OTL logfile created on: 24.02.2012 16:34:40 - Run 1 OTL by OldTimer - Version 3.2.33.1 Folder = C:\Users\Daniem\Desktop 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000414 | Country: Norge | Language: NOR | Date Format: dd.MM.yyyy 5,99 Gb Total Physical Memory | 4,12 Gb Available Physical Memory | 68,70% Memory free 11,98 Gb Paging File | 9,59 Gb Available in Paging File | 80,07% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 97,56 Gb Total Space | 36,75 Gb Free Space | 37,67% Space Free | Partition Type: NTFS Drive E: | 232,88 Gb Total Space | 232,78 Gb Free Space | 99,96% Space Free | Partition Type: NTFS Drive G: | 833,85 Gb Total Space | 487,71 Gb Free Space | 58,49% Space Free | Partition Type: NTFS Computer Name: DANIEM-PC | User Name: Daniem | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2012.02.21 20:14:01 | 000,583,168 | ---- | M] (OldTimer Tools) -- C:\Users\Daniem\Desktop\OTL.exe PRC - [2012.02.18 16:57:08 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2012.02.09 09:08:00 | 002,152,152 | ---- | M] (Lavasoft Limited) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe PRC - [2012.02.09 09:08:00 | 001,187,072 | ---- | M] (Lavasoft Limited) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe PRC - [2012.01.24 17:24:26 | 002,416,480 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgtray.exe PRC - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.10.12 06:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe PRC - [2011.08.02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe PRC - [2010.12.17 11:02:22 | 000,358,808 | ---- | M] (Telenor Norway) -- C:\Program Files (x86)\Telenor Norway\ESUS_TNO\ESUS_TNO.exe PRC - [2010.11.20 13:17:55 | 000,257,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wbem\WmiPrvSE.exe PRC - [2010.07.07 11:33:00 | 000,024,576 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\Ctxfihlp.exe PRC - [2010.07.07 11:27:16 | 001,268,224 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\CTxfispi.exe PRC - [2010.02.12 09:23:12 | 000,286,720 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe PRC - [2009.03.05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2012.02.18 16:57:08 | 001,911,768 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll MOD - [2012.02.18 16:56:14 | 008,527,008 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll MOD - [2010.07.07 11:33:04 | 000,002,560 | ---- | M] () -- C:\Windows\SysWOW64\CtxfiRes.dll MOD - [2009.06.29 09:54:08 | 000,164,864 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV:[b]64bit:[/b] - [2011.12.06 04:11:56 | 000,235,520 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:[b]64bit:[/b] - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:[b]64bit:[/b] - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012.02.15 22:37:57 | 000,481,064 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.02.09 09:08:00 | 002,152,152 | ---- | M] (Lavasoft Limited) [Auto | Running] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service) SRV - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.10.12 06:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe -- (AVGIDSAgent) SRV - [2011.08.02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe -- (avgwd) SRV - [2011.05.24 22:14:58 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service) SRV - [2010.12.17 11:02:22 | 000,358,808 | ---- | M] (Telenor Norway) [Auto | Running] -- C:\Program Files (x86)\Telenor Norway\ESUS_TNO\ESUS_TNO.exe -- (ESUSClient_TNO) SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.02.12 09:23:12 | 000,286,720 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV:[b]64bit:[/b] - [2011.12.23 07:12:12 | 000,069,376 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\Lbd.sys -- (Lbd) DRV:[b]64bit:[/b] - [2011.12.06 04:45:40 | 010,720,256 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:[b]64bit:[/b] - [2011.12.06 03:12:14 | 000,327,168 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:[b]64bit:[/b] - [2011.12.06 01:14:09 | 000,279,616 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV:[b]64bit:[/b] - [2011.10.17 18:40:50 | 000,093,712 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:[b]64bit:[/b] - [2011.10.07 06:23:46 | 000,283,728 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64) DRV:[b]64bit:[/b] - [2011.09.13 06:30:08 | 000,037,456 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64) DRV:[b]64bit:[/b] - [2011.08.08 06:08:58 | 000,046,672 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64) DRV:[b]64bit:[/b] - [2011.07.11 