[Ackleholicism]

I have a 70GB of Space on C and i was only using up 40 i open my computer and bam only 216KB LEFT?

 

 

[Advertisements]

Sorry you had to wait so long. We've been quite busy. However, I have time now and desire to help you.

 

Please perform the following scan.

 

Scan with OTL

Please download OTL by OldTimer and save the file to your desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• Make sure that Scan All Users, LOP check and Purity check are ticked.
• For 64-bit systems only - make sure that Include 64-bit option is also ticked.
• Sections Processes, Modules, Services, Drivers, Standard Registry are set to Use Safelist.
• Section Extra Registry is also set to Use Safelist.
• Under the Custom Scans/Fixes bar in the box paste in the following:

netsvcs

BASESERVICES

%SYSTEMDRIVE%\*.exe

/md5start

services.*

explorer.exe

winlogon.exe

Userinit.exe

svchost.exe

qmgr.dll

winsock.*

/md5stop

dir "%systemdrive%\*" /S /A:L /C

CREATERESTOREPOINT

• Push Run Scan and wait patiently.
• Two notepad windows will be opened after this run: OTL.txt (maximized) and Extras.txt (minimized).

Please include the content of both logfiles in your next reply.

 

[Biscuithd]

Sorry you had to wait so long. We've been quite busy. However, I have time now and desire to help you.

 

Please perform the following scan.

 

Scan with OTL

Please download OTL by OldTimer and save the file to your desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• Make sure that Scan All Users, LOP check and Purity check are ticked.
• For 64-bit systems only - make sure that Include 64-bit option is also ticked.
• Sections Processes, Modules, Services, Drivers, Standard Registry are set to Use Safelist.
• Section Extra Registry is also set to Use Safelist.
• Under the Custom Scans/Fixes bar in the box paste in the following:

netsvcs

BASESERVICES

%SYSTEMDRIVE%\*.exe

/md5start

services.*

explorer.exe

winlogon.exe

Userinit.exe

svchost.exe

qmgr.dll

winsock.*

/md5stop

dir "%systemdrive%\*" /S /A:L /C

CREATERESTOREPOINT

• Push Run Scan and wait patiently.
• Two notepad windows will be opened after this run: OTL.txt (maximized) and Extras.txt (minimized).

Please include the content of both logfiles in your next reply.

 

[Biscuithd]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

[Biscuithd]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

[Biscuithd]

Topic is unlocked.

[Biscuithd]

I've re-opened the topic.

 

Have you performed the steps I gave you in Post 2?

[Ackleholicism]

Yes but im not sure how to post them

[Biscuithd]

There will be two text files. Perhaps they are still open and minimized. They are called OTL.txt and Extras.txt.

 

Open the OTL.txt first in Notepad. Then Click Edit, Select All, Then Control -C. That copies that file to your Paste buffer. Go to this post and in the Reply box, do a Control-V and that will Paste the contents of the Paste Buffer into the Reply box. Either Post that file or repeat the process with the Extras.txt and then post the whole thing. It's fine if you do multiple posts.

[Ackleholicism]

OTL logfile created on: 8/9/2014 9:17:25 PM - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\user\Downloads

 Professional  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

1.87 Gb Total Physical Memory | 0.72 Gb Available Physical Memory | 38.51% Memory free

3.74 Gb Paging File | 1.68 Gb Available in Paging File | 45.02% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = D:\Program Files

Drive C: | 73.14 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: NTFS

Drive D: | 107.42 Gb Total Space | 100.89 Gb Free Space | 93.92% Space Free | Partition Type: NTFS

Drive E: | 117.43 Gb Total Space | 116.99 Gb Free Space | 99.63% Space Free | Partition Type: NTFS

 

Computer Name: USER-PC | User Name: user | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Processes (SafeList) ==========

 

PRC - [2014/08/09 21:15:20 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\user\Downloads\OTL.exe

PRC - [2014/07/15 12:24:50 | 000,860,488 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe

PRC - [2013/10/28 14:32:14 | 000,311,152 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

PRC - [2013/07/05 09:39:58 | 007,306,816 | ---- | M] () -- C:\Program Files\PhotoScape\PhotoScape.exe

PRC - [2012/07/17 15:49:00 | 001,713,904 | ---- | M] (Microsoft Corp.) -- C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

PRC - [2012/07/17 15:49:00 | 000,194,304 | ---- | M] (Microsoft Corp.) -- C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

PRC - [2010/06/16 13:25:39 | 000,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe

PRC - [2009/12/07 16:33:36 | 001,085,720 | ---- | M] (BitDefender S.R.L.) -- C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe

PRC - [2009/12/04 16:31:28 | 001,118,144 | ---- | M] (BitDefender S.R.L.) -- C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe

PRC - [2009/11/30 15:48:30 | 000,309,088 | ---- | M] (BitDefender S.R.L.) -- C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

PRC - [2009/11/11 17:08:14 | 001,622,320 | ---- | M] (BitDefender S.R.L.) -- C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe

PRC - [2009/11/02 05:30:00 | 002,508,104 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE

PRC - [2009/07/14 04:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2009/07/14 04:14:39 | 000,396,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SnippingTool.exe

PRC - [2009/07/14 04:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2007/01/15 16:14:54 | 000,147,456 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

PRC - [2007/01/15 16:13:50 | 001,208,320 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

PRC - [2003/06/19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE

 

 

========== Modules (No Company Name) ==========

 

MOD - [2014/07/15 12:24:48 | 000,353,096 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\36.0.1985.125\ppgooglenaclpluginchrome.dll

MOD - [2014/07/15 12:24:46 | 014,664,008 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\36.0.1985.125\PepperFlash\pepflashplayer.dll

MOD - [2014/07/15 12:24:44 | 008,537,928 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\36.0.1985.125\pdf.dll

MOD - [2014/07/15 12:24:38 | 000,718,664 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\36.0.1985.125\libglesv2.dll

MOD - [2014/07/15 12:24:36 | 000,126,280 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\36.0.1985.125\libegl.dll

MOD - [2014/07/15 12:24:35 | 001,732,936 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\36.0.1985.125\ffmpegsumo.dll

MOD - [2013/07/05 09:39:58 | 007,306,816 | ---- | M] () -- C:\Program Files\PhotoScape\PhotoScape.exe

MOD - [2009/10/22 15:55:06 | 000,094,720 | ---- | M] () -- C:\Program Files\BitDefender\BitDefender 2010\framework.dll

MOD - [2009/01/15 12:45:34 | 000,181,248 | ---- | M] () -- C:\Windows\System32\txmlutil.dll

