I have this text enhance crap that makes words look like links and shows an ad when you hover over the word.
Windows Firewall will not allow me to enable it. An error message appears saying "Windows Firewall can't change some of your settings Error Code: 0x80070424
And lastly I now have a redirect virus that directs me to the Pogo Games website.
OTL logfile created on: 1/16/2013 4:13:33 PM - Run 1
OTL by OldTimer - Version 3.2.15.2 Folder = C:\Users\Sasha\Pictures\Older Pictures\Waterfyre
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
8.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 18.00% Memory free
16.00 Gb Paging File | 7.00 Gb Available in Paging File | 42.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 1383.92 Gb Total Space | 1213.93 Gb Free Space | 87.72% Space Free | Partition Type: NTFS
Drive E: | 298.09 Gb Total Space | 156.22 Gb Free Space | 52.41% Space Free | Partition Type: NTFS
Computer Name: DOOMSDAY | User Name: Sasha | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days
========== Processes (SafeList) ==========
PRC - File not found -- Q:\140066.enu\Office14\WINWORDC.EXE
PRC - File not found -- Q:\140066.enu\Office14\OffSpon.EXE
PRC - [2013/01/07 19:06:24 | 001,248,360 | ---- | M] (Google Inc.) -- C:\Users\Sasha\AppData\Local\Google\Chrome\Application\chrome.exe
PRC - [2012/12/09 23:43:12 | 000,392,312 | ---- | M] (LG Electronics) -- C:\LGMobileUpgrade\LGMOBILEAX\BYR_Client\VZWUAAgent.exe
PRC - [2012/11/21 23:54:09 | 000,296,096 | ---- | M] (RealNetworks, Inc.) -- c:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
PRC - [2012/10/26 12:17:52 | 000,079,384 | ---- | M] (Google) -- C:\Users\Sasha\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
PRC - [2012/04/04 15:36:57 | 000,152,896 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe
PRC - [2012/04/04 15:36:56 | 000,932,608 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\IntelAppStore\bin\AppUp.exe
PRC - [2011/10/17 17:19:14 | 002,521,464 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe
PRC - [2011/10/01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011/09/21 18:37:37 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/09/20 18:04:56 | 000,261,632 | ---- | M] () -- C:\Program Files (x86)\Adobe Media Player\Adobe Media Player.exe
PRC - [2011/09/05 10:04:54 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/08/19 08:26:50 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
PRC - [2011/08/12 11:19:40 | 000,680,984 | ---- | M] () -- C:\Program Files (x86)\Common Files\logishrd\LQCVFX\COCIManager.exe
PRC - [2011/08/12 11:18:42 | 000,205,336 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
PRC - [2011/08/12 11:18:42 | 000,166,424 | ---- | M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\MotionDetection.exe
PRC - [2011/08/12 11:18:30 | 000,265,240 | ---- | M] () -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
PRC - [2011/08/04 16:06:12 | 001,612,920 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
PRC - [2011/07/28 18:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
PRC - [2011/05/15 17:01:44 | 000,478,720 | ---- | M] (Crossrider) -- C:\Program Files (x86)\CrossriderWebApps\Crossrider.exe
PRC - [2011/04/21 06:53:48 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2011/04/21 06:53:33 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011/03/15 17:59:32 | 000,312,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
PRC - [2011/02/07 11:56:11 | 000,138,192 | ---- | M] () -- C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
PRC - [2011/01/17 17:37:40 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2011/01/17 17:37:40 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2010/11/20 22:25:10 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PRC - [2010/11/20 22:24:27 | 000,257,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
PRC - [2010/10/17 21:02:39 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Sasha\Pictures\Older Pictures\Waterfyre\OTL.exe
PRC - [2010/09/13 18:32:32 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010/09/13 18:32:30 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
PRC - [2010/03/10 16:26:30 | 000,237,568 | ---- | M] (Alcor Micro Corp.) -- C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
PRC - [2010/02/28 01:33:14 | 000,077,664 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\OFFICEVIRT.EXE
PRC - [2009/07/26 21:37:50 | 000,180,224 | ---- | M] (PowerISO Computing, Inc.) -- C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
PRC - [2007/06/20 14:39:58 | 000,200,704 | ---- | M] () -- C:\Program Files (x86)\INITIO\Button Manager v1.874\inihid.exe
PRC - [2007/06/06 10:35:02 | 000,270,336 | ---- | M] (ArcSoft, Inc.) -- C:\Program Files (x86)\ArcSoft\TotalMedia Backup & Record\uBBMonitor.exe
========== Modules (SafeList) ==========
MOD - [2012/11/21 23:54:23 | 000,028,160 | ---- | M] (RealNetworks, Inc.) -- C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchrome150browserrecordhelper.dll
MOD - [2011/09/30 02:02:18 | 000,653,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
MOD - [2010/11/20 22:23:55 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
MOD - [2010/10/17 21:02:39 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Sasha\Pictures\Older Pictures\Waterfyre\OTL.exe
========== Win32 Services (SafeList) ==========
