Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-05-2014 02
Ran by robert (administrator) on DERR2 on 28-05-2014 12:35:13
Running from D:\_DOWNLOAD_
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Logitech, Inc.) C:\Program Files\Common Files\logishrd\KHAL3\KHALMNPR.exe
(Greenshot) C:\Program Files\Greenshot\Greenshot.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(O&O Software GmbH) C:\Program Files\OO Software\Defrag\oodtray.exe
(Flexera Software, Inc.) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(Scendix Software-Vertriebsges. mbH) C:\Program Files (x86)\Pamela\Pamela.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(GRETECH) C:\Program Files (x86)\GRETECH\GOMTray\GomTray.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Stoic Joker's Network) C:\Program Files\T-Clock 2010\x64\Clock.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
() C:\Program Files (x86)\KatMouse\KatMouse.exe
() C:\Program Files\Locate\Locate32.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe
(Zhorn Software) C:\Program Files (x86)\Stickies\stickies.exe
(Realtime Soft Ltd) C:\Program Files\UltraMon\UltraMon.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(Realtime Soft Ltd) C:\Program Files\UltraMon\UltraMonTaskbar.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre7\bin\javaw.exe
(Ghisler Software GmbH) C:\Program Files\totalcmd\TOTALCMD64.EXE
(Realtime Soft Ltd) C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(CMCEI) C:\Program Files\Newsbin\newsbinpro64.exe
(Google Inc.) C:\Users\robert\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\robert\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\robert\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\robert\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\robert\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\robert\AppData\Local\Google\Chrome\Application\chrome.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Flexera Software, Inc.) C:\ProgramData\FLEXnet\Connect\11\agent.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
() D:\_DOWNLOAD_\AdwCleaner.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8158240 2009-10-06] (Realtek Semiconductor)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM\...\Run: [apmwinapp] => C:\Program Files (x86)\Paragon Software\HFS+ for Windows  9.0\apmwinsrv.exe [67376 2011-05-11] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)
HKLM\...\Run: [Greenshot] => C:\Program Files\Greenshot\Greenshot.exe [495616 2013-10-27] (Greenshot)
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1275608 2014-03-25] (COMODO)
HKLM\...\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2013-12-11] (LogMeIn, Inc.)
HKLM\...\Run: [OODefragTray] => C:\Program Files\OO Software\Defrag\oodtray.exe [4464936 2014-01-24] (O&O Software GmbH)
HKLM-x32\...\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [74752 2012-06-28] (Nullsoft, Inc.)
HKLM-x32\...\Run: [DNS7reminder] => C:\Program Files (x86)\Nuance\NaturallySpeaking11\Ereg\Ereg.exe [259624 2007-04-16] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [AdobeCS4ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [611712 2008-08-14] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [HFS Activator] => C:\Program Files (x86)\Paragon Software\HFS+ for Windows  9.0\activation\hfsactivator.exe [246064 2011-05-11] ()
HKLM-x32\...\Run: [vmware-tray] => C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe [103576 2012-06-09] (VMware, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\isuspm.exe [324976 2010-05-21] (Flexera Software, Inc.)
HKLM-x32\...\Run: [Nuance OmniPage 18-reminder] => C:\Program Files (x86)\Nuance\OmniPage18\Ereg\Ereg.exe [333088 2011-05-16] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3499896 2014-05-08] (Adobe Systems Inc.)
HKLM-x32\...\Run: [HPUsageTracking] => C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe [30264 2009-10-06] (Hewlett-Packard Company)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-1235320012-531206643-3524170785-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [324976 2010-05-21] (Flexera Software, Inc.)
HKU\S-1-5-21-1235320012-531206643-3524170785-1000\...\Run: [pamela.exe] => C:\Program Files (x86)\Pamela\Pamela.exe [12120064 2012-06-14] (Scendix Software-Vertriebsges. mbH)
HKU\S-1-5-21-1235320012-531206643-3524170785-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2013-01-16] (Hewlett-Packard Company)
HKU\S-1-5-21-1235320012-531206643-3524170785-1000\...\Run: [GomTray] => C:\Program Files (x86)\GRETECH\GOMTray\GomTray.exe [2384472 2013-07-04] (GRETECH)
HKU\S-1-5-21-1235320012-531206643-3524170785-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-1235320012-531206643-3524170785-1000\...\Policies\system: [HideFastUserSwitching] 1
Lsa: [Notification Packages] scecli C:\Program Files\ASUS\Bluetooth Software\BtwProximityCP.dll
Startup: C:\Users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Clock.lnk
ShortcutTarget: Clock.lnk -> C:\Program Files\T-Clock 2010\x64\Clock.exe (Stoic Joker's Network)
Startup: C:\Users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KatMouse.lnk
ShortcutTarget: KatMouse.lnk -> C:\Program Files (x86)\KatMouse\KatMouse.exe ()
Startup: C:\Users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Locate32 Autorun.lnk
ShortcutTarget: Locate32 Autorun.lnk -> C:\Program Files\Locate\Locate32.exe ()
Startup: C:\Users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stickies.lnk
ShortcutTarget: Stickies.lnk -> C:\Program Files (x86)\Stickies\stickies.exe (Zhorn Software)
Startup: C:\Users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UltraMon.lnk
ShortcutTarget: UltraMon.lnk -> C:\Program Files\UltraMon\UltraMon.exe (Realtime Soft Ltd)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xB4EB0F7F2828CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = 
SearchScopes: HKLM-x32 - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKCU - DefaultScope {0F0180FB-1B20-4620-B8CA-F7E141F90193} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=293224&p={searchTerms}
SearchScopes: HKCU - {0F0180FB-1B20-4620-B8CA-F7E141F90193} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=293224&p={searchTerms}
SearchScopes: HKCU - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF from Selection - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: Atomic Savings BHO - {FD54B52E-A521-4C98-A65E-2213146AE98D} - C:\Program Files (x86)\Atomic Savings\FrameworkBHO64.dll No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Adobe Acrobat Create PDF Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - b Search.us.com Toolbar - {C92D948D-97DC-4F90-A21E-5718540A79C3} - C:\Users\robert\AppData\Local\TNT2\Profiles\10262\passport64.dll No File
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Alive Text to Speech - {954F618B-0DEC-4D1A-9317-E0FC96F87865} - C:\Program Files (x86)\AliveMedia\Text to Speech\IEToolbar.dll ()
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - b Search.us.com Toolbar - {C92D948D-97DC-4F90-A21E-5718540A79C3} - C:\Users\robert\AppData\Local\TNT2\Profiles\10262\passport64.dll No File
DPF: HKLM-x32 {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com//activex/ractrl.cab?lmi=1081
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32:  - {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} -  No File [ ]
Tcpip\Parameters: [DhcpNameServer] 66.118.165.22 69.65.41.30 209.18.47.61

FireFox:
========
FF ProfilePath: C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\35es82b6.default_PRZED RESETEM
FF DefaultSearchEngine: Google Default
FF SearchEngineOrder.1: Yahoo! (Avast)
FF SelectedSearchEngine: Google Default
FF Homepage: hxxp://www.metal-archives.com/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.3 - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.10 - C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.0.0.4 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.3 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\robert\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\robert\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF SearchPlugin: C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\35es82b6.default_PRZED RESETEM\searchplugins\bing-avast.xml
FF SearchPlugin: C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\35es82b6.default_PRZED RESETEM\searchplugins\google-default.xml
FF SearchPlugin: C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\35es82b6.default_PRZED RESETEM\searchplugins\yahoo-avast.xml
FF Extension: Push to Kindle - C:\Users\robert\AppData\Roaming\Mozilla\Firefox\Profiles\35es82b6.default_PRZED RESETEM\Extensions\jid0-GokC6R49cBZciOKniufAR4QKFWc@jetpack.xpi [2014-05-25]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2013-10-31]

