Jump to content

LiamMcLaughlin

Members
  • Posts

    9
  • Joined

  • Last visited

Reputation

0 Neutral

About LiamMcLaughlin

  • Birthday 01/30/1996

Profile Information

  • Location
    Canada
  1. My PC definitely isn't infected anymore. Thanks a lot for all your help! I will look into some of these programs to prevent this from happening again.
  2. Adobe AIR Adobe Flash Player 10 Plugin Adobe Reader X (10.1.3) Age of Empires III AMD USB Filter Driver Apple Application Support Apple Software Update Audacity 1.3.13 (Unicode) Bing Bar Call of Duty® 4 - Modern Warfare Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-core-static CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish Compatibility Pack for the 2007 Office system CyberLink DVD Suite Platinum D3DX10 Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition DirectX for Managed Code Update (Summer 2004) DVD Menu Pack for HP MediaSmart Video Freemake Video Converter version 3.0.2 GIMP 2.6.11 Google Chrome Google Earth Google Update Helper Hewlett-Packard ACLM.NET v1.1.2.0 HP Advisor HP Customer Experience Enhancements HP Games HP MediaSmart DVD HP MediaSmart Music/Photo/Video HP Odometer HP Product Detection HP Remote Solution HP Setup HP Support Assistant HP Support Information HP Update Java Auto Updater Java 6 Update 31 Junk Mail filter update LabelPrint LightScribe System Software Malwarebytes Anti-Malware version 1.61.0.1400 Microsoft Corporation Microsoft Office 2010 Service Pack 1 (SP1) Microsoft Office Access MUI (English) 2010 Microsoft Office Access Setup Metadata MUI (English) 2010 Microsoft Office Excel MUI (English) 2010 Microsoft Office Home and Student 2010 Microsoft Office OneNote MUI (English) 2010 Microsoft Office Outlook MUI (English) 2010 Microsoft Office PowerPoint MUI (English) 2010 Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office Proof (English) 2010 Microsoft Office Proof (French) 2010 Microsoft Office Proof (Spanish) 2010 Microsoft Office Proofing (English) 2010 Microsoft Office Publisher MUI (English) 2010 Microsoft Office Shared MUI (English) 2010 Microsoft Office Shared Setup Metadata MUI (English) 2010 Microsoft Office Single Image 2010 Microsoft Office Word MUI (English) 2010 Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Works Movie Theme Pack for HP MediaSmart Video MSVCRT MSVCRT_amd64 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 4.0 SP2 Parser and SDK OLYMPUS Master 2 Peggle PhotoNow! Power2Go PowerDirector QuickTime RAIDXpert RealNetworks - Microsoft Visual C++ 2008 Runtime RealPlayer Realtek High Definition Audio Driver RealUpgrade 1.1 Recovery Manager ResumeMaker Professional Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft Excel 2010 (KB2597166) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2553091) Security Update for Microsoft Office 2010 (KB2553096) Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2598039) 32-Bit Edition Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition Security Update for Microsoft SharePoint Workspace 2010 (KB2566445) Security Update for Microsoft Visio Viewer 2010 (KB2597981) 32-Bit Edition Skype Toolbars Skype™ 5.3 SmartSound Quicktracks Plugin swMSM Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft Office 2010 (KB2494150) Update for Microsoft Office 2010 (KB2553065) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition Update for Microsoft Office 2010 (KB2553385) 32-Bit Edition Update for Microsoft Office 2010 (KB2566458) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition Update for Microsoft Office 2010 (KB2597091) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2589345) 32-Bit Edition Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition Update Installer for WildTangent Games App WildTangent Games App (HP Games) Windows Live Communications Platform Windows Live Essentials Windows Live Installer Windows Live Mail Windows Live Messenger Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live Sync Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources WinRAR 4.01 (32-bit) The computer is running fine and there are no issues.
  3. Don't know why <div> kept appearing... Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.05.27.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 Owner :: OWNER-PC [administrator] 27/05/2012 2:37:59 PM mbam-log-2012-05-27 (14-37-59).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 211413 Time elapsed: 2 minute(s), 22 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) The ESET scanner also found no threats.
  4. <p> </p> <div>Malwarebytes Anti-Malware 1.61.0.1400</div> <div>www.malwarebytes.org</div> <div> </div> <div>Database version: v2012.05.27.04</div> <div> </div> <div>Windows 7 Service Pack 1 x64 NTFS</div> <div>Internet Explorer 8.0.7601.17514</div> <div>Owner :: OWNER-PC [administrator]</div> <div> </div> <div>27/05/2012 2:37:59 PM</div> <div>mbam-log-2012-05-27 (14-37-59).txt</div> <div> </div> <div>Scan type: Quick scan</div> <div>Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM</div> <div>Scan options disabled: P2P</div> <div>Objects scanned: 211413</div> <div>Time elapsed: 2 minute(s), 22 second(s)</div> <div> </div> <div>Memory Processes Detected: 0</div> <div>(No malicious items detected)</div> <div> </div> <div>Memory Modules Detected: 0</div> <div>(No malicious items detected)</div> <div> </div> <div>Registry Keys Detected: 0</div> <div>(No malicious items detected)</div> <div> </div> <div>Registry Values Detected: 0</div> <div>(No malicious items detected)</div> <div> </div> <div>Registry Data Items Detected: 0</div> <div>(No malicious items detected)</div> <div> </div> <div>Folders Detected: 0</div> <div>(No malicious items detected)</div> <div> </div> <div>Files Detected: 0</div> <div>(No malicious items detected)</div> <div> </div> <div>(end)</div> <div> </div> <div>--------------------------------------------------------------------------------------------------------------------------------------------</div> <div> </div> <div>The ESET scanner also found no threats.</div>
  5. ComboFix 12-05-27.02 - Owner 27/05/2012 13:21:57.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.5880.4225 [GMT -4:00] Running from: c:\users\Owner\Desktop\ComboFix.exe SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\SPL1EFA.tmp c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss .exe c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msvcnp .exe c:\users\Owner\AppData\Roaming\msvcnp .exe c:\users\Owner\AppData\Roaming\update.exe c:\windows\iun6002.exe . . ((((((((((((((((((((((((( Files Created from 2012-04-27 to 2012-05-27 ))))))))))))))))))))))))))))))) . . 2074-05-07 22:38 . 2006-11-22 00:48 203576 ------w- c:\program files (x86)\Microsoft Games\Age of Empires III\autopatcher2.exe 2012-05-27 20:01 . 2012-05-27 20:02 -------- d-----w- C:\FRST 2012-05-26 01:44 . 2012-05-26 01:44 -------- d-----w- c:\users\Owner\AppData\Roaming\ATI 2012-05-26 01:36 . 2012-05-26 01:36 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes 2012-05-26 01:36 . 2012-05-26 01:36 -------- d-----w- c:\program files (x86)\Malwarebytes 2012-05-26 01:36 . 2012-05-26 01:36 -------- d-----w- c:\programdata\Malwarebytes 2012-05-26 01:36 . 2012-04-04 19:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-05-20 17:53 . 2012-05-20 17:53 -------- d-----w- C:\Downloads 2012-05-18 16:47 . 2012-05-18 16:47 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll 2012-05-18 16:47 . 2012-05-18 16:47 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll 2012-05-18 16:47 . 2012-05-18 16:47 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll 2012-05-18 16:47 . 2012-05-18 16:47 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll 2012-05-18 16:47 . 2012-05-18 16:47 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll 2012-05-18 16:47 . 2012-05-18 16:47 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll 2012-05-18 16:47 . 2012-05-18 16:47 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll 2012-05-18 16:46 . 2012-05-18 16:47 -------- d-----w- c:\program files (x86)\QuickTime 2012-05-08 22:30 . 2012-03-03 06:35 1544704 ----a-w- c:\windows\system32\DWrite.dll 2012-05-08 22:30 . 2012-03-03 05:31 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll 2012-05-08 22:30 . 2012-03-31 06:05 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-05-08 22:30 . 2012-03-31 04:39 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-05-08 22:30 . 2012-03-31 04:39 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-05-08 22:30 . 2012-03-31 03:10 3146240 ----a-w- c:\windows\system32\win32k.sys 2012-05-08 22:29 . 2012-03-17 07:58 75120 ----a-w- c:\windows\system32\drivers\partmgr.sys 2012-05-08 22:29 . 2012-03-30 11:35 1918320 ----a-w- c:\windows\system32\drivers\tcpip.sys 2012-05-08 22:29 . 2012-03-31 05:42 1732096 ----a-w- c:\program files\Windows Journal\NBDoc.DLL 2012-05-08 22:29 . 2012-03-31 05:40 1367552 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll 2012-05-08 22:29 . 2012-03-31 04:29 936960 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll 2012-05-08 22:29 . 2012-03-31 05:40 1402880 ----a-w- c:\program files\Windows Journal\JNWDRV.dll 2012-05-08 22:29 . 2012-03-31 05:40 1393664 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll 2012-05-04 21:58 . 2012-05-04 21:58 -------- d-----w- c:\windows\system32\Macromed 2012-05-04 21:58 . 2012-05-04 21:58 8769696 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-05-04 21:58 . 2012-04-23 15:34 419488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-05-04 21:58 . 2011-08-12 16:48 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-04-28 21:36 . 2012-04-20 22:39 3529 ----a-w- c:\windows\wininit.tmp 2012-04-19 00:56 . 2012-04-19 00:56 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2012-04-19 00:56 . 2012-04-19 00:56 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts 2012-03-08 22:50 . 2012-03-08 22:50 49016 ----a-w- c:\windows\SysWow64\sirenacm.dll 2012-03-08 22:37 . 2012-03-08 22:37 302448 ----a-w- c:\windows\WLXPGSS.SCR 2012-03-07 22:16 . 2010-07-06 17:28 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll 2012-03-01 06:46 . 2012-04-12 02:56 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys 2012-03-01 06:38 . 2012-04-12 02:56 220672 ----a-w- c:\windows\system32\wintrust.dll 2012-03-01 06:33 . 2012-04-12 02:56 81408 ----a-w- c:\windows\system32\imagehlp.dll 2012-03-01 06:28 . 2012-04-12 02:56 5120 ----a-w- c:\windows\system32\wmi.dll 2012-03-01 05:37 . 2012-04-12 02:56 172544 ----a-w- c:\windows\SysWow64\wintrust.dll 2012-03-01 05:33 . 2012-04-12 02:56 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll 2012-03-01 05:29 . 2012-04-12 02:56 5120 ----a-w- c:\windows\SysWow64\wmi.dll 2012-02-28 06:39 . 2012-04-12 02:44 1188864 ----a-w- c:\windows\system32\wininet.dll 2012-02-28 05:38 . 2012-04-12 02:44 981504 ----a-w- c:\windows\SysWow64\wininet.dll 2012-02-28 04:31 . 2012-04-12 02:44 1638912 ----a-w- c:\windows\system32\mshtml.tlb 2012-02-28 03:52 . 2012-04-12 02:44 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HPADVISOR"="c:\program files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-09-29 1685048] "OM2_Monitor"="c:\program files (x86)\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2008-10-31 95536] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768] "HP Remote Solution"="c:\program files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe" [2009-08-25 656896] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-06-15 98304] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576] "OM2_Monitor"="c:\program files (x86)\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" [2008-10-31 54576] "LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-12-13 135536] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736] "TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2012-04-12 296056] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888] . c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE [2011-9-2 227712] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer4"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-06 136176] R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-09 86072] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-04 257696] R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-06 136176] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184] R3 PCDSRVC{F36B3A4C-F95654BD-06000000}_0;PCDSRVC{F36B3A4C-F95654BD-06000000}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\pc-doctor for windows\pcdsrvc_x64.pkms [2009-09-17 23536] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S0 ahcix64s;ahcix64s;c:\windows\system32\DRIVERS\ahcix64s.sys [x] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [2009-09-19 122880] S2 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176] S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648] S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-03-28 94264] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x] S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2012-05-27 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-23 21:58] . 2012-05-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-06 02:55] . 2012-05-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-06 02:55] . 2012-05-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2576837967-3080261544-2192606049-1000Core.job - c:\users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-06 02:14] . 2012-05-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2576837967-3080261544-2192606049-1000UA.job - c:\users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-06 02:14] . 2012-05-26 c:\windows\Tasks\HPCeeScheduleForOwner.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 03:15] . 2012-02-28 c:\windows\Tasks\PCDRScheduledMaintenance.job - c:\program files\PC-Doctor for Windows\pcdrcui.exe [2009-09-18 07:11] . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PC-Doctor for Windows localizer"="c:\program files\PC-Doctor for Windows\localizer.exe" [2009-09-17 95728] "LXCFCATS"="c:\windows\system32\spool\DRIVERS\x64\3\LXCFtime.dll" [2005-09-14 29184] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.ca/ uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = 192.168.2.1 192.168.2.1 . - - - - ORPHANS REMOVED - - - - . URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file) Wow6432Node-HKCU-Run-msvcnp - c:\users\Owner\AppData\Roaming\msvcnp .exe Wow6432Node-HKCU-Run-blank - c:\users\Owner\AppData\Roaming\update.exe AddRemove-{6F44AF95-3CDE-4513-AD3F-6D45F17BF324} - c:\program files (x86)\InstallShield Installation Information\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}\setup.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{F36B3A4C-F95654BD-06000000}_0] "ImagePath"="\??\c:\program files\pc-doctor for windows\pcdsrvc_x64.pkms" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe c:\windows\SysWOW64\PnkBstrA.exe c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe . ************************************************************************** . Completion time: 2012-05-27 13:34:00 - machine was rebooted ComboFix-quarantined-files.txt 2012-05-27 17:34 . Pre-Run: 396,653,264,896 bytes free Post-Run: 396,374,429,696 bytes free . - - End Of File - - B4957B781B37D133EB540231DE415856