01:14:36 | 000,375,376 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia) DRV:[b]64bit:[/b] - [2011.07.11 01:14:08 | 000,029,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AVGIDSFilter.sys -- (AVGIDSFilter) DRV:[b]64bit:[/b] - [2011.07.11 01:14:06 | 000,120,400 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AVGIDSDriver.sys -- (AVGIDSDriver) DRV:[b]64bit:[/b] - [2011.07.11 01:14:06 | 000,026,704 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AVGIDSEH.sys -- (AVGIDSEH) DRV:[b]64bit:[/b] - [2011.06.10 06:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:[b]64bit:[/b] - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:[b]64bit:[/b] - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:[b]64bit:[/b] - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:[b]64bit:[/b] - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:[b]64bit:[/b] - [2010.11.20 12:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:[b]64bit:[/b] - [2010.07.07 13:21:18 | 001,612,888 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ha20x22k.sys -- (ha20x22k) DRV:[b]64bit:[/b] - [2010.07.07 13:21:06 | 001,567,832 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ha20x2k.sys -- (ha20x2k) DRV:[b]64bit:[/b] - [2010.07.07 13:20:56 | 000,118,360 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\emupia2k.sys -- (emupia) DRV:[b]64bit:[/b] - [2010.07.07 13:20:48 | 000,213,080 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctsfm2k.sys -- (ctsfm2k) DRV:[b]64bit:[/b] - [2010.07.07 13:20:40 | 000,015,960 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctprxy2k.sys -- (ctprxy2k) DRV:[b]64bit:[/b] - [2010.07.07 13:16:32 | 000,179,288 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctoss2k.sys -- (ossrv) DRV:[b]64bit:[/b] - [2010.07.07 13:16:24 | 000,697,816 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctaud2k.sys -- (ctaud2k) Creative Audio Driver (WDM) DRV:[b]64bit:[/b] - [2010.07.07 13:16:14 | 000,580,696 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ctac32k.sys -- (ctac32k) DRV:[b]64bit:[/b] - [2010.07.07 13:16:06 | 001,445,976 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX.SYS) DRV:[b]64bit:[/b] - [2010.07.07 13:16:06 | 001,445,976 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX) DRV:[b]64bit:[/b] - [2010.07.07 13:15:56 | 000,095,320 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT.SYS) DRV:[b]64bit:[/b] - [2010.07.07 13:15:56 | 000,095,320 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT) DRV:[b]64bit:[/b] - [2010.07.07 13:15:50 | 000,230,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT.SYS) DRV:[b]64bit:[/b] - [2010.07.07 13:15:50 | 000,230,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT) DRV:[b]64bit:[/b] - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:[b]64bit:[/b] - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:[b]64bit:[/b] - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:[b]64bit:[/b] - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:[b]64bit:[/b] - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:[b]64bit:[/b] - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:[b]64bit:[/b] - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV - [2012.02.09 09:08:08 | 000,017,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys -- (Lavasoft Kernexplorer) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.online.no IE - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://no.msn.com/?ocid=iehp IE - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = no IE - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 41 DD DA 4D A7 18 CC 01 [binary data] IE - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.startup.homepage: "http://www.google.com/" FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\ [2012.02.09 04:20:20 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.18 16:57:08 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.01.13 18:00:23 | 000,000,000 | ---D | M] [2011.08.09 00:51:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniem\AppData\Roaming\Mozilla\Extensions [2012.02.13 13:59:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniem\AppData\Roaming\Mozilla\Firefox\Profiles\s17v9etn.default\extensions [2012.02.13 13:59:22 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Daniem\AppData\Roaming\Mozilla\Firefox\Profiles\s17v9etn.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b} [2011.12.24 22:28:34 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Daniem\AppData\Roaming\Mozilla\Firefox\Profiles\s17v9etn.