Chrome: 
=======
CHR HomePage: https://www.yahoo.com?fr=hp-avast&type=avastbcl
CHR StartupUrls: "https://www.yahoo.com?fr=hp-avast&type=avastbcl"
CHR Extension: (Google Docs) - C:\Users\robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-25]
CHR Extension: (Google Drive) - C:\Users\robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-25]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-23]
CHR Extension: (YouTube) - C:\Users\robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-08-11]
CHR Extension: (Google Search) - C:\Users\robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-08-11]
CHR Extension: (Google Wallet) - C:\Users\robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]
CHR Extension: (Gmail) - C:\Users\robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-08-11]
CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\robert\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2012-08-11]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-05-08]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-08-06]
CHR HKLM-x32\...\Chrome\Extension: [ljkcijnbckdflhifmbnfnkjacokloacf] - C:\Program Files (x86)\qualitink\ljkcijnbckdflhifmbnfnkjacokloacf.crx [2013-08-06]

==================== Services (Whitelisted) =================

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2012-04-28] (Adobe Systems)
S3 Avid DMF Service; C:\Program Files\Avid\Editor Transcode\Dynamic Media Files\DMFService.exe [464712 2013-06-24] (Avid Technology, Inc.)
R2 Avid Editor Broker; C:\Program Files\Avid\Editor Transcode\TranscodeService\AvidEditorMSE.exe [465224 2013-06-24] (Avid Technology, Inc.)
R2 Avid Editor Db Engine; C:\Program Files\Avid\Editor Transcode\TranscodeService\AvidEditorDbEngine.exe [464712 2013-06-24] (Avid Technology, Inc.)
S3 Avid Editor Transcode Service; C:\Program Files\Avid\Editor Transcode\TranscodeService\AvidEditorTranscode.exe [465224 2013-06-24] (Avid Technology, Inc.)
R2 Avid Editor Transcode Status; C:\Program Files\Avid\Editor Transcode\TranscodeService\rnc-central\AvidEditorTranscodeStatus.exe [100680 2013-06-24] (Avid Technology, Inc.)
S4 BitKinex; C:\Program Files (x86)\BitKinex\bitkinexsvc.exe [32944 2010-07-12] ()
R2 btwdins; C:\Program Files\ASUS\Bluetooth Software\btwdins.exe [1005944 2012-12-06] (Broadcom Corporation.)
R2 cmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [6817544 2014-04-16] (COMODO)
S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2264280 2014-03-25] (COMODO)
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2135232 2014-04-23] ()
R2 EasyRedirect; C:\Program Files\Easy-Hide-IP\rdr\EasyRedirect.exe [3575120 2012-11-22] (EasyTech)
R2 FlowFinder3MonstersAE64; C:\Program Files\GenArts\Monsters-AE64\bin\FlowFinder3MonstersAE64.exe [751104 2010-06-03] ()
R2 JawsServerAE64; C:\Program Files (x86)\GenArts\Monsters-AE64\bin\JawsServerAE64.exe [393216 2010-06-03] ()
S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2003-04-18] ()
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [376144 2014-05-26] (LogMeIn, Inc.)
R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226640 2014-05-26] (LogMeIn, Inc.)
R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2013-12-11] (LogMeIn, Inc.)
R2 nxdeviced; C:\Program Files (x86)\NoMachine\bin\nxdeviced64.exe [958128 2014-01-31] (NoMachine)
R2 nxdisplay; C:\Program Files (x86)\NoMachine\bin\nxdisplay.exe [220336 2014-01-31] (NoMachine)
R2 nxfsd; C:\Program Files (x86)\NoMachine\bin\nxfsd.exe [181936 2014-01-31] (NoMachine)
S2 nxservice; C:\Program Files (x86)\NoMachine\bin\nxservice.exe [206512 2014-01-31] (NoMachine)
R2 nxusbd; C:\Program Files (x86)\NoMachine\bin\nxusbd64.exe [3795632 2014-01-31] (NoMachine)
R2 OODefragAgent; C:\Program Files\OO Software\Defrag\oodag.exe [1657128 2014-01-24] (O&O Software GmbH)
R2 RLM-GenArts; C:\Program Files (x86)\GenArts\rlm\rlm.exe [1540096 2010-06-03] (Reprise Software Inc.)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2010-06-25] (CACE Technologies, Inc.)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
R2 SentinelKeysServer; C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [376832 2013-01-09] (SafeNet, Inc.)
R2 SentinelProtectionServer; C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe [1259872 2013-01-09] (SafeNet, Inc)
R2 SentinelSecurityRuntime; C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe [293216 2013-01-09] (SafeNet, Inc.)
S2 VMwareHostd; C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [11839488 2012-06-09] ()
R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [598808 2013-06-06] (Wacom Technology, Corp.)

==================== Drivers (Whitelisted) ====================

R0 apmwin; C:\Windows\System32\DRIVERS\apmwin.sys [51504 2011-05-11] (Paragon Software Group)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [165688 2012-09-24] (Broadcom Corporation.)
R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [23168 2014-04-16] (COMODO)
R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [738472 2014-04-16] (COMODO)
S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()
R0 gpt_loader; C:\Windows\System32\DRIVERS\gpt_loader.sys [60720 2011-05-11] (Paragon Software Group)
S3 Hfsplus; C:\Windows\System32\DRIVERS\hfsplus.sys [196912 2011-05-11] (Paragon Software Group)
R2 HfsplusRec; C:\Windows\System32\DRIVERS\hfsplusrec.sys [16176 2011-05-11] (Paragon Software Group)
R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-12-11] (LogMeIn, Inc.)
S4 LMIRfsClientNP; No ImagePath
R0 mounthlp; C:\Windows\System32\DRIVERS\mounthlp.sys [42288 2011-05-11] (Paragon Software Group)
R2 NPF; C:\Windows\System32\drivers\npf.sys [35344 2010-06-25] (CACE Technologies, Inc.)
R3 nxaudio; C:\Windows\System32\drivers\nxaudio.sys [17920 2013-08-29] (NoMachine)
R3 nxdm; C:\Windows\System32\DRIVERS\nxdm.sys [29696 2012-12-11] (NoMachine Sarl)
R2 nxfs; C:\Program Files (x86)\NoMachine\bin\drivers\nxdisk\amd64\nxfs.sys [57008 2013-08-30] (NoMachine)
R2 nxusbf; C:\Program Files (x86)\NoMachine\bin\drivers\nxusb\NT6\amd64\nxusbf.sys [87216 2013-11-14] (NoMachine)
R3 nxusbh; C:\Windows\System32\DRIVERS\nxusbh.sys [68096 2013-11-12] (NoMachine)
R3 nxusbs; C:\Windows\System32\DRIVERS\nxusbs.sys [10240 2013-11-04] (NoMachine)
R2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [145448 2009-09-17] (SafeNet, Inc.)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)
S3 VASDeviceDrm; C:\Windows\System32\drivers\vasdDev.sys [1454896 2012-03-19] (ShiningMorning Inc.)
R0 vidsflt61; C:\Windows\System32\DRIVERS\vsflt61.sys [142944 2012-05-28] (Acronis)
R1 WMDrive; C:\Windows\SysWOW64\drivers\WMDrive.sys [92536 2012-06-19] (WinMount International Inc)
S3 WsAudioDevice_383S(1); C:\Windows\System32\drivers\WsAudioDevice_383S(1).sys [29288 2013-05-30] (Wondershare)
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 UCOREW64; \??\C:\Users\robert\AppData\Local\Temp\_FE2C.tmp\UCOREW64.SYS [X]
S3 wacommousefilter; system32\DRIVERS\wacommousefilter.sys [X]
S3 wacomvhid; system32\DRIVERS\wacomvhid.sys [X]
U3 kgtdapob; \??\C:\Users\robert\AppData\Local\Temp\kgtdapob.sys [X]

