no subject email

Hello,
I got a no subject email from a friend and I opened it (sigh). Which it contained a link I did not click, after reading around I found that I could still be infected with something. I did have noscript on but I'm still worried. Thank you for your time. Here is my logs.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:43:25 AM, on 6/18/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18470)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\ATK0100\HControl.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Symantec AntiVirus\VPTray.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\ATK0100\ATKOSD.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe
C:\Program Files\Symantec AntiVirus\vpc32.exe
C:\Program Files\Symantec AntiVirus\SavUI.exe
C:\Windows\system32\werfault.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [HControl] C:\Windows\ATK0100\HControl.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: hpzrcv01.LNK = C:\Program Files\HP\Temp\{706BB40A-4102-4c89-8107-DC68C4EBD19B}\setup\hpzstub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 5734 bytes

2007 Microsoft Office system
32 Bit HP CIO Components Installer
Activation Assistant for the 2007 Microsoft Office suites
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Reader 9.3
AIM 6
ATK0100 ACPI UTILITY
BisonCam
CCleaner (remove only)
Comcast High-Speed Internet Install Wizard
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
EA Download Manager
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Java(TM) 6 Update 18
LiveUpdate 3.2 (Symantec Corporation)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Hybrid 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Office Word Viewer 2003
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.5.9)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Realtek High Definition Audio Driver
Scientific-Atlanta WebSTAR 2000 series Cable Modem
SPORE™
Symantec AntiVirus
TGA Convert 1.3
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Ventrilo Client
Viewpoint Media Player
Winamp (remove only)
World of Warcraft

Hi zsolta,

Welcome to the forum.

My nickname is deltalima and I will be helping you with your computer problems.

The logs can take some time to research, so please be patient with me.

Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.


Please note the following:

• I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• If after 3 days you have not responded to this topic, it will be closed, and you will need to start a new one.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

Please Note:
The programs I ask you to run need to be run in Administrator Mode by... Right clicking the program file and selecting: Run as Administrator.
Additionally, the built-in User Account Control (UAC) utility, if enabled, may prompt you for permission to run the program.
When prompted, please select: Allow. Reference: User Account Control (UAC) and Running as Administrator

Security Check

• Download Security Check by screen317 from:
  
  • Link 1
  • Link 2
• Save it to your Desktop.
• Right click SecurityCheck.exe And select " Run as administrator " , then follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt
• Please post the contents of that document.

Please download GMER Rootkit Scanner from here.

• Right click the .exe file and select Run as Administrator. If asked to allow gmer.sys driver to load, please consent
• If it gives you a warning at program start about rootkit activity and asks if you want to run a scan...click NO.
• Run Gmer again and click on the Rootkit tab.
• Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive.
• Make sure all other boxes on the right of the screen are checked, EXCEPT for "Show All".
• Click on the "Scan" and wait for the scan to finish.
  Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan.
• When completed, click on the Copy button and right-click on your Desktop, choose "New" > Text document. Once the file is created, open it and right-click again and choose Paste or Ctrl+V. Save the file as gmer.txt and copy the information in your next reply.
• Note: If you have any problems, try running GMER in SAFE MODE

Important! Please do not select the "Show all" checkbox during the scan..

Please post the GMER log along with checkup.txt in your next reply.

Hello Deltalima,
I look forward to working with you. I have the scan for Security Check, However when i try to run GMER in Save Mode I get an error that says it has stopped running.
Here is my security check

Results of screen317's Security Check version 0.99.4
Windows Vista Service Pack 1 (UAC is enabled)
Out of date service pack!!
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Symantec AntiVirus
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
HijackThis 2.0.2
CCleaner (remove only)
Java(TM) 6 Update 18
Out of date Java installed!
Adobe Flash Player 9 (Out of date Flash Player installed!)
Adobe Flash Player 10.0.42.34
Adobe Reader 9.3
Mozilla Firefox (3.5.9) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Norton ccSvcHst.exe
Windows Defender MSASCui.exe
Symantec AntiVirus DefWatch.exe
Symantec AntiVirus Rtvscan.exe
Symantec AntiVirus VPTray.exe
Windows Defender MSASCui.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

Hi zsolta,

Scan With RKUnHooker

• Please Download Rootkit Unhooker Save it to your desktop.
• Now right click on RKUnhookerLE.exe and select "Run As Administrator".
• Click the Report tab, then click Scan.
• Check (Tick) Drivers, Stealth, Files, Code Hooks. Uncheck the rest. then Click OK.
• Wait till the scanner has finished and then click File, Save Report.
• Save the report somewhere where you can find it. Click Close.
• Copy the entire contents of the report and paste it in a reply here.

RSIT (Random's System Information Tool)

Please download RSIT by random/random... and save it to your desktop.

• Right click on RSIT.exe and select "Run As Administrator" to run it. If Windows UAC prompts you, please allow it.
• Please read the disclaimer... click on Continue.
• RSIT will start running. When done... 2 logs files...will be produced.
• The first one, "log.txt", << will be maximized
• The second one, "info.txt", << will be minimized.

Please post both... "log.txt" and "info.txt", file contents in your next reply.
(These logs can be lengthy, so post 1 log per reply please.)

Hello,

here is RKUnHooker (part one, sorry it was too long)