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2011.07.10 21:26:23 | 000,000,000 | ---D | M] (Norsk bokmål ordliste) -- C:\Users\Daniem\AppData\Roaming\Mozilla\Firefox\Profiles\s17v9etn.default\extensions\nb-NO@dictionaries.addons.mozilla.org [2012.01.08 09:11:25 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2012.02.09 04:20:20 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES (X86)\AVG\AVG2012\FIREFOX4 () (No name found) -- C:\USERS\DANIEM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S17V9ETN.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI [2012.02.18 16:57:08 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2011.10.03 09:40:59 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2011.11.10 14:23:30 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:[b]64bit:[/b] - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O4:[b]64bit:[/b] - HKLM..\Run: [AsioReg] REGSVR32 /S CTASIO.DLL File not found O4 - HKLM..\Run: [AsioReg] C:\Windows\SysWow64\ctasio.dll (Creative Technology Ltd) O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\SysWow64\Ctxfihlp.exe (Creative Technology Ltd) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [TrojanScanner] C:\Program Files (x86)\Trojan Remover\Trjscan.exe (Simply Super Software) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000..\Run: [Spotify] C:\Users\Daniem\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd) O4 - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O13[b]64bit:[/b] - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites) O15 - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\..Trusted Domains: freerealms.com ([]* in Trusted sites) O15 - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\..Trusted Domains: soe.com ([]* in Trusted sites) O15 - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\..Trusted Domains: sony.com ([]* in Trusted sites) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {99FE5072-78AA-4FEE-89BA-69A5FA55343F} http://download.microsoft.com/download/B/3/A/B3A2EA73-793D-4ABE-992D-C81140384044/igdtoolx.cab (IGDTester Class) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2) O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab (Creative Software AutoUpdate 2) O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab (Creative Software AutoUpdate Support Package) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 130.67.15.198 193.213.112.4 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EE11C4F1-5F52-4264-89C9-A7CBC38BE37D}: DhcpNameServer = 130.67.15.198 193.213.112.4 O18:[b]64bit:[/b] - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll (AVG Technologies CZ, s.r.o.) O18:[b]64bit:[/b] - Protocol\Handler\livecall - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\msnim - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.) O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{0dfda1fe-1f9f-11e1-bb95-406186c3f7c3}\Shell - "" = AutoRun O33 - MountPoints2\{0dfda1fe-1f9f-11e1-bb95-406186c3f7c3}\Shell\AutoRun\command - "" = D:\setup.exe O33 - MountPoints2\{8440294f-8602-11e0-aa80-406186c3f7c3}\Shell - "" = AutoRun O33 - MountPoints2\{8440294f-8602-11e0-aa80-406186c3f7c3}\Shell\AutoRun\command - "" = D:\INSTALL.EXE O34 - HKLM BootExecute: (autocheck autochk *) O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart) O34 - HKLM BootExecute: (lsdelete) O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %* O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs:[b]64bit:[/b] AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2012.02.24 06:38:38 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{29952C91-C459-406A-8E75-C2FF663C6582} [2012.02.24 06:38:26 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{ED42ACAD-11F5-4D35-9FE3-5491316C6A0D} [2012.02.22 16:49:53 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{1F145A31-ABCB-4BCA-85EA-2D02D64796C9} [2012.02.22 16:49:40 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{39657367-6726-4B1C-9B55-FEAA00782599} [2012.02.21 20:14:01 | 000,583,168 | ---- | C] (OldTimer Tools) -- C:\Users\Daniem\Desktop\OTL.exe [2012.02.21 18:35:01 | 004,730,880 | ---- | C] (AVAST Software) -- C:\Users\Daniem\Desktop\aswMBR.exe [2012.02.21 18:17:03 | 000,000,000 | ---D | C] -- C:\Users\Daniem\DoctorWeb [2012.02.21 16:18:50 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{FBA95FC2-6F57-487A-B547-C731235416EC} [2012.02.21 16:18:39 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{C9421980-63B5-45C1-86B2-7266C2733F78} [2012.02.20 