Sinds een paar dagen heb ik last van pop ups van spelletjes, wedkantoren, etc. en (dubbel) onderstreepte woorden in teksten waarbij indien ik er met de muis overheen ga advertenties te zien krijg. Volgens is dit gekomen nadat ik een nep update van skype kreeg te zien. Ik had dacht ik alles genegeerd had, maar kennelijk niet.
Hierbij log.txt:
Logfile of random's system information tool 1.09 (written by random/random)
Run by Jhknip at 2013-11-13 10:40:10
Microsoft Windows 7 Enterprise N Service Pack 1
System drive C: has 212 GB (69%) free of 305 GB
Total RAM: 3793 MB (45% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:40:20, on 13/11/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16720)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\SysWOW64\DWRCS.exe
C:\Program Files (x86)\Novell\ZENworks\bin\nzrWinVNC.exe
C:\Program Files (x86)\Novell\ZENworks\bin\nzrWinVNCApp.exe
C:\windows\SysWOW64\config\systemprofile\AppData\Roaming\okitspace\protect\PluginProtect.exe
C:\Program Files (x86)\Trend Micro\OfficeScan Client\CNTAoSMgr.exe
C:\Windows\SysWOW64\DWRCST.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Windows\CCM\SCNotification.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\jhknip\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Jhknip.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://feed.snapdo.com/?publisher=Vittalia&dpid=Vittalia&co=NL&userid=b2199df2-7218-85b8-e367-230cf0a1544c&searchtype=ds&q={searchTerms}&installDate=13/10/2013
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN NL: Hotmail, Outlook, Skype, Messenger, het laatste nieuws, entertainment en meer!
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN NL: Hotmail, Outlook, Skype, Messenger, het laatste nieuws, entertainment en meer!
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snapdo.com/?publisher=Vittalia&dpid=Vittalia&co=NL&userid=b2199df2-7218-85b8-e367-230cf0a1544c&searchtype=ds&q={searchTerms}&installDate=13/10/2013
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snapdo.com/?publisher=Vittalia&dpid=Vittalia&co=NL&userid=b2199df2-7218-85b8-e367-230cf0a1544c&searchtype=ds&q={searchTerms}&installDate=13/10/2013
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: OKitSpace - {3543619C-D563-43f7-95EA-4DA7E1CC396A} - C:\windows\SysWow64\config\systemprofile\AppData\Roaming\okitSpace\IE\OkitSpace.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - (no file)
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files (x86)\Trend Micro\OfficeScan Client\Pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [ZenNotifyIcon] C:\Program Files (x86)\Novell\Zenworks\bin\ZenNotifyIcon.exe
O4 - HKLM\..\Run: [NalView] C:\Program Files (x86)\Novell\ZENworks\bin\nalview.exe
O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [DameWare MRC Agent] C:\windows\SysWOW64\DWRCST.exe
O4 - HKLM\..\RunOnce: [NSIS.Library.RegTool.v3] "C:\Program Files (x86)\FileZilla FTP Client\NSIS.Library.RegTool.v3.{24BD29A5-07D5-4D1F-9A44-B5B53A8EFAB8}.exe" /S
O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Google Update] "C:\Users\jhknip\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://*.citrix.nj3.gg.group
O15 - Trusted Zone: http://*.ggatlpx1
O15 - Trusted Zone: http://*.ggsydpx1
O15 - Trusted Zone: http://*.ggzrhpx1
O15 - Trusted Zone: http://*.osl1srv004
O16 - DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} (Cisco AnyConnect VPN Client Web Control) - https://emea.gategroup.com/CACHE/stc/2/binaries/vpnweb.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = emea.gg.group
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = emea.gg.group
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = emea.gg.group
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Intel® Content Protection HECI Service (cphs) - Intel Corporation - C:\windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\Windows\SysWOW64\DWRCS.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\windows\system32\ibmpmsvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Novell Identity Store - Novell, Inc - C:\Program Files (x86)\Novell\CASA\bin\micasad.exe
O23 - Service: Novell ZENworks Agent Service - Novell, Inc. - C:\Program Files (x86)\Novell\ZENworks\bin\ZenworksWindowsService.exe
O23 - Service: Novell ZENworks ISD Service (Novell ZENworks Image-Safe Data Service) - Unknown owner - C:\Program Files (x86)\Novell\ZENworks\bin\preboot\novell-zisdservice.exe
O23 - Service: OfficeScan NT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: Novell ZENworks Remote Management powered by VNC (nzwinvnc) - Novell, Inc. - C:\Program Files (x86)\Novell\ZENworks\bin\nzrWinVNC.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: Protect your browser's extensions (srvPlgProtect) - Unknown owner - C:\windows\system32\config\systemprofile\AppData\Roaming\okitspace\protect\PluginProtect.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe
O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: OfficeScan NT Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmPfw.exe
O23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmProxy.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Novell ZENworks Pre Agent (ZENPreAgent) - Unknown owner - C:\windows\novell\zenworks\bin\ZENPreAgent.exe
--
End of file - 12308 bytes
======Listing Processes======
\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\lsm.exe
winlogon.exe
C:\windows\system32\svchost.exe -k DcomLaunch
"C:\Program Files (x86)\Novell\CASA\bin\micasad.exe"
C:\windows\system32\ibmpmsvc.exe
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k GPSvcGroup
C:\windows\system32\svchost.exe -k NetworkService
"C:\Program Files (x86)\Novell\ZENworks\bin\ZenworksWindowsService.exe"
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
C:\Windows\SysWOW64\DWRCS.exe -service
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Trend Micro\OfficeScan Client\ntrtscan.exe"
"C:\Program Files (x86)\Novell\ZENworks\bin\nzrWinVNC.exe" -service
"C:\Program Files (x86)\Novell\ZENworks\bin\nzrWinVNCApp.exe"
C:\windows\SysWOW64\config\systemprofile\AppData\Roaming\okitspace\protect\PluginProtect.exe
"C:\Program Files (x86)\Trend Micro\OfficeScan Client\tmlisten.exe"
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Trend Micro\OfficeScan Client\CNTAoSMgr.exe"
\??\C:\windows\system32\conhost.exe "1119871413-799550027-320323762-1897307199-2017787237-8819323611945579572210470195
"C:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe" /service
"C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmPfw.exe"
"taskhost.exe"
pause
taskeng.exe {CB84FD7F-249E-4036-BBF3-FA0DEE0656D1}
"C:\windows\system32\Dwm.exe"
6129
C:\windows\Explorer.EXE
"\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\Trend Micro\OfficeScan Client\PccNTMon.exe" -HideWindow
"C:\Program Files (x86)\Novell\ZENworks\bin\ZenNotifyIcon.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
C:\windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\CCM\CcmExec.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\system32\wbem\wmiprvse.exe
"C:\Windows\CCM\SCNotification.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="5116.0.150207441\1629573114" --disable-d3d11 --supports-dual-gpus=false --gpu-driver-bug-workarounds=0,9,18,24,26 --gpu-vendor-id=0x8086 --gpu-device-id=0x0166 --gpu-driver-vendor="Intel Corporation" --gpu-driver-version=9.17.10.2843 --ignored=" --type=renderer " /prefetch:822062411
