OTL logfile created on: 14.06.2012 23:19:03 - Run 1
OTL by OldTimer - Version 3.2.49.0 Folder = C:\Documents and Settings\Paul\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000418 | Country: Romania | Language: ROM | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,43 Gb Available Physical Memory | 71,64% Memory free
3,85 Gb Paging File | 3,46 Gb Available in Paging File | 89,87% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 24,41 Gb Total Space | 10,84 Gb Free Space | 44,39% Space Free | Partition Type: NTFS
Drive D: | 124,63 Gb Total Space | 8,83 Gb Free Space | 7,09% Space Free | Partition Type: NTFS
Computer Name: PAULZURBAU | User Name: Paul | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ========== PRC - [2012.06.14 23:17:37 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Paul\Desktop\OTL.exe
PRC - [2012.06.12 23:38:02 | 000,874,384 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe
PRC - [2012.06.12 23:38:02 | 000,800,656 | ---- | M] (Opera Software) -- C:\Program Files\Opera\pluginwrapper\opera_plugin_wrapper.exe
PRC - [2012.03.07 15:40:34 | 000,913,144 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2007.02.19 00:37:47 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
========== Modules (No Company Name) ========== MOD - [2012.02.20 21:29:04 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012.02.20 21:28:42 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2012.01.11 00:45:48 | 008,527,008 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
MOD - [2011.10.08 07:50:00 | 001,564,264 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\nview\nView.dll
MOD - [2004.08.04 02:56:44 | 000,059,904 | ---- | M] () -- C:\WINDOWS\system32\devenum.dll
MOD - [2004.08.04 02:56:44 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
========== Win32 Services (SafeList) ========== SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2012.03.07 15:40:34 | 000,913,144 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2011.10.08 07:50:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2005.10.06 19:12:30 | 000,855,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Media Connect 2\wmccds.exe -- (WMConnectCDS)
========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Garena Plus\Room\safedrv.sys -- (GGSAFERDriver)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (akbni8kg)
DRV - [2012.03.14 08:40:04 | 000,104,160 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdir.sys -- (epfwtdir)
DRV - [2012.03.14 08:40:02 | 000,160,816 | ---- | M] (ESET) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon)
DRV - [2012.03.14 08:40:02 | 000,120,152 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2012.01.20 23:43:39 | 000,611,064 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2009.02.12 16:11:24 | 000,022,312 | ---- | M] (EldoS Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\dddsk.sys -- (ElRawDisk)
DRV - [2008.08.06 13:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2007.12.20 02:53:00 | 000,037,376 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\l151x86.sys -- (AtcL001)
DRV - [2007.10.25 19:31:08 | 000,616,064 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PFC027.SYS -- (PAC207)
DRV - [2007.04.10 20:04:40 | 004,397,568 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006.01.05 08:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKU\S-1-5-21-73586283-1214440339-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKU\S-1-5-21-73586283-1214440339-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://search.condui...&ctid=CT3072253IE - HKU\S-1-5-21-73586283-1214440339-682003330-1003\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKU\S-1-5-21-73586283-1214440339-682003330-1003\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" =
http://search.condui...&ctid=CT3072253IE - HKU\S-1-5-21-73586283-1214440339-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\
[email protected]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2012.06.13 22:39:45 | 000,000,000 | ---D | M]
[2012.06.13 17:14:18 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Paul\Application Data\Mozilla\Firefox\extensions
[2012.06.13 17:14:18 | 000,000,000 | ---D | M] (uTorrentControl2 Community Toolbar) -- C:\Documents and Settings\Paul\Application Data\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}
O1 HOSTS File: ([2001.08.23 15:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll File not found
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKU\S-1-5-21-73586283-1214440339-682003330-1003\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [AdobeARP] C:\Documents and Settings\Paul\Application Data\AdobeARP.exe (blU)
O4 - HKLM..\Run: [AdobeART] C:\Documents and Settings\Paul\Application Data\AdobeART.exe (gambe grane)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKLM..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe ()
