1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Another crudware machine

Discussion in 'Malware and Virus Removal Archive' started by elcajongunsfan, 2014/10/26.

Page 1 of 3
  1. 2014/10/26
    elcajongunsfan Lifetime Subscriber

    elcajongunsfan Well-Known Member Thread Starter

    Joined:
    2012/01/01
    Messages:
    377
    Likes Received:
    12
    [Solved] Another crudware machine

    this machine is from the same source. It seems to run well but the boot.ini file is damaged or something because at the
    bios dump, it sez its damaged and the system is booting from the c:windows\ directory. Also the search function is not working
    It had mysearchdial on it but I think I was able to get rid of it. There are several pages of garbage output from malwarebytes. dont know
    why

    Thanks

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 10/25/2014
    Scan Time: 8:43:53 PM
    Logfile: mbar.txt
    Administrator: Yes

    Version: 2.00.3.1025
    Malware Database: v2014.10.26.01
    Rootkit Database: v2014.10.22.01
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled

    OS: Windows XP Service Pack 3
    CPU: x86
    File System: NTFS
    User: pcuser

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 328467
    Time Elapsed: 8 min, 30 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 10
    PUP.Optional.GamesAGoGo.A, HKLM\SOFTWARE\CLASSES\CLSID\{2e94b700-eafb-4c9e-a696-77200aa3f89b}, Quarantined, [f257d6434f2dd2647ffb2c791ce63ac6],
    PUP.Optional.GamesAGoGo.A, HKU\S-1-5-21-1060284298-1409082233-839522115-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{2E94B700-EAFB-4C9E-A696-77200AA3F89B}, Quarantined, [f257d6434f2dd2647ffb2c791ce63ac6],
    PUP.Optional.LessTabs.A, HKU\S-1-5-21-1060284298-1409082233-839522115-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{3178A392-8963-471E-B7A2-969CB58D6496}, Quarantined, [a6a31405a6d686b0aadab5f2de24b44c],
    PUP.Optional.LessTabs.A, HKU\S-1-5-21-1060284298-1409082233-839522115-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{3178A392-8963-471E-B7A2-969CB58D6496}, Quarantined, [a6a31405a6d686b0aadab5f2de24b44c],
    PUP.Optional.WeCare, HKU\S-1-5-21-1060284298-1409082233-839522115-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{6ED0A312-78F5-493C-A90C-5DAF321D0BF8}, Quarantined, [1e2b978254286cca164afbaa69990ef2],
    PUP.Optional.WeCare, HKU\S-1-5-21-1060284298-1409082233-839522115-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{6ED0A312-78F5-493C-A90C-5DAF321D0BF8}, Quarantined, [1e2b978254286cca164afbaa69990ef2],
    PUP.Optional.PlayTopus, HKU\S-1-5-21-1060284298-1409082233-839522115-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{8EBA1B69-99D8-4135-BD43-729BA79D5CC4}, Quarantined, [22270e0b1c605bdb1b9fb2fffd059070],
    PUP.Optional.PlayTopus, HKU\S-1-5-21-1060284298-1409082233-839522115-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{8EBA1B69-99D8-4135-BD43-729BA79D5CC4}, Quarantined, [22270e0b1c605bdb1b9fb2fffd059070],
    PUP.Optional.LessTabs.A, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\cekmkdkefndbeciggfanobcemjnppbbb, Quarantined, [87c276a396e633038c1691b4bc471ee2],
    PUP.Optional.MySearchDial.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MySearchDial, Quarantined, [2a1f1306443877bf5e22264aa1636c94],

    Registry Values: 2
    PUP.Optional.GamesAGoGo.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{2E94B700-EAFB-4C9E-A696-77200AA3F89B}, GamesBar (W), Quarantined, [f257d6434f2dd2647ffb2c791ce63ac6]
    PUP.Optional.GamesAGoGo.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{2e94b700-eafb-4c9e-a696-77200aa3f89b}, Quarantined, [90b9ef2a691367cfee8ca203e9191ee2],

    Registry Data: 1
    Trojan.0Access, HKLM\SOFTWARE\CLASSES\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\INPROCSERVER32, C:\RECYCLER\S-1-5-18\$a3cddf4b4e95dfbb498ef04e79f36042\n., Good: (fastprox.dll), Bad: (C:\RECYCLER\S-1-5-18\$a3cddf4b4e95dfbb498ef04e79f36042\n.),Replaced,[70d90e0b90ec3cfa3d72f53618edce32]

    Folders: 27
    PUP.Optional.MySearchDial.A, C:\Documents and Settings\NetworkService\Application Data\MySearchDial, Quarantined, [de6b34e595e7d660872d688a6b97ae52],
    PUP.Optional.MySearchDial.A, C:\Documents and Settings\NetworkService\Application Data\MySearchDial\UpdateProc, Quarantined, [de6b34e595e7d660872d688a6b97ae52],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\api, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\defaults, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\defaults\preferences, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\userCode, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\locale, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\locale\en-US, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\skin, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\databases\chrome-extension_lgonpmchaeokedifbjenbcnjcdefdceg_0, Quarantined, [0643a475cab255e1e5921dde7e8408f8],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\lgonpmchaeokedifbjenbcnjcdefdceg, Quarantined, [1633aa6f4636db5b8eeda05b24de619f],
    PUP.Optional.LessTabs.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cekmkdkefndbeciggfanobcemjnppbbb, Quarantined, [81c83fda89f353e37c88b649b34f40c0],
    PUP.Optional.LessTabs.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cekmkdkefndbeciggfanobcemjnppbbb\1.7.2.0_0, Quarantined, [81c83fda89f353e37c88b649b34f40c0],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\SearchProtect, Quarantined, [a8a139e098e4a2942037c93fee15c23e],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\SearchProtect\Logs, Quarantined, [a8a139e098e4a2942037c93fee15c23e],
    PUP.Optional.Extutil.A, C:\Documents and Settings\pcuser\Local Settings\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B, Quarantined, [a7a2031698e4290ddeccb65434cfc739],
    PUP.Optional.Managera.A, C:\Documents and Settings\pcuser\Local Settings\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42, Quarantined, [e86164b5d9a3f4421695808a6a994ab6],
    PUP.Optional.AffiliatedUpdate.A, C:\Documents and Settings\NetworkService\Application Data\AffiliatedUpdate, Quarantined, [ef5a0f0ae09c0a2c79d8eb22b1521fe1],
    PUP.Optional.AffiliatedUpdate.A, C:\Documents and Settings\NetworkService\Application Data\AffiliatedUpdate\UpdateProc, Quarantined, [ef5a0f0ae09c0a2c79d8eb22b1521fe1],
    PUP.Optional.AffiliatedUpdate.A, C:\Documents and Settings\pcuser\Application Data\AffiliatedUpdate, Quarantined, [93b62dec68140234bd949f6e43c050b0],
    PUP.Optional.AffiliatedUpdate.A, C:\Documents and Settings\pcuser\Application Data\AffiliatedUpdate\UpdateProc, Quarantined, [93b62dec68140234bd949f6e43c050b0],
     
    Last edited: 2014/10/26
    elcajongunsfan,
    #1
  2. 2014/10/26
    elcajongunsfan Lifetime Subscriber

    elcajongunsfan Well-Known Member Thread Starter

    Joined:
    2012/01/01
    Messages:
    377
    Likes Received:
    12
    Files: 195
    PUP.Optional.ArcadeFrontier.A, C:\Documents and Settings\pcuser\My Documents\Downloads\ArcadeFrontierGames.exe, Quarantined, [ed5cfc1d97e5ef473637eb84bb4610f0],
    PUP.Optional.OpenSoftwareUpdater, C:\Documents and Settings\pcuser\My Documents\Downloads\SoftwareUpdater.exe, Quarantined, [c7823cddf9836bcb9874953e7b86f50b],
    PUP.Optional.InstallCore, C:\Program Files\FLV Player\FLVPlayer.exe, Quarantined, [e3668990007c3ef8709f161651af55ab],
    Trojan.FakeMS.ED, C:\RECYCLER\S-1-5-21-1060284298-1409082233-839522115-1003\$R92314DDF, Quarantined, [6edb7f9a225a270f597c0df8f50c5aa6],
    PUP.Optional.Somoto.A, C:\Documents and Settings\pcuser\Local Settings\Temp\BI_RunOnce.exe, Quarantined, [98b11009bfbd73c322e2fe3010f1e917],
    PUP.Optional.Somoto, C:\Documents and Settings\pcuser\Local Settings\Temp\rad914B5.tmp_update.exe, Quarantined, [cf7a50c91864f0463b54ac89e61a42be],
    PUP.Optional.Somoto.A, C:\Documents and Settings\pcuser\Local Settings\Temp\radE5037.tmp_update.exe, Quarantined, [47021aff502c2f07d08b183004fca957],
    PUP.Optional.Somoto, C:\Documents and Settings\pcuser\Local Settings\Temp\run.exe, Quarantined, [ca7fa4753d3fa78fb983c290b25315eb],
    PUP.Optional.Conduit.A, C:\Documents and Settings\pcuser\Local Settings\Temp\nsc61.exe, Quarantined, [0148e435a8d46dc97125e0b8bb460bf5],
    PUP.Optional.Conduit.A, C:\Documents and Settings\pcuser\Local Settings\Temp\nsk5B.exe, Quarantined, [dc6dc7523349cb6b494d2a6e35cc3fc1],
    PUP.Optional.Somoto.A, C:\Documents and Settings\pcuser\Local Settings\Temp\appshat-distribution.exe, Quarantined, [91b855c48af2b87e5efedd4543bdcc34],
    PUP.Optional.Conduit.A, C:\Documents and Settings\pcuser\Local Settings\Temp\SecondStepInstaller.exe, Quarantined, [301950c9700ca98d94ebaa8aa06150b0],
    PUP.Optional.SearchProtect.A, C:\Documents and Settings\pcuser\Local Settings\Temp\SPSetup.exe, Quarantined, [d67374a57309d75fe8cea4fe1ce5e719],
    PUP.Optional.MySearchDial.A, C:\Documents and Settings\pcuser\Local Settings\Temp\UpdateTask.exe.258828, Quarantined, [0d3cbe5bde9ead89a2035be3fb063ac6],
    PUP.Optional.Conduit.A, C:\Documents and Settings\pcuser\Local Settings\Temp\nsr4D.exe, Quarantined, [72d7e039b3c9f046940216820af77987],
    PUP.Optional.Conduit.A, C:\Documents and Settings\pcuser\Local Settings\Temp\nsr53.exe, Quarantined, [2a1f66b3ea929a9ca8ee841442bf18e8],
    PUP.Optional.SearchProtect.A, C:\Documents and Settings\pcuser\Local Settings\Temp\nsu48.tmp, Quarantined, [c980ca4f285447effeb8bae8cf32718f],
    PUP.Optional.Conduit.A, C:\Documents and Settings\pcuser\Local Settings\Temp\nsy5E.exe, Quarantined, [1336b3660e6eb383a9eda5f361a09769],
    PUP.Optional.Conduit.A, C:\Documents and Settings\pcuser\Local Settings\Temp\nsz50.exe, Quarantined, [a7a2db3e027a4de9474f5147966b45bb],
    PUP.Optional.Somoto.A, C:\Documents and Settings\pcuser\Local Settings\Temp\FLVPlayerSetup.exe, Quarantined, [262344d5d1ab1026609e77ba59a7b54b],
    PUP.Optional.Somoto, C:\Documents and Settings\pcuser\Local Settings\Temp\FLVPlayerUpdate_downloader_by_FLVPlayerUpdate.exe, Quarantined, [9faadc3d5527082e44f86be727de837d],
    PUP.Optional.Conduit.A, C:\Documents and Settings\pcuser\Local Settings\Temp\AU\SPSetup.exe, Quarantined, [1039d049ee8ea591403f1321629fe818],
    PUP.Optional.ScramblePacker.A, C:\Documents and Settings\pcuser\Local Settings\Temp\nsaD.tmp\flv-player-addon.exe, Quarantined, [5ced62b7611b0a2cadad553db9480bf5],
    PUP.Optional.AppsHat.A, C:\Documents and Settings\pcuser\Local Settings\Temp\nsb2C.tmp\386895, Quarantined, [0d3c42d798e4ae88163c824f05fcbf41],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Local Settings\Temp\nsc22.tmp\Qxknu.exe, Quarantined, [df6aa6731a62fd39f8692227f0100bf5],
    PUP.Optional.CrossRider, C:\Documents and Settings\pcuser\Local Settings\Temp\nsc22.tmp\WrapperUtils.dll, Quarantined, [13360514f8843006d3ecbecda45e8977],
    PUP.Optional.ScramblePacker.A, C:\Documents and Settings\pcuser\Local Settings\Temp\nsgF.tmp\apps-hat-mini.exe, Quarantined, [83c6a970ccb0fc3a45152e6448b92ad6],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Local Settings\Temp\nsq2D.tmp\Padglxfhqu.exe, Quarantined, [7ecbf128c1bb2511a55397da50b1e31d],
    PUP.Optional.Installcore, C:\Documents and Settings\pcuser\Local Settings\Temp\is1412836710\15325293_stp\HomePageDLL.dll, Quarantined, [61e87e9b8eee2e08eda5fbf2aa5a8a76],
    PUP.Optional.BatBrowse.A, C:\Documents and Settings\pcuser\Local Settings\Temp\is1412836710\15325448_stp\BatBrowseSetup.exe, Quarantined, [3b0e76a3daa20b2bb18f801eaf559b65],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\Temp\nsl3F.exe, Quarantined, [28219485671502344f3e6fd046bb847c],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\Temp\nsn4B.exe, Quarantined, [89c0a9703646979f24690f3027dac040],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\Temp\nsx3C.exe, Quarantined, [32170e0bff7d8da99af3b38cca37f30d],
    PUP.Optional.Conduit.A, C:\WINDOWS\Temp\nsc29.exe, Quarantined, [77d2f0290d6f45f10e88871135cca957],
    PUP.Optional.Conduit.A, C:\WINDOWS\Temp\nsd26.exe, Quarantined, [14356faaff7d69cdbcdaefa910f1ce32],
    PUP.Optional.Conduit.A, C:\WINDOWS\Temp\nsd45.exe, Quarantined, [dd6cb960f8843cfa6f10d65e679a4cb4],
    Rootkit.0access, C:\WINDOWS\assembly\GAC\Desktop.ini, Quarantined, [cb7e75a47507cd696d82d7e2b14f20e0],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_lgonpmchaeokedifbjenbcnjcdefdceg_0.localstorage, Quarantined, [8bbe5ebbf6861d1951f2a496b2511ae6],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_lgonpmchaeokedifbjenbcnjcdefdceg_0.localstorage-journal, Quarantined, [89c055c4a3d9cd69f84ba09af90aa55b],
    PUP.Optional.MySearchDial.A, C:\Documents and Settings\NetworkService\Application Data\MySearchDial\UpdateProc\config.dat, Quarantined, [de6b34e595e7d660872d688a6b97ae52],
    PUP.Optional.MySearchDial.A, C:\Documents and Settings\NetworkService\Application Data\MySearchDial\UpdateProc\info.dat, Quarantined, [de6b34e595e7d660872d688a6b97ae52],
    PUP.Optional.MySearchDial.A, C:\Documents and Settings\NetworkService\Application Data\MySearchDial\UpdateProc\STTL.DAT, Quarantined, [de6b34e595e7d660872d688a6b97ae52],
    PUP.Optional.MySearchDial.A, C:\Documents and Settings\NetworkService\Application Data\MySearchDial\UpdateProc\TTL.DAT, Quarantined, [de6b34e595e7d660872d688a6b97ae52],
    PUP.Optional.MySearchDial.A, C:\Documents and Settings\NetworkService\Application Data\MySearchDial\UpdateProc\UpdateTask.exe, Quarantined, [de6b34e595e7d660872d688a6b97ae52],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome.manifest, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\install.rdf, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\29afb29f924be6b1f9ee8897c0b0c03a.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\4ba10955a5a9f97a7dc1f54cccb0384d.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\79b626fb1cabbefc794c141642a86bc8.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\background.html, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\browser.xul, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\d3a38f5a9cdb32cb00fc1bf01c61070d.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\d6f837dd0e6a7183851bb3b4ee47b625.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\dialog.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\f3f9aadbae4fbbb190d082aaa1faff62.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\ffCoreFilesIndex.txt, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\options.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\options.xul, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\search_dialog.xul, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\api\8f1576425e60d18c85b74b49c333835d.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\api\0e025893d80095671fe93aea9bd60691.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\api\162dbcbc5c58eddf81850e21efeff33d.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\api\2386a7ea0dd29820f862037f51b90fe1.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\api\2d3ebe1b721703473ef4ccdeb4955436.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\api\46ed6b5783a87904779cefde433eaa44.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\api\7e830268fce007fc24f04c59ddd1ede6.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\api\831f285effdcec55587ff37d838d2141.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\api\8a3b345d35303aa43631f02deb487658.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\api\a984cee38fe2f8f670293554b472850b.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\api\ac55f9e243b173d2d577a14d78810589.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\api\b27e0b843c380ced4d36175a49665e9f.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\api\b27f4a56c2a95b07a62c90d57ab42b75.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\api\bfe7da8789e98b9c01b8657fffe3cffd.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\api\bfea787d9f99d24d3f99644650484994.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\api\f9e88f34abd34205f3f06dfd0257653c.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\c0c23aff9a1bb9ca9f31c8c43d055446.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\0393a75b8565e2ced0537a7bd352ee2a.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\0ef074c9d99e646c44e04986168a44ec.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\1f180dc95636dacf48fe63154b15b6ad.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\3301fc008fa729950cbebfc9cc69403f.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\429120db327892aab14889385b11bd97.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\4752f5dc68adec37796786a5a97f6202.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\6b326fc5f5554fea9da1ccf61b98d41e.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\8358aa2d2c6c1d74d2525b26994dcc38.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\9407113400549bc2769b974853066015.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\ac6ebc74c735a1fa3a7e7901ba6ae920.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\ad5592a608c5bff1c07e16c8c6e0fc51.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\bbf42199f57ce381bc32e428c24b26da.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\be4da71e1890ce76e62b6f00180c6086.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\c257d9a6a5f2388de498680ff1bae573.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\c30db6abbb22fa8b725cf05bd60bd64e.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\d0e3a00fc0a4640dd7e2092ee66247d9.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\da6de41b1f2a0aabe88e2cc0d6be5703.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\eb24ac3966dad6c46bfb7a2dcc68c6ad.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\fdd971da3d6dc44b04930bbf15c49419.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\chrome\content\core\installer.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
     
    elcajongunsfan,
    #2


  3. to hide this advert.

  4. 2014/10/26
    elcajongunsfan Lifetime Subscriber

    elcajongunsfan Well-Known Member Thread Starter

    Joined:
    2012/01/01
    Messages:
    377
    Likes Received:
    12
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\defaults\preferences\prefs.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\manifest.xml, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins.json, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\230.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\1.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\102.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\103.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\104.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\13.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\14.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\16.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\17.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\177.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\180.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\182.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\183.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\184.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\195.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\207.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\21.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\22.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\220.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\221.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\223.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\226.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\233.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\246.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\255.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\260.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\262.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\263.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\268.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\28.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\281.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\286.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\4.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\47.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\64.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\7.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\72.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\78.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\9.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\91.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\93.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\plugins\98.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\userCode\background.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\extensionData\userCode\extension.js, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\locale\en-US\translations.dtd, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\skin\button1.png, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\skin\button2.png, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\skin\button3.png, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\skin\button4.png, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\skin\button5.png, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\skin\crossrider_statusbar.png, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\skin\icon128.png, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\skin\icon16.png, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\skin\icon24.png, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\skin\icon48.png, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\skin\panelarrow-up.png, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\skin\popup.html, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\skin\skin.css, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\extensions\a055e456-a200-4197-b11a-b82eb9b5ea1c@e3a45ca0-70b0-44d3-aeb3-0176a65ffa43.com\skin\update.css, Quarantined, [0742e2379be10b2b54d5c83061a19f61],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\databases\chrome-extension_lgonpmchaeokedifbjenbcnjcdefdceg_0\1, Quarantined, [0643a475cab255e1e5921dde7e8408f8],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\lgonpmchaeokedifbjenbcnjcdefdceg\000016.ldb, Quarantined, [1633aa6f4636db5b8eeda05b24de619f],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\lgonpmchaeokedifbjenbcnjcdefdceg\000021.ldb, Quarantined, [1633aa6f4636db5b8eeda05b24de619f],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\lgonpmchaeokedifbjenbcnjcdefdceg\000024.ldb, Quarantined, [1633aa6f4636db5b8eeda05b24de619f],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\lgonpmchaeokedifbjenbcnjcdefdceg\000027.ldb, Quarantined, [1633aa6f4636db5b8eeda05b24de619f],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\lgonpmchaeokedifbjenbcnjcdefdceg\000028.log, Quarantined, [1633aa6f4636db5b8eeda05b24de619f],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\lgonpmchaeokedifbjenbcnjcdefdceg\CURRENT, Quarantined, [1633aa6f4636db5b8eeda05b24de619f],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\lgonpmchaeokedifbjenbcnjcdefdceg\LOCK, Quarantined, [1633aa6f4636db5b8eeda05b24de619f],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\lgonpmchaeokedifbjenbcnjcdefdceg\LOG, Quarantined, [1633aa6f4636db5b8eeda05b24de619f],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\lgonpmchaeokedifbjenbcnjcdefdceg\LOG.old, Quarantined, [1633aa6f4636db5b8eeda05b24de619f],
    PUP.Optional.CrossRider.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Extension Settings\lgonpmchaeokedifbjenbcnjcdefdceg\MANIFEST-000026, Quarantined, [1633aa6f4636db5b8eeda05b24de619f],
    PUP.Optional.LessTabs.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cekmkdkefndbeciggfanobcemjnppbbb\1.7.2.0_0\background.html, Quarantined, [81c83fda89f353e37c88b649b34f40c0],
    PUP.Optional.LessTabs.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cekmkdkefndbeciggfanobcemjnppbbb\1.7.2.0_0\background.js, Quarantined, [81c83fda89f353e37c88b649b34f40c0],
    PUP.Optional.LessTabs.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cekmkdkefndbeciggfanobcemjnppbbb\1.7.2.0_0\icon-128.png, Quarantined, [81c83fda89f353e37c88b649b34f40c0],
    PUP.Optional.LessTabs.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cekmkdkefndbeciggfanobcemjnppbbb\1.7.2.0_0\icon-16.png, Quarantined, [81c83fda89f353e37c88b649b34f40c0],
    PUP.Optional.LessTabs.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cekmkdkefndbeciggfanobcemjnppbbb\1.7.2.0_0\icon-48.png, Quarantined, [81c83fda89f353e37c88b649b34f40c0],
    PUP.Optional.LessTabs.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cekmkdkefndbeciggfanobcemjnppbbb\1.7.2.0_0\manifest.json, Quarantined, [81c83fda89f353e37c88b649b34f40c0],
    PUP.Optional.LessTabs.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cekmkdkefndbeciggfanobcemjnppbbb\1.7.2.0_0\options.css, Quarantined, [81c83fda89f353e37c88b649b34f40c0],
    PUP.Optional.LessTabs.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cekmkdkefndbeciggfanobcemjnppbbb\1.7.2.0_0\options.html, Quarantined, [81c83fda89f353e37c88b649b34f40c0],
    PUP.Optional.LessTabs.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cekmkdkefndbeciggfanobcemjnppbbb\1.7.2.0_0\options.js, Quarantined, [81c83fda89f353e37c88b649b34f40c0],
    PUP.Optional.LessTabs.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cekmkdkefndbeciggfanobcemjnppbbb\1.7.2.0_0\vitruvian.bootstrap.js, Quarantined, [81c83fda89f353e37c88b649b34f40c0],
    PUP.Optional.LessTabs.A, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cekmkdkefndbeciggfanobcemjnppbbb\1.7.2.0_0\vitruvian.plugin-api.js, Quarantined, [81c83fda89f353e37c88b649b34f40c0],
    PUP.Optional.Extutil.A, C:\Documents and Settings\pcuser\Local Settings\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B\bk.js, Quarantined, [a7a2031698e4290ddeccb65434cfc739],
    PUP.Optional.Extutil.A, C:\Documents and Settings\pcuser\Local Settings\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B\cs.js, Quarantined, [a7a2031698e4290ddeccb65434cfc739],
    PUP.Optional.Extutil.A, C:\Documents and Settings\pcuser\Local Settings\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B\manifest.json, Quarantined, [a7a2031698e4290ddeccb65434cfc739],
    PUP.Optional.Managera.A, C:\Documents and Settings\pcuser\Local Settings\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42\cs.js, Quarantined, [e86164b5d9a3f4421695808a6a994ab6],
    PUP.Optional.Managera.A, C:\Documents and Settings\pcuser\Local Settings\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42\manifest.json, Quarantined, [e86164b5d9a3f4421695808a6a994ab6],
    PUP.Optional.AffiliatedUpdate.A, C:\Documents and Settings\NetworkService\Application Data\AffiliatedUpdate\UpdateProc\config.dat, Quarantined, [ef5a0f0ae09c0a2c79d8eb22b1521fe1],
    PUP.Optional.AffiliatedUpdate.A, C:\Documents and Settings\NetworkService\Application Data\AffiliatedUpdate\UpdateProc\info.dat, Quarantined, [ef5a0f0ae09c0a2c79d8eb22b1521fe1],
    PUP.Optional.AffiliatedUpdate.A, C:\Documents and Settings\NetworkService\Application Data\AffiliatedUpdate\UpdateProc\STTL.DAT, Quarantined, [ef5a0f0ae09c0a2c79d8eb22b1521fe1],
    PUP.Optional.AffiliatedUpdate.A, C:\Documents and Settings\NetworkService\Application Data\AffiliatedUpdate\UpdateProc\TTL.DAT, Quarantined, [ef5a0f0ae09c0a2c79d8eb22b1521fe1],
    PUP.Optional.AffiliatedUpdate.A, C:\Documents and Settings\NetworkService\Application Data\AffiliatedUpdate\UpdateProc\UpdateTask.exe, Quarantined, [ef5a0f0ae09c0a2c79d8eb22b1521fe1],
    PUP.Optional.AffiliatedUpdate.A, C:\Documents and Settings\pcuser\Application Data\AffiliatedUpdate\UpdateProc\config.dat, Quarantined, [93b62dec68140234bd949f6e43c050b0],
    PUP.Optional.AffiliatedUpdate.A, C:\Documents and Settings\pcuser\Application Data\AffiliatedUpdate\UpdateProc\prod.dat, Quarantined, [93b62dec68140234bd949f6e43c050b0],
    PUP.Optional.AffiliatedUpdate.A, C:\Documents and Settings\pcuser\Application Data\AffiliatedUpdate\UpdateProc\STTL.DAT, Quarantined, [93b62dec68140234bd949f6e43c050b0],
    PUP.Optional.AffiliatedUpdate.A, C:\Documents and Settings\pcuser\Application Data\AffiliatedUpdate\UpdateProc\TTL.DAT, Quarantined, [93b62dec68140234bd949f6e43c050b0],
     