02:36:25 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{3CDFCE6C-493F-4FD6-80BC-065589F9915F} [2012.02.20 02:36:14 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{9D22B738-D85E-485D-8B22-4DCB89648F38} [2012.02.19 18:30:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy [2012.02.19 18:30:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2012.02.19 18:30:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy [2012.02.19 12:55:10 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{275DECED-17B6-42B8-B3C8-AE2B9268C525} [2012.02.19 12:54:58 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{0F067558-74F5-4854-B373-23BC11EC0D89} [2012.02.18 16:52:10 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{93A96F79-AF4F-458E-A141-51091F5303DA} [2012.02.18 16:51:59 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{69289E00-15EE-480A-B19E-40112614CEF2} [2012.02.17 16:15:33 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{BFC385FC-1A9B-4FF5-8037-F4E8DC5BC54B} [2012.02.17 16:15:22 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{AC13E3BD-88A5-44F3-B202-0807E2B9B50A} [2012.02.17 15:49:17 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{AEC12087-3FE9-466A-BEE6-A398316A2BEB} [2012.02.16 21:40:00 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{B6EA88D2-5120-43B8-8FAB-864DF4CBB87D} [2012.02.16 21:39:49 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{D343BDBA-A7E8-444A-8DC0-328C5B1321F6} [2012.02.16 03:00:58 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{30376463-9A9A-4747-97A3-73394EAD7D9B} [2012.02.16 03:00:46 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{F2521951-33C5-4485-8174-F6841DE55AE5} [2012.02.15 12:25:41 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{3C0D4A36-87DD-4383-9798-2BEF5AA81BDF} [2012.02.15 12:25:30 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{2365C52C-509E-42AA-AFF6-D45547E6C98F} [2012.02.15 00:25:05 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{3E65FEDE-76D1-4410-929A-22CA01ED5131} [2012.02.15 00:24:51 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{69043442-DC94-4EFE-8826-BCFA4BBB710B} [2012.02.13 13:50:49 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{BFD7AD66-8744-45B4-A944-5A9DFF86FEA0} [2012.02.13 13:50:37 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{A1BECAD0-FF5E-4ADA-AC1D-E57909EE9B43} [2012.02.13 00:32:51 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{DF737B36-D5B4-4FFD-8ED8-D816251D2105} [2012.02.13 00:32:38 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{096EEADC-228D-4D9A-81DD-4F041322D0D6} [2012.02.11 16:24:49 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{FD2957E5-388D-4C27-95E4-DE374B4E6C19} [2012.02.11 16:24:38 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{8F0177DC-40A3-4AA3-B171-F0A29FEF33FD} [2012.02.10 23:16:01 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{D82C3743-7035-4391-B5E0-72E75D617B86} [2012.02.10 23:15:50 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{4288712A-37EE-4574-836C-90AB2862B6C3} [2012.02.09 20:46:05 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{9E4F31DE-515B-45F5-8598-FFDB06F4127D} [2012.02.09 20:45:54 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{935C6D5A-385A-4792-AAEE-B0C55378FC47} [2012.02.09 09:08:09 | 000,055,384 | ---- | C] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys [2012.02.09 09:05:31 | 000,069,376 | ---- | C] (Lavasoft AB) -- C:\Windows\SysNative\drivers\Lbd.sys [2012.02.09 09:05:31 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE [2012.02.09 09:05:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft [2012.02.09 09:05:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft [2012.02.09 09:05:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lavasoft [2012.02.09 08:45:30 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{7CEF8098-E81F-4831-9B2F-A714D2A46FFC} [2012.02.09 08:45:19 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{D701B639-F987-4751-81CE-CBF2274FB5FD} [2012.02.09 08:22:59 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP [2012.02.09 08:07:19 | 000,000,000 | ---D | C] -- C:\Program Files\HitmanPro [2012.02.09 08:06:58 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro [2012.02.09 08:05:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover [2012.02.09 08:05:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trojan Remover [2012.02.09 08:02:08 | 000,000,000 | ---D | C] -- C:\Users\Daniem\Documents\Simply Super Software [2012.02.09 08:02:07 