OTL logfile created on: 3/21/2012 12:23:51 AM - Run 1 OTL by OldTimer - Version 3.2.39.1 Folder = C:\Users\Root\Downloads\Programs 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 8.00 Gb Total Physical Memory | 5.90 Gb Available Physical Memory | 73.71% Memory free 16.00 Gb Paging File | 13.88 Gb Available in Paging File | 86.75% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 1862.92 Gb Total Space | 574.64 Gb Free Space | 30.85% Space Free | Partition Type: NTFS Computer Name: ROOTX | User Name: Root | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2012/03/21 00:21:51 | 000,594,432 | ---- | M] (OldTimer Tools) -- C:\Users\Root\Downloads\Programs\OTL.exe PRC - [2012/02/09 20:05:32 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2012/01/18 15:47:28 | 000,433,264 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnat.exe PRC - [2012/01/18 15:47:20 | 000,354,416 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnetdhcp.exe PRC - [2012/01/18 13:27:20 | 000,079,872 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe PRC - [2012/01/13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012/01/13 14:53:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2011/12/08 15:16:06 | 000,342,480 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe PRC - [2011/10/11 14:11:30 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2011/10/11 14:09:51 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe PRC - [2011/10/11 14:09:25 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2011/10/11 14:09:23 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2011/10/11 14:09:20 | 000,616,400 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe PRC - [2010/05/25 15:28:58 | 000,263,600 | ---- | M] (Tonec Inc.) -- C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV:[b]64bit:[/b] - [2009/07/14 04:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:[b]64bit:[/b] - [2009/07/14 04:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012/02/23 02:54:51 | 000,489,256 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012/02/09 20:05:32 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2012/01/18 15:47:28 | 000,433,264 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnat.exe -- (VMware NAT Service) SRV - [2012/01/18 15:47:20 | 000,354,416 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnetdhcp.exe -- (VMnetDHCP) SRV - [2012/01/18 15:04:52 | 011,839,488 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe -- (VMwareHostd) SRV - [2012/01/18 13:27:20 | 000,079,872 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe -- (VMAuthdService) SRV - [2012/01/13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011/12/08 15:16:06 | 000,342,480 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService) SRV - [2011/10/11 14:11:30 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011/10/11 14:09:51 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService) SRV - [2011/10/11 14:09:25 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011/10/11 14:09:20 | 000,616,400 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe -- (AntiVirFirewallService) SRV - [2011/08/29 22:11:04 | 000,846,448 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe -- (VMUSBArbService) SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009/06/11 00:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV:[b]64bit:[/b] - [2012/02/15 11:21:25 | 000,132,320 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:[b]64bit:[/b] - [2012/02/08 04:13:32 | 000,149,640 | ---- | M] (Tonec Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\idmwfp.sys -- (IDMWFP) DRV:[b]64bit:[/b] - [2012/01/18 15:47:46 | 000,031,344 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\VMparport.sys -- (VMparport) DRV:[b]64bit:[/b] - [2012/01/18 15:47:44 | 000,063,088 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmx86.sys -- (vmx86) DRV:[b]64bit:[/b] - [2012/01/18 15:46:18 | 000,030,320 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetuserif.sys -- (VMnetuserif) DRV:[b]64bit:[/b] - [2012/01/18 13:06:00 | 000,045,680 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetbridge.sys -- (VMnetBridge) DRV:[b]64bit:[/b] - [2012/01/18 13:06:00 | 000,020,080 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmnetadapter.sys -- (VMnetAdapter) DRV:[b]64bit:[/b] - [2011/12/10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:[b]64bit:[/b] - [2011/12/08 15:42:23 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum) DRV:[b]64bit:[/b] - [2011/12/08 15:42:23 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid) DRV:[b]64bit:[/b] - [2011/12/08 15:42:19 | 000,410,184 | ---- | M] (Logitech) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ladfGSCamd64.sys -- (LADF_CaptureOnly) DRV:[b]64bit:[/b] - [2011/12/08 15:42:19 | 000,341,832 | ---- | M] (Logitech) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ladfGSRamd64.sys -- (LADF_RenderOnly) DRV:[b]64bit:[/b] - [2011/11/04 12:37:00 | 000,146,736 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys -- (VBoxNetAdp) DRV:[b]64bit:[/b] - [2011/10/11 14:12:28 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:[b]64bit:[/b] - [2011/10/11 14:12:24 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:[b]64bit:[/b] - [2011/10/11 14:12:21 | 000,139,512 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avfwot.sys -- (avfwot) DRV:[b]64bit:[/b] - [2011/10/11 14:12:21 | 000,113,768 | ---- | M] (Avira GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\avfwim.sys -- (avfwim) DRV:[b]64bit:[/b] - [2011/09/02 09:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt) DRV:[b]64bit:[/b] - [2011/09/02 09:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt) DRV:[b]64bit:[/b] - [2011/08/29 22:11:04 | 000,039,024 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hcmon.sys -- (hcmon) DRV:[b]64bit:[/b] - [2011/08/29 22:01:10 | 000,037,680 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmusb.sys -- (vmusb) DRV:[b]64bit:[/b] - [2011/08/08 14:59:12 | 000,116,336 | ---- | M] (VMware, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vmci.sys -- (vmci) DRV:[b]64bit:[/b] - [2011/03/11 09:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:[b]64bit:[/b] - [2011/03/11 09:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:[b]64bit:[/b] - [2010/11/21 06:24:43 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:[b]64bit:[/b] - [2010/11/21 06:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:[b]64bit:[/b] - [2010/11/21 06:23:48 | 000,117,248 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tsusbhub.sys -- (tsusbhub) DRV:[b]64bit:[/b] - [2010/11/21 06:23:48 | 000,088,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Synth3dVsc.sys -- (Synth3dVsc) DRV:[b]64bit:[/b] - [2010/11/21 06:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc) DRV:[b]64bit:[/b] - [2010/11/21 06:23:48 | 000,034,816 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\terminpt.sys -- (terminpt) DRV:[b]64bit:[/b] - [2010/11/21 06:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:[b]64bit:[/b] - [2010/11/21 06:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:[b]64bit:[/b] - [2010/09/29 11:34:50 | 000,377,176 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ladfSBVMamd64.sys -- (LADF_SBVM) DRV:[b]64bit:[/b] - [2010/09/29 11:34:48 | 000,062,168 | ---- | M] (Logitech) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ladfDHP2amd64.sys -- (LADF_DHP2) DRV:[b]64bit:[/b] - [2010/08/03 16:25:30 | 000,030,720 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tapoas.sys -- (tapoas) DRV:[b]64bit:[/b] - [2010/07/01 14:21:50 | 000,038,992 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys -- (ScreamBAudioSvc) DRV:[b]64bit:[/b] - [2010/05/10 09:09:36 | 000,617,048 | ---- | M] (TechniSat Digital, S.A.