SRV:64bit: - [2012/09/27 20:38:16 | 000,239,616 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2011/09/21 21:42:27 | 001,038,088 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64)
SRV:64bit: - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2013/01/08 19:31:21 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/04 18:42:01 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/11/09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011/10/01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011/09/21 18:37:37 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/09/20 19:20:01 | 001,045,256 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011/09/05 10:04:54 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/08/19 08:26:50 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2011/04/21 06:53:48 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/02/07 11:56:11 | 000,138,192 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
SRV - [2010/09/13 18:32:32 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel®
SRV - [2010/03/18 16:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Stopped] -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
========== Driver Services (SafeList) ==========
DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pfc.sys -- (pfc)
DRV:64bit: - [2012/09/27 21:21:20 | 010,697,216 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2012/09/27 20:12:52 | 000,460,288 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2012/08/17 16:26:48 | 000,025,584 | ---- | M] (PC-Doctor, Inc.) [Kernel | On_Demand | Running] -- c:\Program Files\Dell Support Center\pcdsrvc_x64.pkms -- (PCDSRVC{1E208CE0-FB7451FF-06020200}_0)
DRV:64bit: - [2012/05/14 01:12:30 | 000,096,896 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2012/01/18 05:44:28 | 000,351,136 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64)
DRV:64bit: - [2011/10/01 08:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011/10/01 08:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011/10/01 08:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011/10/01 08:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011/09/21 18:37:37 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011/09/21 18:37:37 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011/09/15 20:45:15 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/09/15 20:45:15 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/08/19 08:27:30 | 004,869,024 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvuvc64.sys -- (LVUVC64) Logitech Webcam C210(UVC)
DRV:64bit: - [2011/05/13 03:21:04 | 000,177,640 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdm.sys -- (ssadmdm)
DRV:64bit: - [2011/05/13 03:21:04 | 000,146,920 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadserd.sys -- (ssadserd) SAMSUNG Android USB Diagnostic Serial Port (WDM)
DRV:64bit: - [2011/05/13 03:21:02 | 000,157,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadbus.sys -- (ssadbus) SAMSUNG Android USB Composite Device driver (WDM)
DRV:64bit: - [2011/05/13 03:21:02 | 000,016,872 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdfl.sys -- (ssadmdfl) SAMSUNG Android USB Modem (Filter)
DRV:64bit: - [2010/11/20 22:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 22:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 22:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010/09/21 22:59:38 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel®
DRV:64bit: - [2010/09/14 07:24:26 | 000,437,272 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010/08/31 19:07:06 | 000,317,440 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel®
DRV:64bit: - [2010/06/08 07:36:18 | 000,406,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink
DRV:64bit: - [2010/05/20 18:42:44 | 003,058,168 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2010/03/19 03:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010/02/27 04:32:14 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2008/08/14 06:57:42 | 000,074,720 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysWow64\drivers\adfs.sys -- (adfs)
DRV - [2003/08/11 09:07:46 | 000,014,604 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\pfc.sys -- (pfc)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.gboxapp.com/
IE - HKLM\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.gboxapp.com/
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {3B81079D-2AC9-425f-A494-A1C7D93AFA3C} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "GadgetBox"
FF - prefs.js..browser.search.defaultenginename,S: "GadgetBox"
FF - prefs.js..browser.search.defaulturl: "http://search.gboxapp.com/?q="
FF - prefs.js..browser.search.order.1: "GadgetBox"
FF - prefs.js..browser.search.order.1,S: "GadgetBox"
FF - prefs.js..browser.search.selectedEngine: "GadgetBox"
FF - prefs.js..browser.search.selectedEngine,S: "GadgetBox"
FF - prefs.js..browser.startup.homepage: "http://www.searchqu.com/102"
FF - prefs.js..keyword.URL: "http://dts.search-re...id=102&sr=0&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: ""
FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\ProgramData\CodecCheck\firefox [2011/11/06 22:58:57 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/02/11 18:56:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{0153E448-190B-4987-BDE1-F256CADA672F}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/11/21 23:54:24 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/12/04 18:42:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/12/04 18:41:58 | 000,000,000 | ---D | M]
[2012/11/19 11:14:41 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\Mozilla\Extensions
[2013/01/05 15:20:25 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\Mozilla\Firefox\Profiles\0utth5kf.default\extensions
[2012/12/03 23:54:10 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\Mozilla\Firefox\Profiles\0utth5kf.default\extensions\[email protected]
[2012/09/30 22:54:37 | 000,000,487 | ---- | M] () -- C:\Users\Sasha\AppData\Roaming\Mozilla\Firefox\Profiles\0utth5kf.default\searchplugins\GadgetBox.xml
[2012/02/29 09:30:23 | 000,002,515 | ---- | M] () -- C:\Users\Sasha\AppData\Roaming\Mozilla\Firefox\Profiles\0utth5kf.default\searchplugins\Search_Results.xml
[2012/12/04 18:41:56 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/12/04 18:42:01 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll
[2012/04/03 20:24:27 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
[2012/11/21 23:54:18 | 000,129,176 | ---- | M] (RealPlayer) -- C:\Program Files (x86)\Mozilla Firefox\plugins\nprpplugin.dll
[2012/11/22 12:55:09 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\bing.xml
[2012/02/29 09:30:23 | 000,002,515 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\Search_Results.xml
[2012/11/22 12:55:09 | 000,002,058 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\twitter.xml
O1 HOSTS File: ([2012/12/31 13:02:08 | 000,445,426 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 3dns.adobe.com 3dns-1.adobe.com 3dns-2.adobe.com 3dns-3.adobe.com 3dns-4.adobe.com activate.adobe.com activate-sea.adobe.com activate-sjc0.adobe.com activate.wip.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip1.adobe.com activate.wip2.adobe.com activate.wip3.adobe.com activate.wip4.adobe.com adobe-dns.adobe.com adobe-dns-1.adobe.com adobe-dns-2.adobe.com adobe-dns-3.adobe.com adobe-dns-4.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com practivate.adobe practivate.adobe.com practivate.adobe.newoa practivate.adobe.ntp practivate.adobe.ipp ereg.adobe.com ereg.wip.adobe.com ereg.wip1.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip2.adobe.com ereg.wip3.adobe.com ereg.wip4.adobe.com hl2rcv.adobe.com wip.adobe.com wip1.adobe.com wip2.adobe.com wip3.adobe.com wip4.adobe.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com wwis-dubc1-vip60.adobe.com www.wip.adobe.com www.wip1.adobe.com
O1 - Hosts: 127.0.0.1 www.wip2.adobe.com www.wip3.adobe.com www.wip4.adobe.com wwis-dubc1-vip60.adobe.com crl.verisign.net CRL.VERISIGN.NET ood.opsource.net
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 15291 more lines...
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll File not found
O2 - BHO: (no name) - {9D717F81-9148-4f12-8568-69135F087DB0} - No CLSID value found.
O2 - BHO: (CrossRider) - {A876E312-7D08-401a-B7A6-FAFC5DC2F292} - C:\Program Files (x86)\CrossriderWebApps\Crossrider.dll ()
O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll File not found
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [DellStage] C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe ()
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RunDLLEntry_EptMon] C:\Windows\system32\EptMon64.DLL File not found
O4:64bit: - HKLM..\Run: [RunDLLEntry_THXCfg] C:\Windows\system32\THXCfg64.DLL File not found
O4 - HKLM..\Run: [AccuWeatherWidget] C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe ()
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5Se File not found
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe (Dell, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [Intel AppUp(SM) center] C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe (Intel Corporation)
O4 - HKLM..\Run: [Intel AppUp(SM) center Systray] C:\Program Files (x86)\Intel\IntelAppStore\bin\AppUp.exe (Intel Corporation)
O4 - HKLM..\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [ShwiconXP9106] C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe (Alcor Micro Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [THX Audio Control Panel] C:\Program Files (x86)\Creative\THX TruStudio PC\THXAudioCP\THXAudio.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [TkBellExe] c:\program files (x86)\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [BYRUA_AGENT] C:\LGMobileUpgrade\LGMOBILEAX\BYR_Client\VZWUAAgent.exe (LG Electronics)
O4 - HKCU..\Run: [CrossRiderPlugin] C:\Program Files (x86)\CrossriderWebApps\Crossrider.exe (Crossrider)
O4 - HKCU..\Run: [F.lux] C:\Users\Sasha\Local Settings\Apps\F.lux\flux.exe ()
O4 - HKCU..\Run: [Facebook Update] C:\Users\Sasha\AppData\Local\Facebook\Update\FacebookUpdate.exe File not found
O4 - HKCU..\Run: [ooVoo.exe] C:\Program Files (x86)\ooVoo\ooVoo.exe (ooVoo LLC)
O4 - HKCU..\Run: [Spotify] C:\Users\Sasha\AppData\Roaming\Spotify\spotify.exe (Spotify Ltd)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Sasha\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Vagex] C:\Users\Sasha\Downloads\Vagex\Vagex.exe (Vagex)
O4:64bit: - HKLM..\RunOnce: [EDocs] C:\Program Files\Dell Inc\Dell Edoc Viewer\EDocs.exe (Dell Inc.)