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Roaming\Simply Super Software [2012.02.09 08:02:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software [2012.02.09 07:12:17 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{9E03576F-7B2E-4D9F-8F8A-470DB9055145} [2012.02.09 05:07:52 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Roaming\Malwarebytes [2012.02.09 05:07:44 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.02.09 05:07:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.02.09 05:07:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.02.09 05:07:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.02.09 04:56:42 | 000,000,000 | -H-D | C] -- C:\$AVG [2012.02.09 04:24:01 | 000,000,000 | ---D | C] -- C:\Users\Daniem\Documents\My Received Files [2012.02.09 04:21:56 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Roaming\AVG2012 [2012.02.09 04:20:24 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files [2012.02.09 04:20:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2012 [2012.02.09 04:20:19 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\AVG [2012.02.09 04:19:58 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2012 [2012.02.09 04:19:58 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\AVG [2012.02.09 04:19:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG [2012.02.09 04:14:53 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData [2012.02.09 04:01:19 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{9292F09E-00C5-4BDA-868C-D93A789714FF} [2012.02.09 04:01:09 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{4B9F77AE-6DD2-4BA7-9DF4-7662A3666819} [2012.02.08 17:57:34 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\BigHugeEngine [2012.02.08 17:54:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kingdoms of Amalur Reckoning [2012.02.08 17:41:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Kingdoms of Amalur Reckoning [2012.02.07 16:12:01 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{C9427DA1-9F4D-4EF6-BCAF-E78EFE9BD609} [2012.02.07 16:11:49 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{4CAD43A5-715F-4F84-BA35-25C84ABBB17F} [2012.02.06 15:45:03 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2012.02.06 15:45:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP [2012.02.06 15:44:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center [2012.02.06 15:41:12 | 000,000,000 | ---D | C] -- C:\AMD [2012.02.06 15:32:44 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{7D7D8ACF-D5E9-473B-8E8B-21D0E4217284} [2012.02.06 15:32:33 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{9F90BF80-93C9-4E34-BD58-5D958099868B} [2012.02.05 15:26:37 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{FB1B3AFB-DFA3-404A-85A4-59AEF1908386} [2012.02.05 15:26:27 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{0DA25C67-E1A4-46AF-802B-00774AF9E891} [2012.02.04 20:53:35 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\Spotify [2012.02.04 20:53:19 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Roaming\Spotify [2012.02.04 16:52:04 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{4E026CF8-B626-4468-80F2-A136D0F4050C} [2012.02.04 16:51:53 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{11D44F07-97B2-4EDF-BDAD-A86E8AE407BB} [2012.02.03 16:08:23 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{3BA71F1A-37A0-4391-B278-16F9938561D1} [2012.02.03 16:08:12 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{458AF00C-13A3-40E9-9926-0A63732A86BB} [2012.02.02 15:10:02 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{4EED820C-C5ED-4A0C-94B8-81A9C8441C36} [2012.02.02 15:09:52 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{057808CE-6C90-4531-B35D-DB17854F6881} [2012.02.01 14:34:35 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{D3ECFC96-A1E1-4F55-9B0B-29B403D8EC69} [2012.02.01 14:34:24 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{0BF4BA25-93F5-4037-BEA7-872C001D44AF} [2012.01.31 13:56:24 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{7C9D4BD6-CB63-415C-9108-1AF874BC782E} [2012.01.31 13:56:13 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{BF24F025-CE02-4838-B6F8-C0CF58A5791B} [2012.01.31 01:55:50 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{BEEE548B-6781-49DF-B617-524BF5E2DAD8} [2012.01.31 01:55:39 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{BAB91677-4D8A-4A34-92F7-317EB367B79B} [2012.01.30 13:55:14 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{718DE99B-A2E7-4C8E-8ECF-CFC7D17EC28E} [2012.01.30 