open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Instructions followed carefully. This was the only flaw.
I needed to be in Program Files (x86) for this. I don't know why, but I get excited each time it's time for more instructions. XD Anyway, my computer is slightly slow to respond again, I'm noticing.
MBAM Log:Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Database version: v2013.05.28.05
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16576
Bearbear :: BEARBEAR-PC [administrator]
5/28/2013 10:20:45 AM
mbam-log-2013-05-28 (10-20-45).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 206518
Time elapsed: 1 minute(s), 30 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
ESET Log:ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=867055602ff37e4582746203b015de0a
# engine=13939
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2013-05-28 04:33:55
# local_time=2013-05-28 11:33:55 (-0600, Central Daylight Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 0 121302285 0 0
# scanned=103241
# found=0
# cleaned=0
# scan_time=3897
Wininit/CHKDSK Log:Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 5/28/2013 12:03:09 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: Bearbear-PC
Description:
Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
152320 file records processed.
File verification completed.
223 large file records processed.
0 bad file records processed.
0 EA records processed.
44 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 5)...
188898 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 5)...
152320 file SDs/SIDs processed.
Cleaning up 12 unused index entries from index $SII of file 0x9.
Cleaning up 12 unused index entries from index $SDH of file 0x9.
Cleaning up 12 unused security descriptors.
Security descriptor verification completed.
18290 data files processed.
CHKDSK is verifying Usn Journal...
33643456 USN bytes processed.
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
Read failure with status 0xc0000185 at offset 0x4c34b01000 for 0x10000 bytes.
Read failure with status 0xc0000185 at offset 0x4c34b01000 for 0x1000 bytes.
Read failure with status 0xc0000185 at offset 0x4c35da3000 for 0x10000 bytes.
Read failure with status 0xc0000185 at offset 0x4c35da6000 for 0x1000 bytes.
Read failure with status 0xc0000185 at offset 0x4c36d4f000 for 0x10000 bytes.
Read failure with status 0xc0000185 at offset 0x4c36d4f000 for 0x1000 bytes.
Windows replaced bad clusters in file 13618
of name \Nexon\Mabinogi\package\145_FU~1.PAC.
152304 files processed.
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
149966089 free clusters processed.
Free space verification is complete.
Adding 411 bad clusters to the Bad Clusters File.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.
625027071 KB total disk space.
24753916 KB in 83359 files.
64140 KB in 18291 indexes.
75372 KB in bad sectors.
270919 KB in use by the system.
65536 KB occupied by the log file.
599862724 KB available on disk.
4096 bytes in each allocation unit.
156256767 total allocation units on disk.
149965681 allocation units available on disk.
Internal Info:
00 53 02 00 1e 8d 01 00 a1 1d 03 00 00 00 00 00 .S..............
87 00 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 ....,...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.
Event Xml:
<Event xmlns="
http://schemas.micro.../events/event"> <System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-05-28T05:03:09.000000000Z" />
<EventRecordID>1545</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Bearbear-PC</Computer>
<Security />
</System>
<EventData>
<Data>
Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
152320 file records processed.
File verification completed.
223 large file records processed.
0 bad file records processed.
0 EA records processed.
44 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 5)...
188898 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 5)...
152320 file SDs/SIDs processed.
Cleaning up 12 unused index entries from index $SII of file 0x9.
Cleaning up 12 unused index entries from index $SDH of file 0x9.
Cleaning up 12 unused security descriptors.
Security descriptor verification completed.
18290 data files processed.
CHKDSK is verifying Usn Journal...
33643456 USN bytes processed.
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
Read failure with status 0xc0000185 at offset 0x4c34b01000 for 0x10000 bytes.
Read failure with status 0xc0000185 at offset 0x4c34b01000 for 0x1000 bytes.
Read failure with status 0xc0000185 at offset 0x4c35da3000 for 0x10000 bytes.
Read failure with status 0xc0000185 at offset 0x4c35da6000 for 0x1000 bytes.
