-851D-39D31F0242C1}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |"{182898A3-539F-4E01-8888-C93F152A0439}" = rport=10243 | protocol=6 | dir=out | app=system |"{2B2B831D-1C40-48FE-8055-D9F59FB2C02E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |"{46842CFB-2627-420A-9C98-5FA6DB6F28FB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |"{812D0366-E1CB-42F8-A432-D6BA891F42A2}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |"{87D42DC5-AA69-42D9-B6FD-35F1A0E4FB6F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |"{A640CD98-BD6F-41EE-8E40-3DDB294DFBA4}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |"{AAA3E6F2-4D4A-438C-A6A9-D5F78E147C91}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |"{AF2F2E32-EA79-436F-A4FA-D1E496B2267E}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |"{C71A964A-91F4-436A-BFE9-44C4CCB22B6B}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |"{E2194B45-CAA0-43B7-9929-472DD7DD25A1}" = lport=10243 | protocol=6 | dir=in | app=system |"{E3DC79B5-7762-40BE-AEBC-575873457AB7}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office 15\root\office15\outlook.exe |"{E5EF371A-98BF-43DF-AA74-7B36F6797042}" = lport=52000 | protocol=6 | dir=in | name=hpconnectedremoteuser.exe |"{EED7C237-A1EE-4935-84A8-AB6143A03AD5}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |"{FD6F108D-4EE4-47E7-BEC4-EF63309AC291}" = lport=2869 | protocol=6 | dir=in | app=system | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]"{00FA41B0-213F-4B6E-95F0-B2CDBBF195E9}" = dir=out | name=check point vpn |"{01B796B9-D350-4874-A4FD-232E5EBB5275}" = dir=out | name=juniper networks junos pulse |"{01E50993-33DD-4A23-985D-81F468A4E92D}" = dir=in | name=check point vpn |"{06E17FDA-4804-40FD-82AD-CA224644CB4D}" = dir=out | name=savings center featured offers |"{096DCC2F-B6E8-49F2-8261-C59D30C53E7A}" = dir=out | name=microsoft solitaire collection |"{0A582A0E-F25F-4686-8742-58A174D35E15}" = dir=in | name=microsoft solitaire collection |"{0BAA00AE-CC7E-487F-A4AC-EDF5E7EBE2E3}" = dir=out | name=ebay |"{0BE67539-0BB7-4077-9885-D4238D860641}" = dir=out | name=hp+ |"{0DD18570-DBBE-4577-8D1F-3A2BC9CC3AC0}" = dir=in | name=hp+ |"{0DDFC7D3-66DE-4F5C-A85B-82368410773F}" = dir=out | name=windows_ie_ac_001 |"{1322554B-CF76-4383-918E-60319B028F67}" = protocol=6 | dir=in | app=c:\program files\microsoft office 15\root\office15\ucmapi.exe |"{1A6594A3-9260-4C86-A9B4-7CB240F609F6}" = dir=in | name=microsoft mahjong |"{1AD444DA-C7F0-434B-830B-0F99E12FFF60}" = dir=out | name=windows_ie_ac_001 |"{1CE9492A-5E8F-4103-8C83-897A39D0C8EB}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version9\teamviewer.exe |"{1DA5E44C-DE00-4321-84AB-1780335F65FB}" = dir=in | app=c:\windows\system32\lxeecoms.exe |"{1EC91021-DE02-4EFA-947E-00C65603CF3C}" = dir=out | name=hp printer control |"{1F2095D8-E7B3-456B-BB9D-54BF14A638EC}" = dir=out | name=ebay |"{20BA8B87-8FFF-41A5-8F24-11481A4D9F46}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |"{2583DEE8-AAC2-4A36-937F-6409CE74A120}" = dir=out | name=hp games |"{26F6C6CE-8E7E-4C46-9EF7-E7829C325AB7}" = dir=out | name=netflix |"{276AC6EA-ED16-4F57-AAD4-197521F29CE4}" = dir=in | name=sonicwall mobile connect |"{2A5FD34F-7143-48F7-A439-FF9A0075B835}" = dir=out | name=f5 vpn |"{2BFD38BE-75EB-410A-A8CB-A8EB49A6E9E8}" = dir=out | name=hp connected photo powered by snapfish |"{2E1545D0-A0EA-4B80-8CF3-E4BEB4B05EEF}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |"{2FB864D2-39C5-4B6F-9100-8F1DD9F4C3DF}" = dir=out | name=windows 8 cheat keys |"{313267C1-8BA5-40AE-9504-7A19BF9D4B22}" = dir=in | app=c:\program files (x86)\hpconnectedmusic\hpconnectedmusic.exe |"{32B2B658-706F-4914-800C-338873E3EA49}" = dir=out | name=microsoft solitaire collection |"{34CC492F-0FE6-4C98-BE44-C072B0A66CA3}" = dir=out | name=savings center featured offers |"{3741A74F-B0F2-4AE8-8AA9-D5CC6CE84081}" = protocol=17 | dir=in | app=c:\program files\microsoft office 15\root\office15\lync.exe |"{38E4471E-7342-4074-B508-8A51EC9D0DDC}" = dir=in | name=savings center featured offers |"{4282FE99-8560-4BC7-9576-5F3ED84E263F}" = dir=in | name=checkpoint.vpn |"{44E580BC-A23E-4FC2-9A89-9DA1020D9A35}" = dir=out | name=kindle |"{450F4E6E-E2A6-4AFB-86F6-4A79017EF2CB}" = dir=out | name=gmail calendar |"{48B2ED70-E125-4128-BD17-D836A59089D8}" = dir=in | name=juniper networks junos pulse |"{48F12BB5-DE9E-4A5D-95A5-41F1145D1C77}" = dir=out | name=iheartradio |"{48F3841D-CE08-416A-B36F-FD7A7A36D76F}" = dir=out | name=iheartradio |"{49D676F1-3BAF-48BE-8301-98915740F0D5}" = dir=out | name=hp registration |"{4E5F22DC-E5B5-40BB-BD5F-33C499A1EC45}" = dir=out | name=getting started with windows 8 |"{4FB528ED-21D3-4796-91AF-6D75E9C76B49}" = dir=out | name=sonicwall mobile connect |"{560448D6-095C-4907-B046-AC7F710701A7}" = dir=in | name=sonicwall.mobileconnect |"{5782B875-AC15-4D57-AB3B-68644FB54C03}" = dir=in | name=juniper networks junos pulse |"{5F4632C0-D5B1-40C3-B0D9-E3A759C81B9E}" = dir=out | name=sonicwall.mobileconnect |"{5FA56CCD-431F-4114-9A32-13E97428AC5C}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd10\powerdvd10.exe |"{684299AB-E44E-485B-A24C-F8244A86D980}" = dir=out | name=microsoft mahjong |"{69953F0D-8BFF-4E68-9D14-9E34CC47D7F2}" = protocol=17 | dir=in | app=c:\program files\microsoft office 15\root\office15\ucmapi.exe |"{6A5B179E-D26B-4EBE-9C70-6A0DCF6EC85C}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector10\pdr10.exe |"{6DE2EE36-06B8-46BA-9DEB-BF5053499088}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version9\teamviewer.exe |"{721EB4BB-0D64-4928-9CCB-B9423C3FD258}" = dir=out | name=facebook+ lite |"{78C9A872-03B3-4E94-9053-88D6245EC207}" = dir=out | name=skype |"{7CB55D9C-1CDB-4FB5-9581-BDDD14AC47A3}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version9\teamviewer_service.exe |"{8468F5E1-FE55-4DD8-8302-B7D878EFFF84}" = dir=in | name=hp connected photo powered by snapfish |"{87E0CF40-5053-4F5A-BAC7-45EC151AB3AD}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |"{8FF9D786-FADE-4FCD-94BA-D02FF999EA92}" = dir=in | name=skype |"{9063C217-2CD7-443B-9A58-0D99D264CF04}" = protocol=17 | dir=in | name=hpconnectedremoteservice.exe |"{90AF5FA5-1C0C-4355-9CF5-972DF894AB4A}" = dir=in | app=c:\users\administrator\appdata\local\microsoft\skydrive\skydrive.exe |"{91AEABF7-6015-4E69-87B2-96D1D4B116D2}" = protocol=6 | dir=in | app=c:\program files\microsoft office 15\root\office15\lync.exe |"{92ABCA83-3EF9-4402-925D-B6283509F2A9}" = dir=out | name=kindle |"{92AEA5B7-20F9-48E8-8332-0001175ADC54}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |"{93F18CCE-9C8D-41A9-9B51-5BAD8E0D07FD}" = dir=out | app=%localappdata%\hpconnectedmusic\application\hpconnectedmusic.exe |"{9BF2F7A4-1692-4429-AE7D-6FDFBF401D55}" = dir=out | name=sonicwall mobile connect |"{A0E6E285-A010-4B7D-8504-B5BF5A702379}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version9\teamviewer_service.exe |"{A3D86777-8AAF-4572-9855-375B6A3D9232}" = dir=in | app=c:\program files (x86)\hewlett-packard\hp support framework\resources\hpwarrantycheck\hpdevicedetection3.exe |"{A7EB1A33-2F89-43EF-ACAD-644E978225D4}" = dir=in | name=sonicwall mobile connect |"{A9AB1AB2-2C97-4F80-9073-201F94B9CFE1}" = dir=in | app=%localappdata%\hpconnectedmusic\application\hpconnectedmusic.exe |"{AA25DD32-CF7B-42CB-B97A-6E3527B70755}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |"{AC2F431D-8FC8-483B-AE05-8E9A0BBD75A1}" = dir=out | name=f5 vpn |"{AD027757-61C5-4CD4-9719-E4F1D8A76A90}" = dir=out | name=getting started with windows 8 |"{AEC7259B-6E41-4B31-BC82-7401B043CE36}" = dir=out | app=c:\program files (x86)\hpconnectedmusic\hpconnectedmusic.exe |"{AF9829AD-B9F3-4893-8A2E-2FA4E7F9EAE4}" = dir=out | name=hp games |"{B0C5828D-0129-4797-8D1E-4DA33839234D}" = dir=out | name=hp+ |"{B412F6A6-B2A6-4445-BFB1-4A2BFB2DA3D9}" = protocol=58 | dir=in | app=system |"{B532CB30-5AB3-407D-B2ED-DDC44E42B8AA}" = protocol=6 | dir=out | app=system |"{B5863DE2-12D5-4334-B843-CE4F9FF4B050}" = dir=in | name=f5 vpn |"{B63C8816-F66C-4EA6-9B1E-6E6C9C6FE163}" = dir=in | name=hp printer control |"{B657996D-483E-43E7-A5BB-C34C28659D62}" = dir=out | name=hp registration |"{B6A4E0D0-3B30-4D98-81BE-A9F673167CBD}" = dir=in | name=check point vpn |"{BE7DD40B-3C37-48A5-B453-F0F5B2A1E666}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |"{BEFDABCD-397F-4CCA-B968-CFCBB02C88AB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |"{C06BA536-6545-4B59-9F52-7AF385045EBA}" = dir=out | name=netflix |"{C0863D15-3A03-4941-BEBD-C5CBF58A5709}" = dir=out | app=%localappdata%\hpconnectedmusic\application\spotify_helper.exe |"{C1B66251-740D-4D7C-BD20-8EDCF3897A56}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |"{C32C767F-497D-4B2A-ACDA-AD3C9C96227E}" = dir=in | name=microsoft mahjong |"{C47C1ADA-E80C-4EC0-A5A6-32EB8DD51BDA}" = dir=in | app=c:\program files\intel corporation\intel widi\widiapp.exe |"{C4E8D0C5-76B3-4781-B047-26ED6EA5963F}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |"{C8EC6D19-D6C9-432D-9E12-BB0B37352F2D}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 |"{CA402733-43D1-4F97-B156-78AA989ECA47}" = dir=out | name=norton studio |"{CC5C72E9-983C-4DD1-A7BD-AC30BCBFC3A0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |"{CE2EE894-D9A2-4B13-BA9E-7143A9A3394A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |"{D29BBBE8-E819-4BA9-89DF-7AF96CE46EB9}" = dir=in | name=microsoft solitaire collection |"{D3289ACA-95F5-4845-8A3F-BF6AEB393219}" = dir=out | name=drawboard pdf |"{D40F8EB7-8592-48A2-A98F-F6D6BEB3E1D8}" = dir=in | app=c:\program files\intel\wifi\bin\pandhcpdns.exe |"{D6980480-941A-4DF6-AB81-3734ECD3D779}" = dir=out | name=junipernetworks.junospulsevpn |"{DA333056-F0A1-4947-9FA5-311B574C53BF}" = dir=out | name=myhomework |"{DB583654-7058-40D5-8851-864C64931B49}" = dir=in | name=hp connected photo powered by snapfish |"{DB59588E-ED90-4C47-A7B5-7929DD0C0BD2}" = dir=out | name=checkpoint.vpn |"{DE606F3F-5D9E-4A61-96F8-357F983E3B86}" = dir=out | name=adobe photoshop express |"{E20047B3-97DD-41BF-B9C4-8B67E5110C5D}" = dir=in | name=f5 vpn |"{E2286491-EE77-46CB-AFCA-8CAA9D07812A}" = dir=in | name=savings center featured offers |"{EA77964D-2891-4194-8A6E-B39A89B9597F}" = dir=out | name=microsoft mahjong |"{EC799E33-72BA-42D7-9127-DEFE68F9799D}" = dir=in | name=junipernetworks.junospulsevpn |"{EDD08FF7-908F-4384-BBB4-14934C834D3B}" = dir=out | name=juniper networks junos pulse |"{EE23E062-DC49-4449-A5AC-4082FBEFAEE0}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |"{F012CB10-65F2-4052-B70D-CD091E5AA726}" = dir=out | name=check point vpn |"{F0C15FE1-3043-4973-9195-0407B763427A}" = dir=in | name=hp+ |"{F1C43FBD-C1BE-4D29-9167-7B016316513C}" = dir=in | app=%localappdata%\hpconnectedmusic\application\spotify_helper.exe |"{F504038D-E264-4E07-B94B-946A8DD27FEF}" = dir=in | name=adobe photoshop express |"{F5CC0813-A0B8-41E0-9964-2C0B0742B610}" = dir=in | name=skype |"{F64300AD-D559-4000-BD45-0997BCC8E70A}" = dir=out | name=f5.vpn.client |"{F69E7D1A-ADC1-4B05-9855-DFB1F715B5B3}" = dir=out | name=hp connected photo powered by snapfish |"{F77E5446-4378-4E99-8B7A-7061AAAEA193}" = dir=in | name=f5.vpn.client |"{F792F3FE-1602-422E-915D-A5996C544065}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |"{FE795FE8-6176-4D62-BA92-2DEB3185BD14}" = dir=out | name=skype |"{FFA404F2-0561-492E-892B-92C6E5F5FFF9}" = dir=out | name=windows_ie_ac_001 |"TCP Query User{067CD909-9E8C-4D9C-BDAF-D3046B6CA0A5}C:\program files (x86)\xming\xming.exe" = protocol=6 | dir=in | app=c:\program files (x86)\xming\xming.exe |"TCP Query User{4104888F-3149-4CFE-A902-5388D8AEECDD}C:\users\alex vincent\appdata\roaming\vseeinstall\vsee.exe" = protocol=6 | dir=in | app=c:\users\alex vincent\appdata\roaming\vseeinstall\vsee.exe |"TCP Query User{4DDA151E-656B-4878-89BA-433F87738DC5}C:\users\alex vincent\appdata\roaming\vseeinstall\vsee.exe" = protocol=6 | dir=in | app=c:\users\alex vincent\appdata\roaming\vseeinstall\vsee.exe |"TCP Query User{83503E16-EFEE-4CD9-976B-C8214DF79A77}C:\ti\ccsv5\eclipse\jre\bin\java.exe" = protocol=6 | dir=in | app=c:\ti\ccsv5\eclipse\jre\bin\java.exe |"TCP Query User{BA2709AD-614A-4D68-8498-6E2E38335BC6}C:\program files (x86)\xming\xming.exe" = protocol=6 | dir=in | app=c:\program files (x86)\xming\xming.exe |"TCP Query User{C6BECB9F-71D5-4F70-B332-2279FE02A8F2}C:\users\alex vincent\documents\mc\ccsv5\eclipse\jre\bin\java.exe" = protocol=6 | dir=in | app=c:\users\alex vincent\documents\mc\ccsv5\eclipse\jre\bin\java.exe |"UDP Query User{0CB9E222-81D1-41B0-9823-AC6397F9E62E}C:\ti\ccsv5\eclipse\jre\bin\java.exe" = protocol=17 | dir=in | app=c:\ti\ccsv5\eclipse\jre\bin\java.exe |"UDP Query User{A7812F83-811F-4AE8-8C80-4EFCBE916332}C:\users\alex vincent\documents\mc\ccsv5\eclipse\jre\bin\java.exe" = protocol=17 | dir=in | app=c:\users\alex vincent\documents\mc\ccsv5\eclipse\jre\bin\java.exe |"UDP Query User{C9936BEA-0892-4671-9048-3DEF27FFADCA}C:\program files (x86)\xming\xming.exe" = protocol=17 | dir=in | app=c:\program files (x86)\xming\xming.exe |"UDP Query User{F9669B9D-B78C-42B9-9259-F4BC53087C66}C:\users\alex vincent\appdata\roaming\vseeinstall\vsee.exe" = protocol=17 | dir=in | app=c:\users\alex vincent\appdata\roaming\vseeinstall\vsee.exe |"UDP Query User{FC07B377-22E0-4425-91AD-45D1FB6C98A5}C:\users\alex vincent\appdata\roaming\vseeinstall\vsee.exe" = protocol=17 | dir=in | app=c:\users\alex vincent\appdata\roaming\vseeinstall\vsee.exe |"UDP Query User{FE87996B-D80D-46E2-9EFE-8092BFC0EB7D}C:\program files (x86)\xming\xming.exe" = protocol=17 | dir=in | app=c:\program files (x86)\xming\xming.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{0728A184-F899-4356-B93D-8228674F0DEB}" = Intel® PROSet/Wireless Software for Bluetooth® Technology"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219"{1F91C200-8F0F-4009-A75E-DB6CE151BD4E}" = Validity WBF DDK"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148"{54CE68A8-4F2D-4328-B1F7-D6C720405F7F}" = HP 3D DriveGuard"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161"{6097158B-0184-4140-BEC3-7885794D2571}" = Intel® WiDi"{6E14E6D6-3175-4E1A-B934-CAB5A86367CD}" = HP Postscript Converter"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour"{813BA625-B0FA-48D8-9B75-59759C88C219}" = SavingsbullFilter"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight"{90150000-008F-0000-1000-0000000FF1CE}" = Office 15 Click-to-Run Licensing Component"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting"{bda3368d-37bf-4e4a-84b3-3cc1b2155e46}" = Intel® PRO/Wireless Driver"{C2E428EB-116E-41C0-9E84-B22DE9CCA42F}" = HP Registration Service"{DD1AF090-041E-4403-B27A-AC6FA4B985E8}" = Intel® PROSet/Wireless WiFi Software"{E77289CF-12B9-4CAB-A49E-FEAE947F4D95}" = Intel® PROSet/Wireless for Bluetooth® + High Speed"{EBC0CC3F-B7A1-4FC8-8014-4C7BFD3925E8}" = AuthenTec TrueAPI 64-bit"{F4404AFD-2EF3-40C1-8C09-29E5F3B6972B}" = Intel® Trusted Connect Service Client"{F842F8B0-6942-4930-821F-543E976B2C66}" = MSVCRT110_amd64"0BDF85E56A265712467599C1BB6297100A196F83" = Windows Driver Package - Texas Instruments CDM Driver Package (03/18/2011 2.08.14)"493E55AC2C50E157B700A12975E4532D3E246F44" = Windows Driver Package - EWA Technologies, Inc. (XDS560) TI_Emulators (11/02/2011 3.0.0.1)"65A7887924E47D0EA3E2A212B2247E7E9FA1F9EB" = Windows Driver Package - Spectrum Digital (sdusb2em) SDUSBEmulators (03/25/2011 6.0.999.2)"6DBBE862580281438868BCDD37A84E63A0FBB067" = Windows Driver Package - FTDI CDM Driver Package - VCP Driver (03/18/2011 2.08.14)"75CE7050FCC4D8267A3BD5D3253B1AF44CB375B9" = Windows Driver Package - Texas Instruments CDM Driver Package (03/18/2011 2.08.14)"811EE677BA910AF18E88222F81F2AA6F083E3C53" = Windows Driver Package - Texas Instruments, Inc. (WinUSB) StellarisICDIDeviceClass (08/03/2012 2.0.9270)"8A1FDB05EC5DC94785A88769D4A9AF2F496970A1" = Windows Driver Package - Texas Instruments, Inc. (usbser) Ports (08/03/2012 2.0.9270)"95395462375D9A29E54B3082BE6D3CAA7CEFD7BA" = Windows Driver Package - Texas Instruments Incorporated (usbser) Ports (04/21/2009 5.1.2600.0)"A0AA8F842A8763D58C48062D95A9CB19C452DF57" = Windows Driver Package - Texas Instruments Inc. (WinUSB) StellarisDFUDeviceClass (08/03/2012 1.2.9270)"ACBD450607B9A261AF1F694FAE00A92218E1F94B" = Windows Driver Package - FTDI CDM Driver Package - Bus/D2XX Driver (03/18/2011 2.08.14)"ProPlusRetail - en-us" = Microsoft Office Professional Plus 2013 - en-us"Sublime Text 2_is1" = Sublime Text 2.0.2"SynTPDeinstKey" = Synaptics Pointing Device Driver [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements"{0C57987A-A03A-4B95-A309-D23F78F406CA}" = HP Utility Center"{1057511B-F8FE-4230-9ED3-AB949A57EE4A}" = Windows Live PIMT Platform"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148"{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}" = CyberLink Media Suite 10"{26A24AE4-039D-4CA4-87B4-2F83217045FF}" = Java 7 Update 51"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1"{29315CEC-E6CE-4394-84DC-6F862E8D9A52}" = Windows Live UX Platform"{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}" = CyberLink Power2Go 8"{2D416A80-0BB1-4D8B-B770-7BE8F53D5937}" = Windows Live UX Platform Language Pack"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App"{30B2D1D8-0A07-4B71-9553-0710C5D31E35}" = HP Wireless Button Driver"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology"{40F55150-F43D-4C9F-9A00-1A0A6F1EB7F0}" = Movie Maker"{46316411-80D8-4F68-8118-696E05FCE199}" = Windows Live Essentials"{4862344A-A39C-4897-ACD4-A1BED5163C5A}" = CyberLink PhotoDirector"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater"{4BACA3B8-F63A-44ED-9A8D-48B4D02AD268}" = HP SimplePass"{4F9A382F-4478-4036-905C-F77DF2EA0370}" = Windows Live SOXE"{4FA8F084-C42F-45E1-B7E5-E0C8A1083DC5}" = Windows Live SOXE Definitions"{528AB81B-D65A-4AB0-A2B6-82B51A087D01}" = HP Recovery Manager"{53D3E126-699A-4D92-AA66-6560D573553E}" = HP Documentation"{59F8C5AA-91BD-423D-BF05-09A80F39898F}" = HP CoolSense"{5CC4C963-F772-4766-BFF2-DE551E205EE9}" = Photo Common"{60A1253C-2D51-4166-95C2-52E9CF4F8D64}" = Photo Gallery"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM"{64DF7404-9D46-44AF-AFA1-A2F8D5648C2D}" = Windows Live Photo Common"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components"{6C772996-BFF3-3C8C-860B-B3D48FF05D65}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.2.2.3"{702b0b5f-bcbb-44fc-b613-e96f2a3006ed}" = Intel® PROSet/Wireless Software"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp" = WildTangent Games App"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable"{76EE8FE7-1957-4C51-9074-4930A8CFB1AF}" = Windows Live Installer"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110"{8e70e4e1-06d7-470b-9f74-a51bef21088e}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106"{90150000-008C-0000-0000-0000000FF1CE}" = Office 15 Click-to-Run Extensibility Component"{90150000-008C-0409-0000-0000000FF1CE}" = Office 15 Click-to-Run Localization Component"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17"{9B2E55F8-5BA8-4A45-9682-ACB6F2CC0DA5}" = Photo Gallery"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161"{9C35EDE5-4B0F-45E7-A438-314BA889948E}" = HP MyRoom"{AAAB700A-DDB7-4298-AB4B-B6E9F785059C}" = Cisco AnyConnect Secure Mobility Client"{AAECF7BA-E83B-4A10-87EA-DE0B333F8734}" = RealNetworks - Microsoft Visual C++ 2010 Runtime"{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}" = CyberLink PowerDirector 10"{BA73469B-D8C7-4FE3-B33C-1340D09F0709}" = Windows Live Communications Platform"{C1594429-8296-4652-BF54-9DBE4932A44C}" = Realtek PCIE Card Reader"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint"{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}" = RealDownloader"{D71BC54E-A4E6-4E06-866C-FD6EE16EA187}" = Movie Maker"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10"{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}" = HP Support Assistant"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio"{E5823036-6F09-4D0A-B05C-E2BAA129288A}" = HP Quick Launch"{E824E81C-80A4-3DFF-B5F9-4842A9FF5F7F}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106"{EBE939ED-4612-45FD-A39E-77AC199C4273}" = Absolute Notifier"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Processor Graphics"{F243A34B-AB7F-4065-B770-B85B767C247C}" = HP Connected Remote"{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}" = Energy Star"{FCB3772C-B7D0-4933-B1A9-3707EBACC573}" = Intel® SDK for OpenCL - CPU Only Runtime Package"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022"Adobe Flash Player Plugin" = Adobe Flash Player 12 Plugin"Adobe Shockwave Player" = Adobe Shockwave Player 11.6"Cisco AnyConnect Secure Mobility Client" = Cisco AnyConnect Secure Mobility Client"Code Composer Studio 5.5.0" = Code Composer Studio 5.5.0"D1130325-1130-4000-9C10-A4F62C0C66D4" = Blackhawk Emulation Device Drivers for Windows - v1.13.03.25"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam"InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}" = CyberLink Media Suite 10"InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}" = CyberLink Power2Go 8"InstallShield_{4862344A-A39C-4897-ACD4-A1BED5163C5A}" = CyberLink PhotoDirector"InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}" = CyberLink PowerDirector 10"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint"InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300"Mozilla Firefox 27.0.1 (x86 en-US)" = Mozilla Firefox 27.0.1 (x86 en-US)"MozillaMaintenanceService" = Mozilla Maintenance Service"PureLeads" = PureLeads"RealPlayer 16.0" = RealPlayer"StartHPConnectedMusic" = HP Connected Music (Meridian - installer)"TeamViewer 9" = TeamViewer 9"TI Emulators 5.1.232.0" = TI Emulators"WildTangent hp Master Uninstall" = HP Games"WildTangent wildgames Master Uninstall" = WildTangent Games"WinLiveSuite" = Windows Live Essentials"WTA-05b4fa65-a052-4ab9-a6ea-828c93dbe204" = Roads of Rome 3"WTA-118a3043-d5ec-42e1-9223-1b49956e2a75" = Farm Frenzy"WTA-11d71687-2f0c-4017-9f39-81e491de5853" = Penguins!"WTA-1611d1c4-d6d2-485c-a9d4-a4bf7a1996b4" = Luxor Evolved"WTA-36fecf8b-36e0-4641-9f2d-177dafcfa258" = Zuma's Revenge"WTA-471be8b2-313e-483d-821d-1d32a1701e90" = Final Drive Fury"WTA-54a61cd2-1b9a-4aee-8f00-2536667f9dca" = John Deere Drive Green"WTA-5bda3f01-7812-4b87-b63e-9dbcaafb341e" = Governor of Poker 2 Premium Edition"WTA-7dd8d4a1-e87d-4408-8236-3d487ad06677" = Polar Bowler"WTA-7ef74ac7-0f0f-455d-921a-ed0e7f685f1e" = Youda Jewel Shop"WTA-9d3ee5a7-790c-4554-8974-1ccd9c592715" = Tales of