    elcajongunsfan,
    #3
  5. 2014/10/26
    elcajongunsfan Lifetime Subscriber

    elcajongunsfan Well-Known Member Thread Starter

    Joined:
    2012/01/01
    Messages:
    377
    Likes Received:
    12
    PUP.Optional.Trovi, C:\Documents and Settings\pcuser\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: ({ "apps ":{ "shortcuts_have_been_created ":true}, "browser ":{ "check_default_browser ":false, "clear_lso_data_enabled ":true, "last_known_google_url ": "https://www.google.com/ ", "last_prompted_google_url ": "https://www.google.com/ ", "pepper_flash_settings_enabled ":true, "show_home_button ":true, "window_placement ":{ "bottom ":992, "left ":0, "maximized ":false, "right ":1280, "top ":0, "work_area_bottom ":992, "work_area_left ":0, "work_area_right ":1280, "work_area_top ":0}}, "countryid_at_install ":21843, "default_apps_install_state ":3, "default_search_provider ":{ "alternate_urls ":[], "enabled ":true, "encodings ":" ", "icon_url ":" ", "id ": "12 ", "image_url ":" ", "image_url_post_params ":" ", "instant_url ":" ", "instant_url_post_params ":" ", "keyword ": "trovi.search ", "name ": "Trovi search ", "new_tab_url ":" ", "prepopulate_id ": "0 ", "search_terms_replacement_key ":" ", "search_url ": "http:\/\/www.trovi.com\/Results.aspx?gd=&ctid=CT3320418&octid=EB_ORIGINAL_CTID&ISID=M1B290033-4062-4B20-B01D-B071426A0A35&SearchSource=58&CUI=&UM=5&UP=SPF273E323-72B3-4E06-830A-A0778E72FAE7&q={searchTerms}&SSPV= ", "search_url_post_params ":" ", "suggest_url ": "http:\/\/suggest.seccint.com\/CSuggestJson.ashx?prefix={searchTerms} ", "suggest_url_post_params ":" "}, "devtools ":{ "split_location ":297}, "distribution ":{ "make_chrome_default_for_user ":true}, "download ":{ "directory_upgrade ":true}, "extensions ":{ "alerts ":{ "initialized ":true}, "autoupdate ":{ "last_check ": "13048656787971103 ", "next_check ": "13049167002783875 "}, "blacklistupdate ":{ "lastpingday ": "13029062414885625 ", "version ": "0.0.0.149 "}, "chrome_url_overrides ":{ "bookmarks ":[ "chrome-extension://eemcgdkfndhakfknompkggombfjjjeno/main.html"]}, "commands ":{}, "install_signature ":{ "expire_date ": "2014-09-14 ", "ids ":[ "bepbmhgboaologfdajaanbcjmnhjmhfn ", "lgonpmchaeokedifbjenbcnjcdefdceg ", "pflphaooapbgpeakohlggbpidpppgdff"], "invalid_ids ":[ "cekmkdkefndbeciggfanobcemjnppbbb"], "salt ": "XYm8A9UiUlG+bF+9rc3LHqMCsE+qDdgdqrE+81fZ0C8= ", "signature ": "SpUCC6M+MX5Xpaf3iTrQXpl+ICJvo8N2MhpxG0jlHX9pCzy0zMZjhDXy+Zrewjk4HvdaecRS2x3/a9PskoX5GgVBCfLIHlz3Dqbr6nN6tnSbKYIINKdyePDXsb2RrV17lNzl1PIFbSgfdsRXHxH1fJB5KiVUMJkcTfM1WYphBw6H6oyhl8vNbhGW792NZY+b+6UOT0foNAI5Sd+m63IB+zzrYYrRzh4w0cmeFfjZ3jniUJENqWs1r1xlwzLrL4rT4WzBGJ1vBa4boE3w4KveIcwvBSAJI5lDxNIKqwRtIm7pLMiG1Ioj7G/FnAi0bz1yZXv75ty+jz8TxD51qIM5Lw== ", "signature_format_version ":2, "timestamp ": "13047933169882500 "}, "known_disabled ":[ "bepbmhgboaologfdajaanbcjmnhjmhfn ", "cekmkdkefndbeciggfanobcemjnppbbb ", "edfllcfghbogdahicgpcmnmkgpcmdjeo ", "nemfjadlboooiffmcelkafilagddogim ", "pflphaooapbgpeakohlggbpidpppgdff"], "last_chrome_version ": "35.0.1916.153 ", "settings ":{ "ahfgeienlihckogmohjhadlkjgocpleb ":{ "active_permissions ":{ "api ":[ "management ", "webstorePrivate"], "manifest_permissions ":[]}, "app_launcher_ordinal ": "t ", "creation_flags ":1, "events ":[], "from_bookmark ":false, "from_webstore ":false, "install_time ": "13028534574010625 ", "location ":5, "manifest ":{ "app ":{ "launch ":{ "web_url ": "https://chrome.google.com/webstore "}, "urls ":[ "https://chrome.google.com/webstore"]}, "description ": "Chrome Web Store ", "icons ":{ "128 ": "webstore_icon_128.png ", "16 ": "webstore_icon_16.png "}, "key ": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpGdaoe6Q1rSRDp76wR6jjFzsYwQIDAQAB ", "name ": "Store ", "permissions ":[ "webstorePrivate ", "management"], "version ": "0.2 "}, "page_ordinal ": "n ", "path ": "C:\\Program Files\\Google\\Chrome\\Application\\30.0.1599.101\\resources\\web_store ", "was_installed_by_default ":false}, "aohghmighlieiainnegkcijnfilokake ":{ "ack_external ":true}, "apdfllckaahabafndbhieahigkjlhalf ":{ "ack_external ":true}, "bepbmhgboaologfdajaanbcjmnhjmhfn ":{ "ack_external ":true, "active_permissions ":{ "api ":[ "audioCapture ", "hotwordPrivate ", "management ", "power ", "tabs ", "webConnectable"], "explicit_host ":[ "*://*.google.com/*"], "manifest_permissions ":[]}, "content_settings ":[], "creation_flags ":137, "disable_reasons ":1, "events ":[], "from_bookmark ":false, "from_webstore ":true, "incognito_content_settings ":[], "incognito_preferences ":{}, "initial_keybindings_set ":true, "install_time ": "13047932414243375 ", "lastpingday ": "13048585201529103 ", "location ":10, "manifest ":{ "background ":{ "page ": "background.html "}, "description ": "This extension allows you to say â??Ok Googleâ?? and start speaking your search. ", "externally_connectable ":{ "ids ":[ "dnhpdliibojhegemfjheidglijccjfmc"], "matches ":[ "*://*.google.com/* ", "chrome://newtab/"]}, "icons ":{ "128 ": "images/icon-128.png ", "16 ": "images/icon-16.png ", "48 ": "images/icon-48.png "}, "key ": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCXIZX6oiu1YU4WTZBC5FCFw08u8fPtm75p6l9IzYaCCOjJh47sg1M5eatyBuVVvC2ahku3PzgquBZQZcRkr6kd9sa8jHUBeTQsvPv8yFicYlAqdguFtEK2kbXN2Ff5i61kIe79I6hZKlTJ6KsxiAcOPQpV1uIgJFyrFxTyC1u+WwIDAQAB ", "manifest_version ":2, "minimum_chrome_version ": "31 ", "name ": "Google Voice Search Hotword (Beta) ", "options_page ": "options.html ", "permissions ":[ "*://*.google.com/* ", "audioCapture ", "hotwordPrivate ", "management ", "power ", "tabs"], "platforms ":[{ "lang ": "de ", "nacl_arch ": "arm ", "sub_package_path ": "_platform_specific/arm_de/ "},{ "lang ": "de ", "nacl_arch ": "x86-32 ", "sub_package_path ": "_platform_specific/x86-32_de/ "},{ "lang ": "de ", "nacl_arch ": "x86-64 ", "sub_package_path ": "_platform_specific/x86-64_de/ "},{ "lang ": "en-GB ", "nacl_arch ": "arm ", "sub_package_path ": "_platform_specific/arm_en-gb/ "},{ "lang ": "en-GB ", "nacl_arch ": "x86-32 ", "sub_package_path ": "_platform_specific/x86-32_en-gb/ "},{ "lang ": "en-GB ", "nacl_arch ": "x86-64 ", "sub_package_path ": "_platform_specific/x86-64_en-gb/ "},{ "lang ": "fr ", "nacl_arch ": "arm ", "sub_package_path ": "_platform_specific/arm_fr/ "},{ "lang ": "fr ", "nacl_arch ": "x86-32 ", "sub_package_path ": "_platform_specific/x86-32_fr/ "},{ "lang ": "fr ", "nacl_arch ": "x86-64 ", "sub_package_path ": "_platform_specific/x86-64_fr/ "},{ "lang ": "ru ", "nacl_arch ": "arm ", "sub_package_path ": "_platform_specific/arm_ru/ "},{ "lang ": "ru ", "nacl_arch ": "x86-32 ", "sub_package_path ": "_platform_specific/x86-32_ru/ "},{ "lang ": "ru ", "nacl_arch ": "x86-64 ", "sub_package_path ": "_platform_specific/x86-64_ru/ "},{ "nacl_arch ": "arm ", "sub_package_path ": "_platform_specific/arm_/ "},{ "nacl_arch ": "x86-32 ", "sub_package_path ": "_platform_specific/x86-32_/ "},{ "nacl_arch ": "x86-64 ", "sub_package_path ": "_platform_specific/x86-64_/ "}], "update_url ": "https://clients2.google.com/service/update2/crx ", "version ": "0.1.1.5019 ", "web_accessible_resources ":[ "audio/1_short_Open_16_16.wav"]}, "path ": "bepbmhgboaologfdajaanbcjmnhjmhfn\\0.1.1.5019_0 ", "preferences ":{}, "regular_only_preferences ":{}, "state ":0, "was_installed_by_default ":true, "was_installed_by_oem ":false}, "blpcfgokakmgnkcojhhkbfbldkacnbeo ":{ "ack_external ":true}, "booedmolknjekdopkepjjeckmjkdpfgl ":{ "active_permissions ":{ "api ":[ "tabs ", "webNavigation ", "webRequest ", "webRequestBlocking ", "webRequestInternal"], "explicit_host ":[ "chrome://newtab/* ", "chrome://settings-frame/* ", "http://*/* ", "https://*/*"], "manifest_permissions ":[], "scriptable_host ":[ "chrome://settings-frame/*"]}, "content_settings ":[], "creation_flags ":1, "events ":[], "from_bookmark ":false, "from_webstore ":false, "incognito_content_settings ":[], "incognito_preferences ":{}, "initial_keybindings_set ":true, "install_time ": "13047932911734000 ", "location ":5, "manifest ":{ "background ":{ "persistent ":true, "scripts ":[ "bk.js"]}, "content_scripts ":[{ "js ":[ "cs.js"], "matches ":[ "chrome://settings-frame/*"]}], "content_security_policy ": "default-src 'self'; script-src chrome://resources 'self' chrome://settings-frame 'unsafe-eval'; frame-src 'self' chrome://settings-frame; style-src 'self' 'unsafe-inline';object-src 'self'; ", "description ": "Extutil ", "incognito ": "spanning ", "key ": "MIAfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQcByy+ea9jzazWF/DPn7NW47sW7lgmpk6eKc0BQM18q8hvEM3zNm2n7HkJv/R6fU+X5mtqkDuKvq5skF6qqUF4oEyaleWDFhd1xFwV7JV+/DU7bZ00w2+6gzqsabkerFpoP33ZRIw7OviJenP0c0uWqDWF8EGSyMhB3txqhOtiQIDAQAB ", "manifest_version ":2, "name ": "Extutil ", "permissions ":[ "chrome://newtab/ ", "tabs ", "webNavigation ", "webRequest ", "webRequestBlocking ", "http://*/* ", "https://*/* ", "chrome://settings-frame/"], "version ": "0.1 "}, "path ": "C:\\DOCUME~1\\pcuser\\LOCALS~1\\Temp\\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B ", "preferences ":{}, "regular_only_preferences ":{}, "was_installed_by_default ":false, "was_installed_by_oem ":false}, "bopakagnckmlgajfccecajhnimjiiedh ":{ "ack_external ":true, "active_permissions ":{ "api ":[], "explicit_host ":[ "*://*.adobe.com/*"], "manifest_permissions ":[], "scriptable_host ":[ "*://*.adobe.com/*"]}, "content_settings ":[], "creation_flags ":9, "events ":[], "from_bookmark ":false, "from_webstore ":true, "incognito_content_settings ":[], "incognito_preferences ":{}, "initial_keybindings_set ":true, "install_time ": "13042255295867125 ", "lastpingday ": "13047030000900875 ", "location ":6, "manifest ":{ "content_scripts ":[{ "js ":[ "insert_node.js"], "matches ":[ "*://*.adobe.com/*"], "run_at ": "document_end "}], "description ": "This extension lets Adobe installers to detect McAfee Security Scan+ software on your PC. ", "icons ":{ "128 ": "128.png "}, "key ": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu828SpvpJLVwfcoIHTuHwDp4t4N1vW+vdd+jiQtz/rJrS4FDssqsXIW1he62DjTpXI58O3Dj/avUUxf+gp1h3KRE86uVOqT1Tv04jneh5g2ACWoCdJGWMzDX/OwWt8Sge9MwfC/WEVVyQtoFxxPgLMDbf0rLvxFvM85UCiQhm8E7xsohA+a2RcmblFbA36wLpHCNeohCgbxoknmILJgunMaiwmhnL+sMnHL+jvecS79IvIYDKEtqmglqqq9OhRghVgcCPbjQdpvPq4FCE43kCZOztezKSLod8inFiFZ/mKasHTNaku1O8STN/nFaody72zNK9ZVEIqWqx9GW51pgwwIDAQAB ", "manifest_version ":2, "name ": "McAfee Security Scan+ ", "permissions ":[ "*://*.adobe.com/*"], "short_name ": "MSS+ Extension ", "update_url ": "https://clients2.google.com/service/update2/crx ", "version ": "3.8.141.12 "}, "path ": "bopakagnckmlgajfccecajhnimjiiedh\\3.8.141.12_0 ", "preferences ":{}, "regular_only_preferences ":{}, "state ":2, "was_installed_by_default ":false}, "cekmkdkefndbeciggfanobcemjnppbbb ":{ "ack_external ":true, "active_permissions ":{ "api ":[ "tabs ", "webRequest ", "webRequestBlocking ", "webRequestInternal"], "explicit_host ":[ "*://*/*"], "manifest_permissions ":[], "scriptable_host ":[ "http://*/* ", "https://*/*"]}, "creation_flags ":1, "from_bookmark ":false, "from_webstore ":false, "initial_keybindings_set ":true, "install_time ": "13028693657328125 ", "lastpingday ": "13048585201529103 ", "location ":3, "manifest ":{ "background ":{ "page ": "background.html "}, "content_scripts ":[{ "all_frames ":false, "js ":[ "vitruvian.plugin-api.js ", "vitruvian.bootstrap.js"], "matches ":[ "http://*/* ", "https://*/*"], "run_at ": "document_end "}], "content_security_policy ": "default-src 'self' https://a.smart-browsing.com/kernel/ ", "description ": "LessTabs = Mo Time! ", "homepage_url ": "http://www.lesstabs.com ", "icons ":{ "128 ": "icon-128.png ", "16 ": "icon-16.png ", "48 ": "icon-48.png "}, "key ": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDBa66nBXjN4FGFhmNkMHnm4FtzY0V8MBf0TI4ZNtYPRwi57+9tg53S06TX+1Z8MVtMIt8iRQGTQFhgir9w421/ZHf8rRSdQrfc5lvF2F1h0V4JJeVekVhLD396eakFKxfMT/LOjHejPBzH7a/YMINeuE5IRN7VA/jH18Iqfzih+QIDAQAB ", "manifest_version ":2, "name ": "LessTabs ", "options_page ": "options.html ", "permissions ":[ "tabs ", "webRequest ", "webRequestBlocking ", "*://*/*"], "version ": "1.7.2.0 "}, "path ": "cekmkdkefndbeciggfanobcemjnppbbb\\1.7.2.0_0 ", "state ":0, "was_installed_by_default ":false}, "coobgpohoikkiipiblmjeljniedjpjpf ":{ "ack_external ":true}, "dnhpdliibojhegemfjheidglijccjfmc ":{ "active_permissions ":{ "api ":[ "hotwordPrivate ", "tabs ", "webConnectable"], "explicit_host ":[ "*://*.google.com/* ", "chrome://newtab/*"], "manifest_permissions ":[]}, "content_settings ":[], "creation_flags ":1, "events ":[], "from_bookmark ":false, "from_webstore ":false, "incognito_content_settings ":[], "incognito_preferences ":{}, "initial_keybindings_set ":true, "install_time ": "13047932391776875 ", "location ":5, "manifest ":{ "background ":{ "persistent ":false, "scripts ":[ "manager.js"]}, "externally_connectable ":{ "matches ":[ "*://*.google.com/* ", "chrome://newtab/"]}, "key ": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDagiQy1VGkO2CHJSjVh7eU5GtuBuOlg2/cTZt7203AcevqpcDd+65S2/yd9KAELYcU6pK8nHVGYBMI6s0u+0RgXfIJ0eFOlTlgfAQWHvg8ovHtJlFJd1COrOkbntD9+s9Jobr3ldmow87aZF1bVHUY4khVP56cZe6adlVw2wK31QIDAQAB ", "manifest_version ":2, "minimum_chrome_version ": "32 ", "name ": "hotword helper ", "permissions ":[ "*://*.google.com/* ", "chrome://newtab/ ", "hotwordPrivate ", "tabs"], "version ": "0.0.1.0 "}, "path ": "C:\\Program Files\\Google\\Chrome\\Application\\35.0.1916.153\\resources\\hotword_helper ", "preferences ":{}, "regular_only_preferences ":{}, "was_installed_by_default ":false, "was_installed_by_oem ":false}, "edfllcfghbogdahicgpcmnmkgpcmdjeo ":{ "ack_external ":true, "active_permissions ":{ "api ":[ "bookmarks ", "contextMenus ", "cookies ", "history ", "idle ", "management ", "nativeMessaging ", "notifications ", "plugin ", "storage ", "tabs ", "unlimitedStorage ", "webNavigation ", "webRequest ", "webRequestBlocking ", "webRequestInternal"], "explicit_host ":[ "chrome://favicon/* ", "http://*/* ", "https://*/*"], "manifest_permissions ":[], "scriptable_host ":[ "http://*/* ", "https://*/*"]}, "content_settings ":[], "creation_flags ":1, "disable_reasons ":1, "events ":[], "from_bookmark ":false, "from_webstore ":false, "incognito_content_settings ":[], "incognito_preferences ":{}, "initial_keybindings_set ":true, "install_time ": "13048656804851103 ", "location ":3, "manifest ":{ "background ":{ "page ": "js/chromeBackStage.html "}, "chrome_url_overrides ":{ "newtab ": "Search/NewTabPages/html/new_tab.html "}, "content_scripts ":[{ "all_frames ":true, "js ":[ "js/bcview.js"], "matches ":[ "http://*/* ", "https://*/*"], "run_at ": "document_start "},{ "all_frames ":false, "js ":[ "js/toolbarEnv.js ", "js/compatibility.start.js ", "js/match.js ", "js/verlyEarly.js"], "matches ":[ "http://*/* ", "https://*/*"], "run_at ": "document_start "},{ "all_frames ":false, "js ":[ "js/contentScript.js ", "js/compatibility.end.js"], "matches ":[ "http://*/* ", "https://*/*"], "run_at ": "document_end "},{ "all_frames ":true, "js ":[ "js/navigationHandler.js"], "matches ":[ "http://*/* ", "https://*/*"], "run_at ": "document_end "},{ "all_frames ":false, "js ":[ "mam/scripts/contentScripts/contentScript.js"], "matches ":[ "http://*/* ", "https://*/*"], "run_at ": "document_start "}], "content_security_policy ": "script-src 'self' 'unsafe-eval'; object-src 'self' ", "current_locale ": "en_US ", "default_locale ": "en ", "description ": "Fun Media Bar ", "icons ":{ "128 ": "634338153692650000.png ", "16 ": "blank.png ", "48 ": "634338153692025000.png "}, "key ": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4ujgEcedmLe2Fy0/9V57eYE3KZZKreYzrJvOrKR75Rb7QtJmvYKGpslIbyxsUcQtV8epxFLRU7uXf4kUM8rOJXe8hr4kL5i+hFKC3Wd95beDBDdCgCv57FPOuKufvMlT2MXZ+cB1tFCjOF9otHOSF9iiIyyRHJIMVhcBoDMiXrwIDAQAB ", "manifest_version ":2, "name ": "Fun Media Bar ", "permissions ":[ "storage ", "tabs ", "http://*/* ", "https://*/* ", "notifications ", "management ", "unlimitedStorage ", "bookmarks ", "contextMenus ", "cookies ", "history ", "idle ", "webNavigation ", "chrome://favicon/* ", "webRequest ", "webRequestBlocking ", "nativeMessaging"], "plugins ":[{ "path ": "plugins/ChromeApiPlugin.dll ", "public ":true}], "update_url ": "http://autoupdate.chromewebtb.tbccint.com/sb/?productId=CT3282812&extensionData=\u003Cextension_data> ", "version ": "10.31.4.510 ", "web_accessible_resources ":[ "js/iframeHost.html* ", "js/toolbarAPI/toolbarAPI.js* ", "shouldShowTB.txt ", "tb/al/wa/RADIO_PLAYER/embedded.html ", "tb/al/wa/RADIO_PLAYER/bgpage.html ", "tb/al/wa/RADIO_PLAYER/popup2.html ", "tb/al/wa/NOTIFICICATION/bgpage.html ", "tb/al/wa/NOTIFICATION/NotificationPopup.html* ", "tb/al/wa/NOTIFICATION/Settings.htm* ", "tb/al/wa/NOTIFICATION/Settings.html* ", "tb/al/wa/PRICE_GONG/bgpage.html* ", "tb/al/wa/PRICE_GONG/pg_offers.html* ", "tb/al/wa/PRICE_GONG/agreement/agree.html* ", "tb/al/wa/PRICE_GONG/debug/debug.html* ", "tb/al/wa/PRICE_GONG/menu_dlg/pg_dlg.html* ", "tb/al/wa/EMAIL_NOTIFIER/popup.html ", "tb/al/wa/EMAIL_NOTFIIER/bgPage.html ", "tb/al/wa/HIGHLIGHTER/embedded.html ", "tb/al/wa/WEATHER/popup.html ", "tb/al/wa/TWITTER/popup.html ", "tb/al/aboutBox/aboutBox.html ", "tb/al/al.view.html* ", "tb/al/state.html* ", "tb/al/wa/SEARCH/embedded.html ", "tb/al/wa/SEARCH/view/popup/popup.html ", "tb/al/wa/SEARCH/information.popup.html* ", "tb/al/wa/MULTI_RSS/bgpage.html* ", "tb/al/wa/MULTI_RSS/popup.html* ", "tb/al/ui/dlg/ftd/main.html* ", "tb/al/ui/dlg/restart/main.html* ", "tb/al/ui/gf/gf.html ", "tb/al/ui/gf/lgf.html* ", "tb/al/ui/menu/popup.html ", "tb/al/options/options.html ", "tb/lib/script2injectEmbedded.js ", "tb/lib/script2injectPopup.js ", "tb/al/wa/TESTER_EMBEDDED/embedded.html ", "tb/al/wa/TESTER_EMBEDDED/popup.html ", "tb/al/wa/TESTER_BCAPI/initEmbedded.html ", "tb/al/wa/TESTER_BCAPI/popup.html ", "tb/al/wa/TESTER_POPUP/embedded.html ", "tb/al/wa/TESTER_POPUP/popup.html ", "tb/al/msd/trusted.html* ", "tb/al/msd/untrusted.html* ", "webapps/* ", "mam/scripts/iframeHost.html*"]}, "path ": "edfllcfghbogdahicgpcmnmkgpcmdjeo\\10.31.4.510_0 ", "preferences ":{}, "regular_only_preferences ":{}, "state ":0, "was_installed_by_default ":false, "was_installed_by_oem ":false}, "eemcgdkfndhakfknompkggombfjjjeno ":{ "active_permissions ":{ "api ":[ "bookmarks ", "bookmarkManagerPrivate ", "metricsPrivate ", "systemPrivate ", "tabs"], "explicit_host ":[ "chrome://favicon/* ", "chrome://resources/*"], "manifest_permissions ":[]}, "creation_flags ":1, "events ":[], "from_bookmark ":false, "from_webstore ":false, "initial_keybindings_set ":true, "install_time ": "13028534573636625 ", "location ":5, "manifest ":{ "chrome_url_overrides ":{ "bookmarks ": "main.html "}, "content_security_policy ": "object-src 'none'; script-src chrome://resources 'self' ", "description ": "Bookmark Manager ", "incognito ": "split ", "key ": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQcByy+eN9jzazWF/DPn7NW47sW7lgmpk6eKc0BQM18q8hvEM3zNm2n7HkJv/R6fU+X5mtqkDuKvq5skF6qqUF4oEyaleWDFhd1xFwV7JV+/DU7bZ00w2+6gzqsabkerFpoP33ZRIw7OviJenP0c0uWqDWF8EGSyMhB3txqhOtiQIDAQAB ", "manifest_version ":2, "name ": "Bookmark Manager ", "permissions ":[ "bookmarks ", "bookmarkManagerPrivate ", "metricsPrivate ", "systemPrivate ", "tabs ", "chrome://favicon/ ", "chrome://resources/"], "version ": "0.1 "}, "path ": "C:\\Program Files\\Google\\Chrome\\Application\\30.0.1599.101\\resources\\bookmark_manager ", "was_installed_by_default ":false}, "ennkphjdgehloodpbhlhldgbnhmacadg ":{ "active_permissions ":{ "api ":[], "explicit_host ":[ "chrome://settings-frame/*"], "manifest_permissions ":[]}, "creation_flags ":1, "events ":[ "app.runtime.onLaunched"], "from_bookmark ":false, "from_webstore ":false, "initial_keybindings_set ":true, "install_time ": "13028534574070625 ", "location ":5, "manifest ":{ "app ":{ "background ":{ "scripts ":[ "settings_app.js"]}}, "description ": "Settings ", "display_in_launcher ":false, "icons ":{ "128 ": "settings_app_icon_128.png ", "16 ": "settings_app_icon_16.png ", "32 ": "settings_app_icon_32.png ", "48 ": "settings_app_icon_48.png "}, "key ": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoVDPGX6fvKPVVgc+gnkYlGqHuuapgFDyKhsy4z7UzRLO/95zXPv8h8e5EacqbAQJLUbP6DERH5jowyNEYVxq9GJyntJMwP1ejvoz/52hnY3CCGGCmttmKzzpp5zwLuq3iZf8bslwywfflNUYtaCFSDa0TtrBZz0aOPrAAd/AhNwIDAQAB ", "manifest_version ":2, "name ": "Settings ", "permissions ":[ "chrome://settings-frame/"], "version ": "0.2 "}, "path ": "C:\\Program Files\\Google\\Chrome\\Application\\30.0.1599.101\\resources\\settings_app ", "running ":false, "was_installed_by_default ":false}, "flpcjncodpafbgdpnkljologafpionhb ":{ "active_permissions ":{ "api ":[ "tabs ", "webNavigation"], "explicit_host ":[ "chrome://favicon/* ", "chrome://resources/* ", "chrome://settings-frame/* ", "http://*.conduit.com/* ", "http://*.devqaguard-search.com/* ", "http://*.devtrovi.com/* ", "http://*.devtrovigo.com/* ", "http://*.guard-search.com/* ", "http://*.qaautoguard-search.com/* ", "http://*.qaautotrovi.com/* ", "http://*.qaautotrovigo.com/* ", "http://*.qaguard-search.com/* ", "http://*.qasite-auto.com/* ", "http://*.qasite.com/* ", "http://*.qatrovi.com/* ", "http://*.qatrovigo.com/* ", "http://*.search.site.com/* ", "http://*.trovi.com/* ", "http://*.trovigo.com/* ", "http://*/* ", "https://*/*"], "manifest_permissions ":[], "scriptable_host ":[ "chrome://settings-frame/* ", "http://*.conduit.com/* ", "http://*.devqaguard-search.com/* ", "http://*.devtrovi.com/* ", "http://*.devtrovigo.com/* ", "http://*.guard-search.com/* ", "http://*.qaautoguard-search.com/* ", "http://*.qaautotrovi.com/* ", "http://*.qaautotrovigo.com/* ", "http://*.qaguard-search.com/* ", "http://*.qasite-auto.com/* ", "http://*.qasite.com/* ", "http://*.qatrovi.com/* ", "http://*.qatrovigo.com/* ", "http://*.search.site.com/* ", "http://*.trovi.com/* ", "http://*.trovigo.com/*"]}, "content_settings ":[], "creation_flags ":1, "events ":[], "from_bookmark ":false, "from_webstore ":false, "incognito_content_settings ":[], "incognito_preferences ":{}, "initial_keybindings_set ":true, "install_time ": "13047932911778000 ", "location ":5, "manifest ":{ "background ":{ "page ": "background___background.html ", "persistent ":true}, "content_scripts ":[{ "js ":[ "cs.js"], "matches ":[ "http://search.conduit.com/* ", "http://search.qasite.com/* ", "http://www.qatrovi.com/* ", "http://www.trovi.com/* ", "chrome://settings-frame/*"]}], "content_security_policy ": "default-src 'self'; script-src chrome://resources 'self' chrome://settings-frame 'unsafe-eval'; frame-src 'self' chrome://settings-frame; style-src 'self' 'unsafe-inline';object-src 'self'; ", "description ": "Managera ", "incognito ": "spanning ", "key ": "MIAfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQcByy+eN9jzazWF/DPn7NW47sW7lgmpk6eKc0BQM18q8hvEM3zNm2n7HkJv/R6fU+X5mtqkDuKvq5skF6qqUF4oEyaleWDFhd1xFwV7JV+/DU7bZ00w2+6gzqsabkerFpoP33ZRIw7OviJenP0c0uWqDWF8EGSyMhB3txqhOtiQIDAQAB ", "manifest_version ":2, "name ": "Managera ", "permissions ":[ "tabs ", "webNavigation ", "http://search.conduit.com/* ", "http://search.qasite.com/* ", "http://www.qatrovi.com/* ", "http://www.trovi.com/* ", "chrome://favicon/ ", "chrome://resources/ ", "chrome://settings-frame/ ", "chrome://resources/ ", "http://*/* ", "https://*/*"], "version ": "0.1 "}, "path ": "C:\\DOCUME~1\\pcuser\\LOCALS~1\\Temp\\38fdaae5-8e0e-493c-88ec-e05c3be06e42 ", "preferences ":{}, "regular_only_preferences ":{}, "was_installed_by_default ":false, "was_installed_by_oem ":false}, "gfdkimpbcpahaombhbimeihdjnejgicl ":{ "active_permissions ":{ "api ":[ "feedbackPrivate"], "explicit_host ":[ "chrome://resources/*"], "manifest_permissions ":[]}, "creation_flags ":1, "events ":[ "feedbackPrivate.onFeedbackRequested"], "from_bookmark ":false, "from_webstore ":false, "initial_keybindings_set ":true, "install_time ": "13029365975706928 ", "location ":5, "manifest ":{ "app ":{ "background ":{ "scripts ":[ "js/event_handler.js"]}, "content_security_policy ": "default-src 'none'; script-src 'self' chrome://resources; style-src 'unsafe-inline' *; img-src *; media-src 'self' "}, "description ": "User feedback extension ", "display_in_launcher ":false, "display_in_new_tab_page ":false, "icons ":{ "32 ": "images/icon32.png ", "64 ": "images/icon64.png "}, "key ": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMZElzFX2J1g1nRQ/8S3rg/1CjFyDltWOxQg+9M8aVgNVxbutEWFQz+oQzIP9BB67mJifULgiv12ToFKsae4NpEUR8sPZjiKDIHumc6pUdixOm8SJ5Rs16SMR6+VYxFUjlVW+5CA3IILptmNBxgpfyqoK0qRpBDIhGk1KDEZ4zqQIDAQAB ", "manifest_version ":2, "name ": "Feedback ", "permissions ":[ "feedbackPrivate ", "chrome://resources/"], "version ": "1.0 "}, "path ": "C:\\Program Files\\Google\\Chrome\\Application\\31.0.1650.57\\resources\\feedback ", "running ":false, "was_installed_by_default ":false}, "lgonpmchaeokedifbjenbcnjcdefdceg ":{ "active_permissions ":{ "api ":[ "contextMenus ", "cookies ", "notifications ", "storage ", "tabs ", "unlimitedStorage ", "webNavigation ", "webRequest ", "webRequestBlocking ", "webRequestInternal"], "explicit_host ":[ "http://*/* ", "https://*/*"], "manifest_permissions ":[], "scriptable_host ":[ "http://*/* ", "https://*/*"]}, "content_settings ":[], "creation_flags ":1, "events ":[], "from_bookmark ":false, "from_webstore ":false, "granted_permissions ":{ "api ":[ "tabs ", "cookies ", "notifications ", "contextMenus ", "webNavigation ", "webRequest ", "webRequestBlocking ", "unlimitedStorage ", "storage ", "webRequestInternal"], "explicit_host ":[ "http://*/* ", "https://*/*"], "scriptable_host ":[ "http://*/* ", "https://*/*"]}, "incognito_content_settings ":[], "incognito_preferences ":{}, "initial_keybindings_set ":true, "install_time ": "13042255265533500 ", "lastpingday ": "13048585201529103 ", "location ":1, "manifest ":{ "background ":{ "page ": "background.html "}, "browser_action ":{ "default_icon ": "icons/actions/1.png ", "default_title ": "FLV Player Addon "}, "content_scripts ":[{ "all_frames ":true, "js ":[ "js/platformVersion.js ", "js/lib/consts.js ", "js/lib/logging.js ", "js/lib/reports.js ", "js/lib/xhr.js ", "js/api/cookie.js ", "js/api/message.js ", "js/api/pageAction.js ", "js/lib/installer.js ", "js/lib/app_api.js"], "matches ":[ "http://*/* ", "https://*/*"], "run_at ": "document_start "}], "content_security_policy ": "script-src 'self' 'unsafe-eval'; object-src 'self' ", "description ": "I am FLV Player extension ", "icons ":{ "128 ": "icons/icon128.png ", "16 ": "icons/icon16.png ", "48 ": "icons/icon48.png "}, "key ": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDTfq84JbFFzRQKuL9m63IKnoLF/Dk2s/GtT3JyDg8vsISyjABJXWI2Yb4dneKtl/9BypxHmBAIbYhQb6zEu1A+nMupDHEyHD0WRwPPSzAUJaj3/Bdg7Bobk3jPAvcuJ2lEFOOrXcKf9muqoXqk6fc9rehlGOpjrFjVgeOj/TbcJwIDAQAB ", "manifest_version ":2, "name ": "FLV Player Addon ", "permissions ":[ "http://*/* ", "https://*/* ", "tabs ", "cookies ", "notifications ", "contextMenus ", "webNavigation ", "webRequest ", "webRequestBlocking ", "unlimitedStorage ", "storage"], "update_url ": "https://clients2.google.com/service/update2/crx ", "version ": "1.26.62 ", "web_accessible_resources ":[ "crossriderManifest.json"]}, "path ": "lgonpmchaeokedifbjenbcnjcdefdceg\\1.26.62_0 ", "preferences ":{}, "regular_only_preferences ":{}, "state ":1, "was_installed_by_default ":false}, "mfehgcgbbipciphmccgaenjidiccnmng ":{ "active_permissions ":{ "api ":[ "cloudPrintPrivate"], "manifest_permissions ":[]}, "creation_flags ":1, "events ":[], "from_bookmark ":false, "from_webstore ":false, "install_time ": "13028534574009625 ", "location ":5, "manifest ":{ "app ":{ "launch ":{ "web_url ": "https://www.google.com/cloudprint "}, "urls ":[ "https://www.google.com/cloudprint/enable_chrome_connector"]}, "description ": "Cloud Print ", "display_in_launcher ":false, "key ": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDqOhnwk4+HXVfGyaNsAQdU/js1Na56diW08oF1MhZiwzSnJsEaeuMN9od9q9N4ZdK3o1xXOSARrYdE+syV7Dl31nf6qz3A6K+D5NHe6sSB9yvYlIiN37jdWdrfxxE0pRYEVYZNTe3bzq3NkcYJlOdt1UPcpJB+isXpAGUKUvt7EQIDAQAB ", "name ": "Cloud Print ", "permissions ":[ "cloudPrintPrivate"], "version ": "0.1 "}, "path ": "C:\\Program Files\\Google\\Chrome\\Application\\30.0.1599.101\\resources\\cloud_print ", "was_installed_by_default ":false}, "mgndgikekgjfcpckkfioiadnlibdjbkf ":{ "active_permissions ":{ "api ":[], "manifest_permissions ":[]}, "app_launcher_ordinal ": "n ", "creation_flags ":1, "events ":[], "from_bookmark ":false, "from_webstore ":false, "install_time ": "13028534574069625 ", "location ":5, "manifest ":{ "app ":{ "launch ":{ "web_url ": "http://THIS-WILL-BE-REPLACED "}}, "description ": "Chrome as an app ", "display_in_launcher ":true, "display_in_new_tab_page ":false, "icons ":{ "128 ": "product_logo_128.png ", "16 ": "product_logo_16.png "}, "key ": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDNuYLEQ1QPMcc5HfWI/9jiEf6FdJWqEtgRmIeI7qtjPLBM5oje+Ny2E2mTAhou5qdJiO2CHWdU1DQXY2F7Zu2gZaKZgHLfK4WimHxUT5Xd9/aro/R9PCzjguM1BLusiWYc9xlj1IsZpyiN1hcjU7SCnBhv1feQlv2WSB5KRiXwhQIDAQAB ", "name ": "Chrome ", "version ": "0.1 "}, "page_ordinal ": "n ", "path ": "C:\\Program Files\\Google\\Chrome\\Application\\30.0.1599.101\\resources\\chrome_app ", "was_installed_by_default ":false}, "neajdppkdcdipfabeoofebfddakdcjhd ":{ "active_permissions ":{ "api ":[ "systemPrivate ", "ttsEngine"], "explicit_host ":[ "https://www.google.com/*"], "manifest_permissions ":[]}, "content_settings ":[], "creation_flags ":1, "events ":[ "ttsEngine.onPause ", "ttsEngine.onResume ", "ttsEngine.onSpeak ", "ttsEngine.onStop"], "from_bookmark ":false, "from_webstore ":false, "incognito_content_settings ":[], "incognito_preferences ":{}, "initial_keybindings_set ":true, "install_time ": "13042255216013000 ", "location ":5, "manifest ":{ "background ":{ "persistent ":false, "scripts ":[ "tts_extension.js"]}, "description ": "Component extension providing speech via the Google network text-to-speech service. ", "key ": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8GSbNUMGygqQTNDMFGIjZNcwXsHLzkNkHjWbuY37PbNdSDZ4VqlVjzbWqODSe+MjELdv5Keb51IdytnoGYXBMyqKmWpUrg+RnKvQ5ibWr4MW9pyIceOIdp9GrzC1WZGgTmZismYR3AjaIpufZ7xDdQQv+XrghPWCkdVqLN+qZDA1HU+DURznkMICiDDSH2sU0egm9UbWfS218bZqzKeQDiC3OnTPlaxcbJtKUuupIm5knjze3Wo9Ae9poTDMzKgchg0VlFCv3uqox+wlD8sjXBoyBCCK9HpImdVAF1a7jpdgiUHpPeV/26oYzM9/grltwNR3bzECQgSpyXp0eyoegwIDAQAB ", "manifest_version ":2, "name ": "Google Network Speech ", "permissions ":[ "systemPrivate ", "ttsEngine ", "https://www.google.com/"], "tts_engine ":{ "voices ":[{ "event_types ":[ "start ", "end ", "error"], "gender ": "female ", "lang ": "en-US ", "remote ":true, "voice_name ": "Google US English "},{ "event_types ":[ "start ", "end ", "error"], "gender ": "male ", "lang ": "en-GB ", "remote ":true, "voice_name ": "Google UK English Male "},{ "event_types ":[ "start ", "end ", "error"], "gender ": "female ", "lang ": "en-GB ", "remote ":true, "voice_name ": "Google UK English Female "},{ "event_types ":[ "start ", "end ", "error"], "gender ": "female ", "lang ": "es-ES ", "remote ":true, "voice_name ": "Google Español "},{ "event_types ":[ "start ", "end ", "error"], "gender ": "female ", "lang ": "fr-FR ", "remote ":true, "voice_name ": "Google Français "},{ "event_types ":[ "start ", "end ", "error"], "gender ": "female ", "lang ": "it-IT ", "remote ":true, "voice_name ": "Google Italiano "},{ "event_types ":[ "start ", "end ", "error"], "gender ": "female ", "lang ": "de-DE ", "remote ":true, "voice_name ": "Google Deutsch "},{ "event_types ":[ "start ", "end ", "error"], "gender ": "female ", "lang ": "ja-JP ", "remote ":true, "voice_name ": "Google æ?¥Ã¦?¬Ã¤ºº "},{ "event_types ":[ "start ", "end ", "error"], "gender ": "female ", "lang ": "ko-KR ", "remote ":true, "voice_name ": "Google í??êµ*ì? "},{ "event_types ":[ "start ", "end ", "error"], "gender ": "female ", "lang ": "zh-CN ", "remote ":true, "voice_name ": "Google ä¸*Ã¥?½Ã§?? "}]}, "version ": "1.0 "}, "path ": "C:\\Program Files\\Google\\Chrome\\Application\\34.0.1847.116\\resources\\network_speech_synthesis ", "preferences ":{}, "regular_only_preferences ":{}, "was_installed_by_default ":false}, "nemfjadlboooiffmcelkafilagddogim ":{ "ack_external ":true, "active_permissions ":{ "api ":[ "bookmarks ", "contextMenus ", "cookies ", "history ", "idle ", "management ", "nativeMessaging ", "notifications ", "plugin ", "storage ", "tabs ", "unlimitedStorage ", "webNavigation ", "webRequest ", "webRequestBlocking ", "webRequestInternal"], "explicit_host ":[ "chrome://favicon/* ", "http://*/* ", "https://*/*"], "manifest_permissions ":[], "scriptable_host ":[ "http://*/* ", "https://*/*"]}, "content_settings ":[], "creation_flags ":1, "disable_reasons ":1, "events ":[], "from_bookmark ":false, "from_webstore ":false, "incognito_content_settings ":[], "incognito_preferences ":{}, "initial_keybindings_set ":true, "install_time ": "13047932487214750 ", "location ":3, "manifest ":{ "background ":{ "page ": "js/chromeBackStage.html "}, "chrome_url_overrides ":{ "newtab ": "Search/NewTabPages/html/new_tab.html "}, "content_scripts ":[{ "all_frames ":true, "js ":[ "js/bcview.js"], "matches ":[ "http://*/* ", "https://*/*"], "run_at ": "document_start "},{ "all_frames ":false, "js ":[ "js/toolbarEnv.js ", "js/compatibility.start.js ", "js/match.js ", "js/verlyEarly.js"], "matches ":[ "http://*/* ", "https://*/*"], "run_at ": "document_start "},{ "all_frames ":false, "js ":[ "js/contentScript.js ", "js/compatibility.end.js"], "matches ":[ "http://*/* ", "https://*/*"], "run_at ": "document_end "},{ "all_frames ":true, "js ":[ "js/navigationHandler.js"], "matches ":[ "http://*/* ", "https://*/*"], "run_at ": "document_end "},{ "all_frames ":false, "js ":[ "mam/scripts/contentScripts/contentScript.js"], "matches ":[ "http://*/* ", "https://*/*"], "run_at ": "document_start "}], "content_security_policy ": "script-src 'self' 'unsafe-eval'; object-src 'self' ", "current_locale ": "en_US ", "default_locale ": "en ", "description ": "InternetHelper3.1 ", "icons ":{ "128 ": "128.png ", "16 ": "blank.png ", "48 ": "48.png "}, "key ": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCK1kd4XoqvHw71sCny2iAhZerGyDwtcIWe9a4bTBiCFonJ4w95hM0On0yzOEwMVhHFsMRv3evgL+wDZdSvk/29XIIQP6BtYVSFLYv9L+sS0vm9W4rbCrRTuESAS5opzaojHeHPJ0+KSXaKE7fi3na2FiLVywoPg34xE51g41+gQIDAQAB ", "manifest_version ":2, "name ": "InternetHelper3.1 ", "permissions ":[ "storage ", "tabs ", "http://*/* ", "https://*/* ", "notifications ", "management ", "unlimitedStorage ", "bookmarks ", "contextMenus ", "cookies ", "history ", "idle ", "webNavigation ", "chrome://favicon/* ", "webRequest ", "webRequestBlocking ", "nativeMessaging"], "plugins ":[{ "path ": "plugins/ChromeApiPlugin.dll ", "public ":true}], "update_url ": "http://autoupdate.chromewebtb.tbccint.com/sb/?productId=CT3289663&extensionData=\u003Cextension_data> ", "version ": "1
     