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\afcdp.sys B794DD8ACC5CC76177156463DAB4BEBB
C:\Windows\system32\drivers\afd.sys 79059559E89D06E8B80CE2944BE20228
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atikmdag.sys 60216B0E704584DE6D5A9F59E9C34C47
C:\Windows\System32\DRIVERS\atikmpag.sys 6B4E9261B613B047A9A145F328889968
C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\System32\DRIVERS\apmwin.sys 30A14404F582BB650BEE08DD01F88766
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atikmdag.sys 60216B0E704584DE6D5A9F59E9C34C47
C:\Windows\system32\DRIVERS\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\drivers\bcbtums.sys D70CEC0C62FDC1772ACD42EEF467F491
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bridge.sys 5C2F352A4E961D72518261257AAE204B
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\BthEnum.sys CF98190A94F62E405C8CB255018B2315
C:\Windows\System32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthpan.sys 02DD601B708DD0667E1331FA8518E9FF
C:\Windows\System32\Drivers\BTHport.sys 738D0E9272F59EB7A1449C3EC118E6C4
C:\Windows\System32\Drivers\BTHUSB.sys F188B7394D81010767B6DF3178519A37
C:\Windows\system32\drivers\btwampfl.sys 96E22173FD0E2670A2A20C1EEECA162A
C:\Windows\System32\drivers\btwaudio.sys A771078558477068DFD8037B82EB00F8
C:\Windows\System32\DRIVERS\btwavdt.sys 9FF58F76024D25784755B01F926B00BE
C:\Windows\System32\DRIVERS\btwl2cap.sys B1ACFD00CDD13B48D86F46BFEC153BF9
C:\Windows\System32\DRIVERS\btwrchid.sys EDD953D635F3AA89EF902E3F82D60D22
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cmderd.sys 348A7FDDF0D7354ED6308AF96EEF4F54
C:\Windows\System32\DRIVERS\cmdguard.sys 923659525ADAC632EA6F94570CCE1561
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys EBF28856F69CF094A902F884CF989706
C:\Windows\system32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys 3CA734CE373E5675FBC15CA2C45228E5
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ssudbus.sys 73BDD44A6088916964945886F9025409
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\system32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys 88612F1CE3BF42256913BF6E61C70D52
C:\Windows\system32\DRIVERS\evbda.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fltsrv.sys E94E042BC24BB301767A8125D529B705
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\gpt_loader.sys 56BB51F0F9BDD47F3B2B29B4ADBC159D
C:\Windows\system32\drivers\hcmon.sys ADB4348DA1345877B04E22203AFC8993
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\System32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A
C:\Windows\System32\DRIVERS\HDAudBus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\HECIx64.sys B6AC71AAA2B10848F57FC49D55A651AF
C:\Windows\System32\DRIVERS\hfsplus.sys 5EBA8CE3EF8C06F39351B70532F5F19B
C:\Windows\System32\DRIVERS\hfsplusrec.sys 7B2A631E410BAEA98ED802250C88C9AB
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidkmdf.sys 949900BBF7015CCD877D20DB6C2628BE
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\RTKVHD64.sys EE64207F2F5C20BFE5F73DB2566C4601
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys 96BB922A0981BC7432C8CF52B5410FE6
C:\Windows\System32\DRIVERS\k57nd60a.sys D85F3F18E44F7447B5F1BA5C85BAEB7C
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys 353009DEDF918B2A51414F330CF72DEC
C:\Windows\System32\Drivers\ksecpkg.sys 1C2D8E18AA8FD50CD04C15CC27F7F5AB
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\LHidFilt.Sys 241F2648ADF090E2A10095BD6D6F5DCB
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys 0F28935ECF1FBDEC22BAF720A5A94564
C:\Windows\System32\DRIVERS\lmimirr.sys 413ECDCFAD9A82804D3674C8D7EEC24E
C:\Windows\system32\drivers\LMIRfsDriver.sys C57D3FAA50E6F395759FFB7C709BD944
C:\Windows\System32\DRIVERS\LMouFilt.Sys 342ED5A4B3326014438F36D22D803737
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lvuvc64.sys FF3A488924B0032B1A9CA6948C1FA9E8
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mounthlp.sys 5EB154778552121FE1E61FFC30729A2D
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys 1A4F75E63C9FB84B85DFFC6B63FD5404
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\System32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mv91cons.sys 8B6DCD27123421D2D78DDBF832C4E359
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\drivers\npf.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys 1A29A59A4C5BA6F8C85062A613B7E2B2
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\System32\drivers\nvhda64v.sys 8D4AAC74B571FC356560E5B308955E93
C:\Windows\System32\DRIVERS\nvlddmkm.sys FCBA1C22727939E7CFF9EB08FE9692AB
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\System32\drivers\nxaudio.sys EF90AFE5F2E710E7D3ADA0C773D293DB
C:\Windows\System32\DRIVERS\nxdm.sys F539EEF012A5CF40C4925ECA82306577
C:\Program Files (x86)\NoMachine\bin\drivers\nxdisk\amd64\nxfs.sys 9167615A4509F35B71441C118D4980B0
C:\Program Files (x86)\NoMachine\bin\drivers\nxusb\NT6\amd64\nxusbf.sys 4807D663F7B8282EDDD8B8FA54964B38
C:\Windows\System32\DRIVERS\nxusbh.sys FCDC4636F5C44D5A481A6245C7EA2CB7
C:\Windows\System32\DRIVERS\nxusbs.sys 4D1F5FE87C61D593FA5E6EAFB0C11C06
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\System32\Drivers\PxHlpa64.sys BC08F7F3C53CBEE68670ED1314E290FD
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rfcomm.sys 3DD798846E2C28102B922C56E71B7932
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Sentinel64.sys 255476B54C82A89416EFDF09FD62F107
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\snapman.sys BBFB94699C8C265A6AF5FD51BDE26DFC
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\System32\DRIVERS\ssudmdm.sys 5252D7BC56E5E0ED715AEA8FE173A455
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\drivers\tcpip.sys 40AF23633D197905F03AB5628C558C51
C:\Windows\System32\DRIVERS\tcpip.sys 40AF23633D197905F03AB5628C558C51
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tdrpman.sys 9C1A823D4E729C965167B6E71E984296
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\timntr.sys 990447334615A0DB84F620E1426DCFE0
C:\Windows\System32\DRIVERS\tssecsrv.sys 4CE278FC9671BA81A138D70823FCAA09
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Program Files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys 694BCF23662F97D987CF4C6739C35F8B
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\drivers\usbaudio.sys B0435098C81D04CAFFF80DDB746CD3A2
C:\Windows\System32\DRIVERS\usbccgp.sys DCA68B0943D6FA415F0C56C92158A83A
C:\Windows\system32\drivers\usbcir.sys 80B0F7D5CCF86CEB5D402EAAF61FEC31
C:\Windows\System32\DRIVERS\usbehci.sys 18A85013A3E0F7E1755365D287443965
C:\Windows\System32\DRIVERS\usbhub.sys 8D1196CFBB223621F2C67D45710F25BA
C:\Windows\system32\drivers\usbohci.sys 765A92D428A8DB88B960DA5A8D6089DC
C:\Windows\system32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbscan.sys 9661DA76B4531B2DA272ECCE25A8AF24