O4 - Startup: C:\Users\Sasha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Sasha\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Sasha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.10.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{b31af55f-e772-11e1-b163-782bcba02785}\Shell - "" = AutoRun
O33 - MountPoints2\{b31af55f-e772-11e1-b163-782bcba02785}\Shell\AutoRun\command - "" = G:\TL_Bootstrap.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 90 Days ==========
[2013/01/16 16:02:20 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013/01/16 16:02:20 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013/01/16 16:02:20 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013/01/16 16:02:17 | 000,000,000 | --SD | C] -- C:\ComboFix
[2013/01/16 16:00:43 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013/01/16 16:00:18 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013/01/10 03:06:17 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013/01/04 19:50:33 | 000,000,000 | ---D | C] -- C:\Users\Sasha\AppData\Local\Microsoft Help
[2013/01/04 19:50:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2013/01/02 21:05:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012/12/31 11:48:06 | 000,000,000 | ---D | C] -- C:\Users\Sasha\AppData\Local\Programs
[2012/12/17 16:46:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Software Update Utility
[2012/12/17 16:44:19 | 000,000,000 | ---D | C] -- C:\Users\Sasha\AppData\Local\Zoom_Downloader
[2012/12/13 17:49:02 | 000,000,000 | ---D | C] -- C:\Users\Sasha\Documents\New folder
[2012/12/12 12:26:59 | 000,000,000 | ---D | C] -- C:\Users\Sasha\Tracing
[2012/12/10 15:12:00 | 000,000,000 | ---D | C] -- C:\Users\Sasha\AppData\Roaming\PACE Anti-Piracy
[2012/12/10 15:12:00 | 000,000,000 | ---D | C] -- C:\Users\Sasha\AppData\Local\PACE Anti-Piracy
[2012/12/10 15:12:00 | 000,000,000 | ---D | C] -- C:\ProgramData\PACE Anti-Piracy
[2012/12/10 15:12:00 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PACE Anti-Piracy
[2012/12/10 15:04:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe Story
[2012/12/10 15:04:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Sonic Shared
[2012/12/10 15:04:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\My Company Name
[2012/12/10 15:03:55 | 000,000,000 | ---D | C] -- C:\adobeTemp
[2012/12/10 12:43:02 | 000,000,000 | ---D | C] -- C:\Users\Sasha\Documents\pro
[2012/12/10 12:42:04 | 000,000,000 | ---D | C] -- C:\Users\Sasha\Documents\redist
[2012/12/10 12:40:23 | 000,000,000 | ---D | C] -- C:\Users\Sasha\Documents\payloads
[2012/12/10 12:40:20 | 000,000,000 | ---D | C] -- C:\Users\Sasha\Documents\Italiano
[2012/12/10 12:40:16 | 000,000,000 | ---D | C] -- C:\Users\Sasha\Documents\Fran_ais
[2012/12/10 12:40:12 | 000,000,000 | ---D | C] -- C:\Users\Sasha\Documents\Espa_ol
[2012/12/10 12:40:07 | 000,000,000 | ---D | C] -- C:\Users\Sasha\Documents\English
[2012/12/10 12:40:03 | 000,000,000 | ---D | C] -- C:\Users\Sasha\Documents\Deutsch
[2012/12/10 12:40:03 | 000,000,000 | ---D | C] -- C:\Users\Sasha\Documents\deployment
[2012/12/10 12:40:01 | 000,000,000 | ---D | C] -- C:\Users\Sasha\Documents\Crack
[2012/12/08 01:08:50 | 000,000,000 | ---D | C] -- C:\Users\Sasha\Documents\Games
[2012/12/08 00:31:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Project64 1.6
[2012/12/04 18:41:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012/11/24 03:03:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012/11/24 03:03:57 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2012/11/23 01:47:30 | 000,000,000 | -H-D | C] -- C:\Users\Sasha\AppData\Local\vsvHrdA3VxJzF
[2012/11/22 12:55:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012/11/22 12:55:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012/11/21 23:54:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\xing shared
[2012/11/21 23:54:17 | 000,272,896 | ---- | C] (Progressive Networks) -- C:\Windows\SysWow64\pncrt.dll
[2012/11/21 19:47:36 | 000,000,000 | ---D | C] -- C:\Users\Sasha\AppData\Local\Vagex
[2012/11/20 20:25:01 | 000,000,000 | ---D | C] -- C:\Users\Sasha\AppData\Local\{85080DA2-A152-4866-AE59-511D8C367BA5}
[2012/11/15 09:53:19 | 000,000,000 | ---D | C] -- C:\Users\Sasha\Documents\phpSitemapNG