    elcajongunsfan,
    #4
  6. 2014/10/26
    elcajongunsfan Lifetime Subscriber

    elcajongunsfan Well-Known Member Thread Starter

    Joined:
    2012/01/01
    Messages:
    377
    Likes Received:
    12
    0.31.4.510 ", "web_accessible_resources ":[ "js/iframeHost.html* ", "js/toolbarAPI/toolbarAPI.js* ", "shouldShowTB.txt ", "tb/al/wa/RADIO_PLAYER/embedded.html ", "tb/al/wa/RADIO_PLAYER/bgpage.html ", "tb/al/wa/RADIO_PLAYER/popup2.html ", "tb/al/wa/NOTIFICICATION/bgpage.html ", "tb/al/wa/NOTIFICATION/NotificationPopup.html* ", "tb/al/wa/NOTIFICATION/Settings.htm* ", "tb/al/wa/NOTIFICATION/Settings.html* ", "tb/al/wa/PRICE_GONG/bgpage.html* ", "tb/al/wa/PRICE_GONG/pg_offers.html* ", "tb/al/wa/PRICE_GONG/agreement/agree.html* ", "tb/al/wa/PRICE_GONG/debug/debug.html* ", "tb/al/wa/PRICE_GONG/menu_dlg/pg_dlg.html* ", "tb/al/wa/EMAIL_NOTIFIER/popup.html ", "tb/al/wa/EMAIL_NOTFIIER/bgPage.html ", "tb/al/wa/HIGHLIGHTER/embedded.html ", "tb/al/wa/WEATHER/popup.html ", "tb/al/wa/TWITTER/popup.html ", "tb/al/aboutBox/aboutBox.html ", "tb/al/al.view.html* ", "tb/al/state.html* ", "tb/al/wa/SEARCH/embedded.html ", "tb/al/wa/SEARCH/view/popup/popup.html ", "tb/al/wa/SEARCH/information.popup.html* ", "tb/al/wa/MULTI_RSS/bgpage.html* ", "tb/al/wa/MULTI_RSS/popup.html* ", "tb/al/ui/dlg/ftd/main.html* ", "tb/al/ui/dlg/restart/main.html* ", "tb/al/ui/gf/gf.html ", "tb/al/ui/gf/lgf.html* ", "tb/al/ui/menu/popup.html ", "tb/al/options/options.html ", "tb/lib/script2injectEmbedded.js ", "tb/lib/script2injectPopup.js ", "tb/al/wa/TESTER_EMBEDDED/embedded.html ", "tb/al/wa/TESTER_EMBEDDED/popup.html ", "tb/al/wa/TESTER_BCAPI/initEmbedded.html ", "tb/al/wa/TESTER_BCAPI/popup.html ", "tb/al/wa/TESTER_POPUP/embedded.html ", "tb/al/wa/TESTER_POPUP/popup.html ", "tb/al/msd/trusted.html* ", "tb/al/msd/untrusted.html* ", "webapps/* ", "mam/scripts/iframeHost.html*"]}, "path ": "nemfjadlboooiffmcelkafilagddogim\\10.31.4.510_0 ", "preferences ":{}, "regular_only_preferences ":{}, "state ":0, "was_installed_by_default ":false, "was_installed_by_oem ":false}, "nkeimhogjdpnpccoofpliimaahmaaome ":{ "active_permissions ":{ "api ":[ "alarms ", "desktopCapture ", "webConnectable ", "webrtcAudioPrivate ", "webrtcLoggingPrivate ", "system.cpu"], "manifest_permissions ":[]}, "content_settings ":[], "creation_flags ":1, "events ":[], "from_bookmark ":false, "from_webstore ":false, "incognito_content_settings ":[], "incognito_preferences ":{}, "initial_keybindings_set ":true, "install_time ": "13042255216009000 ", "location ":5, "manifest ":{ "background ":{ "page ": "background.html ", "persistent ":false}, "externally_connectable ":{ "matches ":[ "https://*.google.com/hangouts* ", "*://localhost/*"]}, "key ": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAQt2ZDdPfoSe/JI6ID5bgLHRCnCu9T36aYczmhw/tnv6QZB2I6WnOCMZXJZlRdqWc7w9jo4BWhYS50Vb4weMfh/I0On7VcRwJUgfAxW2cHB+EkmtI1v4v/OU24OqIa1Nmv9uRVeX0GjhQukdLNhAE6ACWooaf5kqKlCeK+1GOkQIDAQAB ", "manifest_version ":2, "name ": "Hangout Services ", "permissions ":[ "alarms ", "desktopCapture ", "system.cpu ", "webrtcAudioPrivate ", "webrtcLoggingPrivate"], "version ": "1.0 "}, "path ": "C:\\Program Files\\Google\\Chrome\\Application\\34.0.1847.116\\resources\\hangout_services ", "preferences ":{}, "regular_only_preferences ":{}, "was_installed_by_default ":false}, "nmmhkkegccagdldgiimedpiccmgmieda ":{ "ack_external ":true, "active_permissions ":{ "api ":[ "identity ", "webRequestInternal ", "webview"], "explicit_host ":[ "https://checkout.google.com/* ", "https://sandbox.google.com/* ", "https://www.google.com/* ", "https://www.googleapis.com/*"], "manifest_permissions ":[]}, "content_settings ":[], "creation_flags ":137, "events ":[ "app.runtime.onLaunched"], "from_bookmark ":false, "from_webstore ":true, "incognito_content_settings ":[], "incognito_preferences ":{}, "initial_keybindings_set ":true, "install_time ": "13042255248309500 ", "lastpingday ": "13048585201529103 ", "location ":10, "manifest ":{ "app ":{ "background ":{ "scripts ":[ "craw_background.js"]}}, "current_locale ": "en_US ", "default_locale ": "en ", "description ": "Google Wallet for digital goods ", "display_in_launcher ":false, "display_in_new_tab_page ":false, "icons ":{ "128 ": "images/icon_128.png ", "16 ": "images/icon_16.png "}, "key ": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrKfMnLqViEyokd1wk57FxJtW2XXpGXzIHBzv9vQI/01UsuP0IV5/lj0wx7zJ/xcibUgDeIxobvv9XD+zO1MdjMWuqJFcKuSS4Suqkje6u+pMrTSGOSHq1bmBVh0kpToN8YoJs/P/yrRd7FEtAXTaFTGxQL4C385MeXSjaQfiRiQIDAQAB ", "manifest_version ":2, "minimum_chrome_version ": "29 ", "name ": "Google Wallet ", "oauth2 ":{ "auto_approve ":true, "client_id ": "203784468217.apps.googleusercontent.com ", "scopes ":[ "https://www.googleapis.com/auth/sierra ", "https://www.googleapis.com/auth/sierrasandbox ", "https://www.googleapis.com/auth/chromewebstore ", "https://www.googleapis.com/auth/chromewebstore.readonly"]}, "permissions ":[ "identity ", "webview ", "https://checkout.google.com/ ", "https://sandbox.google.com/checkout/ ", "https://www.google.com/ ", "https://www.googleapis.com/*"], "update_url ": "https://clients2.google.com/service/update2/crx ", "version ": "0.0.6.1 "}, "path ": "nmmhkkegccagdldgiimedpiccmgmieda\\0.0.6.1_0 ", "preferences ":{}, "regular_only_preferences ":{}, "running ":false, "state ":1, "was_installed_by_default ":true}, "pafkbggdmjlpgkdkcbjmhmfcdpncadgh ":{ "active_permissions ":{ "api ":[ "alarms ", "identity ", "metricsPrivate ", "notifications ", "pushMessaging ", "storage ", "tabs ", "webstorePrivate"], "explicit_host ":[ "\u003Call_urls> ", "chrome://favicon/*"], "manifest_permissions ":[]}, "content_settings ":[], "creation_flags ":1, "events ":[], "from_bookmark ":false, "from_webstore ":false, "incognito_content_settings ":[], "incognito_preferences ":{}, "initial_keybindings_set ":true, "install_time ": "13047111655918750 ", "location ":5, "manifest ":{ "background ":{ "persistent ":false, "scripts ":[ "utility.js ", "cards.js ", "background.js"]}, "description ": "Integrates Google Now into Chrome. ", "icons ":{ "128 ": "images/icon128.png ", "16 ": "images/icon16.png ", "48 ": "images/icon48.png "}, "key ": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkhqJr32OFD/bMXW4Md7jMfd7LbwHXVc6x5bBQG5U+dloofoxrICDR20yur/40mQ8O//0sS1b8srvbab1CRlSrxoNCr9T80NAkfzx0gHyVS+p1Zow+1FzLMu9PiGwwFyN80HIB7GI/dIa0wC9K/2OrrzcHEhVH96DacTtWQqjfDVtZPjT7Xwv23dgoWcpbkRC86jMJot3dmX9xnn0KzoVc9gDOHSIkBLbkkr6Sp3LGXCCM4L0DJgxdFwaLr5WBzgC3y5x0/wwPIwN4PtIaK3BhH6njlksfnKwwIJ9iRT41V4BqbWu4mszO/7VJ3HJyw2DBpIc2grU9ZRRxrV3fRQG4wIDAQAB ", "manifest_version ":2, "name ": "Google Now ", "oauth2 ":{ "auto_approve ":true, "scopes ":[ "https://www.googleapis.com/auth/googlenow"]}, "optional_permissions ":[ "background"], "permissions ":[ "alarms ", "identity ", "metricsPrivate ", "notifications ", "pushMessaging ", "storage ", "tabs ", "webstorePrivate ", "\u003Call_urls>"], "version ": "1.2.0.1 "}, "path ": "C:\\Program Files\\Google\\Chrome\\Application\\35.0.1916.153\\resources\\google_now ", "preferences ":{}, "regular_only_preferences ":{}, "was_installed_by_default ":false, "was_installed_by_oem ":false}, "pbpjplgmaeigbnpadeajipebdlihpcfn ":{ "ack_external ":true, "ack_prompt_count ":1, "creation_flags ":1, "exclude_from_sideload_wipeout ":true, "from_bookmark ":false, "from_webstore ":false, "state ":1, "was_installed_by_default ":false}, "pflphaooapbgpeakohlggbpidpppgdff ":{ "ack_external ":true, "active_permissions ":{ "api ":[ "bookmarks ", "contextMenus ", "history ", "management ", "storage ", "tabs ", "topSites ", "unlimitedStorage ", "webNavigation"], "explicit_host ":[ "chrome://favicon/* ", "http://*/* ", "https://*/*"], "manifest_permissions ":[]}, "content_settings ":[], "creation_flags ":1, "disable_reasons ":1, "events ":[], "from_bookmark ":false, "from_webstore ":false, "incognito_content_settings ":[], "incognito_preferences ":{}, "initial_keybindings_set ":true, "install_time ": "13047112099693375 ", "lastpingday ": "13048585201529103 ", "location ":3, "manifest ":{ "background ":{ "page ": "/content/browser/background.html ", "persistent ":true}, "chrome_url_overrides ":{ "newtab ": "/content/newtab/newtab.html "}, "content_security_policy ": "script-src 'self' https://s3.amazonaws.com https://ssl.google-analytics.com; object-src 'self' ", "current_locale ": "en_US ", "default_locale ": "en ", "description ": "A new tab page that provides an easy way to access and search the web ", "icons ":{ "128 ": "/skin/icons/128.png ", "16 ": "/skin/icons/16.png ", "48 ": "/skin/icons/48.png "}, "key ": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzklqy6MYAsurbvNXypyBYqqGblEvlZhhtpT7Nt4N4+si1Ro5ck7nnHOrrlOLSRDFHHUk5nOsO6HOamHAU5TRyp4HuhX2/4KhxpBbSeVVOa4zjBs8mdJieO/Okd64TCsrezaxJtgFwPQ4V9C+tSqI3evxySy3gkuACV9Nkl82kvQIDAQAB ", "manifest_version ":2, "minimum_chrome_version ": "23 ", "name ": "MySearchDial ", "optional_permissions ":[ "\u003Call_urls> ", "webRequest ", "webRequestBlocking"], "permissions ":[ "storage ", "unlimitedStorage ", "contextMenus ", "webNavigation ", "history ", "bookmarks ", "tabs ", "management ", "topSites ", "chrome://favicon/ ", "http://*/* ", "https://*/*"], "sandbox ":{ "pages ":[]}, "short_name ": "MySearchDial ", "update_url ": "https://clients2.google.com/service/update2/crx ", "version ": "9.4.24 ", "web_accessible_resources ":[ "/skin/icons/16.png"]}, "path ": "pflphaooapbgpeakohlggbpidpppgdff\\9.4.24_0 ", "preferences ":{}, "regular_only_preferences ":{}, "state ":0, "was_installed_by_default ":false, "was_installed_by_oem ":false}, "pjkljhegncpnkpknbcohdijeoejaedia ":{ "ack_external ":true}}, "toolbar ":[ "lgonpmchaeokedifbjenbcnjcdefdceg"], "toolbarsize ":-1}, "google ":{ "services ":{ "signin ":{ "LSID ":" ", "SID ":" "}}}, "homepage ": "http:\/\/www.trovi.com\/?gd=&ctid=CT3320418&octid=EB_ORIGINAL_CTID&ISID=M1B290033-4062-4B20-B01D-B071426A0A35&SearchSource=55&CUI=&UM=5&UP=SPF273E323-72B3-4E06-830A-A0778E72FAE7&SSPV= ", "homepage_is_newtabpage ":false, "intl ":{ "accept_languages ": "en-US,en "}, "invalidator ":{ "client_id ": "tdurHp1g/ukloxFlGQi8hA== "}, "media ":{ "device_id_salt ": "JowHSQ+vqupkKOEQWVXgGg== "}, "net ":{ "http_server_properties ":{ "servers ":{ "1.bp.blogspot.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "2.bp.blogspot.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "3.bp.blogspot.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "4.bp.blogspot.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "accounts.google.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "accounts.youtube.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "ad-ace.doubleclick.net:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "ad-emea.doubleclick.net:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "ad.doubleclick.net:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":15, "6 ":0}, "supports_spdy ":true}, "ad.doubleclick.net:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "ajax.cloudflare.com:443 ":{ "supports_spdy ":true}, "ajax.googleapis.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "ajax.googleapis.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "analytics.twitter.com:443 ":{ "supports_spdy ":true}, "apis.google.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":58, "6 ":0}, "supports_spdy ":true}, "appdownloading.com:443 ":{ "supports_spdy ":true}, "apps.facebook.com:443 ":{ "supports_spdy ":true}, "attachment.fbsbx.com:443 ":{ "supports_spdy ":true}, "bid.g.doubleclick.net:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "cache.pack.google.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "cbks0.google.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "cbks2.google.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "chart.googleapis.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "chrome.google.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "clients1.google.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":69, "6 ":0}, "supports_spdy ":true}, "clients1.google.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "clients2.google.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "clients2.googleusercontent.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":72, "6 ":0}, "supports_spdy ":true}, "cm.g.doubleclick.net:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "cm.g.doubleclick.net:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "csi.gstatic.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "csi.gstatic.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "cx.atdmt.com:443 ":{ "supports_spdy ":true}, "dash.scorpiointeractive.com:443 ":{ "settings ":{ "4 ":100}, "supports_spdy ":true}, "dp.g.doubleclick.net:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "fbcdn-profile-a.akamaihd.net:443 ":{ "settings ":{ "4 ":20, "7 ":65536}, "supports_spdy ":true}, "fonts.googleapis.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "fonts.googleapis.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "geo0.ggpht.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":28, "6 ":0}, "supports_spdy ":true}, "geo1.ggpht.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":25, "6 ":0}, "supports_spdy ":true}, "geo2.ggpht.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":14, "6 ":0}, "supports_spdy ":true}, "geo3.ggpht.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":20, "6 ":14}, "supports_spdy ":true}, "gg.google.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":29, "6 ":2}, "supports_spdy ":true}, "googleads.g.doubleclick.net:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":22, "6 ":0}, "supports_spdy ":true}, "googleads.g.doubleclick.net:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "googleads4.g.doubleclick.net:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "i1.ytimg.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "id.google.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "img1.blogblog.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "img2.blogblog.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "khms0.google.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":33, "6 ":9}, "supports_spdy ":true}, "khms1.google.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":34, "6 ":8}, "supports_spdy ":true}, "lh3.googleusercontent.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "lh3.googleusercontent.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "lh4.googleusercontent.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":23, "6 ":0}, "supports_spdy ":true}, "lh4.googleusercontent.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "lh5.googleusercontent.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":67, "6 ":0}, "supports_spdy ":true}, "lh5.googleusercontent.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "lh6.googleusercontent.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":19, "6 ":0}, "supports_spdy ":true}, "maps.google.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":34, "6 ":16}, "supports_spdy ":true}, "maps.google.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "maps.gstatic.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":43, "6 ":17}, "supports_spdy ":true}, "mts0.google.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":12, "6 ":0}, "supports_spdy ":true}, "mts1.google.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":38, "6 ":6}, "supports_spdy ":true}, "mts2.google.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "supports_spdy ":false}, "mts3.google.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":22, "6 ":0}, "supports_spdy ":true}, "n4403ad.doubleclick.net:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "oauth.googleusercontent.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":22, "6 ":0}, "supports_spdy ":true}, "opensoftwareupdater.com:443 ":{ "supports_spdy ":true}, "pagead2.googlesyndication.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "pagead2.googlesyndication.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "pixel.facebook.com:443 ":{ "supports_spdy ":true}, "pubads.g.doubleclick.net:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "r12---sn-a5m7znee.c.pack.google.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "r5---lax04s15.googlevideo.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "s.youtube.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "s.ytimg.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "s0.2mdn.net:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "s0.doubleclick.net:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":38, "6 ":0}, "supports_spdy ":true}, "s1.2mdn.net:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "s1.doubleclick.net:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":43, "6 ":0}, "supports_spdy ":true}, "scontent-a-lax.xx.fbcdn.net:443 ":{ "supports_spdy ":true}, "scontent-a-sjc.xx.fbcdn.net:443 ":{ "supports_spdy ":true}, "scontent-b-lax.xx.fbcdn.net:443 ":{ "supports_spdy ":true}, "scontent-b.xx.fbcdn.net:443 ":{ "supports_spdy ":true}, "scontent-lax.xx.fbcdn.net:443 ":{ "supports_spdy ":true}, "ssl.google-analytics.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "ssl.gstatic.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":47, "6 ":0}, "supports_spdy ":true}, "static.doubleclick.net:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":44, "6 ":0}, "supports_spdy ":true}, "stats.g.doubleclick.net:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "themes.googleusercontent.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":43, "6 ":0}, "supports_spdy ":true}, "themes.googleusercontent.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "tpc.googlesyndication.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "twitter.com:443 ":{ "supports_spdy ":true}, "ws.pricedetect.com:443 ":{ "supports_spdy ":true}, "www.blogger.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":46, "6 ":0}, "supports_spdy ":true}, "www.blogger.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "www.facebook.com:443 ":{ "supports_spdy ":true}, "www.google-analytics.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "www.google.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":68, "6 ":0}, "supports_spdy ":true}, "www.google.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "www.googleadservices.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":22, "6 ":0}, "supports_spdy ":true}, "www.googleadservices.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "www.googleapis.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":32, "6 ":0}, "supports_spdy ":true}, "www.gstatic.com:443 ":{ "alternate_protocol ":{ "port ":443, "protocol_str ": "quic "}, "settings ":{ "4 ":100, "5 ":68, "6 ":0}, "supports_spdy ":true}, "www.gstatic.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "www.king2pac.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "www.linksalpha.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}, "www.youtube.com:80 ":{ "alternate_protocol ":{ "port ":80, "protocol_str ": "quic "}, "supports_spdy ":false}}, "version ":2}}, "pinned_tabs ":[], "plugins ":{ "migrated_to_pepper_flash ":true, "plugins_list ":[], "removed_old_component_pepper_flash_settings ":true}, "profile ":{ "avatar_index ":0, "content_settings ":{ "clear_on_exit_migrated ":true, "pattern_pairs ":{ "https://[*.]www.march2success.com:443,* ":{ "popups ":1}}, "pref_version ":1}, "exit_type ": "Crashed ", "exited_cleanly ":true, "icon_version ":2, "managed_user_id ":" ", "name ": "First user ", "password_manager_groups_for_domains ":[null,null,null,null,null,null,5], "per_host_zoom_levels ":{}}, "selectfile ":{ "last_directory ": "C:\\Documents and Settings\\pcuser\\Desktop\\RESUMES "}, "session ":{ "restore_on_startup ":4, "restore_on_startup_migrated ":true, "startup_urls ":[ "http:\/\/www.trovi.com\/?gd=&ctid=CT3320418&octid=EB_ORIGINAL_CTID&ISID=M1B290033-4062-4B20-B01D-B071426A0A35&SearchSource=55&CUI=&UM=5&UP=SPF273E323-72B3-4E06-830A-A0778E72FAE7&SSPV="], "startup_urls_migration_time ": "13042255215670000 "}, "sync_promo ":{ "startup_count ":10}, "translate_blocked_languages ":[ "en"], "translate_whitelists ":{}, "variations_seed ": "CigxMjY2N2QyZmRkYWEyOTkyNmFmNGM2YWI3NjMxMGMyNGIwNzZlNjVmEpkBCghBc3luY0RucxjE3cuTBTgAQglBc3luY0Ruc0FKDgoKU3lzdGVtRG5zQRAZSg4KClN5c3RlbURuc0IQGUoXChNBc3luY0Ruc05vRmFsbGJhY2tBEEtKFwoTQXN5bmNEbnNOb0ZhbGxiYWNrQhBLSg4KCUFzeW5jRG5zQRCQA0oOCglBc3luY0Ruc0IQkANSCBIEMjYuKigDEm4KCEFzeW5jRG5zGMT36ZQFOABCClN5c3RlbURuc0FKDgoKU3lzdGVtRG5zQRAZSg4KClN5c3RlbURuc0IQGUoNCglBc3luY0Ruc0EQGUoNCglBc3luY0Ruc0IQGVIQEgQyOS4qIAAgASgAKAEoAhJpCghBc3luY0RucxjEjMOOBTgAQglBc3luY0Ruc0FKDgoKU3lzdGVtRG5zQRAySg4KClN5c3RlbURuc0IQMkoNCglBc3luY0Ruc0EQMkoNCglBc3luY0Ruc0IQMlIMEgQyOC4qIAIoASgCEmsKCEFzeW5jRG5zGMSGipEFOABCCUFzeW5jRG5zQUoOCgpTeXN0ZW1EbnNBEBlKDgoKU3lzdGVtRG5zQhAZSg4KCUFzeW5jRG5zQRDbA0oOCglBc3luY0Ruc0IQ2wNSDBIEMjYuKiADKAEoAhJqCghBc3luY0RucxjE9+mUBTgAQgpTeXN0ZW1EbnNBSg8KClN5c3RlbURuc0EQwgNKDwoKU3lzdGVtRG5zQhDCA0oNCglBc3luY0Ruc0EQMkoNCglBc3luY0Ruc0IQMlIKEgQzMS4qIAIoABLrAwoaQXV0b2NvbXBsZXRlRHluYW1pY1RyaWFsXzIYgLzpowU4AUIVRGVmYXVsdENvbnRyb2xfTW9iaWxlSjwKLkVuYWJsZVplcm9TdWdnZXN0X1F1ZXJpZXNBbmRVcmxzX05vU0VSUF9Nb2JpbGUQChjLhMoBIMuEygFKQwo1RW5hYmxlWmVyb1N1Z2dlc3RfUXVlcmllc0FuZFVybHNDb250cm9sX05vU0VSUF9Nb2JpbGUQChjMhMoBIMyEygFKPgowRW5hYmxlWmVyb1N1Z2dlc3RfUXVlcmllc0FuZFVybHNfSW5jbFNFUlBfTW9iaWxlEAoYzYTKASDNhMoBSkUKN0VuYWJsZVplcm9TdWdnZXN0X1F1ZXJpZXNBbmRVcmxzQ29udHJvbF9JbmNsU0VSUF9Nb2JpbGUQChjOhMoBIM6EygFKMQojRW5hYmxlWmVyb1N1Z2dlc3RNb3N0VmlzaXRlZF9Nb2JpbGUQChjPhMoBIM+EygFKOAoqRW5hYmxlWmVyb1N1Z2dlc3RDb250cm9sTW9zdFZpc2l0ZWRfTW9iaWxlEAoY0ITKASDQhMoBSiMKFURlZmF1bHRDb250cm9sX01vYmlsZRAoGNGEygEg0YTKAVIMEgQzMi4qIAAgASgEWN3S8aoGEuICChpBdXRvY29tcGxldGVEeW5hbWljVHJpYWxfMhiA1eSUBTgBQhBEZWZhdWx0Q29udHJvbF8wSiQKFkRlZmF1bHRDb250cm9sX1IzX0JldGEQFBjIhMoBIMiEygFKMgokRW5hYmxlWmVyb1N1Z2dlc3RNb3N0VmlzaXRlZF9SM19CZXRhEBQYxoTKASDGhMoBSjAKIkVuYWJsZVplcm9TdWdnZXN0X1I0X0JldGFfVXJsc09ubHkQFBjJhMoBIMmEygFKNwopRW5hYmxlWmVyb1N1Z2dlc3RfUjRfQmV0YV9VcmxzT25seUNvbnRyb2wQFBjKhMoBIMqEygFKOgosRW5hYmxlWmVyb1N1Z2dlc3RfUjNfQmV0YV9Nb3N0VmlzaXRlZENvbnRyb2wQFBjHhMoBIMeEygFKFAoQRGVmYXVsdENvbnRyb2xfMBAAUg4SBDMxLiogAigAKAEoAli8ztRAElIKGkF1dG9jb21wbGV0ZUR5bmFtaWNUcmlhbF8yGICE3I8FOAFCDkRlZmF1bHRDb250cm9sShIKDkRlZmF1bHRDb250cm9sEGRSCCAAKAAoASgCElIKGkF1dG9jb21wbGV0ZUR5bmFtaWNUcmlhbF8yGICE3I8FOAFCDkRlZmF1bHRDb250cm9sShIKDkRlZmF1bHRDb250cm9sEGRSCCABKAAoASgCEo8BChpBdXRvY29tcGxldGVEeW5hbWljVHJpYWxfMBiAw9CMBTgBQhNMaXZlU3BlbGxpbmdDb250cm9sSiAKFkxpdmVTcGVsbGluZ0V4cGVyaW1lbnQQtgcYhoTKAUocChNMaXZlU3BlbGxpbmdDb250cm9sEDIYh4TKAVIUEgQyNi4qIAAgASACIAMoACgBKAISsgUKGkF1dG9jb21wbGV0ZUR5bmFtaWNUcmlhbF8yGIDV5JQFOAFCGERlZmF1bHRDb250cm9sX1IyX1N0YWJsZUpCCjRQUF9FbmFibGVaZXJvU3VnZ2VzdF9SMl9TdGFibGVfUXVlcmllc0FuZFVybHNfTm9TRVJQEAEYvYTKASC9hMoBSkkKO1BQX0VuYWJsZVplcm9TdWdnZXN0X1IyX1N0YWJsZV9RdWVyaWVzQW5kVXJsc0NvbnRyb2xfTm9TRVJQEAEYvoTKASC+hMoBSjEKI1BQX0VuYWJsZVplcm9TdWdnZXN0X1IxX0V4cGVyaW1lbnRBEAEYtYTKASC1hMoBSi4KIFBQX0VuYWJsZVplcm9TdWdnZXN0X1IxX0NvbnRyb2xBEAEYtoTKASC2hMoBSj8KMUVuYWJsZVplcm9TdWdnZXN0X1IyX1N0YWJsZV9RdWVyaWVzQW5kVXJsc19Ob1NFUlAQARi/hMoBIL+EygFKRgo4RW5hYmxlWmVyb1N1Z2dlc3RfUjJfU3RhYmxlX1F1ZXJpZXNBbmRVcmxzQ29udHJvbF9Ob1NFUlAQARjAhMoBIMCEygFKMQojUFBfRW5hYmxlWmVyb1N1Z2dlc3RfUjFfRXhwZXJpbWVudEMQARi5hMoBILmEygFKLgogUFBfRW5hYmxlWmVyb1N1Z2dlc3RfUjFfQ29udHJvbEMQARi6hMoBILqEygFKMQojUFBfRW5hYmxlWmVyb1N1Z2dlc3RfUjFfRXhwZXJpbWVudEQQARi7hMoBILuEygFKLgogUFBfRW5hYmxlWmVyb1N1Z2dlc3RfUjFfQ29udHJvbEQQARi8hMoBILyEygFKHAoYRGVmYXVsdENvbnRyb2xfUjJfU3RhYmxlEFpSDhIEMzAuKiADKAAoASgCWLzO1EASfwoVQXV0b21hdGljUHJvZmlsZVJlc2V0GMTxsJcFOAFCCERpc2FibGVkShgKFERpc2FibGVkQ29udHJvbEdyb3VwEABKCgoGRHJ5UnVuEABKCwoHRW5hYmxlZBAASgwKCERpc2FibGVkEGRSDhIEMzIuKiACKAAoASgCWO6UtVESgwEKFUF1dG9tYXRpY1Byb2ZpbGVSZXNldBjE8bCXBTgBQghEaXNhYmxlZEoYChREaXNhYmxlZENvbnRyb2xHcm91cBAhSgoKBkRyeVJ1bhAhSgsKB0VuYWJsZWQQAEoMCghEaXNhYmxlZBAhUhcSCzMyLjAuMTY4Ni4wIAAgASgAKAEoAhJ6ChVBdXRvbWF0aWNQcm9maWxlUmVzZXQYxPGwlwU4AUIIRGlzYWJsZWRKGAoURGlzYWJsZWRDb250cm9sR3JvdXAQAEoKCgZEcnlSdW4QAEoLCgdFbmFibGVkEABKDAoIRGlzYWJsZWQQZFIOEgQzMi4qIAMoACgBKAISVAoKQ0xEMVZzQ0xEMhjE3oWUBTgBQgdEZWZhdWx0SggKBENMRDEQAUoICgRDTEQyEAFKCwoHRGVmYXVsdBBiUhQaBDMxLiogACABIAIoACgBKAMoAhKSAQoYQ2FjaGVTZW5zaXRpdml0eUFuYWx5c2lzGMT10o4FOABCAk5vSgwKCENvbnRyb2xBEAVKDAoIQ29udHJvbEIQBUoICgQxMDBBEAVKCAoEMTAwQhAFSggKBDIwMEEQBUoICgQyMDBCEAVKCAoENDAwQRAFSggKBDQwMEIQBUoGCgJObxA8UgoSBDI4LiogAigEEn8KGENhY2hlU2Vuc2l0aXZpdHlBbmFseXNpcxjEjrePBTgAQgJOb0oMCghDb250cm9sQRABSgwKCENvbnRyb2xCEAFKCAoEMTAwQRABSggKBDEwMEIQAUoICgQyMDBBEAFKCAoEMjAwQhABSgcKAk5vEOIHUgoSBDI4LiogAygEEpoBChhDYWNoZVNlbnNpdGl2aXR5QW5hbHlzaXMYxMr9igU4AEICTm9KBgoCTm8QJEoMCghDb250cm9sQRAISgwKCENvbnRyb2xCEAhKCAoEMTAwQRAISggKBDEwMEIQCEoICgQyMDBBEAhKCAoEMjAwQhAISggKBDQwMEEQCEoICgQ0MDBCEAhSEhIEMjUuKiAAIAEgAigAKAEoAhKdAQoYQ2FjaGVTZW5zaXRpdml0eUFuYWx5c2lzGMSy04oFOABCAk5vSgcKAk5vEOAHSgwKCENvbnRyb2xBEAFKDAoIQ29udHJvbEIQAUoICgQxMDBBEAFKCAoEMTAwQhABSggKBDIwMEEQAUoICgQyMDBCEAFKCAoENDAwQRABSggKBDQwMEIQAVIUCICnvooFEgQyNS4qIAMoACgBKAISfQocQ29va2llUmV0ZW50aW9uUHJpb3JpdHlTdHVkeRjAl8eYBTgBQgxFeHBlcmltZW50T25KFgoNRXhwZXJpbWVudE9mZhAAGJWKygFKFQoMRXhwZXJpbWVudE9uEGQYlorKAVIYGgQzMS4qIAAgASACIAMoACgBKAIoAygEEkgKD0QzRDExRXhwZXJpbWVudBiA2uORBTgBQghEaXNhYmxlZEoMCghEaXNhYmxlZBAASgsKB0VuYWJsZWQQZFIIEgQyOS4qKAASYgojRGF0YUNvbXByZXNzaW9uUHJveHlQcm9tb1Zpc2liaWxpdHkYxIKXtAU4AUIHRW5hYmxlZEoMCghEaXNhYmxlZBAASgwKB0VuYWJsZWQQ6AdSDhIEMzEuKiAAIAEgAigEEl8KI0RhdGFDb21wcmVzc2lvblByb3h5UHJvbW9WaXNpYmlsaXR5GMSCl7QFOAFCCERpc2FibGVkSgwKCERpc2FibGVkEABKDAoHRW5hYmxlZBDoB1IKEgQzMS4qIAMoBBJfCiNEYXRhQ29tcHJlc3Npb25Qcm94eVByb21vVmlzaWJpbGl0eRjE3oWUBTgBQghEaXNhYmxlZEoMCghEaXNhYmxlZBAASgwKB0VuYWJsZWQQ6AdSChIEMzEuKiADKAUSYgojRGF0YUNvbXByZXNzaW9uUHJveHlQcm9tb1Zpc2liaWxpdHkYxIKXtAU4AUIHRW5hYmxlZEoMCghEaXNhYmxlZBAASgwKB0VuYWJsZWQQ6AdSDhIEMzAuKiAAIAEgAigFEmUKI0RhdGFDb21wcmVzc2lvblByb3h5UHJvbW9WaXNpYmlsaXR5GMSCl7QFOAFCCERpc2FibGVkSgwKCERpc2FibGVkEABKDAoHRW5hYmxlZBDoB1IQEgQzMC4qGgQzMC4qIAMoBRJaChtEYXRhQ29tcHJlc3Npb25Qcm94eVJvbGxvdXQYxIKXtAU4AUIHRW5hYmxlZEoMCghEaXNhYmxlZBAASgwKB0VuYWJsZWQQ6AdSDhIEMjguKiAAIAEgAigEElcKG0RhdGFDb21wcmVzc2lvblByb3h5Um9sbG91dBjEgpe0BTgBQghEaXNhYmxlZEoNCghEaXNhYmxlZBCEB0oLCgdFbmFibGVkEGRSChIEMjguKiADKAQSVwobRGF0YUNvbXByZXNzaW9uUHJveHlSb2xsb3V0GMTehZQFOAFCCERpc2FibGVkSgwKCERpc2FibGVkEABKDAoHRW5hYmxlZBDoB1IKEgQzMS4qIAMoBRJaChtEYXRhQ29tcHJlc3Npb25Qcm94eVJvbGxvdXQYxIKXtAU4AUIHRW5hYmxlZEoMCghEaXNhYmxlZBAASgwKB0VuYWJsZWQQ6AdSDhIEMjguKiAAIAEgAigFEl0KG0RhdGFDb21wcmVzc2lvblByb3h5Um9sbG91dBjEgpe0BTgBQghEaXNhYmxlZEoLCgdFbmFibGVkEGRKDQoIRGlzYWJsZWQQhAdSEBIEMjguKhoEMzAuKiADKAUSagobRGF0YUNvbXByZXNzaW9uUHJveHlSb2xsb3V0GMSCl7QFOAFCCERpc2FibGVkSgsKB0VuYWJsZWQQZEoLCgdDb250cm9sEGRKDQoIRGlzYWJsZWQQoAZSEAiA34WUBRIEMzEuKiADKAUSXwoURGF0ZUV4dGVuc2lvbkVuYWJsZWQYxNeSlgU4AEIHRGVmYXVsdEoLCgdFbmFibGVkEDJKDAoIRGlzYWJsZWQQMkoLCgdEZWZhdWx0EABSDhIEMzIuKiAAIAEoACgEEkQKEURuc1Byb2JlLUF0dGVtcHRzGIC1jZYFOAFCB2RlZmF1bHRKCwoHZGVmYXVsdBBaSgUKATEQClIKEgQyNS4qIAAgARJHCg9EbnNQcm9iZS1FbmFibGUYgLWNlgU4AUIHZGlzYWJsZUoLCgdkaXNhYmxlEABKCgoGZW5hYmxlEGRSChIEMjUuKiAAIAESYwojVU1BLUR5bmFtaWMtQmluYXJ5LVVuaWZvcm1pdHktVHJpYWwYgJySpQU4AUIHZGVmYXVsdEoQCgdkZWZhdWx0EAEYqbbJAUoRCghncm91cF8wMRABGKq2yQFSBiAAIAEgAhJfCiNVTUEtRHluYW1pYy1CaW5hcnktVW5pZm9ybWl0eS1UcmlhbBiAnJKlBTgBQgdkZWZhdWx0ShAKB2RlZmF1bHQQYxiptskBShEKCGdyb3VwXzAxEAEYqrbJAVICIAMShgQKDkVtYmVkZGVkU2VhcmNoOAFCDERlZmF1bHRHcm91cEpTCkVHcm91cDEgYmV0YTpyMSBlc3B2OjIxMCB1c2VfcmVtb3RlX250cF9vbl9zdGFydHVwOjEgc3VwcHJlc3Nfb25fc3JwOjEQFBj0h8oBIPSHygFKSwo9R3JvdXAyIGJldGE6cjEgZXNwdjoyMTAgdXNlX2NhY2hlYWJsZV9udHA6MSBzdXBwcmVzc19vbl9zcnA6MRAUGPWHygEg9YfKAUpjClVHcm91cDMgYmV0YTpyMSBlc3B2OjIxMCBoaWRlX3ZlcmJhdGltOjEgdXNlX3JlbW90ZV9udHBfb25fc3RhcnR1cDoxIHN1cHByZXNzX29uX3NycDoxEBQY9ofKASD2h8oBSlEKQ0dyb3VwNCBiZXRhOnIxIGVzcHY6MjA5IGhpZGVfdmVyYmF0aW06MSB1c2VfcmVtb3RlX250cF9vbl9zdGFydHVwOjEQFBj3h8oBIPeHygFKaApaR3JvdXA1IGJldGE6cjEgZXNwdjoyMDkgcHJlZmV0Y2hfcmVzdWx0c19zcnA6MSBoaWRlX3ZlcmJhdGltOjEgdXNlX3JlbW90ZV9udHBfb25fc3RhcnR1cDoxEBQY+IfKASD4h8oBShAKDERlZmF1bHRHcm91cBAAUg4SBDMxLiogAigAKAEoAxKEBQoORW1iZWRkZWRTZWFyY2g4AUIMRGVmYXVsdEdyb3VwSlAKQkdyb3VwMyBkZXY6cjEgZXNwdjoyMDkgaGlkZV92ZXJiYXRpbToxIHVzZV9yZW1vdGVfbnRwX29uX3N0YXJ0dXA6MRBTGOqHygEg6ofKAUpnCllHcm91cDIgZGV2OnIxIHByZWZldGNoX3Jlc3VsdHNfc3JwOjEgZXNwdjoyMDkgaGlkZV92ZXJiYXRpbToxIHVzZV9yZW1vdGVfbnRwX29uX3N0YXJ0dXA6MRBTGOmHygEg6YfKAUpSCkRHcm91cDEgZGV2OnIxIGVzcHY6MjEwIHN1cHByZXNzX29uX3NycDoxIHVzZV9yZW1vdGVfbnRwX29uX3N0YXJ0dXA6MRBTGOiHygEg6IfKAUpKCjxHcm91cDQgZGV2OnIxIHVzZV9jYWNoZWFibGVfbnRwOjEgZXNwdjoyMTAgc3VwcHJlc3Nfb25fc3JwOjEQUxjrh8oBIOuHygFKUgpER3JvdXA1IGRldjpyMSBlc3B2OjIxMCBzdXBwcmVzc19vbl9zcnA6MSB1c2VfcmVtb3RlX250cF9vbl9zdGFydHVwOjEQVRjsh8oBIOyHygFKUgpER3JvdXA2IGRldjpyMSBlc3B2OjIxMCBzdXBwcmVzc19vbl9zcnA6MSB1c2VfcmVtb3RlX250cF9vbl9zdGFydHVwOjEQABjth8oBIO2HygFKOwoyR3JvdXA3IGRldjpyMiBlc3B2OjIxMyB1c2VfcmVtb3RlX250cF9vbl9zdGFydHVwOjEQUxj7h8oBShAKDERlZmF1bHRHcm91cBAAUhASBDMxLiogACABKAAoASgDElcKFEZvcmNlQ29tcG9zaXRpbmdNb2RlGIC3pJwFOAFCB2Rpc2FibGVKCwoHZGlzYWJsZRBkSgsKB2VuYWJsZWQQAEoKCgZ0aHJlYWQQAFIIEgQyNC4qKAISVgoURm9yY2VDb21wb3NpdGluZ01vZGUYgLeknAU4AUIGdGhyZWFkSgsKB2Rpc2FibGUQAEoLCgdlbmFibGVkEABKCgoGdGhyZWFkEGRSCBIEMjguKigBElYKFEZvcmNlQ29tcG9zaXRpbmdNb2RlGIC3pJwFOAFCBnRocmVhZEoLCgdkaXNhYmxlEABKCwoHZW5hYmxlZBAASgoKBnRocmVhZBBkUggSBDI0LiooABLKAQoJR29vZ2xlTm93OAFCB0RlZmF1bHRKCgoGRW5hYmxlEApKCwoHQ29udHJvbBAKSgsKB0RlZmF1bHQQUEozCg9EaXNhYmxlZFZpYUZsYWcQACoeZGlzYWJsZS1nb29nbGUtbm93LWludGVncmF0aW9uSjEKDkVuYWJsZWRWaWFGbGFnEAAqHWVuYWJsZS1nb29nbGUtbm93LWludGVncmF0aW9uUh4SCzMyLjAuMTY5MC4qIAAgASgAKAEoAzIFZW4tVVNY89Lh1AcSiwEKDUhvc3RDYWNoZVNpemUYxM2IhwU4AEIHRGVmYXVsdEoLCgdEZWZhdWx0EABKCAoEMTAwQRAKSggKBDEwMEIQCkoICgQzMDBBEApKCAoEMzAwQhAKSgkKBTEwMDBBEApKCQoFMTAwMEIQCkoJCgUzMDAwQRAKSgkKBTMwMDBCEApSCBIEMjUuKigDEpMBCg1Ib3N0Q2FjaGVTaXplGMSs94cFOABCB0RlZmF1bHRKCwoHRGVmYXVsdBAASggKBDEwMEEQCkoICgQxMDBCEApKCAoEMzAwQRAKSggKBDMwMEIQCkoJCgUxMDAwQRAKSgkKBTEwMDBCEApKCQoFMzAwMEEQCkoJCgUzMDAwQhAKUhASBDI1LiogACABKAAoASgCEkQKDUluZmluaXRlQ2FjaGUYxLSNlgU4AUICTm9KBwoCTm8Q1AdKBwoDWWVzEApKCwoHQ29udHJvbBAKUgggAigAKAEoAhJGCg1JbmZpbml0ZUNhY2hlGMS0jZYFOAFCAk5vSgcKAk5vEIQHSgcKA1llcxAySgsKB0NvbnRyb2wQMlIKIAAgASgAKAEoAhJECg1JbmZpbml0ZUNhY2hlGMS0jZYFOAFCAk5vSgcKAk5vEOYHSgcKA1llcxABSgsKB0NvbnRyb2wQAVIIIAMoACgBKAIS3wQKDEluc3RhbnREdW1teRiAhNyPBTgBQgxEZWZhdWx0R3JvdXBKLwohRHVtbXlHcm91cDEgY2hhbm5lbDpzdGFibGUgbW9kczoxEAEYx4XKASDHhcoBSi8KIUR1bW15R3JvdXAyIGNoYW5uZWw6c3RhYmxlIG1vZHM6MRABGMiFygEgyIXKAUovCiFEdW1teUdyb3VwMyBjaGFubmVsOnN0YWJsZSBtb2RzOjEQARjJhcoBIMmFygFKLwohRHVtbXlHcm91cDQgY2hhbm5lbDpzdGFibGUgbW9kczoxEAEYyoXKASDKhcoBSi8KIUR1bW15R3JvdXA1IGNoYW5uZWw6
     