MOD - [2007/10/27 07:06:16 | 000,909,312 | ---- | M] () -- C:\Program Files\Yahoo!\Messenger\yui.dll

MOD - [2005/10/07 15:05:32 | 000,125,440 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll

 

 

========== Services (SafeList) ==========

 

SRV - File not found [Auto | Stopped] -- %PROGRAMFILES%\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - File not found [On_Demand | Stopped] -- %ProgramFiles%\Windows Defender\mpsvc.dll -- (WinDefend)

SRV - [2014/07/12 20:25:41 | 000,262,320 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2014/06/20 04:20:06 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2013/10/23 09:15:08 | 000,172,192 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012/07/17 15:49:00 | 001,713,904 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2009/11/30 15:48:30 | 000,309,088 | ---- | M] (BitDefender S.R.L.) [Auto | Running] -- C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe -- (LIVESRV)

SRV - [2009/11/11 17:08:14 | 001,622,320 | ---- | M] (BitDefender S.R.L.) [Auto | Running] -- C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe -- (VSSERV)

SRV - [2009/10/23 14:45:26 | 000,311,296 | ---- | M] (S.C. BitDefender S.R.L) [On_Demand | Stopped] -- C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\scan.dll -- (scan)

SRV - [2009/10/19 16:06:10 | 000,183,880 | ---- | M] (BitDefender S.R.L. http://www.bitdefender.com) [On_Demand | Stopped] -- C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe -- (Arrakis3)

SRV - [2009/09/09 00:12:51 | 000,116,104 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)

SRV - [2009/07/14 04:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)

SRV - [2009/07/14 04:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009/07/14 04:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)

SRV - [2007/05/31 09:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2007/05/31 09:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

SRV - [2003/07/28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)

SRV - [2003/06/19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE -- (MDM)

 

 

========== Driver Services (SafeList) ==========

 

DRV - [2014/05/17 05:33:08 | 000,039,624 | ---- | M] (AnchorFree Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\hssdrv6.sys -- (HssDRV6)

DRV - [2014/05/17 03:41:54 | 000,037,064 | ---- | M] (Anchorfree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\taphss6.sys -- (taphss6)

DRV - [2014/05/14 19:59:42 | 000,033,720 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tapse01.sys -- (tapse01)

DRV - [2014/01/22 08:52:12 | 000,184,192 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm)

DRV - [2014/01/22 08:52:12 | 000,088,576 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus)

DRV - [2014/01/07 08:42:16 | 000,065,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dc3d.sys -- (dc3d)

DRV - [2011/12/15 20:29:42 | 000,026,624 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tap0901.sys -- (tap0901)

DRV - [2009/12/07 18:46:28 | 000,152,456 | ---- | M] (BitDefender S.R.L. Bucharest, ROMANIA) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\bdfm.sys -- (BDFM)

DRV - [2009/10/19 16:04:00 | 000,079,368 | ---- | M] (BitDefender LLC) [Kernel | System | Running] -- C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdfwfpf.sys -- (bdfwfpf)

DRV - [2009/10/19 16:04:00 | 000,072,200 | ---- | M] (BitDefender LLC) [Kernel | System | Running] -- C:\Windows\System32\drivers\BdfNdisf6.sys -- (BdfNdisf)

DRV - [2009/09/22 08:22:06 | 000,083,208 | ---- | M] (BitDefender) [Kernel | Auto | Running] -- C:\Program Files\BitDefender\BitDefender 2010\bdvedisk.sys -- (BDVEDISK)

DRV - [2009/08/27 16:28:44 | 000,014,720 | ---- | M] (BitDefender S.R.L.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\profos.sys -- (Profos)

DRV - [2009/07/24 11:26:08 | 000,285,704 | ---- | M] (BitDefender S.R.L. Bucharest, ROMANIA) [File_System | Boot | Running] -- C:\Windows\System32\drivers\bdfsfltr.sys -- (bdfsfltr)

DRV - [2009/07/14 04:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)

DRV - [2009/07/14 04:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)

DRV - [2009/07/14 04:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)

DRV - [2009/07/14 02:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2009/07/14 02:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)

DRV - [2009/07/14 02:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)

DRV - [2009/07/14 01:02:53 | 000,347,136 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTL8187B.sys -- (RTL8187B)

DRV - [2009/07/10 06:44:52 | 000,122,880 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService)

DRV - [2009/06/22 17:04:58 | 000,024,064 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\PGEffect.sys -- (PGEffect)

DRV - [2009/05/07 03:22:06 | 000,039,808 | ---- | M] (BitDefender S.R.L.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\trufos.sys -- (Trufos)

 

 

========== Standard Registry (SafeList) ==========

 

 

========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

 

 

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-21-3221818885-2957879276-3168191266-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKU\S-1-5-21-3221818885-2957879276-3168191266-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/

IE - HKU\S-1-5-21-3221818885-2957879276-3168191266-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us

IE - HKU\S-1-5-21-3221818885-2957879276-3168191266-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = AE 9E 45 9A 3A 0D CB 01  [binary data]

IE - HKU\S-1-5-21-3221818885-2957879276-3168191266-1000\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-21-3221818885-2957879276-3168191266-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC

IE - HKU\S-1-5-21-3221818885-2957879276-3168191266-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3221818885-2957879276-3168191266-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1;localhost;10.*;192.168.*;127.0.0.1:895;127.0.0.1:896;<local>

IE - HKU\S-1-5-21-3221818885-2957879276-3168191266-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8555;https=127.0.0.1:8555

 

========== FireFox ==========

 

FF - prefs.js..browser.search.useDBForOrder: "false"

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:30.0

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.3: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3508.0205: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.448: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\user\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 30.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 30.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 30.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 30.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

 

[2013/09/21 10:31:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Extensions

[2014/07/27 03:18:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\1qop69jk.default\extensions

 

========== Chrome  ==========

 

CHR - default_search_provider:  (Enabled)

CHR - default_search_provider: search_url = 

CHR - default_search_provider: suggest_url = 

CHR - homepage: http://www.google.com/

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\36.0.1985.125\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\36.0.1985.125\gcswf32.dll

CHR - plugin: Skype Toolbars (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.3.0.7550_0\npSkypeChromePlugin.dll

CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll

CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit)  (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll

CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll

CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll

CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\user\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: Google Voice Search Hotword (Beta) = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5023_0\

CHR - Extension: YouTube = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_1\

CHR - Extension: GeoGebra = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\bnbaboaihhkjoaolfnfoablhllahjnee\4.4.26.1_0\

CHR - Extension: Google Search = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1\

CHR - Extension: Skype Click to Call = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\7.3.16540.9015_0\

CHR - Extension: Google Wallet = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\

CHR - Extension: Gmail = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_2\

 

O1 HOSTS File: ([2009/06/11 00:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)

O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O3 - HKLM\..\Toolbar: (BitDefender Toolbar) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2010\ietoolbar.dll (BitDefender S.R.L.)