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SkyNET_AMD64.sys -- (SKYNET) DRV:[b]64bit:[/b] - [2010/01/07 03:20:22 | 000,448,512 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RTL8187.sys -- (RTL8187) DRV:[b]64bit:[/b] - [2009/07/14 04:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:[b]64bit:[/b] - [2009/07/14 04:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:[b]64bit:[/b] - [2009/07/14 04:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:[b]64bit:[/b] - [2009/07/14 04:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:[b]64bit:[/b] - [2009/06/10 23:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:[b]64bit:[/b] - [2009/06/10 23:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:[b]64bit:[/b] - [2009/06/10 23:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:[b]64bit:[/b] - [2009/06/10 23:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:[b]64bit:[/b] - [2009/03/18 16:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi) DRV:[b]64bit:[/b] - [2009/03/01 23:05:32 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:[b]64bit:[/b] - [2009/02/24 18:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mcdbus.sys -- (mcdbus) DRV - [2011/08/18 20:43:50 | 000,027,808 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\FinalWire\AIDA64 Extreme Edition\kerneld.x64 -- (AIDA64Driver) DRV - [2011/08/16 13:13:40 | 000,131,336 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysWOW64\drivers\avfwot.sys -- (avfwot) DRV - [2009/07/14 04:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2007/03/03 19:20:44 | 000,057,472 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\WipeFile.sys -- (WipeFile) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3467081549-1835018677-2053729049-1000\SOFTWARE\Microsoft\Internet Explorer\Main,DefaultNetworkProfile = 533844129 IE - HKU\S-1-5-21-3467081549-1835018677-2053729049-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ksa.msn.com/?C=SA IE - HKU\S-1-5-21-3467081549-1835018677-2053729049-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US IE - HKU\S-1-5-21-3467081549-1835018677-2053729049-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 72 5E 7C C2 D3 AA CC 01 [binary data] IE - HKU\S-1-5-21-3467081549-1835018677-2053729049-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-3467081549-1835018677-2053729049-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-3467081549-1835018677-2053729049-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3467081549-1835018677-2053729049-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 64.69.36.41:60000 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..network.proxy.backup.ftp: "83.170.97.240" FF - prefs.js..network.proxy.backup.ftp_port: 60000 FF - prefs.js..network.proxy.backup.socks: "83.170.97.240" FF - prefs.js..network.proxy.backup.socks_port: 60000 FF - prefs.js..network.proxy.backup.ssl: "83.170.97.240" FF - prefs.js..network.proxy.backup.ssl_port: 60000 FF - prefs.js..network.proxy.ftp: "83.170.97.240" FF - prefs.js..network.proxy.ftp_port: 60000 FF - prefs.js..network.proxy.http: "83.170.97.240" FF - prefs.js..network.proxy.http_port: 60000 FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1,192.168.1.1,hackforums.net" FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.socks: "83.170.97.240" FF - prefs.js..network.proxy.socks_port: 60000 FF - prefs.js..network.proxy.ssl: "83.170.97.240" FF - prefs.js..network.proxy.ssl_port: 60000 FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.2.1: C:\Windows\system32\npDeployJava1.dll File not found FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.2.0: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll File not found FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.0.61118.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll File not found FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.0.61118.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/02/18 00:55:43 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\mozilla_cc@internetdownloadmanager.com: C:\Users\Root\AppData\Roaming\IDM\idmmzcc5 [2012/03/12 01:43:14 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey\Extensions\\mozilla_cc@internetdownloadmanager.com: C:\Users\Root\AppData\Roaming\IDM\idmmzcc5 [2012/03/12 01:43:14 | 000,000,000 | ---D | M] [2011/09/22 23:43:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Root\AppData\Roaming\Mozilla\Extensions [2011/09/22 23:43:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Root\AppData\Roaming\Mozilla\Extensions\net.openvpn.client [2012/03/19 05:02:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Root\AppData\Roaming\Mozilla\Firefox\Profiles\s4ivins9.default\extensions [2011/11/11 19:51:52 | 000,000,000 | ---D | M] (WebRank Toolbar) -- C:\Users\Root\AppData\Roaming\Mozilla\Firefox\Profiles\s4ivins9.default\extensions\webrank-toolbar@probcomp.com [2011/08/16 01:16:30 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2012/03/12 01:43:14 | 000,000,000 | ---D | M] (IDM CC) -- C:\USERS\ROOT\APPDATA\ROAMING\IDM\IDMMZCC5 () (No name found) -- C:\USERS\ROOT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S4IVINS9.