Author Topic: Root kit or virus? (Read 35362 times)

Brian Bunney · « **Reply #15 on:** May 07, 2013, 05:08:23 PM »

< MD5 for: EXPLORER.EXE >
[2011/02/26 00:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/25 23:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 19:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/25 23:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009/10/30 23:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/25 23:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 00:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011/02/25 00:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 00:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 06:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009/08/03 00:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/24 23:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011/02/24 23:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009/10/31 00:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009/08/02 23:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 07:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009/10/31 00:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009/08/02 23:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/13 19:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009/10/31 00:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011/02/26 00:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009/08/03 00:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe

< MD5 for: SERVICES >
[2011/09/05 15:02:36 | 002,196,933 | ---- | M] () MD5=ADF611E9C0517EBCCD6EBA2E8B7FB5D3 -- C:\Program Files\Wireshark\services
[2009/06/10 15:00:26 | 000,017,463 | ---- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 -- C:\Windows\winsxs\amd64_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_6079f415110c0210\services

< MD5 for: SERVICES.BMP >
[2011/11/10 13:16:38 | 000,005,030 | ---- | M] () MD5=FDBB222415C2E2A4129C60B3133C2E0E -- C:\ProgramData\Intuit\Quicken\Hpbiz\services.bmp
[2011/11/10 13:16:38 | 000,005,030 | ---- | M] () MD5=FDBB222415C2E2A4129C60B3133C2E0E -- C:\Users\All Users\Intuit\Quicken\Hpbiz\services.bmp

< MD5 for: SERVICES.CFG >
[2012/12/18 08:28:18 | 000,558,791 | ---- | M] () MD5=A9983CC532F9B3FB1E87918D2313731D -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Services\Services.cfg
[2011/06/06 12:55:30 | 000,584,045 | R--- | M] () MD5=B82DD53FA8C260DDD7FDC42182DB816E -- C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\services.cfg

< MD5 for: SERVICES.EXE >
[2009/07/13 19:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\SysNative\services.exe
[2009/07/13 19:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2009/07/13 20:25:40 | 000,017,408 | ---- | M] (Microsoft Corporation) MD5=6507BF0DC2D1F5F32493C288EAA59277 -- C:\Windows\SysNative\en-US\services.exe.mui
[2009/07/13 20:25:40 | 000,017,408 | ---- | M] (Microsoft Corporation) MD5=6507BF0DC2D1F5F32493C288EAA59277 -- C:\Windows\winsxs\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c5f238be3fa63468\services.exe.mui

< MD5 for: SERVICES.HTML >
[2008/04/16 10:29:04 | 000,004,166 | ---- | M] () MD5=DB0CABD236311DDEB186C9B8A13F39A6 -- C:\Program Files (x86)\BillP Studios\WinPatrol\services.html

< MD5 for: SERVICES.JS >
[2011/06/13 14:29:02 | 000,018,691 | ---- | M] () MD5=A29A268BD513B6BC07270653DD48774C -- C:\Program Files (x86)\Barnes & Noble\BNDesktopReader\HTML\js\services.js

< MD5 for: SERVICES.LNK >
[2009/07/13 22:54:05 | 000,001,288 | ---- | M] () MD5=CA0D9F4743DFF86EBAF09D763139E958 -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009/07/13 22:54:05 | 000,001,288 | ---- | M] () MD5=CA0D9F4743DFF86EBAF09D763139E958 -- C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk

< MD5 for: SERVICES.LOG >
[2011/03/24 15:36:27 | 000,062,844 | ---- | M] () MD5=9EE7489FA9524246825454F7B546B69B -- C:\ProgramData\HP\Installer\Temp\services.log
[2011/03/24 15:36:27 | 000,062,844 | ---- | M] () MD5=9EE7489FA9524246825454F7B546B69B -- C:\Users\All Users\HP\Installer\Temp\services.log

< MD5 for: SERVICES.MOF >
[2009/06/10 14:44:06 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\SysNative\wbem\services.mof
[2009/06/10 14:44:06 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.mof

< MD5 for: SERVICES.MSC >
[2009/07/13 20:23:30 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\SysNative\en-US\services.msc
[2009/06/10 14:38:36 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\SysNative\services.msc
[2009/07/13 20:08:50 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\SysWOW64\en-US\services.msc
[2009/06/10 15:21:09 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\SysWOW64\services.msc
[2009/07/13 20:23:30 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\amd64_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_003408aa160fce5b\services.msc
[2009/06/10 14:38:36 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_2b58d44b5f6beb8a\services.msc
[2009/07/13 20:08:50 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a4156d265db25d25\services.msc
[2009/06/10 15:21:09 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_cf3a38c7a70e7a54\services.msc

Brian Bunney · « **Reply #16 on:** May 07, 2013, 05:08:55 PM »

< MD5 for: SERVICES.PTXML >
[2009/07/13 14:16:17 | 000,001,061 | ---- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 -- C:\Windows\SysNative\wdi\perftrack\Services.ptxml
[2009/07/13 14:16:17 | 000,001,061 | ---- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\Services.ptxml

< MD5 for: SVCHOST.EXE >
[2009/07/13 19:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\SysWOW64\svchost.exe
[2009/07/13 19:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2009/07/13 19:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\SysNative\svchost.exe
[2009/07/13 19:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 06:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010/11/20 06:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 19:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/13 19:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 07:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010/11/20 07:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/20 07:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010/11/20 07:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/13 19:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009/10/28 01:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009/10/28 00:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

========== Alternate Data Streams ==========

@Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:3440EB47
@Alternate Data Stream - 194 bytes -> C:\ProgramData\TEMP:01C66DD9
@Alternate Data Stream - 186 bytes -> C:\ProgramData\TEMP:FD9CE1F3
@Alternate Data Stream - 178 bytes -> C:\ProgramData\TEMP:527B6DAD
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:66633281
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:0888F409

< End of report >

Brian Bunney · « **Reply #17 on:** May 07, 2013, 05:10:47 PM »

OTL Extras logfile created on: 07/05/2013 7:57:12 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\bunnb1\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