[2012/11/12 20:00:16 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2012/11/02 16:43:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Participatory Culture Foundation
[2012/11/02 15:43:26 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2012/11/02 15:43:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT
[2012/11/02 15:43:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2012/10/30 18:36:58 | 000,000,000 | ---D | C] -- C:\Users\Sasha\AppData\Roaming\ArcSoft
[2012/10/30 18:25:53 | 000,019,892 | ---- | C] (Initio Corp.) -- C:\Windows\SysWow64\drivers\ISBSTOR.sys
[2012/10/30 18:25:53 | 000,013,758 | ---- | C] (Initio Corp.) -- C:\Windows\SysWow64\drivers\gpio98.sys
[2012/10/30 18:25:53 | 000,013,696 | ---- | C] (Initio Corp.) -- C:\Windows\SysWow64\drivers\inigpio.sys
[2012/10/30 18:25:53 | 000,004,736 | ---- | C] (Initio) -- C:\Windows\SysWow64\drivers\UsbFi2K.sys
[2012/10/30 18:25:53 | 000,000,000 | ---D | C] -- C:\Windows\System\IoSubSys
[2012/10/30 18:25:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\INITIO
[2012/10/30 18:25:03 | 000,022,784 | ---- | C] (Arcsoft, Inc.) -- C:\Windows\SysWow64\drivers\afc.sys
[2012/10/30 18:24:56 | 000,212,480 | ---- | C] (Eastman Kodak) -- C:\Windows\PCDLIB32.DLL
[2012/10/30 18:24:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ArcSoft
[2012/10/30 18:24:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ArcSoft
[2012/10/18 22:17:11 | 000,000,000 | ---D | C] -- C:\Users\Sasha\Documents\Welding
[1 C:\Users\Sasha\Documents\*.tmp files -> C:\Users\Sasha\Documents\*.tmp -> ]
========== Files - Modified Within 90 Days ==========
[2013/01/16 15:49:00 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-175057651-2618150129-1025104438-1000UA.job
[2013/01/16 15:31:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/01/16 14:34:00 | 000,000,928 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-175057651-2618150129-1025104438-1000UA.job
[2013/01/15 20:34:00 | 000,000,906 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-175057651-2618150129-1025104438-1000Core.job
[2013/01/15 18:49:00 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-175057651-2618150129-1025104438-1000Core.job
[2013/01/15 05:21:17 | 000,021,296 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/15 05:21:17 | 000,021,296 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/14 17:50:15 | 000,002,368 | ---- | M] () -- C:\Users\Sasha\Desktop\Google Chrome.lnk
[2013/01/14 01:02:46 | 000,000,162 | -H-- | M] () -- C:\Users\Sasha\Documents\~$e Art of Performing.docx
[2013/01/11 15:17:20 | 000,000,358 | -H-- | M] () -- C:\Windows\tasks\GBoxUpdaterTask{AB87E263-C16C-4F48-B38F-08C90EDB28E3}.job
[2013/01/11 15:17:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/01/11 15:17:04 | 2133,676,031 | -HS- | M] () -- C:\hiberfil.sys
[2013/01/10 06:39:50 | 004,874,136 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/01/02 19:40:04 | 000,846,250 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/01/02 19:40:04 | 000,183,980 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/01/02 19:40:04 | 000,006,498 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/12/31 13:02:08 | 000,445,426 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012/12/31 13:01:23 | 000,445,426 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20121231-130208.backup
[2012/12/31 11:48:22 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/12/31 02:29:13 | 000,218,237 | ---- | M] () -- C:\Users\Sasha\Documents\openMICspam2.jpg
[2012/12/31 02:28:04 | 000,379,458 | ---- | M] () -- C:\Users\Sasha\Documents\openMICspam.jpg
[2012/12/29 18:27:48 | 000,029,921 | ---- | M] () -- C:\Users\Sasha\Documents\Invoice - Anthony Sicari.docx
[2012/12/29 18:27:24 | 000,028,672 | ---- | M] () -- C:\Users\Sasha\Documents\Performance Agreement - Anthony Sicari.doc
[2012/12/29 18:26:26 | 000,029,184 | ---- | M] () -- C:\Users\Sasha\Documents\Performance Agreement - Sharyn Scott.doc
[2012/12/29 18:26:10 | 000,029,184 | ---- | M] () -- C:\Users\Sasha\Documents\Performance Agreement - Robin Lynch.doc
[2012/12/29 18:25:53 | 000,022,016 | ---- | M] () -- C:\Users\Sasha\Documents\Performance Agreement - Rob Luhmann.doc
[2012/12/29 18:25:53 | 000,000,162 | -H-- | M] () -- C:\Users\Sasha\Documents\~$rformance Agreement - Rob Luhmann.doc
[2012/12/29 18:25:13 | 000,022,016 | ---- | M] () -- C:\Users\Sasha\Documents\Performance Agreement - Erika Bansen.doc