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI [2012/02/18 00:55:43 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012/02/11 23:50:03 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012/02/11 23:50:03 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml O1 HOSTS File: ([2009/06/11 00:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:[b]64bit:[/b] - BHO: (IDM integration (IDMIEHlprObj Class)) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll (Internet Download Manager, Tonec Inc.) O2:[b]64bit:[/b] - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found. O2 - BHO: (IDM integration (IDMIEHlprObj Class)) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.) O2 - BHO: (LeapFTP Internet Explorer Hook) - {A5479DA1-7843-43A7-B5C0-BE342C77B629} - C:\Program Files (x86)\LeapFTP 3.0\lftpie.dll (LeapWare) O4:[b]64bit:[/b] - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O7 - HKU\S-1-5-21-3467081549-1835018677-2053729049-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8:[b]64bit:[/b] - Extra context menu item: Download all links with IDM - C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm () O8:[b]64bit:[/b] - Extra context menu item: Download with IDM - C:\Program Files (x86)\Internet Download Manager\IEExt.htm () O8:[b]64bit:[/b] - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: Download all links with IDM - C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm () O8 - Extra context menu item: Download with IDM - C:\Program Files (x86)\Internet Download Manager\IEExt.htm () O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105 File not found O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000015 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000016 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000017 - C:\Windows\SysNative\vsocklib.dll (VMware, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\SysWOW64\vsocklib.dll (VMware, Inc.) O13[b]64bit:[/b] - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2FF17871-FEFF-42E7-A759-2CECC8E34661}: DhcpNameServer = 0.0.0.0 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C3CC0E41-54C4-45BC-B9ED-2FC07EF41E27}: DhcpNameServer = 192.168.1.1 192.168.1.1 O18:[b]64bit:[/b] - Protocol\Handler\livecall - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\msnim - No CLSID value found O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %* O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs:[b]64bit:[/b] AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) MsConfig:64bit - State: "startup" - Reg Error: Key error. SafeBootMin:[b]64bit:[/b] 11009181.sys - Driver SafeBootMin:[b]64bit:[/b] AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SafeBootMin:[b]64bit:[/b] Base - Driver Group SafeBootMin:[b]64bit:[/b] Boot Bus Extender - Driver Group SafeBootMin:[b]64bit:[/b] Boot file system - Driver Group SafeBootMin:[b]64bit:[/b] File system - Driver Group SafeBootMin:[b]64bit:[/b] Filter - Driver Group SafeBootMin:[b]64bit:[/b] HelpSvc - Service SafeBootMin:[b]64bit:[/b] PCI Configuration - Driver Group SafeBootMin:[b]64bit:[/b] PNP Filter - Driver Group SafeBootMin:[b]64bit:[/b] Primary disk - Driver Group SafeBootMin:[b]64bit:[/b] sacsvr - Service SafeBootMin:[b]64bit:[/b] SCSI Class - Driver Group SafeBootMin:[b]64bit:[/b] System Bus Extender - Driver Group SafeBootMin:[b]64bit:[/b] vmms - Service SafeBootMin:[b]64bit:[/b] WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin:[b]64bit:[/b] {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin:[b]64bit:[/b] {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin:[b]64bit:[/b] {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin:[b]64bit:[/b] {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin:[b]64bit:[/b] {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin:[b]64bit:[/b] {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin:[b]64bit:[/b] {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin:[b]64bit:[/b] {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin:[b]64bit:[/b] {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin:[b]64bit:[/b] {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin:[b]64bit:[/b] {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin:[b]64bit:[/b] {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin:[b]64bit:[/b] {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin:[b]64bit:[/b] {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin:[b]64bit:[/b] {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin:[b]64bit:[/b] {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin:[b]64bit:[/b] {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootMin: 11009181.sys - Driver SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet:[b]64bit:[/b] 11009181.sys - Driver SafeBootNet:[b]64bit:[/b] AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SafeBootNet:[b]64bit:[/b] Base - Driver Group SafeBootNet:[b]64bit:[/b] Boot Bus Extender - Driver Group SafeBootNet:[b]64bit:[/b] Boot file system - Driver Group SafeBootNet:[b]64bit:[/b] File system - Driver Group SafeBootNet:[b]64bit:[/b] Filter - Driver Group SafeBootNet:[b]64bit:[/b] HelpSvc - Service SafeBootNet:[b]64bit:[/b] Messenger - Service SafeBootNet:[b]64bit:[/b] NDIS Wrapper - Driver Group SafeBootNet:[b]64bit:[/b] NetBIOSGroup - Driver Group SafeBootNet:[b]64bit:[/b] NetDDEGroup - Driver Group SafeBootNet:[b]64bit:[/b] Network - Driver Group SafeBootNet:[b]64bit:[/b] NetworkProvider - Driver Group SafeBootNet:[b]64bit:[/b] PCI Configuration - Driver Group SafeBootNet:[b]64bit:[/b] PNP Filter - Driver Group SafeBootNet:[b]64bit:[/b] PNP_TDI - Driver Group SafeBootNet:[b]64bit:[/b] Primary disk - Driver Group SafeBootNet:[b]64bit:[/b] rdsessmgr - Service SafeBootNet:[b]64bit:[/b] sacsvr - Service SafeBootNet:[b]64bit:[/b] SCSI Class - Driver Group SafeBootNet:[b]64bit:[/b] Streams Drivers - Driver Group SafeBootNet:[b]64bit:[/b] System Bus Extender - Driver Group SafeBootNet:[b]64bit:[/b] TDI - Driver Group SafeBootNet:[b]64bit:[/b] vmms - Service SafeBootNet:[b]64bit:[/b] WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet:[b]64bit:[/b] WudfUsbccidDriver - Driver SafeBootNet:[b]64bit:[/b] {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet:[b]64bit:[/b] {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet:[b]64bit:[/b] {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet:[b]64bit:[/b] {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet:[b]64bit:[/b] {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet:[b]64bit:[/b] {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet:[b]64bit:[/b] {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet:[b]64bit:[/b] {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet:[b]64bit:[/b] {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet:[b]64bit:[/b] {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet:[b]64bit:[/b] {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet:[b]64bit:[/b] {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet:[b]64bit:[/b] {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet:[b]64bit:[/b] {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet:[b]64bit:[/b] {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet:[b]64bit:[/b] {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet:[b]64bit:[/b] {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet:[b]64bit:[/b] {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet:[b]64bit:[/b] {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet:[b]64bit:[/b] {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet:[b]64bit:[/b] {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet:[b]64bit:[/b] {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: 