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows Vista
Version 6.0.6001 (Service Pack 1)
Number of processors #2
==============================================
>Drivers
==============================================
0x89E05000 C:\Windows\system32\DRIVERS\atikmdag.sys 7897088 bytes (ATI Technologies Inc., ATI Radeon Kernel Mode Driver)
0x82045000 C:\Windows\system32\ntkrnlpa.exe 3903488 bytes (Microsoft Corporation, NT Kernel & System)
0x82045000 PnpManager 3903488 bytes
0x82045000 RAW 3903488 bytes
0x82045000 WMIxWDM 3903488 bytes
0x8A604000 C:\Windows\system32\DRIVERS\NETw3v32.sys 2265088 bytes (Intel Corporation, Intel® Wireless WiFi Link Driver)
0x9B2D0000 Win32k 2105344 bytes
0x9B2D0000 C:\Windows\System32\win32k.sys 2105344 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0x8BA49000 C:\Windows\system32\drivers\RTKVHDA.sys 1650688 bytes (Realtek Semiconductor Corp., Realtek(r) High Definition Audio Function Driver)
0x8C600000 C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20100617.003\NAVEX15.SYS 1343488 bytes (Symantec Corporation, AV Engine)
0x8620B000 C:\Windows\System32\Drivers\Ntfs.sys 1110016 bytes (Microsoft Corporation, NT File System Driver)
0x8267F000 C:\Windows\system32\drivers\ndis.sys 1093632 bytes (Microsoft Corporation, NDIS 6.0 wrapper driver)
0x8BE5C000 C:\Windows\system32\DRIVERS\smserial.sys 1011712 bytes (Motorola Inc., Motorola SM56 Modem WDM Driver)
0x8600B000 C:\Windows\System32\drivers\tcpip.sys 954368 bytes (Microsoft Corporation, TCP/IP Driver)
0x804C3000 C:\Windows\system32\CI.dll 917504 bytes (Microsoft Corporation, Code Integrity Module)
0x9FAD5000 C:\Windows\system32\drivers\peauth.sys 909312 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)
0x8CA05000 C:\Windows\System32\Drivers\BisonCam.sys 806912 bytes (Bison Electronics. Inc. , Universal Serial Bus Camera Driver)
0x9E806000 C:\Windows\system32\drivers\spsys.sys 716800 bytes (Microsoft Corporation, security processor)
0x8611E000 C:\Windows\System32\drivers\dxgkrnl.sys 651264 bytes (Microsoft Corporation, DirectX Graphics Kernel)
0x80603000 C:\Windows\system32\drivers\Wdf01000.sys 507904 bytes (Microsoft Corporation, WDF Dynamic)
0x8260E000 C:\Windows\System32\Drivers\ksecdd.sys 462848 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0x9E90C000 C:\Windows\system32\drivers\HTTP.sys 446464 bytes (Microsoft Corporation, HTTP Protocol Stack)
0x94E33000 C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys 417792 bytes (Symantec Corporation, SPBBC Driver)
0x80409000 C:\Windows\system32\mcupdate_GenuineIntel.dll 393216 bytes (Microsoft Corporation, Intel Microcode Update Library)
0x94EDF000 C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 385024 bytes (Symantec Corporation, Symantec Eraser Control Driver)
0x9FA87000 C:\Windows\System32\DRIVERS\srv.sys 319488 bytes (Microsoft Corporation, Server driver)
0x8A8D1000 C:\Windows\system32\DRIVERS\rixdptsk.sys 311296 bytes (REDC, RICOH XD SM Driver)
0x80735000 C:\Windows\System32\drivers\volmgrx.sys 303104 bytes (Microsoft Corporation, Volume Manager Extension Driver)
0x8BF60000 C:\Windows\System32\Drivers\SRTSP.SYS 299008 bytes (Symantec Corporation, Symantec AutoProtect)
0x8C7B1000 C:\Windows\system32\drivers\afd.sys 294912 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x8068C000 C:\Windows\system32\drivers\acpi.sys 286720 bytes (Microsoft Corporation, ACPI Driver for NT)
0x80482000 C:\Windows\system32\CLFS.SYS 266240 bytes (Microsoft Corporation, Common Log File System Driver)
0x8A9AF000 C:\Windows\system32\DRIVERS\storport.sys 266240 bytes (Microsoft Corporation, Microsoft Storage Port Driver)
0x8A838000 C:\Windows\system32\DRIVERS\USBPORT.SYS 253952 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0x94E99000 C:\Windows\system32\DRIVERS\rdbss.sys 245760 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0x8CAE3000 C:\Windows\System32\Drivers\bthport.sys 237568 bytes (Microsoft Corporation, Bluetooth Bus Driver)
0x827B5000 C:\Windows\system32\drivers\NETIO.SYS 237568 bytes (Microsoft Corporation, Network I/O Subsystem)
0x9FA0F000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 233472 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr)
0x8631A000 C:\Windows\system32\drivers\volsnap.sys 233472 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0x8BA04000 C:\Windows\system32\DRIVERS\usbhub.sys 212992 bytes (Microsoft Corporation, Default Hub Driver for USB)
0x82012000 ACPI_HAL 208896 bytes
0x82012000 C:\Windows\system32\hal.dll 208896 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0x807CA000 C:\Windows\system32\drivers\fltmgr.sys 204800 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0x8BFBA000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver)
0x8A981000 C:\Windows\system32\DRIVERS\msiscsi.sys 188416 bytes (Microsoft Corporation, Microsoft iSCSI Initiator Driver)
0x8BE0A000 C:\Windows\system32\drivers\portcls.sys 184320 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0x94E07000 C:\Windows\System32\Drivers\SYMTDI.SYS 180224 bytes (Symantec Corporation, Network Dispatch Driver)
0x8278A000 C:\Windows\system32\drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider)
0x805B3000 C:\Windows\system32\DRIVERS\ks.sys 172032 bytes (Microsoft Corporation, Kernel CSA Library)
0x9E8C5000 C:\Windows\system32\DRIVERS\nwifi.sys 172032 bytes (Microsoft Corporation, NativeWiFi Miniport Driver)
0x8636A000 C:\Windows\System32\drivers\ecache.sys 159744 bytes (Microsoft Corporation, Special Memory Device Cache)
0x806E3000 C:\Windows\system32\drivers\pci.sys 159744 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0x9FA60000 C:\Windows\System32\DRIVERS\srv2.sys 159744 bytes (Microsoft Corporation, Smb 2.0 Server driver)
0x8BE37000 C:\Windows\system32\drivers\drmk.sys 151552 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0x8A5CE000 C:\Windows\system32\DRIVERS\ndiswan.sys 143360 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0x8C751000 C:\Windows\system32\Drivers\SYMEVENT.SYS 139264 bytes (Symantec Corporation, Symantec Event Library)
0x863A2000 C:\Windows\system32\drivers\CLASSPNP.SYS 135168 bytes (Microsoft Corporation, SCSI Class System Dll)
0x8CB75000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver)
0x9E9CD000 C:\Windows\system32\drivers\mrxdav.sys 131072 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0x94FCD000 C:\Windows\system32\DRIVERS\mrxsmb.sys 126976 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0x807AC000 C:\Windows\system32\drivers\ataport.SYS 122880 bytes (Microsoft Corporation, ATAPI Driver Extension)
0x94F3D000 C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 118784 bytes (Symantec Corporation, Symantec Eraser Utility Driver)
0x9E979000 C:\Windows\System32\DRIVERS\srvnet.sys 118784 bytes (Microsoft Corporation, Server Network driver)
0x860F4000 C:\Windows\System32\drivers\fwpkclnt.sys 110592 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API)
0x94FAA000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver)
0x8CB4F000 C:\Windows\system32\DRIVERS\bthpan.sys 106496 bytes (Microsoft Corporation, Bluetooth Personal Area Networking)
0x8A8A3000 C:\Windows\system32\DRIVERS\sdbus.sys 106496 bytes (Microsoft Corporation, SecureDigital Bus Driver)
0x9E99F000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver)
0x8A963000 C:\Windows\system32\DRIVERS\cdrom.sys 98304 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0x9FA48000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 98304 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector)
0x94F5A000 C:\Windows\System32\Drivers\dfsc.sys 94208 bytes (Microsoft Corporation, DFS Namespace Client Driver)
0x8A5AC000 C:\Windows\system32\DRIVERS\rasl2tp.sys 94208 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0x9FBDD000 C:\Windows\system32\DRIVERS\cdfs.sys 90112 bytes (Microsoft Corporation, CD-ROM File System Driver)
0x8BBDC000 C:\Windows\system32\DRIVERS\pacer.sys 90112 bytes (Microsoft Corporation, QoS Packet Scheduler)
0x8CBC8000 C:\Windows\system32\DRIVERS\tdx.sys 90112 bytes (Microsoft Corporation, TDI Translation Driver)
0x9E9B8000 C:\Windows\System32\drivers\mpsdrv.sys 86016 bytes (Microsoft Corporation, Microsoft Protection Service Driver)
0x861D1000 C:\Windows\system32\DRIVERS\rassstp.sys 86016 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager)
0x9FBC9000 C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20100617.003\NAVENG.SYS 81920 bytes (Symantec Corporation, AV Engine)
0x861BD000 C:\Windows\system32\DRIVERS\raspptp.sys 81920 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0x8CBDE000 C:\Windows\system32\DRIVERS\smb.sys 81920 bytes (Microsoft Corporation, SMB Transport driver)
0x8A92C000 C:\Windows\system32\DRIVERS\i8042prt.sys 77824 bytes (Microsoft Corporation, i8042 Port Driver)
0x9E8F9000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6)
0x8BFEC000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0x8A59A000 C:\Windows\system32\DRIVERS\HDAudBus.sys 73728 bytes (Microsoft Corporation, High Definition Audio Bus Driver)
0x86391000 C:\Windows\system32\drivers\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver)
0x8BA38000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy)
0x80469000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver)
0x8CB26000 C:\Windows\system32\DRIVERS\rfcomm.sys 69632 bytes (Microsoft Corporation, Bluetooth RFCOMM Driver)
0x8BFA9000 C:\Windows\System32\Drivers\SRTSPX.SYS 69632 bytes (Symantec Corporation, Symantec AutoProtect)
0x805A3000 C:\Windows\system32\drivers\fileinfo.sys 65536 bytes (Microsoft Corporation, FileInfo Filter Driver)
0x8C790000 C:\Windows\system32\DRIVERS\HIDCLASS.SYS 65536 bytes (Microsoft Corporation, Hid Class Library)
0x9E8B5000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver)
0x80794000 C:\Windows\System32\drivers\mountmgr.sys 65536 bytes (Microsoft Corporation, Mount Point Manager)
0x8A885000 C:\Windows\system32\DRIVERS\ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)
0x861E6000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Terminal Server Driver)
0x8610F000 C:\Windows\system32\DRIVERS\intelppm.sys 61440 bytes (Microsoft Corporation, Processor Device Driver)
0x94F9B000 C:\Windows\system32\DRIVERS\monitor.sys 61440 bytes (Microsoft Corporation, Monitor Driver)
0x8635B000 C:\Windows\System32\Drivers\mup.sys 61440 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0x8070A000 C:\Windows\System32\drivers\partmgr.sys 61440 bytes (Microsoft Corporation, Partition Management Driver)
0x8A5F1000 C:\Windows\system32\DRIVERS\raspppoe.sys 61440 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0x8A91D000 C:\Windows\system32\DRIVERS\Rtlh86.sys 61440 bytes (Realtek Corporation, Realtek 8101/8168/8169 NDIS6 32-bit Driver)
0x8A876000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0x80726000 C:\Windows\system32\drivers\volmgr.sys 61440 bytes (Microsoft Corporation, Volume Manager Driver)
0x8A895000 C:\Windows\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)
0x9B510000 C:\Windows\System32\cdd.dll 57344 bytes (Microsoft Corporation, Canonical Display Driver)
0x8CBF2000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver)
0x8CBB1000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver)
0x80786000 C:\Windows\system32\drivers\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0x8A955000 C:\Windows\system32\drivers\tpm.sys 57344 bytes (Microsoft Corporation, TPM Device Driver)
0x94F71000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver)
0x8BF53000 C:\Windows\system32\drivers\modem.sys 53248 bytes (Microsoft Corporation, Modem Device Driver)
0x8A8C4000 C:\Windows\system32\DRIVERS\rimsptsk.sys 53248 bytes (REDC, RICOH MS Driver)
0x8CACA000 C:\Windows\System32\Drivers\STREAM.SYS 53248 bytes (Microsoft Corporation, WDM CODEC Class Device Driver 2.0)
0x827EF000 C:\Windows\system32\DRIVERS\umbus.sys 53248 bytes (Microsoft Corporation, User-Mode Bus Enumerator)
0x8A58D000 C:\Windows\System32\drivers\watchdog.sys 53248 bytes (Microsoft Corporation, Watchdog Driver)
0x8067F000 C:\Windows\system32\drivers\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR)
0x8CAD7000 C:\Windows\System32\Drivers\BTHUSB.sys 49152 bytes (Microsoft Corporation, Bluetooth Miniport Driver)
0x9FBBD000 C:\Windows\System32\drivers\tcpipreg.sys 49152 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver)
0x8CB69000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0x94F7E000 C:\Windows\System32\Drivers\dump_dumpata.sys 45056 bytes
0x8A93F000 C:\Windows\system32\DRIVERS\kbdclass.sys 45056 bytes (Microsoft Corporation, Keyboard Class Driver)
0x8A94A000 C:\Windows\system32\DRIVERS\mouclass.sys 45056 bytes (Microsoft Corporation, Mouse Class Driver)
0x8CBA6000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver)
0x8A5C3000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0x8A9F0000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper)
0x863EC000 C:\Windows\system32\DRIVERS\tunnel.sys 45056 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x8A82D000 C:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0x8071C000 C:\Windows\system32\DRIVERS\BATTC.SYS 40960 bytes (Microsoft Corporation, Battery Class Driver)
0x8CB3E000 C:\Windows\system32\DRIVERS\BthEnum.sys 40960 bytes (Microsoft Corporation, Bluetooth Bus Extender)
0x94F91000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver)
0x86200000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver)
0x9E8EF000 C:\Windows\system32\DRIVERS\ndisuio.sys 40960 bytes (Microsoft Corporation, NDIS User mode I/O driver)
0x94ED5000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy)
0x9FBB3000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
0x9E996000 C:\Windows\system32\DRIVERS\asyncmac.sys 36864 bytes (Microsoft Corporation, MS Remote Access serial network driver)
0x863C3000 C:\Windows\system32\drivers\crcdisk.sys 36864 bytes (Microsoft Corporation, Disk Block Verification Filter Driver)
0x8CB1D000 C:\Windows\System32\Drivers\Fs_Rec.SYS 36864 bytes (Microsoft Corporation, File System Recognizer Driver)
0x8C787000 C:\Windows\system32\DRIVERS\hidusb.sys 36864 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0x9FA00000 C:\Windows\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0x8CBBF000 C:\Windows\System32\DRIVERS\rasacd.sys 36864 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0x9B4F0000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver)
0x863F7000 C:\Windows\system32\DRIVERS\tunmp.sys 36864 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x806D2000 C:\Windows\system32\drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0x807A4000 C:\Windows\system32\drivers\atapi.sys 32768 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver)
0x8047A000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver)
0x94F89000 C:\Windows\System32\Drivers\dump_atapi.sys 32768 bytes
0x80401000 C:\Windows\system32\kdcom.dll 32768 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0x8C7A9000 C:\Windows\system32\DRIVERS\mouhid.sys 32768 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0x806DB000 C:\Windows\system32\drivers\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver)
0x8CB96000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x8CB9E000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x86353000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor)
0x8CB48000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver)
0x8C7A0000 C:\Windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0x8077F000 C:\Windows\system32\drivers\intelide.sys 28672 bytes (Microsoft Corporation, Intel PCI IDE Driver)
0x8CB37000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver)
0x8A8BD000 C:\Windows\system32\DRIVERS\rimmptsk.sys 28672 bytes (REDC, RICOH MMC Driver)
0x9FBF3000 C:\Windows\System32\Drivers\SYMREDRV.SYS 24576 bytes (Symantec Corporation, Redirector Filter Driver)
0x8A97B000 C:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)
0x80719000 C:\Windows\system32\DRIVERS\compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver)
0x8A97F000 C:\Windows\system32\DRIVERS\ATKACPI.sys 8192 bytes (-, ATK0100 ACPI Utility)
0x8A9FB000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0x8C7A7000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
==============================================
>Stealth
==============================================
0x01BC0000 Hidden Image-->CLI.Component.Runtime.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 102400 bytes
0x065C0000 Hidden Image-->CLI.Aspect.Radeon3D.Graphics.Wizard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 102400 bytes
0x009A0000 Hidden Image-->MOM.Implementation.DLL [ EPROCESS 0x83DFA858 ] PID: 2620, 110592 bytes
0x01B80000 Hidden Image-->MOM.Implementation.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 110592 bytes
0x07030000 Hidden Image-->CLI.Aspect.DeviceTV.Graphics.Wizard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 110592 bytes
0x068E0000 Hidden Image-->CLI.Aspect.DisplaysOptions.Graphics.Dashboard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 126976 bytes
0x07950000 Hidden Image-->CLI.Component.Dashboard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 1413120 bytes
0x07490000 Hidden Image-->CLI.Aspect.Welcome.Graphics.Dashboard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 143360 bytes
0x06D50000 Hidden Image-->CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 151552 bytes
0x07600000 Hidden Image-->CLI.Aspect.DisplaysManager.Graphics.Wizard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 1683456 bytes
0x072D0000 Hidden Image-->CLI.Aspect.InfoCentre.Graphics.Wizard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 192512 bytes
0x074C0000 Hidden Image-->CLI.Aspect.InfoCentre.Graphics.Dashboard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 217088 bytes
0x03FC0000 Hidden Image-->CLI.Caste.Graphics.Runtime.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 233472 bytes
0x01AC0000 Hidden Image-->MOM.Foundation.DLL [ EPROCESS 0x83DFA858 ] PID: 2620, 28672 bytes
0x01B00000 Hidden Image-->LOG.Foundation.Implementation.Private.DLL [ EPROCESS 0x83DFA858 ] PID: 2620, 28672 bytes
0x07150000 Hidden Image-->CLI.Component.Dashboard.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x00680000 Hidden Image-->MOM.Foundation.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x006C0000 Hidden Image-->LOG.Foundation.Implementation.Private.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x01C30000 Hidden Image-->CLI.Foundation.Private.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x03E80000 Hidden Image-->AEM.Server.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x03E90000 Hidden Image-->DEM.Foundation.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x04A30000 Hidden Image-->DEM.OS.I0602.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x04BA0000 Hidden Image-->DEM.OS.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x04BB0000 Hidden Image-->DEM.Graphics.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x05290000 Hidden Image-->CLI.Aspect.HotkeysHandling.Graphics.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x05280000 Hidden Image-->CLI.Aspect.HotkeysHandling.Graphics.Runtime.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x053D0000 Hidden Image-->CLI.Caste.Graphics.Runtime.Shared.Private.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x05420000 Hidden Image-->CLI.Aspect.DeviceProperty.Graphics.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x06540000 Hidden Image-->CLI.Component.Wizard.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x06530000 Hidden Image-->CLI.Component.Client.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x065B0000 Hidden Image-->CLI.Caste.Graphics.Wizard.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x06600000 Hidden Image-->atixclib.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x07020000 Hidden Image-->Branding.dll [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x07330000 Hidden Image-->CLI.Caste.Graphics.Dashboard.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x07300000 Hidden Image-->CLI.Component.Dashboard.Shared.Private.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 28672 bytes
0x064D0000 Hidden Image-->CLI.Component.Systemtray.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 290816 bytes
0x04EA0000 Hidden Image-->ATIDEMGX.dll [ EPROCESS 0x8406AD90 ] PID: 3792, 315392 bytes
0x06790000 Hidden Image-->CLI.Aspect.DeviceLCD.Graphics.Wizard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 315392 bytes
0x06BA0000 Hidden Image-->CLI.Aspect.Radeon3D.Graphics.Dashboard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 348160 bytes
0x04430000 Hidden Image-->NEWAEM.Foundation.DLL [ EPROCESS 0x83DFA858 ] PID: 2620, 36864 bytes
0x00390000 Hidden Image-->CCC.Implementation.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 36864 bytes
0x01BB0000 Hidden Image-->CLI.Foundation.XManifest.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 36864 bytes
0x01C50000 Hidden Image-->AEM.Foundation.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 36864 bytes
0x03E00000 Hidden Image-->NEWAEM.Foundation.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 36864 bytes
0x04A10000 Hidden Image-->ACE.Graphics.DisplaysManager.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 36864 bytes
0x05400000 Hidden Image-->CLI.Aspect.CustomFormats.Graphics.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 36864 bytes
0x05410000 Hidden Image-->CLI.Aspect.DeviceProperty.Graphics.Runtime.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 36864 bytes
0x05E10000 Hidden Image-->CLI.Aspect.DisplaysOptions.Graphics.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 36864 bytes
0x05DE0000 Hidden Image-->CLI.Aspect.DisplaysColour2.Graphics.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 36864 bytes
0x05E50000 Hidden Image-->CLI.Aspect.DeviceLCD.Graphics.Runtime.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 36864 bytes
0x05E60000 Hidden Image-->CLI.Aspect.DeviceLCD.Graphics.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 36864 bytes
0x06340000 Hidden Image-->CLI.Aspect.PowerPlayDPPE.Graphics.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 36864 bytes
0x06350000 Hidden Image-->APM.Foundation.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 36864 bytes
0x06560000 Hidden Image-->CLI.Component.Wizard.Shared.Private.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 36864 bytes
0x06980000 Hidden Image-->CLI.Aspect.DeviceLCD.Graphics.Dashboard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 405504 bytes
0x07260000 Hidden Image-->CLI.Aspect.MMVideo.Graphics.Wizard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 405504 bytes
0x07AB0000 Hidden Image-->CLI.Aspect.DisplaysManager.Graphics.Dashboard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 446464 bytes
0x009D0000 Hidden Image-->LOG.Foundation.DLL [ EPROCESS 0x83DFA858 ] PID: 2620, 45056 bytes
0x01B60000 Hidden Image-->LOG.Foundation.Private.DLL [ EPROCESS 0x83DFA858 ] PID: 2620, 45056 bytes
0x04420000 Hidden Image-->AEM.Server.DLL [ EPROCESS 0x83DFA858 ] PID: 2620, 45056 bytes
0x003C0000 Hidden Image-->LOG.Foundation.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 45056 bytes
0x006E0000 Hidden Image-->LOG.Foundation.Private.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 45056 bytes
0x01C20000 Hidden Image-->CLI.Component.Runtime.Shared.Private.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 45056 bytes
0x01C40000 Hidden Image-->ATICCCom.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 45056 bytes
0x01C60000 Hidden Image-->AEM.Server.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 45056 bytes
0x053E0000 Hidden Image-->CLI.Aspect.DeviceCV.Graphics.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 45056 bytes
0x05450000 Hidden Image-->CLI.Aspect.InfoCentre.Graphics.Runtime.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 45056 bytes
0x05E00000 Hidden Image-->CLI.Aspect.DisplaysOptions.Graphics.Runtime.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 45056 bytes
0x06190000 Hidden Image-->CLI.Aspect.DeviceDFP.Graphics.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 45056 bytes
0x06300000 Hidden Image-->CLI.Aspect.MMVideo.Graphics.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 45056 bytes
0x06710000 Hidden Image-->CLI.Component.Wizard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 479232 bytes
0x06900000 Hidden Image-->CLI.Aspect.DeviceCRT.Graphics.Dashboard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 487424 bytes
0x06FA0000 Hidden Image-->CLI.Aspect.TransCode.Graphics.Wizard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 495616 bytes
0x04B80000 Hidden Image-->DEM.Graphics.I0601.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 53248 bytes
0x061D0000 Hidden Image-->CLI.Aspect.Radeon3D.Graphics.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 53248 bytes
0x05AD0000 Hidden Image-->CLI.Aspect.DisplaysColour2.Graphics.Runtime.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 53248 bytes
0x05E20000 Hidden Image-->CLI.Aspect.DeviceCRT.Graphics.Runtime.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 53248 bytes
0x061F0000 Hidden Image-->CLI.Aspect.MMVideo.Graphics.Runtime.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 53248 bytes
0x06330000 Hidden Image-->CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 53248 bytes
0x06490000 Hidden Image-->CLI.Component.Client.Shared.Private.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 53248 bytes
0x06550000 Hidden Image-->CLI.Caste.Graphics.Wizard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 53248 bytes
0x065F0000 Hidden Image-->CLI.Aspect.TransCode.Graphics.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 53248 bytes
0x06C10000 Hidden Image-->CLI.Aspect.DisplaysColour2.Graphics.Dashboard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 585728 bytes
0x00690000 Hidden Image-->CLI.Foundation.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 61440 bytes
0x04A00000 Hidden Image-->CLI.Caste.Graphics.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 61440 bytes
0x04D30000 Hidden Image-->ATIDEMOS.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 61440 bytes
0x05AA0000 Hidden Image-->CLI.Aspect.InfoCentre.Graphics.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 61440 bytes
0x05E30000 Hidden Image-->CLI.Aspect.DeviceCRT.Graphics.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 61440 bytes
0x06180000 Hidden Image-->CLI.Aspect.DeviceDFP.Graphics.Runtime.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 61440 bytes
0x06A00000 Hidden Image-->CLI.Aspect.DeviceCV.Graphics.Dashboard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 659456 bytes
0x06CA0000 Hidden Image-->CLI.Aspect.MMVideo.Graphics.Dashboard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 667648 bytes
0x01AE0000 Hidden Image-->LOG.Foundation.Implementation.DLL [ EPROCESS 0x83DFA858 ] PID: 2620, 69632 bytes
0x006A0000 Hidden Image-->LOG.Foundation.Implementation.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 69632 bytes
0x053B0000 Hidden Image-->CLI.Aspect.DeviceCV.Graphics.Runtime.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 69632 bytes
0x05A80000 Hidden Image-->CLI.Aspect.DeviceTV.Graphics.Shared.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 69632 bytes
0x061B0000 Hidden Image-->CLI.Aspect.Radeon3D.Graphics.Runtime.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 69632 bytes
0x078A0000 Hidden Image-->CLI.Aspect.DeviceCV.Graphics.Wizard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 700416 bytes
0x05A60000 Hidden Image-->CLI.Aspect.DeviceTV.Graphics.Runtime.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 77824 bytes
0x07310000 Hidden Image-->CLI.Caste.Graphics.Dashboard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 86016 bytes
0x06AB0000 Hidden Image-->CLI.Aspect.DeviceTV.Graphics.Dashboard.DLL [ EPROCESS 0x8406AD90 ] PID: 3792, 921600 bytes
==============================================
>Files
==============================================
!-->[Hidden] C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{EA29F961-A6B6-48A4-828A-05A9BD804B3A}
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\BackgroundDownloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Battle.net.dll
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Blizzard Updater.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\BNUpdate.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\BackgroundDownload.torrent
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\baddons.wcf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\creaturecache.wdb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\gameobjectcache.wdb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\itemcache.wdb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\itemnamecache.wdb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\itemtextcache.wdb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\npccache.wdb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\pagetextcache.wdb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\questcache.wdb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Cache\WDB\enUS\wowcache.wdb
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\common-2.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\common.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\AccountBilling.url
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\backup-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\base-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\connection-help.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Credits.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Credits_BC.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Credits_LK.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\bg-botleft.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\bg-botright.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\bg-bottom.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\bg-left.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\bg-merge.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\bg-mergebot.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\bg-middle.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\bg-right.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\bg-top.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\Blizz.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\BLWidget.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\BRWidget.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\buttons\contactinfo-over.gif
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\buttons\contactinfo.gif
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\buttons\mac-over.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\buttons\mac.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\buttons\pc-over.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\buttons\pc.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\buttons\readme-over.gif
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\buttons\readme.gif
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\buttons\readme.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\buttons\troubleshooting-over.gif
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\buttons\troubleshooting.gif
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\buttons\troubleshooting.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\buttons\website-over.gif
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\buttons\website.gif
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\BWidget.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\CRepeat.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\dragon-left.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\dragon-right.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\gryphon-right.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\help-request.gif
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\ItemMarker.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\logo-blizzard.gif
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\logo-bnet.gif
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\logo-wow.gif
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\LRepeat.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\MacLogo.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\PCLogo.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\pixel.gif