13:55:03 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{D9C6B94F-DF4C-463E-99AA-41F1F8065DEF} [2012.01.29 14:23:43 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{2110D600-2871-4A16-AF7D-B679062BE78A} [2012.01.29 14:23:32 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{EA7C4C7F-4105-422A-B98B-248B7A21D2AA} [2012.01.28 18:23:21 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{1F44A3C2-361F-43E3-9AF9-99535A1DEEE0} [2012.01.28 18:23:09 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{DBAA50D1-9806-4891-A256-26003BC318F6} [2012.01.27 15:31:40 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{45A5DB53-81C7-43F0-9A80-5AD2E4BD6A7F} [2012.01.27 15:31:29 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{1FBC6686-8C67-44F6-A5A7-FA0771DB8C67} [2012.01.26 12:57:35 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{8111332C-4B50-4FA7-9982-3E1A84E36481} [2012.01.26 12:57:25 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{16E58E10-4B3D-4BA8-9F59-E972A587D1B6} [2010.07.07 11:36:44 | 000,014,336 | ---- | C] ( ) -- C:\Windows\SysWow64\a3d.dll [2010.07.07 11:10:22 | 000,012,800 | ---- | C] ( ) -- C:\Windows\SysWow64\killapps.exe [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2012.02.24 06:42:15 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.02.24 06:42:15 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.02.24 06:40:46 | 089,921,030 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm [2012.02.24 06:37:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.02.24 06:37:05 | 529,883,135 | -HS- | M] () -- C:\hiberfil.sys [2012.02.23 16:48:23 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000004-00000000-00000000-00001102-0000000B-00411102}.rfx [2012.02.23 16:48:23 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000004-00000000-00000000-00001102-0000000B-00411102}.rfx [2012.02.23 16:48:23 | 000,000,820 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000004-00000000-00000000-00001102-0000000B-00411102}.rfx [2012.02.23 09:06:43 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat [2012.02.23 09:06:43 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat [2012.02.23 06:20:52 | 000,779,266 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.02.23 06:20:52 | 000,652,150 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.02.23 06:20:52 | 000,121,082 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.02.21 20:14:01 | 000,583,168 | ---- | M] (OldTimer Tools) -- C:\Users\Daniem\Desktop\OTL.exe [2012.02.21 18:35:40 | 004,730,880 | ---- | M] (AVAST Software) -- C:\Users\Daniem\Desktop\aswMBR.exe [2012.02.21 18:10:08 | 079,688,168 | ---- | M] () -- C:\Users\Daniem\Desktop\drweb-cureit.exe [2012.02.20 18:31:40 | 000,128,698 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\iavichjg.avm [2012.02.19 18:30:17 | 000,001,286 | ---- | M] () -- C:\Users\Daniem\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk [2012.02.17 16:32:37 | 000,093,739 | ---- | M] () -- C:\Users\Daniem\Desktop\bilde 3.JPG [2012.02.17 16:32:29 | 000,096,624 | ---- | M] () -- C:\Users\Daniem\Desktop\bilde 1(1).JPG [2012.02.15 23:55:12 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk [2012.02.15 11:42:05 | 000,267,888 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.02.11 03:58:05 | 000,360,512 | ---- | M] () -- C:\Users\Daniem\Desktop\img_67631.jpg [2012.02.10 00:57:23 | 000,007,468 | ---- | M] () -- C:\Users\Daniem\Desktop\K0006P0000005001_-_2012.pdf [2012.02.09 09:08:08 | 000,055,384 | ---- | M] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys [2012.02.09 09:08:06 | 000,016,432 | ---- | M] () -- C:\Windows\SysNative\lsdelete.exe [2012.02.09 08:28:13 | 000,025,160 | ---- | M] () -- C:\Windows\SysNative\drivers\hitmanpro36.sys [2012.02.09 08:18:59 | 000,000,668 | ---- | M] () -- C:\Windows\SysNative\.crusader [2012.02.09 08:05:04 | 000,000,058 | ---- | M] () -- C:\user.js [2012.02.09 04:20:19 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\drivers\AVG\incavi.avm [2012.02.09 04:20:19 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\drivers\AVG\iavichjw.avm [2012.02.08 17:54:46 | 000,001,164 | ---- | M] () -- C:\Users\Daniem\Desktop\Kingdoms of Amalur Reckoning.lnk [color=#E56717]========== Files Created - No Company Name ==========[/color] [2012.02.24 06:40:46 | 089,921,030 | ---- | C] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm [2012.02.21 18:07:12 | 079,688,168 | ---- | C] () -- C:\Users\Daniem\Desktop\drweb-cureit.exe [2012.02.20 18:31:40 | 000,128,698 | ---- | C] () -- C:\Windows\SysNative\drivers\AVG\iavichjg.avm [2012.02.19 18:30:17 | 000,001,286 | ---- | C] () -- C:\Users\Daniem\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk [2012.02.17 16:16:23 | 000,096,624 | ---- | C] () -- C:\Users\Daniem\Desktop\bilde 1(1).JPG [2012.02.17 07:16:40 | 000,093,739 | ---- | C] () -- C:\Users\Daniem\Desktop\bilde 3.JPG [2012.02.15 23:55:12 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk [2012.02.11 03:58:04 | 000,360,512 | ---- | C] () -- C:\Users\Daniem\Desktop\img_67631.jpg [2012.02.10 00:57:22 | 000,007,468 | ---- | C] () -- C:\Users\Daniem\Desktop\K0006P0000005001_-_2012.pdf [2012.02.09 10:10:01 | 000,016,432 | ---- | C] () -- C:\Windows\SysNative\lsdelete.exe [2012.02.09 09:06:16 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat [2012.02.09 09:06:16 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat [2012.02.09 08:44:51 | 000,002,486 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk [2012.02.09 08:18:59 | 000,000,668 | ---- | C] () -- C:\Windows\SysNative\.crusader [2012.02.09 08:07:54 | 000,025,160 | ---- | C] () -- C:\Windows\SysNative\drivers\hitmanpro36.sys [2012.02.09 08:05:04 | 000,000,058 | ---- | C] () -- C:\user.js [2012.02.09 08:02:08 | 000,162,304 | ---- | C] () -- C:\Windows\SysWow64\ztvunrar36.dll [2012.02.09 08:02:08 | 000,153,088 | ---- | C] () -- C:\Windows\SysWow64\unrar3.dll [2012.02.09 08:02:08 | 000,077,312 | ---- | C] () -- C:\Windows\SysWow64\ztvunace26.dll [2012.02.09 08:02:08 | 000,075,264 | ---- | C] () -- C:\Windows\SysWow64\unacev2.dll [2012.02.09 04:20:19 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\AVG\incavi.avm [2012.02.09 04:20:19 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\AVG\iavichjw.avm [2012.02.08 17:54:46 | 000,001,164 | ---- | C] () -- C:\Users\Daniem\Desktop\Kingdoms of Amalur Reckoning.lnk [2012.02.04 20:53:35 | 000,001,797 | ---- | C] () -- C:\Users\Daniem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk [2011.12.05 22:04:00 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll [2011.12.05 22:03:52 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll [2011.11.10 03:36:06 | 000,204,960 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2011.11.10 03:36:06 | 000,157,152 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2011.10.25 21:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll [2011.10.01 15:10:13 | 000,764,734 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011.06.07 15:04:33 | 000,007,640 | ---- | C] () -- C:\Users\Daniem\AppData\Local\Resmon.ResmonCfg [2011.05.24 22:07:28 | 000,164,864 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL [2011.05.24 22:07:28 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL [2011.05.22 18:09:09 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2010.07.07 12:23:10 | 000,017,868 | ---- | C] () -- C:\Windows\SysWow64\instwdm.ini [2010.07.07 12:23:06 | 000,000,054 | ---- | C] () -- C:\Windows\SysWow64\ctzapxx.ini [2010.07.07 11:33:04 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CtxfiRes.dll [2010.07.07 11:21:00 | 000,384,647 | ---- | C] () -- C:\Windows\SysWow64\ctdnlstr.dat [2010.07.07 11:21:00 | 000,051,787 | ---- | C] () -- C:\Windows\SysWow64\ctdlang.dat [2010.07.07 11:10:30 | 000,007,680 | ---- | C] () -- C:\Windows\SysWow64\enlocstr.exe [color=#E56717]========== LOP Check ==========[/color] [2011.12.03 01:32:22 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\asoftech [2012.02.09 04:21:56 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\AVG2012 [2012.02.24 16:34:28 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\Azureus [2012.01.19 21:14:56 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\DAEMON Tools Lite [2011.08.22 15:21:36 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\Kalypso Media [2011.10.17 20:10:34 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\Might & Magic Heroes VI [2012.01.19 21:26:13 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\PunkBuster [2012.02.09 08:05:50 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\Simply Super Software [2012.02.24 07:00:54 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\Spotify [2011.09.23 22:41:13 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\Tropico 4 [2012.02.04 16:51:31 | 000,032,620 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Custom Scans ==========[/color] [color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color] [color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color] [2011.02.26 07:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe [2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe [2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe [2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe [2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe [2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe [2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe [2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe [2009.08.03 07:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe [2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe [2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe [2010.11.20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe [2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe [2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe [2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe [2011.02.26 07:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe [2009.08.03 07:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe [color=#A23BEC]< MD5 for: SVCHOST.EXE >[/color] [2009.07.14 02:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\SysWOW64\svchost.exe [2009.07.14 02:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe [2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe [2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\SysNative\svchost.exe [2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe [color=#A23BEC]< MD5 for: USERINIT.EXE >[/color] [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe [color=#A23BEC]< MD5 for: WINLOGON.EXE >[/color] [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe [2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe [color=#A23BEC]< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT /s >[/color] "DisplayName" = @%SystemRoot%\system32\drivers\netbt.sys,-2 "Group" = PNP_TDI "ImagePath" = System32\DRIVERS\netbt.sys "Description" = @%SystemRoot%\system32\drivers\netbt.sys,-1 "ErrorControl" = 1 "Start" = 1 "Type" = 1 "DependOnService" = Tdxtcpip [binary data] "Tag" = 87 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Linkage] "OtherDependencies" = Tcpip [binary data] "Bind" = [Binary data over 100 bytes] "Route" = [Binary data over 100 bytes] "Export" = [Binary data over 100 bytes] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters] "BcastNameQueryCount" = 3 "BcastQueryTimeout" = 750 "CacheTimeout" = 600000 "EnableLMHOSTS" = 1 "NameServerPort" = 137 "NameSrvQueryCount" = 3 "NameSrvQueryTimeout" = 1500 "NbProvider" = _tcp "SessionKeepAlive" = 3600000 "Size/Small/Medium/Large" = 1 "TransportBindName" = \Device\ "UseNewSmb" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces\Tcpip_{0E8DCD8E-DE0D-446D-BC43-E9A6097E23D1}] "NameServerList" = [binary data] "NetbiosOptions" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces\Tcpip_{8536E204-F437-4F36-A0A9-32F91879356D}] "NameServerList" = [binary data] "NetbiosOptions" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces\Tcpip_{D3C3716E-4149-46BA-B80D-559946AF9566}] "NameServerList" = [binary data] "NetbiosOptions" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces\Tcpip_{EE11C4F1-5F52-4264-89C9-A7CBC38BE37D}] "NameServerList" = [binary data] "NetbiosOptions" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Security] "Security" = [Binary data over 100 bytes] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Enum] "0" = Root\LEGACY_NETBT\0000 "Count" = 1 "NextInstance" = 1 [color=#A23BEC]< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS /s >[/color] "Type" = 2 "Start" = 1 "ErrorControl" = 1 "Tag" = 2 "ImagePath" = system32\DRIVERS\netbios.sys "DisplayName" = NetBIOS Interface "Group" = NetBIOSGroup "Description" = NetBIOS Interface [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS\Linkage] "LanaMap" = 01 0A 01 08 01 05 01 00 01 0C 01 0B 01 09 01 07 01 06 01 04 01 02 01 01 01 03 [binary data] "Bind" = [Binary data over 100 bytes] "Route" = [Binary data over 100 bytes] "Export" = [Binary data over 100 bytes] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS\Parameters] "MaxLana" = 12 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS\Enum] "0" = Root\LEGACY_NETBIOS\0000 "Count" = 1 "NextInstance" = 1 [color=#A23BEC]< C:\Windows\assembly\tmp\U\*.* /s >[/color] [color=#A23BEC]< %Temp%\smtmp\1\*.* >[/color] [color=#A23BEC]< %Temp%\smtmp\2\*.* >[/color] [color=#A23BEC]< %Temp%\smtmp\3\*.* >[/color] [color=#A23BEC]< %Temp%\smtmp\4\*.* >[/color] [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:CB0AACC9 < End of report >