Lagoona"WTA-9ddd8906-d119-40b5-914c-25f497da3fcd" = Royal Envoy 2 Collector's Edition"WTA-a22d8f62-66c2-4f16-a6cb-b477bec12d8a" = FATE: The Cursed King"WTA-a66d6293-d633-488b-aadd-8915da41a39f" = Jewel Match 3"WTA-ac9c0dc1-5690-4abf-838d-9a6bd8243169" = Peggle Nights"WTA-aeca83b5-415a-4a78-af58-cb27e537f2df" = Cradle of Rome 2"WTA-bc9d5dfd-62c6-4175-9d1a-a307fa416365" = Gardenscapes: Mansion Makeover"WTA-c311c520-7e39-45e9-a253-0cbb3671e5cf" = Hoyle Card Games"WTA-c5a71252-992b-4b86-8e82-bb1a1dde48d8" = Mahjongg Dimensions Deluxe: Tiles in Time"WTA-cb347ed4-ee34-4776-9934-3b2d5a04d15a" = House of 1000 Doors: Family Secrets"WTA-da8a94cd-7704-4ce5-9394-2f1773d3af33" = Mystery P.I. - Curious Case of Counterfeit Cove"WTA-db7698f8-12c8-40fc-a806-d75f171782f4" = Mortimer Beckett and the Crimson Thief Premium Edition"WTA-dc572166-b546-4f82-a909-33e5928a8d2a" = Polar Golfer"WTA-e27ec890-b563-49a9-933a-8f2a0f107763" = Bejeweled 3"WTA-e50e8085-96cf-4ada-801e-f54ffa47cb7e" = Cradle Of Egypt Collector's Edition"WTA-e8ee6c7f-9e0f-4d11-91ab-4d82dca9297f" = Build-a-lot 4 - Power Source"WTA-fb19cbcd-b196-401f-9429-e342a1c30e1f" = 4 Elements II"Xming_is1" = Xming 6.9.0.31 ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-486706304-2225237594-3729880486-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"Define Ext" = Define Ext"SkyDriveSetup.exe" = Microsoft SkyDrive"VSee" = VSee ========== Last 20 Event Log Errors ========== [ Application Events ]Error - 2/20/2014 1:41:00 PM | Computer Name = AlexsPC | Source = PlsvcV2 | ID = 99Description = In the enable methodRetrieving the COM class factory for component with CLSID {6EEBC7FF-67DA-4B90-9251-C2C5696E4B48} failed due to the following error: 80040154 Class not registered (Exception from HRESULT: 0x80040154 (REGDB_E_CLASSNOTREG)). Error - 2/20/2014 1:41:05 PM | Computer Name = AlexsPC | Source = Application Error | ID = 1000Description = Faulting application name: IAStorDataMgrSvc.exe, version: 11.5.9.1002, time stamp: 0x5065e128 Faulting module name: IAStorUtil.ni.dll, version: 11.5.9.1002, time stamp: 0x5065e124 Exception code: 0xc0000005 Fault offset: 0x0002f3fd Faulting process id: 0x1fd0 Faulting application start time: 0x01cf2e62d3924b58 Faulting application path: C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exeFaulting module path: C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\IAStorUtil\853e24a5a081d03994b2b46eccb0107d\IAStorUtil.ni.dllReport Id: 2bc19ba2-9a56-11e3-be94-a0b3cc524620 Faulting package full name: Faulting package-relative application ID: Error - 2/20/2014 1:46:01 PM | Computer Name = AlexsPC | Source = PlsvcV2 | ID = 99Description = In the enable methodRetrieving the COM class factory for component with CLSID {6EEBC7FF-67DA-4B90-9251-C2C5696E4B48} failed due to the following error: 80040154 Class not registered (Exception from HRESULT: 0x80040154 (REGDB_E_CLASSNOTREG)). Error - 2/20/2014 1:51:02 PM | Computer Name = AlexsPC | Source = PlsvcV2 | ID = 99Description = In the enable methodRetrieving the COM class factory for component with CLSID {6EEBC7FF-67DA-4B90-9251-C2C5696E4B48} failed due to the following error: 80040154 Class not registered (Exception from HRESULT: 0x80040154 (REGDB_E_CLASSNOTREG)). Error - 2/20/2014 1:56:01 PM | Computer Name = AlexsPC | Source = PlsvcV2 | ID = 99Description = In the enable methodRetrieving the COM class factory for component with CLSID {6EEBC7FF-67DA-4B90-9251-C2C5696E4B48} failed due to the following error: 80040154 Class not registered (Exception from HRESULT: 0x80040154 (REGDB_E_CLASSNOTREG)). Error - 2/20/2014 2:09:06 PM | Computer Name = AlexsPC | Source = PlsvcV2 | ID = 99Description = In the enable methodRetrieving the COM class factory for component with CLSID {6EEBC7FF-67DA-4B90-9251-C2C5696E4B48} failed due to the following error: 80040154 Class not registered (Exception from HRESULT: 0x80040154 (REGDB_E_CLASSNOTREG)). Error - 2/20/2014 2:14:07 PM | Computer Name = AlexsPC | Source = PlsvcV2 | ID = 99Description = In the enable methodRetrieving the COM class factory for component with CLSID {6EEBC7FF-67DA-4B90-9251-C2C5696E4B48} failed due to the following error: 80040154 Class not registered (Exception from HRESULT: 0x80040154 (REGDB_E_CLASSNOTREG)). Error - 2/20/2014 2:19:07 PM | Computer Name = AlexsPC | Source = PlsvcV2 | ID = 99Description = In the enable methodRetrieving the COM class factory for component with CLSID {6EEBC7FF-67DA-4B90-9251-C2C5696E4B48} failed due to the following error: 80040154 Class not registered (Exception from HRESULT: 0x80040154 (REGDB_E_CLASSNOTREG)). Error - 2/20/2014 11:07:19 PM | Computer Name = AlexsPC | Source = SideBySide | ID = 16842785Description = Activation context generation failed for "C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe".Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"could not be found. Please use sxstrace.exe for detailed diagnosis. Error - 2/20/2014 11:16:10 PM | Computer Name = AlexsPC | Source = SideBySide | ID = 16842785Description = Activation context generation failed for "C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe".Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"could not be found. Please use sxstrace.exe for detailed diagnosis. [ Cisco AnyConnect Secure Mobility Client Events ]Error - 2/20/2014 5:20:56 PM | Computer Name = AlexsPC | Source = acvpnagent | ID = 67108866Description = Function: CHostConfigMgr::determinePublicAddrCandidateFromDefRouteFile: .\HostConfigMgr.cpp Line: 1769 Invoked Function: CHostConfigMgr::FindDefaultRouteInterfaceReturn Code: -24117215 (0xFE900021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED Error - 2/20/2014 5:21:01 PM | Computer Name = AlexsPC | Source = acvpnagent | ID = 67108866Description = Function: CHostConfigMgr::determinePublicAddrCandidateFromDefRouteFile: .\HostConfigMgr.cpp Line: 1769 Invoked Function: CHostConfigMgr::FindDefaultRouteInterfaceReturn Code: -24117215 (0xFE900021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED Error - 2/20/2014 6:13:15 PM | Computer Name = AlexsPC | Source = acvpnagent | ID = 67108866Description = Function: CHostConfigMgr::determinePublicAddrCandidateFromDefRouteFile: .\HostConfigMgr.cpp Line: 1769 Invoked Function: CHostConfigMgr::FindDefaultRouteInterfaceReturn Code: -24117215 (0xFE900021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED Error - 2/20/2014 6:13:20 PM | Computer Name = AlexsPC | Source = acvpnagent | ID = 67108866Description = Function: CHostConfigMgr::determinePublicAddrCandidateFromDefRouteFile: .\HostConfigMgr.cpp Line: 1769 Invoked Function: CHostConfigMgr::FindDefaultRouteInterfaceReturn Code: -24117215 (0xFE900021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED Error - 2/20/2014 8:01:24 PM | Computer Name = AlexsPC | Source = acvpnagent | ID = 67108866Description = Function: CHostConfigMgr::determinePublicAddrCandidateFromDefRouteFile: .\HostConfigMgr.cpp Line: 1769 Invoked Function: CHostConfigMgr::FindDefaultRouteInterfaceReturn Code: -24117215 (0xFE900021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED Error - 2/20/2014 8:01:29 PM | Computer Name = AlexsPC | Source = acvpnagent | ID = 67108866Description = Function: CHostConfigMgr::determinePublicAddrCandidateFromDefRouteFile: .\HostConfigMgr.cpp Line: 1769 Invoked Function: CHostConfigMgr::FindDefaultRouteInterfaceReturn Code: -24117215 (0xFE900021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED Error - 2/20/2014 10:50:18 PM | Computer Name = AlexsPC | Source = acvpnagent | ID = 67108866Description = Function: CHostConfigMgr::determinePublicAddrCandidateFromDefRouteFile: .\HostConfigMgr.cpp Line: 1769 Invoked Function: CHostConfigMgr::FindDefaultRouteInterfaceReturn Code: -24117215 (0xFE900021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED Error - 2/20/2014 10:50:23 PM | Computer Name = AlexsPC | Source = acvpnagent | ID = 67108866Description = Function: CHostConfigMgr::determinePublicAddrCandidateFromDefRouteFile: .\HostConfigMgr.cpp Line: 1769 Invoked Function: CHostConfigMgr::FindDefaultRouteInterfaceReturn Code: -24117215 (0xFE900021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED Error - 2/20/2014 11:19:47 PM | Computer Name = AlexsPC | Source = acvpnagent | ID = 67108866Description = Function: CHostConfigMgr::determinePublicAddrCandidateFromDefRouteFile: .\HostConfigMgr.cpp Line: 1769 Invoked Function: CHostConfigMgr::FindDefaultRouteInterfaceReturn Code: -24117215 (0xFE900021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED Error - 2/20/2014 11:19:52 PM | Computer Name = AlexsPC | Source = acvpnagent | ID = 67108866Description = Function: CHostConfigMgr::determinePublicAddrCandidateFromDefRouteFile: .\HostConfigMgr.cpp Line: 1769 Invoked Function: CHostConfigMgr::FindDefaultRouteInterfaceReturn Code: -24117215 (0xFE900021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED [ System Events ]Error - 2/21/2014 12:22:56 AM | Computer Name = AlexsPC | Source = Service Control Manager | ID = 7009Description = A timeout was reached (30000 milliseconds) while waiting for the plsapp service to connect. Error - 2/21/2014 12:22:56 AM | Computer Name = AlexsPC | Source = Service Control Manager | ID = 7000Description = The plsapp service failed to start due to the following error: %%1053 Error - 2/21/2014 12:27:56 AM | Computer Name = AlexsPC | Source = Service Control Manager | ID = 7009Description = A timeout was reached (30000 milliseconds) while waiting for the plsapp service to connect. Error - 2/21/2014 12:27:56 AM | Computer Name = AlexsPC | Source = Service Control Manager | ID = 7000Description = The plsapp service failed to start due to the following error: %%1053 Error - 2/21/2014 12:32:56 AM | Computer Name = AlexsPC | Source = Service Control Manager | ID = 7009Description = A timeout was reached (30000 milliseconds) while waiting for the plsapp service to connect. Error - 2/21/2014 12:32:56 AM | Computer Name = AlexsPC | Source = Service Control Manager | ID = 7000Description = The plsapp service failed to start due to the following error: %%1053 Error - 2/21/2014 12:37:56 AM | Computer Name = AlexsPC | Source = Service Control Manager | ID = 7009Description = A timeout was reached (30000 milliseconds) while waiting for the plsapp service to connect. Error - 2/21/2014 12:37:56 AM | Computer Name = AlexsPC | Source = Service Control Manager | ID = 7000Description = The plsapp service failed to start due to the following error: %%1053 Error - 2/21/2014 12:42:56 AM | Computer Name = AlexsPC | Source = Service Control Manager | ID = 7009Description = A timeout was reached (30000 milliseconds) while waiting for the plsapp service to connect. Error - 2/21/2014 12:42:56 AM | Computer Name = AlexsPC | Source = Service Control Manager | ID = 7000Description = The plsapp service failed to start due to the following error: %%1053 < End of report > Link to post Share on other sites More sharing options...