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/CookieRetentionPriorityStudy/ExperimentOn/ForceCompositingMode/thread/InfiniteCache/No/InstantExtended/Group5 pct:10d stable:pp1 use_remote_ntp_on_startup:1 espv:210 suppress_on_srp:1/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group6/UMA-New-Install-Uniformity-Trial/Experiment/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-1-Percent/group_78/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_14/UMA-Uniformity-Trial-50-Percent/default/" --renderer-print-preview --instant-process --enable-threaded-compositing --disable-html-notifications --channel="5116.1.1834107604\139178944" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/CookieRetentionPriorityStudy/ExperimentOn/ForceCompositingMode/thread/InfiniteCache/No/InstantExtended/Group5 pct:10d stable:pp1 use_remote_ntp_on_startup:1 espv:210 suppress_on_srp:1/NewMenuStyle/Compact2/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group6/UMA-New-Install-Uniformity-Trial/Experiment/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-1-Percent/group_78/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_14/UMA-Uniformity-Trial-50-Percent/default/" --renderer-print-preview --enable-threaded-compositing --disable-html-notifications --channel="5116.3.618055712\1237367312" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Users\jhknip\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll" --lang=en-US --channel="5116.5.2059877393\721641368" /prefetch:-390060480
"C:\Users\jhknip\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe"
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\jhknip\Desktop\Eigen docs\Voorvallen\Logboekje 23 juli (1).docx"
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/CookieRetentionPriorityStudy/ExperimentOn/ForceCompositingMode/thread/InfiniteCache/No/InstantExtended/Group5 pct:10d stable:pp1 use_remote_ntp_on_startup:1 espv:210 suppress_on_srp:1/NewMenuStyle/Compact2/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group6/UMA-New-Install-Uniformity-Trial/Experiment/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-1-Percent/group_78/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_14/UMA-Uniformity-Trial-50-Percent/default/" --renderer-print-preview --enable-threaded-compositing --disable-html-notifications --channel="5116.6.1888423033\1139126091" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=ppapi --channel="5116.7.1147783399\1386509560" --ppapi-flash-args --lang=en-US --ignored=" --type=renderer " /prefetch:-632637702
C:\windows\splwow64.exe 12288
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/CookieRetentionPriorityStudy/ExperimentOn/ForceCompositingMode/thread/InfiniteCache/No/InstantExtended/Group5 pct:10d stable:pp1 use_remote_ntp_on_startup:1 espv:210 suppress_on_srp:1/NewMenuStyle/Compact2/Prerender/PrerenderEnabled/PrerenderFromOmnibox/OmniboxPrerenderDisabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group6/UMA-New-Install-Uniformity-Trial/Experiment/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-1-Percent/group_78/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_14/UMA-Uniformity-Trial-50-Percent/default/" --renderer-print-preview --enable-threaded-compositing --disable-html-notifications --channel="5116.12.390051255\1899710843" /prefetch:673131151
C:\windows\system32\sppsvc.exe
"C:\Users\jhknip\Downloads\RSITx64.exe"
======Scheduled tasks folder======
C:\windows\tasks\GoogleUpdateTaskMachineCore.job
C:\windows\tasks\GoogleUpdateTaskMachineUA.job
C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2603050116-4143719953-3684268396-38280Core.job
C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2603050116-4143719953-3684268396-38280UA.job
=========Mozilla firefox=========
ProfilePath - C:\Users\jhknip\AppData\Roaming\Mozilla\Firefox\Profiles\dxwosksx.default
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.45.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=1.1.11]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL
C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nsIBitCometAgent.xpt
C:\Program Files (x86)\Mozilla Firefox\plugins\
npBitCometAgent.dll
C:\Program Files (x86)\Mozilla Firefox\searchplugins\
bing.xml
google.xml
yahoo.xml
C:\Users\jhknip\AppData\Roaming\Mozilla\Firefox\Profiles\dxwosksx.default\searchplugins\
Web Search.xml
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2012-08-16 6670496]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2010-12-21 689040]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-04-04 63912]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3543619C-D563-43f7-95EA-4DA7E1CC396A}]
OKitSpace - C:\windows\SysWow64\config\systemprofile\AppData\Roaming\okitSpace\IE\OkitSpace.dll [2013-10-21 190464]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2012-08-16 4171424]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-10-08 462760]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL [2010-12-21 561552]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-10-08 171944]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{ae07101b-46d4-4a98-af68-0333ea26e113}
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{ae07101b-46d4-4a98-af68-0333ea26e113}
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Apoint"=C:\Program Files\DellTPad\Apoint.exe [2011-06-21 608112]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-12-09 11663976]
"IgfxTray"=C:\windows\system32\igfxtray.exe [2013-02-19 170304]
"HotKeysCmds"=C:\windows\system32\hkcmd.exe [2013-02-19 398656]
"Persistence"=C:\windows\system32\igfxpers.exe [2013-02-19 441152]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1475584]
"Google Update"=C:\Users\jhknip\AppData\Local\Google\Update\GoogleUpdate.exe [2013-08-29 116648]
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-04-04 843712]
"BCSSync"=C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [2010-03-13 91520]
"OfficeScanNT Monitor"=C:\Program Files (x86)\Trend Micro\OfficeScan Client\Pccntmon.exe [2012-12-07 2230608]
"ZenNotifyIcon"=C:\Program Files (x86)\Novell\Zenworks\bin\ZenNotifyIcon.exe [2011-11-02 147456]
"NalView"=C:\Program Files (x86)\Novell\ZENworks\bin\nalview.exe [2011-11-02 65024]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]
"DameWare MRC Agent"=C:\windows\SysWOW64\DWRCST.exe [2010-08-06 85528]
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\RunOnce]
"NSIS.Library.RegTool.v3"=C:\Program Files (x86)\FileZilla FTP Client\NSIS.Library.RegTool.v3.{24BD29A5-07D5-4D1F-9A44-B5B53A8EFAB8}.exe [2009-09-28 5120]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2013-02-19 441856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LCredMgr]
C:\Program Files\Novell\CASA\bin\lcredmgr.dll [2011-05-26 56320]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2012-08-16 6670496]
"{763370C4-268E-4308-A60C-D8DA0342BE32}"=C:\Program Files (x86)\Novell\ZENworks\bin\NalShell.dll [2011-11-02 1463296]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2012-08-16 4171424]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
ZenV1_0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"LocalAccountTokenFilterPolicy"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"MSVideo8"=VfWWDM32.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
======List of files/folders created in the last 1 month======
2013-11-13 10:40:10 ----D---- C:\rsit