[2012/12/29 18:24:32 | 000,022,016 | ---- | M] () -- C:\Users\Sasha\Documents\Performance Agreement - Lisa Elkins.doc
[2012/12/28 19:41:22 | 000,001,053 | ---- | M] () -- C:\Users\Sasha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012/12/28 19:41:17 | 000,001,021 | ---- | M] () -- C:\Users\Sasha\Desktop\Dropbox.lnk
[2012/12/14 16:49:28 | 000,024,176 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/12/10 15:25:04 | 000,733,905 | ---- | M] () -- C:\Users\Sasha\Documents\First Night Hold Harmless - Sasha Gaulin.pdf
[2012/12/10 15:21:39 | 000,015,966 | ---- | M] () -- C:\Users\Sasha\Documents\The Art of Performing.docx
[2012/12/10 15:12:00 | 000,000,021 | ---- | M] () -- C:\Windows\SurCode.INI
[2012/12/10 15:10:32 | 000,011,776 | ---- | M] () -- C:\Users\Sasha\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/12/10 13:24:27 | 000,000,769 | ---- | M] () -- C:\Users\Sasha\AppData\Local\recently-used.xbel
[2012/12/04 18:28:44 | 000,867,188 | ---- | M] () -- C:\Users\Sasha\Documents\IMG.pdf
[2012/12/04 18:28:44 | 000,867,188 | ---- | M] () -- C:\Users\Sasha\Documents\First Night - Sasha Fire.pdf
[2012/11/25 22:14:01 | 000,037,020 | ---- | M] () -- C:\Users\Sasha\Desktop\performance email form.rtf
[2012/11/21 23:54:32 | 000,001,042 | ---- | M] () -- C:\Users\Public\Desktop\RealPlayer.lnk
[2012/11/21 23:54:17 | 000,272,896 | ---- | M] (Progressive Networks) -- C:\Windows\SysWow64\pncrt.dll
[2012/11/15 12:08:29 | 000,834,443 | ---- | M] () -- C:\Users\Sasha\Documents\FireGypsy_sitemap.xml
[2012/11/12 19:38:47 | 000,829,301 | ---- | M] () -- C:\Users\Sasha\Documents\TheBosyAlternativeSmall.jpg
[2012/11/12 19:33:02 | 001,815,997 | ---- | M] () -- C:\Users\Sasha\Documents\photo (2).JPG
[2012/11/12 19:19:29 | 002,191,422 | ---- | M] () -- C:\Users\Sasha\Documents\TheBodyAlternative3.jpg
[2012/11/12 19:13:49 | 002,174,165 | ---- | M] () -- C:\Users\Sasha\Documents\TheBodyAlternative2.jpg
[2012/11/12 19:02:35 | 002,078,371 | ---- | M] () -- C:\Users\Sasha\Documents\TheBodyAlternative.jpg
[2012/11/12 19:00:29 | 000,019,301 | ---- | M] () -- C:\Users\Sasha\Documents\labret-body-jewelry-2.jpg
[2012/11/12 18:56:09 | 000,015,906 | ---- | M] () -- C:\Users\Sasha\Documents\te1154z300x228.jpg
[2012/11/12 18:30:49 | 000,006,813 | ---- | M] () -- C:\Users\Sasha\Documents\identifying-qualified-piercing.jpg
[2012/11/12 18:10:54 | 000,015,714 | ---- | M] () -- C:\Users\Sasha\Documents\1081.jpg
[2012/11/12 18:01:53 | 000,127,119 | ---- | M] () -- C:\Users\Sasha\Documents\photo (1).JPG
[2012/11/12 18:01:48 | 002,297,756 | ---- | M] () -- C:\Users\Sasha\Documents\photo.JPG
[2012/11/11 15:51:51 | 000,018,787 | ---- | M] () -- C:\Users\Sasha\Documents\invoice - Haverford.docx
[2012/10/30 18:46:33 | 000,000,020 | -HS- | M] () -- C:\ArcDeviceInfo
[2012/10/30 18:46:26 | 000,000,094 | ---- | M] () -- C:\Windows\MusicRip.ini
[2012/10/30 18:25:53 | 000,000,996 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Button Manager v1.874.lnk
[2012/10/30 18:25:03 | 000,002,103 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TotalMedia Backup Monitor.lnk
[2012/10/30 18:25:03 | 000,002,078 | ---- | M] () -- C:\Users\Public\Desktop\TotalMedia Backup & Record.lnk
[2012/10/18 22:15:22 | 000,000,162 | -H-- | M] () -- C:\Users\Sasha\Desktop\~$ whom this may concern.docx
[2012/10/18 20:08:22 | 000,018,244 | ---- | M] () -- C:\Users\Sasha\Documents\Performance Agreement - Cosgrove.docx
[2012/10/18 20:07:24 | 000,000,162 | -H-- | M] () -- C:\Users\Sasha\Documents\~$rformance Agreement - Cosgrove.docx
[1 C:\Users\Sasha\Documents\*.tmp files -> C:\Users\Sasha\Documents\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013/01/16 16:02:20 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/01/16 16:02:20 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/01/16 16:02:20 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/01/16 16:02:20 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/01/16 16:02:20 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013/01/14 01:02:46 | 000,000,162 | -H-- | C] () -- C:\Users\Sasha\Documents\~$e Art of Performing.docx
[2012/12/31 02:29:12 | 000,218,237 | ---- | C] () -- C:\Users\Sasha\Documents\openMICspam2.jpg
[2012/12/31 02:28:02 | 000,379,458 | ---- | C] () -- C:\Users\Sasha\Documents\openMICspam.jpg