ejw Posted February 21, 2014 Author ID:794539 Share Posted February 21, 2014 And here is OTL.txt OTL logfile created on: 2/20/2014 10:30:35 PM - Run 1OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Alex Vincent\Desktop\Eric Temp64bit- Professional (Version = 6.2.9200) - Type = NTWorkstationInternet Explorer (Version = 9.11.9600.16518)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 15.89 Gb Total Physical Memory | 13.54 Gb Available Physical Memory | 85.19% Memory free31.89 Gb Paging File | 29.26 Gb Available in Paging File | 91.73% Paging File freePaging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86)Drive C: | 665.92 Gb Total Space | 569.63 Gb Free Space | 85.54% Space Free | Partition Type: NTFSDrive D: | 31.60 Gb Total Space | 3.62 Gb Free Space | 11.46% Space Free | Partition Type: NTFS Computer Name: ALEXSPC | User Name: Alex Vincent | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit ScansCompany Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - File not found --PRC - [2014/02/20 22:19:48 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Alex Vincent\Desktop\Eric Temp\OTL.exePRC - [2014/02/17 07:09:49 | 004,415,328 | ---- | M] (TeamViewer GmbH) -- c:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Desktop.exePRC - [2014/02/17 07:09:48 | 012,493,152 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exePRC - [2014/02/17 07:09:48 | 004,915,040 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exePRC - [2014/02/17 06:53:06 | 000,202,592 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exePRC - [2014/01/23 17:12:52 | 000,091,936 | ---- | M] (PureLeads) -- C:\Program Files (x86)\PureLeads\PureLeadsSvc.exePRC - [2014/01/23 17:12:52 | 000,083,232 | ---- | M] (PureLeads) -- C:\Program Files (x86)\PureLeads\PureLeadsTray.exePRC - [2014/01/23 17:12:50 | 000,024,352 | ---- | M] (sendori) -- C:\Program Files (x86)\PureLeads\PureLeads.Service.exePRC - [2014/01/14 17:57:29 | 000,078,576 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXEPRC - [2014/01/10 13:17:06 | 022,971,416 | ---- | M] (VSee Lab, Inc.) -- C:\Users\Alex Vincent\AppData\Roaming\VSeeInstall\vsee.exePRC - [2013/12/12 16:36:27 | 000,707,472 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exePRC - [2013/12/12 16:36:11 | 000,560,528 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exePRC - [2013/11/14 13:32:10 | 000,194,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXEPRC - [2013/09/09 18:08:05 | 000,069,792 | ---- | M] (Absolute Software Corp.) -- C:\Windows\SysWOW64\rpcnet.exePRC - [2013/09/09 16:29:20 | 000,295,512 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exePRC - [2013/08/14 16:19:24 | 000,039,056 | ---- | M] () -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exePRC - [2013/07/19 09:14:44 | 000,011,112 | ---- | M] (Absolute Software) -- C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exePRC - [2013/07/19 09:14:42 | 000,085,864 | ---- | M] (Absolute Software) -- C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifier.exePRC - [2013/06/07 05:16:54 | 001,641,768 | ---- | M] (HP) -- C:\Program Files (x86)\HP SimplePass\TrueSuiteService.exePRC - [2013/06/07 05:16:42 | 003,695,912 | ---- | M] (AuthenTec Inc.) -- C:\Program Files (x86)\HP SimplePass\TouchControl.exePRC - [2013/06/07 05:16:28 | 004,073,768 | ---- | M] () -- C:\Program Files (x86)\HP SimplePass\IEWebSiteLogon.exePRC - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exePRC - [2013/04/04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exePRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exePRC - [2013/01/27 04:52:33 | 001,711,680 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\Power2Go8\Power2GoExpress8.exePRC - [2012/11/05 17:14:34 | 001,343,904 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exePRC - [2012/10/12 15:16:50 | 000,136,488 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exePRC - [2012/09/07 18:33:08 | 000,581,024 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exePRC - [2012/09/07 18:33:08 | 000,035,232 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exePRC - [2012/09/06 05:50:40 | 001,124,288 | ---- | M] (Motorola Solutions, Inc.) -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exePRC - [2012/08/27 09:45:56 | 001,112,000 | ---- | M] (Motorola Solutions, Inc.) -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exePRC - [2012/07/17 19:10:32 | 000,364,416 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exePRC - [2012/07/17 19:10:30 | 000,276,864 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exePRC - [2012/07/17 19:10:24 | 000,128,896 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exePRC - [2012/07/17 19:10:16 | 000,165,760 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exePRC - [2012/06/07 21:34:06 | 000,111,120 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exePRC - [2012/03/28 19:34:30 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe ========== Modules (No Company Name) ========== MOD - [2014/02/14 16:43:21 | 001,840,640 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\3dfc0be2419d9701d2f96c870b2938d5\System.Web.Services.ni.dllMOD - [2014/02/14 16:22:55 | 000,771,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\32cb131358268f010b801e10cc87a76c\System.Runtime.Remoting.ni.dllMOD - [2014/02/14 10:16:49 | 000,978,432 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\97272e5adde36ea896d7216bf0270e15\System.Configuration.ni.dllMOD - [2014/02/14 10:13:29 | 005,463,552 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\672138dc2f47a077f59ef14290a6973e\System.Xml.ni.dllMOD - [2014/02/14 10:13:23 | 012,436,480 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\a673aacf407b499981342bb709cce917\System.Windows.Forms.ni.dllMOD - [2014/02/14 10:13:11 | 001,593,344 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\d76ae95d56d39a59f727f5518ac8e396\System.Drawing.ni.dllMOD - [2014/02/14 10:12:17 | 007,993,856 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\20af51394609c937507288c2b1cf2c8c\System.ni.dllMOD - [2014/02/14 10:12:10 | 011,499,520 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\3de119146ed0e59408f896aa69cdfc42\mscorlib.ni.dllMOD - [2014/02/14 09:57:48 | 007,803,392 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\fd6afdb3a9309e9af89222b778f5901c\System.Xml.ni.dllMOD - [2014/02/14 09:57:37 | 012,856,320 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\ec3e85d83522363e943a978c0572e360\System.Windows.Forms.ni.dllMOD - [2014/02/14 09:56:52 | 001,635,328 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\15ead42b8d352194f0f3fbba4f7ae02b\System.Drawing.ni.dllMOD - [2014/02/14 09:29:53 | 006,951,424 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\ab8978239d891c4afffd6a6df3996a6e\System.Core.ni.dllMOD - [2014/02/14 09:29:43 | 010,003,456 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\8455c031f8ffe82a0109c563873260e8\System.ni.dllMOD - [2014/02/14 09:16:05 | 000,196,096 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\7ba8bc3c49fb30c9603bf070a0e0d51e\CustomMarshalers.ni.dllMOD - [2014/01/14 17:57:26 | 000,359,592 | ---- | M] () -- C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\c2r32.dllMOD - [2014/01/14 17:54:02 | 000,359,592 | ---- | M] () -- C:\Program Files\Microsoft Office 15\root\office15\c2r32.dllMOD - [2013/12/12 16:36:58 | 000,063,376 | ---- | M] () -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dllMOD - [2013/12/02 18:37:02 | 017,376,944 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\ebdd49343f711b2029293f8e621b28a2\mscorlib.ni.dllMOD - [2013/11/14 13:43:28 | 000,316,584 | ---- | M] () -- C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dllMOD - [2013/11/14 13:30:28 | 000,316,584 | ---- | M] () -- C:\Program Files\Microsoft Office 15\root\office15\appvisvstream32.dllMOD - [2013/09/09 21:32:01 | 000,278,528 | ---- | M] () -- C:\Users\Alex Vincent\AppData\Roaming\VSeeInstall\vseeCryptoppEnc.dllMOD - [2013/06/07 05:16:28 | 004,073,768 | ---- | M] () -- C:\Program Files (x86)\HP SimplePass\IEWebSiteLogon.exeMOD - [2013/06/07 05:16:22 | 000,019,240 | ---- | M] () -- C:\Program Files (x86)\HP SimplePass\DownloadManager.dllMOD - [2013/01/27 08:13:04 | 000,806,664 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go8\UNO.dllMOD - [2013/01/27 08:13:04 | 000,175,880 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go8\CLVistaAudioMixer.dllMOD - [2012/09/25 02:32:18 | 001,320,048 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go8\Language\Enu\P2GRC.dllMOD - [2012/06/08 12:34:06 | 000,016,400 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dllMOD - [2012/06/07 21:34:06 | 000,627,216 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll ========== Services (SafeList) ========== SRV:64bit: - [2014/02/06 04:48:45 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)SRV:64bit: - [2013/11/27 09:36:30 | 003,395,920 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\WSService.dll -- (WSService)SRV:64bit: - [2013/11/27 03:17:40 | 000,263,168 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\bisrv.dll -- (BrokerInfrastructure)SRV:64bit: - [2013/11/22 22:50:00 | 000,282,112 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\SystemEventsBrokerServer.dll -- (SystemEventsBroker)SRV:64bit: - [2013/11/19 14:47:14 | 001,584,128 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\workfolderssvc.dll -- (workfolderssvc)SRV:64bit: - [2013/11/19 14:47:14 | 000,533,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AppReadiness.dll -- (AppReadiness)SRV:64bit: - [2013/11/19 14:43:10 | 000,076,800 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\inetsrv\w3logsvc.dll -- (w3logsvc)SRV:64bit: - [2013/11/07 21:41:17 | 001,302,528 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AppXDeploymentServer.dll -- (AppXSvc)SRV:64bit: - [2013/10/31 09:08:22 | 001,907,896 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe -- (OfficeSvc)SRV:64bit: - [2013/09/29 22:03:25 | 000,365,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wcmsvc.dll -- (Wcmsvc)SRV:64bit: - [2013/09/29 22:03:24 | 001,555,456 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wlidsvc.dll -- (wlidsvc)SRV:64bit: - [2013/09/29 22:03:23 | 000,491,520 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\GeofenceMonitorService.dll -- (lfsvc)SRV:64bit: - [2013/09/29 21:51:09 | 000,183,296 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)SRV:64bit: - [2013/09/29 21:51:09 | 000,090,464 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\KeyboardFilterSvc.dll -- (MsKeyboardFilter)SRV:64bit: - [2013/09/10 23:17:03 | 000,323,072 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Program Files\IDT\WDM\stacsv64.exe -- (STacSV)SRV:64bit: - [2013/08/22 06:32:01 | 000,346,872 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Windows Defender\NisSrv.exe -- (WdNisSvc)SRV:64bit: - [2013/08/22 06:32:00 | 000,023,840 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)SRV:64bit: - [2013/08/22 06:31:56 | 002,899,968 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)SRV:64bit: - [2013/08/22 05:32:02 | 000,024,576 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wephostsvc.dll -- (WEPHOSTSVC)SRV:64bit: - [2013/08/22 05:31:43 | 000,040,448 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\efssvc.dll -- (EFS)SRV:64bit: - [2013/08/22 05:22:45 | 000,066,048 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wiarpc.dll -- (WiaRpc)SRV:64bit: - [2013/08/22 05:21:15 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\svsvc.dll -- (svsvc)SRV:64bit: - [2013/08/22 05:16:57 | 000,118,272 