11009181.sys - Driver SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX:[b]64bit:[/b] {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:[b]64bit:[/b] {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:[b]64bit:[/b] {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:[b]64bit:[/b] {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:[b]64bit:[/b] {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:[b]64bit:[/b] {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:[b]64bit:[/b] {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:[b]64bit:[/b] {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:[b]64bit:[/b] {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:[b]64bit:[/b] {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:[b]64bit:[/b] {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:[b]64bit:[/b] {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:[b]64bit:[/b] {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:[b]64bit:[/b] {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:[b]64bit:[/b] {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:[b]64bit:[/b] {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:[b]64bit:[/b] {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:[b]64bit:[/b] {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:[b]64bit:[/b] {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:[b]64bit:[/b] >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:[b]64bit:[/b] >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {9793EDE2-499E-4A14-8220-523691D8F91B} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32:[b]64bit:[/b] msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.l3acm - C:\Windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.) Drivers32: VIDC.VMnc - C:\Windows\SysWow64\vmnc.dll (VMware, Inc.) CREATERESTOREPOINT Restore point Set: OTL Restore Point [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2030/08/29 16:22:31 | 000,143,872 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\iacenc.dll [2012/03/20 22:58:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2012/03/20 22:26:52 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine [2012/03/20 22:25:42 | 002,063,920 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Root\Desktop\TDSSKiller.exe [2012/03/20 22:22:45 | 000,000,000 | ---D | C] -- C:\Users\Root\Desktop\WWE.Monday.Night.RAW.2012.03.19.HDTV.x264-KYR [2012/03/20 22:21:58 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{818FC6DC-4FF9-46D2-B3AB-85C06567F1D1} [2012/03/20 22:21:56 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{F7EA1E17-CA84-456C-B130-8F6316167F1F} [2012/03/20 14:09:04 | 000,000,000 | ---D | C] -- C:\Users\Root\Desktop\New folder [2012/03/20 10:21:31 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{52B8DD49-AAAF-489F-B319-1A8B0D980D15} [2012/03/20 10:21:20 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{1487945F-1E49-49E5-83CA-50EF39047F6C} [2012/03/19 20:17:02 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{DA2CACFE-485B-4BB9-B0D7-67AEFC37BF2E} [2012/03/19 20:16:51 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{51F2F59B-4D0B-49A9-8676-253180D5115E} [2012/03/18 23:15:44 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{BA192447-6FA9-4D99-8B09-3BECB23F5C09} [2012/03/18 23:15:33 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{234C6BBF-486F-4E9E-8E80-2EBBB8D1DD58} [2012/03/18 16:41:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LeapFTP 3.0 [2012/03/16 00:59:04 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{2595A5EB-C8CE-48A6-A8E1-5AC9E2D3C634} [2012/03/16 00:58:53 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{5730992D-F25D-4DDE-913B-2AFC6E7AF29A} [2012/03/14 22:19:05 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{F1D12FC2-47EB-4F9D-A0F3-A2B0B104F65E} [2012/03/14 22:18:54 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{CF9058D2-0E38-4761-AC08-C952BB1C37BF} [2012/03/13 23:43:58 | 005,559,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2012/03/13 23:43:57 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2012/03/13 23:43:57 | 003,913,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2012/03/13 23:41:58 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll [2012/03/13 23:41:58 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll [2012/03/13 23:41:58 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe [2012/03/13 23:41:57 | 001,544,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll [2012/03/13 23:41:52 | 001,112,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorets.dll [2012/03/13 23:41:51 | 001,031,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll [2012/03/13 23:41:51 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll [2012/03/13 18:26:31 | 000,000,000 | ---D | C] -- C:\Users\Root\Desktop\Video [2012/03/13 14:27:43 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{768F1C0C-E5C4-487F-9D73-BF8344D1BC67} [2012/03/13 14:27:31 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{5A9E9B8A-FB4A-4A53-9C42-88C525CF8004} [2012/03/13 14:24:38 | 000,000,000 | ---D | C] -- C:\Users\Root\Desktop\WWE.Monday.Night.RAW.2012.03.12.720p.HDTV.x264-KYR [2012/03/12 16:10:23 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{724EC8EC-C5C7-403B-89BC-8581FA1B7192} [2012/03/12 16:10:12 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{CF578E40-7704-4393-B56D-6C4F5C1825CD} [2012/03/12 00:43:21 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Roaming\Media Player Classic [2012/03/11 05:09:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ProgDVB [2012/03/11 04:40:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elecard [2012/03/11 04:30:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack [2012/03/11 04:13:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Elecard [2012/03/11 04:13:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Elecard [2012/03/10 03:47:42 | 000,000,000 | ---D | C] -- C:\dvbdream [2012/03/10 03:13:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter [2012/03/10 03:13:12 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter [2012/03/10 03:13:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CoreCodec [2012/03/10 03:03:46 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Roaming\ArcSoft [2012/03/09 23:10:28 | 000,671,744 | ---- | C] (Lake Technology Limited, http://www.lake.com.au) -- C:\Windows\SysWow64\DolbyHph.dll [2012/03/09 23:10:28 | 000,089,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\atl71.dll [2012/03/09 22:39:58 | 