C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\system32\drivers\usbuhci.sys DD253AFC3BC6CBA412342DE60C3647F3
C:\Windows\System32\Drivers\usbvideo.sys 1F775DA4CF1A3A1834207E975A72E9D7
C:\Windows\System32\drivers\vasdDev.sys 34812F7FAAFE329D15F55C4EB6DB44DA
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vididr.sys EE12FAFFDD1FB13BE0D6EF67CB0D1617
C:\Windows\System32\DRIVERS\vsflt61.sys 2DFD1EB9DE564460003DE1605A275E8D
C:\Windows\System32\DRIVERS\vmci.sys 87FC1DD880E8CAC4FAEBB84AF61A87C4
C:\Windows\system32\drivers\VMkbd.sys DE41918B7ABAE9056EB1E62540D229D3
C:\Windows\System32\DRIVERS\vmnetadapter.sys B259C31378BC855AFD1B53F59311C251
C:\Windows\System32\DRIVERS\vmnetbridge.sys DEC4CE720FFEDA939CF1BA315CFBD993
C:\Windows\system32\drivers\vmnetuserif.sys 82CB80CE5B1A1B3CB822CB4F2F8747D9
C:\Windows\System32\Drivers\vmusb.sys 415B167695C4B5960A13098622EF3D80
C:\Windows\system32\drivers\vmx86.sys DA53C0174AEBB2F67023A088E0256673
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\SysWow64\drivers\vstor2-mntapi10-shared.sys 6107E33A30C0B923F31C872E1980D2D1
C:\Windows\System32\drivers\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wachidrouter.sys 5E5704A38928D8452246867D94AEDC39
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wacomrouterfilter.sys 056891AD9FB65EEE3A927C9FB5131FC7
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wdcsam64.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys E2C933EDBC389386EBE6D2BA953F43D8
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWOW64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D
C:\Windows\SysWOW64\drivers\WMDrive.sys 7B8C8244274817C382303895A339E43A
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WsAudioDevice_383S(1).sys AD12F5C7251BB8D575D560894E73CBBA
C:\Windows\System32\DRIVERS\WSDPrint.sys 8D918B1DB190A4D9B1753A66FA8C96E8
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-28 12:34 - 2014-05-28 12:35 - 00000000 ____D () C:\FRST
2014-05-28 12:28 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-05-27 16:47 - 2014-05-27 16:58 - 00000000 ____D () C:\rsit
2014-05-26 14:15 - 2014-05-27 13:29 - 00000955 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk
2014-05-26 12:01 - 2014-05-26 12:01 - 00000780 _____ () C:\Users\robert\Desktop\JRT.txt
2014-05-25 17:35 - 2014-05-25 17:35 - 00001225 _____ () C:\Users\robert\Desktop\Spybot - Search & Destroy.lnk
2014-05-25 17:35 - 2014-05-25 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
2014-05-25 16:06 - 2014-05-25 16:06 - 00000331 _____ () C:\Start_.cmd
2014-05-25 16:05 - 2014-05-25 16:11 - 00000000 ___SD () C:\32788R22FWJFW
2014-05-25 14:54 - 2014-05-25 15:18 - 00000000 ____D () C:\Windows\erdnt
2014-05-25 14:05 - 2014-05-26 00:18 - 00001102 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-25 13:44 - 2014-05-27 16:58 - 00000000 ____D () C:\Program Files\trend micro
2014-05-25 12:54 - 2014-05-25 12:54 - 00018325 _____ () C:\Users\robert\Desktop\attach.txt
2014-05-25 12:28 - 2014-05-25 12:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-05-24 22:42 - 2014-05-24 22:42 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Local\Macromedia
2014-05-24 22:41 - 2014-05-24 22:41 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Roaming\Mozilla
2014-05-24 22:41 - 2014-05-24 22:41 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Local\Mozilla
2014-05-24 22:36 - 2014-05-24 22:36 - 00141288 _____ () C:\Users\Administrator.derr2\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-24 22:35 - 2014-05-24 22:35 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Roaming\WinMount
2014-05-24 22:34 - 2014-05-24 22:36 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Roaming\Greenshot
2014-05-24 22:34 - 2014-05-24 22:34 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-05-24 22:34 - 2014-05-24 22:34 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Roaming\WTablet
2014-05-24 22:34 - 2014-05-24 22:34 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Roaming\Logitech
2014-05-24 22:34 - 2014-05-24 22:34 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Roaming\FLEXnet
2014-05-24 22:34 - 2014-05-24 22:34 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Roaming\Apple Computer
2014-05-24 22:34 - 2014-05-24 22:34 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Roaming\Adobe
2014-05-24 22:34 - 2014-05-24 22:34 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Local\LogMeIn
2014-05-24 22:34 - 2014-05-24 22:34 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Local\Greenshot
2014-05-24 22:34 - 2014-05-24 22:34 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Local\Adobe
2014-05-24 22:33 - 2014-05-25 14:14 - 00000000 ____D () C:\Users\Administrator.derr2
2014-05-24 22:33 - 2012-05-07 23:00 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\LocalGoogle
2014-05-24 22:33 - 2012-05-07 23:00 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Local\Google
2014-05-24 22:33 - 2012-04-04 14:30 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Local\Microsoft Help
2014-05-24 22:33 - 2012-04-03 22:20 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Roaming\Macromedia
2014-05-24 21:36 - 2014-05-24 21:36 - 00000000 ____D () C:\Windows\ERUNT
2014-05-24 12:47 - 2014-05-24 12:47 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-05-24 12:46 - 2014-05-24 12:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-05-24 12:45 - 2014-05-25 14:12 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-05-24 00:33 - 2014-05-27 13:29 - 00000971 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Client.lnk
2014-05-23 23:05 - 2014-05-25 17:56 - 00004341 _____ () C:\Windows\wininit.ini
2014-05-23 22:47 - 2014-05-25 17:58 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-23 22:47 - 2014-05-25 17:37 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy
2014-05-23 21:48 - 2014-05-23 21:48 - 00000000 ____D () C:\Users\robert\AppData\Roaming\PC Tech Hotline
2014-05-23 21:14 - 2014-05-28 12:28 - 00000000 ____D () C:\AdwCleaner
2014-05-23 20:50 - 2014-05-25 17:20 - 00000000 ____D () C:\Program Files (x86)\PCTechHotline
2014-05-23 20:50 - 2014-05-25 14:45 - 00000000 ____D () C:\Program Files (x86)\sweetpacks bundle uninstaller_AdwCleaner_1548942
2014-05-22 18:42 - 2014-05-23 18:40 - 00000000 ____D () C:\Users\robert\AppData\Roaming\PAR Buddy
2014-05-22 18:42 - 2014-05-22 18:42 - 00000915 _____ () C:\Users\robert\Desktop\PAR Buddy.lnk
2014-05-22 18:42 - 2014-05-22 18:42 - 00000000 ____D () C:\Program Files (x86)\PAR Buddy
2014-05-22 18:11 - 2014-05-25 14:45 - 00000000 ____D () C:\Users\robert\AppData\Roaming\MultiPar
2014-05-22 18:11 - 2014-05-22 18:11 - 00000992 _____ () C:\Users\Public\Desktop\MultiPar.lnk
2014-05-22 18:07 - 2014-05-25 14:45 - 00000000 ____D () C:\Program Files (x86)\ParNRar
2014-05-22 18:07 - 2014-05-22 18:07 - 00000958 _____ () C:\Users\UpdatusUser\Desktop\ParNRar.lnk
2014-05-22 18:07 - 2014-05-22 18:07 - 00000958 _____ () C:\Users\robert\Desktop\ParNRar.lnk