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\fhsvc.dll -- (fhsvc)SRV:64bit: - [2013/08/22 04:25:28 | 000,164,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\NcaSvc.dll -- (NcaSvc)SRV:64bit: - [2013/08/22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicvss)SRV:64bit: - [2013/08/22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmictimesync)SRV:64bit: - [2013/08/22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicshutdown)SRV:64bit: - [2013/08/22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicrdv)SRV:64bit: - [2013/08/22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmickvpexchange)SRV:64bit: - [2013/08/22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicheartbeat)SRV:64bit: - [2013/08/22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicguestinterface)SRV:64bit: - [2013/08/22 04:04:53 | 000,716,288 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsm.dll -- (LSM)SRV:64bit: - [2013/08/22 04:02:47 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\smphost.dll -- (smphost)SRV:64bit: - [2013/08/22 03:59:26 | 000,832,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\netlogon.dll -- (Netlogon)SRV:64bit: - [2013/08/22 03:57:25 | 000,130,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\ScDeviceEnum.dll -- (ScDeviceEnum)SRV:64bit: - [2013/08/22 03:54:59 | 000,059,392 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\keyiso.dll -- (KeyIso)SRV:64bit: - [2013/08/22 03:50:59 | 000,245,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\TimeBrokerServer.dll -- (TimeBroker)SRV:64bit: - [2013/08/22 03:50:00 | 000,525,312 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofmsvc.dll -- (netprofm)SRV:64bit: - [2013/08/22 03:45:59 | 000,151,040 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\ncbservice.dll -- (NcbService)SRV:64bit: - [2013/08/22 03:40:49 | 000,248,832 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\vaultsvc.dll -- (VaultSvc)SRV:64bit: - [2013/08/22 03:40:14 | 000,398,848 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\das.dll -- (DeviceAssociationService)SRV:64bit: - [2013/08/22 03:39:33 | 000,198,656 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\AudioEndpointBuilder.dll -- (AudioEndpointBuilder)SRV:64bit: - [2013/08/22 03:31:03 | 000,201,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\DeviceSetupManager.dll -- (DsmSvc)SRV:64bit: - [2013/08/22 03:15:54 | 000,073,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\NcdAutoSetup.dll -- (NcdAutoSetup)SRV:64bit: - [2013/06/13 15:59:34 | 003,376,880 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe -- (ZeroConfigService)SRV:64bit: - [2013/06/13 15:59:22 | 000,273,136 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)SRV:64bit: - [2013/06/13 15:59:14 | 000,626,416 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)SRV:64bit: - [2013/06/13 15:59:00 | 000,149,744 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)SRV:64bit: - [2013/01/08 00:31:42 | 000,401,856 | ---- | M] (AuthenTec, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\AuthenTec\TrueService.exe -- (TrueService)SRV:64bit: - [2012/09/24 14:40:56 | 000,031,040 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\hpservice.exe -- (hpsrv)SRV:64bit: - [2012/09/13 05:33:50 | 000,731,688 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3)SRV:64bit: - [2012/09/06 02:47:02 | 000,028,160 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\valWBFPolicyService.exe -- (valWBFPolicyService)SRV:64bit: - [2012/08/15 18:08:14 | 000,135,984 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr)SRV:64bit: - [2012/04/20 15:16:12 | 000,635,104 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\iCLS Client\HeciServer.exe -- (Intel®SRV:64bit: - [2010/04/14 19:01:46 | 001,052,328 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxeecoms.exe -- (lxee_device)SRV - [2014/02/20 17:04:36 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)SRV - [2014/02/17 07:09:48 | 004,915,040 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe -- (TeamViewer9)SRV - [2014/02/12 18:36:33 | 000,118,896 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)SRV - [2014/02/11 19:09:59 | 000,647,680 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)SRV - [2014/01/23 17:12:52 | 000,091,936 | ---- | M] (PureLeads) [Auto | Running] -- C:\Program Files (x86)\PureLeads\PureLeadsSvc.exe -- (PlsvcV1)SRV - [2014/01/23 17:12:50 | 003,690,784 | ---- | M] (Sendori) [Auto | Stopped] -- C:\Program Files (x86)\PureLeads\plsapp.exe -- (plsapp)SRV - [2014/01/23 17:12:50 | 000,024,352 | ---- | M] (sendori) [Auto | Running] -- C:\Program Files (x86)\PureLeads\PureLeads.Service.exe -- (PlsvcV2)SRV - [2013/12/21 00:02:54 | 000,279,000 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)SRV - [2013/12/12 16:36:11 | 000,560,528 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe -- (vpnagent)SRV - [2013/11/19 14:43:12 | 000,475,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS)SRV - [2013/11/19 14:43:10 | 000,066,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\inetsrv\w3logsvc.dll -- (w3logsvc)SRV - [2013/11/19 14:43:10 | 000,062,464 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc)SRV - [2013/11/04 18:31:56 | 000,092,160 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe -- (HP Support Assistant Service)SRV - [2013/09/29 22:03:22 | 000,357,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GeofenceMonitorService.dll -- (lfsvc)SRV - [2013/09/09 18:08:05 | 000,069,792 | ---- | M] (Absolute Software Corp.) [Auto | Running] -- C:\Windows\SysWOW64\rpcnet.exe -- (rpcnet)SRV - [2013/08/22 06:31:56 | 002,899,968 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)SRV - [2013/08/21 21:55:35 | 000,018,944 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\StorSvc.dll -- (StorSvc)SRV - [2013/08/21 20:53:34 | 000,011,776 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\smphost.dll -- (smphost)SRV - [2013/08/14 16:19:24 | 000,039,056 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe -- (RealNetworks Downloader Resolver Service)SRV - [2013/07/19 09:14:44 | 000,011,112 | ---- | M] (Absolute Software) [Auto | Running] -- C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe -- (AbsoluteNotifier)SRV - [2013/06/07 05:16:54 | 001,641,768 | ---- | M] (HP) [Auto | Running] -- C:\Program Files (x86)\HP SimplePass\TrueSuiteService.exe -- (FPLService)SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)SRV - [2012/10/12 18:22:08 | 000,035,744 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe -- (HPConnectedRemote)SRV - [2012/09/27 21:42:26 | 000,014,904 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)SRV - [2012/09/07 18:33:08 | 000,035,232 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe -- (HPWMISVC)SRV - [2012/09/06 05:50:40 | 001,124,288 | ---- | M] (Motorola Solutions, Inc.) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe -- (Bluetooth OBEX Service)SRV - [2012/08/27 09:45:56 | 001,112,000 | ---- | M] (Motorola Solutions, Inc.) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe -- (Bluetooth Device Monitor)SRV - [2012/07/24 20:00:08 | 002,457,232 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe -- (IconMan_R)SRV - [2012/07/17 19:10:32 | 000,364,416 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe -- (UNS)SRV - [2012/07/17 19:10:30 | 000,276,864 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe -- (LMS)SRV - [2012/07/17 19:10:24 | 000,128,896 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe -- (Intel®SRV - [2012/07/17 19:10:16 | 000,165,760 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe -- (jhi_service)SRV - [2010/10/12 11:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService) ========== Driver Services (SafeList) ========== DRV:64bit: - [2014/01/07 19:46:27 | 000,325,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\USBXHCI.SYS -- (USBXHCI)DRV:64bit: - [2013/12/21 00:02:44 | 004,216,320 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)DRV:64bit: - [2013/12/17 16:04:08 | 000,046,232 | ---- | M] (NetFilterSDK.com) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\netfilter64.sys -- (netfilter64)DRV:64bit: - [2013/12/14 17:34:54 | 000,039,320 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\intelaud.sys -- (intaud_WaveExtensible)DRV:64bit: - [2013/12/14 17:34:54 | 000,027,032 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iwdbus.sys -- (iwdbus)DRV:64bit: - [2013/12/12 16:14:30 | 000,112,496 | R--- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acsock64.sys -- (acsock)DRV:64bit: - [2013/11/19 14:47:14 | 000,057,176 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\stornvme.sys -- (stornvme)DRV:64bit: - [2013/11/19 14:45:34 | 000,136,536 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\wfplwfs.sys -- (WFPLWFS)DRV:64bit: - [2013/11/10 20:48:41 | 000,039,768 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\intelpep.sys -- (intelpep)DRV:64bit: - [2013/11/01 05:39:53 | 000,086,872 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\pdc.sys -- (pdc)DRV:64bit: - [2013/10/30 18:58:59 | 000,372,568 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\spaceport.sys -- (spaceport)DRV:64bit: - [2013/10/25 19:54:32 | 000,146,776 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SerCx2.sys -- (SerCx2)DRV:64bit: - [2013/10/10 15:31:34 | 000,052,080 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpnva64-6.sys -- (vpnva)DRV:64bit: - [2013/09/29 22:03:22 | 000,467,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\USBHUB3.SYS -- (USBHUB3)DRV:64bit: - [2013/09/29 22:03:22 | 000,236,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)DRV:64bit: - [2013/09/29 22:03:22 | 000,175,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VerifierExt.sys -- (VerifierExt)DRV:64bit: - [2013/09/29 21:51:11 | 000,022,272 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\kbldfltr.sys -- (kbldfltr)DRV:64bit: - [2013/09/29 21:51:09 | 000,027,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)DRV:64bit: - [2013/09/29 21:51:00 | 000,037,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\terminpt.sys -- (terminpt)DRV:64bit: - [2013/09/29 21:50:59 | 000,220,672 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Vid.sys -- (Vid)DRV:64bit: - [2013/09/29 21:50:59 | 000,129,536 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmbusr.sys -- (vmbusr)DRV:64bit: - [2013/09/29 21:50:59 | 000,068,608 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\storvsp.sys -- (storvsp)DRV:64bit: - [2013/09/29 21:50:59 | 000,065,536 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpcivsp.sys -- (vpcivsp)DRV:64bit: - [2013/09/10 23:17:03 | 000,542,208 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)DRV:64bit: - [2013/09/04 18:03:50 | 003,345,376 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwew00.sys -- (NETwNe64)DRV:64bit: - [2013/08/22 07:25:40 | 000,043,008 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\condrv.sys -- (condrv)DRV:64bit: - [2013/08/22 07:25:40 | 000,030,048 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\WINDOWS\SysNative\drivers\fs_rec.sys -- (Fs_Rec)DRV:64bit: - [2013/08/22 06:50:19 | 000,057,696 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\dam.sys -- (dam)DRV:64bit: - [2013/08/22 06:49:54 | 000,079,712 