7.99 Gb Total Physical Memory | 5.59 Gb Available Physical Memory | 69.91% Memory free
15.98 Gb Paging File | 13.29 Gb Available in Paging File | 83.15% Paging File free
Paging file location(s): d:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 107.03 Gb Total Space | 21.23 Gb Free Space | 19.84% Space Free | Partition Type: NTFS
Drive D: | 596.17 Gb Total Space | 75.76 Gb Free Space | 12.71% Space Free | Partition Type: NTFS
Drive E: | 931.50 Gb Total Space | 216.83 Gb Free Space | 23.28% Space Free | Partition Type: NTFS
Drive K: | 100.00 Mb Total Space | 70.11 Mb Free Space | 70.12% Space Free | Partition Type: NTFS

Computer Name: BUNNB1-I5 | User Name: bunnb1 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

Brian Bunney · « **Reply #18 on:** May 07, 2013, 05:11:32 PM »

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [Digital Photo Professional] -- C:\Program Files (x86)\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [Digital Photo Professional] -- C:\Program Files (x86)\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

Brian Bunney · « **Reply #19 on:** May 07, 2013, 05:12:20 PM »

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()
"C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()
"C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()

Brian Bunney · « **Reply #20 on:** May 07, 2013, 05:13:01 PM »

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0B6944C7-90EE-4207-B26A-0C67CA40BDD2}" = lport=16107 | protocol=6 | dir=in | app=c:\program files\avast software\avast\avastsvc.exe |
"{22D88253-88CD-4EE1-8AE8-62C9CFE8932F}" = lport=139 | protocol=6 | dir=in | app=system |
"{30825051-AD7E-4C41-A639-D01D9F0C03C2}" = rport=445 | protocol=6 | dir=out | app=system |
"{3597EA80-66A9-4990-81C6-20F4A6D15869}" = lport=138 | protocol=17 | dir=in | app=system |
"{3A5B3256-5347-4AD8-8DCD-637AE7EE3EAE}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{3D746CF0-7A9E-4083-B0CC-C6BEB1C180C5}" = rport=139 | protocol=6 | dir=out | app=system |
"{4684A23F-CD97-45FD-9492-EBDA1CDE4E9F}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{47542D1B-1059-4452-9F30-F468AB78B392}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4B65F4BA-4E7D-4C0A-8BA3-E2D7E930910F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{51C9E0FB-ED6C-4D44-BB6E-ADBD0E0F62DC}" = rport=137 | protocol=17 | dir=out | app=system |
"{5B17C982-7866-4D4A-A182-348575AD8FDA}" = lport=16107 | protocol=6 | dir=in | app=c:\program files\avast software\avast\avastsvc.exe |
"{5F07ADB6-2DAB-4E84-94DC-2B0B7F5AC901}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{70DD51BA-CE42-4F6E-99DA-3090B40F5BE5}" = lport=445 | protocol=6 | dir=in | app=system |
"{719F0DBD-60F5-4569-81C0-3FCA7BEE6D2C}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7625F4B6-AF11-4CD1-8D79-92ED90DA0561}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{79C56414-969E-4E78-9358-C5BF4070CB7E}" = lport=10243 | protocol=6 | dir=in | app=system |
"{842523C4-827C-432F-BA6C-CAF4ED2C75D9}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{852ECB93-B636-4B65-8E7D-86B063B18DB3}" = rport=427 | protocol=17 | dir=in | svc=hpslpsvc | app=c:\windows\system32\svchost.exe |
"{AA567424-6421-47BF-93AF-3F039FAE417C}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BBE0F1AF-3F1D-4A10-BBE2-3EA76DBD71BC}" = rport=10243 | protocol=6 | dir=out | app=system |
"{BD466957-C930-48C5-A6C6-2FB1B51C4A28}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BFD88183-90A0-4EA3-9DF7-8E53410CC8F6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{C2D92C89-FF6B-439B-8CAE-F11E4035B1BC}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{C3472271-B248-40C1-B887-756B1761D93E}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C8ECFAAC-88E3-41BB-8E68-352210358A66}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office 15\root\office15\outlook.exe |
"{D195BE7F-C149-43F3-9E1E-44E8EFE8B5CF}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DF448DAA-48F2-4ED9-A511-F7879788B27A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DF837E31-15A5-43BC-AEBD-1DF42622E79B}" = rport=138 | protocol=17 | dir=out | app=system |
"{E0F4933A-92F1-4450-9FD8-2326C7E2DB0C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{EDB17735-39AD-4C1F-8707-A928C4C326EC}" = lport=137 | protocol=17 | dir=in | app=system |
"{F40CDCEF-B3F5-410D-A378-24D4E83D17B9}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |

Brian Bunney · « **Reply #21 on:** May 07, 2013, 05:15:41 PM »