2013-11-13 10:40:10 ----D---- C:\Program Files\trend micro
2013-11-10 11:55:59 ----RD---- C:\Program Files (x86)\Skype
2013-11-10 11:07:36 ----D---- C:\Program Files (x86)\SoftwareUpdater
2013-10-30 16:58:06 ----D---- C:\ProgramData\VS Revo Group
2013-10-30 15:45:05 ----A---- C:\autoexec.bat
2013-10-30 15:44:28 ----D---- C:\Program Files\Enigma Software Group
2013-10-30 15:43:08 ----D---- C:\windows\86CA3695A4124BAE92B649A60C2AC663.TMP
2013-10-23 15:57:03 ----D---- C:\Program Files (x86)\PS3 Media Server
2013-10-23 11:54:22 ----A---- C:\windows\SYSWOW64\javaws.exe
2013-10-23 11:54:14 ----A---- C:\windows\SYSWOW64\WindowsAccessBridge-32.dll
2013-10-23 11:54:14 ----A---- C:\windows\SYSWOW64\javaw.exe
2013-10-23 11:54:14 ----A---- C:\windows\SYSWOW64\java.exe
2013-10-17 15:00:14 ----A---- C:\windows\SYSWOW64\ieui.dll
2013-10-17 15:00:14 ----A---- C:\windows\system32\ieui.dll
2013-10-17 15:00:13 ----A---- C:\windows\SYSWOW64\RegisterIEPKEYs.exe
2013-10-17 15:00:13 ----A---- C:\windows\SYSWOW64\iesysprep.dll
2013-10-17 15:00:13 ----A---- C:\windows\SYSWOW64\iesetup.dll
2013-10-17 15:00:13 ----A---- C:\windows\SYSWOW64\iertutil.dll
2013-10-17 15:00:13 ----A---- C:\windows\SYSWOW64\iernonce.dll
2013-10-17 15:00:13 ----A---- C:\windows\system32\RegisterIEPKEYs.exe
2013-10-17 15:00:13 ----A---- C:\windows\system32\iesysprep.dll
2013-10-17 15:00:13 ----A---- C:\windows\system32\iesetup.dll
2013-10-17 15:00:13 ----A---- C:\windows\system32\iernonce.dll
2013-10-17 15:00:13 ----A---- C:\windows\system32\ie4uinit.exe
2013-10-17 15:00:12 ----A---- C:\windows\SYSWOW64\msfeeds.dll
2013-10-17 15:00:12 ----A---- C:\windows\SYSWOW64\jscript.dll
2013-10-17 15:00:12 ----A---- C:\windows\system32\msfeeds.dll
2013-10-17 15:00:12 ----A---- C:\windows\system32\jscript.dll
2013-10-17 15:00:12 ----A---- C:\windows\system32\iertutil.dll
2013-10-17 15:00:11 ----A---- C:\windows\system32\jscript9.dll
2013-10-17 15:00:10 ----A---- C:\windows\SYSWOW64\urlmon.dll
2013-10-17 15:00:10 ----A---- C:\windows\SYSWOW64\jscript9.dll
2013-10-17 15:00:09 ----A---- C:\windows\system32\urlmon.dll
2013-10-17 15:00:08 ----A---- C:\windows\SYSWOW64\wininet.dll
2013-10-17 15:00:08 ----A---- C:\windows\SYSWOW64\jsproxy.dll
2013-10-17 15:00:08 ----A---- C:\windows\system32\jsproxy.dll
2013-10-17 15:00:07 ----A---- C:\windows\SYSWOW64\ieframe.dll
2013-10-17 15:00:07 ----A---- C:\windows\system32\wininet.dll
2013-10-17 15:00:06 ----A---- C:\windows\system32\ieframe.dll
2013-10-17 15:00:05 ----A---- C:\windows\system32\mshtml.dll
2013-10-17 15:00:03 ----A---- C:\windows\SYSWOW64\mshtml.dll
======List of files/folders modified in the last 1 month======
2013-11-13 10:40:17 ----D---- C:\windows\Prefetch
2013-11-13 10:40:12 ----D---- C:\windows\Temp
2013-11-13 10:40:10 ----RD---- C:\Program Files
2013-11-13 10:37:18 ----D---- C:\windows\system32\config
2013-11-13 10:23:05 ----D---- C:\Program Files (x86)\FileZilla FTP Client
2013-11-12 20:16:14 ----D---- C:\Users\jhknip\AppData\Roaming\Skype
2013-11-12 16:59:08 ----D---- C:\windows\System32
2013-11-12 12:25:11 ----D---- C:\windows\inf
2013-11-12 12:25:11 ----A---- C:\windows\system32\PerfStringBackup.INI
2013-11-12 12:23:23 ----A---- C:\windows\SMSCFG.ini
2013-11-12 12:20:26 ----D---- C:\Program Files (x86)\BitComet
2013-11-12 09:35:40 ----SHD---- C:\System Volume Information
2013-11-11 19:51:36 ----SHD---- C:\windows\Installer
2013-11-11 19:51:36 ----D---- C:\Users\jhknip\AppData\Roaming\Mozilla
2013-11-10 11:56:06 ----D---- C:\ProgramData\Skype
2013-11-10 11:55:59 ----RD---- C:\Program Files (x86)
2013-11-10 11:55:59 ----D---- C:\Program Files (x86)\Common Files
2013-11-10 11:49:04 ----D---- C:\Program Files (x86)\Google
2013-11-10 11:48:25 ----D---- C:\windows\Tasks
2013-11-10 11:48:25 ----D---- C:\windows\system32\Tasks
2013-11-10 11:33:36 ----D---- C:\windows\system32\appmgmt
2013-11-10 11:17:57 ----D---- C:\windows\SysWOW64
2013-11-09 18:25:16 ----D---- C:\Users\jhknip\AppData\Roaming\uTorrent
2013-11-04 14:07:55 ----SD---- C:\Users\jhknip\AppData\Roaming\Microsoft
2013-11-04 14:07:54 ----D---- C:\ProgramData\Microsoft Help
2013-10-30 17:03:19 ----D---- C:\windows\system32\drivers
2013-10-30 16:58:06 ----HD---- C:\ProgramData
2013-10-30 15:43:08 ----D---- C:\Windows
2013-10-29 10:39:03 ----D---- C:\Program Files (x86)\uTorrent
2013-10-29 10:28:06 ----D---- C:\ProgramData\PMS
2013-10-27 09:32:56 ----D---- C:\windows\ccmsetup
2013-10-23 11:54:34 ----D---- C:\ProgramData\Oracle
2013-10-23 11:54:14 ----D---- C:\Program Files (x86)\Java
2013-10-21 17:18:33 ----D---- C:\windows\rescache
2013-10-19 17:20:37 ----RSD---- C:\windows\assembly
2013-10-19 17:20:37 ----D---- C:\windows\Microsoft.NET
2013-10-18 19:54:40 ----D---- C:\windows\winsxs
2013-10-18 19:53:20 ----D---- C:\Program Files\Microsoft Silverlight
2013-10-18 19:53:20 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2013-10-18 19:51:23 ----D---- C:\Program Files (x86)\Internet Explorer
2013-10-18 19:51:20 ----D---- C:\Program Files\Internet Explorer
2013-10-18 19:51:18 ----D---- C:\windows\AppPatch
2013-10-18 19:51:17 ----D---- C:\windows\system32\fr-FR
2013-10-18 19:51:17 ----D---- C:\windows\system32\fi-FI
2013-10-18 19:51:17 ----D---- C:\windows\system32\es-ES
2013-10-18 19:51:17 ----D---- C:\windows\system32\en-US
2013-10-18 19:51:17 ----D---- C:\windows\system32\de-DE
2013-10-18 19:51:17 ----D---- C:\windows\system32\da-DK
2013-10-18 19:51:16 ----D---- C:\windows\system32\DriverStore
2013-10-17 15:00:44 ----D---- C:\windows\system32\catroot2
2013-10-17 15:00:44 ----D---- C:\windows\system32\catroot
2013-10-17 14:51:15 ----D---- C:\windows\system32\MRT
2013-10-17 14:47:21 ----A---- C:\windows\system32\MRT.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 rdyboost;ReadyBoost; C:\windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 tmcomm;tmcomm; C:\windows\system32\DRIVERS\tmcomm.sys [2012-11-13 174016]
R1 TmLwf;Trend Micro NDIS 6.0 Filter Driver; C:\windows\system32\DRIVERS\tmlwf.sys [2012-06-21 197432]
R1 tmtdi;Trend Micro TDI Driver; C:\windows\system32\DRIVERS\tmtdi.sys [2010-12-07 108624]
R1 vwififlt;Virtual WiFi Filter Driver; C:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 tmactmon;tmactmon; C:\windows\system32\DRIVERS\tmactmon.sys [2012-10-30 82840]
R2 tmevtmgr;tmevtmgr; C:\windows\system32\DRIVERS\tmevtmgr.sys [2012-10-30 65872]
R2 TmFilter;Trend Micro Filter; \??\C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmXPFlt.sys [2012-07-17 344376]
R2 TmPreFilter;Trend Micro PreFilter; \??\C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmPreFlt.sys [2012-07-17 42808]
R2 tmWfp;Trend Micro WFP Callout Driver; C:\windows\system32\DRIVERS\tmwfp.sys [2012-06-21 338232]
R2 VSApiNt;Trend Micro VSAPI NT; \??\C:\Program Files (x86)\Trend Micro\OfficeScan Client\VSApiNt.sys [2012-07-17 2224952]
R3 dfmirage;dfmirage; C:\windows\system32\DRIVERS\dfmirage.sys [2011-09-26 36432]
R3 e1cexpress;Intel® PRO/1000 PCI Express Network Connection Driver C; C:\windows\system32\DRIVERS\e1c62x64.sys [2012-01-11 360624]
R3 IBMPMDRV;IBMPMDRV; C:\windows\system32\DRIVERS\ibmpmdrv.sys [2012-12-11 42824]
R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd64.sys [2013-02-19 9000256]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHD64.sys [2010-12-10 2676328]
R3 IntcDAud;Intel® Display Audio; C:\windows\system32\DRIVERS\IntcDAud.sys [2011-12-06 331264]
R3 MEIx64;Intel® Management Engine Interface ; C:\windows\system32\DRIVERS\HECIx64.sys [2012-08-06 62784]