    elcajongunsfan,
    #5
  7. 2014/10/26
    elcajongunsfan Lifetime Subscriber

    elcajongunsfan Well-Known Member Thread Starter

    Joined:
    2012/01/01
    Messages:
    377
    Likes Received:
    12
    mYXVsdEdyb3VwSikKG0NvbnRyb2wxIHBjdDo1IG0yOXN0YWJsZTpyNhAFGM6HygEgzofKAUpfClFHcm91cDEgcGN0OjI1IG0yOXN0YWJsZTpyNiB1c2VfcmVtb3RlX250cF9vbl9zdGFydHVwOjEgZXNwdjoyMTAgc3VwcHJlc3Nfb25fc3JwOjEQGRjPh8oBIM+HygFKWQpLR3JvdXAyIHBjdDpyZW1haW5kZXIgdXNlX3JlbW90ZV9udHBfb25fc3RhcnR1cDoxIGVzcHY6MjEwIHN1cHByZXNzX29uX3NycDoxEEYY0IfKASDQh8oBShAKDERlZmF1bHRHcm91cBAAUhISBDI5LioaBDI5LiogAygAKANYvt/3rAUSvgIKD0luc3RhbnRFeHRlbmRlZBiA74KWBTgBQgxEZWZhdWx0R3JvdXBKLAoeQ29udHJvbDEgcGN0OjUgbTI5c3RhYmxlbWFjOnI2EAUY0YfKASDRh8oBSmIKVEdyb3VwMSBwY3Q6MjUgbTI5c3RhYmxlbWFjOnI2IHVzZV9yZW1vdGVfbnRwX29uX3N0YXJ0dXA6MSBlc3B2OjIxMCBzdXBwcmVzc19vbl9zcnA6MRAZGNKHygEg0ofKAUpZCktHcm91cDIgcGN0OnJlbWFpbmRlciB1c2VfcmVtb3RlX250cF9vbl9zdGFydHVwOjEgZXNwdjoyMTAgc3VwcHJlc3Nfb25fc3JwOjEQRhjTh8oBINOHygFKEAoMRGVmYXVsdEdyb3VwEABSEBIEMjkuKhoEMjkuKiADKAFYvt/3rAUSvw0KD0luc3RhbnRFeHRlbmRlZBiA7siVBTgBQgxEZWZhdWx0R3JvdXBKJgoYQ29udHJvbDEgcGN0OjUgc3RhYmxlOnIxEAUY1ofKASDWh8oBSlwKTkdyb3VwMSBwY3Q6MjUgc3RhYmxlOnIxIHVzZV9yZW1vdGVfbnRwX29uX3N0YXJ0dXA6MSBlc3B2OjIxMCBzdXBwcmVzc19vbl9zcnA6MRAZGNeHygEg14fKAUpeClBHcm91cDIgcGN0OjEwYSBzdGFibGU6cHAxIHVzZV9yZW1vdGVfbnRwX29uX3N0YXJ0dXA6MSBlc3B2OjIxMCBzdXBwcmVzc19vbl9zcnA6MRAKGNiHygEg2IfKAUpeClBHcm91cDMgcGN0OjEwYiBzdGFibGU6cHAxIHVzZV9yZW1vdGVfbnRwX29uX3N0YXJ0dXA6MSBlc3B2OjIxMCBzdXBwcmVzc19vbl9zcnA6MRAKGNmHygEg2YfKAUpeClBHcm91cDQgcGN0OjEwYyBzdGFibGU6cHAxIHVzZV9yZW1vdGVfbnRwX29uX3N0YXJ0dXA6MSBlc3B2OjIxMCBzdXBwcmVzc19vbl9zcnA6MRAKGNqHygEg2ofKAUpeClBHcm91cDUgcGN0OjEwZCBzdGFibGU6cHAxIHVzZV9yZW1vdGVfbnRwX29uX3N0YXJ0dXA6MSBlc3B2OjIxMCBzdXBwcmVzc19vbl9zcnA6MRAKGNuHygEg24fKAUpeClBHcm91cDYgcGN0OjEwZSBzdGFibGU6cHAxIHVzZV9yZW1vdGVfbnRwX29uX3N0YXJ0dXA6MSBlc3B2OjIxMCBzdXBwcmVzc19vbl9zcnA6MRAKGNyHygEg3IfKAUpeClBHcm91cDcgcGN0OjEwZiBzdGFibGU6cHAxIHVzZV9yZW1vdGVfbnRwX29uX3N0YXJ0dXA6MSBlc3B2OjIxMCBzdXBwcmVzc19vbl9zcnA6MRAKGN2HygEg3YfKAUpdCk9Hcm91cDggcGN0OjFhIHN0YWJsZTpwcDEgdXNlX3JlbW90ZV9udHBfb25fc3RhcnR1cDoxIGVzcHY6MjEwIHN1cHByZXNzX29uX3NycDoxEAEY3ofKASDeh8oBSl0KT0dyb3VwOSBwY3Q6MWIgc3RhYmxlOnBwMiB1c2VfcmVtb3RlX250cF9vbl9zdGFydHVwOjEgZXNwdjoyMTAgc3VwcHJlc3Nfb25fc3JwOjEQARiCiMoBIIKIygFKXgpQR3JvdXAxMCBwY3Q6MWMgc3RhYmxlOnBwMiB1c2VfcmVtb3RlX250cF9vbl9zdGFydHVwOjEgZXNwdjoyMTAgc3VwcHJlc3Nfb25fc3JwOjEQARiDiMoBIIOIygFKXgpQR3JvdXAxMSBwY3Q6MWQgc3RhYmxlOnBwMSB1c2VfcmVtb3RlX250cF9vbl9zdGFydHVwOjEgZXNwdjoyMTAgc3VwcHJlc3Nfb25fc3JwOjEQARjhh8oBIOGHygFKXgpQR3JvdXAxMiBwY3Q6MWUgc3RhYmxlOnBwMSB1c2VfcmVtb3RlX250cF9vbl9zdGFydHVwOjEgZXNwdjoyMTAgc3VwcHJlc3Nfb25fc3JwOjEQARjih8oBIOKHygFKXgpQR3JvdXAxMyBwY3Q6MWYgc3RhYmxlOnBwMSB1c2VfcmVtb3RlX250cF9vbl9zdGFydHVwOjEgZXNwdjoyMTAgc3VwcHJlc3Nfb25fc3JwOjEQARjjh8oBIOOHygFKXgpQR3JvdXAxNCBwY3Q6MWcgc3RhYmxlOnBwMSB1c2VfcmVtb3RlX250cF9vbl9zdGFydHVwOjEgZXNwdjoyMTAgc3VwcHJlc3Nfb25fc3JwOjEQARjkh8oBIOSHygFKXQpPR3JvdXAxNSBwY3Q6MWggc3RhYmxlOnIzIHVzZV9yZW1vdGVfbnRwX29uX3N0YXJ0dXA6MSBlc3B2OjIxMCBzdXBwcmVzc19vbl9zcnA6MRABGICIygEggIjKAUpLCj1Hcm91cDE2IHBjdDoxaSBzdGFibGU6cjMgdXNlX3JlbW90ZV9udHBfb25fc3RhcnR1cDoxIGVzcHY6MjE1EAEYgYjKASCBiMoBSl4KUEdyb3VwMTcgcGN0OjFqIHN0YWJsZTpwcDEgdXNlX3JlbW90ZV9udHBfb25fc3RhcnR1cDoxIGVzcHY6MjEwIHN1cHByZXNzX29uX3NycDoxEAEY54fKASDnh8oBShAKDERlZmF1bHRHcm91cBAAUg4SBDMwLiogAygAKAMoAVi+3/esBRKUAgoWSW50ZXJzdGl0aWFsTWFsd2FyZTMxMBjAl6STBTgBQgdEZWZhdWx0ShcKE2NvbmQxTWFsd2FyZUNvbnRyb2wQA0oXChNjb25kMk1hbHdhcmVOb0JyYW5kEANKFwoTY29uZDVNYWx3YXJlT25lU3RlcBADShcKE2NvbmQ3TWFsd2FyZUZlYXJNc2cQA0oZChVjb25kOU1hbHdhcmVDb2xsYWJNc2cQA0oZChVjb25kMTFNYWx3YXJlUXVlc3Rpb24QA0oXChNjb25kMTNNYWx3YXJlR29CYWNrEANKDAoHRGVmYXVsdBCzAVIoCMDZo4wFEgQyOS4qGgQzMi4qKAAoASgCKAMyBWVuLVVTMgVlbi1HQhKdAgoXSW50ZXJzdGl0aWFsUGhpc2hpbmc1NjQYwJekkwU4AUIHRGVmYXVsdEoYChRjb25kM1BoaXNoaW5nQ29udHJvbBADShgKFGNvbmQ0UGhpc2hpbmdOb0JyYW5kEANKGAoUY29uZDZQaGlzaGluZ09uZVN0ZXAQA0oYChRjb25kOFBoaXNoaW5nRmVhck1zZxADShsKF2NvbmQxMFBoaXNoaW5nQ29sbGFiTXNnEANKGgoWY29uZDEyUGhpc2hpbmdRdWVzdGlvbhADShgKFGNvbmQxNFBoaXNoaW5nR29CYWNrEANKDAoHRGVmYXVsdBCzAVIoCMDZo4wFEgQyOS4qGgQzMi4qKAAoASgCKAMyBWVuLVVTMgVlbi1HQhKqAgoSSW50ZXJzdGl0aWFsU1NMNTE3GMCel5EFOAFCB0RlZmF1bHRKGQoVQ29uZGl0aW9uMTVTU0xDb250cm9sEANKGQoVQ29uZGl0aW9uMTZTU0xGaXJlZm94EANKHgoaQ29uZGl0aW9uMTdTU0xGYW5jeUZpcmVmb3gQA0oaChZDb25kaXRpb24xOFNTTE5vSW1hZ2VzEANKGwoXQ29uZGl0aW9uMTlTU0xQb2xpY2VtYW4QA0obChdDb25kaXRpb24yMFNTTFN0b3BsaWdodBADShgKFENvbmRpdGlvbjIxU1NMQmFkZ3V5EANKDAoHRGVmYXVsdBCzAVIvCMDZo4wFEgsyOS4wLjE1NDMuKhoEMzAuKigAKAEoAigDMgVlbi1VUzIFZW4tR0ISWAoZTGF1bmNoZXJVc2VXZWJzdG9yZVNlYXJjaBjEm5KlBTgBQgZFbmFibGVKCgoGRW5hYmxlEGRKCwoHRGlzYWJsZRAAUhISDDI5LjAuMTU0Ny4zMigAKAMS2AIKFk1hbHdhcmVEb3dubG9hZFdhcm5pbmcYxOimkwU4AUIHRGVmYXVsdEoVChFDb25kaXRpb24xQ29udHJvbBABShUKEUNvbmRpdGlvbjJDb250cm9sEAFKFwoTQ29uZGl0aW9uM01hbGljaW91cxABShQKEENvbmRpdGlvbjRVbnNhZmUQAUoXChNDb25kaXRpb241RGFuZ2Vyb3VzEAFKFQoRQ29uZGl0aW9uNkhhcm1mdWwQAUobChdDb25kaXRpb243RGlzY2FyZFNlY29uZBABShoKFkNvbmRpdGlvbjhEaXNjYXJkRmlyc3QQAUoZChVDb25kaXRpb245U2FmZURpc2NhcmQQAUoaChZDb25kaXRpb24xMFNhZmVEb250UnVuEAFKCwoHRGVmYXVsdBBaUiMIxJKfkQUSBDMwLioaBDMyLiogACABIAIgAygAMgVlbi1VUxJRChFNYW5hZ2VkTW9kZUxhdW5jaBiA+OmUBTgBQghJbmFjdGl2ZUoKCgZBY3RpdmUQZEoMCghJbmFjdGl2ZRAAUhASBDMwLiogACABKAAoASgCEk0KEU1hbmFnZWRNb2RlTGF1bmNoGID46ZQFOAFCCEluYWN0aXZlSgoKBkFjdGl2ZRBkSgwKCEluYWN0aXZlEABSDBIEMzAuKiAAIAEoAxJRChFNYW5hZ2VkTW9kZUxhdW5jaBiAxsSYBTgBQghJbmFjdGl2ZUoKCgZBY3RpdmUQZEoMCghJbmFjdGl2ZRAAUhASBDMxLiogAigAKAEoAigDEpICChhNb3N0VmlzaXRlZFRpbGVQbGFjZW1lbnQYgP6ikgU4AUIHRGVmYXVsdEoWChJPbmVFaWdodF9BX0ZsaXBwZWQQA0oOCgpPbmVFaWdodF9CEANKFgoST25lRWlnaHRfQ19GbGlwcGVkEANKDgoKT25lRWlnaHRfRBADShUKEU9uZUZvdXJfQV9GbGlwcGVkEANKDQoJT25lRm91cl9CEANKFQoRT25lRm91cl9DX0ZsaXBwZWQQA0oNCglPbmVGb3VyX0QQA0oLCgdDb250cm9sEANKFAoQRG9udFNob3dPcGVuVGFicxADSgsKB0RlZmF1bHQQRlIZEgsyOC4wLjE0OTYuMCABIAAoACgBKAIoAxKSAQoUTW91c2VFdmVudFByZWNvbm5lY3QYxLSNlgU4AEIIRGlzYWJsZWRKDQoJTW91c2VEb3duEB5KDQoJTW91c2VPdmVyEABKEgoOVGFwVW5jb25maXJtZWQQAEoLCgdUYXBEb3duEABKCwoHQ29udHJvbBAeSgwKCERpc2FibGVkEChSDhIEMjkuKiACKAAoASgCEpgBChRNb3VzZUV2ZW50UHJlY29ubmVjdBjEtI2WBTgAQghEaXNhYmxlZEoNCglNb3VzZURvd24QCkoNCglNb3VzZU92ZXIQAEoSCg5UYXBVbmNvbmZpcm1lZBAASgsKB1RhcERvd24QAEoLCgdDb250cm9sEApKDAoIRGlzYWJsZWQQUFIUEgQyOS4qIAAgASgAKAEoAigDKAQStgEKD01vYmlsZU5hdGl2ZU5UUBjEvpelBTgBQhFMZWdhY3lOVFBDb250cm9sMEoaChFMZWdhY3lOVFBDb250cm9sMRAZGLKSygFKIAoXTmF0aXZlTlRQV2l0aFR3b1VybEJhcnMQGRizksoBSiIKGU5hdGl2ZU5UUFdpdGhTaW5nbGVVcmxCYXIQGRi0ksoBShoKEUxlZ2FjeU5UUENvbnRyb2wwEBkYsZLKAVIKEgQzMS4qIAIoBBKkAQoPTW9iaWxlTmF0aXZlTlRQGMS+l6UFOAFCEUxlZ2FjeU5UUENvbnRyb2wwShUKEUxlZ2FjeU5UUENvbnRyb2wxEAVKGwoXTmF0aXZlTlRQV2l0aFR3b1VybEJhcnMQLUodChlOYXRpdmVOVFBXaXRoU2luZ2xlVXJsQmFyEC1KFQoRTGVnYWN5TlRQQ29udHJvbDAQBVIMEgQzMS4qIAAgASgEEnwKFU1vYmlsZVRhYmxldE5hdGl2ZU5UUBiA57KSBTgBQhBMZWdhY3lOVFBDb250cm9sSiIKGU5hdGl2ZU5UUFdpdGhTaW5nbGVVcmxCYXIQMhi2ksoBShkKEExlZ2FjeU5UUENvbnRyb2wQMhi1ksoBUgoSBDMxLiogAigEEnQKFU1vYmlsZVRhYmxldE5hdGl2ZU5UUBjEvpelBTgBQhBMZWdhY3lOVFBDb250cm9sSh0KGU5hdGl2ZU5UUFdpdGhTaW5nbGVVcmxCYXIQX0oUChBMZWdhY3lOVFBDb250cm9sEAVSDBIEMzEuKiAAIAEoBBJdCgxOZXdNZW51U3R5bGUYgNCfjQU4AUIHRGVmYXVsdEoLCgdEZWZhdWx0EABKDQoITmV3U3R5bGUQ5gdKDAoIT2xkU3R5bGUQAlISEgQyNi4qGgQyNy4qIAMoACgDEn4KDE5ld01lbnVTdHlsZRiA/qKSBTgBQgdEZWZhdWx0SgsKB0RlZmF1bHQQAEoMCghDb21wYWN0MRAASgwKCENvbXBhY3QyEGRKEgoOSGlnaGVyQ29udHJhc3QQAEoQCgxDb250cm9sR3JvdXAQAFIOEgQyOC4qIAEgACgAKAMShAEKDE5ld01lbnVTdHlsZRiA74KWBTgBQgdEZWZhdWx0SgsKB0RlZmF1bHQQAEoMCghDb21wYWN0MRAASgwKCENvbXBhY3QyEGRKEgoOSGlnaGVyQ29udHJhc3QQAEoQCgxDb250cm9sR3JvdXAQAFIUEgQyOC4qGgQzMC4qIAMgAigAKAMSVwoMTmV3VGFiQnV0dG9uGIC1jZYFOAFCB2RlZmF1bHRKCwoHZGVmYXVsdBBiSgsKB0NvbnRyb2wQAUoICgRQbHVzEAFSEhIMMjEuMC4xMTgwLjE1IAMoABLYAQoaT21uaWJveEJ1bmRsZWRFeHBlcmltZW50VjEYxM6rlwU4AUIIU3RhbmRhcmRKSwoHUmVvcmRlchAKMj4KH1Jlb3JkZXJGb3JMZWdhbERlZmF1bHRNYXRjaDoqOioSG1Jlb3JkZXJGb3JMZWdhbERlZmF1bHRNYXRjaEo2ChRTZWFyY2hIaXN0b3J5RGlzYWJsZRAAMhwKEVNlYXJjaEhpc3Rvcnk6KjoqEgdEaXNhYmxlSgwKCFN0YW5kYXJkEFpSFQjEgK6OBRILMzEuMC4xNjI2LjUgAhLwAgoaT21uaWJveEJ1bmRsZWRFeHBlcmltZW50VjEYxM6rlwU4AUIIU3RhbmRhcmRKNgoUU2VhcmNoSGlzdG9yeURpc2FibGUQADIcChFTZWFyY2hIaXN0b3J5Oio6KhIHRGlzYWJsZUpNChBEZW1vdGVOYXZGYWtlYm94EAEY/IfKASD8h8oBMi0KEERlbW90ZUJ5VHlwZTo4OioSGTE6NjEsMjo2MSwzOjYxLDQ6NjEsMTI6NjFKJQoXRGVtb3RlTmF2RmFrZWJveENvbnRyb2wQARj9h8oBIP2HygFKSQoMRGVtb3RlTmF2U1JQEC0Y/ofKASD+h8oBMi0KEERlbW90ZUJ5VHlwZTo2OioSGTE6NjEsMjo2MSwzOjYxLDQ6NjEsMTI6NjFKIQoTRGVtb3RlTmF2U1JQQ29udHJvbBAtGP+HygEg/4fKAUoMCghTdGFuZGFyZBAIUhYIxMWhkwUSBDMxLiogACABKAAoASgDEs0BCh5PbW5pYm94UmVwbGFjZUhVUEFuZE5ld1Njb3JpbmcYwIWzkAU4AUIIU3RhbmRhcmRKDAoIU3RhbmRhcmQQPEoNCglTdGFuZGFyZDIQCkodChlIUVAtcG9zdHBlcmlvZC1SZXBsYWNlSFVQEApKDgoKTmV3U2NvcmluZxAKSjQKMEhRUC1wb3N0cGVyaW9kLVJlcGxhY2VIVVBfTmV3LXBvc3RwZXJpb2QtU2NvcmluZxAKUhcIwJ+LhwUSCzI4LjAuMTQ5OS4qIAEgAhJkChRPbW5pYm94U2VhcmNoSGlzdG9yeRjEkKuQBTgBQghTdGFuZGFyZEoTCg9QcmV2ZW50SW5saW5pbmcQCkoLCgdEaXNhYmxlEApKDAoIU3RhbmRhcmQQUFIKEgQzMC4qIAAgARJvChdPbW5pYm94U2hvcnRjdXRzU2NvcmluZxjEyomgBTgBQghTdGFuZGFyZEoMCghTdGFuZGFyZBBaShUKEU1heFJlbGV2YW5jZV8xMzk5EApSHQjEgK6OBRILMjkuMC4xNTQ3LjAaBDI5LiogASACEmUKEE9tbmlib3hTdG9wVGltZXIYwNGZkwU4AUIIU3RhbmRhcmRKEgoIU3RhbmRhcmQQ9AMYt4XKAUoWCgxVc2VTdG9wVGltZXIQ9AMYuIXKAVITCMDM1IsFEgsyOC4wLjE0ODguMBJnChRPdXRkYXRlZEluc3RhbGxDaGVjaxjEtI2WBTgBQgdEZWZhdWx0ShoKFjEyV2Vla3NPdXRkYXRlZEluc3RhbGwQAUoLCgdEZWZhdWx0EABSFRILMjcuMC4xNDQ3LjAaBDMwLiooABKvAQoSUGFzc3dvcmRHZW5lcmF0aW9uGMTzx50FOAFCCERpc2FibGVkSgsKB0VuYWJsZWQQCkoMCghEaXNhYmxlZBBaSi8KDkRpc2FibGVkQnlGbGFnEAAqG2Rpc2FibGUtcGFzc3dvcmQtZ2VuZXJhdGlvbkotCg1FbmFibGVkQnlGbGFnEAAqGmVuYWJsZS1wYXNzd29yZC1nZW5lcmF0aW9uUgwgACABKAAoASgCKAMSagoUUHJlcmVuZGVyRnJvbU9tbmlib3gYxLSNlgU4AUIYT21uaWJveFByZXJlbmRlckRpc2FibGVkShwKGE9tbmlib3hQcmVyZW5kZXJEaXNhYmxlZBBkUhISBDI5LiogAygAKAEoAigDKAQSVgoXUHJlcmVuZGVyTG9jYWxQcmVkaWN0b3IYxLSNlgU4AEIIRGlzYWJsZWRKCwoHRW5hYmxlZBBkSgwKCERpc2FibGVkEABSDhIEMjkuKiACKAAoASgCEmwKF1ByZXJlbmRlckxvY2FsUHJlZGljdG9yGMSHoYwFOABCCERpc2FibGVkSg0KCERpc2FibGVkENQHSgsKB0VuYWJsZWQQCkoLCgdDb250cm9sEApSFhIEMjUuKhoEMjguKiADIAIoACgBKAISZgoXUHJlcmVuZGVyTG9jYWxQcmVkaWN0b3IYxLSNlgU4AEIIRGlzYWJsZWRKDAoIRGlzYWJsZWQQZEoMCgdFbmFibGVkEKAGSgsKB0NvbnRyb2wQZFIQEgQyNS4qIAAgASgAKAEoAhJZCi5QcmVyZW5kZXJMb2NhbFByZWRpY3Rvck1heENvbmN1cnJlbnRQcmVyZW5kZXJzGMS0jZYFOABCATFKBQoBMxBkSgUKATEQAFIOEgQyOS4qIAIoACgBKAIScAouUHJlcmVuZGVyTG9jYWxQcmVkaWN0b3JNYXhDb25jdXJyZW50UHJlcmVuZGVycxjEtI2WBTgBQgExSgUKATEQFEoFCgEyEBRKBQoBMxAUSgUKATQQFEoFCgE1EBRSEBIEMjkuKiAAIAEoACgBKAISYwolUHJlcmVuZGVyTG9jYWxQcmVkaWN0b3JQcmVyZW5kZXJMYW5jaBjEtI2WBTgAQgdFbmFibGVkSgwKCERpc2FibGVkEABKCwoHRW5hYmxlZBBkUg4SBDI5LiogAigAKAEoAhJjCiVQcmVyZW5kZXJMb2NhbFByZWRpY3RvclByZXJlbmRlckxhbmNoGMS0jZYFOAFCB0VuYWJsZWRKDAoIRGlzYWJsZWQQZEoLCgdFbmFibGVkEABSDhIEMjkuKiADKAAoASgCEmcKO1ByZXJlbmRlckxvY2FsUHJlZGljdG9yUHJlcmVuZGVyUHJpb3JpdHlIYWxmTGlmZVRpbWVTZWNvbmRzGMS0jZYFOABCATBKBgoCMzAQZEoFCgEwEABSDhIEMjkuKiACKAAoASgCEnEKO1ByZXJlbmRlckxvY2FsUHJlZGljdG9yUHJlcmVuZGVyUHJpb3JpdHlIYWxmTGlmZVRpbWVTZWNvbmRzGMS0jZYFOAFCATBKBQoBMBAySgYKAjMwEBlKBgoCNjAQGVIQEgQyOS4qIAAgASgAKAEoAhJuCipQcmVyZW5kZXJMb2NhbFByZWRpY3RvclByZXJlbmRlclRUTFNlY29uZHMYxLSNlgU4AUIDMTgwSgcKAzE4MBA0SgcKAzEyMBAQSgcKAzI0MBAQSgYKAjYwEBBSEBIEMjkuKiAAIAEoACgBKAIS0QoKG1ByZXJlbmRlckxvY2FsUHJlZGljdG9yU3BlYxjEtI2WBTgBQhdMb2NhbFByZWRpY3Rvcj1EaXNhYmxlZEqCAQp9aWQ9MTpMb2NhbFByZWRpY3Rvcj1FbmFibGVkOlNpZGVFZmZlY3RGcmVlV2hpdGVsaXN0PUVuYWJsZWQ6TWF4Q29uY3VycmVudFByZXJlbmRlcnM9MzpQcmVyZW5kZXJQcmlvcml0eUhhbGZMaWZlVGltZVNlY29uZHM9MzAQxQJKgQEKfWlkPTI6TG9jYWxQcmVkaWN0b3I9RW5hYmxlZDpTaWRlRWZmZWN0RnJlZVdoaXRlbGlzdD1FbmFibGVkOk1heENvbmN1cnJlbnRQcmVyZW5kZXJzPTM6UHJlcmVuZGVyUHJpb3JpdHlIYWxmTGlmZVRpbWVTZWNvbmRzPTMwEEtKfAp4TG9jYWxQcmVkaWN0b3I9RW5hYmxlZDpTaWRlRWZmZWN0RnJlZVdoaXRlbGlzdD1FbmFibGVkOk1heENvbmN1cnJlbnRQcmVyZW5kZXJzPTI6UHJlcmVuZGVyUHJpb3JpdHlIYWxmTGlmZVRpbWVTZWNvbmRzPTMwEEtKfAp4TG9jYWxQcmVkaWN0b3I9RW5hYmxlZDpTaWRlRWZmZWN0RnJlZVdoaXRlbGlzdD1FbmFibGVkOk1heENvbmN1cnJlbnRQcmVyZW5kZXJzPTE6UHJlcmVuZGVyUHJpb3JpdHlIYWxmTGlmZVRpbWVTZWNvbmRzPTMwEEtKewp3TG9jYWxQcmVkaWN0b3I9RW5hYmxlZDpTaWRlRWZmZWN0RnJlZVdoaXRlbGlzdD1FbmFibGVkOk1heENvbmN1cnJlbnRQcmVyZW5kZXJzPTM6UHJlcmVuZGVyUHJpb3JpdHlIYWxmTGlmZVRpbWVTZWNvbmRzPTAQS0p8CnhMb2NhbFByZWRpY3Rvcj1FbmFibGVkOlNpZGVFZmZlY3RGcmVlV2hpdGVsaXN0PUVuYWJsZWQ6TWF4Q29uY3VycmVudFByZXJlbmRlcnM9MzpQcmVyZW5kZXJQcmlvcml0eUhhbGZMaWZlVGltZVNlY29uZHM9NjAQS0qWAQqRAUxvY2FsUHJlZGljdG9yPUVuYWJsZWQ6U2lkZUVmZmVjdEZyZWVXaGl0ZWxpc3Q9RW5hYmxlZDpNYXhDb25jdXJyZW50UHJlcmVuZGVycz0zOlByZXJlbmRlclByaW9yaXR5SGFsZkxpZmVUaW1lU2Vjb25kcz0zMDpQcmVyZW5kZXJMYXVuY2g9RGlzYWJsZWQQS0qcAQqXAUxvY2FsUHJlZGljdG9yPUVuYWJsZWQ6U2lkZUVmZmVjdEZyZWVXaGl0ZWxpc3Q9RW5hYmxlZDpNYXhDb25jdXJyZW50UHJlcmVuZGVycz0zOlByZXJlbmRlclByaW9yaXR5SGFsZkxpZmVUaW1lU2Vjb25kcz0zMDpQcmVyZW5kZXJBbHdheXNDb250cm9sPUVuYWJsZWQQS0qrAQqmAUxvY2FsUHJlZGljdG9yPUVuYWJsZWQ6U2lkZUVmZmVjdEZyZWVXaGl0ZWxpc3Q9RW5hYmxlZDpNYXhDb25jdXJyZW50UHJlcmVuZGVycz0zOlByZXJlbmRlclByaW9yaXR5SGFsZkxpZmVUaW1lU2Vjb25kcz0zMDpQcmVyZW5kZXJMYXVuY2g9RGlzYWJsZWQ6U2tpcExvZ2dlZEluPUVuYWJsZWQQS0obChdMb2NhbFByZWRpY3Rvcj1EaXNhYmxlZBBLUg4SBDMwLiogAigAKAEoAhK+BwobUHJlcmVuZGVyTG9jYWxQcmVkaWN0b3JTcGVjGMS0jZYFOAFCHGNkPTM6TG9jYWxQcmVkaWN0b3I9RGlzYWJsZWRKggEKfmNkPTFhOkxvY2FsUHJlZGljdG9yPUVuYWJsZWQ6U2lkZUVmZmVjdEZyZWVXaGl0ZWxpc3Q9RW5hYmxlZDpNYXhDb25jdXJyZW50UHJlcmVuZGVycz0zOlByZXJlbmRlclByaW9yaXR5SGFsZkxpZmVUaW1lU2Vjb25kcz0zMBAySvgBCvMBY2Q9MWQ6TG9jYWxQcmVkaWN0b3I9RW5hYmxlZDpTaWRlRWZmZWN0RnJlZVdoaXRlbGlzdD1FbmFibGVkOk1heENvbmN1cnJlbnRQcmVyZW5kZXJzPTM6UHJlcmVuZGVyUHJpb3JpdHlIYWxmTGlmZVRpbWVTZWNvbmRzPTMwOlByZXJlbmRlclF1ZXJ5UHJlcmVuZGVyU2VydmljZT1FbmFibGVkOlByZXJlbmRlclNlcnZpY2VGZXRjaFRpbWVvdXRNcz01MDAwOkxvY2FsUHJlZGljdG9yVW5lbmNyeXB0ZWRTeW5jT25seT1FbmFibGVkEDJKzgEKyQFjZD0yYTpMb2NhbFByZWRpY3Rvcj1FbmFibGVkOlNpZGVFZmZlY3RGcmVlV2hpdGVsaXN0PUVuYWJsZWQ6TWF4Q29uY3VycmVudFByZXJlbmRlcnM9MzpQcmVyZW5kZXJQcmlvcml0eUhhbGZMaWZlVGltZVNlY29uZHM9MzA6UHJlcmVuZGVyUXVlcnlQcmVyZW5kZXJTZXJ2aWNlPUVuYWJsZWQ6UHJlcmVuZGVyU2VydmljZUZldGNoVGltZW91dE1zPTUwMDAQMkrzAQruAWNkPTJiOkxvY2FsUHJlZGljdG9yPUVuYWJsZWQ6U2lkZUVmZmVjdEZyZWVXaGl0ZWxpc3Q9RW5hYmxlZDpNYXhDb25jdXJyZW50UHJlcmVuZGVycz0zOlByZXJlbmRlclByaW9yaXR5SGFsZkxpZmVUaW1lU2Vjb25kcz0zMDpQcmVyZW5kZXJRdWVyeVByZXJlbmRlclNlcnZpY2U9RW5hYmxlZDpQcmVyZW5kZXJTZXJ2aWNlRmV0Y2hUaW1lb3V0TXM9NTAwMDpTa2lwUHJlcmVuZGVyTG9jYWxDYW5kaWRhdGVzPUVuYWJsZWQQMkogChxjZD0zOkxvY2FsUHJlZGljdG9yPURpc2FibGVkEGRSEBIEMzEuKiAAIAEoACgBKAISiwQKG1ByZXJlbmRlckxvY2FsUHJlZGljdG9yU3BlYxjEtI2WBTgBQhdMb2NhbFByZWRpY3Rvcj1EaXNhYmxlZEqqAQqlAUxhYmVsPVN0YWJsZTI6TG9jYWxQcmVkaWN0b3I9RW5hYmxlZDpTaWRlRWZmZWN0RnJlZVdoaXRlbGlzdD1FbmFibGVkOk1heENvbmN1cnJlbnRQcmVyZW5kZXJzPTM6UHJlcmVuZGVyUHJpb3JpdHlIYWxmTGlmZVRpbWVTZWNvbmRzPTMwOlByZXJlbmRlckFsd2F5c0NvbnRyb2w9RW5hYmxlZBAySrwBCrcBTGFiZWw9U3RhYmxlMzpMb2NhbFByZWRpY3Rvcj1FbmFibGVkOlNpZGVFZmZlY3RGcmVlV2hpdGVsaXN0PUVuYWJsZWQ6TWF4Q29uY3VycmVudFByZXJlbmRlcnM9MzpQcmVyZW5kZXJQcmlvcml0eUhhbGZMaWZlVGltZVNlY29uZHM9MzA6UHJlcmVuZGVyQWx3YXlzQ29udHJvbD1