[2012/12/29 18:27:48 | 000,029,921 | ---- | C] () -- C:\Users\Sasha\Documents\Invoice - Anthony Sicari.docx
[2012/12/29 18:25:53 | 000,000,162 | -H-- | C] () -- C:\Users\Sasha\Documents\~$rformance Agreement - Rob Luhmann.doc
[2012/12/29 18:25:52 | 000,022,016 | ---- | C] () -- C:\Users\Sasha\Documents\Performance Agreement - Rob Luhmann.doc
[2012/12/29 18:25:13 | 000,022,016 | ---- | C] () -- C:\Users\Sasha\Documents\Performance Agreement - Erika Bansen.doc
[2012/12/29 18:24:32 | 000,022,016 | ---- | C] () -- C:\Users\Sasha\Documents\Performance Agreement - Lisa Elkins.doc
[2012/12/29 18:21:50 | 000,029,184 | ---- | C] () -- C:\Users\Sasha\Documents\Performance Agreement - Sharyn Scott.doc
[2012/12/29 18:18:29 | 000,029,184 | ---- | C] () -- C:\Users\Sasha\Documents\Performance Agreement - Robin Lynch.doc
[2012/12/29 18:14:24 | 000,028,672 | ---- | C] () -- C:\Users\Sasha\Documents\Performance Agreement - Anthony Sicari.doc
[2012/12/10 15:25:33 | 000,733,905 | ---- | C] () -- C:\Users\Sasha\Documents\First Night Hold Harmless - Sasha Gaulin.pdf
[2012/12/10 15:21:37 | 000,015,966 | ---- | C] () -- C:\Users\Sasha\Documents\The Art of Performing.docx
[2012/12/10 15:12:00 | 000,000,021 | ---- | C] () -- C:\Windows\SurCode.INI
[2012/12/10 13:24:27 | 000,000,769 | ---- | C] () -- C:\Users\Sasha\AppData\Local\recently-used.xbel
[2012/12/04 18:30:31 | 000,867,188 | ---- | C] () -- C:\Users\Sasha\Documents\First Night - Sasha Fire.pdf
[2012/12/04 18:29:38 | 000,867,188 | ---- | C] () -- C:\Users\Sasha\Documents\IMG.pdf
[2012/11/21 23:54:32 | 000,001,042 | ---- | C] () -- C:\Users\Public\Desktop\RealPlayer.lnk
[2012/11/15 12:08:27 | 000,834,443 | ---- | C] () -- C:\Users\Sasha\Documents\FireGypsy_sitemap.xml
[2012/11/15 09:56:29 | 000,082,957 | ---- | C] () -- C:\Users\Sasha\Documents\sitemap_gen.pl
[2012/11/15 09:56:29 | 000,005,662 | ---- | C] () -- C:\Users\Sasha\Documents\example_config.xml
[2012/11/15 09:56:29 | 000,003,259 | ---- | C] () -- C:\Users\Sasha\Documents\README
[2012/11/15 09:56:29 | 000,000,293 | ---- | C] () -- C:\Users\Sasha\Documents\PKG-INFO
[2012/11/15 03:06:14 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012/11/15 03:01:14 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012/11/12 19:38:45 | 000,829,301 | ---- | C] () -- C:\Users\Sasha\Documents\TheBosyAlternativeSmall.jpg
[2012/11/12 19:33:02 | 001,815,997 | ---- | C] () -- C:\Users\Sasha\Documents\photo (2).JPG
[2012/11/12 19:19:27 | 002,191,422 | ---- | C] () -- C:\Users\Sasha\Documents\TheBodyAlternative3.jpg
[2012/11/12 19:13:48 | 002,174,165 | ---- | C] () -- C:\Users\Sasha\Documents\TheBodyAlternative2.jpg
[2012/11/12 19:02:31 | 002,078,371 | ---- | C] () -- C:\Users\Sasha\Documents\TheBodyAlternative.jpg
[2012/11/12 19:00:28 | 000,019,301 | ---- | C] () -- C:\Users\Sasha\Documents\labret-body-jewelry-2.jpg
[2012/11/12 18:56:09 | 000,015,906 | ---- | C] () -- C:\Users\Sasha\Documents\te1154z300x228.jpg
[2012/11/12 18:30:48 | 000,006,813 | ---- | C] () -- C:\Users\Sasha\Documents\identifying-qualified-piercing.jpg
[2012/11/12 18:10:54 | 000,015,714 | ---- | C] () -- C:\Users\Sasha\Documents\1081.jpg
[2012/11/12 18:01:53 | 000,127,119 | ---- | C] () -- C:\Users\Sasha\Documents\photo (1).JPG
[2012/11/12 18:01:47 | 002,297,756 | ---- | C] () -- C:\Users\Sasha\Documents\photo.JPG
[2012/11/11 15:51:51 | 000,018,787 | ---- | C] () -- C:\Users\Sasha\Documents\invoice - Haverford.docx
[2012/10/30 18:46:33 | 000,000,020 | -HS- | C] () -- C:\ArcDeviceInfo
[2012/10/30 18:46:26 | 000,000,094 | ---- | C] () -- C:\Windows\MusicRip.ini
[2012/10/30 18:25:53 | 000,001,422 | ---- | C] () -- C:\Program Files (x86)\ReadMe.txt
[2012/10/30 18:25:53 | 000,000,996 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Button Manager v1.874.lnk
[2012/10/30 18:25:03 | 000,002,103 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TotalMedia Backup Monitor.lnk
[2012/10/30 18:25:03 | 000,002,078 | ---- | C] () -- C:\Users\Public\Desktop\TotalMedia Backup & Record.lnk
[2012/10/18 22:15:22 | 000,000,162 | -H-- | C] () -- C:\Users\Sasha\Desktop\~$ whom this may concern.docx
[2012/10/18 20:07:24 | 000,000,162 | -H-- | C] () -- C:\Users\Sasha\Documents\~$rformance Agreement - Cosgrove.docx
[2012/10/18 20:07:23 | 000,018,244 | ---- | C] () -- C:\Users\Sasha\Documents\Performance Agreement - Cosgrove.docx