Read failure with status 0xc0000185 at offset 0x4c36d4f000 for 0x10000 bytes.
Read failure with status 0xc0000185 at offset 0x4c36d4f000 for 0x1000 bytes.
Windows replaced bad clusters in file 13618
of name \Nexon\Mabinogi\package\145_FU~1.PAC.
152304 files processed.
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
149966089 free clusters processed.
Free space verification is complete.
Adding 411 bad clusters to the Bad Clusters File.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.
625027071 KB total disk space.
24753916 KB in 83359 files.
64140 KB in 18291 indexes.
75372 KB in bad sectors.
270919 KB in use by the system.
65536 KB occupied by the log file.
599862724 KB available on disk.
4096 bytes in each allocation unit.
156256767 total allocation units on disk.
149965681 allocation units available on disk.
Internal Info:
00 53 02 00 1e 8d 01 00 a1 1d 03 00 00 00 00 00 .S..............
87 00 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 ....,...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
</EventData>
</Event>
OTL Log:OTL logfile created on: 5/28/2013 12:17:26 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Bearbear\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.91 Gb Total Physical Memory | 2.55 Gb Available Physical Memory | 65.31% Memory free
7.82 Gb Paging File | 6.51 Gb Available in Paging File | 83.30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 596.07 Gb Total Space | 571.88 Gb Free Space | 95.94% Space Free | Partition Type: NTFS
Computer Name: BEARBEAR-PC | User Name: Bearbear | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ========== PRC - [2013/05/23 07:33:11 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Bearbear\Desktop\OTL.exe
PRC - [2013/05/23 00:44:09 | 000,825,808 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2013/02/07 12:35:46 | 000,546,944 | ---- | M] (ESET) -- C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe
PRC - [2011/02/01 13:24:42 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
PRC - [2011/02/01 13:24:40 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
========== Modules (No Company Name) ========== MOD - [2013/05/23 00:44:07 | 000,393,168 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\ppgooglenaclpluginchrome.dll
MOD - [2013/05/23 00:43:59 | 004,051,408 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\pdf.dll
MOD - [2013/05/23 00:43:06 | 000,599,504 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\libglesv2.dll
MOD - [2013/05/23 00:43:05 | 000,124,368 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\libegl.dll
MOD - [2013/05/23 00:43:03 | 001,597,392 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\ffmpegsumo.dll
========== Services (SafeList) ========== SRV:
64bit: - [2013/01/27 11:34:32 | 000,379,360 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:
64bit: - [2013/01/27 11:34:32 | 000,022,056 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:
64bit: - [2010/10/19 14:51:44 | 001,430,288 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:
64bit: - [2010/10/19 14:31:40 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)
SRV:
64bit: - [2010/10/19 14:29:38 | 000,838,928 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:
64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2011/02/01 13:24:42 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2011/02/01 13:24:40 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
========== Driver Services (SafeList) ========== DRV:
64bit: - [2013/01/20 15:59:04 | 000,130,008 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:
64bit: - [2012/08/23 09:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:
64bit: - [2012/08/23 09:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:
64bit: - [2012/08/23 09:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:
64bit: - [2012/03/01 01:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:
64bit: - [2011/06/10 06:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:
64bit: - [2011/05/26 08:21:28 | 000,174,680 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR)
DRV:
64bit: - [2011/04/05 03:10:16 | 012,262,624 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:
64bit: - [2011/03/11 01:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:
64bit: - [2011/03/11 01:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:
64bit: - [2011/02/10 14:52:34 | 000,181,760 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:
64bit: - [2011/02/10 14:52:34 | 000,082,432 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:
64bit: - [2010/11/20 22:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:
64bit: - [2010/11/20 22:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:
64bit: - [2010/10/19 16:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:
64bit: - [2010/10/18 02:21:32 | 008,153,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64)
DRV:
64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:
64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:
64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:
64bit: - [2009/06/29 08:16:20 | 000,014,784 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\Thpevm.sys -- (Thpevm)
DRV:
64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:
64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:
64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:
64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:
64bit: - [2007/11/09 05:00:30 | 000,026,968 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)
DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:
64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:
64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" =
http://www.bing.com/...ms}&FORM=IE8SRCIE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" =
http://www.bing.com/...ms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3713297176-944618025-1417552208-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache =
http://www.msn.com/?ocid=iehpIE - HKU\S-1-5-21-3713297176-944618025-1417552208-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKU\S-1-5-21-3713297176-944618025-1417552208-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E5 53 C0 C3 68 57 CE 01 [binary data]
IE - HKU\S-1-5-21-3713297176-944618025-1417552208-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3713297176-944618025-1417552208-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ========== FF:
64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
========== Chrome ========== CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - Extension: YouTube = C:\Users\Bearbear\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Adblock Plus = C:\Users\Bearbear\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.4_0\
CHR - Extension: Google Search = C:\Users\Bearbear\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Wolf and the Ice Planet = C:\Users\Bearbear\AppData\Local\Google\Chrome\User Data\Default\Extensions\gffkhmkbijdmbncaoclaclldnbndflck\1_0\
O1 HOSTS File: ([2013/05/25 08:14:26 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O4:
64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:
64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:
64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4:
64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:
64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O13
64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D22093CA-E336-4018-A821-01CC23D08FDF}: DhcpNameServer = 192.168.1.1
O20:
64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:
64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:
64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:
64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:
64bit: - HKLM\..comfile [open] -- "%1" %*
O35:
64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:
64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:
64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ========== [2013/05/28 10:25:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2013/05/28 10:20:05 | 000,000,000 | ---D | C] -- C:\Users\Bearbear\AppData\Roaming\Malwarebytes
[2013/05/28 10:19:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/05/28 10:19:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013/05/28 10:19:30 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013/05/28 10:19:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/05/25 15:23:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client
[2013/05/25 15:23:57 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2013/05/25 08:14:25 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/05/23 21:50:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Nexon
