========== OTL ========== Registry value HKEY_USERS\S-1-5-21-2886813062-4029538973-659229832-1002\Software\Microsoft\Windows\CurrentVersion\Run\\WinSyncProviders deleted successfully. C:\Users\RIRI\AppData\Local\Microsoft\Windows\2523\WinSyncProviders.exe moved successfully. ========== FILES ========== C:\Users\RIRI\AppData\Local\Microsoft\Windows\2523 folder moved successfully. C:\Users\RIRI\AppData\Roaming\hellomoto folder moved successfully. OTL by OldTimer - Version 3.2.54.1 log created on 07252012_130544