O4 - HKLM..\Run: [PAC207_Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKU\S-1-5-21-73586283-1214440339-682003330-1003..\Run: [a] C:\Documents and Settings\Paul\Desktop\cmd.exe File not found
O4 - HKU\S-1-5-21-73586283-1214440339-682003330-1003..\Run: [b] C:\Documents and Settings\Paul\Start Menu\Programs\cmd.exe (bathless overgeneralizing)
O4 - HKU\S-1-5-21-73586283-1214440339-682003330-1003..\Run: [c] C:\Documents and Settings\Paul\My Documents\cmd.exe (bathless overgeneralizing)
O4 - HKU\S-1-5-21-73586283-1214440339-682003330-1003..\Run: [d] C:\Documents and Settings\Paul\Favorites\cmd.exe (bathless overgeneralizing)
O4 - HKU\S-1-5-21-73586283-1214440339-682003330-1003..\Run: [e] C:\Documents and Settings\Paul\Start Menu\cmd.exe (bathless overgeneralizing)
O4 - HKU\S-1-5-21-73586283-1214440339-682003330-1003..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKU\S-1-5-21-73586283-1214440339-682003330-1003..\Run: [Startup Key] C:\Documents and Settings\Paul\Local Settings\Temp\Name.exe (blU)
O4 - Startup: C:\Documents and Settings\Paul\Start Menu\Programs\Startup\cmd.exe (bathless overgeneralizing)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: 33377 = C:\DOCUME~1\ALLUSE~1\LOCALS~1\Temp\mspvycbrr.exe (Microsoft Corporation)
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-73586283-1214440339-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F}
http://www.nvidia.co...sreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A}
http://quickscan.bit...m/qsax/qsax.cab (Bitdefender QuickScan Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D}
http://content.syste...yri_4.5.1.0.cab (SysInfo Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D5CE37D8-7255-4CE9-8F5C-539832F9713C}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.01.10 21:27:58 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
NetSvcs: 6to4 - File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ========== [2012.06.14 23:17:29 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Paul\Desktop\OTL.exe
[2012.06.13 23:31:51 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2012.06.13 23:31:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Paul\Start Menu\Programs\HiJackThis
[2012.06.13 22:53:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ESET
[2012.06.13 22:39:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ESET
[2012.06.13 22:39:43 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.06.13 22:39:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\ESET
[2012.06.13 22:22:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Paul\Application Data\QuickScan
[2012.06.13 17:14:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Paul\Local Settings\Application Data\Google
[2012.06.13 17:14:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Paul\Local Settings\Application Data\CRE
[2012.06.13 17:14:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Paul\Application Data\Mozilla
[2012.06.13 17:14:17 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
[2012.06.13 17:14:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Paul\Local Settings\Application Data\Conduit
[2012.06.12 21:40:11 | 000,072,704 | ---- | C] (blU) -- C:\Documents and Settings\Paul\Application Data\AdobeARP.exe
[2012.06.12 20:48:12 | 000,077,824 | ---- | C] (gambe grane) -- C:\Documents and Settings\Paul\Application Data\AdobeART.exe
[2012.06.12 20:00:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Paul\Application Data\BabylonToolbar
[2012.06.12 19:34:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Local Settings
[2012.06.12 19:31:18 | 000,061,440 | R--- | C] (bathless overgeneralizing) -- C:\Documents and Settings\Paul\Start Menu\Programs\Startup\cmd.exe
[2012.06.12 19:31:18 | 000,061,440 | -H-- | C] (bathless overgeneralizing) -- C:\Documents and Settings\Paul\Start Menu\Programs\cmd.exe
[2012.06.12 19:31:18 | 000,061,440 | -H-- | C] (bathless overgeneralizing) -- C:\Documents and Settings\Paul\My Documents\cmd.exe
[2012.06.12 19:31:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun
[2012.06.08 20:30:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AMMYY
[2012.06.08 20:14:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Paul\Application Data\Ahead
[2012.06.08 20:13:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Nero
[2012.06.08 20:13:41 | 000,089,184 | ---- | C] (Ahead Software AG and its licensors) -- C:\WINDOWS\System32\drivers\imagedrv.sys
[2012.06.08 20:13:41 | 000,057,344 | ---- | C] (Ahead Software AG) -- C:\WINDOWS\System32\ImageDrive.cpl
[2012.06.08 20:13:32 | 000,569,344 | ---- | C] (Pegasus Software,LLC) -- C:\WINDOWS\System32\imagr5.dll
[2012.06.08 20:13:32 | 000,544,768 | ---- | C] (Pegasus Software, LLC) -- C:\WINDOWS\System32\imagx5.dll
[2012.06.08 20:13:32 | 000,283,920 | ---- | C] (Pegasus Software, LLC) -- C:\WINDOWS\System32\ImagXpr5.dll