[2012/09/10 20:02:42 | 000,000,065 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini
[2012/05/02 13:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012/02/29 09:30:28 | 000,076,407 | ---- | C] () -- C:\Users\Sasha\AppData\Roaming\Smiley.ico
[2011/11/17 18:47:35 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011/11/16 19:44:12 | 000,011,776 | ---- | C] () -- C:\Users\Sasha\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/09/20 19:20:21 | 000,001,264 | ---- | C] () -- C:\Windows\THXCfg_SP_APOIM.ini
[2011/09/20 19:20:21 | 000,001,247 | ---- | C] () -- C:\Windows\THXCfg_HP_APOIM.ini
[2011/09/20 19:20:21 | 000,001,247 | ---- | C] () -- C:\Windows\THXCfg_APOIM.ini
[2011/09/20 19:20:20 | 000,177,664 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011/09/20 19:20:20 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2011/08/19 08:26:20 | 010,898,456 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll
[2011/08/19 08:26:20 | 000,336,408 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2011/02/10 11:10:51 | 000,773,512 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2002/10/15 17:54:04 | 000,153,088 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2002/10/06 13:42:58 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\OggDS.dll
[2002/10/04 18:04:26 | 000,921,600 | ---- | C] () -- C:\Windows\SysWow64\VorbisEnc.dll
[2002/10/04 18:04:26 | 000,188,416 | ---- | C] () -- C:\Windows\SysWow64\vorbis.dll
[2002/10/04 18:04:18 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\ogg.dll
[2002/05/15 19:38:40 | 000,091,136 | ---- | C] () -- C:\Windows\SysWow64\mp4fil32.dll
[2002/05/04 09:19:00 | 000,049,152 | ---- | C] () -- C:\Windows\SysWow64\avisynthEx.dll
[2002/04/19 10:23:26 | 000,106,137 | ---- | C] () -- C:\Windows\SysWow64\libpostproc.dll
[2002/04/19 09:51:04 | 000,211,760 | ---- | C] () -- C:\Windows\SysWow64\libavcodec.dll
[2001/06/22 07:06:02 | 000,167,936 | ---- | C] () -- C:\Windows\SysWow64\MPEG2DEC.dll
========== LOP Check ==========
[2012/08/15 14:46:02 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\Canon
[2013/01/14 18:18:06 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\Dropbox
[2011/10/21 20:40:21 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\FileZilla
[2011/09/20 17:43:23 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\Fingertapps
[2011/09/20 17:43:11 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\Leadertech
[2011/10/04 17:13:25 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\NetMedia Providers
[2012/05/17 19:37:27 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\ooVoo Details
[2011/09/26 16:49:23 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\OpenOffice.org
[2012/12/10 15:12:00 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\PACE Anti-Piracy
[2011/09/27 11:02:14 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\PCDr
[2012/12/12 12:37:45 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\Publish Providers
[2013/01/10 03:25:16 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\SoftGrid Client
[2011/10/04 17:13:25 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\Sony
[2013/01/15 15:06:00 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\Spotify
[2011/09/20 18:40:45 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011/09/26 16:50:09 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\TP
[2013/01/16 16:03:25 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\uTorrent
[2012/02/29 09:19:10 | 000,000,000 | ---D | M] -- C:\Users\Sasha\AppData\Roaming\WinISO Computing
[2013/01/15 20:34:00 | 000,000,906 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-175057651-2618150129-1025104438-1000Core.job
[2013/01/16 14:34:00 | 000,000,928 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-175057651-2618150129-1025104438-1000UA.job
[2013/01/11 15:17:20 | 000,000,358 | -H-- | M] () -- C:\Windows\Tasks\GBoxUpdaterTask{AB87E263-C16C-4F48-B38F-08C90EDB28E3}.job
[2009/07/14 00:08:49 | 000,021,456 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 966 bytes -> C:\ProgramData\Microsoft:gtx5Gjmh9Tod5geC78fPN
@Alternate Data Stream - 1190 bytes -> C:\ProgramData\Microsoft:khl8uejdQ3xy0iRQG1LMVLTY
@Alternate Data Stream - 1147 bytes -> C:\ProgramData\Microsoft:TjcHdea7N6NpkHbDHbNak
< End of report >