O4 - HKLM..\Run: [BDAgent] C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe (BitDefender S.R.L.)

O4 - HKLM..\Run: [BitDefender Antiphishing Helper] C:\Program Files\BitDefender\BitDefender 2010\IEShow.exe (BitDefender S.R.L.)

O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)

O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)

O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)

O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKLM..\Run: [TWebCamera] "%ProgramFiles%\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun File not found

O4 - HKU\S-1-5-19..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun File not found

O4 - HKU\S-1-5-20..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun File not found

O4 - HKU\S-1-5-21-3221818885-2957879276-3168191266-1000..\Run: [] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung)

O4 - HKU\S-1-5-21-3221818885-2957879276-3168191266-1000..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)

O4 - HKU\S-1-5-21-3221818885-2957879276-3168191266-1000..\Run: [Facebook Update] C:\Users\user\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)

O4 - HKU\S-1-5-21-3221818885-2957879276-3168191266-1000..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 0.0.0.0

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0110030C-9FD1-4A61-B877-F8ADD4DA8D47}: DhcpNameServer = 192.168.1.1 0.0.0.0

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{02580512-F001-4C25-AC5A-0A0506036C46}: NameServer = 8.8.8.8

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{194AC0CF-EDE7-4B33-8C6E-6453915A1F05}: DhcpNameServer = 192.168.1.1 0.0.0.0

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AD9F0798-3FD9-42B7-80C9-E6BA7E1DD116}: DhcpNameServer = 192.168.1.1 0.0.0.0

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/06/11 00:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{214d50ca-1c03-11e4-b992-705ab6bd3bde}\Shell - "" = AutoRun

O33 - MountPoints2\{214d50ca-1c03-11e4-b992-705ab6bd3bde}\Shell\AutoRun\command - "" = G:\AutoRun.exe

O33 - MountPoints2\{eee5bf6d-4291-11e0-a96d-705ab6bd3bde}\Shell - "" = AutoRun

O33 - MountPoints2\{eee5bf6d-4291-11e0-a96d-705ab6bd3bde}\Shell\AutoRun\command - "" = G:\LGAutoRun.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

CREATERESTOREPOINT

System Restore Service not available.

 

========== Files/Folders - Created Within 30 Days ==========

 

[2014/08/09 16:47:07 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt

[2014/08/06 09:18:15 | 000,000,000 | ---D | C] -- D:\My Documents

[2014/08/05 23:04:02 | 000,000,000 | ---D | C] -- C:\ProgramData\DatacardService

[2014/08/04 16:14:49 | 000,536,576 | ---- | C] (SQLite Development Team) -- C:\Windows\System32\sqlite3.dll

[2014/08/04 16:12:59 | 000,000,000 | ---D | C] -- C:\AdwCleaner

[2014/08/03 23:30:37 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2014/08/03 23:15:38 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\JAM Software

[2014/08/03 23:15:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TreeSize Free

[2014/07/15 17:50:15 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\OSG

[2014/07/12 00:11:34 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Artweaver Free

[2014/07/11 17:40:03 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Macromedia

[2014/07/11 17:26:58 | 000,699,056 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe

[2014/07/11 17:26:55 | 000,071,344 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl

[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

 

========== Files - Modified Within 30 Days ==========

 

[2014/08/09 21:21:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2014/08/09 20:54:00 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2014/08/09 19:17:35 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3221818885-2957879276-3168191266-1000UA.job

[2014/08/09 19:16:00 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3221818885-2957879276-3168191266-1000Core.job

[2014/08/09 16:07:06 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2014/08/09 14:38:25 | 000,000,878 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2014/08/06 21:09:41 | 001,894,192 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2014/08/06 21:09:41 | 000,550,496 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2014/08/04 21:22:05 | 000,020,688 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2014/08/04 21:22:05 | 000,020,688 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2014/08/04 21:14:29 | 1504,346,112 | -HS- | M] () -- C:\hiberfil.sys

[2014/08/04 20:20:29 | 000,000,132 | ---- | M] () -- C:\Windows\System32\rezumatenoi.dat

[2014/08/03 23:15:37 | 000,001,183 | ---- | M] () -- C:\Users\user\Desktop\TreeSize Free.lnk

[2014/08/03 21:16:40 | 000,000,000 | ---- | M] () -- C:\Users\user\Desktop\capture3.PNG

[2014/08/03 21:11:20 | 000,000,000 | ---- | M] () -- C:\Users\user\Desktop\Capture1.PNG

[2014/07/18 21:47:57 | 000,002,187 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2014/07/17 21:08:36 | 000,002,102 | ---- | M] () -- C:\Users\user\Desktop\BitDefender Total Security 2010.lnk

[2014/07/16 05:39:18 | 000,003,072 | -H-- | M] () -- C:\Users\user\Desktop\photothumb.db

[2014/07/12 20:25:20 | 000,699,056 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe

[2014/07/12 20:25:19 | 000,071,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl

[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

 

========== Files Created - No Company Name ==========

 

[2014/08/03 23:15:37 | 000,001,183 | ---- | C] () -- C:\Users\user\Desktop\TreeSize Free.lnk

[2014/08/03 21:16:40 | 000,000,000 | ---- | C] () -- C:\Users\user\Desktop\capture3.PNG

[2014/08/03 15:27:33 | 000,000,000 | ---- | C] () -- C:\Users\user\Desktop\Capture1.PNG

[2014/07/17 21:08:36 | 000,002,102 | ---- | C] () -- C:\Users\user\Desktop\BitDefender Total Security 2010.lnk

[2014/07/11 17:27:11 | 000,000,830 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2014/05/04 18:04:28 | 000,004,096 | -H-- | C] () -- C:\Users\user\AppData\Local\keyfile3.drm

[2014/02/13 22:30:31 | 000,038,912 | -H-- | C] () -- C:\Users\user\photothumb.db

[2014/01/19 22:55:49 | 000,000,008 | ---- | C] () -- C:\Users\user\AppData\Roaming\DofusAppId0_5

[2014/01/11 14:43:25 | 000,000,008 | ---- | C] () -- C:\Users\user\AppData\Roaming\DofusAppId0_4

[2013/11/05 18:13:53 | 000,001,952 | ---- | C] () -- C:\Users\user\Samsung Kies (Lite).lnk

[2013/11/05 18:13:53 | 000,001,942 | ---- | C] () -- C:\Users\user\Samsung Kies.lnk