000,000,000 | ---D | C] -- C:\Program Files\ProgDVB [2012/03/09 22:28:23 | 000,000,000 | -H-D | C] -- C:\ProgramData\{3DBA7F3A-54F5-4A48-86EE-F122FBAAB103} [2012/03/09 21:03:51 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{1BE042A5-B8F1-4D47-B103-34DDCCAFD196} [2012/03/09 21:03:29 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{89C46178-4EEE-4B47-B2EE-EAFC53C3BECE} [2012/03/09 20:55:58 | 000,000,000 | ---D | C] -- C:\ProgramData\CMUV [2012/03/09 20:48:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ProgDVB [2012/03/09 20:45:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TechniSat DVB [2012/03/09 20:45:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Technisat [2012/03/09 20:45:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVBViewer TE2 [2012/03/09 20:45:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVBViewer TE2 [2012/03/09 20:45:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TechniSat DVB [2012/03/09 00:26:28 | 000,617,048 | ---- | C] (TechniSat Digital, S.A.) -- C:\Windows\SysNative\drivers\SkyNET_AMD64.sys [2012/03/07 22:06:51 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{18D008D0-150A-457A-B796-EC40E1DCBEEF} [2012/03/07 22:06:40 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{1B2ECACC-7AFD-40ED-AA15-F98319235460} [2012/03/05 21:28:48 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{47A527A0-C71B-4A8C-A7E6-458618EAB296} [2012/03/05 21:28:38 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{6FD9BC24-A502-4C88-BE8F-C458A8290DAF} [2012/03/04 23:11:44 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{7190D548-DC8B-46AF-8B09-DF8B36F60B0B} [2012/03/04 23:11:33 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{4A08C823-316B-45C6-A056-33B79C218C42} [2012/03/04 10:58:52 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{15D22168-242C-48D6-BDAE-03ABEA2A4752} [2012/03/04 10:58:41 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{19D9C997-78FF-45FF-9EFB-ABAFBD11FA0B} [2012/03/03 21:27:13 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{B1A28C06-8685-4292-8FD2-4D228B665C3A} [2012/03/03 21:26:59 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{BA41CF5A-1989-49F4-8865-EF6DD6E8B354} [2012/03/01 19:36:59 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\LogiShrd [2012/03/01 19:36:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\LogiShrd [2012/03/01 19:36:47 | 000,018,960 | ---- | C] (Logitech, Inc.) -- C:\Windows\SysNative\drivers\LNonPnP.sys [2012/03/01 19:36:10 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Roaming\Logishrd [2012/03/01 19:11:47 | 000,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\SysWow64\CSVer.dll [2012/03/01 19:11:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Intel [2012/03/01 19:11:23 | 000,000,000 | ---D | C] -- C:\Intel [2012/02/29 06:57:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation [2012/02/29 06:55:51 | 025,222,976 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll [2012/02/29 06:55:51 | 019,443,520 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll [2012/02/29 06:55:51 | 017,642,816 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll [2012/02/29 06:55:51 | 017,543,488 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll [2012/02/29 06:55:51 | 008,008,000 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll [2012/02/29 06:55:51 | 005,892,928 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll [2012/02/29 06:55:51 | 002,872,640 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvenc.dll [2012/02/29 06:55:51 | 002,672,448 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll [2012/02/29 06:55:51 | 002,517,312 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll [2012/02/29 06:55:51 | 002,437,440 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvenc.dll [2012/02/29 06:55:51 | 000,068,928 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll [2012/02/29 06:55:51 | 000,061,248 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll [2012/02/29 06:46:40 | 000,000,000 | ---D | C] -- C:\NVIDIA [2012/02/28 14:34:18 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{703D2332-D086-4922-BED7-4C7C4947FCBA} [2012/02/28 14:34:07 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{2F42EFCD-0120-4ECD-9BFD-21A025397CA5} [2012/02/28 12:42:36 | 000,149,640 | ---- | C] (Tonec Inc.) -- C:\Windows\SysNative\drivers\idmwfp.sys [2012/02/27 19:22:44 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{03917EEB-7360-493D-A9FE-25EE20D31760} [2012/02/27 19:22:34 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{1F828F0C-36DB-4A01-B866-3E1D3E0F3D29} [2012/02/24 02:16:37 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{73AA72E3-70AC-415F-B167-1D85107EA945} [2012/02/24 02:16:26 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{40075EA3-CC89-4D55-AE32-601D5D090B15} [2012/02/23 02:45:40 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{71D36FED-14FB-4A3E-8FD5-D235BCC7E651} [2012/02/23 02:45:27 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{AF04DE2D-1225-4615-87E7-98F9113CAE3A} [2012/02/20 21:18:43 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{DD484FD7-DC1B-4033-B14E-E7AD753404B7} [2012/02/20 21:18:29 | 000,000,000 | ---D | C] -- C:\Users\Root\AppData\Local\{FC8CA931-302A-45FA-AD83-66F2A3493B34} [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2030/08/29 16:22:31 | 000,143,872 | ---- | M] (Intel Corporation) -- C:\Windows\SysWow64\iacenc.dll [2030/08/29 16:22:31 | 000,056,832 | ---- | M] () -- C:\Windows\SysWow64\iyvu9_32.dll [2012/03/20 23:07:56 | 000,019,507 | ---- | M] () -- C:\Users\Root\Desktop\blocked.PNG [2012/03/20 22:37:06 | 000,020,672 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012/03/20 22:37:06 | 000,020,672 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012/03/20 22:31:57 | 000,294,216 | ---- | M] () -- C:\Users\Root\Desktop\gmer.zip [2012/03/20 22:30:39 | 000,000,440 | ---- | M] () -- C:\Windows\tasks\PCConfidential.job [2012/03/20 22:30:01 | 000,405,224 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012/03/20 22:29:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012/03/20 22:29:45 | 2146,295,807 | -HS- | M] () -- C:\hiberfil.sys [2012/03/20 22:26:48 | 000,062,344 | ---- | M] () -- C:\Users\Root\Desktop\Capture.PNG [2012/03/20 22:25:34 | 002,044,822 | ---- | M] () -- C:\Users\Root\Desktop\tdsskiller.zip [2012/03/20 17:48:00 | 026,590,477 | ---- | M] () -- C:\Users\Root\Desktop\New folder2.rar [2012/03/20 16:51:57 | 025,437,040 | ---- | M] () -- C:\Users\Root\Desktop\New folder.zip [2012/03/19 22:37:42 | 000,000,600 | ---- | M] () -- C:\Users\Root\AppData\Local\PUTTY.RND [2012/03/19 21:51:08 | 000,398,872 | ---- | M] () -- C:\Users\Root\Desktop\netcat-0.7.1.tar_2.gz [2012/03/18 16:41:31 | 000,000,981 | ---- | M] () -- C:\Users\Root\Application