[2012.06.08 20:13:32 | 000,038,912 | ---- | C] (Pegasus Imaging Corp.) -- C:\WINDOWS\System32\picn20.dll
[2012.06.08 20:13:31 | 000,155,648 | ---- | C] (Ahead Software Gmbh) -- C:\WINDOWS\System32\NeroCheck.exe
[2012.06.08 20:13:31 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Ahead
[2012.06.08 20:13:28 | 000,000,000 | ---D | C] -- C:\Program Files\Ahead
[2012.06.08 19:56:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt
[2012.06.02 14:01:57 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Paul\My Documents\My Videos
[2012.06.01 00:56:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Paul\Desktop\screamer
[2012.05.19 22:47:23 | 000,139,264 | ---- | C] (Blizzard Entertainment) -- C:\WINDOWS\War3Unin.exe
[2012.05.19 22:47:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Paul\Start Menu\Programs\Warcraft III
[2012.05.19 22:23:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Paul\Application Data\GarenaPlus
[2012.05.19 22:23:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Garena
[2012.05.19 22:23:03 | 000,000,000 | ---D | C] -- C:\Program Files\Garena Plus
[2012.05.19 22:23:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\GarenaMessenger
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ========== [2012.06.14 23:22:28 | 000,026,624 | ---- | M] () -- C:\Documents and Settings\Paul\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.06.14 23:17:37 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Paul\Desktop\OTL.exe
[2012.06.14 23:12:19 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.06.13 23:31:51 | 000,001,982 | ---- | M] () -- C:\Documents and Settings\Paul\Desktop\HiJackThis.lnk
[2012.06.13 22:38:48 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.06.13 17:14:12 | 000,000,420 | ---- | M] () -- C:\Documents and Settings\Paul\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2012.06.13 17:14:12 | 000,000,418 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\µTorrent.lnk
[2012.06.13 17:13:53 | 001,020,816 | ---- | M] (BitTorrent, Inc.) -- C:\Documents and Settings\Paul\Desktop\utorrent.exe
[2012.06.13 14:17:37 | 000,045,194 | ---- | M] () -- C:\Documents and Settings\Paul\Application Data\room_v3.dat
[2012.06.13 12:50:48 | 000,506,150 | ---- | M] () -- C:\Documents and Settings\Paul\Application Data\9757.exe
[2012.06.12 23:01:36 | 000,499,492 | -HS- | M] () -- C:\Documents and Settings\Paul\Application Data\0059a893.exe
[2012.06.12 22:53:27 | 000,506,148 | ---- | M] () -- C:\Documents and Settings\Paul\Application Data\1417.exe
[2012.06.12 22:51:10 | 000,499,492 | ---- | M] () -- C:\Documents and Settings\Paul\Application Data\7406.exe
[2012.06.12 21:40:06 | 000,072,704 | ---- | M] (blU) -- C:\Documents and Settings\Paul\Application Data\AdobeARP.exe
[2012.06.12 20:48:08 | 000,077,824 | ---- | M] (gambe grane) -- C:\Documents and Settings\Paul\Application Data\AdobeART.exe
[2012.06.12 19:34:11 | 000,506,148 | ---- | M] () -- C:\Documents and Settings\Paul\Application Data\8000.exe
[2012.06.12 19:31:18 | 000,061,440 | R--- | M] (bathless overgeneralizing) -- C:\Documents and Settings\Paul\Start Menu\Programs\Startup\cmd.exe
[2012.06.12 19:31:18 | 000,061,440 | -H-- | M] (bathless overgeneralizing) -- C:\Documents and Settings\Paul\My Documents\cmd.exe
[2012.06.10 14:18:03 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.06.08 20:30:05 | 000,726,832 | ---- | M] () -- C:\Documents and Settings\Paul\Desktop\AA_v3.exe
[2012.06.02 12:40:56 | 000,001,431 | ---- | M] () -- C:\Documents and Settings\Paul\My Documents\ISO1.nri
[2012.05.27 19:00:35 | 000,921,632 | ---- | M] () -- C:\PA207.DAT
[2012.05.27 17:51:52 | 000,002,267 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2012.05.19 22:54:56 | 000,071,464 | ---- | M] () -- C:\WINDOWS\War3Unin.dat
[2012.05.19 22:54:11 | 000,139,264 | ---- | M] (Blizzard Entertainment) -- C:\WINDOWS\War3Unin.exe
[2012.05.19 22:54:11 | 000,002,829 | ---- | M] () -- C:\WINDOWS\War3Unin.pif
[2012.05.19 22:23:21 | 000,000,738 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Garena Plus.lnk
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ========== [2012.06.13 23:31:51 | 000,001,982 | ---- | C] () -- C:\Documents and Settings\Paul\Desktop\HiJackThis.lnk
[2012.06.13 17:14:12 | 000,000,420 | ---- | C] () -- C:\Documents and Settings\Paul\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2012.06.13 17:14:12 | 000,000,418 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\µTorrent.lnk
[2012.06.13 12:50:52 | 000,506,150 | ---- | C] () -- C:\Documents and Settings\Paul\Application Data\9757.exe
[2012.06.12 23:01:38 | 000,499,492 | -HS- | C] () -- C:\Documents and Settings\Paul\Application Data\0059a893.exe
[2012.06.12 22:53:30 | 000,506,148 | ---- | C] () -- C:\Documents and Settings\Paul\Application Data\1417.exe
