*.Txt files attached
OTL logfile created on: 24.02.2012 16:34:40 - Run 1
OTL by OldTimer - Version 3.2.33.1 Folder = C:\Users\Daniem\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000414 | Country: Norge | Language: NOR | Date Format: dd.MM.yyyy
5,99 Gb Total Physical Memory | 4,12 Gb Available Physical Memory | 68,70% Memory free
11,98 Gb Paging File | 9,59 Gb Available in Paging File | 80,07% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,56 Gb Total Space | 36,75 Gb Free Space | 37,67% Space Free | Partition Type: NTFS
Drive E: | 232,88 Gb Total Space | 232,78 Gb Free Space | 99,96% Space Free | Partition Type: NTFS
Drive G: | 833,85 Gb Total Space | 487,71 Gb Free Space | 58,49% Space Free | Partition Type: NTFS
Computer Name: DANIEM-PC | User Name: Daniem | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ========== PRC - [2012.02.21 20:14:01 | 000,583,168 | ---- | M] (OldTimer Tools) -- C:\Users\Daniem\Desktop\OTL.exe
PRC - [2012.02.18 16:57:08 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012.02.09 09:08:00 | 002,152,152 | ---- | M] (Lavasoft Limited) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2012.02.09 09:08:00 | 001,187,072 | ---- | M] (Lavasoft Limited) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2012.01.24 17:24:26 | 002,416,480 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
PRC - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.10.12 06:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe
PRC - [2011.08.02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
PRC - [2010.12.17 11:02:22 | 000,358,808 | ---- | M] (Telenor Norway) -- C:\Program Files (x86)\Telenor Norway\ESUS_TNO\ESUS_TNO.exe
PRC - [2010.11.20 13:17:55 | 000,257,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
PRC - [2010.07.07 11:33:00 | 000,024,576 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\Ctxfihlp.exe
PRC - [2010.07.07 11:27:16 | 001,268,224 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\CTxfispi.exe
PRC - [2010.02.12 09:23:12 | 000,286,720 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
PRC - [2009.03.05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
========== Modules (No Company Name) ========== MOD - [2012.02.18 16:57:08 | 001,911,768 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2012.02.18 16:56:14 | 008,527,008 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
MOD - [2010.07.07 11:33:04 | 000,002,560 | ---- | M] () -- C:\Windows\SysWOW64\CtxfiRes.dll
MOD - [2009.06.29 09:54:08 | 000,164,864 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL
========== Win32 Services (SafeList) ========== SRV:
64bit: - [2011.12.06 04:11:56 | 000,235,520 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:
64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:
64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.02.15 22:37:57 | 000,481,064 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.02.09 09:08:00 | 002,152,152 | ---- | M] (Lavasoft Limited) [Auto | Running] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.10.12 06:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011.08.02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2011.05.24 22:14:58 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2010.12.17 11:02:22 | 000,358,808 | ---- | M] (Telenor Norway) [Auto | Running] -- C:\Program Files (x86)\Telenor Norway\ESUS_TNO\ESUS_TNO.exe -- (ESUSClient_TNO)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.12 09:23:12 | 000,286,720 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
========== Driver Services (SafeList) ========== DRV:
64bit: - [2011.12.23 07:12:12 | 000,069,376 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\Lbd.sys -- (Lbd)
DRV:
64bit: - [2011.12.06 04:45:40 | 010,720,256 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:
64bit: - [2011.12.06 03:12:14 | 000,327,168 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:
64bit: - [2011.12.06 01:14:09 | 000,279,616 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:
64bit: - [2011.10.17 18:40:50 | 000,093,712 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:
64bit: - [2011.10.07 06:23:46 | 000,283,728 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:
64bit: - [2011.09.13 06:30:08 | 000,037,456 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:
64bit: - [2011.08.08 06:08:58 | 000,046,672 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:
64bit: - [2011.07.11 01:14:36 | 000,375,376 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:
64bit: - [2011.07.11 01:14:08 | 000,029,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV:
64bit: - [2011.07.11 01:14:06 | 000,120,400 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV:
64bit: - [2011.07.11 01:14:06 | 000,026,704 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AVGIDSEH.sys -- (AVGIDSEH)
DRV:
64bit: - [2011.06.10 06:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:
64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:
64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:
64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:
64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:
64bit: - [2010.11.20 12:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:
64bit: - [2010.07.07 13:21:18 | 001,612,888 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ha20x22k.sys -- (ha20x22k)
DRV:
64bit: - [2010.07.07 13:21:06 | 001,567,832 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ha20x2k.sys -- (ha20x2k)
DRV:
64bit: - [2010.07.07 13:20:56 | 000,118,360 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\emupia2k.sys -- (emupia)
DRV:
64bit: - [2010.07.07 13:20:48 | 000,213,080 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV:
64bit: - [2010.07.07 13:20:40 | 000,015,960 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctprxy2k.sys -- (ctprxy2k)
DRV:
64bit: - [2010.07.07 13:16:32 | 000,179,288 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctoss2k.sys -- (ossrv)
DRV:
64bit: - [2010.07.07 13:16:24 | 000,697,816 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctaud2k.sys -- (ctaud2k) Creative Audio Driver (WDM)
DRV:
64bit: - [2010.07.07 13:16:14 | 000,580,696 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ctac32k.sys -- (ctac32k)
DRV:
64bit: - [2010.07.07 13:16:06 | 001,445,976 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX.SYS)
DRV:
64bit: - [2010.07.07 13:16:06 | 001,445,976 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX)
DRV:
64bit: - [2010.07.07 13:15:56 | 000,095,320 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT.SYS)
DRV:
64bit: - [2010.07.07 13:15:56 | 000,095,320 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT)
DRV:
64bit: - [2010.07.07 13:15:50 | 000,230,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT.SYS)
DRV:
64bit: - [2010.07.07 13:15:50 | 000,230,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT)
DRV:
64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:
64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:
64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:
64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:
64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:
64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:
64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2012.02.09 09:08:08 | 000,017,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys -- (Lavasoft Kernexplorer)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.online.noIE - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache =
http://no.msn.com/?ocid=iehpIE - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = no
IE - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 41 DD DA 4D A7 18 CC 01 [binary data]
IE - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ========== FF - prefs.js..browser.startup.homepage: "
http://www.google.com/" FF:
64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:
64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\ [2012.02.09 04:20:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.18 16:57:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.01.13 18:00:23 | 000,000,000 | ---D | M]
[2011.08.09 00:51:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniem\AppData\Roaming\Mozilla\Extensions
[2012.02.13 13:59:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniem\AppData\Roaming\Mozilla\Firefox\Profiles\s17v9etn.default\extensions
[2012.02.13 13:59:22 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Daniem\AppData\Roaming\Mozilla\Firefox\Profiles\s17v9etn.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2011.12.24 22:28:34 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Daniem\AppData\Roaming\Mozilla\Firefox\Profiles\s17v9etn.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.07.10 21:26:23 | 000,000,000 | ---D | M] (Norsk bokmål ordliste) -- C:\Users\Daniem\AppData\Roaming\Mozilla\Firefox\Profiles\s17v9etn.default\extensions\
[email protected][2012.01.08 09:11:25 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012.02.09 04:20:20 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES (X86)\AVG\AVG2012\FIREFOX4
() (No name found) -- C:\USERS\DANIEM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S17V9ETN.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.02.18 16:57:08 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.03 09:40:59 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.11.10 14:23:30 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:
64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O4:
64bit: - HKLM..\Run: [AsioReg] REGSVR32 /S CTASIO.DLL File not found
O4 - HKLM..\Run: [AsioReg] C:\Windows\SysWow64\ctasio.dll (Creative Technology Ltd)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\SysWow64\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TrojanScanner] C:\Program Files (x86)\Trojan Remover\Trjscan.exe (Simply Super Software)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000..\Run: [Spotify] C:\Users\Daniem\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd)
O4 - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13
64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-3510305745-1512932402-3202869464-1000\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {99FE5072-78AA-4FEE-89BA-69A5FA55343F}
http://download.micr...44/igdtoolx.cab (IGDTester Class)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E}
http://ccfiles.creat...13/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF}
http://ccfiles.creat...015/CTSUEng.cab (Creative Software AutoUpdate 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29}
http://ccfiles.creat...10926/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 130.67.15.198 193.213.112.4
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EE11C4F1-5F52-4264-89C9-A7CBC38BE37D}: DhcpNameServer = 130.67.15.198 193.213.112.4
O18:
64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:
64bit: - Protocol\Handler\livecall - No CLSID value found
O18:
64bit: - Protocol\Handler\msnim - No CLSID value found
O18:
64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20:
64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:
64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:
64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:
64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:
64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{0dfda1fe-1f9f-11e1-bb95-406186c3f7c3}\Shell - "" = AutoRun
O33 - MountPoints2\{0dfda1fe-1f9f-11e1-bb95-406186c3f7c3}\Shell\AutoRun\command - "" = D:\setup.exe
O33 - MountPoints2\{8440294f-8602-11e0-aa80-406186c3f7c3}\Shell - "" = AutoRun
O33 - MountPoints2\{8440294f-8602-11e0-aa80-406186c3f7c3}\Shell\AutoRun\command - "" = D:\INSTALL.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart)
O34 - HKLM BootExecute: (lsdelete)
O35:
64bit: - HKLM\..comfile [open] -- "%1" %*
O35:
64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:
64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:
64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
NetSvcs:
64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ========== [2012.02.24 06:38:38 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{29952C91-C459-406A-8E75-C2FF663C6582}
[2012.02.24 06:38:26 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{ED42ACAD-11F5-4D35-9FE3-5491316C6A0D}
[2012.02.22 16:49:53 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{1F145A31-ABCB-4BCA-85EA-2D02D64796C9}
[2012.02.22 16:49:40 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{39657367-6726-4B1C-9B55-FEAA00782599}
[2012.02.21 20:14:01 | 000,583,168 | ---- | C] (OldTimer Tools) -- C:\Users\Daniem\Desktop\OTL.exe
[2012.02.21 18:35:01 | 004,730,880 | ---- | C] (AVAST Software) -- C:\Users\Daniem\Desktop\aswMBR.exe
[2012.02.21 18:17:03 | 000,000,000 | ---D | C] -- C:\Users\Daniem\DoctorWeb
[2012.02.21 16:18:50 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{FBA95FC2-6F57-487A-B547-C731235416EC}
[2012.02.21 16:18:39 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{C9421980-63B5-45C1-86B2-7266C2733F78}
[2012.02.20 02:36:25 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{3CDFCE6C-493F-4FD6-80BC-065589F9915F}
[2012.02.20 02:36:14 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{9D22B738-D85E-485D-8B22-4DCB89648F38}
[2012.02.19 18:30:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012.02.19 18:30:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2012.02.19 18:30:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2012.02.19 12:55:10 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{275DECED-17B6-42B8-B3C8-AE2B9268C525}
[2012.02.19 12:54:58 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{0F067558-74F5-4854-B373-23BC11EC0D89}
[2012.02.18 16:52:10 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{93A96F79-AF4F-458E-A141-51091F5303DA}
[2012.02.18 16:51:59 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{69289E00-15EE-480A-B19E-40112614CEF2}
[2012.02.17 16:15:33 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{BFC385FC-1A9B-4FF5-8037-F4E8DC5BC54B}
[2012.02.17 16:15:22 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{AC13E3BD-88A5-44F3-B202-0807E2B9B50A}
[2012.02.17 15:49:17 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{AEC12087-3FE9-466A-BEE6-A398316A2BEB}
[2012.02.16 21:40:00 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{B6EA88D2-5120-43B8-8FAB-864DF4CBB87D}
[2012.02.16 21:39:49 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{D343BDBA-A7E8-444A-8DC0-328C5B1321F6}
[2012.02.16 03:00:58 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{30376463-9A9A-4747-97A3-73394EAD7D9B}
[2012.02.16 03:00:46 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{F2521951-33C5-4485-8174-F6841DE55AE5}
[2012.02.15 12:25:41 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{3C0D4A36-87DD-4383-9798-2BEF5AA81BDF}
[2012.02.15 12:25:30 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{2365C52C-509E-42AA-AFF6-D45547E6C98F}
[2012.02.15 00:25:05 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{3E65FEDE-76D1-4410-929A-22CA01ED5131}
[2012.02.15 00:24:51 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{69043442-DC94-4EFE-8826-BCFA4BBB710B}
[2012.02.13 13:50:49 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{BFD7AD66-8744-45B4-A944-5A9DFF86FEA0}
[2012.02.13 13:50:37 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{A1BECAD0-FF5E-4ADA-AC1D-E57909EE9B43}
[2012.02.13 00:32:51 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{DF737B36-D5B4-4FFD-8ED8-D816251D2105}
[2012.02.13 00:32:38 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{096EEADC-228D-4D9A-81DD-4F041322D0D6}
[2012.02.11 16:24:49 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{FD2957E5-388D-4C27-95E4-DE374B4E6C19}
[2012.02.11 16:24:38 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{8F0177DC-40A3-4AA3-B171-F0A29FEF33FD}
[2012.02.10 23:16:01 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{D82C3743-7035-4391-B5E0-72E75D617B86}
[2012.02.10 23:15:50 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{4288712A-37EE-4574-836C-90AB2862B6C3}
[2012.02.09 20:46:05 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{9E4F31DE-515B-45F5-8598-FFDB06F4127D}
[2012.02.09 20:45:54 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{935C6D5A-385A-4792-AAEE-B0C55378FC47}
[2012.02.09 09:08:09 | 000,055,384 | ---- | C] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
[2012.02.09 09:05:31 | 000,069,376 | ---- | C] (Lavasoft AB) -- C:\Windows\SysNative\drivers\Lbd.sys
[2012.02.09 09:05:31 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE
[2012.02.09 09:05:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
[2012.02.09 09:05:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
[2012.02.09 09:05:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lavasoft
[2012.02.09 08:45:30 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{7CEF8098-E81F-4831-9B2F-A714D2A46FFC}
[2012.02.09 08:45:19 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{D701B639-F987-4751-81CE-CBF2274FB5FD}
[2012.02.09 08:22:59 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2012.02.09 08:07:19 | 000,000,000 | ---D | C] -- C:\Program Files\HitmanPro
[2012.02.09 08:06:58 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro
[2012.02.09 08:05:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover
[2012.02.09 08:05:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trojan Remover
[2012.02.09 08:02:08 | 000,000,000 | ---D | C] -- C:\Users\Daniem\Documents\Simply Super Software
[2012.02.09 08:02:07 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Roaming\Simply Super Software
[2012.02.09 08:02:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software
[2012.02.09 07:12:17 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{9E03576F-7B2E-4D9F-8F8A-470DB9055145}
[2012.02.09 05:07:52 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Roaming\Malwarebytes
[2012.02.09 05:07:44 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.02.09 05:07:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.02.09 05:07:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.02.09 05:07:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.02.09 04:56:42 | 000,000,000 | -H-D | C] -- C:\$AVG
[2012.02.09 04:24:01 | 000,000,000 | ---D | C] -- C:\Users\Daniem\Documents\My Received Files
[2012.02.09 04:21:56 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Roaming\AVG2012
[2012.02.09 04:20:24 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012.02.09 04:20:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2012
[2012.02.09 04:20:19 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\AVG
[2012.02.09 04:19:58 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2012
[2012.02.09 04:19:58 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\AVG
[2012.02.09 04:19:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG
[2012.02.09 04:14:53 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2012.02.09 04:01:19 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{9292F09E-00C5-4BDA-868C-D93A789714FF}
[2012.02.09 04:01:09 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{4B9F77AE-6DD2-4BA7-9DF4-7662A3666819}
[2012.02.08 17:57:34 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\BigHugeEngine
[2012.02.08 17:54:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kingdoms of Amalur Reckoning
[2012.02.08 17:41:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Kingdoms of Amalur Reckoning
[2012.02.07 16:12:01 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{C9427DA1-9F4D-4EF6-BCAF-E78EFE9BD609}
[2012.02.07 16:11:49 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{4CAD43A5-715F-4F84-BA35-25C84ABBB17F}
[2012.02.06 15:45:03 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2012.02.06 15:45:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2012.02.06 15:44:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2012.02.06 15:41:12 | 000,000,000 | ---D | C] -- C:\AMD
[2012.02.06 15:32:44 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{7D7D8ACF-D5E9-473B-8E8B-21D0E4217284}
[2012.02.06 15:32:33 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{9F90BF80-93C9-4E34-BD58-5D958099868B}
[2012.02.05 15:26:37 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{FB1B3AFB-DFA3-404A-85A4-59AEF1908386}
[2012.02.05 15:26:27 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{0DA25C67-E1A4-46AF-802B-00774AF9E891}
[2012.02.04 20:53:35 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\Spotify
[2012.02.04 20:53:19 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Roaming\Spotify
[2012.02.04 16:52:04 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{4E026CF8-B626-4468-80F2-A136D0F4050C}
[2012.02.04 16:51:53 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{11D44F07-97B2-4EDF-BDAD-A86E8AE407BB}
[2012.02.03 16:08:23 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{3BA71F1A-37A0-4391-B278-16F9938561D1}
[2012.02.03 16:08:12 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{458AF00C-13A3-40E9-9926-0A63732A86BB}
[2012.02.02 15:10:02 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{4EED820C-C5ED-4A0C-94B8-81A9C8441C36}
[2012.02.02 15:09:52 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{057808CE-6C90-4531-B35D-DB17854F6881}
[2012.02.01 14:34:35 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{D3ECFC96-A1E1-4F55-9B0B-29B403D8EC69}
[2012.02.01 14:34:24 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{0BF4BA25-93F5-4037-BEA7-872C001D44AF}
[2012.01.31 13:56:24 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{7C9D4BD6-CB63-415C-9108-1AF874BC782E}
[2012.01.31 13:56:13 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{BF24F025-CE02-4838-B6F8-C0CF58A5791B}
[2012.01.31 01:55:50 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{BEEE548B-6781-49DF-B617-524BF5E2DAD8}
[2012.01.31 01:55:39 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{BAB91677-4D8A-4A34-92F7-317EB367B79B}
[2012.01.30 13:55:14 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{718DE99B-A2E7-4C8E-8ECF-CFC7D17EC28E}
[2012.01.30 13:55:03 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{D9C6B94F-DF4C-463E-99AA-41F1F8065DEF}
[2012.01.29 14:23:43 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{2110D600-2871-4A16-AF7D-B679062BE78A}
[2012.01.29 14:23:32 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{EA7C4C7F-4105-422A-B98B-248B7A21D2AA}
[2012.01.28 18:23:21 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{1F44A3C2-361F-43E3-9AF9-99535A1DEEE0}
[2012.01.28 18:23:09 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{DBAA50D1-9806-4891-A256-26003BC318F6}
[2012.01.27 15:31:40 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{45A5DB53-81C7-43F0-9A80-5AD2E4BD6A7F}
[2012.01.27 15:31:29 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{1FBC6686-8C67-44F6-A5A7-FA0771DB8C67}
[2012.01.26 12:57:35 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{8111332C-4B50-4FA7-9982-3E1A84E36481}
[2012.01.26 12:57:25 | 000,000,000 | ---D | C] -- C:\Users\Daniem\AppData\Local\{16E58E10-4B3D-4BA8-9F59-E972A587D1B6}
[2010.07.07 11:36:44 | 000,014,336 | ---- | C] ( ) -- C:\Windows\SysWow64\a3d.dll
[2010.07.07 11:10:22 | 000,012,800 | ---- | C] ( ) -- C:\Windows\SysWow64\killapps.exe
========== Files - Modified Within 30 Days ========== [2012.02.24 06:42:15 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.24 06:42:15 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.24 06:40:46 | 089,921,030 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm
[2012.02.24 06:37:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.02.24 06:37:05 | 529,883,135 | -HS- | M] () -- C:\hiberfil.sys
[2012.02.23 16:48:23 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000004-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.02.23 16:48:23 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000004-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.02.23 16:48:23 | 000,000,820 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000004-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.02.23 09:06:43 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat
[2012.02.23 09:06:43 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat
[2012.02.23 06:20:52 | 000,779,266 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.02.23 06:20:52 | 000,652,150 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.02.23 06:20:52 | 000,121,082 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.02.21 20:14:01 | 000,583,168 | ---- | M] (OldTimer Tools) -- C:\Users\Daniem\Desktop\OTL.exe
[2012.02.21 18:35:40 | 004,730,880 | ---- | M] (AVAST Software) -- C:\Users\Daniem\Desktop\aswMBR.exe
[2012.02.21 18:10:08 | 079,688,168 | ---- | M] () -- C:\Users\Daniem\Desktop\drweb-cureit.exe
[2012.02.20 18:31:40 | 000,128,698 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\iavichjg.avm
[2012.02.19 18:30:17 | 000,001,286 | ---- | M] () -- C:\Users\Daniem\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012.02.17 16:32:37 | 000,093,739 | ---- | M] () -- C:\Users\Daniem\Desktop\bilde 3.JPG
[2012.02.17 16:32:29 | 000,096,624 | ---- | M] () -- C:\Users\Daniem\Desktop\bilde 1(1).JPG
[2012.02.15 23:55:12 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.02.15 11:42:05 | 000,267,888 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.02.11 03:58:05 | 000,360,512 | ---- | M] () -- C:\Users\Daniem\Desktop\img_67631.jpg
[2012.02.10 00:57:23 | 000,007,468 | ---- | M] () -- C:\Users\Daniem\Desktop\K0006P0000005001_-_2012.pdf
[2012.02.09 09:08:08 | 000,055,384 | ---- | M] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
[2012.02.09 09:08:06 | 000,016,432 | ---- | M] () -- C:\Windows\SysNative\lsdelete.exe
[2012.02.09 08:28:13 | 000,025,160 | ---- | M] () -- C:\Windows\SysNative\drivers\hitmanpro36.sys
[2012.02.09 08:18:59 | 000,000,668 | ---- | M] () -- C:\Windows\SysNative\.crusader
[2012.02.09 08:05:04 | 000,000,058 | ---- | M] () -- C:\user.js
[2012.02.09 04:20:19 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\drivers\AVG\incavi.avm
[2012.02.09 04:20:19 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\drivers\AVG\iavichjw.avm
[2012.02.08 17:54:46 | 000,001,164 | ---- | M] () -- C:\Users\Daniem\Desktop\Kingdoms of Amalur Reckoning.lnk
========== Files Created - No Company Name ========== [2012.02.24 06:40:46 | 089,921,030 | ---- | C] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm
[2012.02.21 18:07:12 | 079,688,168 | ---- | C] () -- C:\Users\Daniem\Desktop\drweb-cureit.exe
[2012.02.20 18:31:40 | 000,128,698 | ---- | C] () -- C:\Windows\SysNative\drivers\AVG\iavichjg.avm
[2012.02.19 18:30:17 | 000,001,286 | ---- | C] () -- C:\Users\Daniem\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012.02.17 16:16:23 | 000,096,624 | ---- | C] () -- C:\Users\Daniem\Desktop\bilde 1(1).JPG
[2012.02.17 07:16:40 | 000,093,739 | ---- | C] () -- C:\Users\Daniem\Desktop\bilde 3.JPG
[2012.02.15 23:55:12 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.02.11 03:58:04 | 000,360,512 | ---- | C] () -- C:\Users\Daniem\Desktop\img_67631.jpg
[2012.02.10 00:57:22 | 000,007,468 | ---- | C] () -- C:\Users\Daniem\Desktop\K0006P0000005001_-_2012.pdf
[2012.02.09 10:10:01 | 000,016,432 | ---- | C] () -- C:\Windows\SysNative\lsdelete.exe
[2012.02.09 09:06:16 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
[2012.02.09 09:06:16 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
[2012.02.09 08:44:51 | 000,002,486 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2012.02.09 08:18:59 | 000,000,668 | ---- | C] () -- C:\Windows\SysNative\.crusader
[2012.02.09 08:07:54 | 000,025,160 | ---- | C] () -- C:\Windows\SysNative\drivers\hitmanpro36.sys
[2012.02.09 08:05:04 | 000,000,058 | ---- | C] () -- C:\user.js
[2012.02.09 08:02:08 | 000,162,304 | ---- | C] () -- C:\Windows\SysWow64\ztvunrar36.dll
[2012.02.09 08:02:08 | 000,153,088 | ---- | C] () -- C:\Windows\SysWow64\unrar3.dll
[2012.02.09 08:02:08 | 000,077,312 | ---- | C] () -- C:\Windows\SysWow64\ztvunace26.dll
[2012.02.09 08:02:08 | 000,075,264 | ---- | C] () -- C:\Windows\SysWow64\unacev2.dll
[2012.02.09 04:20:19 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\AVG\incavi.avm
[2012.02.09 04:20:19 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\AVG\iavichjw.avm
[2012.02.08 17:54:46 | 000,001,164 | ---- | C] () -- C:\Users\Daniem\Desktop\Kingdoms of Amalur Reckoning.lnk
[2012.02.04 20:53:35 | 000,001,797 | ---- | C] () -- C:\Users\Daniem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
[2011.12.05 22:04:00 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011.12.05 22:03:52 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.11.10 03:36:06 | 000,204,960 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2011.11.10 03:36:06 | 000,157,152 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2011.10.25 21:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011.10.01 15:10:13 | 000,764,734 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.06.07 15:04:33 | 000,007,640 | ---- | C] () -- C:\Users\Daniem\AppData\Local\Resmon.ResmonCfg
[2011.05.24 22:07:28 | 000,164,864 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011.05.24 22:07:28 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2011.05.22 18:09:09 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2010.07.07 12:23:10 | 000,017,868 | ---- | C] () -- C:\Windows\SysWow64\instwdm.ini
[2010.07.07 12:23:06 | 000,000,054 | ---- | C] () -- C:\Windows\SysWow64\ctzapxx.ini
[2010.07.07 11:33:04 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CtxfiRes.dll
[2010.07.07 11:21:00 | 000,384,647 | ---- | C] () -- C:\Windows\SysWow64\ctdnlstr.dat
[2010.07.07 11:21:00 | 000,051,787 | ---- | C] () -- C:\Windows\SysWow64\ctdlang.dat
[2010.07.07 11:10:30 | 000,007,680 | ---- | C] () -- C:\Windows\SysWow64\enlocstr.exe
========== LOP Check ========== [2011.12.03 01:32:22 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\asoftech
[2012.02.09 04:21:56 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\AVG2012