R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit; C:\windows\system32\DRIVERS\NETwNs64.sys [2011-10-31 8615936]
R3 RDPDR;Terminal Server Device Redirector Driver; C:\windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
R3 SynTP;Synaptics TouchPad Driver; C:\windows\system32\DRIVERS\SynTP.sys [2013-04-24 460528]
R3 TPM;TPM; C:\windows\system32\drivers\tpm.sys [2009-07-14 38400]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 Acceler;Accelerometer Service; C:\windows\system32\drivers\accelern.sys [2011-09-13 27760]
S3 ApfiltrService;Alps Touch Pad Filter Driver for Windows x64; C:\windows\system32\drivers\Apfiltr.sys [2011-06-21 355960]
S3 BthEnum;Bluetooth Request Block Driver; C:\windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Bluetooth Port Driver; C:\windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
S3 d554gps;Dell Wireless HSPA Mini-Card GPS Port; C:\windows\system32\drivers\d554gps64.sys [2011-08-10 101416]
S3 DIGITECH;DIGITECH; C:\windows\system32\drivers\DIGITECH.sys [2011-02-14 25648]
S3 dmvsc;dmvsc; C:\windows\system32\drivers\dmvsc.sys [2010-11-20 71168]
S3 ecnssndis; Mobile Broadband Driver; C:\windows\System32\Drivers\wwuss64.sys [2011-08-10 26664]
S3 ecnssndisfltr; Mobile Broadband Driver Filter; C:\windows\System32\Drivers\wwussf64.sys [2011-08-10 30248]
S3 esgiguard;esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys []
S3 FTDIBUS;USB Serial Converter Driver; C:\windows\system32\drivers\ftdibus.sys [2011-04-15 69320]
S3 FTSER2K;USB Serial Port Driver; C:\windows\system32\drivers\ftser2k.sys [2011-04-15 84808]
S3 HECIx64;Intel® Management Engine Interface; C:\windows\system32\drivers\HECIx64.sys [2012-08-06 62784]
S3 iaStor;iaStor; C:\windows\system32\drivers\iaStor.sys [2011-02-22 438808]
S3 IFCoEMP;IFCoEMP; C:\windows\system32\drivers\ifM60x64.sys [2011-11-30 388368]
S3 IFCoEVB;IFCoEVB; C:\windows\system32\drivers\ifP52X64.sys [2010-08-13 65808]
S3 Impcd;Impcd; C:\windows\system32\drivers\Impcd.sys [2012-06-11 158976]
S3 iSSetup;iSSetup; C:\windows\system32\drivers\iSSetup.sys [2010-09-29 189664]
S3 Mbm3CBus;Dell Wireless 5530 HSPA Mini-Card Device (WDM); C:\windows\system32\drivers\Mbm3CBus.sys [2011-08-10 411208]
S3 Mbm3DevMt;Dell Wireless HSPA Mini-Card Device Management Driver (WDM); C:\windows\system32\drivers\Mbm3DevMt.sys [2011-08-10 419912]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver; C:\windows\system32\drivers\nusb3hub.sys [2011-02-22 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver; C:\windows\system32\drivers\nusb3xhc.sys [2011-02-22 181248]
S3 nwdelgobi3kfilter;Dell Wireless Gobi 3000 USB Composite Device Filter Driver; C:\windows\system32\drivers\nwdelgobi3kfilter.sys [2011-09-13 34304]
S3 NWDellPort;Dell Wireless Mobile Broadband Status Port Driver; C:\windows\system32\drivers\nwdelser.sys [2011-02-22 217856]
S3 NWDellPort2;Dell Wireless Mobile Broadband Status2 Port Driver; C:\windows\system32\drivers\nwdelser2.sys [2011-02-22 217856]
S3 nwdelserial;Dell Wireless Gobi 3000 USB Device for Legacy Serial Communication; C:\windows\system32\drivers\nwdelserial.sys [2011-09-13 234112]
S3 O2MDFRDR;O2MDFRDR; C:\windows\system32\drivers\O2MDFw7x64.sys [2011-09-13 72808]
S3 O2MDRRDR;O2MDRRDR; C:\windows\system32\drivers\O2MDRw7x64.sys [2011-09-13 74984]
S3 O2SDJRDR;O2SDJRDR; C:\windows\system32\drivers\o2sdjw7x64.sys [2011-09-13 83560]
S3 pciide;pciide; C:\windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 prepdrvr;SMS Process Event Driver; \??\C:\Windows\CCM\prepdrv.sys [2012-02-20 26992]
S3 qcfilterdl2k;Gobi 2000 USB Composite Device Filter Driver(413C-8186); C:\windows\system32\drivers\qcfilterdl2k.sys [2011-02-14 6400]
S3 qcusbserdl2k;Gobi 2000 USB Device for Legacy Serial Communication(413C-8186); C:\windows\system32\drivers\qcusbserdl2k.sys [2011-02-14 230784]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 rimmptsk;rimmptsk; C:\windows\system32\drivers\rimmpx64.sys [2011-02-14 67584]
S3 rimspci;rimspci; C:\windows\system32\drivers\rimspe64.sys [2011-02-14 61952]
S3 rimsptsk;rimsptsk; C:\windows\system32\drivers\rimspx64.sys [2011-02-14 55296]
S3 risdpcie;risdpcie; C:\windows\system32\drivers\risdpe64.sys [2011-02-14 81920]
S3 rismxdp;rismxdp; C:\windows\system32\drivers\rixdpx64.sys [2011-02-14 57856]
S3 rixdpcie;rixdpcie; C:\windows\system32\drivers\rixdpe64.sys [2011-02-14 55808]
S3 s3cap;s3cap; C:\windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 Ser2pl;Prolific Serial port driver; C:\windows\system32\drivers\ser2pl64.sys [2011-04-15 97280]
S3 SNXPPAMD;SUNIX Parallel Port Driver; C:\windows\system32\drivers\snxppamd.sys [2012-03-31 100728]
S3 SNXPSAMD;SUNIX Serial Port Driver; C:\windows\system32\drivers\snxpsamd.sys [2012-03-31 97144]
S3 storvsc;storvsc; C:\windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver; C:\windows\system32\drivers\Synth3dVsc.sys [2010-11-20 88960]
S3 tcm;tcm; C:\windows\system32\drivers\tcm.sys [2011-02-22 17048]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\windows\system32\drivers\terminpt.sys [2012-08-23 29696]
S3 TsUsbFlt;TsUsbFlt; C:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
S3 tsusbhub;Remote Deskotop USB Hub; C:\windows\system32\drivers\tsusbhub.sys [2010-11-20 117248]
S3 USBAAPL64;Apple Mobile USB Driver; C:\windows\System32\Drivers\usbaapl64.sys [2011-05-10 51712]
S3 VGPU;VGPU; C:\windows\System32\drivers\rdvgkmd.sys []
S3 vmbus;vmbus; C:\windows\system32\drivers\vmbus.sys [2010-11-20 199552]
S3 VMBusHID;VMBusHID; C:\windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 vpnva;Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64; C:\windows\system32\DRIVERS\vpnva64.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2011-05-25 37664]
R2 CcmExec;SMS Agent Host; C:\Windows\CCM\CcmExec.exe [2012-02-20 1684848]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\windows\System32\svchost.exe [2009-07-14 27136]
R2 DWMRCS;DameWare Mini Remote Control; C:\Windows\SysWOW64\DWRCS.exe [2010-08-06 242200]
R2 IBMPMSVC;Lenovo PM Service; C:\windows\system32\ibmpmsvc.exe [2012-12-11 60272]
R2 Novell Identity Store;Novell Identity Store; C:\Program Files (x86)\Novell\CASA\bin\micasad.exe [2011-05-26 253952]
R2 Novell ZENworks Agent Service;Novell ZENworks Agent Service; C:\Program Files (x86)\Novell\ZENworks\bin\ZenworksWindowsService.exe [2011-11-05 28672]
R2 ntrtscan;OfficeScan NT RealTime Scan; C:\Program Files (x86)\Trend Micro\OfficeScan Client\ntrtscan.exe [2012-12-06 3015992]
R2 nzwinvnc;Novell ZENworks Remote Management powered by VNC; C:\Program Files (x86)\Novell\ZENworks\bin\nzrWinVNC.exe [2011-11-02 1839104]
R2 srvPlgProtect;Protect your browser's extensions; C:\windows\syswow64\config\systemprofile\AppData\Roaming\okitspace\protect\PluginProtect.exe [2013-11-04 53760]
R2 tmlisten;OfficeScan NT Listener; C:\Program Files (x86)\Trend Micro\OfficeScan Client\tmlisten.exe [2013-01-04 3116656]
R3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 TMBMServer;Trend Micro Unauthorized Change Prevention Service; C:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe [2012-10-30 572464]
R3 TmPfw;OfficeScan NT Firewall; C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmPfw.exe [2011-04-15 596736]
R3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\windows\System32\svchost.exe [2009-07-14 27136]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Google Update-service (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-08 116648]