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\acpiex.sys -- (acpiex)DRV:64bit: - [2013/08/22 06:49:33 | 000,159,584 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)DRV:64bit: - [2013/08/22 06:43:49 | 000,063,840 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\mvumis.sys -- (mvumis)DRV:64bit: - [2013/08/22 06:43:48 | 000,146,272 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msgpioclx.sys -- (GPIOClx0101)DRV:64bit: - [2013/08/22 06:43:48 | 000,041,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msgpiowin32.sys -- (msgpiowin32)DRV:64bit: - [2013/08/22 06:43:45 | 003,357,024 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)DRV:64bit: - [2013/08/22 06:43:45 | 000,093,536 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)DRV:64bit: - [2013/08/22 06:43:45 | 000,082,784 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sss.sys -- (LSI_SSS)DRV:64bit: - [2013/08/22 06:43:45 | 000,064,352 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)DRV:64bit: - [2013/08/22 06:43:44 | 000,081,760 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas3.sys -- (LSI_SAS3)DRV:64bit: - [2013/08/22 06:43:41 | 000,782,176 | ---- | M] (PMC-Sierra) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\adp80xx.sys -- (ADP80XX)DRV:64bit: - [2013/08/22 06:43:41 | 000,531,296 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)DRV:64bit: - [2013/08/22 06:43:41 | 000,259,424 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)DRV:64bit: - [2013/08/22 06:43:41 | 000,108,896 | ---- | M] (LSI) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\3ware.sys -- (3ware)DRV:64bit: - [2013/08/22 06:43:41 | 000,079,200 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)DRV:64bit: - [2013/08/22 06:43:40 | 000,114,016 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\EhStorTcgDrv.sys -- (EhStorTcgDrv)DRV:64bit: - [2013/08/22 06:43:40 | 000,082,784 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\EhStorClass.sys -- (EhStorClass)DRV:64bit: - [2013/08/22 06:43:40 | 000,025,952 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)DRV:64bit: - [2013/08/22 06:43:34 | 000,305,504 | ---- | M] (VIA Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\VSTXRAID.SYS -- (VSTXRAID)DRV:64bit: - [2013/08/22 06:43:33 | 000,189,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UCX01000.SYS -- (UCX01000)DRV:64bit: - [2013/08/22 06:43:33 | 000,074,080 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\uaspstor.sys -- (UASPStor)DRV:64bit: - [2013/08/22 06:43:32 | 000,078,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdstor.sys -- (sdstor)DRV:64bit: - [2013/08/22 06:43:32 | 000,031,072 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)DRV:64bit: - [2013/08/22 06:43:31 | 000,107,872 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\storahci.sys -- (storahci)DRV:64bit: - [2013/08/22 06:43:31 | 000,072,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SpbCx.sys -- (SpbCx)DRV:64bit: - [2013/08/22 06:43:31 | 000,069,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SerCx.sys -- (SerCx)DRV:64bit: - [2013/08/22 06:41:08 | 000,054,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wpcfltr.sys -- (wpcfltr)DRV:64bit: - [2013/08/22 06:39:44 | 000,377,696 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\clfs.sys -- (CLFS)DRV:64bit: - [2013/08/22 06:39:15 | 000,924,512 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\refs.sys -- (ReFS)DRV:64bit: - [2013/08/22 06:39:15 | 000,026,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\uefi.sys -- (UEFI)DRV:64bit: - [2013/08/22 06:37:27 | 000,069,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpci.sys -- (vpci)DRV:64bit: - [2013/08/22 06:36:12 | 000,026,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WpdUpFltr.sys -- (WpdUpFltr)DRV:64bit: - [2013/08/22 06:34:22 | 000,265,056 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\WdFilter.sys -- (WdFilter)DRV:64bit: - [2013/08/22 06:34:22 | 000,124,256 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WdNisDrv.sys -- (WdNisDrv)DRV:64bit: - [2013/08/22 06:31:28 | 000,034,760 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\WdBoot.sys -- (WdBoot)DRV:64bit: - [2013/08/22 05:40:00 | 000,033,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)DRV:64bit: - [2013/08/22 05:39:58 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)DRV:64bit: - [2013/08/22 05:39:54 | 000,076,800 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ahcache.sys -- (ahcache)DRV:64bit: - [2013/08/22 05:39:31 | 000,050,688 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BasicDisplay.sys -- (BasicDisplay)DRV:64bit: - [2013/08/22 05:39:28 | 000,033,792 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BasicRender.sys -- (BasicRender)DRV:64bit: - [2013/08/22 05:39:20 | 000,022,016 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HyperVideo.sys -- (HyperVideo)DRV:64bit: - [2013/08/22 05:39:06 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mshidumdf.sys -- (mshidumdf)DRV:64bit: - [2013/08/22 05:38:58 | 000,010,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acpitime.sys -- (acpitime)DRV:64bit: - [2013/08/22 05:38:48 | 000,010,240 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acpipagr.sys -- (acpipagr)DRV:64bit: - [2013/08/22 05:38:39 | 000,036,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BthAvrcpTg.sys -- (BthAvrcpTg)DRV:64bit: - [2013/08/22 05:38:26 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kdnic.sys -- (kdnic)DRV:64bit: - [2013/08/22 05:38:23 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmgencounter.sys -- (gencounter)DRV:64bit: - [2013/08/22 05:38:22 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\npsvctrig.sys -- (npsvctrig)DRV:64bit: - [2013/08/22 05:38:16 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BthhfHid.sys -- (bthhfhid)DRV:64bit: - [2013/08/22 05:37:49 | 000,013,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hyperkbd.sys -- (hyperkbd)DRV:64bit: - [2013/08/22 05:37:46 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)DRV:64bit: - [2013/08/22 05:37:42 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bthhfenum.sys -- (BthHFEnum)DRV:64bit: - [2013/08/22 05:37:28 | 000,056,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)DRV:64bit: - [2013/08/22 05:37:28 | 000,041,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hidi2c.sys -- (hidi2c)DRV:64bit: - [2013/08/22 05:37:14 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)DRV:64bit: - [2013/08/22 05:36:43 | 000,087,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netvsc63.sys -- (netvsc)DRV:64bit: - [2013/08/22 05:36:37 | 000,224,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BthLEEnum.sys -- (BthLEEnum)DRV:64bit: - [2013/08/22 05:36:25 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NdisVirtualBus.sys -- (NdisVirtualBus)DRV:64bit: - [2013/08/22 05:36:17 | 000,124,928 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NdisImPlatform.sys -- (NdisImPlatform)DRV:64bit: - [2013/08/22 05:36:07 | 000,066,560 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mslldp.sys -- (MsLldp)DRV:64bit: - [2013/08/22 05:35:42 | 000,103,424 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\Ndu.sys -- (Ndu)DRV:64bit: - [2013/08/22 02:46:33 | 000,027,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fxppm.sys -- (FxPPM)DRV:64bit: - [2013/08/12 17:25:46 | 000,017,624 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bcmfn2.sys -- (bcmfn2)DRV:64bit: - [2013/08/09 18:39:30 | 000,651,248 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorAV.sys -- (iaStorAV)DRV:64bit: - [2013/07/30 12:47:35 | 000,024,568 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iaLPSSi_GPIO.sys -- (iaLPSSi_GPIO)DRV:64bit: - [2013/07/25 13:05:39 | 000,099,320 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iaLPSSi_I2C.sys -- (iaLPSSi_I2C)DRV:64bit: - [2013/06/18 08:46:17 | 000,591,360 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt630x64.sys -- (RTL8168)DRV:64bit: - [2013/04/30 11:56:42 | 000,011,552 | ---- | M] (LogMeIn, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\lmimirr.sys -- (lmimirr)DRV:64bit: - [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)DRV:64bit: - [2013/03/25 14:41:46 | 000,076,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d)DRV:64bit: - [2012/10/09 19:48:48 | 000,188,896 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\xHCIPort.sys -- (XHCIPort)DRV:64bit: - [2012/10/09 19:48:48 | 000,047,072 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usb3Hub.sys -- (usb3Hub)DRV:64bit: - [2012/09/28 12:37:04 | 000,650,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\iaStorA.sys -- (iaStorA)DRV:64bit: - [2012/09/24 14:40:56 | 000,043,840 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelerometer.sys -- (Accelerometer)DRV:64bit: - [2012/09/24 14:40:56 | 000,031,040 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpdskflt.sys -- (hpdskflt)DRV:64bit: - [2012/09/14 16:09:34 | 000,457,528 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)DRV:64bit: - [2012/09/14 16:09:32 | 000,043,832 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Smb_driver_Intel.sys -- (SmbDrvI)DRV:64bit: - [2012/09/14 16:09:32 | 000,041,272 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Smb_driver_AMDASF.sys -- (SmbDrv)DRV:64bit: - [2012/09/13 05:35:08 | 000,162,344 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPAL)DRV:64bit: - [2012/08/31 10:40:24 | 000,020,800 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WirelessButtonDriver64.sys -- (WirelessButtonDriver)DRV:64bit: - [2012/08/29 09:36:54 | 000,857,472 | ---- | M] (Motorola Solutions, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btmhsf.sys -- (btmhsf)DRV:64bit: - [2012/08/08 21:17:50 | 000,273,040 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsP2Stor.sys -- (RSP2STOR)DRV:64bit: - [2012/08/06 12:07:08 | 000,068,136 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iBtFltCoex.sys -- (iBtFltCoex)DRV:64bit: - [2012/07/02 17:16:02 | 000,062,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)DRV:64bit: - [2012/06/25 11:24:50 | 000,092,536 | ---- | M] (CyberLink) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\CLVirtualDrive.sys -- (CLVirtualDrive)DRV:64bit: - [2012/06/20 00:40:52 | 000,342,528 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)DRV:64bit: - [2010/11/17 15:05:14 | 000,105,072 | ---- | M] (Blackhawk) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\bh560eth.sys -- (bh560eth) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT13/1IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT13/1IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJSIE:64bit: - HKLM\..\SearchScopes\{C5E3F919-B9AA-472F-986A-6B3C88549BCE}: "URL" = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}IE:64bit: - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htmIE - HKLM\..\SearchScopes,DefaultScope =IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRCIE - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms} IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-486706304-2225237594-3729880486-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT13/1IE - HKU\S-1-5-21-486706304-2225237594-3729880486-1001\..\SearchScopes,DefaultScope = {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}IE - HKU\S-1-5-21-486706304-2225237594-3729880486-1001\..