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\RRepeat.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\splash.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\title-troubleshooting.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\titles\contactinfo-mac.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\titles\contactinfo-pc.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\titles\readme-mac.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\titles\readme-pc.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\titles\troubleshooting-mac.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\titles\troubleshooting-pc.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\TLWidget.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\TRWidget.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Images\TWidget.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Layout\BSpacer.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Layout\CSpacer.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Layout\Detector.js
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Layout\Greeting.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Layout\Index.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Layout\LBorder.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Layout\Nav.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Layout\RBorder.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Layout\Requirements.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Layout\Splash.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Layout\Styles.css
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Layout\StylesLeft.css
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Layout\TBorder.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Layout\TheScript.js
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Manual.pdf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Manual_TBC.pdf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Manual_WLK.pdf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\(Mac)Foreword.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\(Mac)Installation.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\(Mac)Patching.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\(Mac)ReadMeMenu.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\(Mac)SystemRequirements.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\(Mac)Uninstall.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\(PC)Foreword.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\(PC)Installation.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\(PC)Patching.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\(PC)ReadMeMenu.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\(PC)SystemRequirements.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\(PC)Uninstall.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\BasicCommands.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\CharacterNaming.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\EULA.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\GettingStarted.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\ManualErrata.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\ReadMe\RealmSelection.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Support\(Mac)SupportMenu.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Support\(Mac)TechnicalSupport.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Support\(PC)SupportMenu.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Support\(PC)TechnicalSupport.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Support\AccountAdministration.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Support\BlizzardInsider.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Support\Employment.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Support\GameSuggestions.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Support\GameSupport.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Support\Password.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(Mac)AudioProblems.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(Mac)BlizzardDownloaderProblems.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(Mac)ConnectionLoginProblems.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(Mac)GameplayProblems.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(Mac)Install.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(Mac)PreventiveMaintenance.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(Mac)StartupProblems.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(Mac)TroubleshootingMenu.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(Mac)VideoProblems.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(PC)AudioProblems.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(PC)BlizzardDownloaderProblems.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(PC)ConnectionLoginProblems.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(PC)GameplayProblems.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(PC)Install.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(PC)PreventiveMaintenance.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(PC)StartupProblems.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(PC)TroubleshootingMenu.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Documentation\Troubleshooting\(PC)VideoProblems.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\eula.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\expansion-locale-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\expansion-speech-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\Logo_1024.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\Logo_800.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_FotLK_1024.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_FotLK_800.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_Intro_1024.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_Intro_800.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_Intro_BC_1024.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_Intro_BC_800.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_Intro_LK_1024.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_Intro_LK_800.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_Wrathgate_1024.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\Interface\Cinematics\WOW_Wrathgate_800.avi
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\lichking-locale-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\lichking-speech-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\locale-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\patch-enUS-2.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\patch-enUS-3.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\patch-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\realmlist.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\speech-enUS.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\TechSupport.url
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\enUS\tos.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\expansion.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\lichking.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\patch-2.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\patch-3.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Data\patch.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\dbghelp.dll
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\DivxDecoder.dll
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\ijl15.dll
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_AchievementUI\Blizzard_AchievementUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_ArenaUI\Blizzard_ArenaUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_AuctionUI\Blizzard_AuctionUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_BarbershopUI\Blizzard_BarbershopUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_BattlefieldMinimap\Blizzard_BattlefieldMinimap.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_BindingUI\Blizzard_BindingUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_Calendar\Blizzard_Calendar.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_CombatLog\Blizzard_CombatLog.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_CombatText\Blizzard_CombatText.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_CraftUI\Blizzard_CraftUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_DebugTools\Blizzard_DebugTools.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_GlyphUI\Blizzard_GlyphUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_GMChatUI\Blizzard_GMChatUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_GMSurveyUI\Blizzard_GMSurveyUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_GuildBankUI\Blizzard_GuildBankUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_InspectUI\Blizzard_InspectUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_ItemSocketingUI\Blizzard_ItemSocketingUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_MacroUI\Blizzard_MacroUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_RaidUI\Blizzard_RaidUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_TalentUI\Blizzard_TalentUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_TimeManager\Blizzard_TimeManager.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_TokenUI\Blizzard_TokenUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_TradeSkillUI\Blizzard_TradeSkillUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Interface\AddOns\Blizzard_TrainerUI\Blizzard_TrainerUI.pub
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Launcher.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\BackgroundDownload.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\Blizzard Updater Log.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\connection.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\cpu.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\Downloader.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\FrameXML.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\gx.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\Launcher.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\SESound.log
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Logs\Wrath of the Lich King Install Log.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Microsoft.VC80.CRT.manifest
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\msvcr80.dll
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Patch.html
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Patch.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Repair.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Scan.dll
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Scan.dll.new
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_010308_191926.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_010408_114529.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_010408_213853.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_010508_195908.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_010508_195946.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_010508_200039.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_010509_221046.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_010509_221054.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_010509_221118.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_010808_222721.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_010910_134350.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_011409_213906.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_011810_151246.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_012109_185019.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_012609_172808.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_013108_183949.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_020508_010803.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_020508_011024.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_020508_211351.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_022008_005135.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_022008_010305.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_022008_010321.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_022308_180832.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_022508_143851.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_030508_172346.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_030910_233743.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_031008_133806.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_031008_185552.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_031108_005533.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_031409_143725.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_032009_203250.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_032609_205117.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_040108_230220.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_040608_191251.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_040610_145514.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_042009_123657.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_042108_094249.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_042809_142502.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_050208_213714.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_050208_213802.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_050208_213935.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_050308_173032.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_050308_182856.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_050408_170646.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_051008_110704.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_052108_154653.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_052108_154659.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_061308_091845.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_061408_163910.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_061808_201618.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_062809_203348.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_070609_201703.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_072108_102652.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_072308_223613.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_072308_223618.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_072708_173521.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_072708_173533.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_072907_235358.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_073107_180447.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_073108_101245.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_080107_011701.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_080107_233311.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_080307_150417.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_080407_234654.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_080607_000131.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_080607_013213.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_080607_013233.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_080607_124959.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_080807_233040.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_080808_205323.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_080907_134943.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_080907_143900.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_080907_152743.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_081007_152449.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_081007_154554.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_081009_164013.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_081107_205747.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_081107_205832.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_081107_205839.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_081108_184048.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_081108_184052.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_081108_184111.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_081108_184123.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_081207_163905.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_081307_233229.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_082207_125059.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_082207_170650.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_082207_180623.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_082307_012526.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_082307_021019.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_082307_233228.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_082407_180911.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_082407_183005.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_082409_135322.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_082409_135443.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_082907_012122.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_082907_121748.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_082908_180922.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_083007_010218.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_090407_201616.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_090509_195923.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_090707_125347.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_090709_130649.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_090709_130653.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_090709_134215.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_091007_100817.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_091007_100820.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_091007_100920.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_091007_110227.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_091007_110239.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_091107_115545.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_091107_115638.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_091307_172111.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_091307_172135.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_091307_172142.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_091307_231529.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_091707_230046.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_091907_135122.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_091907_210525.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_091907_234018.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_092007_001706.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_092007_001737.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_092607_180815.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_092807_032240.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_092807_032355.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_092807_032404.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_100307_124049.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_100307_124120.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_100707_195648.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_100809_205013.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_100907_212625.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_100907_214953.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_101407_224538.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_101407_230133.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_101707_195733.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_102108_001348.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_102507_160543.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_102509_231103.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_102607_173743.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_102607_212745.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_102807_191933.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_102807_191948.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_103107_172347.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_110109_114043.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_110109_114047.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_110609_181930.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_111809_235047.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_112908_144256.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_120107_232223.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_120207_120052.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_120207_223913.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_121009_173842.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_121208_011337.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_121307_140357.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_121707_012329.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_121809_153419.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_121809_153631.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_121809_173414.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_121809_174215.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_122407_212219.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_122509_184840.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_122607_192434.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_122607_222514.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Screenshots\WoWScrnShot_122908_235431.jpg
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\unicows.dll
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\wow-3.2.2-to-3.3.0-enUS-Win-patch\Blizzard Updater.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\wow-3.2.2-to-3.3.0-enUS-Win-patch\wow-final.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\wow-3.2.2-to-3.3.0-enUS-Win-patch\wow-partial-1.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\wow-3.2.2-to-3.3.0-enUS-Win-patch\wow-partial-2.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\wow-3.3.2-to-3.3.3-enUS-Win-patch\Blizzard Updater.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\wow-3.3.2-to-3.3.3-enUS-Win-patch\wow-final.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\wow-3.3.2-to-3.3.3-enUS-Win-patch\wow-partial-1.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Updates\wow-3.3.2-to-3.3.3-enUS-Win-patch\wow-partial-2.MPQ
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WDB\baddons.wcf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.0.10.6448-to-2.0.12.6546-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.0.10.6448-to-2.0.12.6546-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.0.12.6546-to-2.1.0.6692-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.0.3-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.0.3.6299-to-2.0.7.6383-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.0.3.6299-to-2.0.7.6383-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.0.7.6383-to-2.0.8.6403-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.0.7.6383-to-2.0.8.6403-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.0.8.6403-to-2.0.10.6448-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.0.8.6403-to-2.0.10.6448-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.1.0.6692-to-2.1.0.6729-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.1.0.6692-to-2.1.0.6729-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.1.0.6729-to-2.1.1.6739-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.1.0.6729-to-2.1.1.6739-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.1.1.6739-to-2.1.2.6803-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.1.1.6739-to-2.1.2.6803-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.1.2.6803-to-2.1.3.6898-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.1.2.6803-to-2.1.3.6898-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.1.3.6898-to-2.2.0.7272-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.2.0.7272-to-2.2.2.7318-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.2.0.7272-to-2.2.2.7318-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.2.2.7318-to-2.2.3.7359-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.2.2.7318-to-2.2.3.7359-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.2.3.7359-to-2.3.0.7561-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.3.0.7561-to-2.3.2.7741-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-2.3.0.7561-to-2.3.2.7741-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.2.2.10505-to-3.3.0.10958-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.0.10958-to-3.3.0.11159-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.0.10958-to-3.3.0.11159-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.0.11159-to-3.3.2.11403-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.0.11159-to-3.3.2.11403-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.2.11403-to-3.3.3.11685-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.3.11685-to-3.3.3.11723-enUS-downloader.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WoW-3.3.3.11685-to-3.3.3.11723-enUS-patch.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\Wow.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WowError.exe
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\config-cache.oldsynchronizeConfig
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Baileyevette\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Baileyevette\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Baileyevette\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Baileyevette\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Baileyevette\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Baileyevette\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Igetstabby\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Igetstabby\camera-settings.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Igetstabby\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Igetstabby\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Igetstabby\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Igetstabby\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Igetstabby\layout-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Igetstabby\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Igetstabby\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Igetstabby\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Igetstabby\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Igetstabby\SavedVariables\Blizzard_BattlefieldMinimap.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Igetstabby\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Igetstabby\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Izzieboo\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Izzieboo\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Izzieboo\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Izzieboo\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Izzieboo\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Izzieboo\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Izzieboo\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Izzieboo\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Izzieboo\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Izzieboo\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Morvishana\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Morvishana\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Morvishana\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Morvishana\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Morvishana\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Morvishana\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Seouli\camera-settings.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Seouli\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Seouli\layout-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Seouli\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Seouli\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sibbie\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sibbie\camera-settings.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sibbie\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sibbie\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sibbie\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sibbie\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sibbie\layout-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sibbie\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sibbie\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sibbie\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sibbie\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sibbie\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sibbie\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sibbie\SavedVariables\Blizzard_BattlefieldMinimap.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATHI\Dunemaul\Sibbie\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sibbie\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sunnah\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sunnah\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sunnah\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sunnah\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sunnah\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sunnah\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sunnah\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sunnah\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sunnah\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sunnah\SavedVariables\Blizzard_BattlefieldMinimap.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sunnah\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sunnah\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sylvinka\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sylvinka\camera-settings.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sylvinka\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sylvinka\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sylvinka\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sylvinka\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sylvinka\layout-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sylvinka\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sylvinka\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sylvinka\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sylvinka\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sylvinka\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sylvinka\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sylvinka\SavedVariables\Blizzard_BattlefieldMinimap.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sylvinka\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Sylvinka\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\camera-settings.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\layout-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\macros-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\SavedVariables\Blizzard_BattlefieldMinimap.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\SavedVariables\Blizzard_RaidUI.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\SavedVariables\Blizzard_RaidUI.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vials\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vokenstoke\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vokenstoke\camera-settings.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vokenstoke\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vokenstoke\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vokenstoke\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vokenstoke\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vokenstoke\layout-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vokenstoke\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vokenstoke\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vokenstoke\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vokenstoke\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Dunemaul\Vokenstoke\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Fenris\Balege\camera-settings.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Fenris\Balege\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Fenris\Balege\layout-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Fenris\Balege\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Fenris\Balege\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Frostmourne\Huggle\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Frostmourne\Huggle\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Frostmourne\Huggle\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Frostmourne\Huggle\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Frostmourne\Huggle\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Frostmourne\Huggle\SavedVariables\Blizzard_TimeManager.lua