S2 Net Driver HPZ12;Net Driver HPZ12; C:\windows\System32\svchost.exe [2009-07-14 27136]
S2 Novell ZENworks Image-Safe Data Service;Novell ZENworks ISD Service; C:\Program Files (x86)\Novell\ZENworks\bin\preboot\novell-zisdservice.exe [2011-11-01 90112]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\windows\System32\svchost.exe [2009-07-14 27136]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-09-05 171680]
S3 AppMgmt;@appmgmts.dll,-3250; C:\windows\system32\svchost.exe [2009-07-14 27136]
S3 cphs;Intel® Content Protection HECI Service; C:\windows\SysWow64\IntelCpHeciSvc.exe [2013-02-19 276288]
S3 gupdatem;Google Update-service (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-08 116648]
S3 lpasvc;Microsoft Policy Platform Local Authority; C:\Program Files\Microsoft Policy Platform\policyHost.exe [2011-12-06 50472]
S3 lppsvc;Microsoft Policy Platform Processor; C:\Program Files\Microsoft Policy Platform\policyHost.exe [2011-12-06 50472]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2012-09-20 30785672]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\windows\System32\svchost.exe [2009-07-14 27136]
S3 smstsmgr;ConfigMgr Task Sequence Agent; C:\Windows\CCM\TSManager.exe [2012-02-20 374640]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\windows\System32\svchost.exe [2009-07-14 27136]
S3 TmProxy;OfficeScan NT Proxy Service; C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmProxy.exe [2012-08-08 918064]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\windows\system32\Wat\WatAdminSvc.exe [2013-06-12 1255736]
S4 CmRcService;Configuration Manager Remote Control; C:\Windows\CCM\RemCtrl\CmRcService.exe [2012-02-20 605040]
-----------------EOF-----------------
Hierbij info.txt:
info.txt logfile of random's system information tool 1.09 2013-11-13 10:40:24
======Uninstall list======
-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{536BD74C-E473-4FCA-961F-4D3768997D57}" "1033" "0"
64 Bit HP CIO Components Installer-->MsiExec.exe /I{BC741628-0AFC-405C-8946-DD46D1005A0A}
7-Zip 9.20 (x64 edition)-->MsiExec.exe /I{23170F69-40C1-2702-0920-000001000000}
Action Handler Resources-->MsiExec.exe /I{D01F332D-FC3C-4AA1-9616-2CFD8D6AF538}
actions-langs-->MsiExec.exe /I{0D62BAF1-569B-451D-891C-6D7D5ACF9ACD}
Adobe AIR-->c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{65CB4C08-C47B-4A7E-A6A4-50C06ADA5FC6}
Adobe Flash Player 11 ActiveX-->C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_265_ActiveX.exe -maintain activex
Adobe Reader X (10.1.3)-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-AA1000000001}
Adobe Shockwave Player 11.6-->"C:\Windows\SysWOW64\Adobe\Shockwave 11\uninstaller.exe"
Apple Application Support-->MsiExec.exe /I{B3575D00-27EF-49C2-B9E0-14B3D954E992}
Apple Mobile Device Support-->MsiExec.exe /I{439760BC-7737-4386-9B1D-A90A3E8A22EA}
auth-satellite-server-langs-->MsiExec.exe /I{E1CBDD98-4E47-4C40-8476-B3595EC76DD3}
bundle-langs-->MsiExec.exe /I{A51502AB-E4E3-4B4D-8321-BC0AEE05197C}
CASA-->MsiExec.exe /I{ACF9E8E5-24E5-4683-9A0A-2600D94A4A01}
Citrix XenApp Plugin for Hosted Apps-->MsiExec.exe /I{388C130B-0079-46B4-A0D5-DC2DD7A89A7B}
content-distribution-point-langs-->MsiExec.exe /I{33DD6D87-3F60-45F1-92BF-245CDD3BBA61}
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{E581F27C-B798-42D8-9BD1-0A469A2C97AE}" "1033" "0"
Dell Touchpad-->C:\Program Files\DellTPad\Uninstap.exe ADDREMOVE
DHTML Editing Component-->MsiExec.exe /I{2EA870FA-585F-4187-903D-CB9FFD21E2E0}
doPDF 7.1 printer-->"C:\Program Files\Softland\doPDF 7\unins000.exe"
ECL Viewer-->"C:\Program Files (x86)\SAP\SAPsetup\setup\NwSapSetup.exe" /uninstall /product="ECL710"
FileZilla Client 3.5.3-->C:\Program Files (x86)\FileZilla FTP Client\uninstall.exe
Google Chrome-->"C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\Installer\setup.exe" --uninstall --multi-install --chrome --system-level --verbose-logging
Google Talk Plugin-->MsiExec.exe /I{2A83AD05-56E6-3FBD-8752-B4143162EF59}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Intel® Network Connections Drivers-->Prounstl.exe
Intel® Processor Graphics-->C:\Program Files (x86)\Intel\Intel® Processor Graphics\Uninstall\setup.exe -uninstall
inventory-langs-->MsiExec.exe /I{03CFFBCD-5ABF-42AE-830E-C98FDB0CAE10}
IrfanView (remove only)-->C:\Program Files (x86)\IrfanView\iv_uninstall.exe
Java 7 Update 45-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83217040FF}
JavaFX 2.1.1-->MsiExec.exe /X{1111706F-666A-4037-7777-211328764D10}
Lenovo Power Management Driver-->RunDll32.exe tpinspm.dll,Uninstall
Microsoft .NET Framework 4 Client Profile-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\Setup.exe /repair /x86 /x64 /parameterfolder Client
Microsoft .NET Framework 4 Client Profile-->MsiExec.exe /X{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{047B0968-E622-4FAA-9B4B-121FA109EDDE}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0015-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0016-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0018-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0019-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001A-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001B-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001F-0409-0000-0000000FF1CE}" "{99ACCA38-6DD3-48A8-96AE-A283C9759279}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001F-040C-0000-0000000FF1CE}" "{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001F-0C0A-0000-0000000FF1CE}" "{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-002A-0000-1000-0000000FF1CE}" "{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-002A-0409-1000-0000000FF1CE}" "{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-002C-0409-0000-0000000FF1CE}" "{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0044-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-006E-0409-0000-0000000FF1CE}" "{4560037C-E356-444A-A015-D21F487D809E}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-00A1-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-00BA-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0115-0409-0000-0000000FF1CE}" "{4560037C-E356-444A-A015-D21F487D809E}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0116-0409-1000-0000000FF1CE}" "{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" "1033" "0"
Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0117-0409-0000-0000000FF1CE}" "{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" "1033" "0"
Microsoft Office Access MUI (English) 2010-->MsiExec.exe /X{90140000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2010-->MsiExec.exe /X{90140000-0117-0409-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2010-->MsiExec.exe /X{90140000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2010-->MsiExec.exe /X{90140000-00BA-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2010-->MsiExec.exe /X{90140000-0044-0409-0000-0000000FF1CE}
Microsoft Office Office 64-bit Components 2010-->MsiExec.exe /X{90140000-002A-0000-1000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2010-->MsiExec.exe /X{90140000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2010-->MsiExec.exe /X{90140000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2010-->MsiExec.exe /X{90140000-0018-0409-0000-0000000FF1CE}