\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}: "URL" = http://search.conduit.com/Results.aspx?ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP7A41A60D-72A5-4A62-8ACA-6DC9F576C78A&q={searchTerms}&SSPV=IE - HKU\S-1-5-21-486706304-2225237594-3729880486-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJSIE - HKU\S-1-5-21-486706304-2225237594-3729880486-1001\..\SearchScopes\{6673B3C7-0244-486D-8607-B998902D048C}: "URL" = http://www.google.com/search?q={searchTerms}IE - HKU\S-1-5-21-486706304-2225237594-3729880486-1001\..\SearchScopes\{C5E3F919-B9AA-472F-986A-6B3C88549BCE}: "URL" = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}IE - HKU\S-1-5-21-486706304-2225237594-3729880486-1001\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}IE - HKU\S-1-5-21-486706304-2225237594-3729880486-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "https://www.google.com"FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:27.0.1FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll File not foundFF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll (Adobe Systems, Inc.)FF - HKLM\Software\MozillaPlugins\@authentec.com/ffwloplugin: C:\Program Files (x86)\HP SimplePass\npffwloplugin.dll ( HP)FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.51.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.51.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/Lync,version=15.0: C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3503.0728: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.3.51: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.3: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.3: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.3: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.3.51: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()FF - HKCU\Software\MozillaPlugins\vsee.com/VSeeDetection: C:\Users\Alex Vincent\AppData\Roaming\VSeeInstall\npVSeeDetection.dll (VSee Lab) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2013/09/09 16:29:33 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013/09/09 16:29:33 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\componentsFF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\pluginsFF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{8492baab-62ca-4e2c-983b-dfef7cae8082}: C:\Program Files (x86)\PassShow\154.xpi [2013/10/05 16:04:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Alex Vincent\AppData\Roaming\Mozilla\Extensions[2014/02/16 15:29:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Alex Vincent\AppData\Roaming\Mozilla\Firefox\Profiles\1325qnyh.default-1392522069781\extensions[2014/02/18 16:24:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions[2014/02/18 16:24:41 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} ========== Chrome ========== CHR - default_search_provider: Conduit Search (Enabled)CHR - default_search_provider: search_url = http://search.conduit.com/Results.aspx?ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP7A41A60D-72A5-4A62-8ACA-6DC9F576C78A&q={searchTerms}&SSPV=CHR - default_search_provider: suggest_url = http://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms},CHR - homepage: http://search.conduit.com/?ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP7A41A60D-72A5-4A62-8ACA-6DC9F576C78A&SSPV=CHR - Extension: Google Docs = C:\Users\Alex Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\CHR - Extension: Google Docs = C:\Users\Alex Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\CHR - Extension: Google Drive = C:\Users\Alex Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\CHR - Extension: Google Drive = C:\Users\Alex Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\CHR - Extension: YouTube = C:\Users\Alex Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\CHR - Extension: YouTube = C:\Users\Alex Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\CHR - Extension: Google Search = C:\Users\Alex Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\CHR - Extension: Google Search = C:\Users\Alex Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\CHR - Extension: RealDownloader = C:\Users\Alex Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.3_0\CHR - Extension: Website Logon = C:\Users\Alex Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\kanflfepiobnpjbljmngfgegijhdpljm\6.0.100_0\CHR - Extension: Google Wallet = C:\Users\Alex Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\CHR - Extension: Gmail = C:\Users\Alex Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\CHR - Extension: Gmail = C:\Users\Alex Vincent\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\ O1 HOSTS File: ([2013/08/22 07:25:41 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hostsO2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)O2:64bit: - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)O2:64bit: - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL (Microsoft Corporation)O2 - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\office15\GROOVEEX.DLL (Microsoft Corporation)O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)O2 - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)O3 - HKU\S-1-5-21-486706304-2225237594-3729880486-1001\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.O3 - HKU\S-1-5-21-486706304-2225237594-3729880486-1001\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.O4:64bit: - HKLM..\Run: [bTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll (Motorola Solutions, Inc.)O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\SysNative\hkcmd.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [igfxTray] C:\WINDOWS\SysNative\igfxtray.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [Persistence] C:\WINDOWS\SysNative\igfxpers.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)O4 - HKLM..\Run: [] File not foundO4 - HKLM..\Run: [Absolute Notifier] C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifier.exe (Absolute Software)O4 - HKLM..\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Cisco Systems, Inc.)O4 - HKLM..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)O4 - HKLM..\Run: [PureLeads Tray] C:\Program Files (x86)\PureLeads\PureLeadsTray.exe (PureLeads)O4 - HKLM..\Run: [RemoteControl10] C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)O4 - HKU\S-1-5-21-486706304-2225237594-3729880486-1001..\Run: [Power2GoExpress8] C:\Program Files (x86)\CyberLink\Power2Go8\Power2GoExpress8.exe (CyberLink Corp.)O4 - HKU\S-1-5-21-486706304-2225237594-3729880486-1001..\Run: [VSee] C:\Users\Alex Vincent\AppData\Roaming\VSeeInstall\vsee.exe (VSee Lab, Inc.)O4:64bit: - HKLM..\RunOnce: [NCPluginUpdater] C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe (Hewlett-Packard)O4 - Startup: C:\Users\Alex Vincent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk = C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE (Microsoft Corporation)O8:64bit: - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll (Microsoft Corporation)O8:64bit: - Extra context menu item: Send to Bluetooth - C:\Program Files (x86)\Intel\Bluetooth\btSendToObject.htm ()O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE (Microsoft Corporation)O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll (Microsoft Corporation)O8 - Extra context menu item: Send to Bluetooth - C:\Program Files (x86)\Intel\Bluetooth\btSendToObject.htm ()O9:64bit: - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)O9:64bit: - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)O9:64bit: - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)O9:64bit: - Extra Button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - Reg Error: Key error. File not foundO9:64bit: - Extra 'Tools' menuitem : Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - Reg Error: Key error. File not foundO9:64bit: - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)O9:64bit: - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)O9 - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll (Microsoft Corporation)O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\WINDOWS\SysNative\plsapp64.dll (Sendori)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\WINDOWS\SysNative\plsapp64.dll (Sendori)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\WINDOWS\SysNative\plsapp64.dll (Sendori)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\WINDOWS\SysNative\plsapp64.dll (Sendori)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000016 - C:\WINDOWS\SysNative\plsapp64.dll (Sendori)O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\SysWow64\plsapp.dll (Sendori)O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\SysWow64\plsapp.dll (Sendori)O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\SysWow64\plsapp.dll (Sendori)O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\SysWow64\plsapp.dll (Sendori)O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\SysWow64\plsapp.dll (Sendori)O1364bit: - gopher Prefix: missingO13 - gopher Prefix: missingO17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.50.0.1O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AC3C71CD-9994-4FEA-8105-E01681F02683}: DhcpNameServer = 10.50.0.1O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F255D4F5-805E-4D33-8CD1-6C50082B7CB1}: DhcpNameServer = 10.50.0.1O18:64bit: - Protocol\Handler\osf - No CLSID value foundO18:64bit: - Protocol\Handler\wlpg - No CLSID value foundO18 - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\SysWow64\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\WINDOWS\SysWow64\userinit.exe (Microsoft Corporation)O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\WINDOWS\SysNative\igfxdev.dll (Intel Corporation)O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.O30 - LSA: Security Packages - (livessp) - File not foundO32 - HKLM CDRom: AutoRun - 1O34 - HKLM BootExecute: (autocheck autochk *)O35:64bit: - HKLM\..comfile [open] -- "%1" %*O35:64bit: - HKLM\..exefile [open] -- "%1" %*O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2014/02/20 22:27:05 | 000,000,000 | ---D | C] -- C:\Users\Alex Vincent\Desktop\Eric Temp[2014/02/19 19:10:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lexmark[2014/02/19 18:20:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT[2014/02/19 18:08:42 | 000,000,000 | ---D | C] -- C:\AdwCleaner[2014/02/19 18:07:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java[2014/02/18 22:18:20 | 000,000,000 | ---D | C] -- C:\Users\Alex Vincent\AppData\Roaming\Malwarebytes[2014/02/18 22:18:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware[2014/02/18 22:18:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes[2014/02/18 22:18:03 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\SysNative\drivers\mbam.sys[2014/02/18 22:18:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware[2014/02/18 16:24:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service[2014/02/18 16:24:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox[2014/02/16 15:28:49 | 000,439,296 | ---- | C] (Sendori) -- C:\WINDOWS\SysNative\plsapp64.dll[2014/02/16 15:28:49 | 000,354,592 | ---- | C] (Sendori) -- C:\WINDOWS\SysWow64\plsapp.dll[2014/02/16 15:28:44 | 000,000,000 | ---D | C] -- C:\ProgramData\PureLeads[2014/02/16 