  6. Scan result of Farbar Recovery Scan Tool Version: 25-05-2012 Ran by Système at 27-05-2012 12:02:02 Running from G:\ Windows 7 Home Premium (X64) OS Language: French Standard The current controlset is ControlSet001 ATTENTION:=====> THE TOOL IS NOT RUN FROM RECOVERY ENVIRONMENT AND WILL NOT FUNTION PROPERLY. ========================== Registry (Whitelisted) ============= HKLM\...\Run: [PC-Doctor for Windows localizer] C:\Program Files\PC-Doctor for Windows\localizer.exe [95728 2009-09-16] (PC-Doctor, Inc.) HKLM\...\Run: [LXCFCATS] rundll32 C:\Windows\system32\spool\DRIVERS\x64\3\LXCFtime.dll,RunDLLEntry [29184 2005-09-14] () HKLM-x32\...\Run: [hpsysdrv] c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard) HKLM-x32\...\Run: [HP Remote Solution] %ProgramFiles%\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe [656896 2009-08-24] (Hewlett-Packard) HKLM-x32\...\Run: [startCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2009-06-14] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard) HKLM-x32\...\Run: [OM2_Monitor] "C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" /OM [54576 2008-10-31] (OLYMPUS IMAGING CORP.) HKLM-x32\...\Run: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe" [135536 2010-12-13] (Microsoft Corporation) HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-02] (Adobe Systems Incorporated) HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2012-02-20] (Apple Inc.) HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2012-03-27] (Apple Inc.) HKLM-x32\...\Run: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot [296056 2012-04-12] (RealNetworks, Inc.) HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-04-18] (Apple Inc.) HKU\Default\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1685048 2009-09-29] (Hewlett-Packard) HKU\Default User\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1685048 2009-09-29] (Hewlett-Packard) HKU\Owner\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW [1685048 2009-09-29] (Hewlett-Packard) HKU\Owner\...\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [4280184 2012-03-08] (Microsoft Corporation) HKU\Owner\...\Run: [Google Update] "C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2010-07-05] (Google Inc.) HKU\Owner\...\Run: [OM2_Monitor] "C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [95536 2008-10-31] (OLYMPUS IMAGING CORP.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1 Startup: C:\Users\Owner\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk ShortcutTarget: OneNote 2010 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) ==================== Services (Whitelisted) ====== 2 AMD_RAIDXpert; "C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe" -s [122880 2009-09-19] (AMD) 2 BBUpdate; "C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE" [249648 2011-10-13] (Microsoft Corporation) 3 GamesAppService; "C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe" [206072 2010-10-12] (WildTangent, Inc.) 2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [86072 2011-09-09] (Hewlett-Packard Company) 2 lxcf_device; C:\Windows\system32\lxcfcoms.exe -service [566192 2007-02-23] ( ) 2 N360; "C:\Program Files (x86)\Norton 360\Engine\5.2.1.3\ccSvcHst.exe" /s "N360" /m "C:\Program Files (x86)\Norton 360\Engine\5.2.1.3\diMaster.dll" /prefetch:1 [262584 2011-03-31] (Symantec Corporation) 2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75136 2010-12-04] () 2 LightScribeService; "c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe" [x] ========================== Drivers (Whitelisted) ============= 1 BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20120517.001\BHDrvx64.sys [1160824 2012-04-02] (Symantec Corporation) 1 eeCtrl; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [482936 2012-02-04] (Symantec Corporation) 3 EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138360 2012-02-04] (Symantec Corporation) 1 IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20120525.001\IDSvia64.sys [488568 2012-04-27] (Symantec Corporation) 3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20120526.006\ENG64.SYS [120440 2012-05-15] (Symantec Corporation) 3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20120526.006\EX64.SYS [2068600 2012-05-15] (Symantec Corporation) 2 SecDrv; C:\Windows\SysWow64\Drivers\SecDrv.sys [163644 2011-06-12] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) 1 SRTSP; C:\Windows\System32\Drivers\N360x64\0502010.003\SRTSP64.SYS [744568 2011-03-30] (Symantec Corporation) 1 SRTSPX; C:\Windows\System32\drivers\N360x64\0502010.003\SRTSPX64.SYS [40568 2011-03-30] (Symantec Corporation) 0 SymDS; C:\Windows\System32\drivers\N360x64\0502010.003\SYMDS64.SYS [450680 2011-01-26] (Symantec Corporation) 0 SymEFA; C:\Windows\System32\drivers\N360x64\0502010.003\SYMEFA64.SYS [912504 2011-03-14] (Symantec Corporation) 3 SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2011-09-18] (Symantec Corporation) 1 SymIRON; C:\Windows\System32\drivers\N360x64\0502010.003\Ironx64.SYS [171128 2011-01-26] (Symantec Corporation) 1 SymNetS; C:\Windows\System32\Drivers\N360x64\0502010.003\SYMNETS.SYS [386168 2011-04-20] (Symantec Corporation) 3 PCDSRVC{F36B3A4C-F95654BD-06000000}_0; \??\c:\program files\pc-doctor for windows\pcdsrvc_x64.pkms [x] ========================== NetSvcs (Whitelisted) =========== ============ One Month Created Files and Folders ============== 2012-05-27 07:36 - 2012-05-27 07:36 - 1394807 ____A C:\Users\Owner\Downloads\FRST64.exe 2012-05-26 20:55 - 2012-05-26 20:56 - 0000000 ____D C:\Users\Owner\AppData\Local\{CA7BA3C1-2940-4D4D-AB89-CC78A248FCBA} 2012-05-26 20:54 - 2012-05-26 20:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{1F123B51-4116-4BBF-A393-E509587094D6} 2012-05-26 15:59 - 2012-05-26 15:59 - 0009793 ____A C:\Users\Owner\Downloads\Attach.txt 2012-05-26 14:59 - 2012-05-26 14:59 - 0029965 ____A C:\Users\Owner\Desktop\DDS.txt 2012-05-26 14:58 - 2012-05-26 14:58 - 0008596 ____A C:\Users\Owner\Desktop\Attach.txt 2012-05-26 14:40 - 2012-05-26 14:40 - 0607260 ____R (Swearware) C:\Users\Owner\Desktop\dds.com 2012-05-26 14:16 - 2012-05-26 14:16 - 0017204 ____A C:\Users\Owner\Documents\HECE display bd.docx 2012-05-26 07:26 - 2012-05-26 07:27 - 0000000 ____D C:\Users\Owner\AppData\Local\{6E2E7121-A799-4A1B-907A-1A1FBABBC2D8} 2012-05-26 07:25 - 2012-05-26 07:26 - 0000000 ____D C:\Users\Owner\AppData\Local\{3229585E-7463-4240-907B-AB1AF0A5C25C} 2012-05-25 20:32 - 2012-05-25 20:32 - 0000043 ____A C:\Users\Owner\AppData\Roaming\mbam.context.scan 2012-05-25 17:44 - 2012-05-25 17:44 - 0000000 ____D C:\Users\Owner\AppData\Roaming\ATI 2012-05-25 17:36 - 2012-05-25 17:36 - 0000977 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2012-05-25 17:36 - 2012-05-25 17:36 - 0000000 ____D C:\Users\Owner\AppData\Roaming\Malwarebytes 2012-05-25 17:36 - 2012-05-25 17:36 - 0000000 ____D C:\Users\All Users\Malwarebytes 2012-05-25 17:36 - 2012-05-25 17:36 - 0000000 ____D C:\Program Files (x86)\Malwarebytes 2012-05-25 17:36 - 2012-04-04 11:56 - 0024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2012-05-25 16:58 - 2012-05-25 16:58 - 0000046 __ASH C:\Users\Owner\AppData\Roaming\desktop.ini 2012-05-25 16:11 - 2012-05-25 16:12 - 0000000 ____D C:\Users\Owner\AppData\Local\{A16619BA-9FD7-4AFC-BE27-426894FCA576} 2012-05-25 04:10 - 2012-05-25 04:11 - 0000000 ____D C:\Users\Owner\AppData\Local\{96B10ABF-B3A7-438C-B149-E4A64491E4FC} 2012-05-24 12:04 - 2012-05-24 12:05 - 0000000 ____D C:\Users\Owner\AppData\Local\{F0A0AAAD-EAC5-4DBB-AF34-72738260429C} 2012-05-24 04:33 - 2012-05-24 04:33 - 10063000 ____A (Malwarebytes Corporation ) C:\Users\Owner\Downloads\mbam-setup-1.61.0.1400.exe 2012-05-23 18:07 - 2012-05-23 18:07 - 0000000 ____D C:\Users\Owner\AppData\Local\{A0D6887F-EC36-4C22-A24B-554E978B9504} 2012-05-23 18:06 - 2012-05-25 16:11 - 0000000 ____D C:\Users\Owner\AppData\Local\{333F0C07-5446-46ED-B3F7-F043806335AA} 2012-05-23 04:46 - 2012-05-23 04:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{1A721035-5E6E-4995-BB68-48F2C435C296} 2012-05-23 04:46 - 2012-05-23 04:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{6EAC46D0-98FF-4621-AC8A-2B19168CB7B3} 2012-05-22 14:22 - 2012-05-22 14:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{51741675-CC3E-4134-B3E5-E0DB18B415C7} 2012-05-22 14:21 - 2012-05-22 14:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{A7283106-A29B-4541-ACDF-B5FBBEE96A2C} 2012-05-21 18:56 - 2012-05-21 18:57 - 0000000 ____D C:\Users\Owner\AppData\Local\{7F468C43-C501-4D26-BE51-5B29E249EEA2} 2012-05-21 06:55 - 2012-05-21 06:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{BDC7CEF4-8F5B-4CC4-8BD1-48D9924EE5ED} 2012-05-21 06:54 - 2012-05-21 18:56 - 0000000 ____D C:\Users\Owner\AppData\Local\{A335B211-5833-4881-A97D-DB524A38C858} 2012-05-20 11:36 - 2012-05-20 11:37 - 0000000 ____D C:\Users\Owner\AppData\Local\{52682771-FD39-44CC-9A25-4FE95E6BE3FA} 2012-05-20 09:54 - 2012-05-26 15:53 - 0016091 ____A C:\Users\Owner\AppData\Roaming\eula 2012-05-20 09:07 - 2010-06-02 00:55 - 0527192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll 2012-05-20 09:07 - 2010-06-02 00:55 - 0518488 ____A (Microsoft Corporation) C:\Windows\System32\XAudio2_7.dll 2012-05-20 09:07 - 2010-06-02 00:55 - 0239960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll 2012-05-20 09:07 - 2010-06-02 00:55 - 0176984 ____A (Microsoft Corporation) C:\Windows\System32\xactengine3_7.dll 2012-05-20 09:07 - 2010-06-02 00:55 - 0077656 ____A (Microsoft Corporation) C:\Windows\System32\XAPOFX1_5.dll 2012-05-20 09:07 - 2010-06-02 00:55 - 0074072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 2526056 ____A (Microsoft Corporation) C:\Windows\System32\D3DCompiler_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 2401112 ____A (Microsoft Corporation) C:\Windows\System32\D3DX9_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 2106216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 1998168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 1907552 ____A (Microsoft Corporation) C:\Windows\System32\d3dcsx_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 1868128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 0511328 ____A (Microsoft Corporation) C:\Windows\System32\d3dx10_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 0470880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 0276832 ____A (Microsoft Corporation) C:\Windows\System32\d3dx11_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 0248672 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll 2012-05-20 09:07 - 2010-02-04 06:01 - 0530776 ____A (Microsoft Corporation) C:\Windows\System32\XAudio2_6.dll 2012-05-20 09:07 - 2010-02-04 06:01 - 0528216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll 2012-05-20 09:07 - 2010-02-04 06:01 - 0238936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll 2012-05-20 09:07 - 2010-02-04 06:01 - 0176984 ____A (Microsoft Corporation) C:\Windows\System32\xactengine3_6.dll 2012-05-20 09:07 - 2010-02-04 06:01 - 0078680 ____A (Microsoft Corporation) C:\Windows\System32\XAPOFX1_4.dll 2012-05-20 09:07 - 2010-02-04 06:01 - 0074072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll 2012-05-20 09:07 - 2010-02-04 06:01 - 0024920 ____A (Microsoft Corporation) C:\Windows\System32\X3DAudio1_7.dll 2012-05-20 09:07 - 2010-02-04 06:01 - 0022360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll 2012-05-19 23:34 - 2012-05-19 23:35 - 0000000 ____D C:\Users\Owner\AppData\Local\{BBBF8D59-16C3-461F-849F-C2EB8C0BA9FB} 2012-05-19 11:32 - 2012-05-20 11:36 - 0000000 ____D C:\Users\Owner\AppData\Local\{8907D52C-221B-4354-8E6A-55020B9286FF} 2012-05-19 11:32 - 2012-05-19 11:33 - 0000000 ____D C:\Users\Owner\AppData\Local\{796617AD-548A-44A1-B1D7-1A5601B2862F} 2012-05-18 18:21 - 2012-05-18 18:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{8BDBDB1D-1281-4362-9E6A-26B29C3BC765} 2012-05-18 08:46 - 2012-05-18 08:47 - 0000000 ____D C:\Program Files (x86)\QuickTime 2012-05-18 08:46 - 2012-05-18 08:46 - 0001807 ____A C:\Users\Public\Desktop\QuickTime Player.lnk 2012-05-18 06:20 - 2012-05-18 06:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{4D89976A-F07B-4395-926C-ECDB94467AC4} 2012-05-17 16:31 - 2012-05-17 16:31 - 0000000 ____D C:\Users\Owner\AppData\Local\{22FEDF3C-F9A9-462F-9B84-A84D84C4629C} 2012-05-17 04:30 - 2012-05-18 18:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{20C178A5-7473-4E6E-93C4-695F0C54AD13} 2012-05-16 04:17 - 2012-05-16 04:18 - 0000000 ____D C:\Users\Owner\AppData\Local\{5A0563F5-2A65-488F-8891-8C5D95513867} 2012-05-15 16:15 - 2012-05-15 16:16 - 0000000 ____D C:\Users\Owner\AppData\Local\{656DF0C2-2A99-4EDE-B174-5AE0A48412E5} 2012-05-15 04:13 - 2012-05-16 04:17 - 0000000 ____D C:\Users\Owner\AppData\Local\{AC8BB4B5-2B9E-48C8-AC88-C54D4F289830} 2012-05-15 04:13 - 2012-05-15 04:14 - 0000000 ____D C:\Users\Owner\AppData\Local\{54434F25-6021-40D8-9D1E-2063AE7AACDF} 2012-05-14 10:39 - 2012-05-14 10:40 - 0000000 ____D C:\Users\Owner\AppData\Local\{EF507E18-EA04-43BB-B420-F6F3F6ACA87D} 2012-05-14 10:38 - 2012-05-14 10:38 - 0000000 ____D C:\Users\Owner\AppData\Local\{194EF547-91F3-46F2-AFE0-F9792660BB19} 2012-05-14 10:37 - 2012-05-14 10:38 - 0000000 ____D C:\Users\Owner\AppData\Local\{6592740A-A3EB-4004-975D-B3CF7ED014CE} 2012-05-13 18:36 - 2012-05-13 18:36 - 0000000 ____D C:\Users\Owner\AppData\Local\{9B2393BD-772E-4BFB-82DE-7E9B07F7D5BF} 2012-05-13 06:34 - 2012-05-13 06:35 - 0000000 ____D C:\Users\Owner\AppData\Local\{DD84F3D7-8F40-47DE-BA4A-DB1B10C180F4} 2012-05-13 06:33 - 2012-05-13 18:36 - 0000000 ____D C:\Users\Owner\AppData\Local\{7BE93690-369F-499A-B5E8-9E1A46972C81} 2012-05-12 18:58 - 2012-05-12 18:58 - 0000000 ____D C:\Users\Owner\AppData\Local\{BE433D65-56DC-4C5C-8B7F-1A44117E3308} 2012-05-12 05:43 - 2012-05-12 05:44 - 0000000 ____D C:\Users\Owner\AppData\Local\{680A9BD5-4110-4D8E-876A-4648FFE5C538} 2012-05-12 05:42 - 2012-05-12 05:43 - 0000000 ____D C:\Users\Owner\AppData\Local\{9B511AFE-4911-4C83-B322-1E9093A9D2FA} 2012-05-11 04:22 - 2012-05-11 04:23 - 0000000 ____D C:\Users\Owner\AppData\Local\{C1480271-2654-4211-A2B3-EE10CA2B499B} 2012-05-11 04:22 - 2012-05-11 04:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{BF9C64D0-4504-489A-875E-726F22FF4F87} 2012-05-10 16:20 - 2012-05-10 16:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{1E51CF83-BCB5-49F0-A2D3-4B7E98D0383E} 2012-05-10 04:19 - 2012-05-10 04:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{356CF653-B38B-4F20-9035-BD7C9D9DD750} 2012-05-10 04:18 - 2012-05-10 16:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{698B53B9-B861-4AD4-8A05-43C99C38B1F1} 2012-05-09 14:52 - 2012-05-09 14:53 - 0000000 ____D C:\Users\Owner\AppData\Local\{EF7E5DCC-D10F-4451-9524-E4D301A501B7} 2012-05-09 14:52 - 2012-05-09 14:52 - 0000000 ____D C:\Users\Owner\AppData\Local\{59997081-E68D-4F2C-B730-2BDA68206DDB} 2012-05-08 14:30 - 2012-03-30 22:05 - 5559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2012-05-08 14:30 - 2012-03-30 20:39 - 3968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2012-05-08 14:30 - 2012-03-30 20:39 - 3913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2012-05-08 14:30 - 2012-03-30 19:10 - 3146240 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-05-08 14:30 - 2012-03-02 22:35 - 1544704 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll 2012-05-08 14:30 - 2012-03-02 21:31 - 1077248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2012-05-08 14:29 - 2012-03-30 03:35 - 1918320 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2012-05-08 14:29 - 2012-03-16 23:58 - 0075120 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\partmgr.sys 2012-05-08 14:19 - 2012-05-08 14:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{01A4EB52-DA45-4B30-B16E-12BB1191C27B} 2012-05-08 14:18 - 2012-05-08 14:19 - 0000000 ____D C:\Users\Owner\AppData\Local\{8AA9E231-2B15-4E2E-ADA5-42122FC13AE8} 2012-05-07 13:58 - 2012-05-07 13:59 - 0000000 ____D C:\Users\Owner\AppData\Local\{D503EE95-0274-4BBA-B97C-F4E1A3F75AD9} 2012-05-07 13:57 - 2012-05-07 13:58 - 0000000 ____D C:\Users\Owner\AppData\Local\{A276E77A-DB8D-4031-B8ED-8D6E525BCDE5} 2012-05-07 13:56 - 2012-05-07 13:57 - 0000000 ____D C:\Users\Owner\AppData\Local\{27FB111B-A826-4FFF-9B47-704018E101AC} 2012-05-07 13:55 - 2012-05-07 13:56 - 0000000 ____D C:\Users\Owner\AppData\Local\{E28C110C-EC92-45DF-8137-AC2E70D67F87} 2012-05-06 17:45 - 2012-05-06 17:45 - 0000000 ____D C:\Users\Owner\AppData\Local\{9C28CC72-41D2-47E6-89F4-9A8EDE228062} 2012-05-06 05:43 - 2012-05-06 17:45 - 0000000 ____D C:\Users\Owner\AppData\Local\{681C69B9-4CAA-4D07-8AC7-A7863A1677EF} 2012-05-06 05:43 - 2012-05-06 05:44 - 0000000 ____D C:\Users\Owner\AppData\Local\{1420201D-3B63-4CC5-A3B1-3DDFC9936C3C} 2012-05-05 05:17 - 2012-05-05 05:18 - 0000000 ____D C:\Users\Owner\AppData\Local\{C27DD495-97E9-439B-B6F9-78A25993A441} 2012-05-05 05:16 - 2012-05-05 05:17 - 0000000 ____D C:\Users\Owner\AppData\Local\{B5BC95DB-7F5E-4276-A817-1264F16BC799} 2012-05-04 13:58 - 2012-05-04 13:58 - 8769696 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe 2012-05-04 13:58 - 2012-05-04 13:58 - 0000000 ____D C:\Windows\System32\Macromed 2012-05-04 11:43 - 2012-05-04 11:43 - 0000000 ____D C:\Users\Owner\AppData\Local\{C855599C-078B-43D8-A68B-54A1888ACA89} 2012-05-04 11:42 - 2012-05-04 11:43 - 0000000 ____D C:\Users\Owner\AppData\Local\{ECF1B774-0E72-475A-B14A-08278482408B} 2012-05-03 12:16 - 2012-05-03 12:17 - 0000000 ____D C:\Users\Owner\AppData\Local\{9798BC2A-5501-4056-B91F-1C4B6C0D4EAD} 2012-05-03 12:15 - 2012-05-03 12:16 - 0000000 ____D C:\Users\Owner\AppData\Local\{26F57F6E-40E7-4A1C-8AA0-F5B927B1FF5A} 2012-05-02 16:19 - 2012-05-02 16:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{BBC7DD86-F35E-44E8-9670-299CF8A2491A} 2012-05-02 04:18 - 2012-05-02 04:18 - 0000000 ____D C:\Users\Owner\AppData\Local\{158D7B64-D85F-47E6-ADDE-E241C2460D6D} 2012-05-02 04:17 - 2012-05-02 16:19 - 0000000 ____D C:\Users\Owner\AppData\Local\{BF5034D4-97DB-43D5-87AE-CA74300B0F5D} 2012-05-01 13:25 - 2012-05-01 13:26 - 0000000 ____D C:\Users\Owner\AppData\Local\{10A68C43-3142-4479-B821-EF8C741B1D8F} 2012-05-01 13:25 - 2012-05-01 13:25 - 0000000 ____D C:\Users\Owner\AppData\Local\{5A85EB40-00D6-42F6-A2E6-6CBC72FD583E} 2012-04-30 19:21 - 2012-04-30 19:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{FA59E7C8-D4DA-43AB-89D7-1ECA63B0CC78} 2012-04-30 07:19 - 2012-04-30 07:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{90811DD1-F1EF-4BF7-9735-03D7493F5046} 2012-04-30 07:18 - 2012-04-30 19:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{31B6B59B-1020-451C-94ED-B4BF90D2C1CC} 2012-04-29 19:00 - 2012-04-29 19:01 - 0000000 ____D C:\Users\Owner\AppData\Local\{0F1B5D35-25E0-40E9-A2B7-1E0F79126DEB} 2012-04-29 06:58 - 2012-04-29 06:59 - 0000000 ____D C:\Users\Owner\AppData\Local\{9B16F3A5-18B4-42DA-8BB6-06441DF26E60} 2012-04-29 06:57 - 2012-04-29 19:00 - 0000000 ____D C:\Users\Owner\AppData\Local\{4B0D91B5-C694-4345-83B5-4BD28D987080} 2012-04-28 17:55 - 2012-04-28 17:56 - 0000000 ____D C:\Users\Owner\AppData\Local\{D4B7EDA5-C928-4961-B787-5BA1EE9624AF} 2012-04-28 05:53 - 2012-04-28 05:54 - 0000000 ____D C:\Users\Owner\AppData\Local\{B88B196F-004C-455D-BE1C-2D188B738470} 2012-04-28 05:52 - 2012-04-28 17:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{BEF14823-98AB-4207-9798-558990132BB5} 2012-04-27 10:46 - 2012-04-27 10:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{83D32099-3D9C-4E3E-B35D-4B7B7695FCB5} 2012-04-27 10:46 - 2012-04-27 10:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{CCC73218-D42C-454C-9A4A-B2A381A260A1} 2012-04-27 09:31 - 2012-04-27 09:29 - 0729088 ____A (Indigo Rose Corporation) C:\Windows\iun6002.exe 