[2012.06.12 22:51:13 | 000,499,492 | ---- | C] () -- C:\Documents and Settings\Paul\Application Data\7406.exe
[2012.06.12 19:34:14 | 000,506,148 | ---- | C] () -- C:\Documents and Settings\Paul\Application Data\8000.exe
[2012.06.12 19:34:14 | 000,000,716 | ---- | C] () -- C:\Documents and Settings\Paul\Start Menu\Programs\Startup.lnk
[2012.06.08 20:29:54 | 000,726,832 | ---- | C] () -- C:\Documents and Settings\Paul\Desktop\AA_v3.exe
[2012.06.02 12:37:25 | 000,001,431 | ---- | C] () -- C:\Documents and Settings\Paul\My Documents\ISO1.nri
[2012.05.19 23:50:33 | 000,045,194 | ---- | C] () -- C:\Documents and Settings\Paul\Application Data\room_v3.dat
[2012.05.19 22:47:24 | 000,071,464 | ---- | C] () -- C:\WINDOWS\War3Unin.dat
[2012.05.19 22:47:23 | 000,002,829 | ---- | C] () -- C:\WINDOWS\War3Unin.pif
[2012.05.19 22:23:21 | 000,000,738 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Garena Plus.lnk
[2012.02.12 15:46:47 | 000,164,810 | ---- | C] () -- C:\WINDOWS\hpoins21.dat
[2012.02.12 15:46:47 | 000,007,262 | ---- | C] () -- C:\WINDOWS\hpomdl21.dat
[2012.02.08 15:35:43 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2012.01.11 17:58:49 | 000,026,624 | ---- | C] () -- C:\Documents and Settings\Paul\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.01.11 13:24:12 | 000,000,399 | ---- | C] () -- C:\WINDOWS\System32\Remover.ini
[2012.01.11 13:24:11 | 000,000,566 | ---- | C] () -- C:\WINDOWS\System32\SP207.ini
[2012.01.10 23:17:40 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2012.01.10 23:14:11 | 000,263,024 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.01.10 22:49:38 | 000,285,176 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2012.01.10 22:49:38 | 000,285,176 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2012.01.10 22:49:38 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2012.01.10 22:49:27 | 002,130,002 | ---- | C] () -- C:\WINDOWS\System32\nvdata.data
[2012.01.10 22:46:02 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.01.10 22:46:01 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2012.01.10 22:32:45 | 000,001,769 | ---- | C] () -- C:\WINDOWS\Language_trs.ini
[2012.01.10 21:30:40 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2012.01.10 21:24:19 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
========== Custom Scans ========== ========== Drive Information ========== Physical Drives
---------------
Drive: \\\\.\\PHYSICALDRIVE0 - Fixed\thard disk media
Interface type: IDE
Media Type: Fixed\thard disk media
Model: SAMSUNG HD161HJ
Partitions: 2
Status: OK
Status Info: 0
Partitions
---------------
DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 24,00GB
Starting Offset: 32256
Hidden sectors: 0
DeviceID: Disk #0, Partition #1
PartitionType: Extended w/Extended Int 13
Bootable: False
BootPartition: False
PrimaryPartition: False
Size: 125,00GB
Starting Offset: 26213967360
Hidden sectors: 0
< %SYSTEMDRIVE%\*.* >[2012.03.20 19:47:52 | 000,272,960 | ---- | M] () -- C:\'oupotuc .JPG
[2012.03.20 19:55:05 | 000,279,801 | ---- | M] () -- C:\-gg.JPG
[2012.03.20 20:00:53 | 000,228,313 | ---- | M] () -- C:\233455.JPG
[2012.03.20 20:01:08 | 000,236,130 | ---- | M] () -- C:\4764879.JPG
[2012.03.20 19:54:40 | 000,327,668 | ---- | M] () -- C:\;opfc.JPG
[2012.03.20 19:51:24 | 000,278,007 | ---- | M] () -- C:\;uyi.JPG
[2012.01.10 21:27:58 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2012.01.10 21:21:45 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2012.01.10 21:27:58 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2007.11.07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1028.txt
[2007.11.07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1031.txt
[2007.11.07 09:00:40 | 000,010,134 | ---- | M] () -- C:\eula.1033.txt
[2007.11.07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1036.txt
[2007.11.07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1040.txt
[2007.11.07 09:00:40 | 000,000,118 | ---- | M] () -- C:\eula.1041.txt
[2007.11.07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1042.txt
[2007.11.07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.2052.txt
[2007.11.07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt
[2012.03.20 19:52:51 | 000,270,789 | ---- | M] () -- C:\ewqrr.JPG
[2012.03.20 19:57:26 | 000,238,115 | ---- | M] () -- C:\F.JPG
[2012.03.20 19:53:44 | 000,233,915 | ---- | M] () -- C:\fiyui.JPG
[2012.03.20 19:53:32 | 000,229,338 | ---- | M] () -- C:\fj8.JPG
[2012.03.20 19:56:02 | 000,265,322 | ---- | M] () -- C:\FXCHHU.JPG
[2007.11.07 09:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini
[2012.03.20 19:51:38 | 000,283,502 | ---- | M] () -- C:\hher.JPG
[2007.11.07 09:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe
[2007.11.07 09:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini
[2007.11.07 09:03:18 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll
[2007.11.07 09:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll
[2007.11.07 09:03:18 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll
[2007.11.07 09:03:18 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll
[2007.11.07 09:03:18 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll
[2007.11.07 09:03:18 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll
[2007.11.07 09:03:18 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll
[2007.11.07 09:03:18 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll
[2007.11.07 09:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll
[2012.01.10 21:27:58 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2012.03.20 19:49:12 | 000,287,301 | ---- | M] () -- C:\iougy.JPG
[2012.03.20 19:53:18 | 000,229,338 | ---- | M] () -- C:\jdfuu.JPG
[2012.03.20 19:48:37 | 000,275,342 | ---- | M] () -- C:\jhugi.JPG
[2012.03.20 19:55:47 | 000,244,871 | ---- | M] () -- C:\KLI.JPG
[2012.03.20 20:01:18 | 000,232,799 | ---- | M] () -- C:\LKGHL.JPG
[2012.03.20 19:57:49 | 000,276,063 | ---- | M] () -- C:\MALL DUBAI.JPG
[2012.03.20 19:54:15 | 000,330,117 | ---- | M] () -- C:\mdyt8.JPG
[2012.03.20 19:52:30 | 000,311,497 | ---- | M] () -- C:\mgic .JPG
[2012.01.10 21:27:58 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2012.03.20 19:54:52 | 000,203,792 | ---- | M] () -- C:\nmcif7.JPG
[2012.03.20 19:48:24 | 000,242,729 | ---- | M] () -- C:\nmfrew.JPG
[2004.08.04 00:38:34 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2004.08.04 00:59:34 | 000,250,032 | RHS- | M] () -- C:\ntldr
[2012.03.20 19:54:00 | 000,260,953 | ---- | M] () -- C:\nyi.JPG
[2012.03.20 19:50:37 | 000,265,856 | ---- | M] () -- C:\o;pi.JPG
[2012.03.20 19:48:49 | 000,287,301 | ---- | M] () -- C:\opxc.JPG
[2012.03.20 19:58:26 | 000,305,320 | ---- | M] () -- C:\OUS.JPG
[2012.03.20 19:59:01 | 000,280,977 | ---- | M] () -- C:\OV.JPG
[2012.03.20 19:53:07 | 000,198,127 | ---- | M] () -- C:\oydi.JPG
[2012.05.27 19:00:35 | 000,921,632 | ---- | M] () -- C:\PA207.DAT
[2012.06.14 23:12:16 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys
[2012.03.20 19:47:33 | 000,248,839 | ---- | M] () -- C:\pfd.JPG
[2012.03.20 19:56:56 | 000,201,479 | ---- | M] () -- C:\POP.JPG
[2012.03.20 20:00:13 | 000,238,527 | ---- | M] () -- C:\Q1.JPG
[2012.03.20 20:00:29 | 000,237,868 | ---- | M] () -- C:\Q2.JPG
[2012.03.20 19:59:57 | 000,301,652 | ---- | M] () -- C:\QUATAR AVION.JPG
[2012.03.20 19:59:24 | 000,216,850 | ---- | M] () -- C:\QUATAR.JPG
[2012.03.20 19:50:59 | 000,263,497 | ---- | M] () -- C:\saw.JPG
[2012.03.20 19:48:06 | 000,223,568 | ---- | M] () -- C:\sdhyup.JPG
[2012.03.20 19:58:48 | 000,239,931 | ---- | M] () -- C:\TYIS.JPG
[2012.05.11 19:24:21 | 000,001,711 | ---- | M] () -- C:\user.js
[2007.11.07 09:09:22 | 001,442,522 | ---- | M] () -- C:\VC_RED.cab
[2007.11.07 09:12:28 | 000,232,960 | ---- | M] () -- C:\VC_RED.MSI
[2012.03.20 19:55:18 | 000,223,187 | ---- | M] () -- C:\viuyo.JPG
[2012.03.20 19:55:33 | 000,226,004 | ---- | M] () -- C:\WEAR.JPG
[2012.03.20 19:52:14 | 000,254,187 | ---- | M] () -- C:\yfffff.JPG
[2012.03.20 19:51:55 | 000,276,889 | ---- | M] () -- C:\yu746utrh.JPG
[2012.03.20 19:57:18 | 000,295,366 | ---- | M] () -- C:\[KO.JPG
< %systemdrive%\drivers\*.exe > < %systemroot%\system32\drivers\*.* /90 > < %PROGRAMFILES%\*.* > < HKLM\SOFTWARE\CLIENTS\Startmenuinternet|command /rs >HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: %systemroot%\system32\shmgrate.exe OCInstallReinstallIE [2004.08.04 02:56:58 | 000,042,496 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: %systemroot%\system32\shmgrate.exe OCInstallHideIE [2004.08.04 02:56:58 | 000,042,496 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: %systemroot%\system32\shmgrate.exe OCInstallShowIE [2004.08.04 02:56:58 | 000,042,496 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" [2004.08.04 02:56:52 | 000,093,184 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\Opera\InstallInfo\\ShowIconsCommand: "C:\Program Files\Opera\Opera.exe" /ShowIconsCommand [2012.06.12 23:38:02 | 000,874,384 | ---- | M] (Opera Software)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\Opera\InstallInfo\\HideIconsCommand: "C:\Program Files\Opera\Opera.exe" /HideIconsCommand [2012.06.12 23:38:02 | 000,874,384 | ---- | M] (Opera Software)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\Opera\InstallInfo\\ReinstallCommand: "C:\Program Files\Opera\Opera.exe" /ReInstallBrowser [2012.06.12 23:38:02 | 000,874,384 | ---- | M] (Opera Software)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\Opera\shell\open\command\\: "C:\Program Files\Opera\Opera.exe" [2012.06.12 23:38:02 | 000,874,384 | ---- | M] (Opera Software)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\Opera.exe\shell\open\command\\: "C:\Program Files\Opera\Opera.exe" [2012.06.12 23:38:02 | 000,874,384 | ---- | M] (Opera Software)
< HKLM\SOFTWARE\CLIENTS\Startmenuinternet|command /64 /rs >HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: %systemroot%\system32\shmgrate.exe OCInstallReinstallIE [2004.08.04 02:56:58 | 000,042,496 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: %systemroot%\system32\shmgrate.exe OCInstallHideIE [2004.08.04 02:56:58 | 000,042,496 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: %systemroot%\system32\shmgrate.exe OCInstallShowIE [2004.08.04 02:56:58 | 000,042,496 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" [2004.08.04 02:56:52 | 000,093,184 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\Opera\InstallInfo\\ShowIconsCommand: "C:\Program Files\Opera\Opera.exe" /ShowIconsCommand [2012.06.12 23:38:02 | 000,874,384 | ---- | M] (Opera Software)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\Opera\InstallInfo\\HideIconsCommand: "C:\Program Files\Opera\Opera.exe" /HideIconsCommand [2012.06.12 23:38:02 | 000,874,384 | ---- | M] (Opera Software)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\Opera\InstallInfo\\ReinstallCommand: "C:\Program Files\Opera\Opera.exe" /ReInstallBrowser [2012.06.12 23:38:02 | 000,874,384 | ---- | M] (Opera Software)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\Opera\shell\open\command\\: "C:\Program Files\Opera\Opera.exe" [2012.06.12 23:38:02 | 000,874,384 | ---- | M] (Opera Software)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\Opera.exe\shell\open\command\\: "C:\Program Files\Opera\Opera.exe" [2012.06.12 23:38:02 | 000,874,384 | ---- | M] (Opera Software)
========== Alternate Data Streams ========== @Alternate Data Stream - 99 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9E00596C
@Alternate Data Stream - 128 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:63238B95
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EC2E1DEC
< End of report >
OTL Extras logfile created on: 14.06.2012 23:19:03 - Run 1
OTL by OldTimer - Version 3.2.49.0 Folder = C:\Documents and Settings\Paul\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000418 | Country: Romania | Language: ROM | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,43 Gb Available Physical Memory | 71,64% Memory free
3,85 Gb Paging File | 3,46 Gb Available in Paging File | 89,87% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 24,41 Gb Total Space | 10,84 Gb Free Space | 44,39% Space Free | Partition Type: NTFS
Drive D: | 124,63 Gb Total Space | 8,83 Gb Free Space | 7,09% Space Free | Partition Type: NTFS
Computer Name: PAULZURBAU | User Name: Paul | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
[HKEY_USERS\S-1-5-21-73586283-1214440339-682003330-1003\SOFTWARE\Classes\<extension>]
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)
========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect
========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe" = C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe:*:Enabled:Daemonu.exe -- (NVIDIA Corporation)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"D:\strong\StrongDC.exe" = D:\strong\StrongDC.exe:*:Enabled:StrongDC++ -- ()
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)
"C:\Program Files\SopCast\SopCast.exe" = C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application -- (www.sopcast.com)
"D:\counyrr\hl.exe" = D:\counyrr\hl.exe:*:Enabled:Half-Life Launcher -- (Valve)
"C:\Documents and Settings\Paul\Desktop\utorrent.exe" = C:\Documents and Settings\Paul\Desktop\utorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)
"C:\Program Files\Garena Plus\room\garena_room.exe" = C:\Program Files\Garena Plus\room\garena_room.exe:*:Enabled:Garena -- (Garena Online PTE LTD)
"C:\Program Files\Opera\pluginwrapper\opera_plugin_wrapper.exe" = C:\Program Files\Opera\pluginwrapper\opera_plugin_wrapper.exe:*:Enabled:Opera Internet Browser - Plugin wrapper -- (Opera Software)
========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{083ABCCD-D0A1-4068-A2B1-A4D06E0B9951}" = ESET NOD32 Antivirus
"{09BDEEF0-5590-457D-89A9-5DB2742F9BBF}" = 32 Bit HP CIO Components Installer
"{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox
"{12A76360-388E-4B27-ABEB-D5FC5378DD2A}" = HPPhotoSmartPhotobookWebPack1
"{18669FF9-C8FE-407a-9F70-E674896B1DB4}" = GPBaseService
"{195F2C6C-A343-4b10-B1A4-3F00AB9E9DD9}" = Fax
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20B30DC1-E423-4939-B51D-05C58B0F9BBB}" = HP Photosmart All-In-One Driver Software 10.0 Rel .2
"{23B8A91D-680B-462B-87AD-3D70F7341731}" = iTunes
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java 6 Update 24
"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE
"{36FDBE6E-6684-462b-AE98-9A39A1B200CC}" = HPProductAssistant
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A2EF287-931C-40A0-AAE7-8C00FDB9968A}" = Decipher TextMessage
"{4CACFCD9-F71B-413A-8DF5-1A6419D5CDC6}" = Cards_Calendar_OrderGift_DoMorePlugout