15:28:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PureLeads[2014/02/15 21:41:15 | 000,000,000 | ---D | C] -- C:\Users\Alex Vincent\Desktop\Old Firefox Data[2014/02/15 19:10:28 | 000,000,000 | ---D | C] -- C:\Users\Alex Vincent\Documents\eagle[2014/02/15 19:09:19 | 000,000,000 | ---D | C] -- C:\Users\Alex Vincent\AppData\Roaming\CadSoft[2014/02/12 18:26:22 | 000,000,000 | ---D | C] -- C:\Users\Alex Vincent\.TI-trace[2014/02/12 00:13:38 | 000,000,000 | ---D | C] -- C:\Users\Alex Vincent\AppData\Roaming\Download Manager[2014/02/11 20:21:51 | 000,000,000 | ---D | C] -- C:\Users\Alex Vincent\AppData\Roaming\Macrovision[2014/02/11 20:21:51 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallShield[2014/02/11 20:21:49 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet[2014/02/11 20:21:47 | 000,000,000 | ---D | C] -- C:\Users\Alex Vincent\AppData\Local\Code Composer Studio[2014/02/11 20:21:39 | 000,000,000 | ---D | C] -- C:\Users\Alex Vincent\workspace_v5_5[2014/02/11 20:08:46 | 000,000,000 | ---D | C] -- C:\Users\Alex Vincent\AppData\Local\.TI[2014/02/11 20:04:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Texas Instruments[2014/02/11 20:01:11 | 000,102,400 | ---- | C] (Spectrum Digital Incorporated) -- C:\WINDOWS\SysWow64\sdxds510usb.dll[2014/02/11 20:01:10 | 000,130,560 | ---- | C] (Spectrum Digital Incorporated) -- C:\WINDOWS\SysWow64\sdspi515.dll[2014/02/11 20:01:10 | 000,128,512 | ---- | C] (Spectrum Digital Incorporated) -- C:\WINDOWS\SysWow64\sdspi525.dll[2014/02/11 20:01:10 | 000,104,960 | ---- | C] (Spectrum Digital Incorporated) -- C:\WINDOWS\SysWow64\sddllmgt2.dll[2014/02/11 20:01:10 | 000,100,352 | ---- | C] (Spectrum Digital Incorporated) -- C:\WINDOWS\SysWow64\sdtsrv.dll[2014/02/11 19:56:51 | 000,000,000 | ---D | C] -- C:\Program Files\DIFX[2014/02/11 19:56:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TI Emulators[2014/02/11 19:54:29 | 000,181,008 | ---- | C] (Blackhawk) -- C:\WINDOWS\SysNative\blackhwk.cpl[2014/02/11 19:54:20 | 000,105,072 | ---- | C] (Blackhawk) -- C:\WINDOWS\SysNative\drivers\bh560eth.sys[2014/02/11 19:54:20 | 000,056,944 | ---- | C] (Blackhawk) -- C:\WINDOWS\SysNative\bh560eth.exe[2014/02/11 19:54:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Blackhawk[2014/02/11 19:54:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\Downloaded Installations[2014/02/11 19:54:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Blackhawk[2014/02/11 19:32:19 | 000,000,000 | ---D | C] -- C:\ti[2014/02/11 19:16:01 | 000,000,000 | ---D | C] -- C:\Users\Alex Vincent\.TI[2014/02/11 19:09:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Macrovision Shared[2014/02/11 19:02:25 | 000,000,000 | ---D | C] -- C:\Users\Alex Vincent\ti[2014/02/11 19:01:53 | 000,000,000 | ---D | C] -- C:\Users\Alex Vincent\Documents\mc[2014/02/11 19:00:50 | 000,000,000 | ---D | C] -- C:\Users\Alex Vincent\Documents\Microcontrollers[2014/02/11 19:00:09 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallJammer Registry[2014/02/06 11:37:19 | 000,000,000 | ---D | C] -- C:\Users\Alex Vincent\Documents\CFBC Stuff[2014/02/05 17:30:17 | 000,000,000 | ---D | C] -- C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F}[2014/01/28 21:23:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump[2014/01/26 21:47:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco[2014/01/23 17:19:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\SysNative\appmgmt[2014/01/23 17:15:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamViewer[2013/09/09 18:06:32 | 006,046,632 | ---- | C] (Absolute Software Corp.) -- C:\Users\Alex Vincent\AppData\Local\Setup.exe ========== Files - Modified Within 30 Days ========== [2014/02/20 22:04:01 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job[2014/02/20 22:00:05 | 000,000,376 | ---- | M] () -- C:\WINDOWS\tasks\HPCeeScheduleForAlex Vincent.job[2014/02/20 21:19:42 | 000,017,408 | ---- | M] () -- C:\WINDOWS\SysNative\rpcnetp.exe[2014/02/20 21:19:41 | 000,067,584 | --S- | M] () -- C:\WINDOWS\bootstat.dat[2014/02/20 11:43:04 | 000,958,356 | ---- | M] () -- C:\WINDOWS\SysNative\PerfStringBackup.INI[2014/02/20 11:43:04 | 000,797,164 | ---- | M] () -- C:\WINDOWS\SysNative\perfh009.dat[2014/02/20 11:43:04 | 000,161,882 | ---- | M] () -- C:\WINDOWS\SysNative\perfc009.dat[2014/02/20 01:05:12 | 000,069,792 | ---- | M] (Absolute Software Corp.) -- C:\WINDOWS\SysWow64\rpcnet.dll[2014/02/20 01:05:12 | 000,017,408 | ---- | M] () -- C:\WINDOWS\SysWow64\rpcnetp.dll[2014/02/20 01:04:27 | 268,435,456 | -HS- | M] () -- C:\swapfile.sys[2014/02/20 01:04:26 | 766,103,549 | -HS- | M] () -- C:\hiberfil.sys[2014/02/20 01:04:26 | 1028,117,903 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP[2014/02/20 01:04:21 | 000,017,408 | ---- | M] () -- C:\WINDOWS\SysWow64\rpcnetp.exe[2014/02/20 01:04:19 | 000,029,528 | ---- | M] () -- C:\WINDOWS\SysNative\wpbbin.exe[2014/02/19 19:29:15 | 000,484,272 | ---- | M] () -- C:\WINDOWS\SysNative\FNTCACHE.DAT[2014/02/18 22:18:09 | 000,001,121 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk[2014/02/15 19:26:41 | 000,001,981 | ---- | M] () -- C:\Users\Alex Vincent\Desktop\Sync Folder.lnk[2014/02/11 19:21:02 | 000,000,000 | ---- | M] () -- C:\WINDOWS\gconf.INI[2014/02/07 14:59:21 | 000,000,140 | ---- | M] () -- C:\Users\Alex Vincent\webct_upload_applet.properties[2014/02/05 17:32:32 | 000,002,233 | ---- | M] () -- C:\Users\Alex Vincent\Desktop\HP Support Assistant.lnk[2014/02/02 21:56:19 | 000,001,115 | ---- | M] () -- C:\Users\Alex Vincent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk[2014/01/23 17:12:50 | 000,354,592 | ---- | M] (Sendori) -- C:\WINDOWS\SysWow64\plsapp.dll ========== Files Created - No Company Name ========== [2014/02/19 19:17:28 | 000,138,240 | ---- | C] () -- C:\WINDOWS\SysNative\OEMLicense.dll[2014/02/19 19:17:28 | 000,103,936 | ---- | C] () -- C:\WINDOWS\SysWow64\OEMLicense.dll[2014/02/18 22:18:09 | 000,001,121 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk[2014/02/18 16:24:57 | 000,001,171 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk[2014/02/15 19:26:41 | 000,001,981 | ---- | C] () -- C:\Users\Alex Vincent\Desktop\Sync Folder.lnk[2014/02/14 23:38:51 | 000,385,614 | ---- | C] () -- C:\WINDOWS\SysNative\ApnDatabase.xml[2014/02/13 12:15:52 | 000,009,701 | ---- | C] () -- C:\WINDOWS\SysWow64\connectedsearch-results.searchconnector-ms[2014/02/13 12:15:52 | 000,009,701 | ---- | C] () -- C:\WINDOWS\SysNative\connectedsearch-results.searchconnector-ms[2014/02/11 20:01:11 | 000,035,645 | ---- | C] () -- C:\WINDOWS\SysWow64\sdopts.cfg[2014/02/11 19:21:02 | 000,000,000 | ---- | C] () -- C:\WINDOWS\gconf.INI[2014/02/05 17:32:32 | 000,002,233 | ---- | C] () -- C:\Users\Alex Vincent\Desktop\HP Support Assistant.lnk[2014/02/05 17:03:17 | 017,649,830 | ---- | C] () -- C:\Users\Alex Vincent\Documents\MVI_6716.AVI[2014/01/24 00:50:03 | 000,000,140 | ---- | C] () -- C:\Users\Alex Vincent\webct_upload_applet.properties[2014/01/23 17:15:10 | 000,001,118 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk[2013/12/21 00:02:44 | 000,280,064 | ---- | C] () -- C:\WINDOWS\SysWow64\igdmd32.dll[2013/12/21 00:02:40 | 000,182,272 | ---- | C] () -- C:\WINDOWS\SysWow64\igdde32.dll[2013/12/21 00:02:40 | 000,142,848 | ---- | C] () -- C:\WINDOWS\SysWow64\igdail32.dll[2013/11/19 12:54:55 | 000,973,226 | ---- | C] () -- C:\WINDOWS\SysWow64\PerfStringBackup.INI[2013/11/19 12:51:51 | 000,017,408 | ---- | C] () -- C:\WINDOWS\SysWow64\rpcnetp.dll[2013/11/19 12:50:52 | 000,017,408 | ---- | C] () -- C:\WINDOWS\SysWow64\rpcnetp.exe[2013/10/29 21:22:04 | 000,000,600 | ---- | C] () -- C:\Users\Alex Vincent\AppData\Local\PUTTY.RND[2013/09/09 13:49:02 | 000,000,141 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc[2013/09/02 18:14:38 | 000,598,780 | ---- | C] () -- C:\WINDOWS\SysWow64\igvpkrng700.bin[2013/09/02 18:14:30 | 000,755,048 | ---- | C] () -- C:\WINDOWS\SysWow64\igcodeckrng700.bin[2013/08/22 09:36:43 | 000,215,943 | ---- | C] () -- C:\WINDOWS\SysWow64\dssec.dat[2013/08/22 09:36:42 | 000,000,741 | ---- | C] () -- C:\WINDOWS\SysWow64\NOISE.DAT[2013/08/22 08:46:23 | 000,067,584 | --S- | C] () -- C:\WINDOWS\bootstat.dat[2013/08/22 01:01:23 | 000,043,131 | ---- | C] () -- C:\WINDOWS\mib.bin[2013/08/21 21:32:36 | 000,046,080 | ---- | C] () -- C:\WINDOWS\SysWow64\BWContextHandler.dll[2013/08/21 17:55:20 | 000,364,544 | ---- | C] () -- C:\WINDOWS\SysWow64\msjetoledb40.dll[2013/08/21 17:52:39 | 000,673,088 | ---- | C] () -- C:\WINDOWS\SysWow64\mlang.dat[2012/07/25 14:22:54 | 000,982,240 | ---- | C] () -- C:\WINDOWS\SysWow64\igkrng500.bin[2012/07/25 14:22:54 | 000,439,308 | ---- | C] () -- C:\WINDOWS\SysWow64\igcompkrng500.bin[2012/07/25 14:22:54 | 000,092,356 | ---- | C] () -- C:\WINDOWS\SysWow64\igfcg500m.bin[2012/04/20 14:59:44 | 000,001,536 | ---- | C] () -- C:\WINDOWS\SysWow64\IusEventLog.dll ========== ZeroAccess Check ========== [2013/11/20 15:19:08 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64"" = C:\Windows\SysNative\shell32.dll -- [2013/12/09 02:05:24 | 021,199,256 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]"" = %SystemRoot%\system32\shell32.dll -- [2013/12/08 22:51:04 | 018,643,560 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2013/08/22 03:49:49 | 000,921,088 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]"" = %systemroot%\system32\wbem\fastprox.dll -- [2013/08/21 20:45:10 | 000,691,712 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2013/08/22 03:45:17 | 000,483,840 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2013/09/09 18:09:26 | 000,000,000 | ---D | M] -- C:\Users\Alex Vincent\AppData\Roaming\Absolute Software[2014/02/15 19:09:19 | 000,000,000 | ---D | M] -- C:\Users\Alex Vincent\AppData\Roaming\CadSoft[2013/09/27 21:54:58 | 000,000,000 | ---D | M] -- C:\Users\Alex Vincent\AppData\Roaming\IDT[2013/11/12 18:01:04 | 000,000,000 | ---D | M] -- C:\Users\Alex Vincent\AppData\Roaming\Sublime Text 2[2013/09/09 13:49:13 | 000,000,000 | ---D | M] -- C:\Users\Alex Vincent\AppData\Roaming\Synaptics[2014/01/10 20:28:47 | 000,000,000 | ---D | M] -- C:\Users\Alex Vincent\AppData\Roaming\VSee[2014/01/10 20:28:43 | 000,000,000 | ---D | M] -- C:\Users\Alex Vincent\AppData\Roaming\VSeeInstall[2013/10/12 15:51:42 | 000,000,000 | ---D | M] -- C:\Users\Alex Vincent\AppData\Roaming\WebApp[2013/09/09 22:16:54 | 000,000,000 | ---D | M] -- C:\Users\Eric\AppData\Roaming\Absolute Software[2013/09/09 22:17:28 | 000,000,000 | ---D | M] -- C:\Users\Eric\AppData\Roaming\Synaptics ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 64 bytes -> C:\Users\Alex Vincent\Documents\MVI_6716.AVI:TOC.WMV@Alternate Data Stream - 220 bytes -> C:\Users\Alex Vincent\SkyDrive:ms-properties< End of report > Link to post Share on other sites More sharing options...
ejw Posted February 22, 2014 Author ID:794946 Share Posted February 22, 2014 any suggestions? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 8, 2014 Root Admin ID:800613 Share Posted March 8, 2014 Sorry for the delay it looks like Boris probably lost track of your topic. If you still need help please let me us know. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 11, 2014 Root Admin ID:801675 Share Posted March 11, 2014 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts