OTL logfile created on: 5/4/2013 9:54:51 PM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = H:\ Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = ) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.96 Gb Total Physical Memory | 2.59 Gb Available Physical Memory | 87.55% Memory free 2.96 Gb Paging File | 2.60 Gb Available in Paging File | 87.70% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = X: | %SystemRoot% = X:\windows | %ProgramFiles% = X:\Program Files Drive C: | 200.00 Mb Total Space | 157.62 Mb Free Space | 78.81% Space Free | Partition Type: NTFS Drive D: | 30.24 Gb Total Space | 29.57 Gb Free Space | 97.79% Space Free | Partition Type: NTFS Drive E: | 420.57 Gb Total Space | 275.74 Gb Free Space | 65.56% Space Free | Partition Type: NTFS Drive F: | 14.75 Gb Total Space | 8.36 Gb Free Space | 56.65% Space Free | Partition Type: NTFS Drive H: | 7.45 Gb Total Space | 7.24 Gb Free Space | 97.25% Space Free | Partition Type: NTFS Drive X: | 31.39 Mb Total Space | 28.96 Mb Free Space | 92.26% Space Free | Partition Type: NTFS Computer Name: MININT-UKHS7O3 | User Name: SYSTEM | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2013/05/04 17:37:32 | 000,602,112 | ---- | M] (OldTimer Tools) -- H:\OTL.exe PRC - [2009/07/13 18:51:47 | 000,602,112 | ---- | M] (Microsoft Corporation) -- X:\sources\recovery\RecEnv.exe PRC - [2009/07/13 17:14:45 | 000,565,760 | ---- | M] (Microsoft Corporation) -- X:\Windows\System32\winpeshl.exe PRC - [2009/07/13 17:14:15 | 000,301,568 | ---- | M] (Microsoft Corporation) -- X:\Windows\System32\cmd.exe PRC - [2009/07/13 17:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- X:\Windows\System32\conhost.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] [color=#E56717]========== Services (SafeList) ==========[/color] SRV - [2009/07/13 17:16:13 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- X:\Windows\System32\sacsvr.dll -- (sacsvr) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009/07/13 18:38:07 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- X:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2009/07/13 18:38:07 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- X:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2009/07/13 18:38:07 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- X:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2009/07/13 18:38:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- X:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2009/07/13 17:19:03 | 000,080,464 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- X:\Windows\System32\drivers\sacdrv.sys -- (sacdrv) DRV - [2009/07/13 15:46:05 | 000,022,016 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- X:\Windows\System32\drivers\ramdisk.sys -- (Ramdisk) DRV - [2009/07/13 15:18:10 | 000,069,632 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- X:\Windows\System32\drivers\fbwf.sys -- (FBWF) DRV - [2009/07/13 15:17:59 | 000,053,248 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- X:\windows\System32\drivers\wimfsf.sys -- (WimFsf) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] O1 HOSTS File: ([2009/06/10 13:39:37 | 000,000,824 | ---- | M]) - X:\windows\System32\Drivers\etc\hosts O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableMIC = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIPI = 0 O13 - ftp Prefix: missing O13 - gopher Prefix: missing O13 - home Prefix: missing O13 - mosaic Prefix: missing O13 - www Prefix: missing O20 - HKLM Winlogon: Shell - (cmd.exe) - X:\windows\System32\cmd.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (/k start cmd.exe) - File not found O20 - HKLM Winlogon: UserInit - (X:\windows\system32\userinit.exe) - X:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - File not found O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/06/10 13:42:20 | 000,000,024 | ---- | M] () - E:\autoexec.bat -- [ NTFS ] O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2013/05/04 21:39:31 | 000,000,000 | ---D | C] -- X:\windows\debug [2013/05/04 21:39:30 | 000,000,000 | --SD | C] -- X:\windows\System32\Microsoft [2013/05/04 21:39:30 | 000,000,000 | ---D | C] -- X:\windows\ServiceProfiles [2013/05/04 15:21:40 | 000,000,000 | ---D | C] -- \sources [2013/05/04 15:21:40 | 000,000,000 | ---D | C] -- \boot [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2013/05/04 21:40:57 | 000,076,760 | ---- | M] () -- X:\windows\System32\FNTCACHE.DAT [color=#E56717]========== Files Created - No Company Name ==========[/color] [2013/05/04 21:39:29 | 000,076,760 | ---- | C] () -- X:\windows\System32\FNTCACHE.DAT [2013/05/04 17:54:12 | 001,317,217 | ---- | C] () -- \FRST.exe [2013/05/04 17:54:09 | 000,602,112 | ---- | C] () -- \OTL.exe [2013/05/04 15:21:54 | 000,383,562 | ---- | C] () -- \bootmgr [color=#E56717]========== ZeroAccess Check ==========[/color] [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2009/07/13 17:16:14 | 012,866,560 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009/07/13 18:52:43 | 000,605,696 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/13 18:52:43 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [color=#E56717]========== LOP Check ==========[/color] [color=#E56717]========== Purity Check ==========[/color] < End of report >