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{036FCF1A-824A-4043-BF6B-C4BFD0235580}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqkygrp.exe |
"{03A6DE63-DEB1-42F9-9CCF-151479E41220}" = protocol=17 | dir=in | app=c:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe |
"{04293DE3-8D56-4AE1-965E-1789789EFFA3}" = protocol=17 | dir=in | app=c:\users\bunnb1\appdata\roaming\dropbox\bin\dropbox.exe |
"{04B8779F-B317-4F26-B529-32B6984783E5}" = protocol=17 | dir=in | app=c:\program files (x86)\acertant\tuneranger\tunerangerhelper.exe |
"{0936DD58-293B-4B21-968F-4F789A8707FE}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{126D8AE5-EC9F-4A29-90B8-BF2EBF0B125F}" = protocol=17 | dir=in | app=c:\users\bunnb1\appdata\local\microsoft\skydrive\skydrive.exe |
"{13DFF7CA-B188-4865-AE2A-376D5D821E20}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{14CE8709-C884-4F52-B977-E4CB0EECB0D8}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposfx08.exe |
"{18E1EA67-2668-4C09-A583-27BB19033EEC}" = protocol=6 | dir=out | app=c:\program files\avast software\avast\avastsvc.exe |
"{194BE41D-28FD-4E9C-AB27-A90A24597F54}" = protocol=6 | dir=in | app=c:\program files (x86)\supersync\supersync.exe |
"{1E62F2D9-3892-4948-9C71-6C6DDA81FDB4}" = protocol=6 | dir=in | app=c:\users\bunnb1\appdata\roaming\dropbox\bin\dropbox.exe |
"{2D70D523-71F1-4CBD-A587-503CC054C306}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{2DCAC1AB-7FEE-4869-A98A-A9B32CDA0BE6}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{2E7FAB10-1DDE-4261-AD21-330C33DC3417}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqcopy2.exe |
"{30A59886-7646-414B-AD11-32BEF343A29F}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{3795B04D-7FF3-411D-8C5C-8FF21842BB40}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{37AA67A3-9E7E-422F-AA18-4692AD137C97}" = protocol=6 | dir=in | app=c:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe |
"{37FB0993-4228-4D15-827B-B11A4EA43C1C}" = protocol=17 | dir=in | app=c:\program files (x86)\nuance\nuance cloud connector\wosvsssvr2003.exe |
"{3942817C-8698-4C48-989E-CE1C64C1C539}" = protocol=6 | dir=in | app=c:\program files (x86)\nuance\nuance cloud connector\wosvsssvr2003.exe |
"{3EFFDAFE-DA6E-430D-99F4-535FC98295ED}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{431DC82B-908A-4263-A2C9-D389C63ECA7C}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqfxt08.exe |
"{4323B05E-E21A-468A-B023-B15A52887D90}" = dir=in | app=c:\program files (x86)\vmware\vmware workstation\vmware-hostd.exe |
"{4381AF65-D35D-4158-A032-19EE554947C2}" = protocol=6 | dir=in | app=c:\program files (x86)\nuance\nuance cloud connector\wosvsssvr.exe |
"{53366754-27E7-4C66-9542-31549463DF61}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{54E22EE7-725A-4188-94B8-E96D5DA1766B}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgplgtupl.exe |
"{562F4A8A-A616-476F-8EEA-D37E326AFAD2}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgh.exe |
"{5656826E-ACE3-4FC2-BE3E-2E33897DACF8}" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"{580FF7C8-5AC0-43AF-9366-C16938314F68}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpofxs08.exe |
"{58211561-BD6D-4314-8BB3-2ACE90034945}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgm.exe |
"{5BCD1290-8A9C-4B98-8CB9-95E867272E9C}" = protocol=6 | dir=in | app=c:\users\bunnb1\appdata\roaming\dropbox\bin\dropbox.exe |
"{5E7CDC5C-8CCA-4348-9E66-0AAB7A7176EA}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{5EBD36C8-2912-46D4-AFA4-36A02D5BCEE2}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposid01.exe |
"{6691AE8A-ECD4-4FFE-B4B8-AB5A80654CCC}" = dir=in | app=c:\program files (x86)\common files\hp\digital imaging\bin\hpqphotocrm.exe |
"{69139A4A-4313-4A41-89D6-A4F14DB66B7C}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqpse.exe |
"{71AB986B-BE1B-442F-B12F-761F34466866}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{72D303D9-7871-4DA7-82C6-14CFDE9AA1CD}" = protocol=17 | dir=in | app=c:\program files (x86)\nuance\nuance cloud connector\wosvsssvr.exe |
"{7328DFA7-21B5-4FA1-B704-6D11DF13B199}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{767B3AD6-63FD-4F83-BC87-4990C8A0FC1E}" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe |
"{7AF6A3F4-1300-4A78-83F3-3E11AD9A0FE7}" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"{7B637792-4871-4850-BFCE-FB0251E040FF}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{80FFE747-65CC-4BB0-838B-E821D880E044}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqpsapp.exe |
"{819AF774-6981-45D2-99BA-4712B984EEFD}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{837CE27F-357F-48E1-8CDE-6EE5CADC3F8A}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpzwiz01.exe |
"{88618E52-209C-406D-AD69-6B0E4CE766AD}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |

Brian Bunney · « **Reply #22 on:** May 07, 2013, 05:16:30 PM »