Microsoft Office Professional Plus 2010-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2010-->MsiExec.exe /X{90140000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (English) 2010-->MsiExec.exe /X{90140000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2010-->MsiExec.exe /X{90140000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2010-->MsiExec.exe /X{90140000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2010-->MsiExec.exe /X{90140000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2010-->MsiExec.exe /X{90140000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared 64-bit MUI (English) 2010-->MsiExec.exe /X{90140000-002A-0409-1000-0000000FF1CE}
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010-->MsiExec.exe /X{90140000-0116-0409-1000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2010-->MsiExec.exe /X{90140000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2010-->MsiExec.exe /X{90140000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2010-->MsiExec.exe /X{90140000-001B-0409-0000-0000000FF1CE}
Microsoft Policy Platform-->MsiExec.exe /X{376CBB7C-A86E-400D-8702-ABA2EFDE35D7}
Microsoft Redistributable Files (x64)-->MsiExec.exe /I{E6E7128A-0783-4290-9002-1810DD35E5BF}
Microsoft Redistributable Files (x86)-->MsiExec.exe /I{B2CC7AE2-995C-48B7-ACA5-09472AE97A79}
Microsoft redistributable runtime DLLs VS2008 SP1(x86)-->MsiExec.exe /I{A47A9101-6EB5-4314-BDA1-297880FBB908}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Sync Framework 2.0 Core Components (x64) ENU -->MsiExec.exe /I{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}
Microsoft Sync Framework 2.0 Provider Services (x64) ENU -->MsiExec.exe /I{03AC245F-4C64-425C-89CF-7783C1D3AB2C}
Microsoft Visual C++ 2005 Redistributable (x64)-->MsiExec.exe /X{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148-->MsiExec.exe /X{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161-->MsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161-->MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F}
mkv2vob-->MsiExec.exe /X{21AE04E8-EBF6-40DB-9AA9-B7A80C5D057D}
Mozilla Firefox 7.0.1 (x86 en-US)-->C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
MSXML4.0 redistributable-->MsiExec.exe /I{44D66AD9-AE19-4AFD-BE7E-A1B44C856697}
Novell CASA Authentication Token Client (x64)-->MsiExec.exe /I{FE0D2049-AD64-418D-A2BD-5C60B940F27D}
Novell ZENworks Adaptive Agent Help-->MsiExec.exe /I{575FBBED-BB5B-4AC8-9BAE-56D827E27F15}
Novell ZENworks Image-Safe Data Service-->MsiExec.exe /I{896318FC-2642-4A64-82AF-A1720AE3DD5E}
Novell ZENworks Remote Management-->MsiExec.exe /I{9C2F911D-0D45-4528-A535-4423787432C0}
Novell ZENworks-->C:\Program Files (x86)\novell\zenworks\bin\ZENworksUninstall.exe
Paint.NET v3.5.10-->MsiExec.exe /X{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}
Policy Action Handler Resources-->MsiExec.exe /I{6E1C241E-3BF8-472C-9381-3155E9A32C24}
Policy Handler Resources-->MsiExec.exe /I{2F90FD31-6DBE-4D0E-AA28-6D905E2B9206}
policy-langs-->MsiExec.exe /I{B9AAA808-271C-40D2-93E1-957D4E5BBEE7}
primary-agent-langs-->MsiExec.exe /I{3C4529F5-3BA5-4B01-894F-EA105F817D96}
PS3 Media Server-->"C:\Program Files (x86)\PS3 Media Server\uninst.exe"
Realtek High Definition Audio Driver-->C:\Program Files\Realtek\Audio\HDA\RtlUpd64.exe -r -m -nrg2709
remotemanagement-langs-->MsiExec.exe /I{2F9FE4B4-B7F4-4B36-B2BA-01CECA817384}
SAP GUI for Windows 7.20-->"C:\Program Files (x86)\SAP\SAPsetup\setup\NwSapSetup.exe" /uninstall /product="ECL710+BW350+KW710+GUI710ISHMED+GUI710TWEAK+JNet+SAPGUI710+SAPDTS" /TitleComponent:"SAPGUI710" /IgnoreMissingProducts
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {6AF6C62E-4E3D-33BF-A591-9E4D53BDF22F} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {E59B2174-E924-311F-8549-AD714C14664D} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {DA36C2E5-6B34-3A6A-9C0A-7D1CC1C5A768} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {7B82A51A-768B-3A7B-ADFA-F777097A8079} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {E40184A4-4A61-3D2E-9035-CB6E1E610E07} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {4736E989-32D9-3B91-90D7-C68848E118CA} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {F1696E2F-4803-362F-A756-65B363483FE6} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {C8B8456C-6A12-3725-95A8-1C9FBE1E3141} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {8E6848A1-B790-34FE-921A-A5319258E254} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {E7F6B64E-E11F-3D1C-868D-3F1443DA5A15} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {08BB8EA1-3BA7-3AD5-8A07-22A5EC1F704E} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {880A0A36-244B-3C7A-8D6B-56E694CE7883} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {9D8496AE-4030-3E92-B44E-4F81051E6C85} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2858302v2)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {43B6E5D3-56A9-36C1-BD8B-9E1D6920FF11} /parameterfolder Client
Security Update for Microsoft Excel 2010 (KB2826033) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{DC8EDDCF-2031-4C8D-916C-64058A3ACA95}" "1033" "0"
Security Update for Microsoft InfoPath 2010 (KB2687422) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{3F1B010E-91E7-45A2-845E-A8132972C01E}" "1033" "0"
Security Update for Microsoft InfoPath 2010 (KB2760406) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{89F78B33-4282-4698-844D-E306D4260C02}" "1033" "0"
Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{CCC48FE2-175F-4CDE-82DF-F7BC4672C1A3}" "1033" "0"
Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{DCE6D0BF-93E4-46C5-9A7C-F1EFF9707C02}" "1033" "0"
Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{B5489515-6DD4-47A5-AE4E-64751D15F10E}" "1033" "0"
Security Update for Microsoft Office 2010 (KB2687276) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{294CFDA0-FFD3-4C74-A26C-F4AE246783D6}" "1033" "0"
Security Update for Microsoft Office 2010 (KB2687423) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{4D6FE7B6-559F-4DAC-92CF-A01C24046AEB}" "1033" "0"
Security Update for Microsoft Office 2010 (KB2687510) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{A5E549EB-FDD3-4CD1-8163-50D429A36516}" "1033" "0"
Security Update for Microsoft Office 2010 (KB2826023) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{EC2CA755-17D8-4392-A91E-FD4D2DD31072}" "1033" "0"
Security Update for Microsoft Office 2010 (KB2826035) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{0241FB40-015F-42AC-A711-1AE59E346B51}" "1033" "0"
Security Update for Microsoft Outlook 2010 (KB2794707) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{D408797D-5972-4204-B7EB-67254DF0F8CE}" "1033" "0"
Security Update for Microsoft Publisher 2010 (KB2553147) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{77AA05C3-6499-49F2-801D-55BD0E587579}" "1033" "0"
Security Update for Microsoft Visio 2010 (KB2810068) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{BC3AD7F4-A075-4C9E-A33A-0FA4F8EBCA96}" "1033" "0"
Skype™ 6.10-->MsiExec.exe /X{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}
status-collection-point-langs-->MsiExec.exe /I{3C26EE55-6E60-41FB-9771-86BD598A9DFD}
swMSM-->MsiExec.exe /I{612C34C7-5E90-47D8-9B5C-0F717DD82726}
SyncToy 2.1 (x64)-->MsiExec.exe /I{88DAAF05-5A72-46D2-A7C5-C3759697E943}
ThinkPad UltraNav Driver-->rundll32.exe "%ProgramFiles%\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Trend Micro OfficeScan Client-->msiexec /x {ECEA7878-2100-4525-915D-B09174E36971}