2014-05-22 18:07 - 2014-05-22 18:07 - 00000958 _____ () C:\Users\nx\Desktop\ParNRar.lnk
2014-05-22 18:03 - 2014-05-22 18:11 - 00000000 ____D () C:\Program Files (x86)\MultiPar
2014-05-19 00:12 - 2014-05-19 00:12 - 00001062 _____ () C:\Users\robert\Desktop\Galaxy NexusCDMA 2 - Shortcut.lnk
2014-05-18 14:08 - 2014-05-18 14:08 - 00001066 _____ () C:\Users\robert\Desktop\LG HBS730 - Shortcut.lnk
2014-05-18 14:07 - 2014-05-18 14:07 - 00001078 _____ () C:\Users\robert\Desktop\Avantree Saturn - Shortcut.lnk
2014-05-15 18:37 - 2014-05-15 18:42 - 00000000 ____D () C:\Users\robert\Documents\Native Instruments
2014-05-15 18:32 - 2014-05-15 18:32 - 00001009 _____ () C:\Users\Public\Desktop\Traktor 2.lnk
2014-05-15 18:32 - 2014-05-15 18:32 - 00000000 __HDC () C:\ProgramData\{5D7D8554-ADF2-463E-B6AC-7A857B390410}
2014-05-15 18:31 - 2014-05-15 18:31 - 00001101 _____ () C:\Users\Public\Desktop\Controller Editor.lnk
2014-05-15 18:31 - 2014-05-15 18:31 - 00000000 __HDC () C:\ProgramData\{E70FDE50-4AB8-4AF6-8E82-A7B843A3AD92}
2014-05-15 18:30 - 2014-05-15 18:31 - 00000000 ____D () C:\ProgramData\Native Instruments
2014-05-15 18:30 - 2014-05-15 18:31 - 00000000 ____D () C:\Program Files\Native Instruments
2014-05-15 18:30 - 2014-05-15 18:31 - 00000000 ____D () C:\Program Files\Common Files\Native Instruments
2014-05-15 18:30 - 2014-05-15 18:30 - 00001066 _____ () C:\Users\Public\Desktop\Service Center.lnk
2014-05-15 18:30 - 2014-05-15 18:30 - 00000000 __HDC () C:\ProgramData\{F2610326-6A40-4BBC-9FBC-7F05356A912A}
2014-05-15 03:05 - 2014-05-06 00:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 03:05 - 2014-05-06 00:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 03:05 - 2014-05-05 23:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 03:05 - 2014-05-05 23:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-15 03:05 - 2014-05-05 23:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 03:05 - 2014-05-05 22:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-14 03:17 - 2014-05-09 02:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-14 03:17 - 2014-05-09 02:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-14 03:17 - 2014-03-24 22:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-14 03:17 - 2014-03-24 22:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-14 03:16 - 2014-04-11 22:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-14 03:16 - 2014-04-11 22:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-14 03:16 - 2014-04-11 22:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-14 03:16 - 2014-04-11 22:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-14 03:16 - 2014-04-11 22:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-14 03:16 - 2014-04-11 22:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-14 03:16 - 2014-04-11 22:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-14 03:16 - 2014-04-11 22:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-14 03:16 - 2014-04-11 22:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-14 03:16 - 2014-03-04 05:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-14 03:16 - 2014-03-04 05:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-14 03:16 - 2014-03-04 05:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-14 03:16 - 2014-03-04 05:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-14 03:16 - 2014-03-04 05:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-14 03:16 - 2014-03-04 05:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-14 03:16 - 2014-03-04 05:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-14 03:16 - 2014-03-04 05:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-14 03:16 - 2014-03-04 05:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-14 03:16 - 2014-03-04 05:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-14 03:16 - 2014-03-04 05:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-14 03:16 - 2014-03-04 05:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-14 03:16 - 2014-03-04 05:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-14 03:16 - 2014-03-04 05:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-14 03:16 - 2014-03-04 05:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-14 03:16 - 2014-03-04 05:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-14 03:16 - 2014-03-04 05:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-14 03:16 - 2014-03-04 05:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-14 03:16 - 2014-03-04 05:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-14 03:16 - 2014-03-04 05:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-14 03:16 - 2014-03-04 05:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-14 03:16 - 2014-03-04 05:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-14 03:16 - 2014-03-04 05:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-14 03:16 - 2014-03-04 05:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-14 03:16 - 2014-03-04 05:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-14 03:16 - 2014-03-04 05:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-14 03:16 - 2014-03-04 05:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-14 03:16 - 2014-03-04 05:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-14 03:16 - 2014-03-04 05:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-14 03:16 - 2014-03-04 05:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-14 03:16 - 2014-03-04 05:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-14 03:16 - 2014-03-04 05:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-03 21:25 - 2014-05-03 21:25 - 00000000 ____D () C:\Users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Elevayta Extra Boy v4.91d
2014-05-03 21:25 - 2014-05-03 21:25 - 00000000 ____D () C:\Program Files (x86)\Elevayta Creativity Tools
2014-05-03 18:02 - 2014-05-12 21:31 - 00000000 ____D () C:\Users\robert\AppData\Roaming\Audacity
2014-05-03 18:02 - 2014-05-03 18:02 - 00000974 _____ () C:\Users\Public\Desktop\Audacity.lnk
2014-05-03 18:02 - 2014-05-03 18:02 - 00000000 ____D () C:\Program Files (x86)\Audacity
2014-05-02 00:07 - 2014-05-25 14:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-30 14:54 - 2014-04-30 14:54 - 00000000 ____D () C:\Users\robert\AppData\Local\MPlayer
2014-04-30 14:54 - 2014-04-30 14:54 - 00000000 ____D () C:\MININT
2014-04-30 14:52 - 2014-04-30 14:52 - 00000258 __RSH () C:\ProgramData\ntuser.pol
2014-04-30 14:52 - 2012-07-25 12:03 - 00016896 _____ () C:\Windows\system32\sasnative64.exe
2014-04-30 03:00 - 2014-05-15 15:11 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-04-29 16:16 - 2014-04-30 17:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-04-29 15:31 - 2014-04-29 15:31 - 00000000 __SHD () C:\Users\robert\AppData\Local\EmieUserList
2014-04-29 15:31 - 2014-04-29 15:31 - 00000000 __SHD () C:\Users\robert\AppData\Local\EmieSiteList