"{9315CD55-9F3B-4E80-9F69-E4A8DDAE9381}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{97C605ED-DCAF-4885-899F-EA533BC19B43}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{9848FEBB-18FB-4825-A1CB-529AD0FBE8A6}" = protocol=17 | dir=in | app=c:\program files (x86)\dvd profiler\dvdpro.exe |
"{A34E10B4-5889-43C9-81D3-732954F3B0DA}" = protocol=6 | dir=in | app=d:\program files (x86)\cook'n9\cook'n.exe |
"{A3F45C25-61E7-4F8C-8B70-3C418DDF366A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A765C0B3-B00F-4CBD-988E-BFA06BEFBF4C}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqste08.exe |
"{B6560657-CFEC-4CDA-BEE6-0867E6875EF7}" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe |
"{B7A669B5-B8B5-46FB-8038-8D1A922D4DC5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B8192A0F-69A7-4F4E-8C0A-74118B18B8BD}" = dir=in | app=c:\program files (x86)\hp\digital imaging\smart web printing\smartwebprintexe.exe |
"{B8DBED7E-E9E7-497E-821C-65FBD25056D3}" = dir=in | app=c:\users\bunnb1\appdata\local\temp\7zs5dd5\setup\hpznui40.exe |
"{BCAA7B09-4FA4-4555-9590-C03EC770BD17}" = dir=in | app=c:\program files (x86)\hp\hp software update\hpwucli.exe |
"{BDE3C3CD-F19A-4628-ACED-CCC2755CC844}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{BDF09DCD-8C0F-4613-8F3F-36C0D7AC2CD9}" = protocol=17 | dir=in | app=d:\program files (x86)\cook'n9\cook'n.exe |
"{BE73C039-7B1A-48C9-9799-1F90A0E62C2B}" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe |
"{C1027153-8B78-4754-9152-30960EF952DC}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{C337E79A-1A98-4653-B24F-8EE1B53161FD}" = dir=in | app=c:\program files (x86)\vmware\vmware workstation\vmware-authd.exe |
"{C877768A-A8E5-4FD2-A893-8B20127153FD}" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe |
"{C8FC52C7-D18E-4DD0-95A6-63E8A585D417}" = protocol=17 | dir=in | app=c:\program files (x86)\supersync\supersync.exe |
"{CA160788-1096-4A55-A204-6C756D8794C7}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqsudi.exe |
"{CBB914A4-3E3E-431A-801F-1DDBD74F961B}" = protocol=6 | dir=in | app=c:\program files (x86)\dvd profiler\dvdpro.exe |
"{CC58D46B-2422-48A7-99B4-9D5063E59F17}" = protocol=17 | dir=in | app=c:\users\bunnb1\appdata\roaming\dropbox\bin\dropbox.exe |
"{CEF09987-3255-4A02-B746-6B12B94106AD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D255F469-DEED-4948-BC23-756FC1AB6418}" = dir=in | app=c:\program files (x86)\vmware\vmware workstation\vmware-authd.exe |
"{D6AAA29A-99F8-4D81-8D84-3169565C5F65}" = protocol=6 | dir=in | app=c:\program files (x86)\acertant\tuneranger\tunerangerhelper.exe |
"{D6E75531-AA65-41C8-98AD-6E2BBCEB8BDB}" = protocol=6 | dir=in | app=c:\users\bunnb1\appdata\local\microsoft\skydrive\skydrive.exe |
"{D89D8468-8FA6-4883-A646-22B0DF0290BD}" = protocol=6 | dir=out | app=system |
"{DB6EEA2F-BDB8-4EA0-BEBD-D0FDEF28DDF4}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqnrs08.exe |
"{E158CF50-F4C5-4AF3-9248-B80038A32C55}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E21C4373-14ED-41D6-BB87-67F3DE09BEA7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E4327DCB-B7B3-4BAE-B5F4-7952947E70BE}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{E7AF5FBC-C780-44A3-A8EA-87CBC5E712A8}" = protocol=6 | dir=out | app=c:\program files\avast software\avast\avastsvc.exe |
"{E956C6AF-C00C-47A4-BA38-F3A55F8D56A4}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpofxm08.exe |
"{EA8A0B55-DA0C-471C-A393-F82C21AF8B1F}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{ED583FB1-0307-4B6C-AA4C-0F6DC4EFBFDF}" = dir=in | app=c:\program files (x86)\vmware\vmware workstation\vmware-hostd.exe |
"{EF570F62-8A5E-4E1F-939B-9BCD5D7A7F09}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpfccopy.exe |
"{F0DEF60E-536A-4B53-B3E6-DA587BAA2645}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqtra08.exe |
"{F50E76AB-DA49-47D8-80AE-4699969AF285}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgpc01.exe |
"{F5E0448A-DE26-4075-832B-2D7E156D8503}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpoews01.exe |
"{F8859E69-42FE-4DF0-9ED3-84382D357E29}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpiscnapp.exe |
"{FA1F0B0D-55C8-4758-BC23-99A46559F774}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{FE27E75E-2AC5-416A-8426-800C290DD1E3}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |

Brian Bunney · « **Reply #23 on:** May 07, 2013, 05:17:11 PM »

"TCP Query User{2688F7C9-B7DE-4A5A-8C68-829AEAFB14BA}C:\program files (x86)\supersync\supersync.exe" = protocol=6 | dir=in | app=c:\program files (x86)\supersync\supersync.exe |
"TCP Query User{295D35F0-BF2B-4BD4-81B1-A1D3FBB1D007}D:\program files (x86)\cook'n9\cook'n.exe" = protocol=6 | dir=in | app=d:\program files (x86)\cook'n9\cook'n.exe |
"TCP Query User{2EF17EE8-F914-45F0-8218-199875A63759}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe |
"TCP Query User{39C68015-326E-44E4-A005-038F61EAB7DF}C:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe |
"TCP Query User{7D18E05B-943F-4DE5-954D-09F2ADDF375B}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe |
"TCP Query User{A87AF823-AEB9-464F-812E-33B21B540FA6}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"TCP Query User{F3C6A869-0D5E-4435-A353-88F93D0F9357}C:\program files (x86)\acertant\tuneranger\tunerangerhelper.exe" = protocol=6 | dir=in | app=c:\program files (x86)\acertant\tuneranger\tunerangerhelper.exe |
"TCP Query User{F6FA4617-F1BD-486C-BD75-934B259CEEBC}C:\program files (x86)\dvd profiler\dvdpro.exe" = protocol=6 | dir=in | app=c:\program files (x86)\dvd profiler\dvdpro.exe |
"UDP Query User{03375248-223D-4BE2-95F6-A0575EFF3D70}C:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\nuance\nuance cloud connector\gladinetclient.exe |
"UDP Query User{2A655B61-3245-4FA4-9639-E4D361B92AEC}C:\program files (x86)\acertant\tuneranger\tunerangerhelper.exe" = protocol=17 | dir=in | app=c:\program files (x86)\acertant\tuneranger\tunerangerhelper.exe |
"UDP Query User{60F6E92A-A1EE-4551-B908-40473D5C17F0}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe |
"UDP Query User{62586023-C0A8-45BE-87BD-E0AD13670550}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"UDP Query User{AEBEF69E-A90B-402B-A3D5-37CE6E2DB374}D:\program files (x86)\cook'n9\cook'n.exe" = protocol=17 | dir=in | app=d:\program files (x86)\cook'n9\cook'n.exe |
"UDP Query User{B4740BF5-F22B-4B67-BB25-E72B27E2BC0A}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe |
"UDP Query User{DD04BD11-9237-4988-A014-41003810B70B}C:\program files (x86)\dvd profiler\dvdpro.exe" = protocol=17 | dir=in | app=c:\program files (x86)\dvd profiler\dvdpro.exe |
"UDP Query User{EDF989FB-7E1F-40A6-9510-3934181B3C9D}C:\program files (x86)\supersync\supersync.exe" = protocol=17 | dir=in | app=c:\program files (x86)\supersync\supersync.exe |

Brian Bunney · « **Reply #24 on:** May 07, 2013, 05:17:49 PM »