2012-04-27 09:29 - 2012-04-27 09:31 - 0024984 ____A C:\Windows\DesertCombat Setup Log.txt ============ 3 Months Modified Files and Folders ============= 2012-05-27 12:02 - 2012-05-27 12:01 - 0000000 ____D C:\FRST 2012-05-27 07:55 - 2010-05-18 12:04 - 1082633 ____A C:\Windows\WindowsUpdate.log 2012-05-27 07:55 - 2009-07-13 20:45 - 0015792 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2012-05-27 07:55 - 2009-07-13 20:45 - 0015792 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2012-05-27 07:49 - 2010-07-05 18:55 - 0000892 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2012-05-27 07:49 - 2010-07-05 17:43 - 0000000 ____D C:\Users\Owner\Tracing 2012-05-27 07:49 - 2010-01-15 09:08 - 329166848 __ASH C:\hiberfil.sys 2012-05-27 07:49 - 2009-07-13 21:08 - 0000006 ___AH C:\Windows\Tasks\SA.DAT 2012-05-27 07:49 - 2009-07-13 20:51 - 0074678 ____A C:\Windows\setupact.log 2012-05-27 07:41 - 2010-07-05 16:43 - 0000000 ____D C:\Program Files\Lx_cats 2012-05-27 07:36 - 2012-05-27 07:36 - 1394807 ____A C:\Users\Owner\Downloads\FRST64.exe 2012-05-27 07:27 - 2010-07-05 18:55 - 0000896 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2012-05-27 07:19 - 2010-07-05 18:14 - 0000908 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2576837967-3080261544-2192606049-1000UA.job 2012-05-27 07:09 - 2010-07-13 13:18 - 0000000 ____D C:\Users\Owner\AppData\Local\CrashDumps 2012-05-26 20:58 - 2012-04-23 07:34 - 0000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2012-05-26 20:56 - 2012-05-26 20:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{CA7BA3C1-2940-4D4D-AB89-CC78A248FCBA} 2012-05-26 20:56 - 2010-11-10 14:58 - 0000000 ____D C:\Users\Owner\AppData\Local\Windows Live 2012-05-26 20:55 - 2012-05-26 20:54 - 0000000 ____D C:\Users\Owner\AppData\Local\{1F123B51-4116-4BBF-A393-E509587094D6} 2012-05-26 20:51 - 2010-07-05 17:56 - 0480048 ____A C:\Windows\PFRO.log 2012-05-26 16:33 - 2010-06-28 06:46 - 0118032 ____A C:\Users\Owner\AppData\Local\GDIPFONTCACHEV1.DAT 2012-05-26 16:31 - 2009-07-13 20:45 - 0435304 ____A C:\Windows\System32\FNTCACHE.DAT 2012-05-26 15:59 - 2012-05-26 15:59 - 0009793 ____A C:\Users\Owner\Downloads\Attach.txt 2012-05-26 15:53 - 2012-05-20 09:54 - 0016091 ____A C:\Users\Owner\AppData\Roaming\eula 2012-05-26 15:52 - 2005-04-07 18:16 - 0027263 ___AH C:\Users\Owner\AppData\Roaming\Ownerv1.18.0 - Trial versionlog.dat 2012-05-26 14:59 - 2012-05-26 14:59 - 0029965 ____A C:\Users\Owner\Desktop\DDS.txt 2012-05-26 14:58 - 2012-05-26 14:58 - 0008596 ____A C:\Users\Owner\Desktop\Attach.txt 2012-05-26 14:40 - 2012-05-26 14:40 - 0607260 ____R (Swearware) C:\Users\Owner\Desktop\dds.com 2012-05-26 14:16 - 2012-05-26 14:16 - 0017204 ____A C:\Users\Owner\Documents\HECE display bd.docx 2012-05-26 10:19 - 2010-07-05 18:14 - 0000856 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2576837967-3080261544-2192606049-1000Core.job 2012-05-26 08:58 - 2009-07-13 21:13 - 0726444 ____A C:\Windows\System32\PerfStringBackup.INI 2012-05-26 07:27 - 2012-05-26 07:26 - 0000000 ____D C:\Users\Owner\AppData\Local\{6E2E7121-A799-4A1B-907A-1A1FBABBC2D8} 2012-05-26 07:26 - 2012-05-26 07:25 - 0000000 ____D C:\Users\Owner\AppData\Local\{3229585E-7463-4240-907B-AB1AF0A5C25C} 2012-05-26 00:13 - 2011-10-18 14:23 - 0000000 ____D C:\Users\Owner\AppData\Local\Facebook 2012-05-25 21:10 - 2010-01-15 09:17 - 0000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2012-05-25 20:50 - 2010-01-15 09:20 - 0000000 ____D C:\Windows\SysWOW64\Macromed 2012-05-25 20:32 - 2012-05-25 20:32 - 0000043 ____A C:\Users\Owner\AppData\Roaming\mbam.context.scan 2012-05-25 20:30 - 2010-06-28 06:32 - 0000000 ____D C:\users\Owner 2012-05-25 17:44 - 2012-05-25 17:44 - 0000000 ____D C:\Users\Owner\AppData\Roaming\ATI 2012-05-25 17:36 - 2012-05-25 17:36 - 0000977 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2012-05-25 17:36 - 2012-05-25 17:36 - 0000000 ____D C:\Users\Owner\AppData\Roaming\Malwarebytes 2012-05-25 17:36 - 2012-05-25 17:36 - 0000000 ____D C:\Users\All Users\Malwarebytes 2012-05-25 17:36 - 2012-05-25 17:36 - 0000000 ____D C:\Program Files (x86)\Malwarebytes 2012-05-25 16:58 - 2012-05-25 16:58 - 0000046 __ASH C:\Users\Owner\AppData\Roaming\desktop.ini 2012-05-25 16:29 - 2011-09-22 12:47 - 0000332 ____A C:\Windows\Tasks\HPCeeScheduleForOwner.job 2012-05-25 16:12 - 2012-05-25 16:11 - 0000000 ____D C:\Users\Owner\AppData\Local\{A16619BA-9FD7-4AFC-BE27-426894FCA576} 2012-05-25 16:11 - 2012-05-23 18:06 - 0000000 ____D C:\Users\Owner\AppData\Local\{333F0C07-5446-46ED-B3F7-F043806335AA} 2012-05-25 04:11 - 2012-05-25 04:10 - 0000000 ____D C:\Users\Owner\AppData\Local\{96B10ABF-B3A7-438C-B149-E4A64491E4FC} 2012-05-24 12:31 - 2011-11-03 14:48 - 0000000 ____A C:\Windows\System32\HP_ActiveX_Patch_NOT_DETECTED.txt 2012-05-24 12:31 - 2010-07-13 13:19 - 0000052 ____A C:\Windows\SysWOW64\DOErrors.log 2012-05-24 12:28 - 2010-07-13 11:56 - 0000000 ____D C:\Users\Owner\AppData\Roaming\HP Support Assistant 2012-05-24 12:28 - 2010-06-28 07:32 - 0000000 ____D C:\Users\Owner\AppData\Roaming\HpUpdate 2012-05-24 12:05 - 2012-05-24 12:04 - 0000000 ____D C:\Users\Owner\AppData\Local\{F0A0AAAD-EAC5-4DBB-AF34-72738260429C} 2012-05-24 04:33 - 2012-05-24 04:33 - 10063000 ____A (Malwarebytes Corporation ) C:\Users\Owner\Downloads\mbam-setup-1.61.0.1400.exe 2012-05-23 18:08 - 2010-07-05 18:15 - 0002405 ____A C:\Users\Owner\Desktop\Google Chrome.lnk 2012-05-23 18:07 - 2012-05-23 18:07 - 0000000 ____D C:\Users\Owner\AppData\Local\{A0D6887F-EC36-4C22-A24B-554E978B9504} 2012-05-23 04:47 - 2012-05-23 04:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{1A721035-5E6E-4995-BB68-48F2C435C296} 2012-05-23 04:46 - 2012-05-23 04:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{6EAC46D0-98FF-4621-AC8A-2B19168CB7B3} 2012-05-23 04:46 - 2011-04-09 21:35 - 0000000 ____D C:\Users\Owner\.gimp-2.6 2012-05-22 14:22 - 2012-05-22 14:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{51741675-CC3E-4134-B3E5-E0DB18B415C7} 2012-05-22 14:22 - 2012-05-22 14:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{A7283106-A29B-4541-ACDF-B5FBBEE96A2C} 2012-05-21 18:57 - 2012-05-21 18:56 - 0000000 ____D C:\Users\Owner\AppData\Local\{7F468C43-C501-4D26-BE51-5B29E249EEA2} 2012-05-21 18:56 - 2012-05-21 06:54 - 0000000 ____D C:\Users\Owner\AppData\Local\{A335B211-5833-4881-A97D-DB524A38C858} 2012-05-21 06:55 - 2012-05-21 06:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{BDC7CEF4-8F5B-4CC4-8BD1-48D9924EE5ED} 2012-05-20 11:37 - 2012-05-20 11:36 - 0000000 ____D C:\Users\Owner\AppData\Local\{52682771-FD39-44CC-9A25-4FE95E6BE3FA} 2012-05-20 11:36 - 2012-05-19 11:32 - 0000000 ____D C:\Users\Owner\AppData\Local\{8907D52C-221B-4354-8E6A-55020B9286FF} 2012-05-20 09:06 - 2010-07-05 17:41 - 0348537 ____A C:\Windows\DirectX.log 2012-05-19 23:35 - 2012-05-19 23:34 - 0000000 ____D C:\Users\Owner\AppData\Local\{BBBF8D59-16C3-461F-849F-C2EB8C0BA9FB} 2012-05-19 11:33 - 2012-05-19 11:32 - 0000000 ____D C:\Users\Owner\AppData\Local\{796617AD-548A-44A1-B1D7-1A5601B2862F} 2012-05-18 18:22 - 2012-05-18 18:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{8BDBDB1D-1281-4362-9E6A-26B29C3BC765} 2012-05-18 18:21 - 2012-05-17 04:30 - 0000000 ____D C:\Users\Owner\AppData\Local\{20C178A5-7473-4E6E-93C4-695F0C54AD13} 2012-05-18 08:47 - 2012-05-18 08:46 - 0000000 ____D C:\Program Files (x86)\QuickTime 2012-05-18 08:46 - 2012-05-18 08:46 - 0001807 ____A C:\Users\Public\Desktop\QuickTime Player.lnk 2012-05-18 06:21 - 2012-05-18 06:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{4D89976A-F07B-4395-926C-ECDB94467AC4} 2012-05-17 16:31 - 2012-05-17 16:31 - 0000000 ____D C:\Users\Owner\AppData\Local\{22FEDF3C-F9A9-462F-9B84-A84D84C4629C} 2012-05-16 04:18 - 2012-05-16 04:17 - 0000000 ____D C:\Users\Owner\AppData\Local\{5A0563F5-2A65-488F-8891-8C5D95513867} 2012-05-16 04:17 - 2012-05-15 04:13 - 0000000 ____D C:\Users\Owner\AppData\Local\{AC8BB4B5-2B9E-48C8-AC88-C54D4F289830} 2012-05-15 16:16 - 2012-05-15 16:15 - 0000000 ____D C:\Users\Owner\AppData\Local\{656DF0C2-2A99-4EDE-B174-5AE0A48412E5} 2012-05-15 04:14 - 2012-05-15 04:13 - 0000000 ____D C:\Users\Owner\AppData\Local\{54434F25-6021-40D8-9D1E-2063AE7AACDF} 2012-05-14 14:17 - 2010-11-02 12:51 - 0000000 ____D C:\Users\Owner\AppData\Roaming\gtk-2.0 2012-05-14 10:40 - 2012-05-14 10:39 - 0000000 ____D C:\Users\Owner\AppData\Local\{EF507E18-EA04-43BB-B420-F6F3F6ACA87D} 2012-05-14 10:38 - 2012-05-14 10:38 - 0000000 ____D C:\Users\Owner\AppData\Local\{194EF547-91F3-46F2-AFE0-F9792660BB19} 2012-05-14 10:38 - 2012-05-14 10:37 - 0000000 ____D C:\Users\Owner\AppData\Local\{6592740A-A3EB-4004-975D-B3CF7ED014CE} 2012-05-13 18:36 - 2012-05-13 18:36 - 0000000 ____D C:\Users\Owner\AppData\Local\{9B2393BD-772E-4BFB-82DE-7E9B07F7D5BF} 2012-05-13 18:36 - 2012-05-13 06:33 - 0000000 ____D C:\Users\Owner\AppData\Local\{7BE93690-369F-499A-B5E8-9E1A46972C81} 2012-05-13 06:35 - 2012-05-13 06:34 - 0000000 ____D C:\Users\Owner\AppData\Local\{DD84F3D7-8F40-47DE-BA4A-DB1B10C180F4} 2012-05-12 18:58 - 2012-05-12 18:58 - 0000000 ____D C:\Users\Owner\AppData\Local\{BE433D65-56DC-4C5C-8B7F-1A44117E3308} 2012-05-12 18:58 - 2010-06-28 06:32 - 0000000 ____D C:\Users\Owner\AppData\LocalLow 2012-05-12 05:44 - 2012-05-12 05:43 - 0000000 ____D C:\Users\Owner\AppData\Local\{680A9BD5-4110-4D8E-876A-4648FFE5C538} 2012-05-12 05:43 - 2012-05-12 05:42 - 0000000 ____D C:\Users\Owner\AppData\Local\{9B511AFE-4911-4C83-B322-1E9093A9D2FA} 2012-05-11 04:23 - 2012-05-11 04:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{C1480271-2654-4211-A2B3-EE10CA2B499B} 2012-05-11 04:22 - 2012-05-11 04:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{BF9C64D0-4504-489A-875E-726F22FF4F87} 2012-05-10 16:21 - 2012-05-10 16:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{1E51CF83-BCB5-49F0-A2D3-4B7E98D0383E} 2012-05-10 16:20 - 2012-05-10 04:18 - 0000000 ____D C:\Users\Owner\AppData\Local\{698B53B9-B861-4AD4-8A05-43C99C38B1F1} 2012-05-10 04:20 - 2012-05-10 04:19 - 0000000 ____D C:\Users\Owner\AppData\Local\{356CF653-B38B-4F20-9035-BD7C9D9DD750} 2012-05-09 14:53 - 2012-05-09 14:52 - 0000000 ____D C:\Users\Owner\AppData\Local\{EF7E5DCC-D10F-4451-9524-E4D301A501B7} 2012-05-09 14:52 - 2012-05-09 14:52 - 0000000 ____D C:\Users\Owner\AppData\Local\{59997081-E68D-4F2C-B730-2BDA68206DDB} 2012-05-08 19:13 - 2010-06-28 08:32 - 0000000 ____D C:\Users\All Users\Microsoft Help 2012-05-08 19:13 - 2010-06-28 07:13 - 57848688 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2012-05-08 19:03 - 2010-01-15 09:43 - 0000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2012-05-08 19:02 - 2009-07-13 23:45 - 0000000 ____D C:\Program Files\Windows Journal 2012-05-08 14:20 - 2012-05-08 14:19 - 0000000 ____D C:\Users\Owner\AppData\Local\{01A4EB52-DA45-4B30-B16E-12BB1191C27B} 2012-05-08 14:19 - 2012-05-08 14:18 - 0000000 ____D C:\Users\Owner\AppData\Local\{8AA9E231-2B15-4E2E-ADA5-42122FC13AE8} 2012-05-07 13:59 - 2012-05-07 13:58 - 0000000 ____D C:\Users\Owner\AppData\Local\{D503EE95-0274-4BBA-B97C-F4E1A3F75AD9} 2012-05-07 13:58 - 2012-05-07 13:57 - 0000000 ____D C:\Users\Owner\AppData\Local\{A276E77A-DB8D-4031-B8ED-8D6E525BCDE5} 2012-05-07 13:57 - 2012-05-07 13:56 - 0000000 ____D C:\Users\Owner\AppData\Local\{27FB111B-A826-4FFF-9B47-704018E101AC} 2012-05-07 13:56 - 2012-05-07 13:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{E28C110C-EC92-45DF-8137-AC2E70D67F87} 2012-05-06 17:45 - 2012-05-06 17:45 - 0000000 ____D C:\Users\Owner\AppData\Local\{9C28CC72-41D2-47E6-89F4-9A8EDE228062} 2012-05-06 17:45 - 2012-05-06 05:43 - 0000000 ____D C:\Users\Owner\AppData\Local\{681C69B9-4CAA-4D07-8AC7-A7863A1677EF} 2012-05-06 13:47 - 2010-07-07 19:22 - 0000000 ____D C:\Users\Owner\AppData\Local\ElevatedDiagnostics 2012-05-06 05:44 - 2012-05-06 05:43 - 0000000 ____D C:\Users\Owner\AppData\Local\{1420201D-3B63-4CC5-A3B1-3DDFC9936C3C} 2012-05-05 05:18 - 2012-05-05 05:17 - 0000000 ____D C:\Users\Owner\AppData\Local\{C27DD495-97E9-439B-B6F9-78A25993A441} 2012-05-05 05:17 - 2012-05-05 05:16 - 0000000 ____D C:\Users\Owner\AppData\Local\{B5BC95DB-7F5E-4276-A817-1264F16BC799} 2012-05-04 13:58 - 2012-05-04 13:58 - 8769696 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe 2012-05-04 13:58 - 2012-05-04 13:58 - 0000000 ____D C:\Windows\System32\Macromed 2012-05-04 13:58 - 2012-04-23 07:34 - 0419488 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2012-05-04 13:58 - 2011-08-12 08:48 - 0070304 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2012-05-04 11:43 - 2012-05-04 11:43 - 0000000 ____D C:\Users\Owner\AppData\Local\{C855599C-078B-43D8-A68B-54A1888ACA89} 2012-05-04 11:43 - 2012-05-04 11:42 - 0000000 ____D C:\Users\Owner\AppData\Local\{ECF1B774-0E72-475A-B14A-08278482408B} 2012-05-03 12:17 - 2012-05-03 12:16 - 0000000 ____D C:\Users\Owner\AppData\Local\{9798BC2A-5501-4056-B91F-1C4B6C0D4EAD} 2012-05-03 12:16 - 2012-05-03 12:15 - 0000000 ____D C:\Users\Owner\AppData\Local\{26F57F6E-40E7-4A1C-8AA0-F5B927B1FF5A} 2012-05-02 16:20 - 2012-05-02 16:19 - 0000000 ____D C:\Users\Owner\AppData\Local\{BBC7DD86-F35E-44E8-9670-299CF8A2491A} 2012-05-02 16:19 - 2012-05-02 04:17 - 0000000 ____D C:\Users\Owner\AppData\Local\{BF5034D4-97DB-43D5-87AE-CA74300B0F5D} 2012-05-02 14:22 - 2011-10-28 15:25 - 0000000 ____D C:\Users\All Users\Freemake 2012-05-02 14:20 - 2011-10-28 15:25 - 0001286 ____A C:\Users\Public\Desktop\Freemake Video Converter.lnk 2012-05-02 04:18 - 2012-05-02 04:18 - 0000000 ____D C:\Users\Owner\AppData\Local\{158D7B64-D85F-47E6-ADDE-E241C2460D6D} 2012-05-01 13:26 - 2012-05-01 13:25 - 0000000 ____D C:\Users\Owner\AppData\Local\{10A68C43-3142-4479-B821-EF8C741B1D8F} 2012-05-01 13:25 - 2012-05-01 13:25 - 0000000 ____D C:\Users\Owner\AppData\Local\{5A85EB40-00D6-42F6-A2E6-6CBC72FD583E} 2012-04-30 19:22 - 2012-04-30 19:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{FA59E7C8-D4DA-43AB-89D7-1ECA63B0CC78} 2012-04-30 19:21 - 2012-04-30 07:18 - 0000000 ____D C:\Users\Owner\AppData\Local\{31B6B59B-1020-451C-94ED-B4BF90D2C1CC} 2012-04-30 07:20 - 2012-04-30 07:19 - 0000000 ____D C:\Users\Owner\AppData\Local\{90811DD1-F1EF-4BF7-9735-03D7493F5046} 2012-04-29 19:01 - 2012-04-29 19:00 - 0000000 ____D C:\Users\Owner\AppData\Local\{0F1B5D35-25E0-40E9-A2B7-1E0F79126DEB} 2012-04-29 19:00 - 2012-04-29 06:57 - 0000000 ____D C:\Users\Owner\AppData\Local\{4B0D91B5-C694-4345-83B5-4BD28D987080} 2012-04-29 06:59 - 2012-04-29 06:58 - 0000000 ____D C:\Users\Owner\AppData\Local\{9B16F3A5-18B4-42DA-8BB6-06441DF26E60} 2012-04-28 17:56 - 2012-04-28 17:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{D4B7EDA5-C928-4961-B787-5BA1EE9624AF} 2012-04-28 17:55 - 2012-04-28 05:52 - 0000000 ____D C:\Users\Owner\AppData\Local\{BEF14823-98AB-4207-9798-558990132BB5} 2012-04-28 13:36 - 2012-04-20 14:39 - 0003580 ____A C:\Windows\wininit.ini 2012-04-28 13:36 - 2012-04-20 14:39 - 0003529 ____A C:\Windows\wininit.tmp 2012-04-28 05:54 - 2012-04-28 05:53 - 0000000 ____D C:\Users\Owner\AppData\Local\{B88B196F-004C-455D-BE1C-2D188B738470} 2012-04-27 10:47 - 2012-04-27 10:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{83D32099-3D9C-4E3E-B35D-4B7B7695FCB5} 2012-04-27 10:46 - 2012-04-27 10:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{CCC73218-D42C-454C-9A4A-B2A381A260A1} 2012-04-27 09:31 - 2012-04-27 09:29 - 0024984 ____A C:\Windows\DesertCombat Setup Log.txt 2012-04-27 09:29 - 2012-04-27 09:31 - 0729088 ____A (Indigo Rose Corporation) C:\Windows\iun6002.exe 2012-04-26 19:08 - 2012-04-26 19:07 - 0000000 ____D C:\Users\Owner\AppData\Local\{4EFB5378-DB3C-458A-AA8C-E2CE56FB9EB1} 2012-04-26 19:07 - 2012-04-26 19:06 - 0000000 ____D C:\Users\Owner\AppData\Local\{8EEE560C-8F2C-4EEA-929D-6498A608DA5C} 2012-04-26 07:06 - 2012-04-26 07:05 - 0000000 ____D C:\Users\Owner\AppData\Local\{AF08F2CA-6991-405B-938C-B3A208C112C9} 2012-04-26 07:05 - 2012-04-26 07:04 - 0000000 ____D C:\Users\Owner\AppData\Local\{A038846A-F674-470D-A4E2-6A04CAC62E2E} 2012-04-25 14:41 - 2012-04-25 14:41 - 0000000 ____D C:\Users\Owner\AppData\Local\{8000D9CE-B5C5-4A11-BE74-CF18832716B7} 2012-04-23 07:35 - 2012-04-23 07:34 - 0000000 ____D C:\Users\Owner\AppData\Local\{18ADE4C6-8340-4E07-AC3E-B5810AECC0C6} 2012-04-23 07:34 - 2012-04-23 07:34 - 0000000 ____D C:\Users\Owner\AppData\Local\{D2D21EDE-4B26-44A7-8DD4-870963AF01E4} 2012-04-22 17:01 - 2010-07-05 18:59 - 0000000 ____D C:\Users\Owner\AppData\Roaming\Skype 2012-04-22 07:12 - 2012-04-22 07:12 - 0000000 ____D C:\Users\Owner\AppData\Local\{2D416039-9219-4066-B80A-E9A9A9D27BBC} 2012-04-22 07:12 - 2012-04-22 07:11 - 0000000 ____D C:\Users\Owner\AppData\Local\{74802FD5-0714-443C-9F4C-90D08C4B7378} 2012-04-21 11:15 - 2012-04-21 11:15 - 0000000 ____D C:\Users\Owner\AppData\Local\{7090D591-1BAD-4F9F-8EC5-F6E98C5DCBC7} 2012-04-21 11:14 - 2012-04-21 11:14 - 0000000 ____D C:\Users\Owner\AppData\Local\{6ED2112C-8134-4BC7-B109-4A54A611AB69} 2012-04-21 11:05 - 2012-04-21 11:05 - 0000000 ____D C:\Users\Owner\AppData\Local\{CB231218-566B-48E1-AD75-DD55E97A741A} 2012-04-21 11:05 - 2012-04-21 11:04 - 0000000 ____D C:\Users\Owner\AppData\Local\{03FB880E-FC12-43B9-866D-018A7A1645BF} 2012-04-21 07:33 - 2012-04-21 07:33 - 0000000 ____D C:\Windows\en 2012-04-21 07:31 - 2012-04-21 07:31 - 0000000 ____D C:\Program Files\Windows Live 2012-04-21 07:31 - 2010-01-15 09:44 - 0000000 ____D C:\Program Files (x86)\Windows Live 2012-04-21 07:27 - 2012-04-21 07:27 - 0000000 ____D C:\Users\Owner\AppData\Local\{0CCEFC26-4477-45BE-8E3A-86605012B081} 2012-04-21 07:27 - 2012-04-21 07:26 - 0000000 ____D C:\Users\Owner\AppData\Local\{99D898E5-B8D8-43F4-A6F7-CE32B8CB7C39} 