==================== One Month Modified Files and Folders =======

2014-05-28 12:35 - 2014-05-28 12:34 - 00000000 ____D () C:\FRST
2014-05-28 12:33 - 2012-04-04 15:25 - 00000000 ____D () C:\Users\robert\AppData\Roaming\Skype
2014-05-28 12:29 - 2014-03-16 21:48 - 01474832 _____ () C:\Windows\system32\Drivers\sfi.dat
2014-05-28 12:28 - 2014-05-23 21:14 - 00000000 ____D () C:\AdwCleaner
2014-05-28 12:26 - 2012-08-11 19:31 - 00000912 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1235320012-531206643-3524170785-1000UA.job
2014-05-28 12:13 - 2012-04-05 21:30 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-28 11:59 - 2012-04-27 12:54 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-28 04:00 - 2012-04-03 16:04 - 02024650 _____ () C:\Windows\WindowsUpdate.log
2014-05-28 02:01 - 2012-04-03 22:02 - 00000000 ____D () C:\Users\robert\AppData\Local\Adobe
2014-05-28 00:47 - 2012-04-03 23:53 - 00000000 ____D () C:\Users\robert\AppData\Local\Newsbin
2014-05-27 23:26 - 2012-08-11 19:31 - 00000860 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1235320012-531206643-3524170785-1000Core.job
2014-05-27 18:59 - 2012-04-27 12:54 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-27 16:58 - 2014-05-27 16:47 - 00000000 ____D () C:\rsit
2014-05-27 16:58 - 2014-05-25 13:44 - 00000000 ____D () C:\Program Files\trend micro
2014-05-27 13:36 - 2009-07-14 00:45 - 00014416 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-27 13:36 - 2009-07-14 00:45 - 00014416 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-27 13:35 - 2009-07-14 01:13 - 00786766 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-27 13:30 - 2012-11-28 12:11 - 00000000 ____D () C:\ProgramData\notracks.com
2014-05-27 13:29 - 2014-05-26 14:15 - 00000955 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk
2014-05-27 13:29 - 2014-05-24 00:33 - 00000971 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Client.lnk
2014-05-27 13:29 - 2014-03-08 12:44 - 00011949 _____ () C:\Windows\setupact.log
2014-05-27 13:29 - 2014-02-01 00:07 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-05-27 13:29 - 2012-05-19 00:54 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-05-27 13:29 - 2012-05-17 04:38 - 00000000 ____D () C:\ProgramData\VMware
2014-05-27 13:29 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-27 12:45 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\tracing
2014-05-27 11:57 - 2012-04-04 12:29 - 00374638 _____ () C:\Windows\PFRO.log
2014-05-27 11:16 - 2012-04-30 01:26 - 00000000 ____D () C:\ProgramData\LogMeIn
2014-05-26 14:15 - 2014-04-20 15:01 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Ignition
2014-05-26 14:15 - 2014-03-16 23:32 - 00000000 ____D () C:\Program Files (x86)\LogMeIn
2014-05-26 14:15 - 2014-02-06 18:53 - 00000000 ____D () C:\Users\robert\AppData\Local\LogMeInIgnition
2014-05-26 14:14 - 2014-03-16 23:32 - 00107368 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIRfsClientNP.dll
2014-05-26 14:14 - 2014-03-16 23:32 - 00092488 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIinit.dll
2014-05-26 14:14 - 2014-03-16 23:32 - 00035656 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIport.dll
2014-05-26 13:29 - 2012-04-05 01:41 - 00000000 ____D () C:\Users\robert\AppData\Roaming\stickies
2014-05-26 12:01 - 2014-05-26 12:01 - 00000780 _____ () C:\Users\robert\Desktop\JRT.txt
2014-05-26 00:18 - 2014-05-25 14:05 - 00001102 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-26 00:18 - 2013-08-14 11:51 - 00001102 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-26 00:18 - 2012-08-11 19:33 - 00002400 _____ () C:\Users\robert\Desktop\Google Chrome.lnk
2014-05-25 21:23 - 2012-05-22 03:01 - 00000000 ____D () C:\Users\robert\AppData\Local\CrashDumps
2014-05-25 21:18 - 2013-07-11 22:42 - 00000000 ____D () C:\Users\robert\AppData\Local\Greenshot
2014-05-25 17:58 - 2014-05-23 22:47 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-25 17:56 - 2014-05-23 23:05 - 00004341 _____ () C:\Windows\wininit.ini
2014-05-25 17:37 - 2014-05-23 22:47 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy
2014-05-25 17:35 - 2014-05-25 17:35 - 00001225 _____ () C:\Users\robert\Desktop\Spybot - Search & Destroy.lnk
2014-05-25 17:35 - 2014-05-25 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
2014-05-25 17:20 - 2014-05-23 20:50 - 00000000 ____D () C:\Program Files (x86)\PCTechHotline
2014-05-25 16:11 - 2014-05-25 16:05 - 00000000 ___SD () C:\32788R22FWJFW
2014-05-25 16:06 - 2014-05-25 16:06 - 00000331 _____ () C:\Start_.cmd
2014-05-25 15:18 - 2014-05-25 14:54 - 00000000 ____D () C:\Windows\erdnt
2014-05-25 15:15 - 2009-07-13 22:34 - 00000215 ____N () C:\Windows\system.ini
2014-05-25 15:13 - 2009-07-13 22:34 - 98041856 _____ () C:\Windows\system32\config\software.bak
2014-05-25 15:13 - 2009-07-13 22:34 - 28835840 _____ () C:\Windows\system32\config\system.bak
2014-05-25 15:13 - 2009-07-13 22:34 - 00524288 _____ () C:\Windows\system32\config\default.bak
2014-05-25 15:13 - 2009-07-13 22:34 - 00032768 _____ () C:\Windows\system32\config\security.bak
2014-05-25 15:13 - 2009-07-13 22:34 - 00024576 _____ () C:\Windows\system32\config\sam.bak
2014-05-25 14:45 - 2014-05-23 20:50 - 00000000 ____D () C:\Program Files (x86)\sweetpacks bundle uninstaller_AdwCleaner_1548942
2014-05-25 14:45 - 2014-05-22 18:11 - 00000000 ____D () C:\Users\robert\AppData\Roaming\MultiPar
2014-05-25 14:45 - 2014-05-22 18:07 - 00000000 ____D () C:\Program Files (x86)\ParNRar
2014-05-25 14:45 - 2014-05-02 00:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-25 14:45 - 2014-03-22 17:01 - 00000000 ____D () C:\Users\robert\AppData\Roaming\Baocg
2014-05-25 14:45 - 2014-03-16 21:48 - 00000000 ____D () C:\Windows\System32\Tasks\COMODO
2014-05-25 14:45 - 2014-01-28 11:40 - 00000000 ____D () C:\Users\robert\AppData\Local\LogMeIn Client
2014-05-25 14:45 - 2013-09-13 20:40 - 00000000 ____D () C:\Program Files\UltraMon
2014-05-25 14:45 - 2013-08-14 14:44 - 00000000 ____D () C:\Users\robert\AppData\Roaming\Easy Macro Recorder
2014-05-25 14:45 - 2013-08-14 14:44 - 00000000 ____D () C:\Program Files (x86)\Easy Macro Recorder
2014-05-25 14:45 - 2012-09-18 13:25 - 00000000 ____D () C:\Program Files (x86)\PA Server Monitor
2014-05-25 14:45 - 2012-05-02 02:48 - 00000000 ____D () C:\Windows\SysWOW64\Adobe
2014-05-25 14:45 - 2012-04-24 23:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-25 14:45 - 2012-04-09 00:04 - 00000000 ____D () C:\Program Files (x86)\NCH Software
2014-05-25 14:45 - 2012-04-04 23:12 - 00000000 ____D () C:\Users\robert\AppData\Roaming\Greenshot
2014-05-25 14:45 - 2012-04-04 22:38 - 00000000 ____D () C:\ProgramData\HP
2014-05-25 14:45 - 2012-04-04 16:05 - 00000000 ____D () C:\Program Files\Unlocker
2014-05-25 14:45 - 2012-04-04 01:18 - 00000000 ____D () C:\Users\robert\AppData\Roaming\Winamp
2014-05-25 14:45 - 2012-04-03 21:37 - 00000000 ____D () C:\Program Files\totalcmd
2014-05-25 14:45 - 2012-04-03 16:04 - 00000000 ___RD () C:\Users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-25 14:45 - 2012-04-03 16:04 - 00000000 ____D () C:\Users\robert
2014-05-25 14:45 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\registration
2014-05-25 14:45 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\AppCompat
2014-05-25 14:14 - 2014-05-24 22:33 - 00000000 ____D () C:\Users\Administrator.derr2
2014-05-25 14:13 - 2014-02-10 10:25 - 00000000 ____D () C:\Users\nx
2014-05-25 14:12 - 2014-05-24 12:45 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-05-25 14:11 - 2013-02-15 19:27 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-05-25 14:11 - 2012-04-03 21:58 - 00000000 ____D () C:\Program Files (x86)\Java
2014-05-25 12:54 - 2014-05-25 12:54 - 00018325 _____ () C:\Users\robert\Desktop\attach.txt
2014-05-25 12:29 - 2013-10-25 20:07 - 00000000 ____D () C:\ProgramData\Oracle
2014-05-25 12:28 - 2014-05-25 12:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-05-24 22:42 - 2014-05-24 22:42 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Local\Macromedia
2014-05-24 22:41 - 2014-05-24 22:41 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Roaming\Mozilla
2014-05-24 22:41 - 2014-05-24 22:41 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Local\Mozilla
2014-05-24 22:36 - 2014-05-24 22:36 - 00141288 _____ () C:\Users\Administrator.derr2\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-24 22:36 - 2014-05-24 22:34 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Roaming\Greenshot
2014-05-24 22:36 - 2014-04-02 23:55 - 00000000 ____D () C:\VTRoot
2014-05-24 22:35 - 2014-05-24 22:35 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Roaming\WinMount
2014-05-24 22:34 - 2014-05-24 22:34 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-05-24 22:34 - 2014-05-24 22:34 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Roaming\WTablet