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {29C7BE97-DE59-37A2-A687-2ADD5321948A} /parameterfolder Client
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {7D799A81-5661-3159-BF92-754161CED6E6} /parameterfolder Client
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {4DFA8287-EA36-3469-99FE-F568FEC81653} /parameterfolder Client
Update for Microsoft .NET Framework 4 Client Profile (KB2836939)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {8C286FD4-AB38-37A6-BC8A-6F16AFE9AB1F} /parameterfolder Client
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {EFD73366-C059-3D04-9848-59072A15DB53} /parameterfolder Client
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}" "1033" "0"
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{001E8BF3-EDC3-4D5E-9C11-1D0E599B6497}" "1033" "0"
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-002A-0000-1000-0000000FF1CE}" "{001E8BF3-EDC3-4D5E-9C11-1D0E599B6497}" "1033" "0"
Update for Microsoft Office 2010 (KB2553065)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{A8686D24-1E89-43A1-973E-05A258D2B3F8}" "1033" "0"
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{48E1B6C2-7299-4F3F-AA63-42F0ACE55AA4}" "1033" "0"
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{18B3CF2A-73F7-4716-B1AE-86D68726D408}" "1033" "0"
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-006E-0409-0000-0000000FF1CE}" "{73E67A3A-8D61-44EF-90C2-1697C3DBE668}" "1033" "0"
Update for Microsoft Office 2010 (KB2566458)-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{EFB525A0-E1C0-4E32-9968-FE401BC87363}" "1033" "0"
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}" "1033" "0"
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{287A1E92-9E41-4BC1-8920-B3D0E9220800}" "1033" "0"
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{ED31DE9A-3E13-4E2C-9106-E0D8AFFB9FA6}" "1033" "0"
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001F-0409-0000-0000000FF1CE}" "{C4F26A9B-B121-4135-8084-A0D9C780C7C8}" "1033" "0"
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001F-040C-0000-0000000FF1CE}" "{460FF681-BC66-4C38-99DF-7012E03F1EBA}" "1033" "0"
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001F-0C0A-0000-0000000FF1CE}" "{C633216E-FF30-45B6-B2AB-21922A9353EF}" "1033" "0"
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{B1FA5E8C-2342-45AF-8A62-5E860042F8DF}" "1033" "0"
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}" "1033" "0"
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-002A-0000-1000-0000000FF1CE}" "{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}" "1033" "0"
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{35698CB7-AAA2-4577-B505-DBFF504AEF23}" "1033" "0"
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{9CFD026D-EB1C-48C2-9DD2-8E8875F251B2}" "1033" "0"
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{5AA578BB-759C-40FD-9661-A737C0884541}" "1033" "0"
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{BA610006-2C39-4419-9834-CF61AB24810A}" "1033" "0"
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{D7D96A96-F61F-48AD-B2DC-4F4B6938D2AB}" "1033" "0"
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-00A1-0409-0000-0000000FF1CE}" "{9865DC3A-2898-48D9-B96A-46397571C934}" "1033" "0"
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{3EFF1957-7DEA-4C7A-8E9C-2D6D58E4B2ED}" "1033" "0"
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-002A-0000-1000-0000000FF1CE}" "{3EFF1957-7DEA-4C7A-8E9C-2D6D58E4B2ED}" "1033" "0"
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001A-0409-0000-0000000FF1CE}" "{47894754-0FEC-4920-9A65-6C1E732587AC}" "1033" "0"
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{BC6DFBFD-16DD-47E1-A7EF-2C062930FA4F}" "1033" "0"
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001A-0409-0000-0000000FF1CE}" "{1EEFF749-6F29-4F0B-AB08-4C6EA52AA110}" "1033" "0"
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{190EC86F-5867-4D7A-B9F3-D14D82C26F3D}" "1033" "0"
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0018-0409-0000-0000000FF1CE}" "{DA2F7ECE-6629-4A80-9CDE-EC95261B75E2}" "1033" "0"
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{5DA2D071-A54C-47C0-83E5-43C63DBFD936}" "1033" "0"
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-002A-0000-1000-0000000FF1CE}" "{5DA2D071-A54C-47C0-83E5-43C63DBFD936}" "1033" "0"
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{8C55AA83-54C2-4236-A622-78440A411DC5}" "1033" "0"
Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-0000-0000000FF1CE}" "{2B7EA7DF-B822-4C58-B90A-961B6BAF454B}" "1033" "0"
usermanagement-langs-x86_64-->MsiExec.exe /I{101077DE-6B6B-4498-9511-064B24A5FB4F}
vcredist_x86-->MsiExec.exe /I{CEC7A786-A9C8-4EF7-BB59-6518E3B3C878}
VLC media player 1.1.11-->C:\Program Files (x86)\VideoLAN\VLC\uninstall.exe
windows-desktop-langs-x86_64-->MsiExec.exe /I{616CD5C5-FD2F-4765-80FF-ABF2494AB9B1}
WinProxy-langs-->MsiExec.exe /I{D74F8463-6F37-4C6E-A640-6DD7D41D9054}
WRQ Reflection Suite for X 13.0 -->MsiExec.exe /I{70EA032A-BB1D-4DC6-8F21-9AFB30716149}
zencore-agent-langs-->MsiExec.exe /I{0E278127-1BB5-4D32-99BB-6494979723D5}
zennotifyicon-langs-->MsiExec.exe /I{A144A80B-85A9-4815-927B-77D7EE27C087}
ZENworks Action Handlers-->MsiExec.exe /I{70883761-C271-4190-BA0C-907BF53DA105}
ZENworks Action Utilities-->MsiExec.exe /I{C2F31DEF-FDA4-429E-AF9E-E864CB975F9E}
ZENworks Actions-->MsiExec.exe /I{29ABBC7A-3B1B-4474-87FF-AC80BF57DF28}
ZENworks Agent Authentication Satellite Module-->MsiExec.exe /I{CCF4BDD1-FE69-4982-B359-34CD4B46908F}
ZENworks Agent Bundle Management-->MsiExec.exe /I{4CB554D3-12CA-47ED-9EC3-E8BC288301DF}
ZENworks Agent Core Modules-->MsiExec.exe /I{8BE67842-3DE8-4D29-91E9-5858FE866A38}
ZENworks Agent Inventory Management-->MsiExec.exe /I{E2CFC462-CC1E-4F3A-B218-4C20A5A0FEE9}
ZENworks Agent Policy Management-->MsiExec.exe /I{6A4C54AA-7EE8-4F02-90C7-BE4B37C005DE}
ZENworks Agent System Update Module-->MsiExec.exe /I{337DC9CB-E664-49DE-A5CB-361A71AAFF9A}
ZENworks Agent WinProxy Module-->MsiExec.exe /I{FA348083-0203-4BAB-871E-212E4928CFE1}
ZENworks Content Distribution Point-->MsiExec.exe /I{0BCBC3E0-D332-4B1D-8C3D-95E5EFD83B21}
ZENworks Extensions Libraries-->MsiExec.exe /I{24EA7216-C0CC-4DB5-A1FF-FAD74409DC0E}
ZENworks Image Management-->MsiExec.exe /I{C042DBB0-3ECA-4632-B99F-7BC7B2D63318}
ZENworks Image-Safe Data Agent-->MsiExec.exe /I{23797189-74BA-4709-B259-8594680E9564}
ZENworks Imaging Server-->MsiExec.exe /I{A82ED331-3AD1-471D-9785-A21AEDF7CEAA}
ZENworks Information Icon-->MsiExec.exe /I{56A5A797-3594-4F52-88F9-A71F8A3CB67E}
ZENworks Policy Handlers-->MsiExec.exe /I{18A4BAF8-6433-42F5-8700-BFC4BECB8DF3}
ZENworks Policy Libraries-->MsiExec.exe /I{BC87A518-88F3-4A9E-8D56-EE3261468D9F}
ZENworks Primary Agent-->MsiExec.exe /I{BE832C67-3554-41F9-9423-77C441A6F694}
ZENworks Remote Management-->MsiExec.exe /I{D493B8B6-599C-46C9-BB22-2372796C2DF4}
ZENworks Status Collection Point-->MsiExec.exe /I{A547DEEC-AAF7-4E39-88A2-9F1ED855F4D6}
ZENworks Uninstaller-->MsiExec.exe /I{C89AA797-8CF1-46AB-8E8B-7A2B9AFF1740}
ZENworks User Management-->MsiExec.exe /I{98213735-A655-40E7-BE60-DA5E312BE107}
ZENworks Version Information-->MsiExec.exe /I{2B15382C-3EAE-487D-9ABD-858D19AA2401}
ZENworks Windows UI-->MsiExec.exe /I{5BD34C31-97F0-4ED8-82CC-495E9A753A28}
======System event log======
Computer Name: r9ypgx2
Event Code: 4001
Message: WLAN AutoConfig service has successfully stopped.