2012-04-20 12:46 - 2011-04-22 12:14 - 0000943 ____A C:\Windows\eReg.dat 2012-04-19 12:11 - 2012-04-19 12:10 - 0000000 ____D C:\Users\Owner\AppData\Local\{E0DBAEF4-8563-48A7-921D-0233F36960D8} 2012-04-19 12:10 - 2012-04-19 12:09 - 0000000 ____D C:\Users\Owner\AppData\Local\{63E30B3B-3BFF-4717-8ED6-002E81B1BF79} 2012-04-19 11:53 - 2012-04-19 11:53 - 0000000 ____D C:\Users\Owner\AppData\Local\{C62963A9-3462-4253-86FD-D1F177BDCD49} 2012-04-19 11:53 - 2012-04-19 11:52 - 0000000 ____D C:\Users\Owner\AppData\Local\{5A8363CB-8B69-4063-B09F-45B1FF6222FB} 2012-04-19 07:18 - 2012-04-19 07:18 - 0000000 ____D C:\Users\Owner\AppData\Local\{C45BAD27-5313-43E8-B984-3DCBFFAAB073} 2012-04-19 07:18 - 2012-04-19 07:17 - 0000000 ____D C:\Users\Owner\AppData\Local\{6CA4122A-D8B3-4934-A3FB-DC47AE336D27} 2012-04-19 07:14 - 2012-04-19 07:13 - 0000000 ____D C:\Users\Owner\AppData\Local\{90392220-B974-4A4B-9720-1608CAA225F5} 2012-04-19 07:13 - 2012-04-19 07:13 - 0000000 ____D C:\Users\Owner\AppData\Local\{3E1D738C-6132-4118-A00D-38E2FD944166} 2012-04-19 07:03 - 2012-04-19 07:02 - 0000000 ____D C:\Users\Owner\AppData\Local\{118A884B-84E0-4A7A-AE6B-8AE49F71F70A} 2012-04-19 07:02 - 2012-04-19 07:01 - 0000000 ____D C:\Users\Owner\AppData\Local\{D68D8026-EA10-4624-BAD9-19773AEE5EE3} 2012-04-19 04:16 - 2012-04-19 04:15 - 0000000 ____D C:\Users\Owner\AppData\Local\{4B7D9475-E612-447A-A3ED-4C30B7649CA7} 2012-04-19 04:15 - 2012-04-19 04:14 - 0000000 ____D C:\Users\Owner\AppData\Local\{666BF968-42AC-40E5-BEF1-B65A788ABC8E} 2012-04-18 16:56 - 2012-04-18 16:56 - 0094208 ____A (Apple Inc.) C:\Windows\SysWOW64\QuickTimeVR.qtx 2012-04-18 16:56 - 2012-04-18 16:56 - 0069632 ____A (Apple Inc.) C:\Windows\SysWOW64\QuickTime.qts 2012-04-18 16:39 - 2012-04-18 16:39 - 0000000 ____D C:\Users\Owner\AppData\Local\{949D611C-0867-4FF7-9D34-09C4E2374105} 2012-04-18 16:39 - 2012-04-18 16:38 - 0000000 ____D C:\Users\Owner\AppData\Local\{64CD6B1A-E05B-48EB-B92A-C3B550A404F8} 2012-04-17 10:11 - 2012-04-17 10:11 - 0000000 ____D C:\Users\Owner\AppData\Local\{D4FBCE03-0081-4431-812E-8C6D4E3D01E8} 2012-04-17 10:11 - 2012-04-17 10:10 - 0000000 ____D C:\Users\Owner\AppData\Local\{4FF117C5-6539-4A1F-8D2E-1200D41DE67A} 2012-04-17 04:27 - 2012-04-17 04:27 - 0000000 ____D C:\Users\Owner\AppData\Local\{595DD4AD-21AE-4F53-B7AE-0278093438F4} 2012-04-17 04:27 - 2012-04-17 04:26 - 0000000 ____D C:\Users\Owner\AppData\Local\{56CE9030-1E2B-4672-B475-78E65C1DE80F} 2012-04-16 17:25 - 2012-04-16 17:25 - 0000000 ____D C:\Users\Owner\AppData\Local\{748567E5-1E4A-49CE-970C-E0DCBACF49BA} 2012-04-16 17:25 - 2012-04-16 17:24 - 0000000 ____D C:\Users\Owner\AppData\Local\{B4EC8A63-BBA8-44C6-A9AF-62CBEDDC66B6} 2012-04-15 07:25 - 2012-04-15 07:24 - 0000000 ____D C:\Users\Owner\AppData\Local\{6D46337F-7B98-46A9-9540-E4F26B8EDCE1} 2012-04-15 07:24 - 2012-04-15 07:23 - 0000000 ____D C:\Users\Owner\AppData\Local\{E1A91476-2DB2-45B8-A1E8-4E1E7F023926} 2012-04-15 07:23 - 2012-04-15 07:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{D76C637C-292D-426B-9596-EB162895B19D} 2012-04-15 07:22 - 2012-04-15 07:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{5BB9C863-3300-4F54-A5D8-F83503D871DC} 2012-04-14 09:09 - 2012-04-14 09:08 - 0000000 ____D C:\Users\Owner\AppData\Local\{9677364A-0627-46C4-9859-74BF2555B030} 2012-04-14 09:08 - 2012-04-14 09:07 - 0000000 ____D C:\Users\Owner\AppData\Local\{F2009087-FEAB-4260-B08E-781011745897} 2012-04-14 06:47 - 2012-04-14 06:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{E593A2AB-92BF-4FF4-AB63-4792BAA3AAAF} 2012-04-14 06:46 - 2012-04-14 06:45 - 0000000 ____D C:\Users\Owner\AppData\Local\{2991FF6C-E565-4435-93DF-04BC4E11FEAB} 2012-04-13 09:09 - 2012-04-13 09:09 - 0000000 ____D C:\Users\Owner\AppData\Local\{7E579A73-1FD6-4DD9-B300-39552C7183A5} 2012-04-13 09:09 - 2012-04-13 09:08 - 0000000 ____D C:\Users\Owner\AppData\Local\{C3DD2ED1-315E-4660-90F3-85F261F69A76} 2012-04-13 09:07 - 2012-04-13 09:07 - 0000000 ____D C:\Users\Owner\AppData\Local\{3877E239-2BBE-42D7-8644-60C42061BFCE} 2012-04-13 09:07 - 2012-04-13 09:06 - 0000000 ____D C:\Users\Owner\AppData\Local\{BF864A8E-964A-4047-A1F1-2A70D82C6A13} 2012-04-12 16:35 - 2012-04-12 04:33 - 0000000 ____D C:\Users\Owner\AppData\Local\{C8FC2381-AA2B-4AC3-8746-909996B4FC8F} 2012-04-12 15:41 - 2012-04-12 15:41 - 0001046 ____A C:\Users\Public\Desktop\RealPlayer.lnk 2012-04-12 15:41 - 2011-11-27 14:25 - 0198832 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll 2012-04-12 15:41 - 2010-11-23 14:22 - 0000000 ____D C:\Program Files (x86)\real 2012-04-12 15:40 - 2011-11-27 14:25 - 0272896 ____A (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll 2012-04-12 15:40 - 2011-11-27 14:25 - 0006656 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll 2012-04-12 15:40 - 2011-11-27 14:25 - 0005632 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll 2012-04-12 15:37 - 2012-04-12 15:37 - 0000000 ____D C:\Users\Owner\AppData\Roaming\RealNetworks 2012-04-12 15:19 - 2010-07-05 19:24 - 0000000 ____D C:\Users\Owner\AppData\Roaming\Real 2012-04-11 18:58 - 2009-07-13 18:34 - 0000478 ____A C:\Windows\win.ini 2012-04-11 16:33 - 2012-04-11 04:31 - 0000000 ____D C:\Users\Owner\AppData\Local\{C1CB8B93-0FA1-4CA1-914A-EF98A52AF11B} 2012-04-10 08:23 - 2012-04-09 20:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{5029912A-33D3-46B2-8BB4-2CA4F137012A} 2012-04-09 06:53 - 2012-04-09 06:53 - 0000000 ____D C:\Users\Owner\AppData\Local\{1C435188-A002-49D8-92A1-5E5E88F5C361} 2012-04-08 08:33 - 2012-04-08 08:33 - 0000000 ____D C:\Users\Owner\AppData\Local\{ACF58EB1-EE2D-4D45-B610-B8263D458BF9} 2012-04-08 07:49 - 2009-07-13 23:44 - 0000000 ___RD C:\Users\Public\Recorded TV 2012-04-07 20:27 - 2012-04-07 20:26 - 0000000 ____D C:\Users\Owner\AppData\Local\{59EAD285-C217-41D5-907A-7B8347D6DE68} 2012-04-07 08:26 - 2012-04-07 08:25 - 0000000 ____D C:\Users\Owner\AppData\Local\{DEED4696-3C5C-48D0-8619-FEDD20E24AA0} 2012-04-06 19:48 - 2012-04-06 19:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{5218D774-479A-417C-A3C6-7E33D957E294} 2012-04-06 07:43 - 2012-04-06 07:42 - 0000000 ____D C:\Users\Owner\AppData\Local\{002EC0E5-0655-48C9-9BC8-E0F060E7141D} 2012-04-05 10:04 - 2012-04-05 10:03 - 0000000 ____D C:\Users\Owner\AppData\Local\{77C293BE-DF2D-408F-8DA7-FFE638250D0E} 2012-04-05 05:49 - 2010-07-05 17:57 - 0000000 ____D C:\Windows\System32\Drivers\N360x64 2012-04-05 05:31 - 2012-04-05 05:31 - 0000000 ____D C:\Users\Owner\AppData\Local\{E710CD57-773D-44DD-8BBA-357B4847FA6C} 2012-04-05 05:30 - 2011-09-18 09:24 - 0002339 ____A C:\Users\Public\Desktop\Norton 360.lnk 2012-04-04 12:24 - 2012-04-03 14:14 - 0000000 ____D C:\Users\Owner\AppData\Local\{3B617419-6633-4B68-A906-0EA59F828CB7} 2012-04-04 11:56 - 2012-05-25 17:36 - 0024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2012-04-02 07:54 - 2012-04-02 07:53 - 0000000 ____D C:\Users\Owner\AppData\Local\{E58505F0-B26F-40E7-856A-7077D4A9DF72} 2012-04-01 07:11 - 2012-03-31 07:08 - 0000000 ____D C:\Users\Owner\AppData\Local\{AA9D8404-9943-4942-80AE-D85CEA02668E} 2012-03-30 22:05 - 2012-05-08 14:30 - 5559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2012-03-30 20:39 - 2012-05-08 14:30 - 3968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2012-03-30 20:39 - 2012-05-08 14:30 - 3913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2012-03-30 19:10 - 2012-05-08 14:30 - 3146240 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-03-30 17:49 - 2012-03-30 05:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{C87FA795-059F-4B54-AE29-F34E56951A6A} 2012-03-30 05:48 - 2012-03-30 05:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{475F1B2B-584F-44B5-A686-6AE0AEC571C6} 2012-03-30 03:35 - 2012-05-08 14:29 - 1918320 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2012-03-29 14:14 - 2012-03-29 14:14 - 0001745 ____A C:\Users\Public\Desktop\iTunes.lnk 2012-03-29 14:14 - 2012-03-29 14:13 - 0000000 ____D C:\Program Files\iTunes 2012-03-29 14:14 - 2012-03-14 12:34 - 0000000 ____D C:\Program Files (x86)\iTunes 2012-03-29 14:13 - 2012-03-29 14:13 - 0000000 ____D C:\Program Files\iPod 2012-03-29 13:19 - 2012-03-28 13:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{536365EE-FCF6-4291-A45B-0D2CF3935EF2} 2012-03-28 13:57 - 2012-03-28 13:56 - 0000000 ____D C:\Users\Owner\AppData\Local\{D9F59410-9748-40FC-888F-087EFB5CF7E8} 2012-03-27 12:50 - 2012-03-27 12:49 - 0000000 ____D C:\Users\Owner\AppData\Local\{F962FA6E-FDB9-458F-B0E2-BA1A37778992} 2012-03-27 12:49 - 2012-03-24 19:15 - 0000000 ____D C:\Users\Owner\AppData\Local\{3D26E03B-8897-4845-BE89-B260B6DE7AAC} 2012-03-27 00:48 - 2012-03-27 00:48 - 0000000 ____D C:\Users\Owner\AppData\Local\{B48D4395-70B4-414C-8738-E3C1AB25EBE3} 2012-03-26 12:47 - 2012-03-26 12:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{50488E0C-9069-48DF-9681-6C185C23F5ED} 2012-03-25 20:43 - 2012-03-25 20:42 - 0000000 ____D C:\Users\Owner\AppData\Local\{E9789298-A832-4515-A870-7B55FCE6B8FA} 2012-03-25 08:42 - 2012-03-25 08:41 - 0000000 ____D C:\Users\Owner\AppData\Local\{FEB18B68-50A9-441E-915B-0C906AB2E411} 2012-03-24 19:17 - 2012-03-24 19:16 - 0000000 ____D C:\Users\Owner\AppData\Local\{AF66FF31-609A-414D-8386-455259BBDCAC} 2012-03-24 07:15 - 2012-03-24 07:14 - 0000000 ____D C:\Users\Owner\AppData\Local\{538C1329-4C3D-4856-8E59-D74505C8AC8D} 2012-03-24 07:14 - 2012-03-24 07:13 - 0000000 ____D C:\Users\Owner\AppData\Local\{C28A2A3D-1FDD-4690-9D31-40A1FFB4121B} 2012-03-23 10:01 - 2012-03-23 10:00 - 0000000 ____D C:\Users\Owner\AppData\Local\{FE2F1538-9F90-49F4-9983-7B74BEF514D5} 2012-03-23 10:00 - 2012-03-23 09:59 - 0000000 ____D C:\Users\Owner\AppData\Local\{14022C7F-5B48-4E5F-9ED9-33BCFFB0BF53} 2012-03-22 08:34 - 2012-03-22 08:33 - 0000000 ____D C:\Users\Owner\AppData\Local\{98F40583-88BF-4CB1-969E-D236680CAFDA} 2012-03-22 08:33 - 2012-03-22 08:32 - 0000000 ____D C:\Users\Owner\AppData\Local\{AA20EEC8-667C-4CA3-BFF8-0C8EE246704F} 2012-03-21 11:59 - 2012-03-21 11:59 - 0000000 ____D C:\Users\Owner\AppData\Local\{3F1B6563-2730-462D-B593-86435EEB07E3} 2012-03-20 18:22 - 2012-03-20 18:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{57615908-DDFC-48C9-900C-38A4FAD1D81F} 2012-03-20 18:21 - 2012-03-20 18:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{9B312F82-1F58-4AEA-BF0D-EC62F1B95B2E} 2012-03-20 06:20 - 2012-03-20 06:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{C535818F-8562-4739-8220-5F742A5F4B4A} 2012-03-20 06:20 - 2012-03-20 06:19 - 0000000 ____D C:\Users\Owner\AppData\Local\{18D7A879-D0DC-4AD8-A3F8-1D9FCF4217BD} 2012-03-19 09:48 - 2012-03-19 09:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{AAB7F439-1449-48D3-B09B-A00553A3C3E8} 2012-03-19 09:47 - 2012-03-19 09:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{2EBF0328-3248-458C-AE97-9E26E148BD3A} 2012-03-19 09:47 - 2012-03-19 09:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{690567A5-248B-4F9E-84F1-EF31A1538367} 2012-03-19 09:46 - 2012-03-19 09:45 - 0000000 ____D C:\Users\Owner\AppData\Local\{93DE10CC-12CF-41B6-8266-397EC261C36C} 2012-03-18 09:36 - 2012-03-18 09:35 - 0000000 ____D C:\Users\Owner\AppData\Local\{966E43D2-DEFE-4487-BD94-1D849A00B10A} 2012-03-18 09:35 - 2012-03-18 09:34 - 0000000 ____D C:\Users\Owner\AppData\Local\{37FC379B-2D31-4305-AA1A-EEE17EFDDD09} 2012-03-17 21:34 - 2012-03-17 21:33 - 0000000 ____D C:\Users\Owner\AppData\Local\{242104EE-0DE0-4ABF-A6BD-AE2B4194491B} 2012-03-17 21:33 - 2012-03-17 07:05 - 0000000 ____D C:\Users\Owner\AppData\Local\{6CE47BCB-B2EC-42C7-83A6-82DA6ECED394} 2012-03-17 07:06 - 2012-03-17 07:06 - 0000000 ____D C:\Users\Owner\AppData\Local\{0915FB63-3C72-4D54-A94A-217AFE1704EC} 2012-03-16 23:58 - 2012-05-08 14:29 - 0075120 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\partmgr.sys 2012-03-16 14:04 - 2012-03-16 14:04 - 0000000 ____D C:\Users\Owner\AppData\Local\{5D797419-58B0-4923-8002-3D9CE4854B56} 2012-03-16 14:04 - 2012-03-16 14:03 - 0000000 ____D C:\Users\Owner\AppData\Local\{C701EEAF-99E1-41D3-964E-CB87416940AF} 2012-03-16 13:58 - 2012-03-16 13:58 - 0000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition 2012-03-16 13:32 - 2010-07-06 16:39 - 0013824 ____A C:\Users\Owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2012-03-16 06:47 - 2012-03-16 06:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{BCB35E47-A2DB-475F-9CF1-55FA971CA210} 2012-03-16 06:46 - 2012-03-16 06:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{61801664-4F23-4BBC-9D40-0BE4D5241EF5} 2012-03-15 18:15 - 2012-03-15 18:14 - 0000000 ____D C:\Users\Owner\AppData\Local\{C2C3E21F-D115-451D-B68D-896297A59593} 2012-03-15 18:14 - 2012-03-15 18:13 - 0000000 ____D C:\Users\Owner\AppData\Local\{374A89D1-F460-48CE-8E48-14997DED7084} 2012-03-15 06:13 - 2012-03-15 06:12 - 0000000 ____D C:\Users\Owner\AppData\Local\{2B4D39BF-619D-40EE-8531-44956A0A8829} 2012-03-15 06:12 - 2012-03-15 06:12 - 0000000 ____D C:\Users\Owner\AppData\Local\{37766F82-A4E3-496D-9EB5-B4AED8B73525} 2012-03-15 06:12 - 2012-03-15 06:11 - 0000000 ____D C:\Users\Owner\AppData\Local\{E1A9C1FC-829E-4615-9551-2525BB500D34} 2012-03-15 06:11 - 2012-03-15 06:10 - 0000000 ____D C:\Users\Owner\AppData\Local\{B3F8EEBB-55BC-489F-9FE3-FC38D285D7D3} 2012-03-14 12:31 - 2012-03-14 12:30 - 0000000 ____D C:\Users\Owner\AppData\Local\{B4A53249-9AF3-4291-AEE8-329704CABF0A} 2012-03-14 12:30 - 2012-03-14 12:29 - 0000000 ____D C:\Users\Owner\AppData\Local\{EF9F3A4D-662D-4127-A178-1A88EFBFC989} 2012-03-13 19:56 - 2012-03-13 19:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{0592C098-1C56-47E7-BB06-8195F13E91EE} 2012-03-13 19:55 - 2012-03-13 19:54 - 0000000 ____D C:\Users\Owner\AppData\Local\{B91ABE2E-2E8E-4755-B76E-B5A3DB76D319} 2012-03-13 07:54 - 2012-03-13 07:54 - 0000000 ____D C:\Users\Owner\AppData\Local\{A8069494-BCAC-4A3A-8B50-6435EDC3FFDA} 2012-03-13 07:54 - 2012-03-13 07:53 - 0000000 ____D C:\Users\Owner\AppData\Local\{6962E2BF-6CF4-4787-A913-57BEEF97FD32} 2012-03-12 19:53 - 2012-03-12 19:52 - 0000000 ____D C:\Users\Owner\AppData\Local\{A0D393BD-BDD2-4849-8C3A-D4EB3F29C3D9} 2012-03-12 19:52 - 2012-03-12 19:51 - 0000000 ____D C:\Users\Owner\AppData\Local\{CE5417FA-15E0-476F-ADAD-6618DCE78FBA} 2012-03-12 07:51 - 2012-03-12 07:50 - 0000000 ____D C:\Users\Owner\AppData\Local\{5796A9A0-4350-4179-8008-54883482D05A} 2012-03-12 07:50 - 2012-03-12 07:49 - 0000000 ____D C:\Users\Owner\AppData\Local\{788336B2-82BD-4DE6-933E-23EB42FFD82A} 2012-03-11 19:49 - 2012-03-11 19:48 - 0000000 ____D C:\Users\Owner\AppData\Local\{7EA95F99-E407-4DCC-B94E-BF7355A6A32B} 2012-03-11 19:48 - 2012-03-11 19:48 - 0000000 ____D C:\Users\Owner\AppData\Local\{A2E16C86-13A3-4D65-83C4-40CAE7D135E9} 2012-03-11 07:48 - 2012-03-11 07:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{49B63505-5175-4A76-A67B-C071E1405D79} 2012-03-11 07:47 - 2012-03-11 07:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{E43BF5C7-E75F-44AA-941A-F207BF2FCB02} 2012-03-10 09:09 - 2012-03-10 09:08 - 0000000 ____D C:\Users\Owner\AppData\Local\{D8894B3A-FAE8-4E6D-A5CD-ABA1DCD7C127} 2012-03-10 09:08 - 2012-03-10 09:07 - 0000000 ____D C:\Users\Owner\AppData\Local\{746F3213-29DD-4C82-B221-82B433E59628} 2012-03-09 21:07 - 2012-03-09 21:06 - 0000000 ____D C:\Users\Owner\AppData\Local\{720DF6B2-652C-41A5-B07F-D1DFD88DDEB8} 2012-03-09 21:06 - 2012-03-09 21:06 - 0000000 ____D C:\Users\Owner\AppData\Local\{053AF500-7B7F-4722-A9DD-3749CF32F29B} 2012-03-09 09:06 - 2012-03-09 09:05 - 0000000 ____D C:\Users\Owner\AppData\Local\{0DBE6579-8703-4DEC-A01A-3B310DAC8177} 2012-03-09 09:05 - 2012-03-09 09:04 - 0000000 ____D C:\Users\Owner\AppData\Local\{2B48CCB5-0173-4A4C-8B62-170109FEC097} 2012-03-08 14:50 - 2012-03-08 14:50 - 0049016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sirenacm.dll 2012-03-08 14:37 - 2012-03-08 14:37 - 0302448 ____A (Microsoft Corporation) C:\Windows\WLXPGSS.SCR 2012-03-08 12:42 - 2012-03-08 12:41 - 0000000 ____D C:\Users\Owner\AppData\Local\{4C2E4D92-239E-4121-B1C5-301696B97FC5} 2012-03-08 12:41 - 2012-03-08 12:40 - 0000000 ____D C:\Users\Owner\AppData\Local\{51806763-F945-4D95-9C20-18A780C54410} 2012-03-07 14:45 - 2010-07-05 18:45 - 0000000 ____D C:\Users\Owner\Documents\Liam 2012-03-07 14:16 - 2012-03-07 14:16 - 0157472 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaws.exe 2012-03-07 14:16 - 2012-03-07 14:16 - 0149280 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaw.exe 2012-03-07 14:16 - 2012-03-07 14:16 - 0149280 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\java.exe 2012-03-07 14:16 - 2010-07-06 09:28 - 0472808 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\deployJava1.dll 2012-03-07 09:48 - 2012-03-07 09:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{9B51CD81-6860-4219-B622-F6C744721A66} 2012-03-07 09:47 - 2012-03-07 09:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{D53C2B14-7873-4837-B324-39ADD94C169F} 2012-03-07 09:46 - 2012-03-07 09:45 - 0000000 ____D C:\Users\Owner\AppData\Local\{05C4A99A-04B4-45BE-8901-B78770543A45} 2012-03-07 09:45 - 2012-03-06 11:38 - 0000000 ____D C:\Users\Owner\AppData\Local\{ED775254-16D5-4D9E-96E7-229B1D15CE13} 2012-03-06 11:39 - 2012-03-06 11:38 - 0000000 ____D C:\Users\Owner\AppData\Local\{CB5C3E85-2B0E-4EA5-A3A9-90A69524C55B} 2012-03-05 10:50 - 2012-03-05 10:49 - 0000000 ____D C:\Users\Owner\AppData\Local\{D6FB6833-65C5-428C-BCFC-1B8E236FC7F2} 2012-03-05 10:49 - 2012-03-04 19:37 - 0000000 ____D C:\Users\Owner\AppData\Local\{A3A032F3-CF9E-46F8-BE30-A21B1202DEE6} 2012-03-04 19:38 - 2012-03-04 19:37 - 0000000 ____D C:\Users\Owner\AppData\Local\{2250A325-735E-4DE2-923E-8DEDA74B45E3} 