2014-05-24 22:34 - 2014-05-24 22:34 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Roaming\Logitech
2014-05-24 22:34 - 2014-05-24 22:34 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Roaming\FLEXnet
2014-05-24 22:34 - 2014-05-24 22:34 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Roaming\Apple Computer
2014-05-24 22:34 - 2014-05-24 22:34 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Roaming\Adobe
2014-05-24 22:34 - 2014-05-24 22:34 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Local\LogMeIn
2014-05-24 22:34 - 2014-05-24 22:34 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Local\Greenshot
2014-05-24 22:34 - 2014-05-24 22:34 - 00000000 ____D () C:\Users\Administrator.derr2\AppData\Local\Adobe
2014-05-24 21:36 - 2014-05-24 21:36 - 00000000 ____D () C:\Windows\ERUNT
2014-05-24 14:00 - 2012-04-03 23:58 - 00000000 ____D () C:\Users\robert\AppData\Local\QuickPar
2014-05-24 12:47 - 2014-05-24 12:47 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-05-24 12:46 - 2014-05-24 12:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-05-24 00:17 - 2013-08-20 21:27 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LightScribe Direct Disc Labeling
2014-05-24 00:17 - 2013-06-24 23:02 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wacom Tablet
2014-05-24 00:17 - 2009-07-14 01:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-05-24 00:17 - 2009-07-14 01:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-24 00:17 - 2009-07-13 23:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-24 00:17 - 2009-07-13 23:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-05-24 00:17 - 2009-07-13 23:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-05-23 22:08 - 2012-04-04 15:24 - 00000000 ____D () C:\ProgramData\Skype
2014-05-23 21:48 - 2014-05-23 21:48 - 00000000 ____D () C:\Users\robert\AppData\Roaming\PC Tech Hotline
2014-05-23 20:59 - 2013-07-09 23:52 - 00000000 ____D () C:\Users\robert\AppData\Roaming\Wondershare
2014-05-23 18:40 - 2014-05-22 18:42 - 00000000 ____D () C:\Users\robert\AppData\Roaming\PAR Buddy
2014-05-22 23:48 - 2013-08-26 21:39 - 00000000 ____D () C:\Users\robert\AppData\Roaming\uTorrent
2014-05-22 18:42 - 2014-05-22 18:42 - 00000915 _____ () C:\Users\robert\Desktop\PAR Buddy.lnk
2014-05-22 18:42 - 2014-05-22 18:42 - 00000000 ____D () C:\Program Files (x86)\PAR Buddy
2014-05-22 18:25 - 2014-04-10 15:48 - 00000000 ____D () C:\Users\robert\AppData\Roaming\foobar2000
2014-05-22 18:25 - 2012-06-03 00:23 - 00030208 _____ () C:\Users\robert\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-05-22 18:11 - 2014-05-22 18:11 - 00000992 _____ () C:\Users\Public\Desktop\MultiPar.lnk
2014-05-22 18:11 - 2014-05-22 18:03 - 00000000 ____D () C:\Program Files (x86)\MultiPar
2014-05-22 18:07 - 2014-05-22 18:07 - 00000958 _____ () C:\Users\UpdatusUser\Desktop\ParNRar.lnk
2014-05-22 18:07 - 2014-05-22 18:07 - 00000958 _____ () C:\Users\robert\Desktop\ParNRar.lnk
2014-05-22 18:07 - 2014-05-22 18:07 - 00000958 _____ () C:\Users\nx\Desktop\ParNRar.lnk
2014-05-21 20:16 - 2012-04-03 22:02 - 00000000 ____D () C:\Users\robert\AppData\Roaming\Adobe
2014-05-19 00:13 - 2012-04-21 14:10 - 00101184 _____ (Amazon.com, Inc.) C:\Windows\system32\stkMonitor.dll
2014-05-19 00:13 - 2012-04-21 14:10 - 00000000 ____D () C:\Program Files (x86)\Amazon
2014-05-19 00:12 - 2014-05-19 00:12 - 00001062 _____ () C:\Users\robert\Desktop\Galaxy NexusCDMA 2 - Shortcut.lnk
2014-05-18 14:08 - 2014-05-18 14:08 - 00001066 _____ () C:\Users\robert\Desktop\LG HBS730 - Shortcut.lnk
2014-05-18 14:07 - 2014-05-18 14:07 - 00001078 _____ () C:\Users\robert\Desktop\Avantree Saturn - Shortcut.lnk
2014-05-15 19:38 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\rescache
2014-05-15 18:42 - 2014-05-15 18:37 - 00000000 ____D () C:\Users\robert\Documents\Native Instruments
2014-05-15 18:32 - 2014-05-15 18:32 - 00001009 _____ () C:\Users\Public\Desktop\Traktor 2.lnk
2014-05-15 18:32 - 2014-05-15 18:32 - 00000000 __HDC () C:\ProgramData\{5D7D8554-ADF2-463E-B6AC-7A857B390410}
2014-05-15 18:31 - 2014-05-15 18:31 - 00001101 _____ () C:\Users\Public\Desktop\Controller Editor.lnk
2014-05-15 18:31 - 2014-05-15 18:31 - 00000000 __HDC () C:\ProgramData\{E70FDE50-4AB8-4AF6-8E82-A7B843A3AD92}
2014-05-15 18:31 - 2014-05-15 18:30 - 00000000 ____D () C:\ProgramData\Native Instruments
2014-05-15 18:31 - 2014-05-15 18:30 - 00000000 ____D () C:\Program Files\Native Instruments
2014-05-15 18:31 - 2014-05-15 18:30 - 00000000 ____D () C:\Program Files\Common Files\Native Instruments
2014-05-15 18:30 - 2014-05-15 18:30 - 00001066 _____ () C:\Users\Public\Desktop\Service Center.lnk
2014-05-15 18:30 - 2014-05-15 18:30 - 00000000 __HDC () C:\ProgramData\{F2610326-6A40-4BBC-9FBC-7F05356A912A}
2014-05-15 15:13 - 2012-04-03 16:04 - 00000000 ___RD () C:\Users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-15 15:11 - 2014-04-30 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 03:06 - 2012-04-03 23:29 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-15 03:04 - 2013-08-14 03:00 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 03:01 - 2012-04-03 18:25 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-14 20:13 - 2014-03-01 14:54 - 00003839 _____ () C:\Users\robert\Documents\AutoHotkey.ahk
2014-05-14 01:13 - 2012-12-11 16:13 - 17938608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-14 01:13 - 2012-04-05 21:30 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 01:13 - 2012-04-05 21:30 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 01:13 - 2012-04-05 21:30 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-12 21:31 - 2014-05-03 18:02 - 00000000 ____D () C:\Users\robert\AppData\Roaming\Audacity
2014-05-09 02:14 - 2014-05-14 03:17 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 02:11 - 2014-05-14 03:17 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-06 19:22 - 2014-04-05 15:03 - 00000000 ____D () C:\Users\robert\AppData\Roaming\vlc
2014-05-06 00:40 - 2014-05-15 03:05 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 00:17 - 2014-05-15 03:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-05 23:25 - 2014-05-15 03:05 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-05 23:21 - 2012-08-11 19:31 - 00003888 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1235320012-531206643-3524170785-1000UA
2014-05-05 23:21 - 2012-08-11 19:31 - 00003492 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1235320012-531206643-3524170785-1000Core
2014-05-05 23:07 - 2014-05-15 03:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-05 23:00 - 2014-05-15 03:05 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-05 22:10 - 2014-05-15 03:05 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-05 18:55 - 2012-04-27 12:54 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-05 18:54 - 2012-04-27 12:54 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-03 21:25 - 2014-05-03 21:25 - 00000000 ____D () C:\Users\robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Elevayta Extra Boy v4.91d
2014-05-03 21:25 - 2014-05-03 21:25 - 00000000 ____D () C:\Program Files (x86)\Elevayta Creativity Tools
2014-05-03 20:58 - 2012-04-28 23:33 - 00000000 ____D () C:\Program Files (x86)\Sony
2014-05-03 20:15 - 2009-07-13 22:34 - 00000482 ____N () C:\Windows\win.ini
2014-05-03 20:14 - 2012-11-07 22:05 - 00000000 ____D () C:\Users\robert\Documents\MAGIX_ACLab15_deluxe_Download_version
2014-05-03 18:02 - 2014-05-03 18:02 - 00000974 _____ () C:\Users\Public\Desktop\Audacity.lnk
2014-05-03 18:02 - 2014-05-03 18:02 - 00000000 ____D () C:\Program Files (x86)\Audacity
2014-05-02 13:34 - 2009-07-14 01:08 - 00032598 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-01 16:29 - 2012-05-25 02:11 - 00000008 _____ () C:\ProgramData\peeddy.log
2014-05-01 16:27 - 2013-12-29 17:24 - 00000000 ____D () C:\Program Files (x86)\Samsung
2014-04-30 17:37 - 2014-04-29 16:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-04-30 14:54 - 2014-04-30 14:54 - 00000000 ____D () C:\Users\robert\AppData\Local\MPlayer
2014-04-30 14:54 - 2014-04-30 14:54 - 00000000 ____D () C:\MININT
2014-04-30 14:52 - 2014-04-30 14:52 - 00000258 __RSH () C:\ProgramData\ntuser.pol
2014-04-30 14:52 - 2009-07-13 23:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-04-30 14:52 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-04-29 15:31 - 2014-04-29 15:31 - 00000000 __SHD () C:\Users\robert\AppData\Local\EmieUserList
2014-04-29 15:31 - 2014-04-29 15:31 - 00000000 __SHD () C:\Users\robert\AppData\Local\EmieSiteList
2014-04-29 15:22 - 2012-07-28 15:50 - 00000000 ____D () C:\ProgramData\Samsung
2014-04-29 00:09 - 2012-05-30 17:45 - 00001456 _____ () C:\Users\robert\AppData\Local\Adobe Save for Web 13.0 Prefs
2014-04-28 22:18 - 2013-01-17 13:46 - 00001057 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk

Some content of TEMP:
====================
C:\Users\robert\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== BCD ================================

Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=C:
path                    \bootmgr
description             Windows Boot Manager
locale                  en-US
default                 {current}
resumeobject            {b8146f20-a538-11e1-a19d-806e6f6e6963}
displayorder            {current}
timeout                 30

Windows Boot Loader
-------------------
identifier              {current}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7 Home Premium (recovered)
locale                  en-US
recoverysequence        {db425c96-a554-11e1-9322-9e3295d8f401}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {b8146f20-a538-11e1-a19d-806e6f6e6963}

Windows Boot Loader
-------------------
identifier              {db425c96-a554-11e1-9322-9e3295d8f401}
device                  ramdisk=[C:]\Recovery\9e9a11e7-7de8-11e1-a7cf-ba5468d8df9a\Winre.wim,{db425c97-a554-11e1-9322-9e3295d8f401}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment (recovered) 
locale                  
osdevice                ramdisk=[C:]\Recovery\9e9a11e7-7de8-11e1-a7cf-ba5468d8df9a\Winre.wim,{db425c97-a554-11e1-9322-9e3295d8f401}
systemroot              \windows
winpe                   Yes

Resume from Hibernate
---------------------
identifier              {b8146f20-a538-11e1-a19d-806e6f6e6963}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows 7 Home Premium (recovered) 
locale                  en-US
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Windows Memory Tester
---------------------
identifier              {memdiag}
device                  partition=C:
path                    \boot\memtest.exe
description             Windows Memory Diagnostic
locale                  en-US

Device options
--------------
identifier              {db425c97-a554-11e1-9322-9e3295d8f401}
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\9e9a11e7-7de8-11e1-a7cf-ba5468d8df9a\boot.sdi



LastRegBack: 2014-05-19 01:02

==================== End Of Log ============================