[2013/10/01 15:18:03 | 000,000,355 | ---- | C] () -- C:\Users\user\Computer - Shortcut (2).lnk

[2013/10/01 15:18:03 | 000,000,351 | ---- | C] () -- C:\Users\user\Network - Shortcut (2).lnk

[2013/10/01 15:18:00 | 000,000,355 | ---- | C] () -- C:\Users\user\Computer - Shortcut.lnk

[2013/10/01 15:18:00 | 000,000,351 | ---- | C] () -- C:\Users\user\Network - Shortcut.lnk

[2013/10/01 14:53:27 | 000,024,650 | ---- | C] () -- C:\Users\user\-home-maraya-public_html-wp-content-files_mf-cache-0e85cc930eebd0b474b8bcc8401130c0_1327875769kingg.jpg

[2013/09/29 16:11:54 | 000,011,273 | ---- | C] () -- C:\Users\user\no-just-no.png

[2013/09/28 18:28:24 | 000,000,008 | ---- | C] () -- C:\Users\user\AppData\Roaming\DofusAppId0_3

[2013/09/28 18:19:50 | 000,620,785 | ---- | C] () -- C:\Users\user\1111.PNG

[2013/09/22 21:53:31 | 000,010,402 | ---- | C] () -- C:\Users\user\images (2).jpg

[2013/09/22 21:28:59 | 000,006,937 | ---- | C] () -- C:\Users\user\images.jpg

[2013/09/14 20:32:29 | 000,013,105 | ---- | C] () -- C:\Users\user\download (2).jpg

[2013/09/14 20:31:38 | 000,008,403 | ---- | C] () -- C:\Users\user\download (1).jpg

[2013/09/14 20:28:12 | 000,005,596 | ---- | C] () -- C:\Users\user\download.jpg

[2013/09/14 20:26:00 | 000,027,928 | ---- | C] () -- C:\Users\user\avocat2.jpg

[2013/09/14 20:25:30 | 000,009,682 | ---- | C] () -- C:\Users\user\engineer.gif

[2013/09/14 20:19:28 | 000,043,654 | ---- | C] () -- C:\Users\user\089835529215.jpg

[2013/07/18 15:32:38 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe

[2013/07/18 15:32:34 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll

[2013/07/18 15:32:34 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll

[2013/07/18 15:32:34 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll

[2013/07/18 15:32:34 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll

[2012/02/16 19:31:07 | 000,000,008 | ---- | C] () -- C:\Users\user\AppData\Roaming\DofusAppId0_1

[2012/02/16 19:03:25 | 000,000,113 | ---- | C] () -- C:\Users\user\AppData\Roaming\D2Info0

[2012/02/16 19:03:25 | 000,000,008 | ---- | C] () -- C:\Users\user\AppData\Roaming\DofusAppId0_2

[2011/06/14 23:39:03 | 000,002,508 | ---- | C] () -- C:\Users\user\Windows Mobile® Device Handbook.lnk

 

========== ZeroAccess Check ==========

 

[2009/07/14 07:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2009/07/14 04:16:14 | 012,866,560 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/07/14 04:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/14 04:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

========== LOP Check ==========

 

[2013/09/15 15:51:20 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\AnkamaCertificates

[2014/03/03 16:44:05 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\app

[2014/07/12 00:11:34 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Artweaver Free

[2014/04/17 15:11:50 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\asoftech

[2010/06/16 14:01:20 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\BitDefender

[2014/03/22 11:43:20 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant

[2014/01/11 01:37:53 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Dofus

[2014/01/08 18:21:50 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Dofus 2

[2014/01/11 16:46:22 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Dofus-2

[2012/02/16 19:03:25 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Dofus-2.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1

[2014/01/11 02:00:04 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Dofus-3

[2013/09/28 18:28:24 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Dofus-3.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1

[2014/01/11 14:43:27 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Dofus-4

[2014/01/19 22:55:51 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Dofus-5

[2012/02/16 19:31:07 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Dofus.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1

[2014/07/08 21:22:24 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Dofus2

[2014/04/17 14:52:09 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\DofusTesting

[2014/04/17 15:06:45 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\DofusTesting-2

[2014/08/03 23:15:38 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\JAM Software

[2013/12/16 15:55:59 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\JihoPhotoRecovery

[2014/05/24 21:41:01 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\PhotoScape

[2014/03/03 16:44:27 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Reg

[2014/03/03 16:44:05 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Reg.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1

[2014/06/23 08:58:15 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\RegLocal

[2014/06/17 05:41:12 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Samsung

[2014/06/21 22:02:03 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\uTorrent

[2010/06/16 13:02:34 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\WinBatch

[2014/02/04 15:07:18 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\WindowTabs

 

========== Purity Check ==========

 

 

 

========== Custom Scans ==========

 

<  >

[2009/07/14 07:53:46 | 000,032,566 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2009/07/14 07:53:47 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT

[2011/10/23 21:07:32 | 000,000,902 | ---- | C] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3221818885-2957879276-3168191266-1000Core.job

[2011/10/23 21:07:33 | 000,000,924 | ---- | C] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3221818885-2957879276-3168191266-1000UA.job

[2011/11/15 17:31:19 | 000,000,878 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

[2011/11/15 17:31:20 | 000,000,882 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

[2014/07/11 17:27:11 | 000,000,830 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

 

========== Base Services ==========

SRV - [2009/07/14 04:14:53 | 000,062,464 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\aelupsvc.dll -- (AeLookupSvc)

SRV - [2009/07/14 04:14:53 | 000,046,592 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\appinfo.dll -- (Appinfo)

SRV - [2009/07/14 04:14:11 | 000,059,392 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\alg.exe -- (ALG)

SRV - [2009/07/14 04:16:12 | 000,589,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\qmgr.dll -- (BITS)

SRV - [2009/07/14 04:14:59 | 000,493,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\BFE.DLL -- (BFE)

SRV - [2009/07/14 04:14:23 | 000,022,528 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\lsass.exe -- (KeyIso)

SRV - [2009/07/14 04:15:19 | 000,271,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\es.dll -- (EventSystem)

SRV - [2009/07/14 04:15:00 | 000,102,400 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\browser.dll -- (Browser)

SRV - [2009/07/14 04:15:07 | 000,135,680 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\cryptsvc.dll -- (CryptSvc)

SRV - [2009/07/14 04:16:13 | 000,376,320 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\rpcss.dll -- (DcomLaunch)

SRV - [2009/07/14 04:15:11 | 000,253,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\dhcpcore.dll -- (Dhcp)