[2013/05/23 13:35:38 | 000,000,000 | ---D | C] -- C:\ProgramData\NexonUS
[2013/05/23 13:35:31 | 000,000,000 | --SD | C] -- C:\Users\Bearbear\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mabinogi
[2013/05/23 13:35:28 | 000,000,000 | ---D | C] -- C:\Nexon
[2013/05/23 12:37:01 | 000,000,000 | --SD | C] -- C:\Users\Bearbear\Documents\Mabinogi
[2013/05/23 07:52:12 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Bearbear\Desktop\OTL.exe
[2013/05/23 01:54:10 | 000,000,000 | ---D | C] -- C:\Windows\tasks\TaskDisabled
[2013/05/23 00:35:55 | 000,000,000 | ---D | C] -- C:\ProgramData\{CED89F1A-945F-46EC-B23C-5EAF6D2DB12A}
[2013/05/23 00:35:53 | 000,000,000 | ---D | C] -- C:\Users\Bearbear\AppData\Roaming\Apple Computer
[2013/05/23 00:35:52 | 000,000,000 | ---D | C] -- C:\ProgramData\{BDDB56DE-AE4E-48A2-B856-FB60C8498453}
[2013/05/22 23:42:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2013/05/22 23:33:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2013/05/22 23:31:25 | 000,000,000 | ---D | C] -- C:\Users\Bearbear\AppData\Local\Programs
[2013/05/22 23:06:59 | 000,000,000 | ---D | C] -- C:\Users\Bearbear\AppData\Roaming\Adobe
[2013/05/22 23:02:55 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Wat
[2013/05/22 23:02:55 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Wat
[2013/05/22 22:53:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013/05/22 22:52:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2013/05/22 22:52:27 | 000,000,000 | ---D | C] -- C:\Users\Bearbear\AppData\Local\Google
[2013/05/22 22:52:17 | 000,000,000 | ---D | C] -- C:\Users\Bearbear\AppData\Local\Deployment
[2013/05/22 21:22:09 | 000,000,000 | ---D | C] -- C:\Users\Bearbear\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows 7 USB DVD Download Tool
[2013/05/22 21:22:09 | 000,000,000 | ---D | C] -- C:\Users\Bearbear\AppData\Local\Apps
[2013/05/22 21:18:14 | 000,000,000 | ---D | C] -- C:\Users\Bearbear\AppData\Roaming\Intel
[2013/05/22 21:16:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet Wireless
[2013/05/22 21:15:52 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel
[2013/05/22 21:15:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Intel
[2013/05/22 21:15:51 | 000,000,000 | ---D | C] -- C:\Program Files\Intel
[2013/05/22 21:15:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cisco
[2013/05/22 20:55:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\postureAgent
[2013/05/22 20:55:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Intel
[2013/05/22 20:55:11 | 000,000,000 | ---D | C] -- C:\Intel
[2013/05/22 20:54:35 | 000,000,000 | ---D | C] -- C:\Program Files\Synaptics
[2013/05/22 20:37:36 | 000,000,000 | ---D | C] -- C:\Users\Bearbear\AppData\Local\Diagnostics
[2013/05/22 20:34:40 | 000,000,000 | ---D | C] -- C:\Users\Bearbear\AppData\Local\Toshiba
[2013/05/22 20:34:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Toshiba
[2013/05/22 20:34:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TOSHIBA
[2013/05/22 20:33:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TOSHIBA
[2013/05/22 20:28:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Renesas Electronics
[2013/05/22 20:27:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Downloaded Installations
[2013/05/22 18:05:48 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2013/05/22 16:47:29 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SRSLabs
[2013/05/22 16:47:23 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM
[2013/05/22 16:47:23 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2013/05/22 16:46:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek
[2013/05/22 16:46:49 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2013/05/22 16:46:42 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp
[2013/05/22 16:46:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2013/05/22 16:46:39 | 000,000,000 | ---D | C] -- C:\Users\Bearbear\AppData\Roaming\WinBatch
[2013/05/22 09:14:18 | 000,000,000 | R--D | C] -- C:\Users\Bearbear\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2013/05/22 09:14:18 | 000,000,000 | R--D | C] -- C:\Users\Bearbear\Searches
[2013/05/22 09:14:18 | 000,000,000 | R--D | C] -- C:\Users\Bearbear\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2013/05/22 09:14:18 | 000,000,000 | -H-D | C] -- C:\Users\Bearbear\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2013/05/22 09:14:08 | 000,000,000 | ---D | C] -- C:\Users\Bearbear\AppData\Roaming\Identities