Data\Microsoft\Internet Explorer\Quick Launch\LeapFTP.lnk [2012/03/18 16:41:31 | 000,000,957 | ---- | M] () -- C:\Users\Root\Desktop\LeapFTP.lnk [2012/03/18 01:21:38 | 001,515,770 | ---- | M] () -- C:\Users\Root\Desktop\My Fort - My Empire.zip [2012/03/17 01:24:51 | 007,012,609 | ---- | M] () -- C:\Users\Root\Desktop\Voobly Map Pack v16.rar [2012/03/17 01:23:53 | 000,262,175 | ---- | M] () -- C:\Users\Root\Desktop\Map Pack Update.rar [2012/03/11 04:14:16 | 000,005,040 | ---- | M] () -- C:\ProgramData\johhwvhg.fob [2012/03/10 21:55:34 | 000,002,044 | -H-- | M] () -- C:\Users\Root\Documents\Default.rdp [2012/03/09 21:29:20 | 000,000,000 | ---- | M] () -- C:\Windows\graphedt.INI [2012/03/09 20:45:18 | 000,002,057 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Server4PC.lnk [2012/03/09 20:45:13 | 000,001,011 | ---- | M] () -- C:\Users\Root\Application Data\Microsoft\Internet Explorer\Quick Launch\DVBViewer TE2.lnk [2012/03/09 17:12:06 | 002,063,920 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Root\Desktop\TDSSKiller.exe [2012/03/09 00:43:13 | 000,012,557 | ---- | M] () -- C:\ProgramData\nxnhytee.feu [2012/03/09 00:43:13 | 000,000,000 | ---- | M] () -- C:\ProgramData\733742748 [2012/03/09 00:41:26 | 000,012,557 | ---- | M] () -- C:\ProgramData\mxnhytee.feu [2012/03/07 00:07:35 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012/03/01 19:36:47 | 000,018,960 | ---- | M] (Logitech, Inc.) -- C:\Windows\SysNative\drivers\LNonPnP.sys [color=#E56717]========== Files Created - No Company Name ==========[/color] [2030/08/29 16:22:31 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\iyvu9_32.dll [2012/03/20 23:07:56 | 000,019,507 | ---- | C] () -- C:\Users\Root\Desktop\blocked.PNG [2012/03/20 22:32:05 | 000,302,592 | ---- | C] () -- C:\Users\Root\Desktop\gmer.exe [2012/03/20 22:31:55 | 000,294,216 | ---- | C] () -- C:\Users\Root\Desktop\gmer.zip [2012/03/20 22:29:46 | 000,405,224 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012/03/20 22:26:48 | 000,062,344 | ---- | C] () -- C:\Users\Root\Desktop\Capture.PNG [2012/03/20 22:25:25 | 002,044,822 | ---- | C] () -- C:\Users\Root\Desktop\tdsskiller.zip [2012/03/20 17:47:44 | 026,590,477 | ---- | C] () -- C:\Users\Root\Desktop\New folder2.rar [2012/03/20 16:51:51 | 025,437,040 | ---- | C] () -- C:\Users\Root\Desktop\New folder.zip [2012/03/19 21:51:04 | 000,398,872 | ---- | C] () -- C:\Users\Root\Desktop\netcat-0.7.1.tar_2.gz [2012/03/18 16:41:31 | 000,000,981 | ---- | C] () -- C:\Users\Root\Application Data\Microsoft\Internet Explorer\Quick Launch\LeapFTP.lnk [2012/03/18 16:41:31 | 000,000,969 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LeapFTP.lnk [2012/03/18 16:41:31 | 000,000,957 | ---- | C] () -- C:\Users\Root\Desktop\LeapFTP.lnk [2012/03/18 01:21:28 | 001,515,770 | ---- | C] () -- C:\Users\Root\Desktop\My Fort - My Empire.zip [2012/03/17 01:24:38 | 007,012,609 | ---- | C] () -- C:\Users\Root\Desktop\Voobly Map Pack v16.rar [2012/03/17 01:23:51 | 000,262,175 | ---- | C] () -- C:\Users\Root\Desktop\Map Pack Update.rar [2012/03/11 04:14:16 | 000,005,040 | ---- | C] () -- C:\ProgramData\johhwvhg.fob [2012/03/09 21:29:20 | 000,000,000 | ---- | C] () -- C:\Windows\graphedt.INI [2012/03/09 20:45:18 | 000,002,057 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Server4PC.lnk [2012/03/09 20:45:13 | 000,001,011 | ---- | C] () -- C:\Users\Root\Application Data\Microsoft\Internet Explorer\Quick Launch\DVBViewer TE2.lnk [2012/03/09 00:43:13 | 000,012,557 | ---- | C] () -- C:\ProgramData\nxnhytee.feu [2012/03/09 00:43:13 | 000,000,000 | ---- | C] () -- C:\ProgramData\733742748 [2012/03/09 00:41:26 | 000,012,557 | ---- | C] () -- C:\ProgramData\mxnhytee.feu [2012/02/09 20:05:44 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2012/01/24 16:51:33 | 000,007,611 | ---- | C] () -- C:\Users\Root\AppData\Local\resmon.resmoncfg [2011/12/02 12:35:39 | 000,000,600 | ---- | C] () -- C:\Users\Root\AppData\Local\PUTTY.RND [2011/09/30 14:02:50 | 000,280,904 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011/08/21 03:48:37 | 002,017,582 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011/08/16 07:35:42 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll [color=#E56717]========== LOP Check ==========[/color] [2012/03/21 00:23:42 | 000,000,000 | ---D | M] -- C:\Users\Root\AppData\Roaming\DMCache [2012/03/20 15:02:32 | 000,000,000 | ---D | M] -- C:\Users\Root\AppData\Roaming\IDM [2011/08/16 01:24:20 | 000,000,000 | ---D | M] -- C:\Users\Root\AppData\Roaming\Leadertech [2011/08/16 01:05:14 | 000,000,000 | ---D | M] -- C:\Users\Root\AppData\Roaming\QFX Software [2012/02/19 23:05:30 | 000,000,000 | ---D | M] -- C:\Users\Root\AppData\Roaming\TeamViewer [2012/03/20 17:49:24 | 000,000,000 | ---D | M] -- C:\Users\Root\AppData\Roaming\TS3Client [2011/08/21 18:52:34 | 000,000,000 | ---D | M] -- C:\Users\Root\AppData\Roaming\URSoft [2012/03/20 23:21:07 | 000,000,000 | ---D | M] -- C:\Users\Root\AppData\Roaming\uTorrent [2012/03/20 22:30:39 | 000,000,440 | ---- | M] () -- C:\Windows\Tasks\PCConfidential.job [2012/03/01 07:14:05 | 000,032,580 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Custom Scans ==========[/color] [color=#A23BEC]< %systemroot%\Fonts\*.com >[/color] [2009/07/14 08:32:31 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont [2009/07/14 08:32:31 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont [2009/07/14 08:32:31 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont [2009/07/14 08:32:31 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont [color=#A23BEC]< %systemroot%\Fonts\*.dll >[/color] [color=#A23BEC]< %systemroot%\Fonts\*.ini >[/color] [2009/06/10 23:49:50 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini [color=#A23BEC]< %systemroot%\Fonts\*.ini2 >[/color] [color=#A23BEC]< %systemroot%\Fonts\*.exe >[/color] [color=#A23BEC]< %systemroot%\system32\spool\prtprocs\w32x86\*.* >[/color] [color=#A23BEC]< %systemroot%\REPAIR\*.bak1 >[/color] [color=#A23BEC]< %systemroot%\REPAIR\*.ini >[/color] [color=#A23BEC]< %systemroot%\system32\*.jpg >[/color] [color=#A23BEC]< %systemroot%\*.jpg >[/color] [color=#A23BEC]< %systemroot%\*.png >[/color] [color=#A23BEC]< %systemroot%\*.scr >[/color] [color=#A23BEC]< %systemroot%\*._sy >[/color] [color=#A23BEC]< %APPDATA%\Adobe\Update\*.* >[/color] [color=#A23BEC]< %ALLUSERSPROFILE%\Favorites\*.* >[/color] [color=#A23BEC]< %APPDATA%\Microsoft\*.* >[/color] [color=#A23BEC]< %PROGRAMFILES%\*.* >[/color] [2009/07/14 07:54:24 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini [color=#A23BEC]< %APPDATA%\Update\*.