[2012.02.24 16:34:28 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\Azureus
[2012.01.19 21:14:56 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\DAEMON Tools Lite
[2011.08.22 15:21:36 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\Kalypso Media
[2011.10.17 20:10:34 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\Might & Magic Heroes VI
[2012.01.19 21:26:13 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\PunkBuster
[2012.02.09 08:05:50 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\Simply Super Software
[2012.02.24 07:00:54 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\Spotify
[2011.09.23 22:41:13 | 000,000,000 | ---D | M] -- C:\Users\Daniem\AppData\Roaming\Tropico 4
[2012.02.04 16:51:31 | 000,032,620 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.exe > < MD5 for: EXPLORER.EXE >[2011.02.26 07:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009.08.03 07:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010.11.20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011.02.26 07:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009.08.03 07:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
< MD5 for: SVCHOST.EXE >[2009.07.14 02:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\SysWOW64\svchost.exe
[2009.07.14 02:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\SysNative\svchost.exe
[2009.07.14 02:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe
< MD5 for: USERINIT.EXE >[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
< MD5 for: WINLOGON.EXE >[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT /s >"DisplayName" = @%SystemRoot%\system32\drivers\netbt.sys,-2
"Group" = PNP_TDI
"ImagePath" = System32\DRIVERS\netbt.sys
"Description" = @%SystemRoot%\system32\drivers\netbt.sys,-1
"ErrorControl" = 1
"Start" = 1
"Type" = 1
"DependOnService" = Tdxtcpip [binary data]
"Tag" = 87
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Linkage]
"OtherDependencies" = Tcpip [binary data]
"Bind" = [Binary data over 100 bytes]
"Route" = [Binary data over 100 bytes]
"Export" = [Binary data over 100 bytes]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters]
"BcastNameQueryCount" = 3
"BcastQueryTimeout" = 750
"CacheTimeout" = 600000
"EnableLMHOSTS" = 1
"NameServerPort" = 137
"NameSrvQueryCount" = 3
"NameSrvQueryTimeout" = 1500
"NbProvider" = _tcp
"SessionKeepAlive" = 3600000
"Size/Small/Medium/Large" = 1
"TransportBindName" = \Device\
"UseNewSmb" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces\Tcpip_{0E8DCD8E-DE0D-446D-BC43-E9A6097E23D1}]
"NameServerList" = [binary data]
"NetbiosOptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces\Tcpip_{8536E204-F437-4F36-A0A9-32F91879356D}]
"NameServerList" = [binary data]
"NetbiosOptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces\Tcpip_{D3C3716E-4149-46BA-B80D-559946AF9566}]
"NameServerList" = [binary data]
"NetbiosOptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces\Tcpip_{EE11C4F1-5F52-4264-89C9-A7CBC38BE37D}]
"NameServerList" = [binary data]
"NetbiosOptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Security]
"Security" = [Binary data over 100 bytes]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Enum]
"0" = Root\LEGACY_NETBT\0000
"Count" = 1
"NextInstance" = 1
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS /s >"Type" = 2
"Start" = 1
"ErrorControl" = 1
"Tag" = 2
"ImagePath" = system32\DRIVERS\netbios.sys
"DisplayName" = NetBIOS Interface
"Group" = NetBIOSGroup
"Description" = NetBIOS Interface
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS\Linkage]
"LanaMap" = 01 0A 01 08 01 05 01 00 01 0C 01 0B 01 09 01 07 01 06 01 04 01 02 01 01 01 03 [binary data]
"Bind" = [Binary data over 100 bytes]
"Route" = [Binary data over 100 bytes]
"Export" = [Binary data over 100 bytes]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS\Parameters]
"MaxLana" = 12
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS\Enum]
"0" = Root\LEGACY_NETBIOS\0000
"Count" = 1
"NextInstance" = 1
< C:\Windows\assembly\tmp\U\*.* /s > < %Temp%\smtmp\1\*.* > < %Temp%\smtmp\2\*.* > < %Temp%\smtmp\3\*.* > < %Temp%\smtmp\4\*.* > ========== Alternate Data Streams ========== @Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:CB0AACC9
< End of report >