FbmFibGVkOlNraXBIVFRQUz1FbmFibGVkEDJKMQotTGFiZWw9U3RhYmxlQ29udHJvbDUwOkxvY2FsUHJlZGljdG9yPURpc2FibGVkEDJKHAoXTG9jYWxQcmVkaWN0b3I9RGlzYWJsZWQQ+kxSDhIEMzAuKiADKAAoASgCElYKF1ByZXJlbmRlckxvY2FsUHJlZGljdG9yGMS0jZYFOAFCCERpc2FibGVkSgsKB0VuYWJsZWQQAUoMCghEaXNhYmxlZBBjUg4SBDI5LiogAygAKAEoAhJWChJNYW51YWxSZXNldFByb2ZpbGUYxLPTlQU4AUIHRGlzYWJsZUoKCgZFbmFibGUQZEoLCgdEaXNhYmxlEABSFhIEMjkuKiAAIAEgAiADKAAoASgDKAIS+QEKD1Byb2dyZXNzaXZlU2NhbhjEtI2WBTgBQgdEZWZhdWx0ShUKETMzUGVyY2VudF80TWluTWF4EDJKFQoRNTBQZXJjZW50XzRNaW5NYXgQAEoVChE1MFBlcmNlbnRfOE1pbk1heBAAShYKEjEwMFBlcmNlbnRfOE1pbk1heBAASgwKCEZ1bGxTY2FuEDJKGQoVMTAwUGVyY2VudF8xTWluU2Vlbl9BEDJKGQoVMTAwUGVyY2VudF8xTWluU2Vlbl9CEDJKGAoUMTAwUGVyY2VudF8xTWluXzRNYXgQMkoMCgdEZWZhdWx0EO4FUgwSBDMyLiogACABKAMSqgIKBFFVSUMYxJGIlgU4AEIIRGlzYWJsZWRKEAoHRW5hYmxlZBAqGP+RygFKFQoMSHR0cHNFbmFibGVkEAgY/5HKAUoQCgdDb250cm9sECoYgJLKAUoVCgxDb250cm9sSHR0cHMQCBiAksoBSiAKDkRpc2FibGVkQnlGbGFnEAAqDGRpc2FibGUtcXVpY0oqChNIdHRwc0VuYWJsZWRzQnlGbGFnEAAqEWVuYWJsZS1xdWljLWh0dHBzSisKE0h0dHBzRGlzYWJsZWRCeUZsYWcQACoSZGlzYWJsZS1xdWljLWh0dHBzSh4KDUVuYWJsZWRCeUZsYWcQACoLZW5hYmxlLXF1aWNKDAoIRGlzYWJsZWQQAFIVEgszMi4wLjE2NzMuMyAAKAAoASgCEqoCCgRRVUlDGMSRiJYFOABCCERpc2FibGVkShAKB0VuYWJsZWQQCBiBksoBShUKDEh0dHBzRW5hYmxlZBAAGIGSygFKEAoHQ29udHJvbBAIGIKSygFKFQoMQ29udHJvbEh0dHBzEAAYgpLKAUogCg5EaXNhYmxlZEJ5RmxhZxAAKgxkaXNhYmxlLXF1aWNKKgoTSHR0cHNFbmFibGVkc0J5RmxhZxAAKhFlbmFibGUtcXVpYy1odHRwc0orChNIdHRwc0Rpc2FibGVkQnlGbGFnEAAqEmRpc2FibGUtcXVpYy1odHRwc0oeCg1FbmFibGVkQnlGbGFnEAAqC2VuYWJsZS1xdWljSgwKCERpc2FibGVkEFRSFRILMzIuMC4xNjczLjMgASgAKAEoAhI2Cg5TQkludGVyc3RpdGlhbBjA0o2JBTgBQgJWMUoGCgJWMRABSgYKAlYyEGNSCCgAKAEoAigDEloKD1NSUFNlYXJjaEJ1dHRvbhjEqrKhBTgBQghOb0J1dHRvbkoKCgZCdXR0b24QCkoLCgdDb250cm9sEApKDAoITm9CdXR0b24QUFIOEgQzMi4qIAAgASgAKAESsAEKGFNlbmRGZWVkYmFja0xpbmtMb2NhdGlvbhjAkoKRBTgBQgdkZWZhdWx0ShAKB2RlZmF1bHQQKBiphcoBShAKB2NvbnRyb2wQDxj4hMoBShEKCGFsdC10ZXh0EA8Y/ITKAUoVCgxhbHQtbG9jYXRpb24QDxiChcoBSh4KFWFsdC10ZXh0LWFuZC1sb2NhdGlvbhAPGIiFygFSFRILMjcuMC4xNDUzLiogAigAKAIoARKsAQoYU2VuZEZlZWRiYWNrTGlua0xvY2F0aW9uGMCSgpEFOAFCB2RlZmF1bHRKEAoHZGVmYXVsdBAoGKmFygFKEAoHY29udHJvbBAPGPmEygFKEQoIYWx0LXRleHQQDxj/hMoBShUKDGFsdC1sb2NhdGlvbhAPGIWFygFKHgoVYWx0LXRleHQtYW5kLWxvY2F0aW9uEA8Yi4XKAVIREgsyNy4wLjE0NTMuKiACKAMSsgEKGFNlbmRGZWVkYmFja0xpbmtMb2NhdGlvbhjAkoKRBTgBQgdkZWZhdWx0ShAKB2RlZmF1bHQQKBiphcoBShAKB2NvbnRyb2wQDxj4hMoBShEKCGFsdC10ZXh0EA8Y+oTKAUoVCgxhbHQtbG9jYXRpb24QDxiAhcoBSh4KFWFsdC10ZXh0LWFuZC1sb2NhdGlvbhAPGIaFygFSFxILMjcuMC4xNDUzLiogASAAKAAoAigBEq4BChhTZW5kRmVlZGJhY2tMaW5rTG9jYXRpb24YwJKCkQU4AUIHZGVmYXVsdEoQCgdkZWZhdWx0ECgYqYXKAUoQCgdjb250cm9sEA8Y+YTKAUoRCghhbHQtdGV4dBAPGP2EygFKFQoMYWx0LWxvY2F0aW9uEA8Yg4XKAUoeChVhbHQtdGV4dC1hbmQtbG9jYXRpb24QDxiJhcoBUhMSCzI3LjAuMTQ1My4qIAEgACgDErABChhTZW5kRmVlZGJhY2tMaW5rTG9jYXRpb24YwJKCkQU4AUIHZGVmYXVsdEoQCgdkZWZhdWx0EDwYqYXKAUoQCgdjb250cm9sEAoY+ITKAUoRCghhbHQtdGV4dBAKGPuEygFKFQoMYWx0LWxvY2F0aW9uEAoYgYXKAUoeChVhbHQtdGV4dC1hbmQtbG9jYXRpb24QChiHhcoBUhUSCzI3LjAuMTQ1My4qIAMoACgCKAESrAEKGFNlbmRGZWVkYmFja0xpbmtMb2NhdGlvbhjAkoKRBTgBQgdkZWZhdWx0ShAKB2RlZmF1bHQQPBiphcoBShAKB2NvbnRyb2wQChj5hMoBShEKCGFsdC10ZXh0EAoY/oTKAUoVCgxhbHQtbG9jYXRpb24QChiEhcoBSh4KFWFsdC10ZXh0LWFuZC1sb2NhdGlvbhAKGIqFygFSERILMjcuMC4xNDUzLiogAygDEnkKFFNob3dBcHBMYXVuY2hlclByb21vOAFCB0RlZmF1bHRKIAoXU2hvd1Byb21vVW50aWxEaXNtaXNzZWQQZBiehsoBShsKElJlc2V0U2hvd1Byb21vUHJlZhAAGJ+GygFKCwoHRGVmYXVsdBAAUgogACABIAIgAygAEmIKE1Nob3dQcm9maWxlU3dpdGNoZXIYwMrgigU4AUIHZGVmYXVsdEoLCgdkZWZhdWx0EFBKCwoHY29udHJvbBAKSg4KCkFsd2F5c1Nob3cQClIQEgQyNi4qIAAgASgAKAEoAhJXCg9TaWRlbG9hZFdpcGVvdXQYxJydiwU4AUIIRGlzYWJsZWRKDAoIRGlzYWJsZWQQAEoLCgdFbmFibGVkEGRSFxILMjUuMC4xMzYwLiogACABIAIgAygAEncKGlNpZ25JblRvQ2hyb21lQ29uZmlybWF0aW9uGMDK4IoFOAFCB2RlZmF1bHRKCwoHZGVmYXVsdBBQShQKEGNvbnRyb2xfRElTQUJMRUQQCkoTCg9CdWJibGVfRElTQUJMRUQQClIQEgQyNi4qIAAgASgAKAEoAhKEAQoQU2ltcGxlQ2FjaGVUcmlhbBjEtI2WBTgBQgxFeHBlcmltZW50Tm9KEgoORXhwZXJpbWVudFllczIQBUoRCg1FeHBlcmltZW50WWVzEFVKFQoRRXhwZXJpbWVudENvbnRyb2wQBUoQCgxFeHBlcmltZW50Tm8QBVIKEgQyOS4qIAIoBBKGAQoQU2ltcGxlQ2FjaGVUcmlhbBjEtI2WBTgBQgxFeHBlcmltZW50Tm9KEAoMRXhwZXJpbWVudE5vEABKEQoNRXhwZXJpbWVudFllcxBQShIKDkV4cGVyaW1lbnRZZXMyEApKFQoRRXhwZXJpbWVudENvbnRyb2wQClIMEgQyOC4qIAAgASgEEosBCjBTaW1wbGVDYWNoZUluZGV4Rmx1c2hEZWxheV9Gb3JlZ3JvdW5kX0JhY2tncm91bmQYxLSNlgU4AUIJMjAwMDBfMTAwSgwKCDUwMDBfMTAwEBlKDAoIMTAwMF8xMDAQGUoLCgcxMDAwXzIwEBlKDQoJMjAwMDBfMTAwEBlSDBIEMjkuKiAAIAEoBBJhChVTaW1wbGVDYWNoZU1heFRocmVhZHMYxLSNlgU4AEICNTBKBQoBMRAKSgUKATUQEkoGCgIxMBASSgYKAjIwEBJKBgoCMzAQEkoGCgI1MBASUg4SBDI5LiogACABIAIoBBKEAQoQU2ltcGxlQ2FjaGVUcmlhbBjEm5KlBTgBQgxFeHBlcmltZW50Tm9KEgoORXhwZXJpbWVudFllczIQAUoVChFFeHBlcmltZW50Q29udHJvbBABShEKDUV4cGVyaW1lbnRZZXMQWUoQCgxFeHBlcmltZW50Tm8QCVIKEgQzMC4qIAMoBBKeAwoEU1BEWRjEvuiKBTgAQgtTcGR5RW5hYmxlZEoPCgtTcGR5RW5hYmxlZBBaSgsKB0NvbnRyb2wQBUoQCgxTcGR5RGlzYWJsZWQQBUo+Ch5TcGR5RW5hYmxlZEJ5V2ViU29ja2V0T3ZlclNwZHkQACoaZW5hYmxlLXdlYnNvY2tldC1vdmVyLXNwZHlKNAoZU3BkeUVuYWJsZWRCeUh0dHAyRHJhZnQwNBAAKhVlbmFibGUtaHR0cDItZHJhZnQtMDRKKAoUU3BkeUVuYWJsZWRCeVNwZHk0YTIQACoOZW5hYmxlLXNwZHk0YTJKJgoSU3BkeUVuYWJsZWRCeVNwZHkzEAAqDmRpc2FibGUtc3BkeTMxSiQKFFNwZHlFbmFibGVkQnlOcG5TcGR5EAAqCmVuYWJsZS1ucG5KIwoVU3BkeURpc2FibGVkQnlVc2VTcGR5EAAqCHVzZS1zcGR5SisKFlNwZHlEaXNhYmxlZEJ5SHR0cE9ubHkQACoPZW5hYmxlLW5wbi1odHRwUhESCzMyLjAuMTY1My4wIAAgARKVAwoeU3BlY3VsYXRpdmVSZXNvdXJjZVByZWZldGNoaW5nGICc44oFOAFCCERpc2FibGVkSgwKCERpc2FibGVkEChKEAoMTGVhcm5pbmdIb3N0EApKDwoLTGVhcm5pbmdVUkwQCkoMCghMZWFybmluZxAKShMKD1ByZWZldGNoaW5nSG9zdBAKShIKDlByZWZldGNoaW5nVVJMEApKDwoLUHJlZmV0Y2hpbmcQCkocChhQcmVmZXRjaGluZ0xvd0NvbmZpZGVuY2UQAEodChlQcmVmZXRjaGluZ0hpZ2hDb25maWRlbmNlEABKHAoYUHJlZmV0Y2hpbmdNb3JlUmVzb3VyY2VzEABKEwoPTGVhcm5pbmdTbWFsbERCEABKFgoSUHJlZmV0Y2hpbmdTbWFsbERCEABKIwofUHJlZmV0Y2hpbmdTbWFsbERCTG93Q29uZmlkZW5jZRAASiQKIFByZWZldGNoaW5nU21hbGxEQkhpZ2hDb25maWRlbmNlEABSFRILMjUuMC4xMzY0LiogAigAKAEoAhKXAwoeU3BlY3VsYXRpdmVSZXNvdXJjZVByZWZldGNoaW5nGICc44oFOAFCCERpc2FibGVkSgwKCERpc2FibGVkEChKEAoMTGVhcm5pbmdIb3N0EApKDwoLTGVhcm5pbmdVUkwQCkoMCghMZWFybmluZxAKShMKD1ByZWZldGNoaW5nSG9zdBAKShIKDlByZWZldGNoaW5nVVJMEApKDwoLUHJlZmV0Y2hpbmcQCkocChhQcmVmZXRjaGluZ0xvd0NvbmZpZGVuY2UQAEodChlQcmVmZXRjaGluZ0hpZ2hDb25maWRlbmNlEABKHAoYUHJlZmV0Y2hpbmdNb3JlUmVzb3VyY2VzEABKEwoPTGVhcm5pbmdTbWFsbERCEABKFgoSUHJlZmV0Y2hpbmdTbWFsbERCEABKIwofUHJlZmV0Y2hpbmdTbWFsbERCTG93Q29uZmlkZW5jZRAASiQKIFByZWZldGNoaW5nU21hbGxEQkhpZ2hDb25maWRlbmNlEABSFxILMjUuMC4xMzY0LiogACABKAAoASgCEl0KFVNwZWN1bGF0aXZlVGFiUmVzdG9yZRjEtI2WBTgBQghEaXNhYmxlZEoLCgdFbmFibGVkEApKCwoHQ29udHJvbBAKSgwKCERpc2FibGVkEFBSChIEMzEuKiACKAQSXwoVU3BlY3VsYXRpdmVUYWJSZXN0b3JlGMS0jZYFOAFCCERpc2FibGVkSgsKB0VuYWJsZWQQMkoLCgdDb250cm9sEDJKDAoIRGlzYWJsZWQQAFIMEgQzMS4qIAAgASgEElIKClNwZWxsY2hlY2sYxNu0jQU4AUIHRGVmYXVsdEoLCgdEZWZhdWx0EGRKDwoLU3VnZ2VzdGlvbnMQAFIVEgsyNi4wLjE0MDMuMCACIAEgACgAElQKClNwZWxsY2hlY2sYxNu0jQU4AUIHRGVmYXVsdEoLCgdEZWZhdWx0EGRKDwoLU3VnZ2VzdGlvbnMQAFIXEgsyNi4wLjE0MDMuMCADIAIgASgCKAMSTgoKU3BlbGxjaGVjaxjE27SNBTgBQgdEZWZhdWx0SgsKB0RlZmF1bHQQZEoPCgtTdWdnZXN0aW9ucxAAUhESCzI2LjAuMTQwMy4wIAMoABJPCg1FbmFibGVTdGFnZTNEGICI/oYFOAFCB2VuYWJsZWRKDAoHZW5hYmxlZBC2B0oPCgtibGFja2xpc3RlZBAyUg4SBDIyLiogACABIAIoABJRCg1FbmFibGVTdGFnZTNEGICI/oYFOAFCB2VuYWJsZWRKDAoHZW5hYmxlZBDoB0oPCgtibGFja2xpc3RlZBAAUhASBDIyLioaBDIyLiogAygAEmgKDUVuYWJsZVN0YWdlM0QYgN+/iQU4AUIPZW5hYmxlZF9kZWZhdWx0ShMKD2VuYWJsZWRfZGVmYXVsdBAASgwKB2VuYWJsZWQQ6AdKDwoLYmxhY2tsaXN0ZWQQAFIKEgQyMy4qIAMoABKuAgoLVGFiRXZpY3Rpb24YgPmMpQU4AUIHRGVmYXVsdEoLCgdDb250cm9sEDJKEQoNTWVtb3J5S2VlcEFsbBAAShMKD01lbW9yeUV2aWN0SGFsZhAAShMKD01lbW9yeUtlZXBUaHJlZRAyShQKEE1lbW9yeUV2aWN0VGhyZWUQAEoYChRCYWNrZ3JvdW5kaW5nS2VlcEFsbBAAShoKFkJhY2tncm91bmRpbmdFdmljdEhhbGYQAEoYChRCYWNrZ3JvdW5kaW5nS2VlcE9uZRAAShsKF0JhY2tncm91bmRpbmdFdmljdFRocmVlEABKEgoOTm9QcmVyZW5kZXJpbmcQAEoPCgtOb1F1aWNrYmFjaxAASgwKB0RlZmF1bHQQhAdSDhIEMjkuKiAAIAIgAygFEk4KE1Rlc3QwUGVyY2VudERlZmF1bHQYgJySpQU4AUIHZGVmYXVsdEoLCgdkZWZhdWx0EABKDAoIZ3JvdXBfMDEQZEoLCgdkb2dmb29kEAASYQoYVHJhbnNsYXRlSW5mb2JhclZzQnViYmxlGMSe15YFOAFCB0RlZmF1bHRKCwoHSW5mb2JhchABSgoKBkJ1YmJsZRABSgsKB0RlZmF1bHQQYlIOEgQzMi4qIAAgASgAKAMS2gEKHFVNQS1EeW5hbWljLVVuaWZvcm1pdHktVHJpYWwYgJySpQU4AUIHRGVmYXVsdEoUCgZHcm91cDEQARi/tskBIL+2yQFKFAoGR3JvdXAyEAkYwLbJASDAtskBShUKBkdyb3VwMxDqAxjBtskBIMG2yQFKFAoGR3JvdXA0EAEYwrbJASDCtskBShQKBkdyb3VwNRAJGMO2yQEgw7bJAUoVCgZHcm91cDYQ6gMYxLbJASDEtskBShUKB0RlZmF1bHQQABjFtskBIMW2yQFSDBIEMjcuKiADKAAoARJaChdVTUEtUG9wdWxhdGlvbi1SZXN0cmljdBiAnJKlBTgBQgdkZWZhdWx0SgsKB2RlZmF1bHQQAEoKCgZub3JtYWwQZEoLCgdkb2dmb29kEABSBhIEMzIuKmABEr0BCh9VTUEtVW5pZm9ybWl0eS1UcmlhbC0xMC1QZXJjZW50GICckqUFOAFCB2RlZmF1bHRKCwoHZGVmYXVsdBABSgwKCGdyb3VwXzAxEAFKDAoIZ3JvdXBfMDIQAUoMCghncm91cF8wMxABSgwKCGdyb3VwXzA0EAFKDAoIZ3JvdXBfMDUQAUoMCghncm91cF8wNhABSgwKCGdyb3VwXzA3EAFKDAoIZ3JvdXBfMDgQAUoMCghncm91cF8wORABEqYPCh5VTUEtVW5pZm9ybWl0eS1UcmlhbC0xLVBlcmNlbnQYgJySpQU4AUIHZGVmYXVsdEoQCgdkZWZhdWx0EAEYoLXJAUoRCghncm91cF8wMRABGKG1yQFKEQoIZ3JvdXBfMDIQARiitckBShEKCGdyb3VwXzAzEAEYo7XJAUoRCghncm91cF8wNBABGKS1yQFKEQoIZ3JvdXBfMDUQARiltckBShEKCGdyb3VwXzA2EAEYprXJAUoRCghncm91cF8wNxABGKe1yQFKEQoIZ3JvdXBfMDgQARiotckBShEKCGdyb3VwXzA5EAEYqbXJAUoRCghncm91cF8xMBABGKq1yQFKEQoIZ3JvdXBfMTEQARirtckBShEKCGdyb3VwXzEyEAEYrLXJAUoRCghncm91cF8xMxABGK21yQFKEQoIZ3JvdXBfMTQQARiutckBShEKCGdyb3VwXzE1EAEYr7XJAUoRCghncm91cF8xNhABGLC1yQFKEQoIZ3JvdXBfMTcQARixtckBShEKCGdyb3VwXzE4EAEYsrXJAUoRCghncm91cF8xORABGLO1yQFKEQoIZ3JvdXBfMjAQARi0tckBShEKCGdyb3VwXzIxEAEYtbXJAUoRCghncm91cF8yMhABGLa1yQFKEQoIZ3JvdXBfMjMQARi3tckBShEKCGdyb3VwXzI0EAEYuLXJAUoRCghncm91cF8yNRABGLm1yQFKEQoIZ3JvdXBfMjYQARi6tckBShEKCGdyb3VwXzI3EAEYu7XJAUoRCghncm91cF8yOBABGLy1yQFKEQoIZ3JvdXBfMjkQARi9tckBShEKCGdyb3VwXzMwEAEYvrXJAUoRCghncm91cF8zMRABGL+1yQFKEQoIZ3JvdXBfMzIQARjAtckBShEKCGdyb3VwXzMzEAEYwbXJAUoRCghncm91cF8zNBABGMK1yQFKEQoIZ3JvdXBfMzUQARjDtckBShEKCGdyb3VwXzM2EAEYxLXJAUoRCghncm91cF8zNxABGMW1yQFKEQoIZ3JvdXBfMzgQARjGtckBShEKCGdyb3VwXzM5EAEYx7XJAUoRCghncm91cF80MBABGMi1yQFKEQoIZ3JvdXBfNDEQARjJtckBShEKCGdyb3VwXzQyEAEYyrXJAUoRCghncm91cF80MxABGMu1yQFKEQoIZ3JvdXBfNDQQARjMtckBShEKCGdyb3VwXzQ1EAEYzbXJAUoRCghncm91cF80NhABGM61yQFKEQoIZ3JvdXBfNDcQARjPtckBShEKCGdyb3VwXzQ4EAEY0LXJAUoRCghncm91cF80ORABGNG1yQFKEQoIZ3JvdXBfNTAQARjStckBShEKCGdyb3VwXzUxEAEY07XJAUoRCghncm91cF81MhABGNS1yQFKEQoIZ3JvdXBfNTMQARjVtckBShEKCGdyb3VwXzU0EAEY1rXJAUoRCghncm91cF81NRABGNe1yQFKEQoIZ3JvdXBfNTYQARjYtckBShEKCGdyb3VwXzU3EAEY2bXJAUoRCghncm91cF81OBABGNq1yQFKEQoIZ3JvdXBfNTkQARjbtckBShEKCGdyb3VwXzYwEAEY3LXJAUoRCghncm91cF82MRABGN21yQFKEQoIZ3JvdXBfNjIQARjetckBShEKCGdyb3VwXzYzEAEY37XJAUoRCghncm91cF82NBABGOC1yQFKEQoIZ3JvdXBfNjUQARjhtckBShEKCGdyb3VwXzY2EAEY4rXJAUoRCghncm91cF82NxABGOO1yQFKEQoIZ3JvdXBfNjgQARjktckBShEKCGdyb3VwXzY5EAEY5bXJAUoRCghncm91cF83MBABGOa1yQFKEQoIZ3JvdXBfNzEQARjntckBShEKCGdyb3VwXzcyEAEY6LXJAUoRCghncm91cF83MxABGOm1yQFKEQoIZ3JvdXBfNzQQARjqtckBShEKCGdyb3VwXzc1EAEY67XJAUoRCghncm91cF83NhABGOy1yQFKEQoIZ3JvdXBfNzcQARjttckBShEKCGdyb3VwXzc4EAEY7rXJAUoRCghncm91cF83ORABGO+1yQFKEQoIZ3JvdXBfODAQARjwtckBShEKCGdyb3VwXzgxEAEY8bXJAUoRCghncm91cF84MhABGPK1yQFKEQoIZ3JvdXBfODMQARjztckBShEKCGdyb3VwXzg0EAEY9LXJAUoRCghncm91cF84NRABGPW1yQFKEQoIZ3JvdXBfODYQARj2tckBShEKCGdyb3VwXzg3EAEY97XJAUoRCghncm91cF84OBABGPi1yQFKEQoIZ3JvdXBfODkQARj5tckBShEKCGdyb3VwXzkwEAEY+rXJAUoRCghncm91cF85MRABGPu1yQFKEQoIZ3JvdXBfOTIQARj8tckBShEKCGdyb3VwXzkzEAEY/bXJAUoRCghncm91cF85NBABGP61yQFKEQoIZ3JvdXBfOTUQARj/tckBShEKCGdyb3VwXzk2EAEYgLbJAUoRCghncm91cF85NxABGIG2yQFKEQoIZ3JvdXBfOTgQARiCtskBShEKCGdyb3VwXzk5EAEYg7bJAVIIKAAoASgCKAMSrgsKHlVNQS1Vbmlmb3JtaXR5LVRyaWFsLTEtUGVyY2VudBiAnJKlBTgBQgdkZWZhdWx0SgsKB2RlZmF1bHQQAUoMCghncm91cF8wMRABSgwKCGdyb3VwXzAyEAFKDAoIZ3JvdXBfMDMQAUoMCghncm91cF8wNBABSgwKCGdyb3VwXzA1EAFKDAoIZ3JvdXBfMDYQAUoMCghncm91cF8wNxABSgwKCGdyb3VwXzA4EAFKDAoIZ3JvdXBfMDkQAUoMCghncm91cF8xMBABSgwKCGdyb3VwXzExEAFKDAoIZ3JvdXBfMTIQAUoMCghncm91cF8xMxABSgwKCGdyb3VwXzE0EAFKDAoIZ3JvdXBfMTUQAUoMCghncm91cF8xNhABSgwKCGdyb3VwXzE3EAFKDAoIZ3JvdXBfMTgQAUoMCghncm91cF8xORABSgwKCGdyb3VwXzIwEAFKDAoIZ3JvdXBfMjEQAUoMCghncm91cF8yMhABSgwKCGdyb3VwXzIzEAFKDAoIZ3JvdXBfMjQQAUoMCghncm91cF8yNRABSgwKCGdyb3VwXzI2EAFKDAoIZ3JvdXBfMjcQAUoMCghncm91cF8yOBABSgwKCGdyb3VwXzI5EAFKDAoIZ3JvdXBfMzAQAUoMCghncm91cF8zMRABSgwKCGdyb3VwXzMyEAFKDAoIZ3JvdXBfMzMQAUoMCghncm91cF8zNBABSgwKCGdyb3VwXzM1EAFKDAoIZ3JvdXBfMzYQAUoMCghncm91cF8zNxABSgwKCGdyb3VwXzM4EAFKDAoIZ3JvdXBfMzkQAUoMCghncm91cF80MBABSgwKCGdyb3VwXzQxEAFKDAoIZ3JvdXBfNDIQAUoMCghncm91cF80MxABSgwKCGdyb3VwXzQ0EAFKDAoIZ3JvdXBfNDUQAUoMCghncm91cF80NhABSgwKCGdyb3VwXzQ3EAFKDAoIZ3JvdXBfNDgQAUoMCghncm91cF80ORABSgwKCGdyb3VwXzUwEAFKDAoIZ3JvdXBfNTEQAUoMCghncm91cF81MhABSgwKCGdyb3VwXzUzEAFKDAoIZ3JvdXBfNTQQAUoMCghncm91cF81NRABSgwKCGdyb3VwXzU2EAFKDAoIZ3JvdXBfNTcQAUoMCghncm91cF81OBABSgwKCGdyb3VwXzU5EAFKDAoIZ3JvdXBfNjAQAUoMCghncm91cF82MRABSgwKCGdyb3VwXzYyEAFKDAoIZ3JvdXBfNjMQAUoMCghncm91cF82NBABSgwKCGdyb3VwXzY1EAFKDAoIZ3JvdXBfNjYQAUoMCghncm91cF82NxABSgwKCGdyb3VwXzY4EAFKDAoIZ3JvdXBfNjkQAUoMCghncm91cF83MBABSgwKCGdyb3VwXzcxEAFKDAoIZ3JvdXBfNzIQAUoMCghncm91cF83MxABSgwKCGdyb3VwXzc0EAFKDAoIZ3JvdXBfNzUQAUoMCghncm91cF83NhABSgwKCGdyb3VwXzc3EAFKDAoIZ3JvdXBfNzgQAUoMCghncm91cF83ORABSgwKCGdyb3VwXzgwEAFKDAoIZ3JvdXBfODEQAUoMCghncm91cF84MhABSgwKCGdyb3VwXzgzEAFKDAoIZ3JvdXBfODQQAUoMCghncm91cF84NRABSgwKCGdyb3VwXzg2EAFKDAoIZ3JvdXBfODcQAUoMCghncm91cF84OBABSgwKCGdyb3VwXzg5EAFKDAoIZ3JvdXBfOTAQAUoMCghncm91cF85MRABSgwKCGdyb3VwXzkyEAFKDAoIZ3JvdXBfOTMQAUoMCghncm91cF85NBABSgwKCGdyb3VwXzk1EAFKDAoIZ3JvdXBfOTYQAUoMCghncm91cF85NxABSgwKCGdyb3VwXzk4EAFKDAoIZ3JvdXBfOTkQAVIEKAQoBRKQAQofVU1BLVVuaWZvcm1pdHktVHJpYWwtMjAtUGVyY2VudBiAnJKlBTgBQgdkZWZhdWx0ShAKB2RlZmF1bHQQARiitskBShEKCGdyb3VwXzAxEAEYo7bJAUoRCghncm91cF8wMhABGKS2yQFKEQoIZ3JvdXBfMDMQARiltskBShEKCGdyb3VwXzA0EAEYprbJARJNCh9VTUEtVW5pZm9ybWl0eS1UcmlhbC01MC1QZXJjZW50GICckqUFOAFCB2RlZmF1bHRKCwoHZGVmYXVsdBABSgwKCGdyb3VwXzAxEAEStgMKHlVNQS1Vbmlmb3JtaXR5LVRyaWFsLTUtUGVyY2VudBiAnJKlBTgBQgdkZWZhdWx0ShAKB2RlZmF1bHQQARiEtskBShEKCGdyb3VwXzAxEAEYhbbJAUoRCghncm91cF8wMhABGIa2yQFKEQoIZ3JvdXBfMDMQARiHtskBShEKCGdyb3VwXzA0EAEYiLbJAUoRCghncm91cF8wNRABGIm2yQFKEQoIZ3JvdXBfMDYQARiKtskBShEKCGdyb3VwXzA3EAEYi7bJAUoRCghncm91cF8wOBABGIy2yQFKEQoIZ3JvdXBfMDkQARiNtskBShEKCGdyb3VwXzEwEAEYjrbJAUoRCghncm91cF8xMRABGI+2yQFKEQoIZ3JvdXBfMTIQARiQtskBShEKCGdyb3VwXzEzEAEYkbbJAUoRCghncm91cF8xNBABGJK2yQFKEQoIZ3JvdXBfMTUQARiTtskBShEKCGdyb3VwXzE2EAEYlLbJAUoRCghncm91cF8xNxABGJW2yQFKEQoIZ3JvdXBfMTgQARiWtskBShEKCGdyb3VwXzE5EAEYl7bJAVIIKAAoASgCKAMSzgIKHlVNQS1Vbmlmb3JtaXR5LVRyaWFsLTUtUGVyY2VudBiAnJKlBTgBQgdkZWZhdWx0SgsKB2RlZmF1bHQQAUoMCghncm91cF8wMRABSgwKCGdyb3VwXzAyEAFKDAoIZ3JvdXBfMDMQAUoMCghncm91cF8wNBABSgwKCGdyb3VwXzA1EAFKDAoIZ3JvdXBfMDYQAUoMCghncm91cF8wNxABSgwKCGdyb3VwXzA4EAFKDAoIZ3JvdXBfMDkQAUoMCghncm91cF8xMBABSgwKCGdyb3VwXzExEAFKDAoIZ3JvdXBfMTIQAUoMCghncm91cF8xMxABSgwKCGdyb3VwXzE0EAFKDAoIZ3JvdXBfMTUQAUoMCghncm91cF8xNhABSgwKCGdyb3VwXzE3EAFKDAoIZ3JvdXBfMTgQAUoMCghncm91cF8xORABUgQoBCgFEmIKFldlYkdMRGVidWdSZW5kZXJlckluZm8YxILomQU4AUIIZGlzYWJsZWRKCwoHZW5hYmxlZBAySgsKB2NvbnRyb2wQMkoMCghkaXNhYmxlZBAAUg4gACABKAAoASgDKAIoBA== "}), Replaced,[222750c9106c92a44638da877e879f61]