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0225AD21-F3E2-4916-BFF3-65D3F9052582}" = iTunes
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1FB31F44-D4D0-4D76-944A-A1A5D79FD321}" = Windows Live Family Safety
"{21E49794-7C13-4E84-8659-55BD378267D5}" = Windows Home Server Connector
"{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support
"{44713725-8CC8-4710-B727-DC13A3665F9C}" = Adobe Photoshop Lightroom 3.5 64-bit
"{48C0866E-57EB-444C-8371-8E4321066BC3}" = Network64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{52357C6C-FE7F-4E8C-B045-EDE5146A1F9C}" = PaperPort Anywhere 1.1.4269.39023 powered by OfficeDrop
"{550331CC-C34B-494F-BCDA-37CE4EF6E924}" = Garmin Communicator Plugin x64
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{624C7F0A-89B2-4C49-9CAB-9D69613EC95A}" = Microsoft IntelliPoint 8.2
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{669A82E0-43E2-4645-8A2E-1A3DE78F8312}" = Adobe Photoshop Lightroom 4 64-bit
"{6BFAB6C1-6D46-46DB-A538-A269907C9F2F}" = Network64
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{6FE8A1DA-8CA6-4801-BF0F-0F2FED143FF4}" = WD SmartWare
"{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}" = PaperPort Image Printer 64-bit
"{71C4F928-136A-4222-A191-310E081FB96B}" = HP Photosmart C309a All-In-One Driver Software 14.0 Rel. 5
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DF73A13-F54C-4CB3-B4AD-4375A2E8F4F8}" = VmciSockets
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{90150000-008F-0000-1000-0000000FF1CE}" = Office 15 Click-to-Run Licensing Component
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91415F19-4C22-3609-A105-92ED3522D83C}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4048
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A62F9CD0-B2E0-4F2A-88F2-79254A3C8539}" = WinPatrol
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{BEC2EFB7-93E4-4F5F-B056-602ACEC2B759}" = WD SmartWare Drive Manager
"{CD7A262C-287E-41DD-A0F7-733856252C6B}" = Nuance PDF Create 7
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CEA21F20-DBF4-464C-8B81-28B8508AFDDD}" = Windows Live Family Safety
"{D0CB24F4-084F-40DE-B6B9-A03626E682F0}" = iCloud
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FF21C3E6-97FD-474F-9518-8DCBE94C2854}" = 64 Bit HP CIO Components Installer
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"HP Imaging Device Functions" = HP Imaging Device Functions 14.0
"HP Photosmart Essential" = HP Photosmart Essential 3.5
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0
"HPExtendedCapabilities" = HP Customer Participation Program 14.0
"HPOCR" = OCR Software by I.R.I.S. 14.0
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2
"Shop for HP Supplies" = Shop for HP Supplies
"sp6" = Logitech SetPoint 6.32
"TeraCopy_is1" = TeraCopy 2.27

Brian Bunney · « **Reply #25 on:** May 07, 2013, 05:18:50 PM »

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{003BFBBD-6C67-419E-A24D-0DCAFC3A5249}" = tools-freebsd
"{042A6F10-F770-4886-A502-B795DCF2D3B5}" = Nuance PDF Viewer Plus
"{068724F8-D8BE-4B43-8DDD-B9FE9E49FD76}" = Scansoft PDF Create
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D1414C8-9B0B-4146-BD87-8163E9114F88}" = Quicken 2012
"{0D94F75A-0EA6-4951-B3AF-B145FA9E05C6}" = VMware Workstation
"{0E13CAA3-B5FC-48C0-AA4A-26F5CD0C371C}" = Garmin Lifetime Updater
"{11D08055-939C-432b-98C3-E072478A0CD7}" = PSE10 STI Installer
"{12CAA28E-56CA-4C3D-B3F2-7311540DD410}" = TurboTax 2011
"{13F054F3-0B07-4D15-9E80-C55B496AB557}" = Garmin Communicator Plugin
"{1439B98F-681E-4D51-BB90-D04474E4C6EA}" = Serif Digital Scrapbook Artist 2
"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery
"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18A8E78B-9EF2-496E-B310-BCD8E4C1DAB3}" = iSEEK AnswerWorks English Runtime
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{197597A7-AD33-4898-9D8E-73066818B464}" = tools-netware
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.7.2
"{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}" = Bing Bar
"{1E8EB086-AE5F-45F6-887C-E5178868290F}" = Living Cookbook 2011
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink Blu-ray Disc Suite
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{20EFC9AA-BBC1-4DFD-81FF-99654F71CBF8}" = HPPhotoSmartDiscLabel_PrintOnDisc
"{22461A1C-BD68-4D90-9897-1DB146D55ECB}" = LogMeIn
"{22D3A614-482C-444A-932C-9DA1B8ECDFD2}" = Elements 10 Organizer
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{24AE6B5B-3D5A-488C-9224-1BEE11F75DD9}" = TurboTax 2010
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2FB9EA69-51D4-4913-9AD5-762C034DE811}" = Status
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMicron JMB36X Driver
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}" = Apple Application Support
"{468D22C0-8080-11E2-B86E-B8AC6F98CCE3}" = Google Earth
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{510D2239-6C2E-457B-9590-485EC552D94D}" = Garmin USB Drivers
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{56B83336-FBC1-4C46-8613-90A9E3B440D6}" = EPU-6 Engine
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{59E44523-0F0F-4454-9F37-E951BBA55B84}" = C309a
"{5B1F2843-B379-3FF2-B0D3-64DD143ED53A}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4048
"{5C47C8B6-77FF-4FC7-A388-66FCF9CFC24C}" = Snagit 9.1.3
"{5C6F884D-680C-448B-B4C9-22296EE1B206}" = Logitech Harmony Remote Software 7
"{5DCF0E4B-F8EA-4229-A0BD-5CA6D4AFB749}" = SolutionCenter
"{6179550A-3E7C-499E-BCC9-9E8113E0A285}" = LG Tool Kit
"{681B698F-C997-42C3-B184-B489C6CA24C9}" = HPPhotoSmartDiscLabelContent1
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.1.0.0
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{726DDC29-79B3-41B4-BDBF-97DF25BF1EA8}" = TurboTax 2012
"{761E061F-FB8E-BBB4-69A4-B1DEF3640DB7}" = Zinio Reader 4
"{76CE5B47-F5A4-4E5C-99A0-CEFF6146EA4A}" = System Requirements Lab for Intel
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{80F19EAA-44C4-47C2-AE87-1C7628E858D6}" = Logitech Harmony Remote Software 7
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{83ED1E80-A1B7-4236-BCF1-AC4A88151A6B}" = Microsoft AutoRoute 2006
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{8471021C-F529-43DE-84DF-3612E10F58C4}" = Remote Control USB Driver
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver
"{8A158B7D-A6E3-49B6-8702-A6A10CCC6323}" = Garmin POI Loader
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting

Brian Bunney · « **Reply #26 on:** May 07, 2013, 05:19:45 PM »

"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_OUTLOOKR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_OUTLOOKR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_OUTLOOKR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_OUTLOOKR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_OUTLOOKR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_OUTLOOKR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_OUTLOOKR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_OUTLOOKR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_OUTLOOKR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90150000-008C-0000-0000-0000000FF1CE}" = Office 15 Click-to-Run Extensibility Component
"{90150000-008C-0409-0000-0000000FF1CE}" = Office 15 Click-to-Run Localization Component
"{91120000-001A-0000-0000-0000000FF1CE}" = Microsoft Office Outlook 2007
"{91120000-001A-0000-0000-0000000FF1CE}_OUTLOOKR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9294F169-72EE-4D74-AE92-CA25F64B4FF8}" = Fax
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95140000-0081-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{958A793F-F1D2-4A90-B6A5-C52E2D74E8FE}" = AzureBay Screen Saver 3.5
"{959B7F35-2819-40C5-A0CD-3C53B5FCC935}" = Rocketfish Internal All-in-1 Card Reader/Writer
"{97486FBE-A3FC-4783-8D55-EA37E9D171CC}" = HP Update
"{98C4F0D9-3C09-4BD9-B835-29744B94931A}" = BigOven
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B362566-EC1B-4700-BB9C-EC661BDE2175}" = DocProc
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0087DDE-69D0-11E2-AD57-43CA6188709B}" = Adobe AIR
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A127C3C0-055E-38CF-B38F-1E85F8BBBFFE}" = Adobe Community Help
"{A24AAF6D-3EDB-43da-89BE-1A95D5CFA672}_is1" = Aiseesoft Blu-ray Copy 6.3.6
"{A436F67F-687E-4736-BD2B-537121A804CF}" = HP Product Detection
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB1C87CB-1807-4CF0-B4C2-CEE14C18CDB4}" = tools-solaris
"{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply
"{AC76BA86-1033-0000-7760-000000000003}" = Adobe Acrobat 8 Professional
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.6)
"{ADAEEC53-24AF-4A49-B872-75FCBDA59916}" = True Image 2013
"{ADAEEC53-24AF-4A49-B872-75FCBDA59916}Visible" = True Image 2013
"{AE0F62A7-A1A2-407F-9F4C-48939BD9AD8D}" = tools-winPre2k
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{B28635AB-1DF3-4F07-BFEA-975D911B549B}" = hpphotosmartdisclabelplugin
"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2
"{BBD3F66B-1180-4785-B679-3F91572CD3B4}_is1" = iolo technologies' System Mechanic Professional
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C2F8CA82-2BD9-4513-B2D1-08A47914C1DA}_is1" = Uniblue DriverScanner
"{C56BBAC8-0DD2-4CE4-86E0-F2BDEABDD0CF}" = Xmarks for IE
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C82185E8-C27B-4EF4-2008-4444BC2C2B6D}" = Microsoft Streets & Trips 2008
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CCF298AF-9CE1-4B26-B251-486E98A34789}" = Windows 7 USB/DVD Download Tool
"{CCFD2B4E-1308-4363-9C83-BD616666E7A1}" = BigOven
"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D102611A-6466-4101-A51D-51069303AC65}" = tools-linux
"{D2E707E8-090E-EC5B-4833-1CA694FB7460}" = Zinio Alert Messenger
"{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D79113E7-274C-470B-BD46-01B10219DF6A}" = HPPhotosmartEssential
"{D9D8F2CF-FE2D-4644-9762-01F916FE90A9}" = HPPhotoSmartDiscLabel_PaperLabel
"{DBCC73BA-C69A-4BF5-B4BF-F07501EE7039}" = AnswerWorks 5.0 English Runtime
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E517094C-06B6-419F-8FFD-EF4F57972130}" = QuickTransfer
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EE549AF9-8FAA-4584-83B2-ECF1BC9DC1FF}" = Adobe Photoshop Elements 10
"{EEE31B2B-F517-4BD2-8F92-57E4AE938BA3}" = Nuance Cloud Connector
"{EEE791A8-4AB5-1540-FE9D-70EC70938AD2}" = The Complete National Geographic
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{FA0E7183-6B11-4899-B25F-2C490543967E}" = PS_AIO_05_C309_Software_Min
"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
"{FC652C8E-5C2F-4612-A8D8-DFF8EF5C4EE2}" = BigOven
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FFD9383C-01D5-4897-A954-43AF599AED30}" = tools-windows

Brian Bunney · « **Reply #27 on:** May 07, 2013, 05:20:49 PM »