"{52A69E11-7CEB-4a7d-9607-68BA4F39A89B}" = DeviceDiscovery
"{5ACE69F0-A3E8-44eb-88C1-0A841E700180}" = TrayApp
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{679EC478-3FF9-4987-B2FF-C2C2B27532A2}" = DocProc
"{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm
"{6B437F94-056F-4791-AF2C-0D10E2706AF0}" = PanoStandAlone
"{6E19F210-3813-4002-B561-94D66AA182B6}" = Atheros Communications Inc.® L1 Gigabit Ethernet Driver
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7CCEBC24-62DB-4280-A8EC-BFA49F167920}" = Software Update for Web Folders
"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX
"{80533B67-C407-485D-8B5D-63BB8ED9D878}" = Scan
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8A85DEAD-7C1F-4368-881C-72AC74CB2E91}" = UnloadSupport
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ULTIMATER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ULTIMATER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ULTIMATER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ULTIMATER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ULTIMATER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ULTIMATER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ULTIMATER_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ULTIMATER_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ULTIMATER_{F7A31780-33C4-4E39-951A-5EC9B91D7BF1}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ULTIMATER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ULTIMATER_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ULTIMATER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ULTIMATER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ULTIMATER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ULTIMATER_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ULTIMATER_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{91120000-002E-0000-0000-0000000FF1CE}" = Microsoft Office Ultimate 2007
"{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A07840FC-CE63-4CB8-8030-EF4B9805925A}" = HPPhotoSmartDiscLabel_PaperLabel
"{A0B9F8DF-C949-45ed-9808-7DC5C0C19C81}" = Status
"{A5AB9D5E-52E2-440e-A3ED-9512E253C81A}" = SolutionCenter
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.2)
"{ADFB9653-F44C-460C-BF58-189CC552DFFE}" = hpphotosmartdisclabelplugin
"{AF7FC1CA-79DF-43c3-90A3-33EFEB9294CE}" = AIO_Scan
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 285.58
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 285.58
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 135.95
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.11.0621
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.5.20
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B4E91E95-A5BA-4E50-A465-DB7EFEB176E8}" = HPPhotoSmartDiscLabel_PrintOnDisc
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{b9be267c-e096-4cce-a4fd-f24eec004938}" = PS_AIO_02_ProductContext
"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5
"{c4549405-195f-4450-8865-6be9dc5ad136}" = PS_AIO_02_Software_Min
"{C679F9B9-C65D-4C65-BD6C-BF90B859E281}" = Eye 110
"{C708333C-B1B9-43be-B797-49FEC7A8D15B}" = C5200
"{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg
"{cd0b9359-b716-4fd0-8e0a-09b3e312e8a4}" = PS_AIO_02_Software
"{cef78f86-19a8-4bbd-91fa-e9b6b2d37348}" = C5200_Help
"{D99A8E3A-AE5A-4692-8B19-6F16D454E240}" = Destination Component
"{DD3C88A0-C53C-41D0-A21B-6D021981D23E}" = HPPhotoSmartDiscLabelContent1
"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EFC04D3F-A152-47E7-8517-EE0F6201AFEF}" = Apple Mobile Device Support
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F42CD69D-E393-47c8-B2CD-B139C4ADA9A8}" = Copy
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"HP Imaging Device Functions" = HP Imaging Device Functions 10.0
"HP Photosmart Essential" = HP Photosmart Essential 2.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 10.0
"HPOCR" = OCR Software by I.R.I.S. 10.0
"im" = Garena Plus
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Nero - Burning Rom!UninstallKey" = Ahead Nero 6 Demo
"Opera 12.00.1467" = Opera 12.00
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"ULTIMATER" = Microsoft Office Ultimate 2007
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.11
"Winamp" = Winamp
"WinRAR archiver" = WinRAR archiver
"Yahoo! Messenger" = Yahoo! Messenger
========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-73586283-1214440339-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Warcraft III" = Warcraft III: All Products
========== Last 20 Event Log Errors ========== [ Application Events ]
Error - 03.04.2012 04:22:15 | Computer Name = PAULZURBAU | Source = MsiInstaller | ID = 11713
Description = Product: Microsoft Office Word MUI (English) 2007 -- Error 1713. Setup
cannot install one of the required products for Microsoft Office Word MUI (English)
2007.