* >[/color] [color=#A23BEC]< %PROGRAMFILES%\bak. /s >[/color] [color=#A23BEC]< %systemroot%\system32\bak. /s >[/color] [color=#A23BEC]< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >[/color] [color=#A23BEC]< %systemroot%\system32\config\systemprofile\*.dat /x >[/color] [color=#A23BEC]< %systemroot%\*.config >[/color] [color=#A23BEC]< %systemroot%\system32\*.db >[/color] [color=#A23BEC]< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >[/color] [2011/11/24 21:05:45 | 000,000,221 | -HS- | M] () -- C:\Users\Root\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini [color=#A23BEC]< %USERPROFILE%\Desktop\*.exe >[/color] [2011/07/16 22:21:04 | 000,302,592 | ---- | M] () -- C:\Users\Root\Desktop\gmer.exe [2012/03/09 17:12:06 | 002,063,920 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Root\Desktop\TDSSKiller.exe [color=#A23BEC]< %PROGRAMFILES%\Common Files\*.* >[/color] [color=#A23BEC]< %systemroot%\*.src >[/color] [color=#A23BEC]< %systemroot%\install\*.* >[/color] [color=#A23BEC]< %systemroot%\system32\DLL\*.* >[/color] [color=#A23BEC]< %systemroot%\system32\HelpFiles\*.* >[/color] [color=#A23BEC]< %systemroot%\system32\rundll\*.* >[/color] [color=#A23BEC]< %systemroot%\winn32\*.* >[/color] [color=#A23BEC]< %systemroot%\Java\*.* >[/color] [color=#A23BEC]< %systemroot%\system32\test\*.* >[/color] [color=#A23BEC]< %systemroot%\system32\Rundll32\*.* >[/color] [color=#A23BEC]< %systemroot%\AppPatch\Custom\*.* >[/color] [color=#A23BEC]< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >[/color] [color=#A23BEC]< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >[/color] [color=#A23BEC]< %PROGRAMFILES%\Internet Explorer\*.tmp >[/color] [color=#A23BEC]< %PROGRAMFILES%\Internet Explorer\*.dat >[/color] [color=#A23BEC]< %USERPROFILE%\My Documents\*.exe >[/color] [color=#A23BEC]< %USERPROFILE%\*.exe >[/color] [color=#A23BEC]< %systemroot%\ADDINS\*.* >[/color] [color=#A23BEC]< %systemroot%\assembly\*.bak2 >[/color] [color=#A23BEC]< %systemroot%\Config\*.* >[/color] [color=#A23BEC]< %systemroot%\REPAIR\*.bak2 >[/color] [color=#A23BEC]< %systemroot%\SECURITY\Database\*.sdb /x >[/color] [2012/02/29 06:56:47 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edb.log [2012/02/29 06:56:47 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edbres00001.jrs [2012/02/29 06:56:47 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edbres00002.jrs [2012/02/29 06:56:47 | 000,786,432 | ---- | M] () -- C:\Windows\SECURITY\Database\edbtmp.log [2012/02/29 06:56:47 | 001,056,768 | ---- | M] () -- C:\Windows\SECURITY\Database\tmp.edb [color=#A23BEC]< %systemroot%\SYSTEM\*.bak2 >[/color] [color=#A23BEC]< %systemroot%\Web\*.bak2 >[/color] [color=#A23BEC]< %systemroot%\Driver Cache\*.* >[/color] [color=#A23BEC]< %PROGRAMFILES%\Mozilla Firefox\*.exe >[/color] [2012/02/18 00:55:43 | 000,125,912 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\Mozilla Firefox\crashreporter.exe [2012/02/18 00:55:43 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [2012/02/18 00:55:43 | 000,016,856 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe [2012/02/18 00:55:43 | 000,269,272 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\Mozilla Firefox\updater.exe [color=#A23BEC]< %ProgramFiles%\Microsoft Common\*.* >[/color] [color=#A23BEC]< %ProgramFiles%\TinyProxy. >[/color] [color=#A23BEC]< %USERPROFILE%\Favorites\*.url /x >[/color] [2012/02/16 03:16:56 | 000,000,402 | -HS- | M] () -- C:\Users\Root\Favorites\desktop.ini [color=#A23BEC]< %systemroot%\system32\*.bk >[/color] [color=#A23BEC]< %systemroot%\*.te >[/color] [color=#A23BEC]< %systemroot%\system32\system32\*.* >[/color] [color=#A23BEC]< %ALLUSERSPROFILE%\*.dat /x >[/color] [2012/03/09 00:43:13 | 000,000,000 | ---- | M] () -- C:\ProgramData\733742748 [2012/03/11 04:14:16 | 000,005,040 | ---- | M] () -- C:\ProgramData\johhwvhg.fob [2012/03/09 00:41:26 | 000,012,557 | ---- | M] () -- C:\ProgramData\mxnhytee.feu [2012/03/09 00:43:13 | 000,012,557 | ---- | M] () -- C:\ProgramData\nxnhytee.feu [color=#A23BEC]< %systemroot%\*. /mp /s >[/color] [color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color] [color=#A23BEC]< %systemroot%\system32\*.exe /lockedfiles >[/color] [color=#A23BEC]< %systemroot%\Tasks\*.job /lockedfiles >[/color] [color=#A23BEC]< %systemroot%\system32\drivers\*.sys /lockedfiles >[/color] [color=#A23BEC]< %systemroot%\System32\config\*.sav >[/color] [color=#A23BEC]< %systemroot%\system32\*.sys >[/color] [2011/03/18 19:08:56 | 000,029,592 | ---- | M] (Almico Software) -- C:\Windows\system32\speedfan.sys [color=#A23BEC]< %systemroot%\system32\drivers\*.dll >[/color] [color=#A23BEC]< %systemroot%\system32\drivers\*.ini >[/color] [color=#A23BEC]< %systemroot%\system32\drivers\*.exe >[/color] [color=#A23BEC]< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >[/color] [color=#A23BEC]< %SYSTEMDRIVE%\*.* >[/color] [2012/01/26 20:22:36 | 000,001,024 | ---- | M] () -- C:\.rnd [2012/03/20 22:29:45 | 2146,295,807 | -HS- | M] () -- C:\hiberfil.sys [2012/03/20 22:29:45 | 4293,386,239 | -HS- | M] () -- C:\pagefile.sys [2012/03/20 22:28:58 | 000,087,902 | ---- | M] () -- C:\TDSSKiller.2.7.20.0_20.03.2012_22.25.48_log.txt [2012/03/20 22:32:04 | 000,086,490 | ---- | M] () -- C:\TDSSKiller.2.7.20.0_20.03.2012_22.31.14_log.txt [2007/11/07 08:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp [color=#A23BEC]< %PROGRAMFILES%\*. >[/color] [2011/09/21 14:05:55 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Adobe [2011/10/11 14:16:51 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Avira [2012/03/11 04:13:02 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Common Files [2012/03/10 03:13:10 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\CoreCodec [2012/03/09 20:45:13 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\DVBViewer TE2 [2012/03/11 04:39:59 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Elecard [2012/03/20 22:58:23 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\ESET [2011/11/29 13:22:51 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\EVGA Precision [2011/10/04 13:36:32 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\FinalWire [2012/03/09 20:44:39 | 000,000,000 | -H-D | M] -- C:\Program Files (x86)\InstallShield Installation Information [2012/03/01 19:11:47 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Intel [2012/03/12 01:53:46 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Internet Download Manager [2012/02/16 03:15:19 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Internet Explorer [2012/03/11 04:31:18 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\K-Lite Codec Pack [2012/03/18 16:41:50 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\LeapFTP 3.0 [2012/02/05 21:23:07 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\MagicISO [2012/02/01 13:07:17 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012/02/05 16:30:04 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Microsoft Games [2011/12/17 13:44:00 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Microsoft