RKUnHooker (part two)

!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\camera-settings.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\layout-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\SavedVariables\Blizzard_BattlefieldMinimap.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Aoii\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Janessa\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Janessa\camera-settings.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Janessa\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Janessa\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Janessa\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Janessa\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Janessa\layout-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Janessa\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Janessa\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Janessa\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Janessa\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Janessa\SavedVariables\Blizzard_BattlefieldMinimap.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Janessa\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Janessa\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Khorana\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Khorana\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Khorana\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Khorana\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Khorana\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Khorana\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Khorana\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Khorana\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Khorana\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Khorana\SavedVariables\Blizzard_BattlefieldMinimap.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Khorana\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Khorana\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\camera-settings.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\layout-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\SavedVariables\Blizzard_BattlefieldMinimap.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\SavedVariables\Blizzard_RaidUI.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lilic\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\camera-settings.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\layout-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\SavedVariables\Blizzard_BattlefieldMinimap.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\SavedVariables\Blizzard_RaidUI.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\SavedVariables\Blizzard_RaidUI.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Lillyorien\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Onions\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Onions\camera-settings.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Onions\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Onions\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Onions\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Onions\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Onions\layout-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Onions\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Onions\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Onions\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Onions\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Onions\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Onions\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Onions\SavedVariables\Blizzard_BattlefieldMinimap.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Onions\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Onions\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Pakawink\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Pakawink\camera-settings.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Pakawink\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Pakawink\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Pakawink\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Pakawink\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Pakawink\layout-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Pakawink\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Pakawink\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Pakawink\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Pakawink\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Pakawink\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Pakawink\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Pakawink\SavedVariables\Blizzard_BattlefieldMinimap.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Pakawink\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Pakawink\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Seouli\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Seouli\camera-settings.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Seouli\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Seouli\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Seouli\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Seouli\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Seouli\layout-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Seouli\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Seouli\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Seouli\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Seouli\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Seouli\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zetian\bindings-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zetian\bindings-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zetian\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zetian\camera-settings.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATHI\Jaedenar\Zetian\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zetian\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zetian\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zetian\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zetian\layout-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zetian\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zetian\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zetian\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zetian\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zetian\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zetian\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zetian\SavedVariables\Blizzard_BattlefieldMinimap.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zetian\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zetian\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\camera-settings.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\layout-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\SavedVariables\Blizzard_BattlefieldMinimap.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\SavedVariables\Blizzard_BattlefieldMinimap.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\SavedVariables\Blizzard_RaidUI.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\SavedVariables\Blizzard_RaidUI.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Jaedenar\Zsolta\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Kalecgos\Orein\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Kalecgos\Orein\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Kalecgos\Orein\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Kalecgos\Orein\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Kalecgos\Orein\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Kalecgos\Orein\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Kalecgos\Orein\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATHM\Kalecgos\Orein\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Kalecgos\Orein\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Laughing Skull\Akhta\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Laughing Skull\Akhta\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Laughing Skull\Akhta\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Laughing Skull\Akhta\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Laughing Skull\Akhta\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Laughing Skull\Akhta\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Laughing Skull\Lilic\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Laughing Skull\Lilic\camera-settings.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Laughing Skull\Lilic\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Laughing Skull\Lilic\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATHM\Laughing Skull\Lilic\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Laughing Skull\Lilic\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Laughing Skull\Lilic\layout-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Laughing Skull\Lilic\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Laughing Skull\Lilic\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Laughing Skull\Lilic\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Laughing Skull\Lilic\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Laughing Skull\Lilic\SavedVariables\Blizzard_TimeManager.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\macros-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\macros-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\macros-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Quel'dorei\Esmereldah\cache.md5
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Quel'dorei\Esmereldah\chat-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Quel'dorei\Esmereldah\chat-cache.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Quel'dorei\Esmereldah\config-cache.old
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Quel'dorei\Esmereldah\config-cache.wtf
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Quel'dorei\Esmereldah\layout-local.txt
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Quel'dorei\Esmereldah\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Quel'dorei\Esmereldah\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\Quel'dorei\Esmereldah\SavedVariables\Blizzard_TimeManager.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\SavedVariables.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\SavedVariables.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATHM\SavedVariables\Blizzard_AuctionUI.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\SavedVariables\Blizzard_CombatLog.lua
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\SavedVariables\Blizzard_CombatLog.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Account\DEATH\SavedVariables\Blizzard_TrainerUI.lua.bak
!-->[Hidden] C:\Users\Public\Games\World of Warcraft\WTF\Config.wtf
==============================================
>Hooks
==============================================
ntkrnlpa.exe+0x000B4EEA, Type: Inline - RelativeJump 0x820F9EEA-->820F9EF1 [ntkrnlpa.exe]
ntkrnlpa.exe+0x000B8B18, Type: Inline - RelativeJump 0x820FDB18-->820FDABD [ntkrnlpa.exe]