    Physical Sectors: 0
    (No malicious items detected)


    (end)
     
    elcajongunsfan,
    #6
  8. 2014/10/26
    elcajongunsfan Lifetime Subscriber

    elcajongunsfan Well-Known Member Thread Starter

    Joined:
    2012/01/01
    Messages:
    377
    Likes Received:
    12
    DDS (Ver_2012-11-20.01) - NTFS_x86
    Internet Explorer: 8.0.6001.18702
    Run by pcuser at 8:01:27 on 2014-10-26
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1475 [GMT -7:00]
    .
    AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
    AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
    .
    ============== Running Processes ================
    .
    c:\Program Files\Microsoft Security Client\MsMpEng.exe
    C:\windows\system32\spoolsv.exe
    C:\Program Files\Jsip\Jsip.exe
    C:\Program Files\CDBurnerXP\NMSAccessU.exe
    C:\windows\System32\alg.exe
    C:\windows\Explorer.EXE
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Microsoft Security Client\msseces.exe
    C:\windows\system32\ctfmon.exe
    C:\windows\system32\wuauclt.exe
    C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\windows\System32\svchost.exe -k netsvcs
    C:\windows\system32\svchost.exe -k WudfServiceGroup
    C:\windows\system32\svchost.exe -k NetworkService
    C:\windows\system32\svchost.exe -k LocalService
    C:\windows\system32\svchost.exe -k HPService
    C:\windows\System32\svchost.exe -k HPZ12
    C:\windows\System32\svchost.exe -k HPZ12
    C:\windows\system32\svchost.exe -k imgsvc
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.com
    mStart Page = hxxp://www.google.com
    uProxyServer = hxxp=127.0.0.1:13091;
    uProxyOverride = <-loopback>
    BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
    BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office14\GROOVEEX.DLL
    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office14\URLREDIR.DLL
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} -
    BHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
    mRun: [JobHisInit] c:\program files\rmclient\JobHisInit.exe
    mRun: [MplSetUp] c:\program files\rmclient\MplSetUp.exe
    mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
    mRun: [KernelFaultCheck] c:\windows\system32\dumprep 0 -k
    mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
    dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
    dRunOnce: [SpUninstallDeleteDir] rmdir /s /q "c:\windows\system32\config\systemprofile\application data\SearchProtect "
    dRunOnce: [Del103401687] cmd.exe /Q /D /c del "c:\windows\temp\0.del "
    dRunOnce: [Del103462953] cmd.exe /Q /D /c del "c:\windows\temp\0.del "
    uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
    mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
    mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    Trusted Zone: candy%20crush%20saga.com
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1274730520000
    DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect118.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    TCP: NameServer = 192.168.1.1 68.105.28.12 68.105.29.12
    TCP: Interfaces\{5236652A-D031-4CB5-8CB7-6E6F52C77CBA} : DHCPNameServer = 192.168.1.1 68.105.28.12 68.105.29.12
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
    Notify: igfxcui - igfxdev.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
    SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office14\GROOVEEX.DLL
    mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\38.0.2125.104\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\documents and settings\pcuser\application data\mozilla\firefox\profiles\9mic4unz.default\
    FF - plugin: c:\progra~1\micros~3\office14\NPAUTHZ.DLL
    FF - plugin: c:\progra~1\micros~3\office14\NPSPWRAP.DLL
    FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll
    FF - plugin: c:\program files\google\update\1.3.24.15\npGoogleUpdate3.dll
    FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_13_0_0_214.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 195296]
    R1 MpKsl071a081d;MpKsl071a081d;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b835c5ac-0c0a-4045-96ae-58fd1e4b8826}\MpKsl071a081d.sys [2014-10-26 39464]
    R2 Jsip;Jsip;c:\program files\jsip\jsip.exe -service --> c:\program files\jsip\Jsip.exe -service [?]
    R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2014-10-25 114904]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S3 SIUSBXP;SIUSBXP;c:\windows\system32\drivers\SiUSBXp.sys [2012-8-1 21992]
    S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-4 14336]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2013-7-20 754856]
    .
    =============== Created Last 30 ================
    .
    2014-10-26 15:00:41 62576 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b835c5ac-0c0a-4045-96ae-58fd1e4b8826}\offreg.dll
    2014-10-26 15:00:41 39464 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b835c5ac-0c0a-4045-96ae-58fd1e4b8826}\MpKsl071a081d.sys
    2014-10-26 04:58:31 -------- d-----w- c:\windows\system32\MRT
    2014-10-26 04:19:21 17903792 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
    2014-10-26 04:13:12 25088 -c----w- c:\windows\system32\dllcache\hidparse.sys
    2014-10-26 04:10:23 60160 -c----w- c:\windows\system32\dllcache\usbaudio.sys
    2014-10-26 04:10:23 46848 -c----w- c:\windows\system32\dllcache\irbus.sys
    2014-10-26 04:10:23 123008 -c----w- c:\windows\system32\dllcache\usbvideo.sys
    2014-10-26 04:09:12 5376 -c----w- c:\windows\system32\dllcache\usbd.sys
    2014-10-26 04:09:12 30336 -c----w- c:\windows\system32\dllcache\usbehci.sys
    2014-10-26 04:09:12 144128 -c----w- c:\windows\system32\dllcache\usbport.sys
    2014-10-26 03:59:54 8901368 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b835c5ac-0c0a-4045-96ae-58fd1e4b8826}\mpengine.dll
    2014-10-26 03:43:29 114904 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2014-10-26 03:43:15 54360 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2014-10-26 03:43:15 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
    2014-10-26 03:43:14 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
    2014-10-26 03:43:14 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
    2014-10-26 03:37:08 -------- d-----w- c:\windows\ERUNT
    2014-10-26 03:29:52 -------- d-----w- C:\AdwCleaner
    2014-10-26 02:45:47 -------- d-----w- c:\windows\pss
    .
    ==================== Find3M ====================
    .
    2014-10-26 04:19:40 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2014-10-26 04:19:40 701104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2014-09-22 06:41:56 231568 ------w- c:\windows\system32\MpSigStub.exe
    2013-07-12 00:20:09 0 ----a-w- c:\program files\GUTA6E.tmp
    2013-07-08 07:15:03 0 ----a-w- c:\program files\GUT4D2.tmp
    2013-07-06 08:15:10 0 ----a-w- c:\program files\GUT120.tmp
    2012-03-29 01:48:04 0 ----a-w- c:\program files\GUTA.tmp
    2012-03-28 17:48:27 0 ----a-w- c:\program files\GUT79.tmp
    .
    ============= FINISH: 8:02:56.04 ===============
     
    elcajongunsfan,
    #7
  9. 2014/10/26
    elcajongunsfan Lifetime Subscriber

    elcajongunsfan Well-Known Member Thread Starter

    Joined:
    2012/01/01
    Messages:
    377
    Likes Received:
    12
    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2012-11-20.01)
    .
    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 5/24/2010 11:17:01 AM
    System Uptime: 10/26/2014 7:25:36 AM (1 hours ago)
    .
    Motherboard: Dell Inc. | | 0RF705
    Processor: Intel(R) Pentium(R) D CPU 2.80GHz | Microprocessor | 2793/800mhz
    .
    ==== Disk Partitions =========================
    .
    A: is Removable
    C: is FIXED (NTFS) - 74 GiB total, 43.702 GiB free.
    D: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: WAN Miniport (IPX)
    Device ID: ROOT\MS_NDISWANIPX\0000
    Manufacturer: Microsoft
    Name: WAN Miniport (IPX)
    PNP Device ID: ROOT\MS_NDISWANIPX\0000
    Service: NdisWan
    .
    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: WAN Miniport (IPX)
    Device ID: ROOT\MS_NDISWANIPX\0001
    Manufacturer: Microsoft
    Name: WAN Miniport (IPX) #2
    PNP Device ID: ROOT\MS_NDISWANIPX\0001
    Service: NdisWan
    .
    Class GUID: {4D36E971-E325-11CE-BFC1-08002BE10318}
    Description: HP LaserJet 4000 Series
    Device ID: ROOT\MULTIFUNCTION\0000
    Manufacturer: Hewlett-Packard
    Name: HP LaserJet 4000 Series
    PNP Device ID: ROOT\MULTIFUNCTION\0000
    Service:
    .
    ==== System Restore Points ===================
    .
    RP755: 10/25/2014 8:10:22 PM - Removed WeatherBug
    RP756: 10/25/2014 8:11:03 PM - Removed Uninstall Helper
    RP757: 10/25/2014 8:13:20 PM - Removed CWA Reminder by We-Care.com v4.1.22.3
    RP758: 10/25/2014 9:09:02 PM - Software Distribution Service 3.0
    RP759: 10/25/2014 9:25:18 PM - Software Distribution Service 3.0
    RP760: 10/25/2014 11:24:03 PM - Microsoft Antimalware Checkpoint
    RP761: 10/26/2014 3:00:21 AM - Software Distribution Service 3.0
    RP762: 10/26/2014 7:12:51 AM - Software Distribution Service 3.0
    RP763: 10/26/2014 7:23:46 AM - Software Distribution Service 3.0
    .
    ==== Installed Programs ======================
    .
    32 Bit HP CIO Components Installer
    4500_G510gm_Help
    4500G510gm
    4500G510gm_Software_Min
    Adobe Flash Player 15 ActiveX
    Adobe Flash Player 15 Plugin
    Adobe Reader XI (11.0.03)
    Broadcom Gigabit Integrated Controller
    BufferChm
    CDBurnerXP
    Critical Security Update
    Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
    Google Chrome
    Google Update Helper
    Hewlett-Packard ACLM.NET v1.1.0.0
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB2158563)
    Hotfix for Windows XP (KB2443685)
    Hotfix for Windows XP (KB2633952)
    Hotfix for Windows XP (KB2756822)
    Hotfix for Windows XP (KB2779562)
    Hotfix for Windows XP (KB915800-v4)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    HP Officejet 4500 G510g-m
    HP Product Detection
    Intel(R) Graphics Media Accelerator Driver
    Jsip
    LessTabs
    Malwarebytes Anti-Malware version 2.0.3.1025
    McAfee Security Scan Plus
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2698023)
    Microsoft .NET Framework 1.1 Security Update (KB2833941)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft .NET Framework 4 Extended
    Microsoft Application Error Reporting
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Office Access MUI (English) 2010
    Microsoft Office Access Setup Metadata MUI (English) 2010
    Microsoft Office Excel MUI (English) 2010
    Microsoft Office File Validation Add-In
    Microsoft Office Groove MUI (English) 2010
    Microsoft Office InfoPath MUI (English) 2010
    Microsoft Office OneNote MUI (English) 2010
    Microsoft Office Outlook MUI (English) 2010
    Microsoft Office PowerPoint MUI (English) 2010
    Microsoft Office Professional Plus 2010
    Microsoft Office Proof (English) 2010
    Microsoft Office Proof (French) 2010
    Microsoft Office Proof (Spanish) 2010
    Microsoft Office Proofing (English) 2010
    Microsoft Office Publisher MUI (English) 2010
    Microsoft Office Shared MUI (English) 2010
    Microsoft Office Shared Setup Metadata MUI (English) 2010
    Microsoft Office Word MUI (English) 2010
    Microsoft Security Client
    Microsoft Security Essentials
    Microsoft Software Update for Web Folders (English) 14
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft VC9 runtime libraries
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Mozilla Firefox 30.0 (x86 en-US)
    Mozilla Maintenance Service
    mPlayer version 1.0
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    Network
    PrintMaster 2012 Platinum
    QuickTime
    Scan
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2861697)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2858302v2)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2861188)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2898855v2)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2901110v2)
    Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
    Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
    Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
    Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
    Security Update for Microsoft .NET Framework 4 Extended (KB2858302v2)
    Security Update for Microsoft .NET Framework 4 Extended (KB2901110v2)
    Security Update for Microsoft Office 2010 (KB2553284) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2687423) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2810073) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2850016) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2863942) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2880971) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2881071) 32-Bit Edition
    Security Update for Microsoft Windows (KB2564958)
    Security Update for Microsoft Word 2010 (KB2883013) 32-Bit Edition
    Security Update for Windows Internet Explorer 8 (KB2183461)
    Security Update for Windows Internet Explorer 8 (KB2360131)
    Security Update for Windows Internet Explorer 8 (KB2416400)
    Security Update for Windows Internet Explorer 8 (KB2482017)
    Security Update for Windows Internet Explorer 8 (KB2497640)
    Security Update for Windows Internet Explorer 8 (KB2510531)
    Security Update for Windows Internet Explorer 8 (KB2544521)
    Security Update for Windows Internet Explorer 8 (KB2618444)
    Security Update for Windows Internet Explorer 8 (KB2647516)
    Security Update for Windows Internet Explorer 8 (KB2675157)
    Security Update for Windows Internet Explorer 8 (KB2699988)
    Security Update for Windows Internet Explorer 8 (KB2722913)
    Security Update for Windows Internet Explorer 8 (KB2744842)
    Security Update for Windows Internet Explorer 8 (KB2761465)
    Security Update for Windows Internet Explorer 8 (KB2792100)
    Security Update for Windows Internet Explorer 8 (KB2797052)
    Security Update for Windows Internet Explorer 8 (KB2799329)
    Security Update for Windows Internet Explorer 8 (KB2809289)
    Security Update for Windows Internet Explorer 8 (KB2817183)
    Security Update for Windows Internet Explorer 8 (KB2829530)
    Security Update for Windows Internet Explorer 8 (KB2847204)
    Security Update for Windows Internet Explorer 8 (KB2909210)
    Security Update for Windows Internet Explorer 8 (KB2936068)
    Security Update for Windows Internet Explorer 8 (KB2964358)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player (KB2378111)
    Security Update for Windows Media Player (KB2834904-v2)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player (KB979402)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Search 4 - KB963093
    Security Update for Windows XP (KB2079403)
    Security Update for Windows XP (KB2115168)
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2160329)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2279986)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB2296011)
    Security Update for Windows XP (KB2296199)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB2360937)
    Security Update for Windows XP (KB2387149)
    Security Update for Windows XP (KB2393802)
    Security Update for Windows XP (KB2412687)
    Security Update for Windows XP (KB2419632)
    Security Update for Windows XP (KB2423089)
    Security Update for Windows XP (KB2436673)
    Security Update for Windows XP (KB2440591)
    Security Update for Windows XP (KB2443105)
    Security Update for Windows XP (KB2476490)
    Security Update for Windows XP (KB2476687)
    Security Update for Windows XP (KB2478960)
    Security Update for Windows XP (KB2478971)
    Security Update for Windows XP (KB2479628)
    Security Update for Windows XP (KB2479943)
    Security Update for Windows XP (KB2481109)
    Security Update for Windows XP (KB2483185)
    Security Update for Windows XP (KB2485376)
    Security Update for Windows XP (KB2485663)
    Security Update for Windows XP (KB2503658)
    Security Update for Windows XP (KB2506212)
    Security Update for Windows XP (KB2506223)
    Security Update for Windows XP (KB2507618)
    Security Update for Windows XP (KB2507938)
    Security Update for Windows XP (KB2508272)
    Security Update for Windows XP (KB2508429)
    Security Update for Windows XP (KB2509553)
    Security Update for Windows XP (KB2511455)
    Security Update for Windows XP (KB2524375)
    Security Update for Windows XP (KB2535512)
    Security Update for Windows XP (KB2536276-v2)
    Security Update for Windows XP (KB2544893-v2)
    Security Update for Windows XP (KB2566454)
    Security Update for Windows XP (KB2567680)
    Security Update for Windows XP (KB2570222)
    Security Update for Windows XP (KB2570947)
    Security Update for Windows XP (KB2584146)
    Security Update for Windows XP (KB2585542)
    Security Update for Windows XP (KB2592799)
    Security Update for Windows XP (KB2598479)
    Security Update for Windows XP (KB2603381)
    Security Update for Windows XP (KB2618451)
    Security Update for Windows XP (KB2619339)
    Security Update for Windows XP (KB2620712)
    Security Update for Windows XP (KB2621440)
    Security Update for Windows XP (KB2624667)
    Security Update for Windows XP (KB2631813)
    Security Update for Windows XP (KB2633171)
    Security Update for Windows XP (KB2639417)
    Security Update for Windows XP (KB2641653)
    Security Update for Windows XP (KB2646524)
    Security Update for Windows XP (KB2647518)
    Security Update for Windows XP (KB2653956)
    Security Update for Windows XP (KB2655992)
    Security Update for Windows XP (KB2659262)
    Security Update for Windows XP (KB2660465)
    Security Update for Windows XP (KB2661637)
    Security Update for Windows XP (KB2676562)
    Security Update for Windows XP (KB2685939)
    Security Update for Windows XP (KB2686509)
    Security Update for Windows XP (KB2691442)
    Security Update for Windows XP (KB2695962)
    Security Update for Windows XP (KB2698365)
    Security Update for Windows XP (KB2705219)
    Security Update for Windows XP (KB2707511)
    Security Update for Windows XP (KB2712808)
    Security Update for Windows XP (KB2718523)
    Security Update for Windows XP (KB2719985)
    Security Update for Windows XP (KB2723135)
    Security Update for Windows XP (KB2724197)
    Security Update for Windows XP (KB2727528)
    Security Update for Windows XP (KB2731847)
    Security Update for Windows XP (KB2753842-v2)
    Security Update for Windows XP (KB2753842)
    Security Update for Windows XP (KB2757638)
    Security Update for Windows XP (KB2758857)
    Security Update for Windows XP (KB2761226)
    Security Update for Windows XP (KB2770660)
    Security Update for Windows XP (KB2778344)
    Security Update for Windows XP (KB2779030)
    Security Update for Windows XP (KB2780091)
    Security Update for Windows XP (KB2799494)
    Security Update for Windows XP (KB2802968)
    Security Update for Windows XP (KB2807986)
    Security Update for Windows XP (KB2808735)
    Security Update for Windows XP (KB2813170)
    Security Update for Windows XP (KB2813345)
    Security Update for Windows XP (KB2820197)
    Security Update for Windows XP (KB2820917)
    Security Update for Windows XP (KB2829361)
    Security Update for Windows XP (KB2834886)
    Security Update for Windows XP (KB2847311)
    Security Update for Windows XP (KB2850869)
    Security Update for Windows XP (KB2859537)
    Security Update for Windows XP (KB2862152)
    Security Update for Windows XP (KB2862330)
    Security Update for Windows XP (KB2862335)
    Security Update for Windows XP (KB2864063)
    Security Update for Windows XP (KB2868038)
    Security Update for Windows XP (KB2868626)
    Security Update for Windows XP (KB2876217)
    Security Update for Windows XP (KB2876331)
    Security Update for Windows XP (KB2892075)
    Security Update for Windows XP (KB2893294)
    Security Update for Windows XP (KB2898715)
    Security Update for Windows XP (KB2900986)
    Security Update for Windows XP (KB2914368)
    Security Update for Windows XP (KB2916036)
    Security Update for Windows XP (KB2922229)
    Security Update for Windows XP (KB2929961)
    Security Update for Windows XP (KB2930275)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923789)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB979687)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB980436)
    Security Update for Windows XP (KB981322)
    Security Update for Windows XP (KB981852)
    Security Update for Windows XP (KB981957)
    Security Update for Windows XP (KB981997)
    Security Update for Windows XP (KB982132)
    Security Update for Windows XP (KB982214)
    Security Update for Windows XP (KB982665)
    Security Update for Windows XP (KB982802)
    Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition
    SmartDeviceMonitor for Client
    Spybot - Search & Destroy
    Toolbox
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3)
    Update for Microsoft .NET Framework 4 Extended (KB2836939v3)
    Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition
    Update for Microsoft Excel 2010 (KB2889836) 32-Bit Edition
    Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition
    Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition
    Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2687502) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2837606) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2878252) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition
    Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition
    Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition
    Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition
    Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition
    Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition
    Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition
    Update for Microsoft Windows (KB971513)
    Update for Windows Internet Explorer 8 (KB2362765)
    Update for Windows Internet Explorer 8 (KB2447568)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB980182)
    Update for Windows Internet Explorer 8 (KB980302)
    Update for Windows Internet Explorer 8 (KB982632)
    Update for Windows XP (KB2141007)
    Update for Windows XP (KB2345886)
    Update for Windows XP (KB2467659)
    Update for Windows XP (KB2492386)
    Update for Windows XP (KB2541763)
    Update for Windows XP (KB2641690)
    Update for Windows XP (KB2661254-v2)
    Update for Windows XP (KB2718704)
    Update for Windows XP (KB2736233)
    Update for Windows XP (KB2749655)
    Update for Windows XP (KB2904266)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971029)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Update for Windows XP (KB980182)
    WebFldrs XP
    WebReg
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Internet Explorer 8
    Windows Management Framework Core
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Search 4.0
    Windows XP Service Pack 3
    Wireless USB Card
    Yahoo! Toolbar
    .
    ==== Event Viewer Messages From Past Week ========
    .
    10/26/2014 12:40:11 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service gupdate with arguments "/comsvc" in order to run the server: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
    10/25/2014 9:20:00 PM, error: Schedule [7901] - The At4.job command failed to start due to the following error: %%2147942403
    10/25/2014 9:19:00 PM, error: Schedule [7901] - The At3.job command failed to start due to the following error: %%2147942403
    10/25/2014 8:56:47 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.149.1856.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.9402.0 Error code: 0x80244015 Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
    10/25/2014 8:55:57 PM, error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).
    10/25/2014 8:55:27 PM, error: Service Control Manager [7023] - The Client Service for NetWare service terminated with the following error: The system cannot find the file specified.
    10/25/2014 8:55:14 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
    10/25/2014 8:35:48 PM, error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
    10/25/2014 8:35:48 PM, error: Service Control Manager [7000] - The Microsoft Antimalware Service service failed to start due to the following error: The file can not be accessed by the system.
    10/25/2014 8:33:05 PM, error: Service Control Manager [7028] - The Jsip Registry key denied access to SYSTEM account programs so the Service Control Manager took ownership of the Registry key.
    10/25/2014 8:33:04 PM, error: Service Control Manager [7034] - The NMSAccess service terminated unexpectedly. It has done this 1 time(s).
    10/25/2014 8:33:04 PM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    10/25/2014 8:33:04 PM, error: Service Control Manager [7031] - The Jsip service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
    10/25/2014 8:07:57 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    10/25/2014 8:05:04 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments " " in order to run the server: {000C101C-0000-0000-C000-000000000046}
    10/25/2014 7:53:54 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MpFilter MRxSmb NetBIOS NetBT PCTSD RasAcd Rdbss Tcpip tStLibG WS2IFSL {a459d632-5225-4bb9-9a0b-002544d16f6e}t
    10/25/2014 7:53:54 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
    10/25/2014 7:53:54 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    10/25/2014 7:53:54 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
    10/25/2014 7:53:00 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    .
    ==== End Of File ===========================
     
    elcajongunsfan,
    #8
  10. 2014/10/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    =================================

    [​IMG] Uninstall:
    - LessTabs
    - McAfee Security Scan Plus

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2

    • Close all the running programs
    • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Create new restore point before proceeding with the next step....
    How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

    Download [​IMG] Malwarebytes Anti-Rootkit to your desktop.
    • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
    • Double click on downloaded file. OK self extracting prompt.
    • MBAR will start. Click "Next" to continue.
    • Click in the following screen "Update" to obtain the latest malware definitions.
    • Once the update is complete select "Next" and click "Scan ".
    • When the scan is finished and no malware has been found select "Exit ".
    • If malware was detected, make sure to check all the items and click "Cleanup ". Reboot your computer.
    • Open the MBAR folder located on your Desktop and paste the content of the following files in your next reply:
      • "mbar-log-{date} (xx-xx-xx).txt "
      • "system-log.txt "
     
    broni,
    #9
  11. 2014/10/27
    elcajongunsfan Lifetime Subscriber

    elcajongunsfan Well-Known Member Thread Starter

    Joined:
    2012/01/01
    Messages:
    377
    Likes Received:
    12
    OK, on Rogue Killer, the output showed some items ( the bad ones?) that were checked and others that were not. So I'm showing the log with the checked and fixed items first, and a second scan log with items that were not checked

    thanks

    RogueKiller V10.0.3.0 [Oct 22 2014] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
    Started in : Normal mode
    User : pcuser [Administrator]
    Mode : Scan -- Date : 10/27/2014 16:32:21

    ¤¤¤ Processes : 0 ¤¤¤

    ¤¤¤ Registry : 19 ¤¤¤
    [ZeroAccess] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad | CDBurn : {fbeb8a05-beee-4442-804e-409d6c4515e9} -> Found
    [Suspicious.Path] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce | Del103401687 : cmd.exe /Q /D /c del "C:\windows\TEMP\0.del" -> Found
    [Suspicious.Path] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce | Del103462953 : cmd.exe /Q /D /c del "C:\windows\TEMP\0.del" -> Found
    [Suspicious.Path] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce | Del103401687 : cmd.exe /Q /D /c del "C:\windows\TEMP\0.del" -> Found
    [Suspicious.Path] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce | Del103462953 : cmd.exe /Q /D /c del "C:\windows\TEMP\0.del" -> Found
    [PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found
    [PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found
    [PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13091; -> Found
    [PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13091; -> Found
    [PUM.SearchPage] HKEY_USERS\S-1-5-21-1060284298-1409082233-839522115-1003\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5236652A-D031-4CB5-8CB7-6E6F52C77CBA} | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{5236652A-D031-4CB5-8CB7-6E6F52C77CBA} | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{5236652A-D031-4CB5-8CB7-6E6F52C77CBA} | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Found
    [PUM.StartMenu] HKEY_USERS\S-1-5-21-1060284298-1409082233-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 2 -> Found
    [PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found
    [ZeroAccess] HKEY_CLASSES_ROOT\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 | (default) : C:\RECYCLER\S-1-5-21-1060284298-1409082233-839522115-1003\$a3cddf4b4e95dfbb498ef04e79f36042\n. -> Found

    ¤¤¤ Tasks : 2 ¤¤¤
    [Suspicious.Path] At3.job -- C:\DOCUME~1\NETWOR~1\APPLIC~1\AFFILI~1\UPDATE~1\UPDATE~1.EXE (/Check) -> Found
    [Suspicious.Path] At4.job -- C:\DOCUME~1\NETWOR~1\APPLIC~1\MYSEAR~1\UPDATE~1\UPDATE~1.EXE (/Check) -> Found

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ Hosts File : 1 ¤¤¤
    [C:\windows\System32\drivers\etc\hosts] 127.0.0.1 localhost

    ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: WDC WD800JD-75MSA3 +++++
    --- User ---
    [MBR] 8ac1828d61096aca7fb4d2a99ffddb6e
    [BSP] 1f5489c92910f37e59d4737a5895225c : Windows XP MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 76285 MB
    User = LL1 ... OK
    User = LL2 ... OK

    RogueKiller V10.0.3.0 [Oct 22 2014] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
    Started in : Normal mode
    User : pcuser [Administrator]
    Mode : Scan -- Date : 10/27/2014 16:41:16

    ¤¤¤ Processes : 0 ¤¤¤

    ¤¤¤ Registry : 13 ¤¤¤
    [PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found
    [PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found
    [PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13091; -> Found
    [PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13091; -> Found
    [PUM.SearchPage] HKEY_USERS\S-1-5-21-1060284298-1409082233-839522115-1003\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5236652A-D031-4CB5-8CB7-6E6F52C77CBA} | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{5236652A-D031-4CB5-8CB7-6E6F52C77CBA} | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{5236652A-D031-4CB5-8CB7-6E6F52C77CBA} | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Found
    [PUM.StartMenu] HKEY_USERS\S-1-5-21-1060284298-1409082233-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 2 -> Found
    [PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found

    ¤¤¤ Tasks : 0 ¤¤¤

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ Hosts File : 1 ¤¤¤
    [C:\windows\System32\drivers\etc\hosts] 127.0.0.1 localhost

    ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: WDC WD800JD-75MSA3 +++++
    --- User ---
    [MBR] 8ac1828d61096aca7fb4d2a99ffddb6e
    [BSP] 1f5489c92910f37e59d4737a5895225c : Windows XP MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 76285 MB
    User = LL1 ... OK
    User = LL2 ... OK


    ============================================
    RKreport_DEL_10272014_163441.log - RKreport_SCN_10272014_163221.log

    Malwarebytes Anti-Rootkit BETA 1.07.0.1012
    www.malwarebytes.org

    Database version: v2014.10.27.09

    Windows XP Service Pack 3 x86 NTFS
    Internet Explorer 8.0.6001.18702
    pcuser :: 745REGMSO-07 [administrator]

    10/27/2014 4:51:48 PM
    mbar-log-2014-10-27 (16-51-48).txt

    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 331468
    Time elapsed: 15 minute(s), 12 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 2
    C:\RECYCLER\S-1-5-18\$a3cddf4b4e95dfbb498ef04e79f36042 (Trojan.Siredef.C) -> Delete on reboot. [15ac67b0cdaff73f22cc29d7a15fdc24]
    C:\RECYCLER\S-1-5-21-1060284298-1409082233-839522115-1003\$a3cddf4b4e95dfbb498ef04e79f36042 (Trojan.Siredef.C) -> Delete on reboot. [fac70017df9d82b4509ec83820e0728e]

    Files Detected: 0
    (No malicious items detected)

    Physical Sectors Detected: 0
    (No malicious items detected)

    (end)

    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.07.0.1012

    (c) Malwarebytes Corporation 2011-2012

    OS version: 5.1.2600 Windows XP Service Pack 3 x86

    Account is Administrative

    Internet Explorer version: 8.0.6001.18702

    File system is: NTFS
    Disk drives: C:\ DRIVE_FIXED
    CPU speed: 2.793000 GHz
    Memory total: 2136514560, free: 1442844672

    Downloaded database version: v2014.10.27.09
    Downloaded database version: v2014.10.22.01
    =======================================
    Initializing...
    ------------ Kernel report ------------
    10/27/2014 16:51:21
    ------------ Loaded modules -----------
    \windows\system32\ntkrnlpa.exe
    \windows\system32\hal.dll
    \windows\system32\KDCOM.DLL
    \windows\system32\BOOTVID.dll
    ACPI.sys
    \windows\system32\DRIVERS\WMILIB.SYS
    pci.sys
    isapnp.sys
    pciide.sys
    \windows\system32\DRIVERS\PCIIDEX.SYS
    MountMgr.sys
    ftdisk.sys
    dmload.sys
    dmio.sys
    PartMgr.sys
    VolSnap.sys
    atapi.sys
    cercsr6.sys
    \windows\System32\Drivers\SCSIPORT.SYS
    disk.sys
    \windows\system32\DRIVERS\CLASSPNP.SYS
    fltmgr.sys
    sr.sys
    MpFilter.sys
    PxHelp20.sys
    KSecDD.sys
    WudfPf.sys
    Ntfs.sys
    NDIS.sys
    Mup.sys
    \SystemRoot\system32\DRIVERS\intelppm.sys
    \SystemRoot\system32\DRIVERS\igxpmp32.sys
    \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    \SystemRoot\system32\DRIVERS\usbuhci.sys
    \SystemRoot\system32\DRIVERS\USBPORT.SYS
    \SystemRoot\system32\DRIVERS\usbehci.sys
    \SystemRoot\system32\DRIVERS\HDAudBus.sys
    \SystemRoot\system32\DRIVERS\b57xp32.sys
    \SystemRoot\system32\DRIVERS\fdc.sys
    \SystemRoot\system32\DRIVERS\parport.sys
    \SystemRoot\system32\DRIVERS\serial.sys
    \SystemRoot\system32\DRIVERS\serenum.sys
    \SystemRoot\system32\DRIVERS\imapi.sys
    \SystemRoot\system32\DRIVERS\cdrom.sys
    \SystemRoot\system32\DRIVERS\redbook.sys
    \SystemRoot\system32\DRIVERS\ks.sys
    \SystemRoot\system32\DRIVERS\audstub.sys
    \SystemRoot\system32\DRIVERS\rasl2tp.sys
    \SystemRoot\system32\DRIVERS\ndistapi.sys
    \SystemRoot\system32\DRIVERS\ndiswan.sys
    \SystemRoot\system32\DRIVERS\raspppoe.sys
    \SystemRoot\system32\DRIVERS\raspptp.sys
    \SystemRoot\system32\DRIVERS\TDI.SYS
    \SystemRoot\system32\DRIVERS\psched.sys
    \SystemRoot\system32\DRIVERS\msgpc.sys
    \SystemRoot\system32\DRIVERS\ptilink.sys
    \SystemRoot\system32\DRIVERS\raspti.sys
    \SystemRoot\system32\DRIVERS\rdpdr.sys
    \SystemRoot\system32\DRIVERS\termdd.sys
    \SystemRoot\system32\DRIVERS\kbdclass.sys
    \SystemRoot\system32\DRIVERS\mouclass.sys
    \SystemRoot\system32\DRIVERS\swenum.sys
    \SystemRoot\system32\DRIVERS\update.sys
    \SystemRoot\system32\DRIVERS\mssmbios.sys
    \SystemRoot\System32\Drivers\NDProxy.SYS
    \SystemRoot\system32\DRIVERS\usbhub.sys
    \SystemRoot\system32\DRIVERS\USBD.SYS
    \SystemRoot\system32\drivers\ADIHdAud.sys
    \SystemRoot\system32\drivers\portcls.sys
    \SystemRoot\system32\drivers\drmk.sys
    \SystemRoot\system32\DRIVERS\flpydisk.sys
    \SystemRoot\System32\Drivers\Fs_Rec.SYS
    \SystemRoot\System32\Drivers\Null.SYS
    \SystemRoot\System32\Drivers\Beep.SYS
    \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    \SystemRoot\System32\drivers\vga.sys
    \SystemRoot\System32\Drivers\mnmdd.SYS
    \SystemRoot\System32\DRIVERS\RDPCDD.sys
    \SystemRoot\System32\Drivers\Msfs.SYS
    \SystemRoot\System32\Drivers\Npfs.SYS
    \SystemRoot\system32\DRIVERS\rasacd.sys
    \SystemRoot\system32\DRIVERS\ipsec.sys
    \SystemRoot\system32\DRIVERS\tcpip.sys
    \SystemRoot\system32\DRIVERS\netbt.sys
    \SystemRoot\system32\DRIVERS\ipnat.sys
    \SystemRoot\System32\drivers\afd.sys
    \SystemRoot\system32\DRIVERS\netbios.sys
    \SystemRoot\system32\DRIVERS\rdbss.sys
    \SystemRoot\system32\DRIVERS\mrxsmb.sys
    \SystemRoot\System32\Drivers\Fips.SYS
    \SystemRoot\system32\DRIVERS\hidusb.sys
    \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    \SystemRoot\system32\DRIVERS\usbccgp.sys
    \SystemRoot\system32\DRIVERS\mouhid.sys
    \SystemRoot\system32\DRIVERS\kbdhid.sys
    \SystemRoot\system32\DRIVERS\wanarp.sys
    \SystemRoot\System32\Drivers\Cdfs.SYS
    \SystemRoot\System32\Drivers\dump_atapi.sys
    \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    \SystemRoot\System32\win32k.sys
    \SystemRoot\System32\drivers\Dxapi.sys
    \SystemRoot\System32\watchdog.sys
    \SystemRoot\System32\drivers\dxg.sys
    \SystemRoot\System32\drivers\dxgthk.sys
    \SystemRoot\System32\igxpgd32.dll
    \SystemRoot\System32\igxprd32.dll
    \SystemRoot\System32\igxpdv32.DLL
    \SystemRoot\System32\igxpdx32.DLL
    \SystemRoot\System32\ATMFD.DLL
    \SystemRoot\system32\DRIVERS\nwlnkipx.sys
    \SystemRoot\system32\DRIVERS\nwlnknb.sys
    \SystemRoot\system32\DRIVERS\ndisuio.sys
    \SystemRoot\system32\DRIVERS\nwlnkspx.sys
    \SystemRoot\System32\Drivers\ParVdm.SYS
    \SystemRoot\system32\DRIVERS\srv.sys
    \SystemRoot\system32\drivers\wdmaud.sys
    \SystemRoot\system32\drivers\sysaudio.sys
    \SystemRoot\System32\Drivers\HTTP.sys
    \SystemRoot\System32\Drivers\Fastfat.SYS
    \??\c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2D30ABEB-3E9B-4A4E-BD44-9CE99761B052}\MpKslb0536ead.sys
    \SystemRoot\system32\drivers\kmixer.sys
    \??\C:\windows\system32\drivers\mbamchameleon.sys
    \??\C:\windows\system32\drivers\MBAMSwissArmy.sys
    \WINDOWS\system32\ntdll.dll
    ----------- End -----------
    Done!
    <<<1>>>
    Upper Device Name: \Device\Harddisk0\DR0
    Upper Device Object: 0xffffffff8a598ab8
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-3\
    Lower Device Object: 0xffffffff8a5a7d98
    Lower Device Driver Name: \Driver\atapi\
    <<<2>>>
    Physical Sector Size: 512
    Drive: 0, DevicePointer: 0xffffffff8a598ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xffffffff8a59eb70, DeviceName: Unknown, DriverName: \Driver\PartMgr\
    DevicePointer: 0xffffffff8a598ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    DevicePointer: 0xffffffff8a5a7d98, DeviceName: \Device\Ide\IdeDeviceP0T0L0-3\, DriverName: \Driver\atapi\
    ------------ End ----------
    Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    Upper DeviceData: 0x0, 0x0, 0x0
    Lower DeviceData: 0x0, 0x0, 0x0
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    <<<2>>>
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
    Done!
    Drive 0
    This is a System drive
    Scanning MBR on drive 0...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: 72617261

    Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 63 Numsec = 156232062
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 80000000000 bytes
    Sector size: 512 bytes

    Scanning physical sectors of unpartitioned space on drive 0 (1-62-156230000-156250000)...
    Done!
    File "C:\Documents and Settings\pcuser\Cookies\index.dat" is compressed (flags = 1)
    File "C:\WINDOWS\wiadebug.log" is compressed (flags = 1)
    File "C:\WINDOWS\wiaservc.log" is compressed (flags = 1)
    File "C:\Documents and Settings\pcuser\Local Settings\History\History.IE5\index.dat" is compressed (flags = 1)
    Infected: C:\RECYCLER\S-1-5-18\$a3cddf4b4e95dfbb498ef04e79f36042 --> [Trojan.Siredef.C]
    Infected: C:\RECYCLER\S-1-5-21-1060284298-1409082233-839522115-1003\$a3cddf4b4e95dfbb498ef04e79f36042 --> [Trojan.Siredef.C]
    Scan finished
    Creating System Restore point...
    Cleaning up...
    Executing an action fixdamage.exe...
    Success!
    Queuing an action fixdamage.exe
    Removal successful. No system shutdown is required.
    =======================================


    Removal queue found; removal started
    Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
    Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\VBR-0-0-63-i.mbam...
    Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
    Removal finished
     
    elcajongunsfan,
    #10
  12. 2014/10/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    RogueKiller produces two logs, before and after fixes.
    You posted only first one.