SRV - [2009/07/14 04:15:12 | 000,132,608 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\dnsrslvr.dll -- (Dnscache)

SRV - [2009/07/14 04:15:13 | 000,098,304 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\eapsvc.dll -- (EapHost)

SRV - [2009/07/14 04:15:24 | 000,049,152 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\hidserv.dll -- (hidserv)

SRV - [2009/07/14 04:15:33 | 000,300,544 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\ipnathlp.dll -- (SharedAccess)

SRV - [2009/07/14 04:15:33 | 000,350,720 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\IPSECSVC.DLL -- (PolicyAgent)

No service found with a name of MsMpSvc

No service found with a name of NisSrv

SRV - [2009/07/14 04:16:15 | 000,313,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\swprv.dll -- (swprv)

SRV - [2009/07/14 04:15:41 | 000,049,664 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\mmcss.dll -- (MMCSS)

SRV - [2009/07/14 04:16:03 | 000,280,576 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\netman.dll -- (Netman)

SRV - [2009/07/14 04:16:03 | 000,360,448 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\netprofm.dll -- (netprofm)

SRV - [2009/07/14 04:16:03 | 000,242,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\nlasvc.dll -- (NlaSvc)

SRV - [2009/07/14 04:16:11 | 000,019,456 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\nsisvc.dll -- (nsi)

SRV - [2009/07/14 04:16:17 | 000,294,400 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\umpnpmgr.dll -- (PlugPlay)

SRV - [2009/07/14 04:14:41 | 000,316,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\spoolsv.exe -- (Spooler)

SRV - [2009/07/14 04:14:23 | 000,022,528 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\lsass.exe -- (ProtectedStorage)

No service found with a name of EMDMgmt

SRV - [2009/07/14 04:16:12 | 000,090,624 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\rasauto.dll -- (RasAuto)

SRV - [2009/07/14 04:16:12 | 000,285,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\rasmans.dll -- (RasMan)

SRV - [2009/07/14 04:16:13 | 000,376,320 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\rpcss.dll -- (RpcSs)

SRV - [2009/07/14 04:16:13 | 000,021,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\seclogon.dll -- (seclogon)

SRV - [2009/07/14 04:14:23 | 000,022,528 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\lsass.exe -- (SamSs)

SRV - [2009/07/14 04:16:20 | 000,073,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wscsvc.dll -- (wscsvc)

SRV - [2009/07/14 04:16:15 | 000,168,448 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\srvsvc.dll -- (LanmanServer)

SRV - [2009/07/14 04:16:14 | 000,328,192 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\shsvcs.dll -- (ShellHWDetection)

No service found with a name of slsvc

SRV - [2009/07/14 04:16:13 | 000,743,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\schedsvc.dll -- (Schedule)

SRV - [2009/07/14 04:16:15 | 000,241,664 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\tapisrv.dll -- (TapiSrv)

SRV - [2009/07/14 04:16:16 | 000,037,376 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\themeservice.dll -- (Themes)

SRV - [2009/07/14 04:16:12 | 000,162,816 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\profsvc.dll -- (ProfSvc)

SRV - [2009/07/14 04:14:43 | 001,025,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\VSSVC.exe -- (VSS)

SRV - [2009/07/14 04:14:57 | 000,473,088 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\audiosrv.dll -- (Audiosrv)

SRV - [2009/07/14 04:14:57 | 000,473,088 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\audiosrv.dll -- (AudioEndpointBuilder)

SRV - [2009/07/14 04:16:13 | 000,125,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sdrsvc.dll -- (SDRSVC)

SRV - File not found [On_Demand | Stopped] -- %ProgramFiles%\Windows Defender\mpsvc.dll -- (WinDefend)

SRV - [2009/07/14 04:16:18 | 001,086,464 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wevtsvc.dll -- (eventlog)

SRV - [2009/07/14 04:15:41 | 000,565,760 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\MPSSVC.dll -- (MpsSvc)

SRV - [2009/07/14 04:16:18 | 000,462,336 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wiaservc.dll -- (StiSvc)

SRV - [2009/07/14 04:14:25 | 000,073,216 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\msiexec.exe -- (msiserver)

SRV - [2009/07/14 04:16:19 | 000,168,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wbem\WMIsvc.dll -- (Winmgmt)

SRV - [2009/07/14 04:16:21 | 001,912,832 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wuaueng.dll -- (wuauserv)

SRV - [2009/07/14 04:15:12 | 000,214,016 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\dot3svc.dll -- (dot3svc)

SRV - [2009/07/14 04:16:19 | 000,829,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wlansvc.dll -- (Wlansvc)

SRV - [2009/07/14 04:16:19 | 000,084,480 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wkssvc.dll -- (LanmanWorkstation)

 

<  >

 

< %SYSTEMDRIVE%\*.exe >

 

<  >

 

< MD5 for: EXPLORER.EXE  >

[2009/07/14 04:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\explorer.exe

[2009/07/14 04:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe

 

< MD5 for: QMGR.DLL  >

[2009/07/14 04:16:12 | 000,589,312 | ---- | M] (Microsoft Corporation) MD5=53F476476F55A27F580661BDE09C4EC4 -- C:\Windows\System32\qmgr.dll

[2009/07/14 04:16:12 | 000,589,312 | ---- | M] (Microsoft Corporation) MD5=53F476476F55A27F580661BDE09C4EC4 -- C:\Windows\winsxs\x86_microsoft-windows-bits-client_31bf3856ad364e35_6.1.7600.16385_none_23671b105ac5a0fd\qmgr.dll

 

< MD5 for: SERVICES  >

[2009/06/11 00:39:37 | 000,017,463 | ---- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 -- C:\Windows\System32\drivers\etc\services

[2009/06/11 00:39:37 | 000,017,463 | ---- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 -- C:\Windows\winsxs\x86_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_045b589158ae90da\services

 

< MD5 for: SERVICES.EXE  >

[2009/07/14 04:14:36 | 000,259,072 | ---- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 -- C:\Windows\System32\services.exe

[2009/07/14 04:14:36 | 000,259,072 | ---- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe

 

< MD5 for: SERVICES.EXE.MUI  >

[2009/07/14 05:03:06 | 000,017,408 | ---- | M] (Microsoft Corporation) MD5=0DA5F221169DEB5AC3A22465CD6F0281 -- C:\Windows\System32\en-US\services.exe.mui

[2009/07/14 05:03:06 | 000,017,408 | ---- | M] (Microsoft Corporation) MD5=0DA5F221169DEB5AC3A22465CD6F0281 -- C:\Windows\winsxs\x86_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.1.7600.16385_en-us_69d39d3a8748c332\services.exe.mui