Lastly,
Here is my log.txt, however i did not get an info.txt. Thanks

Logfile of random's system information tool 1.07 (written by random/random)
Run by [removed] at 2010-06-23 02:05:05
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 49 GB (43%) free of 114 GB
Total RAM: 1023 MB (28% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:05:15 AM, on 6/23/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18470)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\ATK0100\HControl.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Symantec AntiVirus\VPTray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\ATK0100\ATKOSD.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Margie\Downloads\RSIT.exe
C:\Program Files\trend micro\Margie.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [HControl] C:\Windows\ATK0100\HControl.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: hpzrcv01.LNK = C:\Program Files\HP\Temp\{706BB40A-4102-4c89-8107-DC68C4EBD19B}\setup\hpzstub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 5651 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-02-07 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"HControl"=C:\Windows\ATK0100\HControl.exe [2006-04-17 110592]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2006-12-01 4186112]
"ccApp"=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2006-11-22 107112]
"vptray"=C:\PROGRA~1\SYMANT~1\VPTray.exe [2006-11-28 134808]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-01-11 246504]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-19 1233920]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2006-11-10 90112]
"Aim6"=C:\Program Files\AIM6\aim6.exe [2007-10-04 50528]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"EA Core"=C:\Program Files\Electronic Arts\EADM\Core.exe [2008-07-21 2752512]
"MsnMsgr"=C:\Program Files\MSN Messenger\MsnMsgr.Exe /background []

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
hpzrcv01.LNK - C:\Program Files\HP\Temp\{706BB40A-4102-4c89-8107-DC68C4EBD19B}\setup\hpzstub.exe

C:\Users\Margie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
shell\AutoRun\command - D:\SAV/setup.exe -q


======File associations======

.scr - open - "%1" %*

======List of files/folders created in the last 1 months======

2010-06-22 12:10:57 ----A---- C:\Windows\ntbtlog.txt
2010-06-16 21:08:40 ----D---- C:\ProgramData\WindowsSearch
2010-06-10 00:05:58 ----A---- C:\Windows\system32\mshtml.dll
2010-06-10 00:05:56 ----A---- C:\Windows\system32\occache.dll
2010-06-10 00:05:54 ----A---- C:\Windows\system32\wininet.dll
2010-06-10 00:05:53 ----A---- C:\Windows\system32\urlmon.dll
2010-06-10 00:05:51 ----A---- C:\Windows\system32\ieframe.dll
2010-06-10 00:05:50 ----A---- C:\Windows\system32\ieapfltr.dll
2010-06-10 00:05:49 ----A---- C:\Windows\system32\mshtmled.dll
2010-06-10 00:05:49 ----A---- C:\Windows\system32\iertutil.dll
2010-06-10 00:05:49 ----A---- C:\Windows\system32\iedkcs32.dll
2010-06-10 00:05:48 ----A---- C:\Windows\system32\msfeeds.dll
2010-06-10 00:05:47 ----A---- C:\Windows\system32\iepeers.dll
2010-06-10 00:05:47 ----A---- C:\Windows\system32\ieaksie.dll
2010-06-10 00:05:46 ----A---- C:\Windows\system32\ieUnatt.exe
2010-06-10 00:05:45 ----A---- C:\Windows\system32\mstime.dll
2010-06-10 00:05:45 ----A---- C:\Windows\system32\ieencode.dll
2010-06-10 00:05:44 ----A---- C:\Windows\system32\jsproxy.dll
2010-06-10 00:05:13 ----A---- C:\Windows\system32\asycfilt.dll
2010-06-10 00:05:08 ----A---- C:\Windows\system32\atmfd.dll
2010-06-10 00:05:07 ----A---- C:\Windows\system32\atmlib.dll
2010-06-10 00:04:59 ----A---- C:\Windows\system32\quartz.dll
2010-05-27 12:47:03 ----A---- C:\Windows\system32\tzres.dll

======List of files/folders modified in the last 1 months======

2010-06-23 02:05:13 ----D---- C:\Program Files\Trend Micro
2010-06-23 02:05:07 ----D---- C:\Windows\Temp
2010-06-23 02:00:59 ----D---- C:\Windows\Prefetch
2010-06-23 01:08:46 ----D---- C:\Windows\System32
2010-06-22 22:43:49 ----D---- C:\Windows\system32\drivers
2010-06-22 13:06:22 ----SHD---- C:\System Volume Information
2010-06-22 12:18:58 ----D---- C:\Program Files\Mozilla Firefox
2010-06-22 12:17:01 ----D---- C:\Windows\Minidump
2010-06-22 12:17:01 ----D---- C:\Windows
2010-06-17 22:59:08 ----D---- C:\Windows\Debug
2010-06-16 21:08:40 ----HD---- C:\ProgramData
2010-06-10 03:44:07 ----D---- C:\Windows\winsxs
2010-06-10 03:42:34 ----D---- C:\Windows\Microsoft.NET
2010-06-10 03:42:27 ----RSD---- C:\Windows\assembly
2010-06-10 03:33:56 ----D---- C:\Windows\system32\catroot
2010-06-10 03:29:20 ----D---- C:\Windows\system32\wbem
2010-06-10 03:29:17 ----D---- C:\Program Files\Internet Explorer
2010-06-10 03:29:14 ----D---- C:\Program Files\Windows Mail
2010-06-10 03:12:22 ----D---- C:\Windows\system32\catroot2
2010-05-31 14:59:00 ----D---- C:\Windows\rescache
2010-05-31 14:37:37 ----D---- C:\Windows\system32\en-US
2010-05-28 15:37:34 ----A---- C:\Windows\system32\mrt.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2010-05-28 371248]
R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [2006-10-06 406672]
R1 SRTSP;SRTSP; C:\Windows\System32\Drivers\SRTSP.SYS [2006-11-22 247144]
R1 SRTSPX;SRTSPX; C:\Windows\System32\Drivers\SRTSPX.SYS [2006-11-22 25448]
R1 SYMTDI;SYMTDI; C:\Windows\System32\Drivers\SYMTDI.SYS [2006-10-26 185744]
R3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2008-06-11 19456]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-19 92160]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2008-06-11 29184]
R3 Cam5603D;BisonCam, NB Pro; C:\Windows\System32\Drivers\BisonCam.sys [2006-11-30 811440]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-05-28 102448]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2006-12-01 1655464]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATKACPI.sys [2005-02-17 5632]
R3 NAVENG;NAVENG; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20100617.003\NAVENG.SYS [2010-05-17 85552]
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20100617.003\NAVEX15.SYS [2010-05-17 1347504]
R3 NETw3v32;%NIC_Service_DispName_VISTA%; C:\Windows\system32\DRIVERS\NETw3v32.sys [2008-01-19 2225664]
R3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2007-01-18 2314752]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2008-01-19 49664]
R3 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2005-09-16 28672]
R3 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2005-09-14 50560]
R3 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2005-09-29 310016]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2006-11-02 44544]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-19 88576]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2006-11-02 1010560]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2008-02-25 109744]
R3 SYMREDRV;SYMREDRV; C:\Windows\System32\Drivers\SYMREDRV.SYS [2006-10-26 26384]
R3 TPM;TPM; C:\Windows\system32\drivers\tpm.sys [2008-01-19 45624]
S2 MCSTRM;MCSTRM; C:\Windows\system32\drivers\MCSTRM.sys []
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2008-06-11 220160]
S3 Dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2006-11-02 131584]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2006-11-02 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2006-11-02 36864]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 SRTSPL;SRTSPL; C:\Windows\System32\Drivers\SRTSPL.SYS [2006-11-22 274328]
S3 USBCM;Scientific-Atlanta USB Cable Modem Driver; C:\Windows\system32\DRIVERS\Sacm2A.sys [2004-06-10 15429]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2006-11-02 35328]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-19 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2007-01-18 561152]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2006-11-22 107624]
R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2006-11-22 107624]
R2 DefWatch;Symantec AntiVirus Definition Watcher; C:\Program Files\Symantec AntiVirus\DefWatch.exe [2006-11-28 30872]
R2 hpqddsvc;HP CUE DeviceDiscovery Service; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 Symantec AntiVirus;Symantec AntiVirus; C:\Program Files\Symantec AntiVirus\Rtvscan.exe [2006-11-28 1962136]
R2 Viewpoint Manager Service;Viewpoint Manager Service; C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-10-31 2541248]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SavRoam;SAVRoam; C:\Program Files\Symantec AntiVirus\SavRoam.exe [2006-11-28 122008]

-----------------EOF-----------------

Hi zsolta,

however i did not get an info.txt

info.txt should be located in the folder c:\rsit, please post in your next reply.