2012-03-04 07:37 - 2012-03-04 07:36 - 0000000 ____D C:\Users\Owner\AppData\Local\{F8E0465D-49D1-446E-8646-35812E593B83} 2012-03-04 07:36 - 2012-03-04 07:35 - 0000000 ____D C:\Users\Owner\AppData\Local\{6872B923-6546-43D2-B990-3B03514BD4B9} 2012-03-04 07:35 - 2012-03-04 07:34 - 0000000 ____D C:\Users\Owner\AppData\Local\{E53E9DD6-994D-4B37-B563-0267CED6882D} 2012-03-04 07:34 - 2012-03-04 07:34 - 0000000 ____D C:\Users\Owner\AppData\Local\{75984AF0-854E-4982-8D94-AE771C38F816} 2012-03-03 18:24 - 2012-03-03 18:23 - 0000000 ____D C:\Users\Owner\AppData\Local\{D774033B-3534-4A46-907C-509143EDB976} 2012-03-03 18:23 - 2012-03-03 18:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{80DDF98E-3839-427C-9B88-EF0BEB9638FC} 2012-03-03 08:14 - 2011-09-27 11:28 - 0000000 ____D C:\Users\Owner\Documents\ResumeMaker 2012-03-03 06:22 - 2012-03-03 06:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{39B95969-E41B-46BF-B1EE-EC47C7BE066A} 2012-03-03 06:22 - 2012-03-03 06:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{9F9F4C9F-47FA-4CFD-A0D4-195C9560E851} 2012-03-02 22:35 - 2012-05-08 14:30 - 1544704 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll 2012-03-02 21:31 - 2012-05-08 14:30 - 1077248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2012-03-02 18:21 - 2012-03-02 18:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{E8C6B165-CDD3-483F-BD40-E2433E400114} 2012-03-02 18:20 - 2012-03-02 18:19 - 0000000 ____D C:\Users\Owner\AppData\Local\{FA1C7568-6C40-46F8-8E54-2EFE54D8FD6D} 2012-03-02 05:51 - 2012-03-02 05:51 - 0000000 ____D C:\Users\Owner\AppData\Local\{9F2ECBD5-312B-47F1-A85E-59260C6FA246} 2012-03-02 05:51 - 2012-03-02 05:50 - 0000000 ____D C:\Users\Owner\AppData\Local\{542CF24B-51BB-44C2-A0DD-9B73DD61A9FD} 2012-03-01 12:30 - 2012-03-01 12:29 - 0000000 ____D C:\Users\Owner\AppData\Local\{4FCB2364-30E6-42AC-B22B-65935A12AF1E} 2012-03-01 12:29 - 2012-03-01 12:29 - 0000000 ____D C:\Users\Owner\AppData\Local\{5BB61CEA-2950-47F7-B046-9659C895D46B} 2012-02-29 22:46 - 2012-04-11 18:56 - 0023408 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\fs_rec.sys 2012-02-29 22:38 - 2012-04-11 18:56 - 0220672 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll 2012-02-29 22:33 - 2012-04-11 18:56 - 0081408 ____A (Microsoft Corporation) C:\Windows\System32\imagehlp.dll 2012-02-29 22:28 - 2012-04-11 18:56 - 0005120 ____A (Microsoft Corporation) C:\Windows\System32\wmi.dll 2012-02-29 21:37 - 2012-04-11 18:56 - 0172544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2012-02-29 21:33 - 2012-04-11 18:56 - 0159232 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll 2012-02-29 21:29 - 2012-04-11 18:56 - 0005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wmi.dll 2012-02-29 09:42 - 2012-02-29 09:41 - 0000000 ____D C:\Users\Owner\AppData\Local\{FA037111-9332-46C9-B04B-171D1857B87F} 2012-02-29 09:41 - 2012-02-29 09:40 - 0000000 ____D C:\Users\Owner\AppData\Local\{7239F38F-FD31-4D55-9026-019E03933BE5} 2012-02-29 09:40 - 2012-02-29 09:40 - 0000000 ____D C:\Users\Owner\AppData\Local\{93B28406-9BA8-4CDA-B40E-F0607365DD4E} 2012-02-29 09:40 - 2012-02-29 09:39 - 0000000 ____D C:\Users\Owner\AppData\Local\{0DD69378-011F-4F91-9690-C5DD370BCEB6} 2012-02-28 19:17 - 2012-02-28 19:17 - 0000000 ____D C:\Users\Owner\AppData\Local\{FF9625EC-3A41-4292-AE63-232D21D44862} 2012-02-28 19:17 - 2012-02-28 19:16 - 0000000 ____D C:\Users\Owner\AppData\Local\{51EBA023-4CE1-4F34-916F-9FBF87D5C204} 2012-02-28 07:17 - 2010-06-28 07:29 - 0000544 ____A C:\Windows\Tasks\PCDRScheduledMaintenance.job 2012-02-28 07:16 - 2012-02-28 07:15 - 0000000 ____D C:\Users\Owner\AppData\Local\{6FA5B420-7C9C-4675-BE3B-4815C109F0C6} 2012-02-28 07:15 - 2012-02-27 15:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{1CBB91AD-B4F0-48E9-AE01-C5B0DC08D68B} ========================= Known DLLs (Whitelisted) ============ ========================= Bamital & volsnap Check ============ C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ========================= Memory info ====================== Percentage of memory in use: 14% Total physical RAM: 5879.89 MB Available physical RAM: 5036.95 MB Total Pagefile: 5878.04 MB Available Pagefile: 5017.04 MB Total Virtual: 8192 MB Available Virtual: 8191.9 MB ======================= Partitions ========================= 1 Drive c: (HP) (Fixed) (Total:454.08 GB) (Free:369.29 GB) NTFS 2 Drive e: (FACTORY_IMAGE) (Fixed) (Total:11.48 GB) (Free:1.63 GB) NTFS ==>[system with boot components (obtained from reading drive)] 4 Drive g: () (Removable) (Total:14.89 GB) (Free:14.89 GB) FAT32 9 Drive x: (Boot) (Fixed) (Total:0.08 GB) (Free:0.07 GB) NTFS 10 Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)] Disk ### Status Size Free Dyn Gpt -------- ------------- ------- ------- --- --- Disk 0 Online 465 GB 0 B Disk 1 Online 14 GB 0 B Disk 2 No Media 0 B 0 B Disk 3 No Media 0 B 0 B Disk 4 No Media 0 B 0 B Disk 5 No Media 0 B 0 B ========================================================== Last Boot: 2012-05-19 21:30 ======================= End Of Log ==========================
  7. Scan result of Farbar Recovery Scan Tool Version: 25-05-2012 Ran by Système at 27-05-2012 12:02:02 Running from G:\ Windows 7 Home Premium (X64) OS Language: French Standard The current controlset is ControlSet001 ATTENTION:=====> THE TOOL IS NOT RUN FROM RECOVERY ENVIRONMENT AND WILL NOT FUNTION PROPERLY. ========================== Registry (Whitelisted) ============= HKLM\...\Run: [PC-Doctor for Windows localizer] C:\Program Files\PC-Doctor for Windows\localizer.exe [95728 2009-09-16] (PC-Doctor, Inc.) HKLM\...\Run: [LXCFCATS] rundll32 C:\Windows\system32\spool\DRIVERS\x64\3\LXCFtime.dll,RunDLLEntry [29184 2005-09-14] () HKLM-x32\...\Run: [hpsysdrv] c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard) HKLM-x32\...\Run: [HP Remote Solution] %ProgramFiles%\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe [656896 2009-08-24] (Hewlett-Packard) HKLM-x32\...\Run: [startCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2009-06-14] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard) HKLM-x32\...\Run: [OM2_Monitor] "C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" /OM [54576 2008-10-31] (OLYMPUS IMAGING CORP.) HKLM-x32\...\Run: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe" [135536 2010-12-13] (Microsoft Corporation) HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-02] (Adobe Systems Incorporated) HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2012-02-20] (Apple Inc.) HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2012-03-27] (Apple Inc.) HKLM-x32\...\Run: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot [296056 2012-04-12] (RealNetworks, Inc.) HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-04-18] (Apple Inc.) HKU\Default\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1685048 2009-09-29] (Hewlett-Packard) HKU\Default User\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1685048 2009-09-29] (Hewlett-Packard) HKU\Owner\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW [1685048 2009-09-29] (Hewlett-Packard) HKU\Owner\...\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [4280184 2012-03-08] (Microsoft Corporation) HKU\Owner\...\Run: [Google Update] "C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2010-07-05] (Google Inc.) HKU\Owner\...\Run: [OM2_Monitor] "C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [95536 2008-10-31] (OLYMPUS IMAGING CORP.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1 Startup: C:\Users\Owner\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk ShortcutTarget: OneNote 2010 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) ==================== Services (Whitelisted) ====== 2 AMD_RAIDXpert; "C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe" -s [122880 2009-09-19] (AMD) 2 BBUpdate; "C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE" [249648 2011-10-13] (Microsoft Corporation) 3 GamesAppService; "C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe" [206072 2010-10-12] (WildTangent, Inc.) 2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [86072 2011-09-09] (Hewlett-Packard Company) 2 lxcf_device; C:\Windows\system32\lxcfcoms.exe -service [566192 2007-02-23] ( ) 2 N360; "C:\Program Files (x86)\Norton 360\Engine\5.2.1.3\ccSvcHst.exe" /s "N360" /m "C:\Program Files (x86)\Norton 360\Engine\5.2.1.3\diMaster.dll" /prefetch:1 [262584 2011-03-31] (Symantec Corporation) 2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75136 2010-12-04] () 2 LightScribeService; "c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe" [x] ========================== Drivers (Whitelisted) ============= 1 BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20120517.001\BHDrvx64.sys [1160824 2012-04-02] (Symantec Corporation) 1 eeCtrl; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [482936 2012-02-04] (Symantec Corporation) 3 EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138360 2012-02-04] (Symantec Corporation) 1 IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20120525.001\IDSvia64.sys [488568 2012-04-27] (Symantec Corporation) 3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20120526.006\ENG64.SYS [120440 2012-05-15] (Symantec Corporation) 3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20120526.006\EX64.SYS [2068600 2012-05-15] (Symantec Corporation) 2 SecDrv; C:\Windows\SysWow64\Drivers\SecDrv.sys [163644 2011-06-12] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) 1 SRTSP; C:\Windows\System32\Drivers\N360x64\0502010.003\SRTSP64.SYS [744568 2011-03-30] (Symantec Corporation) 1 SRTSPX; C:\Windows\System32\drivers\N360x64\0502010.003\SRTSPX64.SYS [40568 2011-03-30] (Symantec Corporation) 0 SymDS; C:\Windows\System32\drivers\N360x64\0502010.003\SYMDS64.SYS [450680 2011-01-26] (Symantec Corporation) 0 SymEFA; C:\Windows\System32\drivers\N360x64\0502010.003\SYMEFA64.SYS [912504 2011-03-14] (Symantec Corporation) 3 SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2011-09-18] (Symantec Corporation) 1 SymIRON; C:\Windows\System32\drivers\N360x64\0502010.003\Ironx64.SYS [171128 2011-01-26] (Symantec Corporation) 1 SymNetS; C:\Windows\System32\Drivers\N360x64\0502010.003\SYMNETS.SYS [386168 2011-04-20] (Symantec Corporation) 3 PCDSRVC{F36B3A4C-F95654BD-06000000}_0; \??\c:\program files\pc-doctor for windows\pcdsrvc_x64.pkms [x] ========================== NetSvcs (Whitelisted) =========== ============ One Month Created Files and Folders ============== 2012-05-27 07:36 - 2012-05-27 07:36 - 1394807 ____A C:\Users\Owner\Downloads\FRST64.exe 2012-05-26 20:55 - 2012-05-26 20:56 - 0000000 ____D C:\Users\Owner\AppData\Local\{CA7BA3C1-2940-4D4D-AB89-CC78A248FCBA} 2012-05-26 20:54 - 2012-05-26 20:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{1F123B51-4116-4BBF-A393-E509587094D6} 2012-05-26 15:59 - 2012-05-26 15:59 - 0009793 ____A C:\Users\Owner\Downloads\Attach.txt 2012-05-26 14:59 - 2012-05-26 14:59 - 0029965 ____A C:\Users\Owner\Desktop\DDS.txt 2012-05-26 14:58 - 2012-05-26 14:58 - 0008596 ____A C:\Users\Owner\Desktop\Attach.txt 2012-05-26 14:40 - 2012-05-26 14:40 - 0607260 ____R (Swearware) C:\Users\Owner\Desktop\dds.com 2012-05-26 14:16 - 2012-05-26 14:16 - 0017204 ____A C:\Users\Owner\Documents\HECE display bd.docx 2012-05-26 07:26 - 2012-05-26 07:27 - 0000000 ____D C:\Users\Owner\AppData\Local\{6E2E7121-A799-4A1B-907A-1A1FBABBC2D8} 2012-05-26 07:25 - 2012-05-26 07:26 - 0000000 ____D C:\Users\Owner\AppData\Local\{3229585E-7463-4240-907B-AB1AF0A5C25C} 2012-05-25 20:32 - 2012-05-25 20:32 - 0000043 ____A C:\Users\Owner\AppData\Roaming\mbam.context.scan 2012-05-25 17:44 - 2012-05-25 17:44 - 0000000 ____D C:\Users\Owner\AppData\Roaming\ATI 2012-05-25 17:36 - 2012-05-25 17:36 - 0000977 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2012-05-25 17:36 - 2012-05-25 17:36 - 0000000 ____D C:\Users\Owner\AppData\Roaming\Malwarebytes 2012-05-25 17:36 - 2012-05-25 17:36 - 0000000 ____D C:\Users\All Users\Malwarebytes 2012-05-25 17:36 - 2012-05-25 17:36 - 0000000 ____D C:\Program Files (x86)\Malwarebytes 2012-05-25 17:36 - 2012-04-04 11:56 - 0024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2012-05-25 16:58 - 2012-05-25 16:58 - 0000046 __ASH C:\Users\Owner\AppData\Roaming\desktop.ini 2012-05-25 16:11 - 2012-05-25 16:12 - 0000000 ____D C:\Users\Owner\AppData\Local\{A16619BA-9FD7-4AFC-BE27-426894FCA576} 2012-05-25 04:10 - 2012-05-25 04:11 - 0000000 ____D C:\Users\Owner\AppData\Local\{96B10ABF-B3A7-438C-B149-E4A64491E4FC} 2012-05-24 12:04 - 2012-05-24 12:05 - 0000000 ____D C:\Users\Owner\AppData\Local\{F0A0AAAD-EAC5-4DBB-AF34-72738260429C} 2012-05-24 04:33 - 2012-05-24 04:33 - 10063000 ____A (Malwarebytes Corporation ) C:\Users\Owner\Downloads\mbam-setup-1.61.0.1400.exe 2012-05-23 18:07 - 2012-05-23 18:07 - 0000000 ____D C:\Users\Owner\AppData\Local\{A0D6887F-EC36-4C22-A24B-554E978B9504} 2012-05-23 18:06 - 2012-05-25 16:11 - 0000000 ____D C:\Users\Owner\AppData\Local\{333F0C07-5446-46ED-B3F7-F043806335AA} 2012-05-23 04:46 - 2012-05-23 04:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{1A721035-5E6E-4995-BB68-48F2C435C296} 2012-05-23 04:46 - 2012-05-23 04:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{6EAC46D0-98FF-4621-AC8A-2B19168CB7B3} 2012-05-22 14:22 - 2012-05-22 14:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{51741675-CC3E-4134-B3E5-E0DB18B415C7} 2012-05-22 14:21 - 2012-05-22 14:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{A7283106-A29B-4541-ACDF-B5FBBEE96A2C} 2012-05-21 18:56 - 2012-05-21 18:57 - 0000000 ____D C:\Users\Owner\AppData\Local\{7F468C43-C501-4D26-BE51-5B29E249EEA2} 2012-05-21 06:55 - 2012-05-21 06:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{BDC7CEF4-8F5B-4CC4-8BD1-48D9924EE5ED} 2012-05-21 06:54 - 2012-05-21 18:56 - 0000000 ____D C:\Users\Owner\AppData\Local\{A335B211-5833-4881-A97D-DB524A38C858} 2012-05-20 11:36 - 2012-05-20 11:37 - 0000000 ____D C:\Users\Owner\AppData\Local\{52682771-FD39-44CC-9A25-4FE95E6BE3FA} 2012-05-20 09:54 - 2012-05-26 15:53 - 0016091 ____A C:\Users\Owner\AppData\Roaming\eula 2012-05-20 09:07 - 2010-06-02 00:55 - 0527192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll 2012-05-20 09:07 - 2010-06-02 00:55 - 0518488 ____A (Microsoft Corporation) C:\Windows\System32\XAudio2_7.dll 2012-05-20 09:07 - 2010-06-02 00:55 - 0239960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll 2012-05-20 09:07 - 2010-06-02 00:55 - 0176984 ____A (Microsoft Corporation) C:\Windows\System32\xactengine3_7.dll 2012-05-20 09:07 - 2010-06-02 00:55 - 0077656 ____A (Microsoft Corporation) C:\Windows\System32\XAPOFX1_5.dll 2012-05-20 09:07 - 2010-06-02 00:55 - 0074072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 2526056 ____A (Microsoft Corporation) C:\Windows\System32\D3DCompiler_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 2401112 ____A (Microsoft Corporation) C:\Windows\System32\D3DX9_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 2106216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 1998168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 1907552 ____A (Microsoft Corporation) C:\Windows\System32\d3dcsx_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 1868128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 0511328 ____A (Microsoft Corporation) C:\Windows\System32\d3dx10_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 0470880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 0276832 ____A (Microsoft Corporation) C:\Windows\System32\d3dx11_43.dll 2012-05-20 09:07 - 2010-05-26 07:41 - 0248672 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll 2012-05-20 09:07 - 2010-02-04 06:01 - 0530776 ____A (Microsoft Corporation) C:\Windows\System32\XAudio2_6.dll 2012-05-20 09:07 - 2010-02-04 06:01 - 0528216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll 2012-05-20 09:07 - 2010-02-04 06:01 - 0238936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll 2012-05-20 09:07 - 2010-02-04 06:01 - 0176984 ____A (Microsoft Corporation) C:\Windows\System32\xactengine3_6.dll 2012-05-20 09:07 - 2010-02-04 06:01 - 0078680 ____A (Microsoft Corporation) C:\Windows\System32\XAPOFX1_4.dll 2012-05-20 09:07 - 2010-02-04 06:01 - 0074072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll 2012-05-20 09:07 - 2010-02-04 06:01 - 0024920 ____A (Microsoft Corporation) C:\Windows\System32\X3DAudio1_7.dll 2012-05-20 09:07 - 2010-02-04 06:01 - 0022360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll 2012-05-19 23:34 - 2012-05-19 23:35 - 0000000 ____D C:\Users\Owner\AppData\Local\{BBBF8D59-16C3-461F-849F-C2EB8C0BA9FB} 2012-05-19 11:32 - 2012-05-20 11:36 - 0000000 ____D C:\Users\Owner\AppData\Local\{8907D52C-221B-4354-8E6A-55020B9286FF} 2012-05-19 11:32 - 2012-05-19 11:33 - 0000000 ____D C:\Users\Owner\AppData\Local\{796617AD-548A-44A1-B1D7-1A5601B2862F} 2012-05-18 18:21 - 2012-05-18 18:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{8BDBDB1D-1281-4362-9E6A-26B29C3BC765} 2012-05-18 08:46 - 2012-05-18 08:47 - 0000000 ____D C:\Program Files (x86)\QuickTime 2012-05-18 08:46 - 2012-05-18 08:46 - 0001807 ____A C:\Users\Public\Desktop\QuickTime Player.lnk 2012-05-18 06:20 - 2012-05-18 06:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{4D89976A-F07B-4395-926C-ECDB94467AC4} 2012-05-17 16:31 - 2012-05-17 16:31 - 0000000 ____D C:\Users\Owner\AppData\Local\{22FEDF3C-F9A9-462F-9B84-A84D84C4629C} 2012-05-17 04:30 - 2012-05-18 18:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{20C178A5-7473-4E6E-93C4-695F0C54AD13} 2012-05-16 04:17 - 2012-05-16 04:18 - 0000000 ____D C:\Users\Owner\AppData\Local\{5A0563F5-2A65-488F-8891-8C5D95513867} 2012-05-15 16:15 - 2012-05-15 16:16 - 0000000 ____D C:\Users\Owner\AppData\Local\{656DF0C2-2A99-4EDE-B174-5AE0A48412E5} 2012-05-15 04:13 - 2012-05-16 04:17 - 0000000 ____D C:\Users\Owner\AppData\Local\{AC8BB4B5-2B9E-48C8-AC88-C54D4F289830} 2012-05-15 04:13 - 2012-05-15 04:14 - 0000000 ____D C:\Users\Owner\AppData\Local\{54434F25-6021-40D8-9D1E-2063AE7AACDF} 2012-05-14 10:39 - 2012-05-14 10:40 - 0000000 ____D C:\Users\Owner\AppData\Local\{EF507E18-EA04-43BB-B420-F6F3F6ACA87D} 2012-05-14 10:38 - 2012-05-14 10:38 - 0000000 ____D C:\Users\Owner\AppData\Local\{194EF547-91F3-46F2-AFE0-F9792660BB19} 2012-05-14 10:37 - 2012-05-14 10:38 - 0000000 ____D C:\Users\Owner\AppData\Local\{6592740A-A3EB-4004-975D-B3CF7ED014CE} 2012-05-13 18:36 - 2012-05-13 18:36 - 0000000 ____D C:\Users\Owner\AppData\Local\{9B2393BD-772E-4BFB-82DE-7E9B07F7D5BF} 2012-05-13 06:34 - 2012-05-13 06:35 - 0000000 ____D C:\Users\Owner\AppData\Local\{DD84F3D7-8F40-47DE-BA4A-DB1B10C180F4} 2012-05-13 06:33 - 2012-05-13 18:36 - 0000000 ____D C:\Users\Owner\AppData\Local\{7BE93690-369F-499A-B5E8-9E1A46972C81} 2012-05-12 18:58 - 2012-05-12 18:58 - 0000000 ____D C:\Users\Owner\AppData\Local\{BE433D65-56DC-4C5C-8B7F-1A44117E3308} 2012-05-12 05:43 - 2012-05-12 05:44 - 0000000 ____D C:\Users\Owner\AppData\Local\{680A9BD5-4110-4D8E-876A-4648FFE5C538} 2012-05-12 05:42 - 2012-05-12 05:43 - 0000000 ____D C:\Users\Owner\AppData\Local\{9B511AFE-4911-4C83-B322-1E9093A9D2FA} 2012-05-11 04:22 - 2012-05-11 04:23 - 0000000 ____D C:\Users\Owner\AppData\Local\{C1480271-2654-4211-A2B3-EE10CA2B499B} 2012-05-11 04:22 - 2012-05-11 04:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{BF9C64D0-4504-489A-875E-726F22FF4F87} 2012-05-10 16:20 - 2012-05-10 16:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{1E51CF83-BCB5-49F0-A2D3-4B7E98D0383E} 2012-05-10 04:19 - 2012-05-10 04:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{356CF653-B38B-4F20-9035-BD7C9D9DD750} 2012-05-10 04:18 - 2012-05-10 16:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{698B53B9-B861-4AD4-8A05-43C99C38B1F1} 2012-05-09 14:52 - 2012-05-09 14:53 - 0000000 ____D C:\Users\Owner\AppData\Local\{EF7E5DCC-D10F-4451-9524-E4D301A501B7} 2012-05-09 14:52 - 2012-05-09 14:52 - 0000000 ____D C:\Users\Owner\AppData\Local\{59997081-E68D-4F2C-B730-2BDA68206DDB} 2012-05-08 14:30 - 2012-03-30 22:05 - 5559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2012-05-08 14:30 - 2012-03-30 20:39 - 3968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2012-05-08 14:30 - 2012-03-30 20:39 - 3913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2012-05-08 14:30 - 2012-03-30 19:10 - 3146240 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-05-08 14:30 - 2012-03-02 22:35 - 1544704 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll 2012-05-08 14:30 - 2012-03-02 21:31 - 1077248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2012-05-08 14:29 - 2012-03-30 03:35 - 1918320 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2012-05-08 14:29 - 2012-03-16 23:58 - 0075120 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\partmgr.sys 2012-05-08 14:19 - 2012-05-08 14:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{01A4EB52-DA45-4B30-B16E-12BB1191C27B} 2012-05-08 14:18 - 2012-05-08 14:19 - 0000000 ____D C:\Users\Owner\AppData\Local\{8AA9E231-2B15-4E2E-ADA5-42122FC13AE8} 2012-05-07 13:58 - 2012-05-07 13:59 - 0000000 ____D C:\Users\Owner\AppData\Local\{D503EE95-0274-4BBA-B97C-F4E1A3F75AD9} 2012-05-07 13:57 - 2012-05-07 13:58 - 0000000 ____D C:\Users\Owner\AppData\Local\{A276E77A-DB8D-4031-B8ED-8D6E525BCDE5} 2012-05-07 13:56 - 2012-05-07 13:57 - 0000000 ____D C:\Users\Owner\AppData\Local\{27FB111B-A826-4FFF-9B47-704018E101AC} 2012-05-07 13:55 - 2012-05-07 13:56 - 0000000 ____D C:\Users\Owner\AppData\Local\{E28C110C-EC92-45DF-8137-AC2E70D67F87} 2012-05-06 17:45 - 2012-05-06 17:45 - 0000000 ____D C:\Users\Owner\AppData\Local\{9C28CC72-41D2-47E6-89F4-9A8EDE228062} 2012-05-06 05:43 - 2012-05-06 17:45 - 0000000 ____D C:\Users\Owner\AppData\Local\{681C69B9-4CAA-4D07-8AC7-A7863A1677EF} 2012-05-06 05:43 - 2012-05-06 05:44 - 0000000 ____D C:\Users\Owner\AppData\Local\{1420201D-3B63-4CC5-A3B1-3DDFC9936C3C} 2012-05-05 05:17 - 2012-05-05 05:18 - 0000000 ____D C:\Users\Owner\AppData\Local\{C27DD495-97E9-439B-B6F9-78A25993A441} 2012-05-05 05:16 - 2012-05-05 05:17 - 0000000 ____D C:\Users\Owner\AppData\Local\{B5BC95DB-7F5E-4276-A817-1264F16BC799} 2012-05-04 13:58 - 2012-05-04 13:58 - 8769696 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe 2012-05-04 13:58 - 2012-05-04 13:58 - 0000000 ____D C:\Windows\System32\Macromed 2012-05-04 11:43 - 2012-05-04 11:43 - 0000000 ____D C:\Users\Owner\AppData\Local\{C855599C-078B-43D8-A68B-54A1888ACA89} 2012-05-04 11:42 - 2012-05-04 11:43 - 0000000 ____D C:\Users\Owner\AppData\Local\{ECF1B774-0E72-475A-B14A-08278482408B} 2012-05-03 12:16 - 2012-05-03 12:17 - 0000000 ____D C:\Users\Owner\AppData\Local\{9798BC2A-5501-4056-B91F-1C4B6C0D4EAD} 2012-05-03 12:15 - 2012-05-03 12:16 - 0000000 ____D C:\Users\Owner\AppData\Local\{26F57F6E-40E7-4A1C-8AA0-F5B927B1FF5A} 2012-05-02 16:19 - 2012-05-02 16:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{BBC7DD86-F35E-44E8-9670-299CF8A2491A} 2012-05-02 04:18 - 2012-05-02 04:18 - 0000000 ____D C:\Users\Owner\AppData\Local\{158D7B64-D85F-47E6-ADDE-E241C2460D6D} 2012-05-02 04:17 - 2012-05-02 16:19 - 0000000 ____D C:\Users\Owner\AppData\Local\{BF5034D4-97DB-43D5-87AE-CA74300B0F5D} 2012-05-01 13:25 - 2012-05-01 13:26 - 0000000 ____D C:\Users\Owner\AppData\Local\{10A68C43-3142-4479-B821-EF8C741B1D8F} 2012-05-01 13:25 - 2012-05-01 13:25 - 0000000 ____D C:\Users\Owner\AppData\Local\{5A85EB40-00D6-42F6-A2E6-6CBC72FD583E} 2012-04-30 19:21 - 2012-04-30 19:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{FA59E7C8-D4DA-43AB-89D7-1ECA63B0CC78} 2012-04-30 07:19 - 2012-04-30 07:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{90811DD1-F1EF-4BF7-9735-03D7493F5046} 2012-04-30 07:18 - 2012-04-30 19:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{31B6B59B-1020-451C-94ED-B4BF90D2C1CC} 2012-04-29 19:00 - 2012-04-29 19:01 - 0000000 ____D C:\Users\Owner\AppData\Local\{0F1B5D35-25E0-40E9-A2B7-1E0F79126DEB} 2012-04-29 06:58 - 2012-04-29 06:59 - 0000000 ____D C:\Users\Owner\AppData\Local\{9B16F3A5-18B4-42DA-8BB6-06441DF26E60} 2012-04-29 06:57 - 2012-04-29 19:00 - 0000000 ____D C:\Users\Owner\AppData\Local\{4B0D91B5-C694-4345-83B5-4BD28D987080} 2012-04-28 17:55 - 2012-04-28 17:56 - 0000000 ____D C:\Users\Owner\AppData\Local\{D4B7EDA5-C928-4961-B787-5BA1EE9624AF} 2012-04-28 05:53 - 2012-04-28 05:54 - 0000000 ____D C:\Users\Owner\AppData\Local\{B88B196F-004C-455D-BE1C-2D188B738470} 2012-04-28 05:52 - 2012-04-28 17:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{BEF14823-98AB-4207-9798-558990132BB5} 2012-04-27 10:46 - 2012-04-27 10:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{83D32099-3D9C-4E3E-B35D-4B7B7695FCB5} 2012-04-27 10:46 - 2012-04-27 10:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{CCC73218-D42C-454C-9A4A-B2A381A260A1} 2012-04-27 09:31 - 2012-04-27 09:29 - 0729088 ____A (Indigo Rose Corporation) C:\Windows\iun6002.exe 2012-04-27 09:29 - 2012-04-27 09:31 - 0024984 ____A C:\Windows\DesertCombat Setup Log.txt ============ 3 Months Modified Files and Folders ============= 2012-05-27 12:02 - 2012-05-27 12:01 - 0000000 ____D C:\FRST 2012-05-27 07:55 - 2010-05-18 12:04 - 1082633 ____A C:\Windows\WindowsUpdate.log 2012-05-27 07:55 - 2009-07-13 20:45 - 0015792 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2012-05-27 07:55 - 2009-07-13 20:45 - 0015792 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2012-05-27 07:49 - 2010-07-05 18:55 - 0000892 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2012-05-27 07:49 - 2010-07-05 17:43 - 0000000 ____D C:\Users\Owner\Tracing 2012-05-27 07:49 - 2010-01-15 09:08 - 329166848 __ASH C:\hiberfil.sys 2012-05-27 07:49 - 2009-07-13 21:08 - 0000006 ___AH C:\Windows\Tasks\SA.DAT 2012-05-27 07:49 - 2009-07-13 20:51 - 0074678 ____A C:\Windows\setupact.log 2012-05-27 07:41 - 2010-07-05 16:43 - 0000000 ____D C:\Program Files\Lx_cats 2012-05-27 07:36 - 2012-05-27 07:36 - 1394807 ____A C:\Users\Owner\Downloads\FRST64.exe 2012-05-27 07:27 - 2010-07-05 18:55 - 0000896 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2012-05-27 07:19 - 2010-07-05 18:14 - 0000908 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2576837967-3080261544-2192606049-1000UA.job 2012-05-27 07:09 - 2010-07-13 13:18 - 0000000 ____D C:\Users\Owner\AppData\Local\CrashDumps 2012-05-26 20:58 - 2012-04-23 07:34 - 0000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2012-05-26 20:56 - 2012-05-26 20:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{CA7BA3C1-2940-4D4D-AB89-CC78A248FCBA} 2012-05-26 20:56 - 2010-11-10 14:58 - 0000000 ____D C:\Users\Owner\AppData\Local\Windows Live 2012-05-26 20:55 - 2012-05-26 20:54 - 0000000 ____D C:\Users\Owner\AppData\Local\{1F123B51-4116-4BBF-A393-E509587094D6} 2012-05-26 20:51 - 2010-07-05 17:56 - 0480048 ____A C:\Windows\PFRO.log 2012-05-26 16:33 - 2010-06-28 06:46 - 0118032 ____A C:\Users\Owner\AppData\Local\GDIPFONTCACHEV1.DAT 2012-05-26 16:31 - 2009-07-13 20:45 - 0435304 ____A C:\Windows\System32\FNTCACHE.DAT 2012-05-26 15:59 - 2012-05-26 15:59 - 0009793 ____A C:\Users\Owner\Downloads\Attach.txt 2012-05-26 15:53 - 2012-05-20 09:54 - 0016091 ____A C:\Users\Owner\AppData\Roaming\eula 2012-05-26 15:52 - 2005-04-07 18:16 - 0027263 ___AH C:\Users\Owner\AppData\Roaming\Ownerv1.18.0 - Trial versionlog.dat 2012-05-26 14:59 - 2012-05-26 14:59 - 0029965 ____A C:\Users\Owner\Desktop\DDS.txt 2012-05-26 14:58 - 2012-05-26 14:58 - 0008596 ____A C:\Users\Owner\Desktop\Attach.txt 2012-05-26 14:40 - 2012-05-26 14:40 - 0607260 ____R (Swearware) C:\Users\Owner\Desktop\dds.com 2012-05-26 14:16 - 2012-05-26 14:16 - 0017204 ____A C:\Users\Owner\Documents\HECE display bd.docx 2012-05-26 10:19 - 2010-07-05 18:14 - 0000856 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2576837967-3080261544-2192606049-1000Core.job 2012-05-26 08:58 - 2009-07-13 21:13 - 0726444 ____A C:\Windows\System32\PerfStringBackup.INI 2012-05-26 07:27 - 2012-05-26 07:26 - 0000000 ____D C:\Users\Owner\AppData\Local\{6E2E7121-A799-4A1B-907A-1A1FBABBC2D8} 2012-05-26 07:26 - 2012-05-26 07:25 - 0000000 ____D C:\Users\Owner\AppData\Local\{3229585E-7463-4240-907B-AB1AF0A5C25C} 2012-05-26 00:13 - 2011-10-18 14:23 - 0000000 ____D C:\Users\Owner\AppData\Local\Facebook 2012-05-25 21:10 - 2010-01-15 09:17 - 0000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2012-05-25 20:50 - 2010-01-15 09:20 - 0000000 ____D C:\Windows\SysWOW64\Macromed 2012-05-25 20:32 - 2012-05-25 20:32 - 0000043 ____A C:\Users\Owner\AppData\Roaming\mbam.context.scan 2012-05-25 20:30 - 2010-06-28 06:32 - 0000000 ____D C:\users\Owner 2012-05-25 17:44 - 2012-05-25 17:44 - 0000000 ____D C:\Users\Owner\AppData\Roaming\ATI 2012-05-25 17:36 - 2012-05-25 17:36 - 0000977 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2012-05-25 17:36 - 2012-05-25 17:36 - 0000000 ____D C:\Users\Owner\AppData\Roaming\Malwarebytes 2012-05-25 17:36 - 2012-05-25 17:36 - 0000000 ____D C:\Users\All Users\Malwarebytes 2012-05-25 17:36 - 2012-05-25 17:36 - 0000000 ____D C:\Program Files (x86)\Malwarebytes 2012-05-25 16:58 - 2012-05-25 16:58 - 0000046 __ASH C:\Users\Owner\AppData\Roaming\desktop.ini 2012-05-25 16:29 - 2011-09-22 12:47 - 0000332 ____A C:\Windows\Tasks\HPCeeScheduleForOwner.job 2012-05-25 16:12 - 2012-05-25 16:11 - 0000000 ____D C:\Users\Owner\AppData\Local\{A16619BA-9FD7-4AFC-BE27-426894FCA576} 2012-05-25 16:11 - 2012-05-23 18:06 - 0000000 ____D C:\Users\Owner\AppData\Local\{333F0C07-5446-46ED-B3F7-F043806335AA} 2012-05-25 04:11 - 2012-05-25 04:10 - 0000000 ____D C:\Users\Owner\AppData\Local\{96B10ABF-B3A7-438C-B149-E4A64491E4FC} 2012-05-24 12:31 - 2011-11-03 14:48 - 0000000 ____A C:\Windows\System32\HP_ActiveX_Patch_NOT_DETECTED.txt 2012-05-24 12:31 - 2010-07-13 13:19 - 0000052 ____A C:\Windows\SysWOW64\DOErrors.log 2012-05-24 12:28 - 2010-07-13 11:56 - 0000000 ____D C:\Users\Owner\AppData\Roaming\HP Support Assistant 2012-05-24 12:28 - 2010-06-28 07:32 - 0000000 ____D C:\Users\Owner\AppData\Roaming\HpUpdate 2012-05-24 12:05 - 2012-05-24 12:04 - 0000000 ____D C:\Users\Owner\AppData\Local\{F0A0AAAD-EAC5-4DBB-AF34-72738260429C} 2012-05-24 04:33 - 2012-05-24 04:33 - 10063000 ____A (Malwarebytes Corporation ) C:\Users\Owner\Downloads\mbam-setup-1.61.0.1400.exe 2012-05-23 18:08 - 2010-07-05 18:15 - 0002405 ____A C:\Users\Owner\Desktop\Google Chrome.lnk 2012-05-23 18:07 - 2012-05-23 18:07 - 0000000 ____D C:\Users\Owner\AppData\Local\{A0D6887F-EC36-4C22-A24B-554E978B9504} 2012-05-23 04:47 - 2012-05-23 04:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{1A721035-5E6E-4995-BB68-48F2C435C296} 2012-05-23 04:46 - 2012-05-23 04:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{6EAC46D0-98FF-4621-AC8A-2B19168CB7B3} 2012-05-23 04:46 - 2011-04-09 21:35 - 0000000 ____D C:\Users\Owner\.gimp-2.6 2012-05-22 14:22 - 2012-05-22 14:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{51741675-CC3E-4134-B3E5-E0DB18B415C7} 2012-05-22 14:22 - 2012-05-22 14:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{A7283106-A29B-4541-ACDF-B5FBBEE96A2C} 2012-05-21 18:57 - 2012-05-21 18:56 - 0000000 ____D C:\Users\Owner\AppData\Local\{7F468C43-C501-4D26-BE51-5B29E249EEA2} 2012-05-21 18:56 - 2012-05-21 06:54 - 0000000 ____D C:\Users\Owner\AppData\Local\{A335B211-5833-4881-A97D-DB524A38C858} 2012-05-21 06:55 - 2012-05-21 06:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{BDC7CEF4-8F5B-4CC4-8BD1-48D9924EE5ED} 2012-05-20 11:37 - 2012-05-20 11:36 - 0000000 ____D C:\Users\Owner\AppData\Local\{52682771-FD39-44CC-9A25-4FE95E6BE3FA} 2012-05-20 11:36 - 2012-05-19 11:32 - 0000000 ____D C:\Users\Owner\AppData\Local\{8907D52C-221B-4354-8E6A-55020B9286FF} 2012-05-20 09:06 - 2010-07-05 17:41 - 0348537 ____A C:\Windows\DirectX.log 2012-05-19 23:35 - 2012-05-19 23:34 - 0000000 ____D C:\Users\Owner\AppData\Local\{BBBF8D59-16C3-461F-849F-C2EB8C0BA9FB} 2012-05-19 11:33 - 2012-05-19 11:32 - 0000000 ____D C:\Users\Owner\AppData\Local\{796617AD-548A-44A1-B1D7-1A5601B2862F} 2012-05-18 18:22 - 2012-05-18 18:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{8BDBDB1D-1281-4362-9E6A-26B29C3BC765} 2012-05-18 18:21 - 2012-05-17 04:30 - 0000000 ____D C:\Users\Owner\AppData\Local\{20C178A5-7473-4E6E-93C4-695F0C54AD13} 2012-05-18 08:47 - 2012-05-18 08:46 - 0000000 ____D C:\Program Files (x86)\QuickTime 2012-05-18 08:46 - 2012-05-18 08:46 - 0001807 ____A C:\Users\Public\Desktop\QuickTime Player.lnk 2012-05-18 06:21 - 2012-05-18 06:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{4D89976A-F07B-4395-926C-ECDB94467AC4} 2012-05-17 16:31 - 2012-05-17 16:31 - 0000000 ____D C:\Users\Owner\AppData\Local\{22FEDF3C-F9A9-462F-9B84-A84D84C4629C} 2012-05-16 04:18 - 2012-05-16 04:17 - 0000000 ____D C:\Users\Owner\AppData\Local\{5A0563F5-2A65-488F-8891-8C5D95513867} 2012-05-16 04:17 - 2012-05-15 04:13 - 0000000 ____D C:\Users\Owner\AppData\Local\{AC8BB4B5-2B9E-48C8-AC88-C54D4F289830} 2012-05-15 16:16 - 2012-05-15 16:15 - 0000000 ____D C:\Users\Owner\AppData\Local\{656DF0C2-2A99-4EDE-B174-5AE0A48412E5} 2012-05-15 04:14 - 2012-05-15 04:13 - 0000000 ____D C:\Users\Owner\AppData\Local\{54434F25-6021-40D8-9D1E-2063AE7AACDF} 2012-05-14 14:17 - 2010-11-02 12:51 - 0000000 ____D C:\Users\Owner\AppData\Roaming\gtk-2.0 2012-05-14 10:40 - 2012-05-14 10:39 - 0000000 ____D C:\Users\Owner\AppData\Local\{EF507E18-EA04-43BB-B420-F6F3F6ACA87D} 2012-05-14 10:38 - 2012-05-14 10:38 - 0000000 ____D C:\Users\Owner\AppData\Local\{194EF547-91F3-46F2-AFE0-F9792660BB19} 2012-05-14 10:38 - 2012-05-14 10:37 - 0000000 ____D C:\Users\Owner\AppData\Local\{6592740A-A3EB-4004-975D-B3CF7ED014CE} 2012-05-13 18:36 - 2012-05-13 18:36 - 0000000 ____D C:\Users\Owner\AppData\Local\{9B2393BD-772E-4BFB-82DE-7E9B07F7D5BF} 2012-05-13 18:36 - 2012-05-13 06:33 - 0000000 ____D C:\Users\Owner\AppData\Local\{7BE93690-369F-499A-B5E8-9E1A46972C81} 2012-05-13 06:35 - 2012-05-13 06:34 - 0000000 ____D C:\Users\Owner\AppData\Local\{DD84F3D7-8F40-47DE-BA4A-DB1B10C180F4} 2012-05-12 18:58 - 2012-05-12 18:58 - 0000000 ____D C:\Users\Owner\AppData\Local\{BE433D65-56DC-4C5C-8B7F-1A44117E3308} 2012-05-12 18:58 - 2010-06-28 06:32 - 0000000 ____D C:\Users\Owner\AppData\LocalLow 2012-05-12 05:44 - 2012-05-12 05:43 - 0000000 ____D C:\Users\Owner\AppData\Local\{680A9BD5-4110-4D8E-876A-4648FFE5C538} 2012-05-12 05:43 - 2012-05-12 05:42 - 0000000 ____D C:\Users\Owner\AppData\Local\{9B511AFE-4911-4C83-B322-1E9093A9D2FA} 2012-05-11 04:23 - 2012-05-11 04:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{C1480271-2654-4211-A2B3-EE10CA2B499B} 2012-05-11 04:22 - 2012-05-11 04:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{BF9C64D0-4504-489A-875E-726F22FF4F87} 2012-05-10 16:21 - 2012-05-10 16:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{1E51CF83-BCB5-49F0-A2D3-4B7E98D0383E} 2012-05-10 16:20 - 2012-05-10 04:18 - 0000000 ____D C:\Users\Owner\AppData\Local\{698B53B9-B861-4AD4-8A05-43C99C38B1F1} 2012-05-10 04:20 - 2012-05-10 04:19 - 0000000 ____D C:\Users\Owner\AppData\Local\{356CF653-B38B-4F20-9035-BD7C9D9DD750} 2012-05-09 14:53 - 2012-05-09 14:52 - 0000000 ____D C:\Users\Owner\AppData\Local\{EF7E5DCC-D10F-4451-9524-E4D301A501B7} 2012-05-09 14:52 - 2012-05-09 14:52 - 0000000 ____D C:\Users\Owner\AppData\Local\{59997081-E68D-4F2C-B730-2BDA68206DDB} 