    When done with posting second log...

    Please re-run MBAR one more time and post new logs.
     
    broni,
    #11
  13. 2014/10/27
    elcajongunsfan Lifetime Subscriber

    elcajongunsfan Well-Known Member Thread Starter

    Joined:
    2012/01/01
    Messages:
    377
    Likes Received:
    12
    What about the issue where RK doesnt check mark some items? Should I manually check them
     
    elcajongunsfan,
    #12
  14. 2014/10/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    No....
     
    broni,
    #13
  15. 2014/10/27
    elcajongunsfan Lifetime Subscriber

    elcajongunsfan Well-Known Member Thread Starter

    Joined:
    2012/01/01
    Messages:
    377
    Likes Received:
    12
    RogueKiller V10.0.3.0 [Oct 22 2014] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
    Started in : Normal mode
    User : pcuser [Administrator]
    Mode : Delete -- Date : 10/27/2014 16:34:42

    ¤¤¤ Processes : 0 ¤¤¤

    ¤¤¤ Registry : 19 ¤¤¤
    [ZeroAccess] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad | CDBurn : {fbeb8a05-beee-4442-804e-409d6c4515e9} -> Deleted
    [Suspicious.Path] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce | Del103401687 : cmd.exe /Q /D /c del "C:\windows\TEMP\0.del" [-][x][x][x][x][x] -> Deleted
    [Suspicious.Path] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce | Del103462953 : cmd.exe /Q /D /c del "C:\windows\TEMP\0.del" [-][x][x][x][x][x] -> Deleted
    [Suspicious.Path] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce | Del103401687 : cmd.exe /Q /D /c del "C:\windows\TEMP\0.del" -> ERROR [2]
    [Suspicious.Path] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce | Del103462953 : cmd.exe /Q /D /c del "C:\windows\TEMP\0.del" -> ERROR [2]
    [PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Not selected
    [PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Not selected
    [PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13091; -> Not selected
    [PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13091; -> Not selected
    [PUM.SearchPage] HKEY_USERS\S-1-5-21-1060284298-1409082233-839522115-1003\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Not selected
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Not selected
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Not selected
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Not selected
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5236652A-D031-4CB5-8CB7-6E6F52C77CBA} | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Not selected
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{5236652A-D031-4CB5-8CB7-6E6F52C77CBA} | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Not selected
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{5236652A-D031-4CB5-8CB7-6E6F52C77CBA} | DhcpNameServer : 192.168.1.1 68.105.28.12 68.105.29.12 -> Not selected
    [PUM.StartMenu] HKEY_USERS\S-1-5-21-1060284298-1409082233-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 2 -> Not selected
    [PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
    [ZeroAccess] HKEY_CLASSES_ROOT\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 | (default) : C:\RECYCLER\S-1-5-21-1060284298-1409082233-839522115-1003\$a3cddf4b4e95dfbb498ef04e79f36042\n. [x] -> Replaced (%systemroot%\system32\shell32.dll)

    ¤¤¤ Tasks : 2 ¤¤¤
    [Suspicious.Path] At3.job -- C:\DOCUME~1\NETWOR~1\APPLIC~1\AFFILI~1\UPDATE~1\UPDATE~1.EXE (/Check) -> Deleted
    [Suspicious.Path] At4.job -- C:\DOCUME~1\NETWOR~1\APPLIC~1\MYSEAR~1\UPDATE~1\UPDATE~1.EXE (/Check) -> Deleted

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ Hosts File : 1 ¤¤¤
    [C:\windows\System32\drivers\etc\hosts] 127.0.0.1 localhost

    ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: WDC WD800JD-75MSA3 +++++
    --- User ---
    [MBR] 8ac1828d61096aca7fb4d2a99ffddb6e
    [BSP] 1f5489c92910f37e59d4737a5895225c : Windows XP MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 76285 MB
    User = LL1 ... OK
    User = LL2 ... OK


    ============================================
    RKreport_SCN_10272014_163221.log
     
    elcajongunsfan,
    #14
  16. 2014/10/27
    elcajongunsfan Lifetime Subscriber

    elcajongunsfan Well-Known Member Thread Starter

    Joined:
    2012/01/01
    Messages:
    377
    Likes Received:
    12
    Malwarebytes Anti-Rootkit BETA 1.07.0.1012
    www.malwarebytes.org

    Database version: v2014.10.27.09

    Windows XP Service Pack 3 x86 NTFS
    Internet Explorer 8.0.6001.18702
    pcuser :: 745REGMSO-07 [administrator]

    10/27/2014 5:33:47 PM
    mbar-log-2014-10-27 (17-33-47).txt

    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 331538
    Time elapsed: 16 minute(s), 58 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    Physical Sectors Detected: 0
    (No malicious items detected)

    (end)


    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.07.0.1012

    (c) Malwarebytes Corporation 2011-2012

    OS version: 5.1.2600 Windows XP Service Pack 3 x86

    Account is Administrative

    Internet Explorer version: 8.0.6001.18702

    File system is: NTFS
    Disk drives: C:\ DRIVE_FIXED
    CPU speed: 2.793000 GHz
    Memory total: 2136514560, free: 1312006144

    Downloaded database version: v2014.10.27.09
    Downloaded database version: v2014.10.22.01
    Initializing...
    ======================
    ------------ Kernel report ------------
    10/27/2014 17:33:22
    ------------ Loaded modules -----------
    \windows\system32\ntkrnlpa.exe
    \windows\system32\hal.dll
    \windows\system32\KDCOM.DLL
    \windows\system32\BOOTVID.dll
    ACPI.sys
    \windows\system32\DRIVERS\WMILIB.SYS
    pci.sys
    isapnp.sys
    pciide.sys
    \windows\system32\DRIVERS\PCIIDEX.SYS
    MountMgr.sys
    ftdisk.sys
    dmload.sys
    dmio.sys
    PartMgr.sys
    VolSnap.sys
    atapi.sys
    cercsr6.sys
    \windows\System32\Drivers\SCSIPORT.SYS
    disk.sys
    \windows\system32\DRIVERS\CLASSPNP.SYS
    fltmgr.sys
    sr.sys
    MpFilter.sys
    PxHelp20.sys
    KSecDD.sys
    WudfPf.sys
    Ntfs.sys
    NDIS.sys
    Mup.sys
    \SystemRoot\system32\DRIVERS\intelppm.sys
    \SystemRoot\system32\DRIVERS\igxpmp32.sys
    \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    \SystemRoot\system32\DRIVERS\usbuhci.sys
    \SystemRoot\system32\DRIVERS\USBPORT.SYS
    \SystemRoot\system32\DRIVERS\usbehci.sys
    \SystemRoot\system32\DRIVERS\HDAudBus.sys
    \SystemRoot\system32\DRIVERS\b57xp32.sys
    \SystemRoot\system32\DRIVERS\fdc.sys
    \SystemRoot\system32\DRIVERS\parport.sys
    \SystemRoot\system32\DRIVERS\serial.sys
    \SystemRoot\system32\DRIVERS\serenum.sys
    \SystemRoot\system32\DRIVERS\imapi.sys
    \SystemRoot\system32\DRIVERS\cdrom.sys
    \SystemRoot\system32\DRIVERS\redbook.sys
    \SystemRoot\system32\DRIVERS\ks.sys
    \SystemRoot\system32\DRIVERS\audstub.sys
    \SystemRoot\system32\DRIVERS\rasl2tp.sys
    \SystemRoot\system32\DRIVERS\ndistapi.sys
    \SystemRoot\system32\DRIVERS\ndiswan.sys
    \SystemRoot\system32\DRIVERS\raspppoe.sys
    \SystemRoot\system32\DRIVERS\raspptp.sys
    \SystemRoot\system32\DRIVERS\TDI.SYS
    \SystemRoot\system32\DRIVERS\psched.sys
    \SystemRoot\system32\DRIVERS\msgpc.sys
    \SystemRoot\system32\DRIVERS\ptilink.sys
    \SystemRoot\system32\DRIVERS\raspti.sys
    \SystemRoot\system32\DRIVERS\rdpdr.sys
    \SystemRoot\system32\DRIVERS\termdd.sys
    \SystemRoot\system32\DRIVERS\kbdclass.sys
    \SystemRoot\system32\DRIVERS\mouclass.sys
    \SystemRoot\system32\DRIVERS\swenum.sys
    \SystemRoot\system32\DRIVERS\update.sys
    \SystemRoot\system32\DRIVERS\mssmbios.sys
    \SystemRoot\System32\Drivers\NDProxy.SYS
    \SystemRoot\system32\DRIVERS\usbhub.sys
    \SystemRoot\system32\DRIVERS\USBD.SYS
    \SystemRoot\system32\drivers\ADIHdAud.sys
    \SystemRoot\system32\drivers\portcls.sys
    \SystemRoot\system32\drivers\drmk.sys
    \SystemRoot\system32\DRIVERS\flpydisk.sys
    \SystemRoot\System32\Drivers\Fs_Rec.SYS
    \SystemRoot\System32\Drivers\Null.SYS
    \SystemRoot\System32\Drivers\Beep.SYS
    \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    \SystemRoot\System32\drivers\vga.sys
    \SystemRoot\System32\Drivers\mnmdd.SYS
    \SystemRoot\System32\DRIVERS\RDPCDD.sys
    \SystemRoot\System32\Drivers\Msfs.SYS
    \SystemRoot\System32\Drivers\Npfs.SYS
    \SystemRoot\system32\DRIVERS\rasacd.sys
    \SystemRoot\system32\DRIVERS\ipsec.sys
    \SystemRoot\system32\DRIVERS\tcpip.sys
    \SystemRoot\system32\DRIVERS\netbt.sys
    \SystemRoot\system32\DRIVERS\ipnat.sys
    \SystemRoot\System32\drivers\afd.sys
    \SystemRoot\system32\DRIVERS\netbios.sys
    \SystemRoot\system32\DRIVERS\rdbss.sys
    \SystemRoot\system32\DRIVERS\mrxsmb.sys
    \SystemRoot\System32\Drivers\Fips.SYS
    \SystemRoot\system32\DRIVERS\hidusb.sys
    \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    \SystemRoot\system32\DRIVERS\usbccgp.sys
    \SystemRoot\system32\DRIVERS\mouhid.sys
    \SystemRoot\system32\DRIVERS\kbdhid.sys
    \SystemRoot\system32\DRIVERS\wanarp.sys
    \SystemRoot\System32\Drivers\Cdfs.SYS
    \SystemRoot\System32\Drivers\dump_atapi.sys
    \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    \SystemRoot\System32\win32k.sys
    \SystemRoot\System32\drivers\Dxapi.sys
    \SystemRoot\System32\watchdog.sys
    \SystemRoot\System32\drivers\dxg.sys
    \SystemRoot\System32\drivers\dxgthk.sys
    \SystemRoot\System32\igxpgd32.dll
    \SystemRoot\System32\igxprd32.dll
    \SystemRoot\System32\igxpdv32.DLL
    \SystemRoot\System32\igxpdx32.DLL
    \SystemRoot\System32\ATMFD.DLL
    \SystemRoot\system32\DRIVERS\nwlnkipx.sys
    \SystemRoot\system32\DRIVERS\nwlnknb.sys
    \SystemRoot\system32\DRIVERS\ndisuio.sys
    \SystemRoot\system32\DRIVERS\nwlnkspx.sys
    \SystemRoot\System32\Drivers\ParVdm.SYS
    \SystemRoot\system32\DRIVERS\srv.sys
    \SystemRoot\system32\drivers\wdmaud.sys
    \SystemRoot\system32\drivers\sysaudio.sys
    \SystemRoot\System32\Drivers\HTTP.sys
    \SystemRoot\System32\Drivers\Fastfat.SYS
    \??\C:\windows\system32\drivers\mbamchameleon.sys
    \??\c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8820D195-B317-4C7E-B1F9-B2634C4DDD75}\MpKsl61a277c0.sys
    \??\C:\windows\system32\drivers\MBAMSwissArmy.sys
    \WINDOWS\system32\ntdll.dll
    ----------- End -----------
    Done!
    <<<1>>>
    Upper Device Name: \Device\Harddisk0\DR0
    Upper Device Object: 0xffffffff8a598ab8
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-3\
    Lower Device Object: 0xffffffff8a5a7d98
    Lower Device Driver Name: \Driver\atapi\
    <<<2>>>
    Physical Sector Size: 512
    Drive: 0, DevicePointer: 0xffffffff8a598ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xffffffff8a59eb70, DeviceName: Unknown, DriverName: \Driver\PartMgr\
    DevicePointer: 0xffffffff8a598ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    DevicePointer: 0xffffffff8a5a7d98, DeviceName: \Device\Ide\IdeDeviceP0T0L0-3\, DriverName: \Driver\atapi\
    ------------ End ----------
    Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    Upper DeviceData: 0x0, 0x0, 0x0
    Lower DeviceData: 0x0, 0x0, 0x0
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    <<<2>>>
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
    Done!
    Drive 0
    This is a System drive
    Scanning MBR on drive 0...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: 72617261

    Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 63 Numsec = 156232062
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 80000000000 bytes
    Sector size: 512 bytes

    Scanning physical sectors of unpartitioned space on drive 0 (1-62-156230000-156250000)...
    Done!
    File "C:\Documents and Settings\pcuser\Cookies\index.dat" is compressed (flags = 1)
    File "C:\WINDOWS\wiadebug.log" is compressed (flags = 1)
    File "C:\WINDOWS\wiaservc.log" is compressed (flags = 1)
    File "C:\Documents and Settings\pcuser\Local Settings\History\History.IE5\index.dat" is compressed (flags = 1)
    Scan finished
    =======================================


    Removal queue found; removal started
    Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
    Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\VBR-0-0-63-i.mbam...
    Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
    Removal finished
     
    elcajongunsfan,
    #15
  17. 2014/10/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Good :)

    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
    broni,
    #16
  18. 2014/10/27
    elcajongunsfan Lifetime Subscriber

    elcajongunsfan Well-Known Member Thread Starter

    Joined:
    2012/01/01
    Messages:
    377
    Likes Received:
    12
    in regards to the recovery console, the error message was "boot partition cannot be enumerated properly "

    thanks


    ComboFix 14-10-27.01 - pcuser 10/27/2014 18:02:01.1.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1425 [GMT -7:00]
    Running from: c:\documents and settings\pcuser\Desktop\ComboFix.exe
    AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
    AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
    .
    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\All Users\Application Data\TEMP
    c:\documents and settings\All Users\Application Data\TEMP\DFC5A2B2.TMP
    c:\documents and settings\pcuser\Local Settings\Temporary Internet Files\BatBrowse_iels
    c:\program files\Internet Explorer\SET2E1.tmp
    c:\program files\Internet Explorer\SET2E2.tmp
    c:\windows\$msi31uninstall_kb893803v2$
    c:\windows\$msi31uninstall_kb893803v2$\msi.dll
    c:\windows\$msi31uninstall_kb893803v2$\msiexec.exe
    c:\windows\$msi31uninstall_kb893803v2$\msihnd.dll
    c:\windows\$msi31uninstall_kb893803v2$\msimsg.dll
    c:\windows\$msi31uninstall_kb893803v2$\msisip.dll
    c:\windows\$msi31uninstall_kb893803v2$\reg00013
    c:\windows\$msi31uninstall_kb893803v2$\reg00014
    c:\windows\$msi31uninstall_kb893803v2$\reg00015
    c:\windows\$msi31uninstall_kb893803v2$\reg00016
    c:\windows\$msi31uninstall_kb893803v2$\reg00017
    c:\windows\$msi31uninstall_kb893803v2$\reg00018
    c:\windows\$msi31uninstall_kb893803v2$\reg00019
    c:\windows\$msi31uninstall_kb893803v2$\reg00020
    c:\windows\$msi31uninstall_kb893803v2$\reg00021
    c:\windows\$msi31uninstall_kb893803v2$\reg00022
    c:\windows\$msi31uninstall_kb893803v2$\reg00023
    c:\windows\$msi31uninstall_kb893803v2$\reg00024
    c:\windows\$msi31uninstall_kb893803v2$\reg00025
    c:\windows\$msi31uninstall_kb893803v2$\reg00026
    c:\windows\$msi31uninstall_kb893803v2$\reg00027
    c:\windows\$msi31uninstall_kb893803v2$\reg00028
    c:\windows\$msi31uninstall_kb893803v2$\reg00029
    c:\windows\$msi31uninstall_kb893803v2$\reg00030
    c:\windows\$msi31uninstall_kb893803v2$\reg00031
    c:\windows\$msi31uninstall_kb893803v2$\reg00032
    c:\windows\$msi31uninstall_kb893803v2$\reg00033
    c:\windows\$msi31uninstall_kb893803v2$\reg00034
    c:\windows\$msi31uninstall_kb893803v2$\reg00035
    c:\windows\$msi31uninstall_kb893803v2$\reg00036
    c:\windows\$msi31uninstall_kb893803v2$\reg00037
    c:\windows\$msi31uninstall_kb893803v2$\reg00038
    c:\windows\$msi31uninstall_kb893803v2$\reg00039
    c:\windows\$msi31uninstall_kb893803v2$\reg00040
    c:\windows\$msi31uninstall_kb893803v2$\reg00041
    c:\windows\$msi31uninstall_kb893803v2$\reg00042
    c:\windows\$msi31uninstall_kb893803v2$\reg00043
    c:\windows\$msi31uninstall_kb893803v2$\reg00044
    c:\windows\$msi31uninstall_kb893803v2$\reg00045
    c:\windows\$msi31uninstall_kb893803v2$\reg00046
    c:\windows\$msi31uninstall_kb893803v2$\reg00047
    c:\windows\$msi31uninstall_kb893803v2$\reg00048
    c:\windows\$msi31uninstall_kb893803v2$\reg00051
    c:\windows\$msi31uninstall_kb893803v2$\reg00052
    c:\windows\$msi31uninstall_kb893803v2$\reg00053
    c:\windows\$msi31uninstall_kb893803v2$\reg00054
    c:\windows\$msi31uninstall_kb893803v2$\reg00055
    c:\windows\$msi31uninstall_kb893803v2$\reg00056
    c:\windows\$msi31uninstall_kb893803v2$\reg00057
    c:\windows\$msi31uninstall_kb893803v2$\reg00058
    c:\windows\$msi31uninstall_kb893803v2$\reg00059
    c:\windows\$msi31uninstall_kb893803v2$\reg00060
    c:\windows\$msi31uninstall_kb893803v2$\reg00061
    c:\windows\$msi31uninstall_kb893803v2$\reg00062
    c:\windows\$msi31uninstall_kb893803v2$\reg00063
    c:\windows\$msi31uninstall_kb893803v2$\reg00064
    c:\windows\$msi31uninstall_kb893803v2$\reg00065
    c:\windows\$msi31uninstall_kb893803v2$\reg00066
    c:\windows\$msi31uninstall_kb893803v2$\reg00067
    c:\windows\$msi31uninstall_kb893803v2$\reg00068
    c:\windows\$msi31uninstall_kb893803v2$\reg00069
    c:\windows\$msi31uninstall_kb893803v2$\reg00070
    c:\windows\$msi31uninstall_kb893803v2$\reg00071
    c:\windows\$msi31uninstall_kb893803v2$\reg00072
    c:\windows\$msi31uninstall_kb893803v2$\reg00073
    c:\windows\$msi31uninstall_kb893803v2$\reg00074
    c:\windows\$msi31uninstall_kb893803v2$\reg00075
    c:\windows\$msi31uninstall_kb893803v2$\reg00076
    c:\windows\$msi31uninstall_kb893803v2$\reg00077
    c:\windows\$msi31uninstall_kb893803v2$\reg00078
    c:\windows\$msi31uninstall_kb893803v2$\reg00079
    c:\windows\$msi31uninstall_kb893803v2$\reg00080
    c:\windows\$msi31uninstall_kb893803v2$\reg00081
    c:\windows\$msi31uninstall_kb893803v2$\reg00082
    c:\windows\$msi31uninstall_kb893803v2$\reg00083
    c:\windows\$msi31uninstall_kb893803v2$\reg00084
    c:\windows\$msi31uninstall_kb893803v2$\reg00085
    c:\windows\$msi31uninstall_kb893803v2$\reg00086
    c:\windows\$msi31uninstall_kb893803v2$\reg00087
    c:\windows\$msi31uninstall_kb893803v2$\reg00088
    c:\windows\$msi31uninstall_kb893803v2$\reg00089
    c:\windows\$msi31uninstall_kb893803v2$\reg00090
    c:\windows\$msi31uninstall_kb893803v2$\reg00091
    c:\windows\$msi31uninstall_kb893803v2$\reg00092
    c:\windows\$msi31uninstall_kb893803v2$\reg00093
    c:\windows\$msi31uninstall_kb893803v2$\reg00094
    c:\windows\$msi31uninstall_kb893803v2$\reg00095
    c:\windows\$msi31uninstall_kb893803v2$\reg00096
    c:\windows\$msi31uninstall_kb893803v2$\reg00097
    c:\windows\$msi31uninstall_kb893803v2$\reg00098
    c:\windows\$msi31uninstall_kb893803v2$\reg00099
    c:\windows\$msi31uninstall_kb893803v2$\reg00100
    c:\windows\$msi31uninstall_kb893803v2$\reg00101
    c:\windows\$msi31uninstall_kb893803v2$\reg00102
    c:\windows\$msi31uninstall_kb893803v2$\reg00103
    c:\windows\$msi31uninstall_kb893803v2$\reg00104
    c:\windows\$msi31uninstall_kb893803v2$\reg00105
    c:\windows\$msi31uninstall_kb893803v2$\reg00106
    c:\windows\$msi31uninstall_kb893803v2$\reg00107
    c:\windows\$msi31uninstall_kb893803v2$\reg00108
    c:\windows\$msi31uninstall_kb893803v2$\reg00109
    c:\windows\$msi31uninstall_kb893803v2$\reg00110
    c:\windows\$msi31uninstall_kb893803v2$\reg00111
    c:\windows\$msi31uninstall_kb893803v2$\reg00112
    c:\windows\$msi31uninstall_kb893803v2$\reg00113
    c:\windows\$msi31uninstall_kb893803v2$\reg00114
    c:\windows\$msi31uninstall_kb893803v2$\reg00115
    c:\windows\$msi31uninstall_kb893803v2$\reg00116
    c:\windows\$msi31uninstall_kb893803v2$\spuninst\spuninst.exe
    c:\windows\$msi31uninstall_kb893803v2$\spuninst\spuninst.inf
    c:\windows\$msi31uninstall_kb893803v2$\spuninst\spuninst.txt
    c:\windows\$msi31uninstall_kb893803v2$\spuninst\updspapi.dll
    c:\windows\system32\SET19B.tmp
    c:\windows\system32\SET20.tmp
    c:\windows\system32\SET2D3.tmp
    c:\windows\system32\SET2D4.tmp
    c:\windows\system32\SET2D7.tmp
    c:\windows\system32\SET2D8.tmp
    c:\windows\system32\SET2D9.tmp
    c:\windows\system32\SET2DC.tmp
    c:\windows\system32\SET2DD.tmp
    c:\windows\system32\SET2DE.tmp
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    -------\Legacy_NPF
    .
    .
    ((((((((((((((((((((((((( Files Created from 2014-09-28 to 2014-10-28 )))))))))))))))))))))))))))))))
    .
    .
    2014-10-28 00:15 . 2014-10-20 10:37 8901368 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8820D195-B317-4C7E-B1F9-B2634C4DDD75}\mpengine.dll
    2014-10-27 23:51 . 2014-10-28 00:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
    2014-10-27 23:28 . 2014-10-27 23:37 34808 ----a-w- c:\windows\system32\drivers\TrueSight.sys
    2014-10-27 23:28 . 2014-10-27 23:28 -------- d-----w- c:\documents and settings\All Users\Application Data\RogueKiller
    2014-10-26 23:59 . 2014-10-20 10:37 8901368 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2014-10-26 19:25 . 2014-10-26 19:25 -------- d-----w- c:\documents and settings\pcuser\Application Data\Oracle
    2014-10-26 19:25 . 2014-10-26 19:25 -------- d-----w- c:\program files\Common Files\Java
    2014-10-26 19:25 . 2014-10-26 19:25 -------- d-----w- c:\documents and settings\pcuser\Local Settings\Application Data\Sun
    2014-10-26 19:25 . 2014-10-26 19:24 145408 ----a-w- c:\windows\system32\javacpl.cpl
    2014-10-26 19:25 . 2014-10-26 19:24 96680 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
    2014-10-26 04:58 . 2014-10-26 05:08 -------- d-----w- c:\windows\system32\MRT
    2014-10-26 04:19 . 2014-10-26 04:19 17903792 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
    2014-10-26 04:13 . 2013-07-03 02:12 25088 -c----w- c:\windows\system32\dllcache\hidparse.sys
    2014-10-26 04:10 . 2013-07-17 00:58 123008 -c----w- c:\windows\system32\dllcache\usbvideo.sys
    2014-10-26 04:10 . 2013-07-17 00:58 46848 -c----w- c:\windows\system32\dllcache\irbus.sys
    2014-10-26 04:10 . 2013-07-17 00:58 60160 -c----w- c:\windows\system32\dllcache\usbaudio.sys
    2014-10-26 04:09 . 2013-08-09 00:55 144128 -c----w- c:\windows\system32\dllcache\usbport.sys
    2014-10-26 04:09 . 2013-08-09 00:55 5376 -c----w- c:\windows\system32\dllcache\usbd.sys
    2014-10-26 04:09 . 2009-03-18 11:02 30336 -c----w- c:\windows\system32\dllcache\usbehci.sys
    2014-10-26 03:43 . 2014-10-28 00:33 113880 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2014-10-26 03:43 . 2014-10-27 23:50 54232 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2014-10-26 03:43 . 2014-10-01 18:11 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
    2014-10-26 03:43 . 2014-10-26 03:53 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
    2014-10-26 03:43 . 2014-10-26 03:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2014-10-26 03:37 . 2014-10-26 03:37 -------- d-----w- c:\windows\ERUNT
    2014-10-26 03:29 . 2014-10-26 17:46 -------- d-----w- C:\AdwCleaner
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2014-10-26 19:27 . 2012-04-12 19:35 701104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2014-10-26 19:27 . 2011-12-22 20:08 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2014-09-22 06:41 . 2010-08-04 18:15 231568 ------w- c:\windows\system32\MpSigStub.exe
    2013-07-12 00:20 . 2013-07-12 00:20 0 ----a-w- c:\program files\GUTA6E.tmp
    2013-07-08 07:15 . 2013-07-08 07:15 0 ----a-w- c:\program files\GUT4D2.tmp
    2013-07-06 08:15 . 2013-07-06 08:15 0 ----a-w- c:\program files\GUT120.tmp
    2012-03-29 01:48 . 2012-03-29 01:48 0 ----a-w- c:\program files\GUTA.tmp
    2012-03-28 17:48 . 2012-03-28 17:48 0 ----a-w- c:\program files\GUT79.tmp
    .
    .
    ------- Sigcheck -------
    Note: Unsigned files aren't necessarily malware.
    .
    [-] 2008-04-14 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
    [-] 2008-04-14 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\drivers\atapi.sys
    [-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
    [-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys
    [-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0007\DriverFiles\i386\atapi.sys
    .
    [-] 2008-04-14 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\asyncmac.sys
    [-] 2008-04-14 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\drivers\asyncmac.sys
    [-] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\asyncmac.sys
    .
    [-] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys
    [-] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys
    .
    [-] 2008-04-14 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\kbdclass.sys
    [-] 2008-04-14 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\system32\drivers\kbdclass.sys
    [-] 2004-08-04 . EBDEE8A2EE5393890A1ACEE971C4C246 . 24576 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\kbdclass.sys
    .
    [-] 2008-04-14 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ndis.sys
    [-] 2008-04-14 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ndis.sys
    [-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ndis.sys
    .
    [-] 2008-04-14 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntfs.sys
    [-] 2008-04-14 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ntfs.sys
    [-] 2004-08-04 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ntfs.sys
    .
    [-] 2004-08-04 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys
    [-] 2004-08-04 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys
    .
    [-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\tcpip.sys
    [-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
    [-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
    [-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
    [-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
    [-] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
    [-] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
    [-] 2008-04-14 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
    [-] 2008-04-14 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tcpip.sys
    [-] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB951748_0$\tcpip.sys
    .
    [-] 2012-07-06 . CFD4E51402DA9838B5A04AE680AF54A0 . 78336 . . [5.1.2600.6260] . . c:\windows\system32\browser.dll
    [-] 2012-07-06 . CFD4E51402DA9838B5A04AE680AF54A0 . 78336 . . [5.1.2600.6260] . . c:\windows\system32\dllcache\browser.dll
    [-] 2012-07-06 . FC6D1D80588D371F0321E15A75B2F8F2 . 78336 . . [5.1.2600.6260] . . c:\windows\$hf_mig$\KB2705219\SP3QFE\browser.dll
    [-] 2008-04-14 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB2705219$\browser.dll
    [-] 2008-04-14 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\browser.dll
    [-] 2004-08-04 . E3CFCCDDA4EDD1D0DC9168B2E18F27B8 . 77312 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\browser.dll
    .
    [-] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\lsass.exe
    [-] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\lsass.exe
    [-] 2004-08-04 . 84885F9B82F4D55C6146EBF6065D75D2 . 13312 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\lsass.exe
    .
    [-] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\netman.dll
    [-] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\netman.dll
    [-] 2004-08-04 . DAB9E6C7105D2EF49876FE92C524F565 . 198144 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\netman.dll
    .
    [-] 2008-04-14 12:41 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\ServicePackFiles\i386\comres.dll
    [-] 2008-04-14 12:41 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll
    [-] 2004-08-04 10:00 . 6728270CB7DBB776ED086F5AC4C82310 . 792064 . . [2001.12.4414.258] . . c:\windows\$NtServicePackUninstall$\comres.dll
    .
    [-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\ServicePackFiles\i386\qmgr.dll
    [-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\qmgr.dll
    [-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\bits\qmgr.dll
    [-] 2004-08-04 . 2C69EC7E5A311334D10DD95F338FCCEA . 382464 . . [6.6.2600.2180] . . c:\windows\$NtServicePackUninstall$\qmgr.dll
    .
    [-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\rpcss.dll
    [-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\rpcss.dll
    [-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\rpcss.dll
    [-] 2009-02-09 . 9222562D44021B988B9F9F62207FB6F2 . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll
    [-] 2009-02-09 . 24B5D53B9ACCC1E2EDCF0A878D6659D4 . 401408 . . [5.1.2600.3520] . . c:\windows\$NtServicePackUninstall$\rpcss.dll
    [-] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\rpcss.dll
    [-] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\rpcss.dll
    [-] 2004-08-04 . 5C83A4408604F737717AB96371201680 . 395776 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB956572_0$\rpcss.dll
    .
    [-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\services.exe
    [-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\services.exe
    [-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\services.exe
    [-] 2009-02-06 . 020CEAAEDC8EB655B6506B8C70D53BB6 . 110592 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
    [-] 2009-02-06 . 4712531AB7A01B7EE059853CA17D39BD . 110592 . . [5.1.2600.3520] . . c:\windows\$NtServicePackUninstall$\services.exe
    [-] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\services.exe
    [-] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\services.exe
    [-] 2004-08-04 . C6CE6EEC82F187615D1002BB3BB50ED4 . 108032 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB956572_0$\services.exe
    .
    [-] 2010-08-17 . 258DD5D4283FD9F9A7166BE9AE45CE73 . 58880 . . [5.1.2600.6024] . . c:\windows\$hf_mig$\KB2347290\SP3QFE\spoolsv.exe
    [-] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\spoolsv.exe
    [-] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\dllcache\spoolsv.exe
    [-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB2347290$\spoolsv.exe
    [-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\spoolsv.exe
    [-] 2004-08-04 . 7435B108B935E42EA92CA94F59C8E717 . 57856 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\spoolsv.exe
    .
    [-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\winlogon.exe
    [-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
    [-] 2004-08-04 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\winlogon.exe
    .
    [-] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ipsec.sys
    [-] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
    [-] 2004-08-04 . 64537AA5C003A6AFEEE1DF819062D0D1 . 74752 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ipsec.sys
    .
    [-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll
    [-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll
    [-] 2010-08-23 . 736B12B725AEB2B07F0241A9F680CB10 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
    [-] 2008-04-14 . BD38D1EBE24A46BD3EDA059560AFBA12 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
    [-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\$NtUninstallKB2296011$\comctl32.dll
    [-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\ServicePackFiles\i386\comctl32.dll
    [-] 2004-08-04 . A77DFB85FAEE49D66C74DA6024EBC69B . 611328 . . [5.82] . . c:\windows\$NtServicePackUninstall$\comctl32.dll
    [-] 2004-08-04 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
    [-] 2004-08-04 . 5AF68A5E44734A082442668E9C787743 . 1050624 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
    .
    [-] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\cryptsvc.dll
    [-] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\cryptsvc.dll
    [-] 2004-08-04 . 10654F9DDCEA9C46CFB77554231BE73B . 60416 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\cryptsvc.dll
    .
    [-] 2008-07-07 20:32 . 60D1A6342238378BFB7545C81EE3606C . 253952 . . [2001.12.4414.320] . . c:\windows\$NtServicePackUninstall$\es.dll
    [-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3GDR\es.dll
    [-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\es.dll
    [-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\dllcache\es.dll
    [-] 2008-07-07 20:23 . F17F6226BDC0CD5F0BEF0DAF84D29BEC . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll
    [-] 2008-07-07 20:06 . A4AB3DCA4A383F0DF4988ABDEB84F9A4 . 253952 . . [2001.12.4414.320] . . c:\windows\$hf_mig$\KB950974\SP2QFE\es.dll
    [-] 2008-04-14 12:41 . 19A799805B24990867B00C120D300C3A . 246272 . . [2001.12.4414.701] . . c:\windows\$NtUninstallKB950974$\es.dll
    [-] 2008-04-14 12:41 . 19A799805B24990867B00C120D300C3A . 246272 . . [2001.12.4414.701] . . c:\windows\ServicePackFiles\i386\es.dll
    [-] 2004-08-04 10:00 . ACD36A2DD7D1E9D8A060AA651DC07E63 . 243200 . . [2001.12.4414.258] . . c:\windows\$NtUninstallKB950974_0$\es.dll
    .
    [-] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\imm32.dll
    [-] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\imm32.dll
    [-] 2004-08-04 . 87CA7CE6469577F059297B9D6556D66D . 110080 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\imm32.dll
    .
    [-] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\linkinfo.dll
    [-] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\linkinfo.dll
    [-] 2004-08-04 . C2BBD044C741EA4292016C36F718D2E4 . 18944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\linkinfo.dll
    .
    [-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\lpk.dll
    [-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\lpk.dll
    [-] 2004-08-04 . 74D66B3DE265E8789153414E75175F26 . 22016 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\lpk.dll
    .
    [-] 2008-04-14 . D7075E95AA599EE77B7A89D39296BD3D . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll
    [-] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\ServicePackFiles\i386\msvcrt.dll
    [-] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\msvcrt.dll
    [-] 2004-08-04 . B0FEFA816D61EC66AA765DDF534EAB5E . 343040 . . [7.0.2600.2180] . . c:\windows\$NtServicePackUninstall$\msvcrt.dll
    [-] 2004-08-04 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll
    [-] 2004-08-04 . 98EC447E00229AFD88D5161A25D065DA . 343040 . . [7.0.2600.2180] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll
    .
    [-] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\mswsock.dll
    [-] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\$NtUninstallKB2509553$\mswsock.dll
    [-] 2008-06-20 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\mswsock.dll
    [-] 2008-06-20 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll
    [-] 2008-06-20 . 097722F235A1FB698BF9234E01B52637 . 245248 . . [5.1.2600.3394] . . c:\windows\$NtServicePackUninstall$\mswsock.dll
    [-] 2008-06-20 . 1DFCA7713EA5A70D5D93B436AEA0317A . 245248 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\mswsock.dll
    [-] 2008-06-20 . 943337D786A56729263071623BBB9DE5 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\mswsock.dll
    [-] 2008-06-20 . 943337D786A56729263071623BBB9DE5 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\mswsock.dll
    [-] 2008-04-14 . B4138E99236F0F57D4CF49BAE98A0746 . 245248 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\mswsock.dll
    [-] 2008-04-14 . B4138E99236F0F57D4CF49BAE98A0746 . 245248 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\mswsock.dll
    [-] 2004-08-04 . 4E74AF063C3271FBEA20DD940CFD1184 . 245248 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB951748_0$\mswsock.dll
    .
    [-] 2009-02-06 . 6C476D33D82F1054849790181E8F7772 . 408064 . . [5.1.2600.3520] . . c:\windows\$NtServicePackUninstall$\netlogon.dll
    [-] 2009-02-06 . 6C476D33D82F1054849790181E8F7772 . 408064 . . [5.1.2600.3520] . . c:\windows\$NtUninstallKB975467_0$\netlogon.dll
    [-] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\netlogon.dll
    [-] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\netlogon.dll
    [-] 2004-08-04 . 96353FCECBA774BB8DA74A1C6507015A . 407040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB968389_0$\netlogon.dll
    .
    [-] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\powrprof.dll
    [-] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll
    [-] 2004-08-04 . 1B5F6923ABB450692E9FE0672C897AED . 17408 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\powrprof.dll
    .
    [-] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\scecli.dll
    [-] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\scecli.dll
    [-] 2004-08-04 . 0F78E27F563F2AAF74B91A49E2ABF19A . 180224 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\scecli.dll
    .
    [-] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\sfc.dll
    [-] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\sfc.dll
    [-] 2004-08-04 . E8A12A12EA9088B4327D49EDCA3ADD3E . 5120 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\sfc.dll
    .
    [-] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\svchost.exe
    [-] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\svchost.exe
    [-] 2004-08-04 . 8F078AE4ED187AAABC0A305146DE6716 . 14336 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\svchost.exe
    .
    [-] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tapisrv.dll
    [-] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\tapisrv.dll
    [-] 2004-08-04 . EB4A4187D74A8EFDCBEA3EA2CB1BDFBD . 246272 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\tapisrv.dll
    .
    [-] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\user32.dll
    [-] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
    [-] 2004-08-04 . C72661F8552ACE7C5C85E16A3CF505C4 . 577024 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\user32.dll
    .
    [-] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\userinit.exe
    [-] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe
    [-] 2004-08-04 . 39B1FFB03C2296323832ACBAE50D2AFF . 24576 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\userinit.exe
    .
    [-] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ws2_32.dll
    [-] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll
    [-] 2004-08-04 . 2ED0B7F12A60F90092081C50FA0EC2B2 . 82944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ws2_32.dll
    .
    [-] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ws2help.dll
    [-] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\ws2help.dll
    [-] 2004-08-04 . 9BEACB911CA61E5881102188AB7FB431 . 19968 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ws2help.dll
    .
    [-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\explorer.exe
    [-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
    [-] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\explorer.exe
    .
    [-] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\regedit.exe
    [-] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regedit.exe
    [-] 2004-08-04 . 783AFC80383C176B22DBF8333343992D . 146432 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regedit.exe
    .
    [-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\ServicePackFiles\i386\ksuser.dll
    [-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\ksuser.dll
    [-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\dllcache\ksuser.dll
    .
    [-] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ctfmon.exe
    [-] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
    [-] 2004-08-04 . 24232996A38C0B0CF151C2140AE29FC8 . 15360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ctfmon.exe
    .
    [-] 2009-07-27 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853] . . c:\windows\system32\shsvcs.dll
    [-] 2009-07-27 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853] . . c:\windows\system32\dllcache\shsvcs.dll
    [-] 2009-07-27 . 888CD7B39C37E13A2419BECFAAF0A28C . 135168 . . [6.00.2900.5853] . . c:\windows\$hf_mig$\KB971029\SP3QFE\shsvcs.dll
    [-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\$NtUninstallKB971029$\shsvcs.dll
    [-] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\shsvcs.dll
    [-] 2004-08-04 . E7518DC542D3EBDCB80EDD98462C7821 . 134656 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\shsvcs.dll
    .
    [-] 2008-04-14 . AFFC87E2501FCE8F09D4C10BA6421CCF . 4608 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\msimg32.dll
    [-] 2008-04-14 . AFFC87E2501FCE8F09D4C10BA6421CCF . 4608 . . [5.1.2600.5512] . . c:\windows\system32\msimg32.dll
    [-] 2004-08-04 . B5331F2B6F37C66C29C847F3B94FF900 . 4608 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\msimg32.dll
    .
    [-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\srsvc.dll
    [-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
    [-] 2004-08-04 . 92BDF74F12D6CBEC43C94D4B7F804838 . 170496 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\srsvc.dll
    .
    [-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wscntfy.exe
    [-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe
    [-] 2004-08-04 . 49911DD39E023BB6C45E4E436CFBD297 . 13824 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wscntfy.exe
    .
    [-] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\xmlprov.dll
    [-] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\xmlprov.dll
    [-] 2004-08-04 . EEF46DAB68229A14DA3D8E73C99E2959 . 129536 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\xmlprov.dll
    .
    [-] 2010-12-09 . 15CE4DBC22FAB90B3CA5352AF1FFF81C . 718336 . . [5.1.2600.6055] . . c:\windows\$hf_mig$\KB2393802\SP3QFE\ntdll.dll
    [-] 2010-12-09 . F8F0D25CA553E39DDE485D8FC7FCCE89 . 718336 . . [5.1.2600.6055] . . c:\windows\system32\ntdll.dll
    [-] 2010-12-09 . F8F0D25CA553E39DDE485D8FC7FCCE89 . 718336 . . [5.1.2600.6055] . . c:\windows\system32\dllcache\ntdll.dll
    [-] 2009-02-09 . 911DDF2E16761643A47225F654D811E5 . 714752 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\ntdll.dll
    [-] 2009-02-09 . 911DDF2E16761643A47225F654D811E5 . 714752 . . [5.1.2600.5755] . . c:\windows\$NtUninstallKB2393802$\ntdll.dll
    [-] 2009-02-09 . B0913005EE3FC15D7F72472D0B8A30EB . 715264 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntdll.dll
    [-] 2009-02-09 . 2F868BFFBF50524653D7FE0D99AFB064 . 715264 . . [5.1.2600.3520] . . c:\windows\$NtServicePackUninstall$\ntdll.dll
    [-] 2008-04-14 . 27D9ED8CB8B62D1E0A8E5ACE6CF52E2F . 706048 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\ntdll.dll
    [-] 2008-04-14 . 27D9ED8CB8B62D1E0A8E5ACE6CF52E2F . 706048 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntdll.dll
    [-] 2004-08-04 . BB5CBFFC096497506167BCE1D9690EF2 . 708096 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB956572_0$\ntdll.dll
    .
    [-] 2008-04-14 . 5733177BCF16EE78B99543C9B0AB81EA . 177152 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\msctfime.ime
    [-] 2008-04-14 . 5733177BCF16EE78B99543C9B0AB81EA . 177152 . . [5.1.2600.5512] . . c:\windows\system32\msctfime.ime
    [-] 2004-08-04 . D87041EAA67ECA4394F6D5D09C0C2885 . 177152 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\msctfime.ime
    .
    [-] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\eventlog.dll
    [-] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\eventlog.dll
    [-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\eventlog.dll
    .
    [-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\sfcfiles.dll
    [-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
    [-] 2004-08-04 . 30A609E00BD1D4FFC49D6B5A432BE7F2 . 1580544 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\sfcfiles.dll
    .
    [-] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ipsec.sys
    [-] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
    [-] 2004-08-04 . 64537AA5C003A6AFEEE1DF819062D0D1 . 74752 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ipsec.sys
    .
    [-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regsvc.dll
    [-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\regsvc.dll
    [-] 2004-08-04 . 3151427DB7D87107D1C5BE58FAC53960 . 59904 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regsvc.dll
    .
    [-] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\schedsvc.dll
    [-] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\schedsvc.dll
    [-] 2004-08-04 . 92360854316611F6CC471612213C3D92 . 190976 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\schedsvc.dll
    .
    [-] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ssdpsrv.dll
    [-] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\ssdpsrv.dll
    [-] 2004-08-04 . 4B8D61792F7175BED48859CC18CE4E38 . 71680 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ssdpsrv.dll
    .
    [-] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\termsrv.dll
    [-] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\termsrv.dll
    [-] 2004-08-04 . B60C877D16D9C880B952FDA04ADF16E6 . 295424 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\termsrv.dll
    .
     