Now please run Malwarebytes, update and then run a quick scan and save a copy of the log and post it in your next reply.

ESET online scannner

• Please go Here then click on:
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on:
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:

• Scan for potentially unwanted applications
  
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology


• Now click on:
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on:
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Hi,
I ran ESET online scanner, It said no threats detected

this is my info.txt from c:\rsit however it says it was made 2/7/10 the last time I ran rsit while my log.txt was made 6/23/10

Thanks



info.txt logfile of random's system information tool 1.06 2010-02-07 22:17:30

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
2007 Microsoft Office system-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROHYBRIDR /dll OSETUP.DLL
32 Bit HP CIO Components Installer-->MsiExec.exe /I{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}
Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player 9 ActiveX-->C:\Windows\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Reader 9.3-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A93000000001}
AIM 6-->C:\Program Files\AIM6\uninst.exe
ATK0100 ACPI UTILITY-->C:\Windows\ATK0100\XPunin.exe
BisonCam-->C:\Program Files\InstallShield Installation Information\{4A57592C-FF92-4083-97A9-92783BD5AFB4}\SETUP.exe -runfromtemp -l0x0009 -removeonly
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Comcast High-Speed Internet Install Wizard-->C:\Program Files\support.com\uninstall\chsi_uninstaller.exe
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
EA Download Manager-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{EF7E931D-DC84-471B-8DB6-A83358095474} /l1033
ERUNT 1.1j-->"C:\Program Files\ERUNT\unins000.exe"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Java(TM) 6 Update 18-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216018FF}
LiveUpdate 3.2 (Symantec Corporation)-->"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Professional Hybrid 2007-->MsiExec.exe /X{91120000-0031-0000-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Office Word Viewer 2003-->MsiExec.exe /I{90850409-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Mozilla Firefox (3.5.7)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x9 -removeonly
Scientific-Atlanta WebSTAR 2000 series Cable Modem-->UNDPX2A.EXE
SPORE™-->"C:\Program Files\InstallShield Installation Information\{9DF0196F-B6B8-4C3A-8790-DE42AA530101}\SPORESetup.exe" -runfromtemp -l0x0009 -removeonly
Symantec AntiVirus-->MsiExec.exe /I{7C9E6E52-EB11-44DB-A761-82D5D873A8D9}
TGA Convert 1.3-->C:\Program Files\TGA Convert\uninst.exe
Ventrilo Client-->MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Media Player\mtsAxInstaller.exe /u
Winamp (remove only)-->"C:\Program Files\Winamp\UninstWA.exe"
World of Warcraft-->C:\Program Files\Common Files\Blizzard Entertainment\World of Warcraft\Uninstall.exe

=====HijackThis Backups=====

O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file) [2010-02-06]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555 [2010-02-06]

======Security center information======

AV: Symantec AntiVirus
AS: Symantec AntiVirus
AS: Windows Defender

======System event log======

Computer Name: Margie-PC
Event Code: 4374
Message: Windows Servicing identified that package KB958483(Update) is not applicable for this system
Record Number: 214733
Source Name: Microsoft-Windows-Servicing
Time Written: 20100208011522.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: Margie-PC
Event Code: 4374
Message: Windows Servicing identified that package KB958483(Update) is not applicable for this system
Record Number: 214734
Source Name: Microsoft-Windows-Servicing
Time Written: 20100208011522.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: Margie-PC
Event Code: 4374
Message: Windows Servicing identified that package KB958483(Update) is not applicable for this system
Record Number: 214735
Source Name: Microsoft-Windows-Servicing
Time Written: 20100208011522.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: Margie-PC
Event Code: 4374
Message: Windows Servicing identified that package KB958483(Update) is not applicable for this system
Record Number: 214736
Source Name: Microsoft-Windows-Servicing
Time Written: 20100208011522.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: Margie-PC
Event Code: 4374
Message: Windows Servicing identified that package KB958483(Update) is not applicable for this system
Record Number: 214737
Source Name: Microsoft-Windows-Servicing
Time Written: 20100208011523.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

=====Application event log=====

Computer Name: Margie-PC
Event Code: 42
Message:

Auto-Protect Error: Auto-Protect loaded the default configuration
Record Number: 80257
Source Name: Symantec AntiVirus
Time Written: 20100207175042.000000-000
Event Type: Warning
User:

Computer Name: Margie-PC
Event Code: 8194
Message: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005. This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {fdfab2fe-f834-4b65-ba3b-b65cd6604e0f}
Record Number: 80285
Source Name: VSS
Time Written: 20100208002046.000000-000
Event Type: Error
User:

Computer Name: Margie-PC
Event Code: 1013
Message: Product: Adobe Reader 8.1.0 -- A process is running that cannot be shut down by Setup. Please either close all applications and run Setup again, or restart your computer and run Setup again.
Record Number: 80315
Source Name: MsiInstaller
Time Written: 20100208023144.000000-000
Event Type: Error
User: Margie-PC\Margie

Computer Name: Margie-PC
Event Code: 10010
Message: Application 'C:\Program Files\Java\jre1.6.0\bin\jusched.exe' (pid 3240) cannot be restarted - Application SID does not match Conductor SID..
Record Number: 80339
Source Name: Microsoft-Windows-RestartManager
Time Written: 20100208024741.007887-000
Event Type: Warning
User: Margie-PC\Margie

Computer Name: Margie-PC
Event Code: 10006
Message: Application or service 'Java(TM) Platform SE binary' could not be shut down.
Record Number: 80342
Source Name: Microsoft-Windows-RestartManager
Time Written: 20100208024846.524201-000
Event Type: Error
User: Margie-PC\Margie

=====Security event log=====

Computer Name: Margie-PC
Event Code: 4648
Message: A logon was attempted using explicit credentials.

Subject:
Security ID: S-1-5-18
Account Name: MARGIE-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon GUID: {00000000-0000-0000-0000-000000000000}

Target Server:
Target Server Name: localhost
Additional Information: localhost

Process Information:
Process ID: 0x28c
Process Name: C:\Windows\System32\services.exe

Network Information:
Network Address: -
Port: -

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Record Number: 66599
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100208031326.006505-000
Event Type: Audit Success
User:

Computer Name: Margie-PC
Event Code: 4624
Message: An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: MARGIE-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7

Logon Type: 5

New Logon:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x28c
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name:
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 66600
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100208031326.006505-000
Event Type: Audit Success
User:

Computer Name: Margie-PC
Event Code: 4672
Message: Special privileges assigned to new logon.

Subject:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7

Privileges: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 66601
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100208031326.006505-000
Event Type: Audit Success
User:

Computer Name: Margie-PC
Event Code: 4904
Message: An attempt was made to register a security event source.

Subject :
Security ID: S-1-5-18
Account Name: MARGIE-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7

Process:
Process ID: 0x12b8
Process Name: C:\Windows\System32\VSSVC.exe

Event Source:
Source Name: VSSAudit
Event Source ID: 0x15ce536
Record Number: 66602
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100208031532.319005-000
Event Type: Audit Success
User:

Computer Name: Margie-PC
Event Code: 4905
Message: An attempt was made to unregister a security event source.

Subject
Security ID: S-1-5-18
Account Name: MARGIE-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7

Process:
Process ID: 0x12b8
Process Name: C:\Windows\System32\VSSVC.exe

Event Source:
Source Name: VSSAudit
Event Source ID: 0x15ce536
Record Number: 66603
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100208031532.319005-000
Event Type: Audit Success
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 6, GenuineIntel
"PROCESSOR_REVISION"=0f06
"NUMBER_OF_PROCESSORS"=2

-----------------EOF-----------------

Hi zsolta,

this is my info.txt from c:\rsit however it says it was made 2/7/10 the last time I ran rsit

Yes, that is an old log, Let's scan with OTL as an alternative, but first let's do some updates.

Windows Vista SP1
Internet Explorer v7.00

These need to be updated to SP2 and IE8.

Security Updates for Windows, Internet Explorer & Microsoft Office
Whenever a security problem in its software is found, Microsoft will usually create a patch so that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malicious software being installed on your PC. Ensure you are registered for Windows updates via Start > right-click on My Computer > Properties > Automatic Updates tab or visit the Microsoft Update site on a regular basis.

Please visit the above site and make sure all updates are applied.

Update Java Runtime
You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, & also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 6 Update 20.

• Download the latest version of Java Runtime Environment (JRE) 6 Here
• Scroll down to where it says "JDK 6 Update 20 (JDK or JRE)"
• Click the orange Download JRE button to the right
• Select the Windows platform from the dropdown menu
• Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh
• Click on the link to download Windows Offline Installation & save the file to your desktop
• Close any programs you may have running - especially your web browser
• Go to Start > Settings > Control Panel, double-click on Add/Remove Programs & remove all older versions of Java
• Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions
• Reboot your computer once all Java components are removed
• Then from your desktop double-click on jre-6u20-windows-i586-p.exe to install the newest version

Download and run OTL
Download OTL by Old Timer and save it to your Desktop.

• Right click on OTL.exe and select Run as Administrator.
• Under Output, ensure that Minimal Output is selected.
• Under Extra Registry section, select Use SafeList.
• Click the Scan All Users checkbox.
• Click on Run Scan at the top left hand corner.
• When done, two Notepad files will open.
  