 

< MD5 for: SERVICES.LNK  >

[2009/07/14 07:41:45 | 000,001,288 | ---- | M] () MD5=021B1B178776500E54560EDCFFE0EE21 -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk

[2009/07/14 07:41:45 | 000,001,288 | ---- | M] () MD5=021B1B178776500E54560EDCFFE0EE21 -- C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk

 

< MD5 for: SERVICES.MOF  >

[2009/06/11 00:26:14 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\System32\wbem\services.mof

[2009/06/11 00:26:14 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.mof

 

< MD5 for: SERVICES.MSC  >

[2009/07/14 05:08:50 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\System32\en-US\services.msc

[2009/06/11 00:21:09 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\System32\services.msc

[2009/07/14 05:08:50 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a4156d265db25d25\services.msc

[2009/06/11 00:21:09 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_cf3a38c7a70e7a54\services.msc

 

< MD5 for: SERVICES.PTXML  >

[2009/07/13 23:20:01 | 000,001,061 | ---- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 -- C:\Windows\System32\wdi\perftrack\Services.ptxml

[2009/07/13 23:20:01 | 000,001,061 | ---- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\Services.ptxml

 

< MD5 for: SVCHOST.EXE  >

[2009/07/14 04:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\System32\svchost.exe

[2009/07/14 04:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe

 

< MD5 for: USERINIT.EXE  >

[2009/07/14 04:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe

[2009/07/14 04:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

 

< MD5 for: WINLOGON.EXE  >

[2009/07/14 04:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\System32\winlogon.exe

[2009/07/14 04:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

 

< MD5 for: WINSOCK.DLL  >

[2009/07/14 00:41:34 | 000,002,864 | ---- | M] (Microsoft Corporation) MD5=68485C5EF0E2EFCEBF21BBB1042B823B -- C:\Windows\System32\WINSOCK.DLL

[2009/07/14 00:41:34 | 000,002,864 | ---- | M] (Microsoft Corporation) MD5=68485C5EF0E2EFCEBF21BBB1042B823B -- C:\Windows\winsxs\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.1.7600.16385_none_fde3cf3dd3e16d0d\WINSOCK.DLL

 

<  >

 

< dir "%systemdrive%\*" /S /A:L /C >

 Volume in drive C has no label.

 Volume Serial Number is FA0A-FBC8

 Directory of C:\

07/14/2009  07:53 AM    <JUNCTION>     Documents and Settings [C:\Users]

               0 File(s)              0 bytes

 Directory of C:\ProgramData

07/14/2009  07:53 AM    <JUNCTION>     Application Data [C:\ProgramData]

07/14/2009  07:53 AM    <JUNCTION>     Desktop [C:\Users\Public\Desktop]

07/14/2009  07:53 AM    <JUNCTION>     Documents [C:\Users\Public\Documents]

07/14/2009  07:53 AM    <JUNCTION>     Favorites [C:\Users\Public\Favorites]

07/14/2009  07:53 AM    <JUNCTION>     Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]

07/14/2009  07:53 AM    <JUNCTION>     Templates [C:\ProgramData\Microsoft\Windows\Templates]

               0 File(s)              0 bytes

 Directory of C:\Users

07/14/2009  07:53 AM    <SYMLINKD>     All Users [C:\ProgramData]

07/14/2009  07:53 AM    <JUNCTION>     Default User [C:\Users\Default]

               0 File(s)              0 bytes

 Directory of C:\Users\All Users

07/14/2009  07:53 AM    <JUNCTION>     Application Data [C:\ProgramData]

07/14/2009  07:53 AM    <JUNCTION>     Desktop [C:\Users\Public\Desktop]

07/14/2009  07:53 AM    <JUNCTION>     Documents [C:\Users\Public\Documents]

07/14/2009  07:53 AM    <JUNCTION>     Favorites [C:\Users\Public\Favorites]

07/14/2009  07:53 AM    <JUNCTION>     Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]

07/14/2009  07:53 AM    <JUNCTION>     Templates [C:\ProgramData\Microsoft\Windows\Templates]

               0 File(s)              0 bytes

 Directory of C:\Users\Default

07/14/2009  07:53 AM    <JUNCTION>     Application Data [C:\Users\Default\AppData\Roaming]

07/14/2009  07:53 AM    <JUNCTION>     Cookies [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies]

07/14/2009  07:53 AM    <JUNCTION>     Local Settings [C:\Users\Default\AppData\Local]

07/14/2009  07:53 AM    <JUNCTION>     My Documents [C:\Users\Default\Documents]

07/14/2009  07:53 AM    <JUNCTION>     NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]

07/14/2009  07:53 AM    <JUNCTION>     PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]

07/14/2009  07:53 AM    <JUNCTION>     Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]

07/14/2009  07:53 AM    <JUNCTION>     SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]

07/14/2009  07:53 AM    <JUNCTION>     Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]

07/14/2009  07:53 AM    <JUNCTION>     Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]

               0 File(s)              0 bytes

 Directory of C:\Users\Default\AppData\Local

07/14/2009  07:53 AM    <JUNCTION>     Application Data [C:\Users\Default\AppData\Local]

07/14/2009  07:53 AM    <JUNCTION>     History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]

07/14/2009  07:53 AM    <JUNCTION>     Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]

               0 File(s)              0 bytes

 Directory of C:\Users\Default\Documents

07/14/2009  07:53 AM    <JUNCTION>     My Music [C:\Users\Default\Music]

07/14/2009  07:53 AM    <JUNCTION>     My Pictures [C:\Users\Default\Pictures]

07/14/2009  07:53 AM    <JUNCTION>     My Videos [C:\Users\Default\Videos]

               0 File(s)              0 bytes

 Directory of C:\Users\Public\Documents

07/14/2009  07:53 AM    <JUNCTION>     My Music [C:\Users\Public\Music]

07/14/2009  07:53 AM    <JUNCTION>     My Pictures [C:\Users\Public\Pictures]

07/14/2009  07:53 AM    <JUNCTION>     My Videos [C:\Users\Public\Videos]

               0 File(s)              0 bytes

 Directory of C:\Users\user

06/16/2010  12:34 AM    <JUNCTION>     Application Data [C:\Users\user\AppData\Roaming]

06/16/2010  12:34 AM    <JUNCTION>     Cookies [C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies]

06/16/2010  12:34 AM    <JUNCTION>     Local Settings [C:\Users\user\AppData\Local]

06/16/2010  12:34 AM    <JUNCTION>     My Documents [C:\Users\user\Documents]

06/16/2010  12:34 AM    <JUNCTION>     NetHood [C:\Users\user\AppData\Roaming\Microsoft\Windows\Network Shortcuts]