Record Number: 5541
Source Name: Microsoft-Windows-WLAN-AutoConfig
Time Written: 20130612181312.633995-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM
Computer Name: ZRH2WSN-IMAGE
Event Code: 4
Message: The Intel® Management Engine Interface is being disabled.
Record Number: 5411
Source Name: MEIx64
Time Written: 20130612180946.900834-000
Event Type: Warning
User:
Computer Name: ZRH2WSN-IMAGE
Event Code: 4001
Message: WLAN AutoConfig service has successfully stopped.
Record Number: 5166
Source Name: Microsoft-Windows-WLAN-AutoConfig
Time Written: 20121023193258.003357-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM
Computer Name: ZRH2WSN-IMAGE
Event Code: 10010
Message: The server {9E175B6D-F52A-11D8-B9A5-505054503030} did not register with DCOM within the required timeout.
Record Number: 5129
Source Name: Microsoft-Windows-DistributedCOM
Time Written: 20121023193230.000000-000
Event Type: Error
User:
Computer Name: ZRH2WSN-IMAGE
Event Code: 10010
Message: The server {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} did not register with DCOM within the required timeout.
Record Number: 5127
Source Name: Microsoft-Windows-DistributedCOM
Time Written: 20121023193030.000000-000
Event Type: Error
User:
=====Application event log=====
Computer Name: r9ypgx2
Event Code: 63
Message: A provider, PolicyAgentInstanceProvider, has been registered in the Windows Management Instrumentation namespace ROOT\ccm\policy\S_1_5_21_1457313504_1409406559_3513417977_1002 to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.
Record Number: 2189
Source Name: Microsoft-Windows-WMI
Time Written: 20130612182156.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM
Computer Name: r9ypgx2
Event Code: 215
Message: WinMail (2144) WindowsMail0: The backup has been stopped because it was halted by the client or the connection with the client failed.
Record Number: 2181
Source Name: ESENT
Time Written: 20130612182010.000000-000
Event Type: Error
User:
Computer Name: r9ypgx2
Event Code: 3086
Message: The system locale has changed. Existing data will be deleted and the index must be recreated.
Context: Application, SystemIndex Catalog
Record Number: 2172
Source Name: Microsoft-Windows-Search
Time Written: 20130612182007.000000-000
Event Type: Warning
User:
Computer Name: r9ypgx2
Event Code: 215
Message: WinMail (2980) WindowsMail0: The backup has been stopped because it was halted by the client or the connection with the client failed.
Record Number: 2170
Source Name: ESENT
Time Written: 20130612182001.000000-000
Event Type: Error
User:
Computer Name: ZRH2WSN-IMAGE
Event Code: 1008
Message: The Windows Search Service is starting up and attempting to remove the old search index {Reason: Full Index Reset}.
Record Number: 2132
Source Name: Microsoft-Windows-Search
Time Written: 20130612181306.000000-000
Event Type: Warning
User:
=====Security event log=====
Computer Name: R9YPGX2.emea.gg.group
Event Code: 4656
Message: A handle to an object was requested.
Subject:
Security ID: S-1-5-18
Account Name: R9YPGX2$
Account Domain: GGEMEA
Logon ID: 0x3e7
Object:
Object Server: PlugPlayManager
Object Type: Security
Object Name: PlugPlaySecurityObject
Handle ID: 0x0
Process Information:
Process ID: 0x320
Process Name: C:\Windows\System32\svchost.exe
Access Request Information:
Transaction ID: {00000000-0000-0000-0000-000000000000}
Accesses: Unknown specific access (bit 1)
Access Reasons: -
Access Mask: 0x2
Privileges Used for Access Check: -
Restricted SID Count: 0
Record Number: 8675664
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20131112180204.969740-000
Event Type: Audit Success
User:
Computer Name: R9YPGX2.emea.gg.group
Event Code: 4656
Message: A handle to an object was requested.
Subject:
Security ID: S-1-5-18
Account Name: R9YPGX2$
Account Domain: GGEMEA
Logon ID: 0x3e7
Object:
Object Server: PlugPlayManager
Object Type: Security
Object Name: PlugPlaySecurityObject
Handle ID: 0x0
Process Information:
Process ID: 0x320
Process Name: C:\Windows\System32\svchost.exe
Access Request Information:
Transaction ID: {00000000-0000-0000-0000-000000000000}
Accesses: Unknown specific access (bit 1)
Access Reasons: -
Access Mask: 0x2
Privileges Used for Access Check: -
Restricted SID Count: 0
Record Number: 8675663
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20131112180204.968740-000
Event Type: Audit Success
User:
Computer Name: R9YPGX2.emea.gg.group
Event Code: 4656
Message: A handle to an object was requested.
Subject:
Security ID: S-1-5-18
Account Name: R9YPGX2$
Account Domain: GGEMEA
Logon ID: 0x3e7
Object:
Object Server: PlugPlayManager
Object Type: Security
Object Name: PlugPlaySecurityObject
Handle ID: 0x0
Process Information:
Process ID: 0x320
Process Name: C:\Windows\System32\svchost.exe
Access Request Information:
Transaction ID: {00000000-0000-0000-0000-000000000000}
Accesses: Unknown specific access (bit 1)
Access Reasons: -
Access Mask: 0x2
Privileges Used for Access Check: -
Restricted SID Count: 0
Record Number: 8675662
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20131112180204.966740-000
Event Type: Audit Success
User:
Computer Name: R9YPGX2.emea.gg.group
Event Code: 4656
Message: A handle to an object was requested.
Subject:
Security ID: S-1-5-18
Account Name: R9YPGX2$
Account Domain: GGEMEA
Logon ID: 0x3e7
Object:
Object Server: PlugPlayManager
Object Type: Security
Object Name: PlugPlaySecurityObject
Handle ID: 0x0
Process Information:
Process ID: 0x320
Process Name: C:\Windows\System32\svchost.exe
Access Request Information:
Transaction ID: {00000000-0000-0000-0000-000000000000}
Accesses: Unknown specific access (bit 1)
Access Reasons: -
Access Mask: 0x2
Privileges Used for Access Check: -
Restricted SID Count: 0
Record Number: 8675661
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20131112180204.965740-000
Event Type: Audit Success
User:
Computer Name: R9YPGX2.emea.gg.group
Event Code: 4656
Message: A handle to an object was requested.
Subject:
Security ID: S-1-5-18
Account Name: R9YPGX2$
Account Domain: GGEMEA
Logon ID: 0x3e7
Object:
Object Server: PlugPlayManager
Object Type: Security
Object Name: PlugPlaySecurityObject
Handle ID: 0x0
Process Information:
Process ID: 0x320
Process Name: C:\Windows\System32\svchost.exe
Access Request Information:
Transaction ID: {00000000-0000-0000-0000-000000000000}
Accesses: Unknown specific access (bit 1)
Access Reasons: -
Access Mask: 0x2
Privileges Used for Access Check: -
Restricted SID Count: 0
Record Number: 8675660
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20131112180204.965740-000
Event Type: Audit Success
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=C:\windows\system32;C:\windows;C:\windows\System32\Wbem;C:\windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Novell\ZENworks\bin;C:\Program Files (x86)\Reflection\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=AMD64
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PSModulePath"=%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\
"NUMBER_OF_PROCESSORS"=4
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=Intel64 Family 6 Model 58 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=3a09
"asl.log"=Destination=file
"PLMVIS_61_LIBPATH"=C:\Program Files (x86)\SAP\FrontEnd\SapGui
"UATDATA"=C:\Windows\CCM\UATData\D9F8C395-CAB8-491d-B8AC-179A1FE1BE77
"ZENWORKS_HOME"=C:\Program Files (x86)\Novell\ZENworks
-----------------EOF-----------------