"Adobe Acrobat 8 Professional_831" = Adobe Acrobat 8.3.1 - CPSID_83708
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Photoshop Elements 10" = Adobe Photoshop Elements 10
"AudibleManager" = AudibleManager
"avast" = avast! Internet Security
"AVS Update Manager_is1" = AVS Update Manager 1.0
"BeyondCompare3_is1" = Beyond Compare Version 3.3.5
"BN_DesktopReader" = NOOK for PC
"CameraUserGuide-PSG12" = Canon PowerShot G12 Camera User Guide
"CameraWindowDC8" = Canon Utilities CameraWindow DC 8
"CameraWindowLauncher" = Canon Utilities CameraWindow Launcher
"Canon MOV Decoder" = Canon MOV Decoder
"Canon MOV Encoder" = Canon MOV Encoder
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"Cisco Connect" = Cisco Connect
"Color Efex Pro 4" = Color Efex Pro 4
"com.nationalgeographic.products.cng120.68B1CC4249876152EBE333BD4B7514ADB4D94062.1" = The Complete National Geographic
"CombiMovie version 2" = CombiMovie version 2
"Cook'n" = Cook'n
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"CrystalDiskInfo_is1" = CrystalDiskInfo 3.10.0
"Dfine 2.0" = Dfine 2.0
"DPP" = Canon Utilities Digital Photo Professional 3.9
"EASEUS Todo Backup Home 2.0_is1" = EASEUS Todo Backup Home 2.0
"Emperor's Mahjong for Windows" = Emperor's Mahjong for Windows
"Glary Utilities_is1" = Glary Utilities 2.36.0.1232
"Google Chrome" = Google Chrome
"HDR Efex Pro" = HDR Efex Pro
"HotspotShield" = Hotspot Shield 2.78
"huey_is1" = hueyPRO 1.5.1
"IDrive_is1" = IDrive version 3.4.1 July 27, 2011
"Ilium Software eWallet_is1" = eWallet 7.2
"ImgBurn" = ImgBurn
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink Blu-ray Disc Suite
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"InvelosDVDProfiler_is1" = DVD Profiler Version 3.8.2
"Living Cookbook 2011" = Living Cookbook 2011
"MagniDriver" = marvell 91xx driver
"Mapit_1 Toolbar" = Mapit 1 Toolbar
"McAfee Security Scan" = McAfee Security Scan Plus
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"MovieUploaderForYouTube" = Canon Utilities Movie Uploader for YouTube
"MyCamera" = Canon Utilities MyCamera
"OUTLOOKR" = Microsoft Office Outlook 2007
"PandoraRecovery" = PandoraRecovery (Remove Only)
"Personal Printing Guide" = Canon Personal Printing Guide
"PhotoStitch" = Canon Utilities PhotoStitch
"Sharpener Pro 3.0" = Sharpener Pro 3.0
"Silver Efex Pro 2" = Silver Efex Pro 2
"SmartDraw VP" = SmartDraw VP
"Software Guide" = Canon DIGITAL CAMERA Solution Disk Software Guide
"SugarSync" = SugarSync
"SuperSync 4.5.1" = SuperSync 4.5.1
"The Complete National Geographic 1.59" = The Complete National Geographic
"VideoReDo4_is1" = VideoReDo TVSuite Version 4.20.7.629
"VirtualCloneDrive" = VirtualCloneDrive
"Viveza 2" = Viveza 2
"VMware_Workstation" = VMware Workstation
"WinLiveSuite" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.1.2
"WinX Blu-ray Decrypter_is1" = WinX Blu-ray Decrypter 3.0.0
"Wireshark" = Wireshark 1.6.2
"Yahoo! Companion" = Yahoo! Toolbar
"ZinioAlertMessenger.9310D8F796442B71068C511E15D70529A702D19D.1" = Zinio Alert Messenger
"ZinioReader4.9310D8F796442B71068C511E15D70529A702D19D.1" = Zinio Reader 4
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

Brian Bunney · « **Reply #28 on:** May 07, 2013, 05:21:41 PM »

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2136029548-1328334061-613265227-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Amazon Kindle" = Amazon Kindle
"CNET TechTracker" = CNET TechTracker
"Dropbox" = Dropbox
"GoToMeeting" = GoToMeeting 5.1.0.880
"SkyDriveSetup.exe" = Microsoft SkyDrive

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 01/05/2013 7:25:19 PM | Computer Name = bunnb1-I5 | Source = .NET Runtime | ID = 1026
Description =

Error - 01/05/2013 7:25:22 PM | Computer Name = bunnb1-I5 | Source = Application Error | ID = 1000
Description = Faulting application name: PaperPortAnywhere.exe, version: 1.1.4276.25481,
time stamp: 0x4e739ee3 Faulting module name: KERNELBASE.dll, version: 6.1.7601.18015,
time stamp: 0x50b83c8a Exception code: 0xe0434352 Fault offset: 0x0000c41f Faulting
process id: 0x7cc Faulting application start time: 0x01ce46c324713694 Faulting application
path: C:\Program Files (x86)\Nuance\PaperPort Anywhere\PaperPortAnywhere.exe Faulting
module path: C:\Windows\syswow64\KERNELBASE.dll Report Id: 6465cdc3-b2b6-11e2-bf4d-005056c00008

Error - 06/05/2013 4:35:43 PM | Computer Name = bunnb1-I5 | Source = .NET Runtime | ID = 1026
Description =

Error - 06/05/2013 4:35:43 PM | Computer Name = bunnb1-I5 | Source = Application Error | ID = 1000
Description = Faulting application name: PaperPortAnywhere.exe, version: 1.1.4276.25481,
time stamp: 0x4e739ee3 Faulting module name: KERNELBASE.dll, version: 6.1.7601.18015,
time stamp: 0x50b83c8a Exception code: 0xe0434352 Fault offset: 0x0000c41f Faulting
process id: 0x6b8 Faulting application start time: 0x01ce4a99472b7c18 Faulting application
path: C:\Program Files (x86)\Nuance\PaperPort Anywhere\PaperPortAnywhere.exe Faulting
module path: C:\Windows\syswow64\KERNELBASE.dll Report Id: 85ae8325-b68c-11e2-81b6-005056c00008

Error - 06/05/2013 5:20:59 PM | Computer Name = bunnb1-I5 | Source = .NET Runtime | ID = 1026
Description =

Error - 06/05/2013 5:21:01 PM | Computer Name = bunnb1-I5 | Source = Application Error | ID = 1000
Description = Faulting application name: PaperPortAnywhere.exe, version: 1.1.4276.25481,
time stamp: 0x4e739ee3 Faulting module name: KERNELBASE.dll, version: 6.1.7601.18015,
time stamp: 0x50b83c8a Exception code: 0xe0434352 Fault offset: 0x0000c41f Faulting
process id: 0x1634 Faulting application start time: 0x01ce4a9f9a2f2d0a Faulting application
path: C:\Program Files (x86)\Nuance\PaperPort Anywhere\PaperPortAnywhere.exe Faulting
module path: C:\Windows\syswow64\KERNELBASE.dll Report Id: d977ebe5-b692-11e2-871e-005056c00008