06/16/2010  12:34 AM    <JUNCTION>     PrintHood [C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]

06/16/2010  12:34 AM    <JUNCTION>     Recent [C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent]

06/16/2010  12:34 AM    <JUNCTION>     SendTo [C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo]

06/16/2010  12:34 AM    <JUNCTION>     Start Menu [C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu]

06/16/2010  12:34 AM    <JUNCTION>     Templates [C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates]

               0 File(s)              0 bytes

 Directory of C:\Users\user\AppData\Local

06/16/2010  12:34 AM    <JUNCTION>     Application Data [C:\Users\user\AppData\Local]

06/16/2010  12:34 AM    <JUNCTION>     History [C:\Users\user\AppData\Local\Microsoft\Windows\History]

06/16/2010  12:34 AM    <JUNCTION>     Temporary Internet Files [C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files]

               0 File(s)              0 bytes

     Total Files Listed:

               0 File(s)              0 bytes

              47 Dir(s)         331,776 bytes free

 

<  >

 

========== Files - Unicode (All) ==========

[2013/09/24 22:14:46 | 000,019,968 | ---- | M] ()(C:\Users\user\?????? ???? ?????.doc) -- C:\Users\user\مجموعة نزار قباني.doc

[2013/09/24 22:14:45 | 000,019,968 | ---- | C] ()(C:\Users\user\?????? ???? ?????.doc) -- C:\Users\user\مجموعة نزار قباني.doc

[2013/09/14 20:20:47 | 001,260,054 | ---- | C] ()(C:\Users\user\?????.bmp) -- C:\Users\user\الكرك.bmp

[2013/09/14 20:20:45 | 001,260,054 | ---- | M] ()(C:\Users\user\?????.bmp) -- C:\Users\user\الكرك.bmp

 

========== Alternate Data Streams ==========

 

@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:63238B95

@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:F0D7EE30

 

< End of report >

[Ackleholicism]

OTL Extras logfile created on: 8/9/2014 9:17:25 PM - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\user\Downloads

 Professional  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

1.87 Gb Total Physical Memory | 0.72 Gb Available Physical Memory | 38.51% Memory free

3.74 Gb Paging File | 1.68 Gb Available in Paging File | 45.02% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = D:\Program Files

Drive C: | 73.14 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: NTFS

Drive D: | 107.42 Gb Total Space | 100.89 Gb Free Space | 93.92% Space Free | Partition Type: NTFS

Drive E: | 117.43 Gb Total Space | 116.99 Gb Free Space | 99.63% Space Free | Partition Type: NTFS

 

Computer Name: USER-PC | User Name: user | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Extra Registry (SafeList) ==========

 

 

========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

 

========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

 

========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

========== Authorized Applications List ==========

 

 

========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0306B909-D9E1-4403-B306-D4F6705615AD}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe | 

"{0D104FFA-336B-4AE6-BC93-7BC4A3AF26C2}" = rport=139 | protocol=6 | dir=out | app=system | 

"{196FBE97-9641-48CF-B01D-E05834B2BABD}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\google\chrome\application\chrome.exe | 

"{1EE6DB56-283C-4BFA-88E0-B23CA60125E7}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{2A61C8F1-7020-4A9C-B8D3-E6486E454E13}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{392D361C-5E01-4AB8-96C2-A477FCF2E92F}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 

"{3B4BD095-E472-4CE8-9714-EFA4539715F3}" = rport=137 | protocol=17 | dir=out | app=system | 

"{3B748577-228B-4F06-9DC7-CEB48AB0DF4C}" = lport=138 | protocol=17 | dir=in | app=system | 

"{47914457-A5DA-40D2-A1BF-0FF688F155AF}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 

"{4EF34DFA-B9FA-4D99-8C04-33008470D640}" = rport=445 | protocol=6 | dir=out | app=system | 

"{587B4020-3142-4FA0-9F1E-0DE0723A9E63}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{5F02129B-A16A-434B-88EA-F963568DF35A}" = lport=139 | protocol=6 | dir=in | app=system | 

"{666F3859-4FC8-4508-8137-A331299800CA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{6D1D199A-8E4A-4106-9322-B167AE6D45A4}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{77AAA608-3791-493E-A461-7E88C2C5037A}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 | 

"{82B86B10-10CE-4BF6-AD89-B5FA07593775}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{8E5BFD7E-283B-4CA1-B5BA-9BD51BD42F0D}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 

"{8F015EFB-5BC6-45DC-820F-B74FA61E0F1E}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{915F5CD2-FBAD-4581-ADE7-BFB4493B85B1}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{9D79CA79-DC67-458B-B249-5134344E0B4C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{A0D72AE4-DEA1-4BF5-9482-986033E377EB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{A7CAE002-CC98-48CE-826F-1A068B37B692}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{AAE19ACB-1E32-4400-ABF7-B0BB1BA7DF2E}" = lport=445 | protocol=6 | dir=in | app=system | 

"{AE0C8532-A7E0-4589-8324-07AD0033EE9E}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{CB0A6AA6-50F4-43FA-ACBA-DE02058AAB41}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{CC483DD5-730D-4D53-BCE7-D282A64AB519}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 

"{E33A6FBD-2D4E-49DF-9A2E-3567611E3CA5}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{E7E69897-9638-4D97-942D-BC4A1222DDDD}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{E829156F-AFFA-4741-9389-724E8D2AE17E}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{EAA9C423-435E-4E17-A1E9-C9323A5361EC}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{F7C1A15B-4643-463F-A4EC-1087C6BA3C72}" = rport=138 | protocol=17 | dir=out | app=system | 

"{F8BE5B49-C4DD-4C0A-B2BE-4A9AE8750C26}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 | 

"{FAF503DE-F3A3-47DD-8308-93DB2665E78E}" = lport=137 | protocol=17 | dir=in | app=system | 

 

========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{11AD6497-1856-4FAD-A4A7-D0FAB9567375}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | 

"{141ACF57-F2BA-4AFD-AA7F-D7A547DBC6EA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1EAEE8CA-6D2B-42DE-BCC9-17C8A0432C43}" = protocol=58 | dir=in | [email protected],-28545 | 

"{1F755EEF-DFC8-41F0-AC9C-2FACD5E3C65D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{3AD0E878-A197-42CC-A0BF-51764AA6C08A}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{442B7CE9-61EE-4D92-975C-0396F33DDFAB}" = protocol=1 | dir=out | [email protected],-28544 | 

"{5398A1A0-3BC5-451B-BAD8-E23F987A37F5}" = protocol=1 | dir=in | [email protected],-28543 | 