[2013/05/22 09:14:05 | 000,000,000 | R--D | C] -- C:\Users\Bearbear\Contacts
[2013/05/22 09:14:04 | 000,000,000 | ---D | C] -- C:\Users\Bearbear\AppData\Local\VirtualStore
[2013/05/22 09:13:54 | 000,000,000 | --SD | C] -- C:\Users\Bearbear\AppData\Roaming\Microsoft
[2013/05/22 09:13:54 | 000,000,000 | R--D | C] -- C:\Users\Bearbear\Videos
[2013/05/22 09:13:54 | 000,000,000 | R--D | C] -- C:\Users\Bearbear\Saved Games
[2013/05/22 09:13:54 | 000,000,000 | R--D | C] -- C:\Users\Bearbear\Pictures
[2013/05/22 09:13:54 | 000,000,000 | R--D | C] -- C:\Users\Bearbear\Music
[2013/05/22 09:13:54 | 000,000,000 | R--D | C] -- C:\Users\Bearbear\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2013/05/22 09:13:54 | 000,000,000 | R--D | C] -- C:\Users\Bearbear\Links
[2013/05/22 09:13:54 | 000,000,000 | R--D | C] -- C:\Users\Bearbear\Favorites
[2013/05/22 09:13:54 | 000,000,000 | R--D | C] -- C:\Users\Bearbear\Downloads
[2013/05/22 09:13:54 | 000,000,000 | R--D | C] -- C:\Users\Bearbear\Documents
[2013/05/22 09:13:54 | 000,000,000 | R--D | C] -- C:\Users\Bearbear\Desktop
[2013/05/22 09:13:54 | 000,000,000 | R--D | C] -- C:\Users\Bearbear\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2013/05/22 09:13:54 | 000,000,000 | -HSD | C] -- C:\Users\Bearbear\AppData\Local\Temporary Internet Files
[2013/05/22 09:13:54 | 000,000,000 | -HSD | C] -- C:\Users\Bearbear\Templates
[2013/05/22 09:13:54 | 000,000,000 | -HSD | C] -- C:\Users\Bearbear\Start Menu
[2013/05/22 09:13:54 | 000,000,000 | -HSD | C] -- C:\Users\Bearbear\SendTo
[2013/05/22 09:13:54 | 000,000,000 | -HSD | C] -- C:\Users\Bearbear\Recent
[2013/05/22 09:13:54 | 000,000,000 | -HSD | C] -- C:\Users\Bearbear\PrintHood
[2013/05/22 09:13:54 | 000,000,000 | -HSD | C] -- C:\Users\Bearbear\NetHood
[2013/05/22 09:13:54 | 000,000,000 | -HSD | C] -- C:\Users\Bearbear\Documents\My Videos
[2013/05/22 09:13:54 | 000,000,000 | -HSD | C] -- C:\Users\Bearbear\Documents\My Pictures
[2013/05/22 09:13:54 | 000,000,000 | -HSD | C] -- C:\Users\Bearbear\Documents\My Music
[2013/05/22 09:13:54 | 000,000,000 | -HSD | C] -- C:\Users\Bearbear\My Documents
[2013/05/22 09:13:54 | 000,000,000 | -HSD | C] -- C:\Users\Bearbear\Local Settings
[2013/05/22 09:13:54 | 000,000,000 | -HSD | C] -- C:\Users\Bearbear\AppData\Local\History
[2013/05/22 09:13:54 | 000,000,000 | -HSD | C] -- C:\Users\Bearbear\Cookies
[2013/05/22 09:13:54 | 000,000,000 | -HSD | C] -- C:\Users\Bearbear\Application Data
[2013/05/22 09:13:54 | 000,000,000 | -HSD | C] -- C:\Users\Bearbear\AppData\Local\Application Data
[2013/05/22 09:13:54 | 000,000,000 | -H-D | C] -- C:\Users\Bearbear\AppData
[2013/05/22 09:13:54 | 000,000,000 | ---D | C] -- C:\Users\Bearbear\AppData\Local\Temp
[2013/05/22 09:13:54 | 000,000,000 | ---D | C] -- C:\Users\Bearbear\AppData\Local\Microsoft
[2013/05/22 09:13:54 | 000,000,000 | ---D | C] -- C:\Users\Bearbear\AppData\Roaming\Media Center Programs
[2013/05/22 09:05:11 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2013/05/22 08:47:49 | 000,000,000 | ---D | C] -- C:\Windows.old
[2013/05/22 08:08:27 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2013/05/22 08:06:20 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2013/05/22 04:27:19 | 000,000,000 | -HSD | C] -- C:\Recovery
[2013/05/22 04:13:06 | 000,000,000 | -HSD | C] -- C:\System Volume Information
========== Files - Modified Within 30 Days ========== [2013/05/28 11:57:00 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/28 10:19:31 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/05/28 10:17:13 | 000,018,560 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/28 10:17:13 | 000,018,560 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/28 10:15:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/05/28 00:03:33 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/28 00:02:16 | 3148,689,408 | -HS- | M] () -- C:\hiberfil.sys
[2013/05/28 00:00:52 | 000,003,544 | ---- | M] () -- C:\bootsqm.dat
[2013/05/25 15:24:14 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2013/05/25 14:30:48 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2013/05/25 09:22:08 | 000,001,182 | ---- | M] () -- C:\Users\Bearbear\Desktop\ Mabinogi .lnk
[2013/05/25 08:57:34 | 000,002,183 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013/05/25 08:14:26 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts
[2013/05/23 12:17:44 | 000,726,316 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/05/23 12:17:44 | 000,624,178 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/05/23 12:17:44 | 000,106,522 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/05/23 12:05:34 | 000,000,085 | ---- | M] () -- C:\Windows\wininit.ini
[2013/05/23 07:33:11 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Bearbear\Desktop\OTL.exe
[2013/05/22 23:06:57 | 000,002,279 | ---- | M] () -- C:\Users\Bearbear\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/05/22 22:57:29 | 000,025,185 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2013/05/22 22:57:28 | 000,025,185 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2013/05/22 22:44:24 | 000,275,712 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/05/22 21:22:09 | 000,002,495 | ---- | M] () -- C:\Users\Bearbear\Desktop\Windows 7 USB DVD Download Tool.lnk
[2013/05/22 21:13:49 | 044,953,528 | ---- | M] () -- C:\Users\Bearbear\Documents\TC00333600D.exe
[2013/05/22 20:54:39 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf
[2013/05/22 08:09:14 | 000,108,227 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2013/05/22 08:09:14 | 000,108,227 | ---- | M] () -- C:\Windows\SysNative\license.rtf
========== Files Created - No Company Name ========== [2013/05/28 10:19:31 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/05/28 00:00:52 | 000,003,544 | ---- | C] () -- C:\bootsqm.dat
[2013/05/25 15:24:14 | 000,001,945 | ---- | C] () -- C:\Windows\epplauncher.mif
[2013/05/25 15:24:08 | 000,002,117 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2013/05/25 14:30:48 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2013/05/23 13:35:31 | 000,001,182 | ---- | C] () -- C:\Users\Bearbear\Desktop\ Mabinogi .lnk
[2013/05/23 12:05:31 | 000,000,085 | ---- | C] () -- C:\Windows\wininit.ini
[2013/05/22 22:57:29 | 000,025,185 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2013/05/22 22:57:28 | 000,025,185 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2013/05/22 22:53:43 | 000,002,279 | ---- | C] () -- C:\Users\Bearbear\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/05/22 22:53:43 | 000,002,183 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013/05/22 22:52:42 | 000,000,902 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/22 22:52:38 | 000,000,898 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/22 22:14:53 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2013/05/22 22:00:11 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2013/05/22 21:22:09 | 000,002,495 | ---- | C] () -- C:\Users\Bearbear\Desktop\Windows 7 USB DVD Download Tool.lnk
[2013/05/22 21:13:59 | 044,953,528 | ---- | C] () -- C:\Users\Bearbear\Documents\TC00333600D.exe
[2013/05/22 20:55:24 | 000,008,192 | ---- | C] () -- C:\Windows\SysNative\drivers\IntelMEFWVer.dll
[2013/05/22 20:54:39 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf
[2013/05/22 16:46:53 | 000,000,852 | ---- | C] () -- C:\Windows\SysNative\drivers\RTKHDRC.dat
[2013/05/22 16:46:53 | 000,000,712 | ---- | C] () -- C:\Windows\SysNative\drivers\RTEQEX1.dat
[2013/05/22 16:46:53 | 000,000,712 | ---- | C] () -- C:\Windows\SysNative\drivers\RTEQEX0.dat
[2013/05/22 09:13:54 | 000,000,290 | ---- | C] () -- C:\Users\Bearbear\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2013/05/22 09:13:54 | 000,000,272 | ---- | C] () -- C:\Users\Bearbear\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2013/05/22 08:09:08 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2013/05/22 08:09:02 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2013/05/22 04:13:06 | 3148,689,408 | -HS- | C] () -- C:\hiberfil.sys
========== ZeroAccess Check ========== [2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/02/27 00:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/02/26 23:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 20:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 22:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 20:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
< End of report >
If G2G had spoilers, I'd use 'em. ^^
Edited by Neinei, 28 May 2013 - 11:45 AM.