Error - 07/05/2013 8:03:56 AM | Computer Name = bunnb1-I5 | Source = .NET Runtime | ID = 1026
Description =

Error - 07/05/2013 8:03:57 AM | Computer Name = bunnb1-I5 | Source = Application Error | ID = 1000
Description = Faulting application name: PaperPortAnywhere.exe, version: 1.1.4276.25481,
time stamp: 0x4e739ee3 Faulting module name: KERNELBASE.dll, version: 6.1.7601.18015,
time stamp: 0x50b83c8a Exception code: 0xe0434352 Fault offset: 0x0000c41f Faulting
process id: 0x18d8 Faulting application start time: 0x01ce4b1af2d55e35 Faulting application
path: C:\Program Files (x86)\Nuance\PaperPort Anywhere\PaperPortAnywhere.exe Faulting
module path: C:\Windows\syswow64\KERNELBASE.dll Report Id: 31eb5d0d-b70e-11e2-81f9-005056c00008

Error - 07/05/2013 9:48:46 AM | Computer Name = bunnb1-I5 | Source = .NET Runtime | ID = 1026
Description =

Error - 07/05/2013 9:48:47 AM | Computer Name = bunnb1-I5 | Source = Application Error | ID = 1000
Description = Faulting application name: PaperPortAnywhere.exe, version: 1.1.4276.25481,
time stamp: 0x4e739ee3 Faulting module name: KERNELBASE.dll, version: 6.1.7601.18015,
time stamp: 0x50b83c8a Exception code: 0xe0434352 Fault offset: 0x0000c41f Faulting
process id: 0x18f8 Faulting application start time: 0x01ce4b2998177ca1 Faulting application
path: C:\Program Files (x86)\Nuance\PaperPort Anywhere\PaperPortAnywhere.exe Faulting
module path: C:\Windows\syswow64\KERNELBASE.dll Report Id: d6c60f20-b71c-11e2-a12a-005056c00008

[ OSession Events ]
Error - 20/07/2011 7:58:36 AM | Computer Name = bunnb1-I5 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 1873
seconds with 600 seconds of active time. This session ended with a crash.

Brian Bunney · « **Reply #29 on:** May 07, 2013, 05:22:31 PM »

Error - 25/07/2011 8:42:36 AM | Computer Name = bunnb1-I5 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 1841
seconds with 360 seconds of active time. This session ended with a crash.

Error - 02/08/2011 10:44:04 PM | Computer Name = bunnb1-I5 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 1845
seconds with 60 seconds of active time. This session ended with a crash.

Error - 05/09/2011 10:34:50 PM | Computer Name = bunnb1-I5 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 1830
seconds with 120 seconds of active time. This session ended with a crash.

Error - 30/01/2012 10:02:40 PM | Computer Name = bunnb1-I5 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 1820
seconds with 120 seconds of active time. This session ended with a crash.

Error - 11/02/2012 8:10:16 PM | Computer Name = bunnb1-I5 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 42614
seconds with 2160 seconds of active time. This session ended with a crash.

Error - 29/02/2012 5:15:46 PM | Computer Name = bunnb1-I5 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 1845
seconds with 60 seconds of active time. This session ended with a crash.

Error - 04/04/2012 7:23:21 PM | Computer Name = bunnb1-I5 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 725
seconds with 180 seconds of active time. This session ended with a crash.

Error - 01/07/2012 7:08:12 PM | Computer Name = bunnb1-I5 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 257
seconds with 240 seconds of active time. This session ended with a crash.

Error - 01/07/2012 7:09:18 PM | Computer Name = bunnb1-I5 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 50
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 07/05/2013 7:47:50 AM | Computer Name = bunnb1-I5 | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 07/05/2013 7:47:50 AM | Computer Name = bunnb1-I5 | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 07/05/2013 7:47:50 AM | Computer Name = bunnb1-I5 | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 07/05/2013 7:47:50 AM | Computer Name = bunnb1-I5 | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 07/05/2013 7:49:10 AM | Computer Name = bunnb1-I5 | Source = Service Control Manager | ID = 7001
Description = The PnP-X IP Bus Enumerator service depends on the Function Discovery
Provider Host service which failed to start because of the following error: %%1068

Error - 07/05/2013 8:02:51 AM | Computer Name = bunnb1-I5 | Source = Service Control Manager | ID = 7000
Description = The iolo FileInfoList Service service failed to start due to the following
error: %%1083

Error - 07/05/2013 8:03:00 AM | Computer Name = bunnb1-I5 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
FileDisk

Error - 07/05/2013 8:56:23 AM | Computer Name = bunnb1-I5 | Source = DCOM | ID = 10010
Description =

Error - 07/05/2013 9:47:44 AM | Computer Name = bunnb1-I5 | Source = Service Control Manager | ID = 7000
Description = The iolo FileInfoList Service service failed to start due to the following
error: %%1083

Error - 07/05/2013 9:47:51 AM | Computer Name = bunnb1-I5 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
FileDisk

< End of report >

Author Topic: Root kit or virus? (Read 35362 times)

Brian Bunney

Re: Root kit or virus? (13)

Brian Bunney

Re: Root kit or virus? (14)

Brian Bunney

Re: Root kit or virus? (Extras.txt-1)

Brian Bunney

Re: Root kit or virus? (Extras.txt-2)

Brian Bunney

Re: Root kit or virus? (Extras.txt-3)

Brian Bunney

Re: Root kit or virus? (Extras.txt-4)

Brian Bunney

Re: Root kit or virus? (Extras.txt-5)

Brian Bunney

Re: Root kit or virus? (Extras.txt-6)

Brian Bunney

Re: Root kit or virus? (Extras.txt-7)

Brian Bunney

Re: Root kit or virus? (Extras.txt-8)

Brian Bunney

Re: Root kit or virus? (Extras.txt-9)

Brian Bunney

Re: Root kit or virus? (Extras.txt-10)

Brian Bunney

Re: Root kit or virus? (Extras.txt-11)

Brian Bunney

Re: Root kit or virus? (Extras.txt-12)

Brian Bunney

Re: Root kit or virus? (Extras.txt-13)