Silverlight [2012/02/09 14:28:29 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Microsoft.NET [2012/03/19 19:58:11 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox [2009/07/14 08:32:38 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\MSBuild [2011/09/21 14:05:28 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\MSXML 4.0 [2012/02/29 06:56:46 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\NVIDIA Corporation [2011/09/22 23:43:01 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\OpenVPN Technologies [2011/09/03 18:16:49 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\PrivacyEraser Computing [2012/03/16 19:41:06 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\ProgDVB [2012/01/01 19:59:38 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Real [2011/12/08 12:26:06 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Realtek [2009/07/14 08:32:38 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Reference Assemblies [2012/03/09 20:37:00 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\SpeedFan [2012/03/20 23:26:49 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Steam [2012/03/09 20:46:04 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\TechniSat DVB [2012/01/05 19:48:08 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\URUSoft [2012/02/21 12:09:11 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\uTorrent [2012/01/26 20:22:01 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\VMware [2012/02/15 05:34:43 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Voobly [2011/08/16 00:28:03 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Defender [2011/11/24 20:57:04 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Live [2011/08/16 00:28:03 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Mail [2009/07/14 08:32:38 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows NT [2011/08/16 00:28:03 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Photo Viewer [2010/11/21 06:31:38 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Portable Devices [2011/08/16 00:28:03 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Windows Sidebar [2012/01/24 11:55:22 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Your Uninstaller! 7 [color=#A23BEC]< %appdata%\*.* >[/color] [color=#A23BEC]< MD5 for: AGP440.SYS >[/color] [2009/07/14 04:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys [2009/07/14 04:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys [2009/07/14 04:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys [color=#A23BEC]< MD5 for: ATAPI.SYS >[/color] [2009/07/14 04:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys [2009/07/14 04:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys [2009/07/14 04:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys [color=#A23BEC]< MD5 for: CNGAUDIT.DLL >[/color] [2009/07/14 04:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009/07/14 04:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll [2009/07/14 04:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll [2009/07/14 04:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll [color=#A23BEC]< MD5 for: DISK.SYS >[/color] [2009/07/14 04:47:48 | 000,073,280 | ---- | M] (Microsoft Corporation) MD5=9819EEE8B5EA3784EC4AF3B137A5244C -- C:\Windows\SysNative\drivers\disk.sys [2009/07/14 04:47:48 | 000,073,280 | ---- | M] (Microsoft Corporation) MD5=9819EEE8B5EA3784EC4AF3B137A5244C -- C:\Windows\SysNative\DriverStore\FileRepository\disk.inf_amd64_neutral_10ce25bbc5a9cc43\disk.sys [2009/07/14 04:47:48 | 000,073,280 | ---- | M] (Microsoft Corporation) MD5=9819EEE8B5EA3784EC4AF3B137A5244C -- C:\Windows\winsxs\amd64_disk.inf_31bf3856ad364e35_6.1.7600.16385_none_55bb738b8ddd8a01\disk.sys [color=#A23BEC]< MD5 for: IASTORV.SYS >[/color] [2010/11/21 06:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys [2010/11/21 06:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys [2011/03/11 09:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys [2011/03/11 09:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys [2011/03/11 09:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys [2011/03/11 09:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys [color=#A23BEC]< MD5 for: NETLOGON.DLL >[/color] [2010/11/21 06:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll [2010/11/21 06:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll [2010/11/21 06:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll [2010/11/21 06:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll [color=#A23BEC]< MD5 for: NVSTOR.SYS >[/color] [2011/03/11 09:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys [2011/03/11 09:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys [2011/03/11 09:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys [2011/03/11 09:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys [2010/11/21 06:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys [2010/11/21 06:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys [color=#A23BEC]< MD5 for: SCECLI.DLL >[/color] [2010/11/21 06:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll [2010/11/21 06:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll [2010/11/21 06:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll [2010/11/21 06:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll [color=#A23BEC]< MD5 for: USBSTOR.SYS >[/color] [2011/03/11 07:21:50 | 000,091,648 | ---- | M] (Microsoft Corporation) MD5=36106AC439EDFBB7B8BDBF99079C7590 -- C:\Windows\winsxs\amd64_usbstor.inf_31bf3856ad364e35_6.1.7601.21680_none_a6e64054c7cca389\USBSTOR.SYS [2010/11/21 06:23:47 | 000,091,648 | ---- | M] (Microsoft Corporation) MD5=D76510CFA0FC09023077F22C2F979D86 -- C:\Windows\SysNative\DriverStore\FileRepository\usbstor.inf_amd64_neutral_0725c2806a159a9d\USBSTOR.SYS [2010/11/21 06:23:47 | 000,091,648 | ---- | M] (Microsoft Corporation) MD5=D76510CFA0FC09023077F22C2F979D86 -- C:\Windows\winsxs\amd64_usbstor.inf_31bf3856ad364e35_6.1.7601.17514_none_a6ac5425ae72a584\USBSTOR.SYS [2011/03/11 07:37:16 | 000,091,648 | ---- | M] (Microsoft Corporation) MD5=FED648B01349A3C8395A5169DB5FB7D6 -- C:\Windows\SysNative\drivers\USBSTOR.SYS [2011/03/11 07:37:16 | 000,091,648 | ---- | M] (Microsoft Corporation) MD5=FED648B01349A3C8395A5169DB5FB7D6 -- C:\Windows\SysNative\DriverStore\FileRepository\usbstor.inf_amd64_neutral_26b33263a639795d\USBSTOR.SYS [2011/03/11 07:37:16 | 000,091,648 | ---- | M] (Microsoft Corporation) MD5=FED648B01349A3C8395A5169DB5FB7D6 -- C:\Windows\winsxs\amd64_usbstor.inf_31bf3856ad364e35_6.1.7601.17577_none_a66e757baea0992f\USBSTOR.SYS [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >[/color] [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 178 bytes -> C:\ProgramData\TEMP:1CE11B51 < End of report >