  • OTL.txt <-- Will be opened
  • Extras.txt <-- Will be minimized
• Please post the contents of these 2 Notepad files in your next reply.

hello,

I updated windows and installed the new java,
here is my results from OTL
Thank you


OTL.Txt

OTL logfile created on: 6/24/2010 9:10:40 PM - Run 1
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Users\Margie\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 149.00 Mb Available Physical Memory | 15.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 56.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111.79 Gb Total Space | 60.68 Gb Free Space | 54.29% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MARGIE-PC
Current User Name: Margie
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Margie\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Windows\System32\mcbuilder.exe (Microsoft Corporation)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec AntiVirus\Rtvscan.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Windows\ATK0100\HControl.exe ()
PRC - C:\Windows\ATK0100\ATKOSD.exe ()


========== Modules (SafeList) ==========

MOD - C:\Users\Margie\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Viewpoint Manager Service) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (SavRoam) -- C:\Program Files\Symantec AntiVirus\SavRoam.exe (symantec)
SRV - (Symantec AntiVirus) -- C:\Program Files\Symantec AntiVirus\Rtvscan.exe (Symantec Corporation)
SRV - (DefWatch) -- C:\Program Files\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
SRV - (ccSetMgr) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (ccEvtMgr) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (LiveUpdate) -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation)


========== Driver Services (SafeList) ==========

DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NAVEX15) -- C:\ProgramData\Symantec\Definitions\VirusDefs\20100617.003\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) -- C:\ProgramData\Symantec\Definitions\VirusDefs\20100617.003\NAVENG.SYS (Symantec Corporation)
DRV - (SymEvent) -- C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (TPM) -- C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation)
DRV - (NETw3v32) Intel(R) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel Corporation)
DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (Cam5603D) -- C:\Windows\System32\drivers\BisonCam.sys (Bison Electronics. Inc. )
DRV - (SRTSPL) -- C:\Windows\System32\drivers\srtspl.sys (Symantec Corporation)
DRV - (SRTSP) -- C:\Windows\System32\drivers\srtsp.sys (Symantec Corporation)
DRV - (SRTSPX) -- C:\Windows\System32\drivers\srtspx.sys (Symantec Corporation)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (SYMTDI) -- C:\Windows\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (SYMREDRV) -- C:\Windows\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SPBBCDrv) -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys ()
DRV - (USBCM) -- C:\Windows\System32\drivers\Sacm2A.sys ( )


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0



IE - HKU\S-1-5-21-1924072367-3181390333-750806620-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-1924072367-3181390333-750806620-1001\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1924072367-3181390333-750806620-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-1924072367-3181390333-750806620-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.96
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - HKLM\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2010/01/28 22:28:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/24 12:59:10 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/06/24 21:05:52 | 000,000,000 | ---D | M]

[2008/12/19 13:19:12 | 000,000,000 | ---D | M] -- C:\Users\Margie\AppData\Roaming\Mozilla\Extensions
[2010/06/24 21:07:44 | 000,000,000 | ---D | M] -- C:\Users\Margie\AppData\Roaming\Mozilla\Firefox\Profiles\40fnegxb.default\extensions
[2010/02/13 17:28:09 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Margie\AppData\Roaming\Mozilla\Firefox\Profiles\40fnegxb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/24 20:41:05 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\Margie\AppData\Roaming\Mozilla\Firefox\Profiles\40fnegxb.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2007/08/09 23:33:16 | 000,002,386 | ---- | M] () -- C:\Users\Margie\AppData\Roaming\Mozilla\Firefox\Profiles\40fnegxb.default\searchplugins\siteadvisor.xml
[2010/06/24 21:06:18 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/06/24 21:06:19 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2008/12/19 13:19:05 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\[removed]
[2008/12/19 13:19:05 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\[removed]
[2010/06/24 21:04:56 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2007/04/16 13:07:12 | 000,180,293 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,736 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: ::1 localhost
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [HControl] C:\Windows\ATK0100\HControl.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [vptray] C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1924072367-3181390333-750806620-1001..\Run: [Aim6] C:\Program Files\AIM6\aim6.exe (AOL LLC)
O4 - HKU\S-1-5-21-1924072367-3181390333-750806620-1001..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe (Electronic Arts)
O4 - HKU\S-1-5-21-1924072367-3181390333-750806620-1001..\Run: [MsnMsgr] C:\Program Files\MSN Messenger\MsnMsgr.Exe File not found
O4 - HKU\S-1-5-21-1924072367-3181390333-750806620-1001..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - Startup: C:\Users\Margie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Margie\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Margie\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\SAV\setup.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/06/24 21:06:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/06/24 21:05:52 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
[2010/06/24 21:05:52 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2010/06/24 21:05:51 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2010/06/24 21:05:51 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2010/06/24 21:04:26 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2010/06/24 20:19:16 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES
[2010/06/24 20:19:16 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES
[2010/06/24 20:19:09 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN
[2010/06/24 17:09:51 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2010/06/24 03:00:42 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHostProxy.dll
[2010/06/24 03:00:41 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHost.exe
[2010/06/24 03:00:40 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll
[2010/06/23 09:06:45 | 001,696,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gameux.dll
[2010/06/23 09:06:45 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll
[2010/06/23 09:06:44 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll
[2010/06/16 21:08:40 | 000,000,000 | ---D | C] -- C:\ProgramData\WindowsSearch
[2010/06/10 00:05:50 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2010/06/10 00:05:48 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2010/06/10 00:05:48 | 000,180,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2010/06/10 00:05:45 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll
[2010/06/10 00:05:13 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll
[2010/06/10 00:05:09 | 000,289,792 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2010/06/10 00:05:07 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2010/06/10 00:00:32 | 002,037,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2010/05/27 12:47:03 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2007/03/06 15:23:13 | 000,015,429 | ---- | C] ( ) -- C:\Windows\System32\drivers\Sacm2A.sys
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Margie\Documents\*.tmp files -> C:\Users\Margie\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/06/24 21:09:31 | 002,359,296 | -HS- | M] () -- C:\Users\Margie\NTUSER.DAT
[2010/06/24 21:04:49 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2010/06/24 21:04:49 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2010/06/24 21:04:48 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2010/06/24 21:04:47 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
[2010/06/24 21:02:30 | 000,690,960 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/06/24 21:02:30 | 000,595,684 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/06/24 21:02:30 | 000,101,350 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/06/24 20:55:09 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/06/24 20:55:08 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/06/24 20:54:57 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/06/24 20:54:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/06/24 20:54:07 | 1070,927,872 | -HS- | M] () -- C:\hiberfil.sys
[2010/06/24 20:53:10 | 000,524,288 | -HS- | M] () -- C:\Users\Margie\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/06/24 20:53:10 | 000,065,536 | -HS- | M] () -- C:\Users\Margie\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/06/24 20:52:44 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010/06/24 20:52:10 | 002,339,894 | -H-- | M] () -- C:\Users\Margie\AppData\Local\IconCache.db
[2010/06/24 20:35:25 | 000,000,943 | ---- | M] () -- C:\Users\Margie\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/06/24 20:28:22 | 000,374,488 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/06/22 12:17:01 | 123,395,366 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010/06/07 23:22:02 | 000,008,704 | ---- | M] () -- C:\Users\Margie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/03 13:52:28 | 000,030,208 | ---- | M] () -- C:\Users\Margie\Documents\emailmargie72.doc
[2010/06/03 13:49:50 | 000,059,904 | ---- | M] () -- C:\Users\Margie\Documents\margieresume52.doc
[2010/05/26 13:06:41 | 000,034,304 | ---- | M] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2010/05/26 10:47:41 | 000,289,792 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Margie\Documents\*.tmp files -> C:\Users\Margie\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/22 12:21:50 | 1070,927,872 | -HS- | C] () -- C:\hiberfil.sys
[2010/06/22 12:16:38 | 123,395,366 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010/02/11 06:50:29 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2007/09/28 12:07:52 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2007/09/28 12:05:50 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dtu100.dll.manifest
[2007/09/28 12:05:50 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dpl100.dll.manifest
[2007/09/28 12:05:08 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
[2007/03/06 15:23:13 | 000,053,693 | ---- | C] () -- C:\Windows\UNDPX2A.sys
[2007/02/28 19:28:07 | 000,000,029 | ---- | C] () -- C:\Windows\atid.ini
[2007/02/20 11:47:00 | 000,015,190 | ---- | C] () -- C:\Windows\M2000Twn.ini
[2007/02/20 11:44:57 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\ATKACPI.sys
[2007/02/20 11:44:14 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

========== Alternate Data Streams ==========

@Alternate Data Stream - 64 bytes -> C:\Users\Margie\Desktop\Futurama 03x05 - Amazon Women In The Mood.avi:TOC.WMV
< End of report >