Error - 17.04.2012 10:08:46 | Computer Name = PAULZURBAU | Source = Bonjour Service | ID = 100
Description =
Error - 17.04.2012 10:08:46 | Computer Name = PAULZURBAU | Source = Bonjour Service | ID = 100
Description =
Error - 17.04.2012 10:08:46 | Computer Name = PAULZURBAU | Source = Bonjour Service | ID = 100
Description =
Error - 17.04.2012 10:08:48 | Computer Name = PAULZURBAU | Source = Bonjour Service | ID = 100
Description =
Error - 17.04.2012 10:08:48 | Computer Name = PAULZURBAU | Source = Bonjour Service | ID = 100
Description =
Error - 17.04.2012 10:08:48 | Computer Name = PAULZURBAU | Source = Bonjour Service | ID = 100
Description =
Error - 12.05.2012 14:31:16 | Computer Name = PAULZURBAU | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application winword.exe, version 12.0.6211.1000, stamp 46d4a7df,
faulting module hpz3r5ha.dll, version 61.71.244.0, stamp 45f91d42, debug? 0, fault
address 0x000467e8.
Error - 12.05.2012 14:53:03 | Computer Name = PAULZURBAU | Source = Microsoft Office 12 | ID = 1000
Description = Faulting application winword.exe, version 12.0.6211.1000, stamp 46d4a7df,
faulting module hpz3r5ha.dll, version 61.71.244.0, stamp 45f91d42, debug? 0, fault
address 0x000467e8.
Error - 21.05.2012 06:31:54 | Computer Name = PAULZURBAU | Source = Microsoft Office 12 | ID = 2000
Description = Accepted Safe Mode action : Microsoft Office PowerPoint.
[ System Events ]
Error - 14.06.2012 10:39:08 | Computer Name = PAULZURBAU | Source = Service Control Manager | ID = 7031
Description = The Apple Mobile Device service terminated unexpectedly. It has done
this 3 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.
Error - 14.06.2012 16:14:52 | Computer Name = PAULZURBAU | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery Service service hung on starting.
Error - 14.06.2012 16:14:52 | Computer Name = PAULZURBAU | Source = Service Control Manager | ID = 7034
Description = The NVIDIA Update Service Daemon service terminated unexpectedly.
It has done this 1 time(s).
Error - 14.06.2012 16:14:52 | Computer Name = PAULZURBAU | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).
Error - 14.06.2012 16:14:52 | Computer Name = PAULZURBAU | Source = Service Control Manager | ID = 7031
Description = The Apple Mobile Device service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.
Error - 14.06.2012 16:15:00 | Computer Name = PAULZURBAU | Source = Service Control Manager | ID = 7034
Description = The IMAPI CD-Burning COM Service service terminated unexpectedly.
It has done this 1 time(s).
Error - 14.06.2012 16:15:11 | Computer Name = PAULZURBAU | Source = Service Control Manager | ID = 7034
Description = The iPod Service service terminated unexpectedly. It has done this
1 time(s).
Error - 14.06.2012 16:15:59 | Computer Name = PAULZURBAU | Source = Service Control Manager | ID = 7031
Description = The Apple Mobile Device service terminated unexpectedly. It has done
this 2 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.
Error - 14.06.2012 16:17:17 | Computer Name = PAULZURBAU | Source = Service Control Manager | ID = 7034
Description = The NVIDIA Driver Helper Service service terminated unexpectedly.
It has done this 1 time(s).
Error - 14.06.2012 16:17:21 | Computer Name = PAULZURBAU | Source = Service Control Manager | ID = 7031
Description = The Apple Mobile Device service terminated unexpectedly. It has done
this 3 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.
< End of report >
aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-06-14 23:26:03
-----------------------------
23:26:03.296 OS Version: Windows 5.1.2600 Service Pack 2
23:26:03.296 Number of processors: 2 586 0x605
23:26:03.296 ComputerName: PAULZURBAU UserName: Paul
23:26:03.531 Initialize success
23:26:09.515 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e
23:26:09.515 Disk 0 Vendor: SAMSUNG_HD161HJ JF100-19 Size: 152627MB BusType: 3
23:26:09.531 Disk 0 MBR read successfully
23:26:09.531 Disk 0 MBR scan
23:26:09.531 Disk 0 Windows XP default MBR code
23:26:09.531 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 24999 MB offset 63
23:26:09.531 Disk 0 Partition - 00 0F Extended LBA 127617 MB offset 51199155
23:26:09.546 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 127617 MB offset 51199218
23:26:09.546 Disk 0 scanning sectors +312560640
23:26:09.625 Disk 0 scanning C:\WINDOWS\system32\drivers
23:26:12.593 Service scanning
23:26:16.859 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32
23:26:18.328 Modules scanning
23:26:22.640 Disk 0 trace - called modules:
23:26:22.718 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x89de51d8]<<
23:26:22.718 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89db9ab8]
23:26:22.718 3 CLASSPNP.SYS[b80e8fcf] -> nt!IofCallDriver -> \Device\00000069[0x89e22d38]
23:26:22.734 5 ACPI.sys[b7e9f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-e[0x89d83d98]
23:26:22.734 \Driver\atapi[0x89e479f8] -> IRP_MJ_CREATE -> 0x89de51d8
23:26:22.734 Scan finished successfully
23:26:38.125 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Paul\Desktop\MBR.dat"
23:26:38.125 The log file has been saved successfully to "C:\Documents and Settings\Paul\Desktop\aswMBR.txt"