    elcajongunsfan,
    #17
  19. 2014/10/27
    elcajongunsfan Lifetime Subscriber

    elcajongunsfan Well-Known Member Thread Starter

    Joined:
    2012/01/01
    Messages:
    377
    Likes Received:
    12
    [-] 2008-04-14 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\hnetcfg.dll
    [-] 2008-04-14 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll
    [-] 2004-08-04 . 765B30C776A1780B46B479FE614F707C . 344064 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\hnetcfg.dll
    .
    [-] 2008-04-14 . D8849F77C0B66226335A59D26CB4EDC6 . 167936 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\appmgmts.dll
    [-] 2008-04-14 . D8849F77C0B66226335A59D26CB4EDC6 . 167936 . . [5.1.2600.5512] . . c:\windows\system32\appmgmts.dll
    [-] 2004-08-04 . 9C3C12975C97119412802B181FBEEFFE . 167936 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\appmgmts.dll
    .
    [-] 2004-08-04 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys
    .
    [-] 2008-04-14 05:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\ServicePackFiles\i386\aec.sys
    [-] 2008-04-14 05:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\dllcache\aec.sys
    [-] 2008-04-14 05:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\drivers\aec.sys
    .
    [-] 2008-04-14 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\agp440.sys
    [-] 2008-04-14 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\system32\drivers\agp440.sys
    .
    [-] 2008-04-14 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ip6fw.sys
    [-] 2008-04-14 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ip6fw.sys
    [-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ip6fw.sys
    .
    [-] 2010-09-18 07:18 . 842900DEDBC8E3E8DBCCCB298FD88F65 . 953856 . . [4.1.6151] . . c:\windows\$hf_mig$\KB2387149\SP3QFE\mfc40u.dll
    [-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\mfc40u.dll
    [-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\dllcache\mfc40u.dll
    [-] 2008-04-14 12:41 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\$NtUninstallKB2387149$\mfc40u.dll
    [-] 2008-04-14 12:41 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\ServicePackFiles\i386\mfc40u.dll
    [-] 2004-08-04 10:00 . DDF8D47ACF8FC3FE5F7F2B95C4D4D136 . 924432 . . [4.1.6140] . . c:\windows\$NtServicePackUninstall$\mfc40u.dll
    .
    [-] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\msgsvc.dll
    [-] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\msgsvc.dll
    [-] 2004-08-04 . 95FD808E4AC22ABA025A7B3EAC0375D2 . 33792 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\msgsvc.dll
    .
    [-] 2008-04-14 12:42 . C7E39EA41233E9F5B86C8DA3A9F1E4A8 . 52224 . . [9.0.1.56] . . c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll
    [-] 2006-10-19 04:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll
    [-] 2006-10-19 04:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\dllcache\mspmsnsv.dll
    [-] 2004-08-04 10:00 . C086483E3DBA8C1C0A687EC8D5B3D4C1 . 52224 . . [9.0.1.56] . . c:\windows\$NtServicePackUninstall$\mspmsnsv.dll
    .
    [7] 2013-07-04 . 4C47B37CF351FFEB1227CED0FF4751D5 . 2070144 . . [5.1.2600.6419] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe
    [7] 2013-07-04 . 4C47B37CF351FFEB1227CED0FF4751D5 . 2070144 . . [5.1.2600.6419] . . c:\windows\SoftwareDistribution\Download\c08b665da8c22012f43cbfaa106605b3\sp3qfe\ntkrnlpa.exe
    [7] 2013-07-04 . 4C47B37CF351FFEB1227CED0FF4751D5 . 2070144 . . [5.1.2600.6419] . . c:\windows\system32\dllcache\ntkrnlpa.exe
    [-] 2013-03-07 . 9EBEDA306E5EABDABCFF8B695FCD4CD6 . 2070016 . . [5.1.2600.6368] . . c:\windows\$hf_mig$\KB2813170\SP3QFE\ntkrnlpa.exe
    [-] 2013-03-07 . 9ED39805DF38061BB031D0F2B20DFB77 . 2028544 . . [5.1.2600.6368] . . c:\windows\system32\ntkrnlpa.exe
    [-] 2013-03-07 . 9C8E896FCF103F943EB3F405A974447D . 2070016 . . [5.1.2600.6368] . . c:\windows\$NtUninstallKB2859537$\ntkrnlpa.exe
    [-] 2013-01-07 . 1251D608DFCE4B6801AD27A59B74985C . 2069760 . . [5.1.2600.6335] . . c:\windows\$hf_mig$\KB2799494\SP3QFE\ntkrnlpa.exe
    [-] 2013-01-07 . 2C9091C3350E369BBB2464AABE2FD7CA . 2027520 . . [5.1.2600.6335] . . c:\windows\$NtUninstallKB2813170$\ntkrnlpa.exe
    [-] 2012-08-21 . B326D5E256D2F32B23E64F49DEBCE31B . 2069632 . . [5.1.2600.6284] . . c:\windows\$hf_mig$\KB2724197\SP3QFE\ntkrnlpa.exe
    [-] 2012-08-21 . 61027EE2D9859A2B41D588D92F256CFB . 2027520 . . [5.1.2600.6284] . . c:\windows\$NtUninstallKB2799494$\ntkrnlpa.exe
    [-] 2012-05-04 . 8E99A0CE02C1BEDA6C0935A4DDE9CEAA . 2069120 . . [5.1.2600.6223] . . c:\windows\$hf_mig$\KB2707511\SP3QFE\ntkrnlpa.exe
    [-] 2012-05-04 . 87763BB6C95901818050E52C378C9E15 . 2026496 . . [5.1.2600.6223] . . c:\windows\$NtUninstallKB2724197$\ntkrnlpa.exe
    [-] 2012-04-11 . 063A0F8A90D8E2B802E5243FE9AABCF3 . 2069120 . . [5.1.2600.6206] . . c:\windows\$hf_mig$\KB2676562\SP3QFE\ntkrnlpa.exe
    [-] 2012-04-11 . 61CCE48F7BD00E0E4D5CDE206F2DDC1B . 2026496 . . [5.1.2600.6206] . . c:\windows\$NtUninstallKB2707511$\ntkrnlpa.exe
    [-] 2011-10-25 . DB19FFF0C805664CB95062C027B11FE9 . 2069376 . . [5.1.2600.6165] . . c:\windows\$hf_mig$\KB2633171\SP3QFE\ntkrnlpa.exe
    [-] 2011-10-25 . 36CAC3C8C4C10F4E21BFEABBFE7ACFFC . 2027008 . . [5.1.2600.6165] . . c:\windows\$NtUninstallKB2676562$\ntkrnlpa.exe
    [-] 2010-12-10 . F67CD97282E0ABFAF91A9A1359B16F2D . 2069376 . . [5.1.2600.6055] . . c:\windows\$hf_mig$\KB2393802\SP3QFE\ntkrnlpa.exe
    [-] 2010-12-09 . 9ED77E2307F6EC6F174C063C15AA3B8C . 2027008 . . [5.1.2600.6055] . . c:\windows\$NtUninstallKB2633171$\ntkrnlpa.exe
    [-] 2010-04-28 . 756362706DE8BC92F11E197C98A73844 . 2066944 . . [5.1.2600.5973] . . c:\windows\$hf_mig$\KB981852\SP3QFE\ntkrnlpa.exe
    [-] 2010-04-27 . 49E936E1398D1A536E84CD5D068F0F09 . 2024448 . . [5.1.2600.5973] . . c:\windows\$NtUninstallKB2393802$\ntkrnlpa.exe
    [-] 2010-02-16 . 115964D2E8323D9DE4FF5B74795AA0D5 . 2021888 . . [5.1.2600.3670] . . c:\windows\$NtServicePackUninstall$\ntkrnlpa.exe
    [-] 2010-02-16 . A046C627EC20456E2959B7BD628E1FD0 . 2066816 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3GDR\ntkrnlpa.exe
    [-] 2010-02-16 . E8B8801DE921912EBDEEFC76662F7EAD . 2024448 . . [5.1.2600.5938] . . c:\windows\$NtUninstallKB981852$\ntkrnlpa.exe
    [-] 2010-02-16 . DED8B5A89B085284634502E9D75AC78C . 2066944 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntkrnlpa.exe
    [-] 2009-02-08 . 5BA7F2141BC6DB06100D0E5A732C617A . 2066048 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\ntkrnlpa.exe
    [-] 2009-02-06 . 65D4220799E6FC2CB079070A6393CC0E . 2023936 . . [5.1.2600.5755] . . c:\windows\$NtUninstallKB979683$\ntkrnlpa.exe
    [-] 2009-02-06 . 607352B9CB3D708C67F6039097801B5A . 2066176 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
    [-] 2009-02-06 . 243223E3FB74B68DFFBB41989F33DFB3 . 2020864 . . [5.1.2600.3520] . . c:\windows\$NtUninstallKB979683_0$\ntkrnlpa.exe
    [-] 2008-04-14 . 7F653A89F6E89E3AE0D49830EECE35D4 . 2023936 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe
    [-] 2008-04-14 . 109F8E3E3C82E337BB71B6BC9B895D61 . 2065792 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntkrnlpa.exe
    [-] 2005-03-30 . 02FE8020C3A758FE2A8C45CBF4FD17CB . 2015232 . . [5.1.2600.2643] . . c:\windows\$NtUninstallKB956572_0$\ntkrnlpa.exe
    .
    [-] 2008-04-14 12:42 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\ServicePackFiles\i386\ntmssvc.dll
    [-] 2008-04-14 12:42 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\ntmssvc.dll
    [-] 2004-08-04 10:00 . B62F29C00AC55A761B2E45877D85EA0F . 435200 . . [5.1.2400.2180] . . c:\windows\$NtServicePackUninstall$\ntmssvc.dll
    .
    [-] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\upnphost.dll
    [-] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\upnphost.dll
    [-] 2004-08-04 . 0546477BDE979E33294FE97F6B3DE84A . 185344 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\upnphost.dll
    .
    [-] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\ServicePackFiles\i386\dsound.dll
    [-] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dsound.dll
    [-] 2004-08-04 . 55E148C01296696588EAFA425782C3E8 . 367616 . . [5.3.2600.2180] . . c:\windows\$NtServicePackUninstall$\dsound.dll
    .
    [-] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\ServicePackFiles\i386\d3d9.dll
    [-] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\d3d9.dll
    [-] 2004-08-04 . D67BDBBDA86CC9AEEBBAF3217C1717D8 . 1689088 . . [5.03.2600.2180] . . c:\windows\$NtServicePackUninstall$\d3d9.dll
    .
    [-] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\ServicePackFiles\i386\ddraw.dll
    [-] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\ddraw.dll
    [-] 2004-08-04 . 7ED462F353B3D915A418A689FA881F96 . 266240 . . [5.03.2600.2180] . . c:\windows\$NtServicePackUninstall$\ddraw.dll
    .
    [-] 2008-04-14 12:42 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\olepro32.dll
    [-] 2008-04-14 12:42 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\olepro32.dll
    [-] 2004-08-04 10:00 . B48D3193DD1474DCBCC32BF4779AC698 . 83456 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\olepro32.dll
    .
    [-] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\perfctrs.dll
    [-] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\perfctrs.dll
    [-] 2004-08-04 . 96492C721C6EA517E2BFD5381FEF55E3 . 39936 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\perfctrs.dll
    .
    [-] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\version.dll
    [-] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\version.dll
    [-] 2004-08-04 . D38408967BE738D0C1B47005BCE8CEEB . 18944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\version.dll
    .
    [7] 2013-07-04 . A4A50A53FFBFEC545CDA85E98AF2106B . 2193536 . . [5.1.2600.6419] . . c:\windows\Driver Cache\i386\ntoskrnl.exe
    [7] 2013-07-04 . A4A50A53FFBFEC545CDA85E98AF2106B . 2193536 . . [5.1.2600.6419] . . c:\windows\SoftwareDistribution\Download\c08b665da8c22012f43cbfaa106605b3\sp3qfe\ntoskrnl.exe
    [7] 2013-07-04 . A4A50A53FFBFEC545CDA85E98AF2106B . 2193536 . . [5.1.2600.6419] . . c:\windows\system32\dllcache\ntoskrnl.exe
    [-] 2013-03-07 . 8C39722F8C291F1BBCCE80EE23065897 . 2149888 . . [5.1.2600.6368] . . c:\windows\system32\ntoskrnl.exe
    [-] 2013-03-07 . 9FC16E5EBFE88F3C844FFE2E6CB7F1E8 . 2193536 . . [5.1.2600.6368] . . c:\windows\$hf_mig$\KB2813170\SP3QFE\ntoskrnl.exe
    [-] 2013-03-07 . 3FD65320312C8411B72E33DA8661D36A . 2193408 . . [5.1.2600.6368] . . c:\windows\$NtUninstallKB2859537$\ntoskrnl.exe
    [-] 2013-01-07 . AE2FEE63789F5DF6B19DD9A39E26D03E . 2193152 . . [5.1.2600.6335] . . c:\windows\$hf_mig$\KB2799494\SP3QFE\ntoskrnl.exe
    [-] 2013-01-07 . DD5A89274B47499CCFF7ADCA3A3C560E . 2148864 . . [5.1.2600.6335] . . c:\windows\$NtUninstallKB2813170$\ntoskrnl.exe
    [-] 2012-08-21 . ECA5980E1A78DBF9CB7F49F76791C0D1 . 2193024 . . [5.1.2600.6284] . . c:\windows\$hf_mig$\KB2724197\SP3QFE\ntoskrnl.exe
    [-] 2012-08-21 . B9A14D5875CE262774388BD43BA56FF3 . 2148864 . . [5.1.2600.6284] . . c:\windows\$NtUninstallKB2799494$\ntoskrnl.exe
    [-] 2012-05-04 . 099A0F80A563EBE935F4A9750F96C219 . 2192640 . . [5.1.2600.6223] . . c:\windows\$hf_mig$\KB2707511\SP3QFE\ntoskrnl.exe
    [-] 2012-05-04 . AC4B3C4A6DC31867034C66663B9B8A38 . 2148352 . . [5.1.2600.6223] . . c:\windows\$NtUninstallKB2724197$\ntoskrnl.exe
    [-] 2012-04-11 . 8D061BB825BC606C2B1C6F7452D1BAAA . 2192640 . . [5.1.2600.6206] . . c:\windows\$hf_mig$\KB2676562\SP3QFE\ntoskrnl.exe
    [-] 2012-04-11 . A144D60B35E6DD14CCB9649B5E0D1092 . 2148352 . . [5.1.2600.6206] . . c:\windows\$NtUninstallKB2707511$\ntoskrnl.exe
    [-] 2011-10-25 . 3B663B9B193D7E1DE39A466020F1FD91 . 2148864 . . [5.1.2600.6165] . . c:\windows\$NtUninstallKB2676562$\ntoskrnl.exe
    [-] 2011-10-25 . F512C662874D7545E5BD8005E6800A44 . 2192768 . . [5.1.2600.6165] . . c:\windows\$hf_mig$\KB2633171\SP3QFE\ntoskrnl.exe
    [-] 2010-12-09 . A531BBD3DE13121C1380ED7DC99082DB . 2192768 . . [5.1.2600.6055] . . c:\windows\$hf_mig$\KB2393802\SP3QFE\ntoskrnl.exe
    [-] 2010-12-09 . 60E16152D847D7A7B7D3DA4C4B8E2120 . 2148864 . . [5.1.2600.6055] . . c:\windows\$NtUninstallKB2633171$\ntoskrnl.exe
    [-] 2010-04-27 . 466A3E1239F4A9428797730E81A7A865 . 2146304 . . [5.1.2600.5973] . . c:\windows\$NtUninstallKB2393802$\ntoskrnl.exe
    [-] 2010-04-27 . A2ABBEC40CDB57454645D06B7EBD22F5 . 2190080 . . [5.1.2600.5973] . . c:\windows\$hf_mig$\KB981852\SP3QFE\ntoskrnl.exe
    [-] 2010-02-17 . D41C3CBAD0E1C0728D1CDFD541F60CFA . 2189952 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3GDR\ntoskrnl.exe
    [-] 2010-02-16 . 4F1BBAF9BA10B29022FB3F5FAC32D022 . 2143744 . . [5.1.2600.3670] . . c:\windows\$NtServicePackUninstall$\ntoskrnl.exe
    [-] 2010-02-16 . 048DB3459FAB4CA741DCC84E1F374D65 . 2146304 . . [5.1.2600.5938] . . c:\windows\$NtUninstallKB981852$\ntoskrnl.exe
    [-] 2010-02-16 . E1F653A542449D54FA2D27463D99B6B6 . 2190080 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntoskrnl.exe
    [-] 2009-02-08 . EFE8EACE83EAAD5849A7A548FB75B584 . 2189184 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
    [-] 2009-02-06 . 7A95B10A73737EBF24139AAA63F5212B . 2189056 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\ntoskrnl.exe
    [-] 2009-02-06 . 0CBA44D0938D57F334C0862424148B70 . 2145280 . . [5.1.2600.5755] . . c:\windows\$NtUninstallKB979683$\ntoskrnl.exe
    [-] 2009-02-06 . 19A791C5DFE59AA9BB1461C4957004F6 . 2142720 . . [5.1.2600.3520] . . c:\windows\$NtUninstallKB979683_0$\ntoskrnl.exe
    [-] 2008-04-14 . 0C89243C7C3EE199B96FCC16990E0679 . 2188928 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntoskrnl.exe
    [-] 2008-04-14 . 40F8880122A030A7E9E1FEDEA833B33D . 2145280 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\ntoskrnl.exe
    [-] 2005-03-30 . D5B44CEB743886F36222928CE2536C44 . 2135552 . . [5.1.2600.2643] . . c:\windows\$NtUninstallKB956572_0$\ntoskrnl.exe
    .
    [-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\srsvc.dll
    [-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
    [-] 2004-08-04 . 92BDF74F12D6CBEC43C94D4B7F804838 . 170496 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\srsvc.dll
    .
    [-] 2008-04-14 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\w32time.dll
    [-] 2008-04-14 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\system32\w32time.dll
    [-] 2004-08-04 . 2B281958F5D0CF99ED626E3EF39D5C8D . 174592 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\w32time.dll
    .
    [-] 2008-04-14 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wiaservc.dll
    [-] 2008-04-14 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\system32\wiaservc.dll
    [-] 2004-08-04 . D9F6C4F6B1E188ADAFC42B561D9BC2E6 . 333312 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wiaservc.dll
    .
    [-] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\midimap.dll
    [-] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\midimap.dll
    [-] 2004-08-04 . 3B4702155BB2AE9DC00C06A68834BDFA . 18944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\midimap.dll
    .
    [-] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\rasadhlp.dll
    [-] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\rasadhlp.dll
    [-] 2004-08-04 . 4CAEC028C1E21C75E17877D4522D3DB4 . 8192 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\rasadhlp.dll
    .
    [-] 2008-04-14 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wshtcpip.dll
    [-] 2008-04-14 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\system32\wshtcpip.dll
    [-] 2004-08-04 . A7F95A53EE055115DF03588997A47D4D . 19968 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wshtcpip.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray "= "c:\windows\system32\igfxtray.exe" [2008-05-30 150040]
    "HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2008-05-30 170520]
    "SoundMAXPnP "= "c:\program files\Analog Devices\Core\smax4pnp.exe" [2009-08-03 1044480]
    "JobHisInit "= "c:\program files\RMClient\JobHisInit.exe" [2003-05-30 135168]
    "MplSetUp "= "c:\program files\RMClient\MplSetUp.exe" [2000-11-05 40960]
    "MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]
    "BCSSync "= "c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
    "SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2014-09-27 271744]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "DWQueuedReporting "= "c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2013-03-06 520424]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "SpUninstallDeleteDir "= "rmdir" [X]
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5} "= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @= "Service "
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
    2013-04-04 21:06 958576 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
    2012-11-05 22:27 89184 ----a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeSyncProcess]
    2013-04-22 17:05 720064 ----a-w- c:\program files\Microsoft Office\Office14\MSOSYNC.EXE
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
    2008-05-30 02:00 141848 ----a-w- c:\windows\system32\igfxpers.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2013-07-31 17:22 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
    2009-01-26 22:31 2144088 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "ERSvc "=2 (0x2)
    "gupdate "=2 (0x2)
    "helpsvc "=2 (0x2)
    "PolicyAgent "=2 (0x2)
    "RemoteRegistry "=2 (0x2)
    "seclogon "=2 (0x2)
    "WebClient "=2 (0x2)
    "Util BatBrowse "=2 (0x2)
    "Update BatBrowse "=2 (0x2)
    "sdCoreService "=2 (0x2)
    "sdAuxService "=2 (0x2)
    "PCTechHotlineSvc "=2 (0x2)
    "CltMngSvc "=2 (0x2)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride "=dword:00000001
    "FirewallOverride "=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\Google\\Chrome\\Application\\chrome.exe "=
    .
    S1 MpKsl61a277c0;MpKsl61a277c0;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8820D195-B317-4C7E-B1F9-B2634C4DDD75}\MpKsl61a277c0.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8820D195-B317-4C7E-B1F9-B2634C4DDD75}\MpKsl61a277c0.sys [?]
    S3 SIUSBXP;SIUSBXP;c:\windows\system32\drivers\SiUSBXp.sys [8/1/2012 7:24 PM 21992]
    .
    --- Other Services/Drivers In Memory ---
    .
    *Deregistered* - mbamchameleon
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    HPService REG_MULTI_SZ HPSLPSVC
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2014-10-26 07:40 1089352 ----a-w- c:\program files\Google\Chrome\Application\38.0.2125.104\Installer\chrmstp.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2014-10-28 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 19:27]
    .
    2014-10-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2013-11-10 05:21]
    .
    2014-10-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2013-11-10 05:21]
    .
    2014-10-28 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
    - c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-01-27 19:11]
    .
    2014-10-27 c:\windows\Tasks\User_Feed_Synchronization-{CC932386-5783-4C63-AF1C-7A83ACC779E0}.job
    - c:\windows\system32\msfeedssync.exe [2009-03-08 11:31]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com
    mStart Page = hxxp://www.google.com
    uInternet Settings,ProxyServer = http=127.0.0.1:13091;
    uInternet Settings,ProxyOverride = <-loopback>
    Trusted Zone: candy%20crush%20saga.com
    Trusted Zone: facebook.com\apps
    TCP: DhcpNameServer = 192.168.1.1 68.105.28.12 68.105.29.12
    FF - ProfilePath - c:\documents and settings\pcuser\Application Data\Mozilla\Firefox\Profiles\9mic4unz.default\
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-Locked - (no file)
    MSConfigStartUp-Advanced System Protector_startup - c:\program files\Advanced System Protector\AdvancedSystemProtector.exe
    MSConfigStartUp-OpenSoftwareUpdater - c:\program files\OpenSoftwareUpdater\OpenSoftwareUpdater.exe
    MSConfigStartUp-PC Health Kit - c:\program files\PC Health Kit\PCHKLauncher.exe
    MSConfigStartUp-PCFixSpeed - c:\program files\PCFixSpeed\PCFixTray.exe
    MSConfigStartUp-PCTechHotline - c:\program files\PCTechHotline\PCTechHotline.exe
    MSConfigStartUp-SDP - c:\documents and settings\pcuser\Local Settings\Application Data\FilesFrog Update Checker\update_checker.exe
    MSConfigStartUp-Weather - c:\program files\AWS\WeatherBug\Weather.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2014-10-27 18:13
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Jsip]
    "ImagePath "= "c:\program files\Jsip\Jsip.exe -service "
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
    @Denied: (A 2) (Everyone)
    @= "FlashBroker "
    "LocalizedString "= "@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101 "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
    "Enabled "=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
    @= "c:\\windows\\system32\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
    @Denied: (A 2) (Everyone)
    @= "IFlashBroker6 "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
    @= "{00020424-0000-0000-C000-000000000046} "
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
    "Version "= "1.0 "
    .
    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Jsip]
    @Denied: (A B 2 3) (Everyone)
    "Type "=dword:00000010
    "Start "=dword:00000002
    "ErrorControl "=dword:00000001
    "ImagePath "=expand: "c:\\Program Files\\Jsip\\Jsip.exe -service "
    "DisplayName "= "Jsip "
    "ObjectName "= "LocalSystem "
    "Description "= "This Jsip service is page assistant in all browsers. "
    "FailureActions "=hex:01,00,00,00,00,00,00,00,00,00,00,00,03,00,00,00,74,00,6d,
    00,01,00,00,00,64,00,00,00,01,00,00,00,64,00,00,00,01,00,00,00,64,00,00,00
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'explorer.exe'(1748)
    c:\windows\system32\WININET.dll
    c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
    c:\progra~1\MICROS~3\Office14\1033\GrooveIntlResource.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Microsoft Security Client\MsMpEng.exe
    c:\program files\Java\jre7\bin\jqs.exe
    c:\program files\CDBurnerXP\NMSAccessU.exe
    .
    **************************************************************************
    .
    Completion time: 2014-10-27 18:19:13 - machine was rebooted
    ComboFix-quarantined-files.txt 2014-10-28 01:19
    .
    Pre-Run: 46,259,167,232 bytes free
    Post-Run: 47,398,998,016 bytes free
    .
    - - End Of File - - 84B8983AF98F88F21968AE9C61D8BA15
    8F558EB6672622401DA993E1E865C861
     
    elcajongunsfan,
    #18
  20. 2014/10/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Looks good.

    It must be something wrong with boot.ini file.

    Download BootCheck.exe to your desktop.
    Unzip downloaded file.

    • Double click BootCheck.exe to run the check
    • When complete, a Notepad window will open with some text in it
    • Save the Notepad file to your desktop as BootCheck.txt
    • Copy the contents of BootCheck.txt and post it in your next reply
     
    broni,
    #19
  21. 2014/10/27
    elcajongunsfan Lifetime Subscriber

    elcajongunsfan Well-Known Member Thread Starter

    Joined:
    2012/01/01
    Messages:
    377
    Likes Received:
    12
    I tried to look at the boot.ini in system properties at the beginning of this clean but got the error that "c:\docs and settings\pcuser\notepad.exe is a not a valid win32 application ". This boot check threw the same error.
     
    elcajongunsfan,
    #20
Page 1 of 3

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...