2012-05-08 19:13 - 2010-06-28 08:32 - 0000000 ____D C:\Users\All Users\Microsoft Help 2012-05-08 19:13 - 2010-06-28 07:13 - 57848688 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2012-05-08 19:03 - 2010-01-15 09:43 - 0000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2012-05-08 19:02 - 2009-07-13 23:45 - 0000000 ____D C:\Program Files\Windows Journal 2012-05-08 14:20 - 2012-05-08 14:19 - 0000000 ____D C:\Users\Owner\AppData\Local\{01A4EB52-DA45-4B30-B16E-12BB1191C27B} 2012-05-08 14:19 - 2012-05-08 14:18 - 0000000 ____D C:\Users\Owner\AppData\Local\{8AA9E231-2B15-4E2E-ADA5-42122FC13AE8} 2012-05-07 13:59 - 2012-05-07 13:58 - 0000000 ____D C:\Users\Owner\AppData\Local\{D503EE95-0274-4BBA-B97C-F4E1A3F75AD9} 2012-05-07 13:58 - 2012-05-07 13:57 - 0000000 ____D C:\Users\Owner\AppData\Local\{A276E77A-DB8D-4031-B8ED-8D6E525BCDE5} 2012-05-07 13:57 - 2012-05-07 13:56 - 0000000 ____D C:\Users\Owner\AppData\Local\{27FB111B-A826-4FFF-9B47-704018E101AC} 2012-05-07 13:56 - 2012-05-07 13:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{E28C110C-EC92-45DF-8137-AC2E70D67F87} 2012-05-06 17:45 - 2012-05-06 17:45 - 0000000 ____D C:\Users\Owner\AppData\Local\{9C28CC72-41D2-47E6-89F4-9A8EDE228062} 2012-05-06 17:45 - 2012-05-06 05:43 - 0000000 ____D C:\Users\Owner\AppData\Local\{681C69B9-4CAA-4D07-8AC7-A7863A1677EF} 2012-05-06 13:47 - 2010-07-07 19:22 - 0000000 ____D C:\Users\Owner\AppData\Local\ElevatedDiagnostics 2012-05-06 05:44 - 2012-05-06 05:43 - 0000000 ____D C:\Users\Owner\AppData\Local\{1420201D-3B63-4CC5-A3B1-3DDFC9936C3C} 2012-05-05 05:18 - 2012-05-05 05:17 - 0000000 ____D C:\Users\Owner\AppData\Local\{C27DD495-97E9-439B-B6F9-78A25993A441} 2012-05-05 05:17 - 2012-05-05 05:16 - 0000000 ____D C:\Users\Owner\AppData\Local\{B5BC95DB-7F5E-4276-A817-1264F16BC799} 2012-05-04 13:58 - 2012-05-04 13:58 - 8769696 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe 2012-05-04 13:58 - 2012-05-04 13:58 - 0000000 ____D C:\Windows\System32\Macromed 2012-05-04 13:58 - 2012-04-23 07:34 - 0419488 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2012-05-04 13:58 - 2011-08-12 08:48 - 0070304 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2012-05-04 11:43 - 2012-05-04 11:43 - 0000000 ____D C:\Users\Owner\AppData\Local\{C855599C-078B-43D8-A68B-54A1888ACA89} 2012-05-04 11:43 - 2012-05-04 11:42 - 0000000 ____D C:\Users\Owner\AppData\Local\{ECF1B774-0E72-475A-B14A-08278482408B} 2012-05-03 12:17 - 2012-05-03 12:16 - 0000000 ____D C:\Users\Owner\AppData\Local\{9798BC2A-5501-4056-B91F-1C4B6C0D4EAD} 2012-05-03 12:16 - 2012-05-03 12:15 - 0000000 ____D C:\Users\Owner\AppData\Local\{26F57F6E-40E7-4A1C-8AA0-F5B927B1FF5A} 2012-05-02 16:20 - 2012-05-02 16:19 - 0000000 ____D C:\Users\Owner\AppData\Local\{BBC7DD86-F35E-44E8-9670-299CF8A2491A} 2012-05-02 16:19 - 2012-05-02 04:17 - 0000000 ____D C:\Users\Owner\AppData\Local\{BF5034D4-97DB-43D5-87AE-CA74300B0F5D} 2012-05-02 14:22 - 2011-10-28 15:25 - 0000000 ____D C:\Users\All Users\Freemake 2012-05-02 14:20 - 2011-10-28 15:25 - 0001286 ____A C:\Users\Public\Desktop\Freemake Video Converter.lnk 2012-05-02 04:18 - 2012-05-02 04:18 - 0000000 ____D C:\Users\Owner\AppData\Local\{158D7B64-D85F-47E6-ADDE-E241C2460D6D} 2012-05-01 13:26 - 2012-05-01 13:25 - 0000000 ____D C:\Users\Owner\AppData\Local\{10A68C43-3142-4479-B821-EF8C741B1D8F} 2012-05-01 13:25 - 2012-05-01 13:25 - 0000000 ____D C:\Users\Owner\AppData\Local\{5A85EB40-00D6-42F6-A2E6-6CBC72FD583E} 2012-04-30 19:22 - 2012-04-30 19:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{FA59E7C8-D4DA-43AB-89D7-1ECA63B0CC78} 2012-04-30 19:21 - 2012-04-30 07:18 - 0000000 ____D C:\Users\Owner\AppData\Local\{31B6B59B-1020-451C-94ED-B4BF90D2C1CC} 2012-04-30 07:20 - 2012-04-30 07:19 - 0000000 ____D C:\Users\Owner\AppData\Local\{90811DD1-F1EF-4BF7-9735-03D7493F5046} 2012-04-29 19:01 - 2012-04-29 19:00 - 0000000 ____D C:\Users\Owner\AppData\Local\{0F1B5D35-25E0-40E9-A2B7-1E0F79126DEB} 2012-04-29 19:00 - 2012-04-29 06:57 - 0000000 ____D C:\Users\Owner\AppData\Local\{4B0D91B5-C694-4345-83B5-4BD28D987080} 2012-04-29 06:59 - 2012-04-29 06:58 - 0000000 ____D C:\Users\Owner\AppData\Local\{9B16F3A5-18B4-42DA-8BB6-06441DF26E60} 2012-04-28 17:56 - 2012-04-28 17:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{D4B7EDA5-C928-4961-B787-5BA1EE9624AF} 2012-04-28 17:55 - 2012-04-28 05:52 - 0000000 ____D C:\Users\Owner\AppData\Local\{BEF14823-98AB-4207-9798-558990132BB5} 2012-04-28 13:36 - 2012-04-20 14:39 - 0003580 ____A C:\Windows\wininit.ini 2012-04-28 13:36 - 2012-04-20 14:39 - 0003529 ____A C:\Windows\wininit.tmp 2012-04-28 05:54 - 2012-04-28 05:53 - 0000000 ____D C:\Users\Owner\AppData\Local\{B88B196F-004C-455D-BE1C-2D188B738470} 2012-04-27 10:47 - 2012-04-27 10:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{83D32099-3D9C-4E3E-B35D-4B7B7695FCB5} 2012-04-27 10:46 - 2012-04-27 10:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{CCC73218-D42C-454C-9A4A-B2A381A260A1} 2012-04-27 09:31 - 2012-04-27 09:29 - 0024984 ____A C:\Windows\DesertCombat Setup Log.txt 2012-04-27 09:29 - 2012-04-27 09:31 - 0729088 ____A (Indigo Rose Corporation) C:\Windows\iun6002.exe 2012-04-26 19:08 - 2012-04-26 19:07 - 0000000 ____D C:\Users\Owner\AppData\Local\{4EFB5378-DB3C-458A-AA8C-E2CE56FB9EB1} 2012-04-26 19:07 - 2012-04-26 19:06 - 0000000 ____D C:\Users\Owner\AppData\Local\{8EEE560C-8F2C-4EEA-929D-6498A608DA5C} 2012-04-26 07:06 - 2012-04-26 07:05 - 0000000 ____D C:\Users\Owner\AppData\Local\{AF08F2CA-6991-405B-938C-B3A208C112C9} 2012-04-26 07:05 - 2012-04-26 07:04 - 0000000 ____D C:\Users\Owner\AppData\Local\{A038846A-F674-470D-A4E2-6A04CAC62E2E} 2012-04-25 14:41 - 2012-04-25 14:41 - 0000000 ____D C:\Users\Owner\AppData\Local\{8000D9CE-B5C5-4A11-BE74-CF18832716B7} 2012-04-23 07:35 - 2012-04-23 07:34 - 0000000 ____D C:\Users\Owner\AppData\Local\{18ADE4C6-8340-4E07-AC3E-B5810AECC0C6} 2012-04-23 07:34 - 2012-04-23 07:34 - 0000000 ____D C:\Users\Owner\AppData\Local\{D2D21EDE-4B26-44A7-8DD4-870963AF01E4} 2012-04-22 17:01 - 2010-07-05 18:59 - 0000000 ____D C:\Users\Owner\AppData\Roaming\Skype 2012-04-22 07:12 - 2012-04-22 07:12 - 0000000 ____D C:\Users\Owner\AppData\Local\{2D416039-9219-4066-B80A-E9A9A9D27BBC} 2012-04-22 07:12 - 2012-04-22 07:11 - 0000000 ____D C:\Users\Owner\AppData\Local\{74802FD5-0714-443C-9F4C-90D08C4B7378} 2012-04-21 11:15 - 2012-04-21 11:15 - 0000000 ____D C:\Users\Owner\AppData\Local\{7090D591-1BAD-4F9F-8EC5-F6E98C5DCBC7} 2012-04-21 11:14 - 2012-04-21 11:14 - 0000000 ____D C:\Users\Owner\AppData\Local\{6ED2112C-8134-4BC7-B109-4A54A611AB69} 2012-04-21 11:05 - 2012-04-21 11:05 - 0000000 ____D C:\Users\Owner\AppData\Local\{CB231218-566B-48E1-AD75-DD55E97A741A} 2012-04-21 11:05 - 2012-04-21 11:04 - 0000000 ____D C:\Users\Owner\AppData\Local\{03FB880E-FC12-43B9-866D-018A7A1645BF} 2012-04-21 07:33 - 2012-04-21 07:33 - 0000000 ____D C:\Windows\en 2012-04-21 07:31 - 2012-04-21 07:31 - 0000000 ____D C:\Program Files\Windows Live 2012-04-21 07:31 - 2010-01-15 09:44 - 0000000 ____D C:\Program Files (x86)\Windows Live 2012-04-21 07:27 - 2012-04-21 07:27 - 0000000 ____D C:\Users\Owner\AppData\Local\{0CCEFC26-4477-45BE-8E3A-86605012B081} 2012-04-21 07:27 - 2012-04-21 07:26 - 0000000 ____D C:\Users\Owner\AppData\Local\{99D898E5-B8D8-43F4-A6F7-CE32B8CB7C39} 2012-04-20 12:46 - 2011-04-22 12:14 - 0000943 ____A C:\Windows\eReg.dat 2012-04-19 12:11 - 2012-04-19 12:10 - 0000000 ____D C:\Users\Owner\AppData\Local\{E0DBAEF4-8563-48A7-921D-0233F36960D8} 2012-04-19 12:10 - 2012-04-19 12:09 - 0000000 ____D C:\Users\Owner\AppData\Local\{63E30B3B-3BFF-4717-8ED6-002E81B1BF79} 2012-04-19 11:53 - 2012-04-19 11:53 - 0000000 ____D C:\Users\Owner\AppData\Local\{C62963A9-3462-4253-86FD-D1F177BDCD49} 2012-04-19 11:53 - 2012-04-19 11:52 - 0000000 ____D C:\Users\Owner\AppData\Local\{5A8363CB-8B69-4063-B09F-45B1FF6222FB} 2012-04-19 07:18 - 2012-04-19 07:18 - 0000000 ____D C:\Users\Owner\AppData\Local\{C45BAD27-5313-43E8-B984-3DCBFFAAB073} 2012-04-19 07:18 - 2012-04-19 07:17 - 0000000 ____D C:\Users\Owner\AppData\Local\{6CA4122A-D8B3-4934-A3FB-DC47AE336D27} 2012-04-19 07:14 - 2012-04-19 07:13 - 0000000 ____D C:\Users\Owner\AppData\Local\{90392220-B974-4A4B-9720-1608CAA225F5} 2012-04-19 07:13 - 2012-04-19 07:13 - 0000000 ____D C:\Users\Owner\AppData\Local\{3E1D738C-6132-4118-A00D-38E2FD944166} 2012-04-19 07:03 - 2012-04-19 07:02 - 0000000 ____D C:\Users\Owner\AppData\Local\{118A884B-84E0-4A7A-AE6B-8AE49F71F70A} 2012-04-19 07:02 - 2012-04-19 07:01 - 0000000 ____D C:\Users\Owner\AppData\Local\{D68D8026-EA10-4624-BAD9-19773AEE5EE3} 2012-04-19 04:16 - 2012-04-19 04:15 - 0000000 ____D C:\Users\Owner\AppData\Local\{4B7D9475-E612-447A-A3ED-4C30B7649CA7} 2012-04-19 04:15 - 2012-04-19 04:14 - 0000000 ____D C:\Users\Owner\AppData\Local\{666BF968-42AC-40E5-BEF1-B65A788ABC8E} 2012-04-18 16:56 - 2012-04-18 16:56 - 0094208 ____A (Apple Inc.) C:\Windows\SysWOW64\QuickTimeVR.qtx 2012-04-18 16:56 - 2012-04-18 16:56 - 0069632 ____A (Apple Inc.) C:\Windows\SysWOW64\QuickTime.qts 2012-04-18 16:39 - 2012-04-18 16:39 - 0000000 ____D C:\Users\Owner\AppData\Local\{949D611C-0867-4FF7-9D34-09C4E2374105} 2012-04-18 16:39 - 2012-04-18 16:38 - 0000000 ____D C:\Users\Owner\AppData\Local\{64CD6B1A-E05B-48EB-B92A-C3B550A404F8} 2012-04-17 10:11 - 2012-04-17 10:11 - 0000000 ____D C:\Users\Owner\AppData\Local\{D4FBCE03-0081-4431-812E-8C6D4E3D01E8} 2012-04-17 10:11 - 2012-04-17 10:10 - 0000000 ____D C:\Users\Owner\AppData\Local\{4FF117C5-6539-4A1F-8D2E-1200D41DE67A} 2012-04-17 04:27 - 2012-04-17 04:27 - 0000000 ____D C:\Users\Owner\AppData\Local\{595DD4AD-21AE-4F53-B7AE-0278093438F4} 2012-04-17 04:27 - 2012-04-17 04:26 - 0000000 ____D C:\Users\Owner\AppData\Local\{56CE9030-1E2B-4672-B475-78E65C1DE80F} 2012-04-16 17:25 - 2012-04-16 17:25 - 0000000 ____D C:\Users\Owner\AppData\Local\{748567E5-1E4A-49CE-970C-E0DCBACF49BA} 2012-04-16 17:25 - 2012-04-16 17:24 - 0000000 ____D C:\Users\Owner\AppData\Local\{B4EC8A63-BBA8-44C6-A9AF-62CBEDDC66B6} 2012-04-15 07:25 - 2012-04-15 07:24 - 0000000 ____D C:\Users\Owner\AppData\Local\{6D46337F-7B98-46A9-9540-E4F26B8EDCE1} 2012-04-15 07:24 - 2012-04-15 07:23 - 0000000 ____D C:\Users\Owner\AppData\Local\{E1A91476-2DB2-45B8-A1E8-4E1E7F023926} 2012-04-15 07:23 - 2012-04-15 07:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{D76C637C-292D-426B-9596-EB162895B19D} 2012-04-15 07:22 - 2012-04-15 07:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{5BB9C863-3300-4F54-A5D8-F83503D871DC} 2012-04-14 09:09 - 2012-04-14 09:08 - 0000000 ____D C:\Users\Owner\AppData\Local\{9677364A-0627-46C4-9859-74BF2555B030} 2012-04-14 09:08 - 2012-04-14 09:07 - 0000000 ____D C:\Users\Owner\AppData\Local\{F2009087-FEAB-4260-B08E-781011745897} 2012-04-14 06:47 - 2012-04-14 06:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{E593A2AB-92BF-4FF4-AB63-4792BAA3AAAF} 2012-04-14 06:46 - 2012-04-14 06:45 - 0000000 ____D C:\Users\Owner\AppData\Local\{2991FF6C-E565-4435-93DF-04BC4E11FEAB} 2012-04-13 09:09 - 2012-04-13 09:09 - 0000000 ____D C:\Users\Owner\AppData\Local\{7E579A73-1FD6-4DD9-B300-39552C7183A5} 2012-04-13 09:09 - 2012-04-13 09:08 - 0000000 ____D C:\Users\Owner\AppData\Local\{C3DD2ED1-315E-4660-90F3-85F261F69A76} 2012-04-13 09:07 - 2012-04-13 09:07 - 0000000 ____D C:\Users\Owner\AppData\Local\{3877E239-2BBE-42D7-8644-60C42061BFCE} 2012-04-13 09:07 - 2012-04-13 09:06 - 0000000 ____D C:\Users\Owner\AppData\Local\{BF864A8E-964A-4047-A1F1-2A70D82C6A13} 2012-04-12 16:35 - 2012-04-12 04:33 - 0000000 ____D C:\Users\Owner\AppData\Local\{C8FC2381-AA2B-4AC3-8746-909996B4FC8F} 2012-04-12 15:41 - 2012-04-12 15:41 - 0001046 ____A C:\Users\Public\Desktop\RealPlayer.lnk 2012-04-12 15:41 - 2011-11-27 14:25 - 0198832 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll 2012-04-12 15:41 - 2010-11-23 14:22 - 0000000 ____D C:\Program Files (x86)\real 2012-04-12 15:40 - 2011-11-27 14:25 - 0272896 ____A (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll 2012-04-12 15:40 - 2011-11-27 14:25 - 0006656 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll 2012-04-12 15:40 - 2011-11-27 14:25 - 0005632 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll 2012-04-12 15:37 - 2012-04-12 15:37 - 0000000 ____D C:\Users\Owner\AppData\Roaming\RealNetworks 2012-04-12 15:19 - 2010-07-05 19:24 - 0000000 ____D C:\Users\Owner\AppData\Roaming\Real 2012-04-11 18:58 - 2009-07-13 18:34 - 0000478 ____A C:\Windows\win.ini 2012-04-11 16:33 - 2012-04-11 04:31 - 0000000 ____D C:\Users\Owner\AppData\Local\{C1CB8B93-0FA1-4CA1-914A-EF98A52AF11B} 2012-04-10 08:23 - 2012-04-09 20:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{5029912A-33D3-46B2-8BB4-2CA4F137012A} 2012-04-09 06:53 - 2012-04-09 06:53 - 0000000 ____D C:\Users\Owner\AppData\Local\{1C435188-A002-49D8-92A1-5E5E88F5C361} 2012-04-08 08:33 - 2012-04-08 08:33 - 0000000 ____D C:\Users\Owner\AppData\Local\{ACF58EB1-EE2D-4D45-B610-B8263D458BF9} 2012-04-08 07:49 - 2009-07-13 23:44 - 0000000 ___RD C:\Users\Public\Recorded TV 2012-04-07 20:27 - 2012-04-07 20:26 - 0000000 ____D C:\Users\Owner\AppData\Local\{59EAD285-C217-41D5-907A-7B8347D6DE68} 2012-04-07 08:26 - 2012-04-07 08:25 - 0000000 ____D C:\Users\Owner\AppData\Local\{DEED4696-3C5C-48D0-8619-FEDD20E24AA0} 2012-04-06 19:48 - 2012-04-06 19:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{5218D774-479A-417C-A3C6-7E33D957E294} 2012-04-06 07:43 - 2012-04-06 07:42 - 0000000 ____D C:\Users\Owner\AppData\Local\{002EC0E5-0655-48C9-9BC8-E0F060E7141D} 2012-04-05 10:04 - 2012-04-05 10:03 - 0000000 ____D C:\Users\Owner\AppData\Local\{77C293BE-DF2D-408F-8DA7-FFE638250D0E} 2012-04-05 05:49 - 2010-07-05 17:57 - 0000000 ____D C:\Windows\System32\Drivers\N360x64 2012-04-05 05:31 - 2012-04-05 05:31 - 0000000 ____D C:\Users\Owner\AppData\Local\{E710CD57-773D-44DD-8BBA-357B4847FA6C} 2012-04-05 05:30 - 2011-09-18 09:24 - 0002339 ____A C:\Users\Public\Desktop\Norton 360.lnk 2012-04-04 12:24 - 2012-04-03 14:14 - 0000000 ____D C:\Users\Owner\AppData\Local\{3B617419-6633-4B68-A906-0EA59F828CB7} 2012-04-04 11:56 - 2012-05-25 17:36 - 0024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2012-04-02 07:54 - 2012-04-02 07:53 - 0000000 ____D C:\Users\Owner\AppData\Local\{E58505F0-B26F-40E7-856A-7077D4A9DF72} 2012-04-01 07:11 - 2012-03-31 07:08 - 0000000 ____D C:\Users\Owner\AppData\Local\{AA9D8404-9943-4942-80AE-D85CEA02668E} 2012-03-30 22:05 - 2012-05-08 14:30 - 5559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2012-03-30 20:39 - 2012-05-08 14:30 - 3968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2012-03-30 20:39 - 2012-05-08 14:30 - 3913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2012-03-30 19:10 - 2012-05-08 14:30 - 3146240 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-03-30 17:49 - 2012-03-30 05:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{C87FA795-059F-4B54-AE29-F34E56951A6A} 2012-03-30 05:48 - 2012-03-30 05:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{475F1B2B-584F-44B5-A686-6AE0AEC571C6} 2012-03-30 03:35 - 2012-05-08 14:29 - 1918320 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2012-03-29 14:14 - 2012-03-29 14:14 - 0001745 ____A C:\Users\Public\Desktop\iTunes.lnk 2012-03-29 14:14 - 2012-03-29 14:13 - 0000000 ____D C:\Program Files\iTunes 2012-03-29 14:14 - 2012-03-14 12:34 - 0000000 ____D C:\Program Files (x86)\iTunes 2012-03-29 14:13 - 2012-03-29 14:13 - 0000000 ____D C:\Program Files\iPod 2012-03-29 13:19 - 2012-03-28 13:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{536365EE-FCF6-4291-A45B-0D2CF3935EF2} 2012-03-28 13:57 - 2012-03-28 13:56 - 0000000 ____D C:\Users\Owner\AppData\Local\{D9F59410-9748-40FC-888F-087EFB5CF7E8} 2012-03-27 12:50 - 2012-03-27 12:49 - 0000000 ____D C:\Users\Owner\AppData\Local\{F962FA6E-FDB9-458F-B0E2-BA1A37778992} 2012-03-27 12:49 - 2012-03-24 19:15 - 0000000 ____D C:\Users\Owner\AppData\Local\{3D26E03B-8897-4845-BE89-B260B6DE7AAC} 2012-03-27 00:48 - 2012-03-27 00:48 - 0000000 ____D C:\Users\Owner\AppData\Local\{B48D4395-70B4-414C-8738-E3C1AB25EBE3} 2012-03-26 12:47 - 2012-03-26 12:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{50488E0C-9069-48DF-9681-6C185C23F5ED} 2012-03-25 20:43 - 2012-03-25 20:42 - 0000000 ____D C:\Users\Owner\AppData\Local\{E9789298-A832-4515-A870-7B55FCE6B8FA} 2012-03-25 08:42 - 2012-03-25 08:41 - 0000000 ____D C:\Users\Owner\AppData\Local\{FEB18B68-50A9-441E-915B-0C906AB2E411} 2012-03-24 19:17 - 2012-03-24 19:16 - 0000000 ____D C:\Users\Owner\AppData\Local\{AF66FF31-609A-414D-8386-455259BBDCAC} 2012-03-24 07:15 - 2012-03-24 07:14 - 0000000 ____D C:\Users\Owner\AppData\Local\{538C1329-4C3D-4856-8E59-D74505C8AC8D} 2012-03-24 07:14 - 2012-03-24 07:13 - 0000000 ____D C:\Users\Owner\AppData\Local\{C28A2A3D-1FDD-4690-9D31-40A1FFB4121B} 2012-03-23 10:01 - 2012-03-23 10:00 - 0000000 ____D C:\Users\Owner\AppData\Local\{FE2F1538-9F90-49F4-9983-7B74BEF514D5} 2012-03-23 10:00 - 2012-03-23 09:59 - 0000000 ____D C:\Users\Owner\AppData\Local\{14022C7F-5B48-4E5F-9ED9-33BCFFB0BF53} 2012-03-22 08:34 - 2012-03-22 08:33 - 0000000 ____D C:\Users\Owner\AppData\Local\{98F40583-88BF-4CB1-969E-D236680CAFDA} 2012-03-22 08:33 - 2012-03-22 08:32 - 0000000 ____D C:\Users\Owner\AppData\Local\{AA20EEC8-667C-4CA3-BFF8-0C8EE246704F} 2012-03-21 11:59 - 2012-03-21 11:59 - 0000000 ____D C:\Users\Owner\AppData\Local\{3F1B6563-2730-462D-B593-86435EEB07E3} 2012-03-20 18:22 - 2012-03-20 18:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{57615908-DDFC-48C9-900C-38A4FAD1D81F} 2012-03-20 18:21 - 2012-03-20 18:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{9B312F82-1F58-4AEA-BF0D-EC62F1B95B2E} 