Extras.Txt

OTL Extras logfile created on: 6/24/2010 9:10:40 PM - Run 1
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Users\Margie\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 149.00 Mb Available Physical Memory | 15.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 56.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111.79 Gb Total Space | 60.68 Gb Free Space | 54.29% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MARGIE-PC
Current User Name: Margie
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-1924072367-3181390333-750806620-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" %*
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{005572F8-E8D9-434E-9D2D-1C6CAE1C9838}" = lport=2869 | protocol=6 | dir=in | app=system |
"{57B9F8AC-29B7-4174-AE16-C1CC895E44EB}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{8CA00564-4C7F-4931-A5DB-506A87A370EA}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 |
"{CA030C31-DA63-43C3-B7C0-57B3E7B6BE82}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05821022-5EB3-40A9-82E1-5CD3939B3614}" = protocol=6 | dir=in | app=c:\program files\symantec antivirus\rtvscan.exe |
"{1A583540-17C7-4AC9-9ACD-9371EB7A228F}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-2.4.2.8278-to-2.4.3.8606-enus-downloader.exe |
"{2D356635-F686-475D-BB28-13E89CCE6C05}" = dir=in | app=c:\program files\msn messenger\livecall.exe |
"{488B4683-9090-4742-946C-5A5E956560CE}" = protocol=17 | dir=in | app=c:\program files\symantec antivirus\rtvscan.exe |
"{4A64C8A5-6B30-4CA8-B95B-FABD4AEEDBFA}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{4E300FF3-D23C-414B-BE77-550EAF480A23}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{56CA505B-F774-493A-A25B-641F7CF7763B}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.2.10482-to-3.2.2.10505-enus-downloader.exe |
"{5B539065-37E7-429A-809F-4F5E2215BAD3}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10314-to-3.2.2.10482-enus-downloader.exe |
"{5E635CEE-E55E-4EF5-A218-65B609712CE8}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-enus-downloader.exe |
"{69CE058E-E79E-4479-8F2D-FDC63F49DEDC}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{78BD8675-27FB-4157-B9CD-39A409CDA5C0}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{7A428033-CBFC-45AF-B7DD-8E15E69AA705}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.1.3.9947-to-3.2.0.10192-enus-downloader.exe |
"{83FE85CE-050B-468A-A3F9-409E3BBC1826}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10314-to-3.2.2.10482-enus-downloader.exe |
"{993FF75F-B890-445C-9B96-F32E28721C64}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{A5B1C39F-819E-431E-86BD-E0A58A1F157C}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.1.3.9947-to-3.2.0.10192-enus-downloader.exe |
"{A9946422-A8B3-4213-BAEE-9236CD8AD70A}" = protocol=17 | dir=in | app=c:\program files\common files\symantec shared\ccapp.exe |
"{ACFCEE12-CFA3-43DF-975A-539D579AF2EE}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.2.10482-to-3.2.2.10505-enus-downloader.exe |
"{AE2B3B5A-6EFB-4AF1-BD8C-ECDAF4344B53}" = dir=in | app=c:\program files\msn messenger\msnmsgr.exe |
"{B5720FEF-B7C0-461A-A1E2-628D3CF187C9}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-2.4.2.8278-to-2.4.3.8606-enus-downloader.exe |
"{B78F5BF4-F26F-4EBB-A294-02A71764F1BB}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{CA5B1CAE-7710-4570-9506-EF09514B996F}" = protocol=6 | dir=in | app=c:\program files\common files\symantec shared\ccapp.exe |
"{EB9CFD55-E066-481C-8785-58886A3DF6CE}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{EECA887D-2D22-46A2-AF1F-EDC40D1A3618}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-enus-downloader.exe |
"TCP Query User{1A256B52-9C1C-4C04-8DE2-DA99F1BEA041}C:\program files\rhapsody\rhapsody.exe" = protocol=6 | dir=in | app=c:\program files\rhapsody\rhapsody.exe |
"TCP Query User{376364CB-0B8B-46C1-9068-D82CC8FBCB39}C:\users\public\games\world of warcraft\backgrounddownloader.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\backgrounddownloader.exe |
"TCP Query User{3EDBA075-AB70-4947-AEBC-A15C2B5E7E43}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{72AE4375-02EA-4B50-9816-A00148381C34}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{7815344F-5BDD-4802-BACF-F4BABF577AA1}C:\users\margie\appdata\local\temp\blizzard launcher temporary - 1588f728\launcher.exe" = protocol=6 | dir=in | app=c:\users\margie\appdata\local\temp\blizzard launcher temporary - 1588f728\launcher.exe |
"TCP Query User{91D8E965-F1F3-4A63-B13F-89767668F1E9}C:\users\margie\appdata\local\temp\blizzard launcher temporary - 75fd7990\launcher.exe" = protocol=6 | dir=in | app=c:\users\margie\appdata\local\temp\blizzard launcher temporary - 75fd7990\launcher.exe |
"TCP Query User{97819745-089B-4E51-92A3-B627ACC51DFD}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"TCP Query User{9C8B7EA6-9E58-4E5A-AF04-98D7D7F4D935}C:\program files\aim6\aim6.exe" = protocol=6 | dir=in | app=c:\program files\aim6\aim6.exe |
"TCP Query User{9DDFF9BE-FBAB-4473-B8B9-ED7A88179D5D}C:\program files\world of warcraft\backgrounddownloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\backgrounddownloader.exe |
"TCP Query User{BC7E0211-7C49-4DB1-B46B-D78F888B1932}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"TCP Query User{F388A2E2-E769-4314-88D8-80F1A51A7E8B}C:\program files\world of warcraft\wow-2.0.3-enus-downloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\wow-2.0.3-enus-downloader.exe |
"UDP Query User{0E29E67D-DF45-4211-960A-5551F8149CCD}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{217EFAEF-42A5-4FFF-A933-56C3CEFD8C67}C:\program files\world of warcraft\wow-2.0.3-enus-downloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\wow-2.0.3-enus-downloader.exe |
"UDP Query User{235E4553-45A6-4A7A-A8EE-8F673D254151}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"UDP Query User{29D1BF47-9090-40BB-B830-603CAB152CC8}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"UDP Query User{3608F6A6-218B-4A16-A05A-073D1A0C5BB3}C:\users\margie\appdata\local\temp\blizzard launcher temporary - 75fd7990\launcher.exe" = protocol=17 | dir=in | app=c:\users\margie\appdata\local\temp\blizzard launcher temporary - 75fd7990\launcher.exe |
"UDP Query User{98870E15-19B8-40EF-B82E-580B9D999C95}C:\users\margie\appdata\local\temp\blizzard launcher temporary - 1588f728\launcher.exe" = protocol=17 | dir=in | app=c:\users\margie\appdata\local\temp\blizzard launcher temporary - 1588f728\launcher.exe |
"UDP Query User{A04C24BA-F635-4D1A-9FCE-FDD076652AA0}C:\users\public\games\world of warcraft\backgrounddownloader.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\backgrounddownloader.exe |
"UDP Query User{A3A32B55-D3D2-46C1-942A-285004008082}C:\program files\world of warcraft\backgrounddownloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\backgrounddownloader.exe |
"UDP Query User{B57D9F07-3591-47B0-9C85-D06B479F52A9}C:\program files\rhapsody\rhapsody.exe" = protocol=17 | dir=in | app=c:\program files\rhapsody\rhapsody.exe |
"UDP Query User{B884298A-B39D-4290-B99E-E992006505A4}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{CF4735CB-18C4-4BC9-A0FF-F5682A715583}C:\program files\aim6\aim6.exe" = protocol=17 | dir=in | app=c:\program files\aim6\aim6.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{086E0B3A-09EB-8F51-2091-7F14FEDCF998}" = Catalyst Control Center Graphics Full New
"{10E1E87C-656C-4D08-86D6-5443D28583BE}" = TrayApp
"{1753255A-0AEB-4220-8C75-607B73F0C133}" = Copy
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1974DD93-F8F5-997C-D4E0-9F885B89B4D3}" = Catalyst Control Center Graphics Full Existing
"{1B1FB05A-4251-48CE-57A3-1958FBE24C42}" = Catalyst Control Center Graphics Previews Vista
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{4160DC5B-4C56-D0C3-C5FD-F5BDAD3C882B}" = ATI Catalyst Install Manager
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A57592C-FF92-4083-97A9-92783BD5AFB4}" = BisonCam
"{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport
"{56595552-71B5-24E7-D358-A660AC8CE9F5}" = ccc-utility
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6EC9CD6D-9FDC-3E5A-AFAB-295750D21C32}" = Catalyst Control Center Core Implementation
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{795F8B93-6865-17FB-AE58-1A74C2DB0070}" = Skins
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C9E6E52-EB11-44DB-A761-82D5D873A8D9}" = Symantec AntiVirus
"{870C80B7-3042-AEE9-0B00-73CA05CC730F}" = CCC Help English
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{93F54611-2701-454e-94AB-623F458D9E6B}" = DeviceDiscovery
"{98903E1C-4085-4B69-9EB1-381752870004}" = Branding
"{9DF0196F-B6B8-4C3A-8790-DE42AA530101}" = SPORE™
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BD4E605D-02AB-3ED9-9742-5449D8C21A3D}" = Catalyst Control Center Graphics Light
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component
"{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm
"{EF7E931D-DC84-471B-8DB6-A83358095474}" = EA Download Manager
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F8487D71-8722-24E3-AC1E-8BA8B34E8832}" = ccc-core-static
"{FD8D8B04-BEAD-4A55-AA1D-62D2373E7DEA}" = Status
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AIM_6" = AIM 6
"CCleaner" = CCleaner (remove only)
"ComcastHSI" = Comcast High-Speed Internet Install Wizard
"HControl" = ATK0100 ACPI UTILITY
"HijackThis" = HijackThis 2.0.2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{EF7E931D-DC84-471B-8DB6-A83358095474}" = EA Download Manager
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.10)" = Mozilla Firefox (3.5.10)
"PROHYBRIDR" = 2007 Microsoft Office system
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"TGA Convert" = TGA Convert 1.3
"ViewpointMediaPlayer" = Viewpoint Media Player
"WebSTAR DPC2100 Uninstall" = Scientific-Atlanta WebSTAR 2000 series Cable Modem
"Winamp" = Winamp (remove only)
"World of Warcraft" = World of Warcraft

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/16/2008 10:19:23 PM | Computer Name = Margie-PC | Source = Symantec AntiVirus | ID = 16711726
Description = Security Risk Found!Risk: Downloader in File: C:\ProgramData\Symantec\SRTSP\Quarantine\APQ67A8.tmp
by: Auto-Protect scan. Action: Cleaned by Deletion. Action Description:

Error - 7/16/2008 10:19:23 PM | Computer Name = Margie-PC | Source = Symantec AntiVirus | ID = 16711685
Description = Risk Found!Risk: Downloader in File: C:\ProgramData\Symantec\SRTSP\Quarantine\APQ67A8.tmp
by: Auto-Protect scan. Action: Cleaned by Deletion. Action Description:

Error - 7/16/2008 10:19:23 PM | Computer Name = Margie-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Risk: Downloader in File: C:\ProgramData\Symantec\SRTSP\Quarantine\APQ67A8.tmp
by: Auto-Protect scan. Action: Cleaned by Deletion. Action Description:

Error - 7/16/2008 10:19:40 PM | Computer Name = Margie-PC | Source = Symantec AntiVirus | ID = 16711726
Description = Security Risk Found!Risk: Downloader in File: C:\ProgramData\Symantec\SRTSP\Quarantine\APQB3D6.tmp
by: Auto-Protect scan. Action: Cleaned by Deletion. Action Description:

Error - 7/16/2008 10:19:40 PM | Computer Name = Margie-PC | Source = Symantec AntiVirus | ID = 16711685
Description = Risk Found!Risk: Downloader in File: C:\ProgramData\Symantec\SRTSP\Quarantine\APQB3D6.tmp
by: Auto-Protect scan. Action: Cleaned by Deletion. Action Description:

Error - 7/16/2008 10:19:41 PM | Computer Name = Margie-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Risk: Downloader in File: C:\ProgramData\Symantec\SRTSP\Quarantine\APQB3D6.tmp
by: Auto-Protect scan. Action: Cleaned by Deletion. Action Description:

Error - 7/16/2008 10:20:38 PM | Computer Name = Margie-PC | Source = Symantec AntiVirus | ID = 16711726
Description = Security Risk Found!Risk: Downloader in File: C:\ProgramData\Symantec\SRTSP\Quarantine\APQEFF7.tmp
by: Auto-Protect scan. Action: Cleaned by Deletion. Action Description:

Error - 7/16/2008 10:20:38 PM | Computer Name = Margie-PC | Source = Symantec AntiVirus | ID = 16711685
Description = Risk Found!Risk: Downloader in File: C:\ProgramData\Symantec\SRTSP\Quarantine\APQEFF7.tmp
by: Auto-Protect scan. Action: Cleaned by Deletion. Action Description:

Error - 7/16/2008 10:20:39 PM | Computer Name = Margie-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Risk: Downloader in File: C:\ProgramData\Symantec\SRTSP\Quarantine\APQEFF7.tmp
by: Auto-Protect scan. Action: Cleaned by Deletion. Action Description:

Error - 7/17/2008 10:42:32 PM | Computer Name = Margie-PC | Source = EventSystem | ID = 4621
Description =

[ Media Center Events ]
Error - 12/20/2007 8:02:20 PM | Computer Name = Margie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 5/25/2008 8:46:14 PM | Computer Name = Margie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 5/29/2008 3:02:39 PM | Computer Name = Margie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 6/2/2008 12:02:01 PM | Computer Name = Margie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 6/2/2008 8:28:57 PM | Computer Name = Margie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 6/10/2008 3:36:56 PM | Computer Name = Margie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 3/16/2009 11:44:11 PM | Computer Name = Margie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 4/20/2009 3:46:55 AM | Computer Name = Margie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 6/9/2009 12:07:02 PM | Computer Name = Margie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 11/22/2009 10:41:37 PM | Computer Name = Margie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]
Error - 6/22/2010 10:35:17 PM | Computer Name = Margie-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/24/2010 3:21:05 AM | Computer Name = Margie-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description =

Error - 6/24/2010 3:21:58 AM | Computer Name = Margie-PC | Source = HTTP | ID = 15016
Description =

Error - 6/24/2010 3:23:02 AM | Computer Name = Margie-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/24/2010 8:16:02 PM | Computer Name = Margie-PC | Source = DCOM | ID = 10010
Description =

Error - 6/24/2010 8:26:56 PM | Computer Name = Margie-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description =

Error - 6/24/2010 8:29:31 PM | Computer Name = Margie-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/24/2010 8:52:22 PM | Computer Name = Margie-PC | Source = DCOM | ID = 10010
Description =

Error - 6/24/2010 8:53:50 PM | Computer Name = Margie-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description =

Error - 6/24/2010 8:55:44 PM | Computer Name = Margie-PC | Source = Service Control Manager | ID = 7000
Description =


< End of report >

Hi zsolta,

After exhaustive checks, your computer looks to be clean.

The updates that you have done will improve the security of your computer.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure

Remove GMER

Delete the GMER icon from your desktop.

Clean up with OTL

• Double-click OTL.exe to start the program. This will remove all the tools we used to clean your pc.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CleanUp! button
• Say Yes to the prompt and then allow the program to reboot your computer.

Update your AntiVirus Software and keep your other programs up-to-date
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Security Updates for Windows, Internet Explorer & Microsoft Office
Whenever a security problem in its software is found, Microsoft will usually create a patch so that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malicious software being installed on your PC. Ensure you are registered for Windows updates via Start > right-click on My Computer > Properties > Automatic Updates tab or visit the Microsoft Update site on a regular basis.


Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware


Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.[/list]Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety

• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
• Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
  Using Winpatrol to protect your computer from malicious software

Also, please read this great article by Tony Klein So How Did I Get Infected In First Place

Happy surfing and stay clean!

Thank you so much DeltaLima, I really appreciate that effort that you put into putting my worries at ease.

You're very welcome!