2012-03-20 06:20 - 2012-03-20 06:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{C535818F-8562-4739-8220-5F742A5F4B4A} 2012-03-20 06:20 - 2012-03-20 06:19 - 0000000 ____D C:\Users\Owner\AppData\Local\{18D7A879-D0DC-4AD8-A3F8-1D9FCF4217BD} 2012-03-19 09:48 - 2012-03-19 09:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{AAB7F439-1449-48D3-B09B-A00553A3C3E8} 2012-03-19 09:47 - 2012-03-19 09:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{2EBF0328-3248-458C-AE97-9E26E148BD3A} 2012-03-19 09:47 - 2012-03-19 09:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{690567A5-248B-4F9E-84F1-EF31A1538367} 2012-03-19 09:46 - 2012-03-19 09:45 - 0000000 ____D C:\Users\Owner\AppData\Local\{93DE10CC-12CF-41B6-8266-397EC261C36C} 2012-03-18 09:36 - 2012-03-18 09:35 - 0000000 ____D C:\Users\Owner\AppData\Local\{966E43D2-DEFE-4487-BD94-1D849A00B10A} 2012-03-18 09:35 - 2012-03-18 09:34 - 0000000 ____D C:\Users\Owner\AppData\Local\{37FC379B-2D31-4305-AA1A-EEE17EFDDD09} 2012-03-17 21:34 - 2012-03-17 21:33 - 0000000 ____D C:\Users\Owner\AppData\Local\{242104EE-0DE0-4ABF-A6BD-AE2B4194491B} 2012-03-17 21:33 - 2012-03-17 07:05 - 0000000 ____D C:\Users\Owner\AppData\Local\{6CE47BCB-B2EC-42C7-83A6-82DA6ECED394} 2012-03-17 07:06 - 2012-03-17 07:06 - 0000000 ____D C:\Users\Owner\AppData\Local\{0915FB63-3C72-4D54-A94A-217AFE1704EC} 2012-03-16 23:58 - 2012-05-08 14:29 - 0075120 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\partmgr.sys 2012-03-16 14:04 - 2012-03-16 14:04 - 0000000 ____D C:\Users\Owner\AppData\Local\{5D797419-58B0-4923-8002-3D9CE4854B56} 2012-03-16 14:04 - 2012-03-16 14:03 - 0000000 ____D C:\Users\Owner\AppData\Local\{C701EEAF-99E1-41D3-964E-CB87416940AF} 2012-03-16 13:58 - 2012-03-16 13:58 - 0000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition 2012-03-16 13:32 - 2010-07-06 16:39 - 0013824 ____A C:\Users\Owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2012-03-16 06:47 - 2012-03-16 06:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{BCB35E47-A2DB-475F-9CF1-55FA971CA210} 2012-03-16 06:46 - 2012-03-16 06:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{61801664-4F23-4BBC-9D40-0BE4D5241EF5} 2012-03-15 18:15 - 2012-03-15 18:14 - 0000000 ____D C:\Users\Owner\AppData\Local\{C2C3E21F-D115-451D-B68D-896297A59593} 2012-03-15 18:14 - 2012-03-15 18:13 - 0000000 ____D C:\Users\Owner\AppData\Local\{374A89D1-F460-48CE-8E48-14997DED7084} 2012-03-15 06:13 - 2012-03-15 06:12 - 0000000 ____D C:\Users\Owner\AppData\Local\{2B4D39BF-619D-40EE-8531-44956A0A8829} 2012-03-15 06:12 - 2012-03-15 06:12 - 0000000 ____D C:\Users\Owner\AppData\Local\{37766F82-A4E3-496D-9EB5-B4AED8B73525} 2012-03-15 06:12 - 2012-03-15 06:11 - 0000000 ____D C:\Users\Owner\AppData\Local\{E1A9C1FC-829E-4615-9551-2525BB500D34} 2012-03-15 06:11 - 2012-03-15 06:10 - 0000000 ____D C:\Users\Owner\AppData\Local\{B3F8EEBB-55BC-489F-9FE3-FC38D285D7D3} 2012-03-14 12:31 - 2012-03-14 12:30 - 0000000 ____D C:\Users\Owner\AppData\Local\{B4A53249-9AF3-4291-AEE8-329704CABF0A} 2012-03-14 12:30 - 2012-03-14 12:29 - 0000000 ____D C:\Users\Owner\AppData\Local\{EF9F3A4D-662D-4127-A178-1A88EFBFC989} 2012-03-13 19:56 - 2012-03-13 19:55 - 0000000 ____D C:\Users\Owner\AppData\Local\{0592C098-1C56-47E7-BB06-8195F13E91EE} 2012-03-13 19:55 - 2012-03-13 19:54 - 0000000 ____D C:\Users\Owner\AppData\Local\{B91ABE2E-2E8E-4755-B76E-B5A3DB76D319} 2012-03-13 07:54 - 2012-03-13 07:54 - 0000000 ____D C:\Users\Owner\AppData\Local\{A8069494-BCAC-4A3A-8B50-6435EDC3FFDA} 2012-03-13 07:54 - 2012-03-13 07:53 - 0000000 ____D C:\Users\Owner\AppData\Local\{6962E2BF-6CF4-4787-A913-57BEEF97FD32} 2012-03-12 19:53 - 2012-03-12 19:52 - 0000000 ____D C:\Users\Owner\AppData\Local\{A0D393BD-BDD2-4849-8C3A-D4EB3F29C3D9} 2012-03-12 19:52 - 2012-03-12 19:51 - 0000000 ____D C:\Users\Owner\AppData\Local\{CE5417FA-15E0-476F-ADAD-6618DCE78FBA} 2012-03-12 07:51 - 2012-03-12 07:50 - 0000000 ____D C:\Users\Owner\AppData\Local\{5796A9A0-4350-4179-8008-54883482D05A} 2012-03-12 07:50 - 2012-03-12 07:49 - 0000000 ____D C:\Users\Owner\AppData\Local\{788336B2-82BD-4DE6-933E-23EB42FFD82A} 2012-03-11 19:49 - 2012-03-11 19:48 - 0000000 ____D C:\Users\Owner\AppData\Local\{7EA95F99-E407-4DCC-B94E-BF7355A6A32B} 2012-03-11 19:48 - 2012-03-11 19:48 - 0000000 ____D C:\Users\Owner\AppData\Local\{A2E16C86-13A3-4D65-83C4-40CAE7D135E9} 2012-03-11 07:48 - 2012-03-11 07:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{49B63505-5175-4A76-A67B-C071E1405D79} 2012-03-11 07:47 - 2012-03-11 07:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{E43BF5C7-E75F-44AA-941A-F207BF2FCB02} 2012-03-10 09:09 - 2012-03-10 09:08 - 0000000 ____D C:\Users\Owner\AppData\Local\{D8894B3A-FAE8-4E6D-A5CD-ABA1DCD7C127} 2012-03-10 09:08 - 2012-03-10 09:07 - 0000000 ____D C:\Users\Owner\AppData\Local\{746F3213-29DD-4C82-B221-82B433E59628} 2012-03-09 21:07 - 2012-03-09 21:06 - 0000000 ____D C:\Users\Owner\AppData\Local\{720DF6B2-652C-41A5-B07F-D1DFD88DDEB8} 2012-03-09 21:06 - 2012-03-09 21:06 - 0000000 ____D C:\Users\Owner\AppData\Local\{053AF500-7B7F-4722-A9DD-3749CF32F29B} 2012-03-09 09:06 - 2012-03-09 09:05 - 0000000 ____D C:\Users\Owner\AppData\Local\{0DBE6579-8703-4DEC-A01A-3B310DAC8177} 2012-03-09 09:05 - 2012-03-09 09:04 - 0000000 ____D C:\Users\Owner\AppData\Local\{2B48CCB5-0173-4A4C-8B62-170109FEC097} 2012-03-08 14:50 - 2012-03-08 14:50 - 0049016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sirenacm.dll 2012-03-08 14:37 - 2012-03-08 14:37 - 0302448 ____A (Microsoft Corporation) C:\Windows\WLXPGSS.SCR 2012-03-08 12:42 - 2012-03-08 12:41 - 0000000 ____D C:\Users\Owner\AppData\Local\{4C2E4D92-239E-4121-B1C5-301696B97FC5} 2012-03-08 12:41 - 2012-03-08 12:40 - 0000000 ____D C:\Users\Owner\AppData\Local\{51806763-F945-4D95-9C20-18A780C54410} 2012-03-07 14:45 - 2010-07-05 18:45 - 0000000 ____D C:\Users\Owner\Documents\Liam 2012-03-07 14:16 - 2012-03-07 14:16 - 0157472 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaws.exe 2012-03-07 14:16 - 2012-03-07 14:16 - 0149280 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaw.exe 2012-03-07 14:16 - 2012-03-07 14:16 - 0149280 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\java.exe 2012-03-07 14:16 - 2010-07-06 09:28 - 0472808 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\deployJava1.dll 2012-03-07 09:48 - 2012-03-07 09:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{9B51CD81-6860-4219-B622-F6C744721A66} 2012-03-07 09:47 - 2012-03-07 09:46 - 0000000 ____D C:\Users\Owner\AppData\Local\{D53C2B14-7873-4837-B324-39ADD94C169F} 2012-03-07 09:46 - 2012-03-07 09:45 - 0000000 ____D C:\Users\Owner\AppData\Local\{05C4A99A-04B4-45BE-8901-B78770543A45} 2012-03-07 09:45 - 2012-03-06 11:38 - 0000000 ____D C:\Users\Owner\AppData\Local\{ED775254-16D5-4D9E-96E7-229B1D15CE13} 2012-03-06 11:39 - 2012-03-06 11:38 - 0000000 ____D C:\Users\Owner\AppData\Local\{CB5C3E85-2B0E-4EA5-A3A9-90A69524C55B} 2012-03-05 10:50 - 2012-03-05 10:49 - 0000000 ____D C:\Users\Owner\AppData\Local\{D6FB6833-65C5-428C-BCFC-1B8E236FC7F2} 2012-03-05 10:49 - 2012-03-04 19:37 - 0000000 ____D C:\Users\Owner\AppData\Local\{A3A032F3-CF9E-46F8-BE30-A21B1202DEE6} 2012-03-04 19:38 - 2012-03-04 19:37 - 0000000 ____D C:\Users\Owner\AppData\Local\{2250A325-735E-4DE2-923E-8DEDA74B45E3} 2012-03-04 07:37 - 2012-03-04 07:36 - 0000000 ____D C:\Users\Owner\AppData\Local\{F8E0465D-49D1-446E-8646-35812E593B83} 2012-03-04 07:36 - 2012-03-04 07:35 - 0000000 ____D C:\Users\Owner\AppData\Local\{6872B923-6546-43D2-B990-3B03514BD4B9} 2012-03-04 07:35 - 2012-03-04 07:34 - 0000000 ____D C:\Users\Owner\AppData\Local\{E53E9DD6-994D-4B37-B563-0267CED6882D} 2012-03-04 07:34 - 2012-03-04 07:34 - 0000000 ____D C:\Users\Owner\AppData\Local\{75984AF0-854E-4982-8D94-AE771C38F816} 2012-03-03 18:24 - 2012-03-03 18:23 - 0000000 ____D C:\Users\Owner\AppData\Local\{D774033B-3534-4A46-907C-509143EDB976} 2012-03-03 18:23 - 2012-03-03 18:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{80DDF98E-3839-427C-9B88-EF0BEB9638FC} 2012-03-03 08:14 - 2011-09-27 11:28 - 0000000 ____D C:\Users\Owner\Documents\ResumeMaker 2012-03-03 06:22 - 2012-03-03 06:22 - 0000000 ____D C:\Users\Owner\AppData\Local\{39B95969-E41B-46BF-B1EE-EC47C7BE066A} 2012-03-03 06:22 - 2012-03-03 06:21 - 0000000 ____D C:\Users\Owner\AppData\Local\{9F9F4C9F-47FA-4CFD-A0D4-195C9560E851} 2012-03-02 22:35 - 2012-05-08 14:30 - 1544704 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll 2012-03-02 21:31 - 2012-05-08 14:30 - 1077248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2012-03-02 18:21 - 2012-03-02 18:20 - 0000000 ____D C:\Users\Owner\AppData\Local\{E8C6B165-CDD3-483F-BD40-E2433E400114} 2012-03-02 18:20 - 2012-03-02 18:19 - 0000000 ____D C:\Users\Owner\AppData\Local\{FA1C7568-6C40-46F8-8E54-2EFE54D8FD6D} 2012-03-02 05:51 - 2012-03-02 05:51 - 0000000 ____D C:\Users\Owner\AppData\Local\{9F2ECBD5-312B-47F1-A85E-59260C6FA246} 2012-03-02 05:51 - 2012-03-02 05:50 - 0000000 ____D C:\Users\Owner\AppData\Local\{542CF24B-51BB-44C2-A0DD-9B73DD61A9FD} 2012-03-01 12:30 - 2012-03-01 12:29 - 0000000 ____D C:\Users\Owner\AppData\Local\{4FCB2364-30E6-42AC-B22B-65935A12AF1E} 2012-03-01 12:29 - 2012-03-01 12:29 - 0000000 ____D C:\Users\Owner\AppData\Local\{5BB61CEA-2950-47F7-B046-9659C895D46B} 2012-02-29 22:46 - 2012-04-11 18:56 - 0023408 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\fs_rec.sys 2012-02-29 22:38 - 2012-04-11 18:56 - 0220672 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll 2012-02-29 22:33 - 2012-04-11 18:56 - 0081408 ____A (Microsoft Corporation) C:\Windows\System32\imagehlp.dll 2012-02-29 22:28 - 2012-04-11 18:56 - 0005120 ____A (Microsoft Corporation) C:\Windows\System32\wmi.dll 2012-02-29 21:37 - 2012-04-11 18:56 - 0172544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2012-02-29 21:33 - 2012-04-11 18:56 - 0159232 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll 2012-02-29 21:29 - 2012-04-11 18:56 - 0005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wmi.dll 2012-02-29 09:42 - 2012-02-29 09:41 - 0000000 ____D C:\Users\Owner\AppData\Local\{FA037111-9332-46C9-B04B-171D1857B87F} 2012-02-29 09:41 - 2012-02-29 09:40 - 0000000 ____D C:\Users\Owner\AppData\Local\{7239F38F-FD31-4D55-9026-019E03933BE5} 2012-02-29 09:40 - 2012-02-29 09:40 - 0000000 ____D C:\Users\Owner\AppData\Local\{93B28406-9BA8-4CDA-B40E-F0607365DD4E} 2012-02-29 09:40 - 2012-02-29 09:39 - 0000000 ____D C:\Users\Owner\AppData\Local\{0DD69378-011F-4F91-9690-C5DD370BCEB6} 2012-02-28 19:17 - 2012-02-28 19:17 - 0000000 ____D C:\Users\Owner\AppData\Local\{FF9625EC-3A41-4292-AE63-232D21D44862} 2012-02-28 19:17 - 2012-02-28 19:16 - 0000000 ____D C:\Users\Owner\AppData\Local\{51EBA023-4CE1-4F34-916F-9FBF87D5C204} 2012-02-28 07:17 - 2010-06-28 07:29 - 0000544 ____A C:\Windows\Tasks\PCDRScheduledMaintenance.job 2012-02-28 07:16 - 2012-02-28 07:15 - 0000000 ____D C:\Users\Owner\AppData\Local\{6FA5B420-7C9C-4675-BE3B-4815C109F0C6} 2012-02-28 07:15 - 2012-02-27 15:47 - 0000000 ____D C:\Users\Owner\AppData\Local\{1CBB91AD-B4F0-48E9-AE01-C5B0DC08D68B} ========================= Known DLLs (Whitelisted) ============ ========================= Bamital & volsnap Check ============ C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ========================= Memory info ====================== Percentage of memory in use: 14% Total physical RAM: 5879.89 MB Available physical RAM: 5036.95 MB Total Pagefile: 5878.04 MB Available Pagefile: 5017.04 MB Total Virtual: 8192 MB Available Virtual: 8191.9 MB ======================= Partitions ========================= 1 Drive c: (HP) (Fixed) (Total:454.08 GB) (Free:369.29 GB) NTFS 2 Drive e: (FACTORY_IMAGE) (Fixed) (Total:11.48 GB) (Free:1.63 GB) NTFS ==>[system with boot components (obtained from reading drive)] 4 Drive g: () (Removable) (Total:14.89 GB) (Free:14.89 GB) FAT32 9 Drive x: (Boot) (Fixed) (Total:0.08 GB) (Free:0.07 GB) NTFS 10 Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)] Disk ### Status Size Free Dyn Gpt -------- ------------- ------- ------- --- --- Disk 0 Online 465 GB 0 B Disk 1 Online 14 GB 0 B Disk 2 No Media 0 B 0 B Disk 3 No Media 0 B 0 B Disk 4 No Media 0 B 0 B Disk 5 No Media 0 B 0 B ========================================================== Last Boot: 2012-05-19 21:30 ======================= End Of Log ========================== Just curious, what did this do?
  8. Thank you for your reply and the time you took to write it for me. But I managed to fix this problem using Norton 360 "PC Tuneup" tools. The first task I ran was the "Registry Cleanup". This cleaned up about 150 registry entries, but I don't think it is what solved my problem. I then used Norton's "Startup Manager". It displayed a list of Programs that weren't vital to the computers functioning that launch automatically upon startup, their popularity among Norton users, and the trust level. I ended up disabling some .exe files that were not trusted. The files I can recall disabling were csrss.exe, msvcnp.exe, and BLANK.exe (which was located by Norton to be the update.exe file I had talked about earlier). When I attempted to locate csrss.exe and msvcnp.exe, they were both located in a Norton folder (which is located in a hidden folder called ProgramData under (C:)1) All three of these files were less than 2 weeks old, and had less than 50 users in the Norton Community. After managing my startup programs I ran the Malwarebytes quick scan (which detected I believe 11 issues) and restarted my PC. After the restart I ran another quick scan and full scan which both detected 0 issues. To the best of my knowledge, this means there are no more issues with my PC. The update.exe file has also stopped appearing in my Roaming folder. Thank you again for your reply and unless you think my computer is still compromised I will consider this issue resolved. If you want to continue troubleshooting or have any requests, I will cooperate. 1: Under the Ignore List on Malwarebytes *I believe* I had set it to ignore the Norton folder within Program Files (x86). Since the Norton folder with the Trojan files was under ProgramData I doubt this affected the scan. I say *I believe* because just now I checked the Ignore list and it's empty.
  9. I recently downloaded Malwarebytes after Norton 360 kept telling me that I was getting attacked by a worm. I thought with Norton 360 I was protected from everything, but it appears not. After downloading Malwarebytes I ran a few scans and had to restart my computer a few times. I have run into 8 files that keep coming up on the scan. Here is the log: Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.05.25.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 Owner :: OWNER-PC [administrator] 26/05/2012 3:07:26 PM 1.txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 207390 Time elapsed: 2 minute(s), 22 second(s) Memory Processes Detected: 3 C:\Windows\Temp\svchost.exe (Trojan.Agent) -> 3412 -> No action taken. C:\Windows\Temp\svchost.exe (Trojan.Agent) -> 3424 -> No action taken. C:\Windows\Temp\svchost.exe (Trojan.Agent) -> 2776 -> No action taken. Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKCU\Software\VB and VBA Program Settings\SrvID (Malware.Trace) -> No action taken. Registry Values Detected: 2 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|msvcnp (Backdoor.Agent) -> Data: C:\Users\Owner\AppData\Roaming\msvcnp .exe -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|csrss (Trojan.Agent) -> Data: C:\Users\Owner\AppData\Roaming\csrss .exe -> No action taken. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 2 C:\Windows\Temp\svchost.exe (Trojan.Agent) -> No action taken. C:\Users\Owner\AppData\Roaming\csrss .exe (Trojan.Agent) -> No action taken. (end) Here is the removal log of the same files. A popup also appears telling me to restart my computer. Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.05.25.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 Owner :: OWNER-PC [administrator] 26/05/2012 3:07:26 PM mbam-log-2012-05-26 (15-07-26).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 207390 Time elapsed: 2 minute(s), 22 second(s) Memory Processes Detected: 3 C:\Windows\Temp\svchost.exe (Trojan.Agent) -> 3412 -> Delete on reboot. C:\Windows\Temp\svchost.exe (Trojan.Agent) -> 3424 -> Delete on reboot. C:\Windows\Temp\svchost.exe (Trojan.Agent) -> 2776 -> Delete on reboot. Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKCU\Software\VB and VBA Program Settings\SrvID (Malware.Trace) -> Quarantined and deleted successfully. Registry Values Detected: 2 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|msvcnp (Backdoor.Agent) -> Data: C:\Users\Owner\AppData\Roaming\msvcnp .exe -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|csrss (Trojan.Agent) -> Data: C:\Users\Owner\AppData\Roaming\csrss .exe -> Quarantined and deleted successfully. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 2 C:\Windows\Temp\svchost.exe (Trojan.Agent) -> Delete on reboot. C:\Users\Owner\AppData\Roaming\csrss .exe (Trojan.Agent) -> Quarantined and deleted successfully. (end) After restarting my computer, the same 8 files appear in the next scan. Is there anything I can do to stop this? I had problems before with a file called update.exe appearing in my Roaming folder. When I deleted it, it would just appear again after a few seconds. So I deleted it and then put a folder in Roaming called update.exe. This stopped the file from appearing. Any input or help is appreciated.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.