"{5588F842-3EA2-4BF4-9208-B719B10E9151}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{63A27529-BFEE-4465-974B-D7A8C2DA7215}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{6ACFFED3-6A0D-4151-A961-16F94E197362}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{6E6459E7-25F6-4985-A019-B6622E5A8D3C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{7FF0FD7F-AA7B-435A-B1E0-0AC760DCDA74}" = dir=in | app=c:\users\user\appdata\local\facebook\video\skype\facebookvideocalling.exe | 

"{878938A4-E2F9-4891-97C9-C21C13B9003D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{95E4BEB6-3A85-4452-B7AB-B1AEAAE9983B}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{9B6DE7BE-F926-4CFA-AE65-6C3B072A257C}" = protocol=17 | dir=in | app=c:\users\user\appdata\roaming\utorrent\utorrent.exe | 

"{A0C1D3C6-1E91-41B4-A548-22DA2D8480A5}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{A894E0E5-5386-40C8-92C7-C3E38695E7E7}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{A972938A-A2B3-44CF-8F8A-BD7660A7B957}" = protocol=58 | dir=out | [email protected],-28546 | 

"{B395E1CF-F155-4C21-A769-91E472A3C5FD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{B637D29D-BF4E-4205-BD60-CBBB4074C140}" = protocol=6 | dir=in | app=c:\users\user\appdata\roaming\utorrent\utorrent.exe | 

"{CA12B3D6-C31B-4062-B7EB-0561850EED4E}" = protocol=6 | dir=out | app=system | 

"{CCA61FFC-EA5A-4978-A28E-4C32D416A420}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{CF88C758-E053-41B0-ACD8-C913A7C67EBB}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | 

"{D5065CD2-C250-4CDA-B51D-DF2FE0F0B796}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 

"{E897211B-79B8-4EE3-8FE2-DAEDF192FB7E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{EE39908B-4CDA-4273-8483-68BF3C046C93}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{F5AF7973-F333-48D3-A78E-C206343B1EA2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{F6850D76-C1F7-475E-8962-7D1CA2439217}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

 

========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{03D562B5-C4E2-4846-A920-33178788BE00}" = Windows Live Communications Platform

"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended

"{0A3925EA-5B0E-401B-A189-7419149747B2}" = Adobe AIR

"{0F929651-F516-4956-90F2-FFBD2CD5D30E}" = Photo Gallery

"{0FF9CC94-EF23-401E-BDBD-37403D1A2B38}" = Windows Live SOXE Definitions

"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP2700_series" = Canon iP2700 series Printer Driver

"{15B0ED62-93DC-431C-89F3-3CC6F0FCE94D}" = WindowTabs

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{2AC01935-3774-4981-98C8-14E93C14372C}" = Windows Live UX Platform Language Pack

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{45898170-E68C-4F02-AA35-C2186BF347A3}" = Movie Maker

"{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}" = Google Earth

"{5A0EE0F0-E909-4F3B-B437-AAD9252427CB}" = Windows Live Installer

"{5E094C92-6288-4F43-AA9A-D452D0218F3F}" = Windows Live Essentials

"{5E6F6CF3-BACC-4144-868C-E14622C658F3}" = TOSHIBA Web Camera Application

"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD

"{6B6923B9-8719-425B-916C-CD2908F31AAF}" = Windows Live SOXE

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies

"{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}" = Skype™ 6.16

"{8256F87F-8554-4457-8C3D-3F3324697D9F}" = Windows Live ID Sign-in Assistant

"{88547073-C566-4895-9005-EBE98EA3F7C7}" = Samsung Kies3

"{89C7E0A7-4D9D-4DCC-8834-A9A2B92D7EBB}" = Photo Gallery

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT

"{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}" = Facebook Video Calling 2.0.0.447

"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110

"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile Device Center

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{B39A6825-EA20-43EA-AB2D-A6BC0298D9A1}" = Movie Maker

"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call

"{C6B0EE9E-2128-4448-B7AE-5E2B46E0F0E7}" = Windows Live Photo Common

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones

"{DD7C5FC1-DCA5-487A-AF23-658B1C00243F}" = Photo Common

"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10

"{E3445598-4424-4EE2-B71C-C23325F7FB71}" = Windows Live PIMT Platform

"{E7044E25-3038-4A76-9064-344AC038043E}" = Windows Mobile Device Center Driver Update

"{EAA190F4-FF0D-4D28-A4E7-E0A20E1DDDFA}" = BitDefender Total Security 2010

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F0E58739-2B4C-498F-9B0D-FF0F2FD52B61}" = Windows Live UX Platform

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{FC98FBE9-E931-494C-8717-497185371033}" = Nero 7 Premium

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 14 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 14 Plugin

"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program

"CanonMyPrinter" = Canon Utilities My Printer

"CanonSolutionMenu" = Canon Utilities Solution Menu

"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX

"HDMI" = Intel® Graphics Media Accelerator Driver

"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies

"InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}" = Samsung Kies3

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended

"Mozilla Firefox 30.0 (x86 en-US)" = Mozilla Firefox 30.0 (x86 en-US)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"OJOsoft Total Video Converter_is1" = OJOsoft Total Video Converter

"PhotoScape" = PhotoScape

"RealPlayer 12.0" = RealPlayer

"TreeSize Free_is1" = TreeSize Free V3.0.1

"Windows Mobile Device Handbook" = Windows Mobile® Device Handbook

"WinLiveSuite" = Windows Live Essentials

"WinRAR archiver" = WinRAR archiver

"Yahoo! Messenger" = Yahoo! Messenger

 

========== HKEY_USERS Uninstall List ==========

 

[HKEY_USERS\S-1-5-21-3221818885-2957879276-3168191266-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

 

========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 8/9/2014 9:48:11 AM | Computer Name = user-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>

 with error: There is not enough space on the disk.  .

 

Error - 8/9/2014 10:54:46 AM | Computer Name = user-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>

 with error: There is not enough space on the disk.  .

 

Error - 8/9/2014 10:54:46 AM | Computer Name = user-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>

 with error: There is not enough space on the disk.  .

 

Error - 8/9/2014 10:54:46 AM | Computer Name = user-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>

 with error: There is not enough space on the disk.  .

 

Error - 8/9/2014 10:54:46 AM | Computer Name = user-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>

 with error: There is not enough space on the disk.  .

 

Error - 8/9/2014 10:54:46 AM | Computer Name = user-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>

 with error: There is not enough space on the disk.  .

 

Error - 8/9/2014 10:54:46 AM | Computer Name = user-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>

 with error: There is not enough space on the disk.  .

 

Error - 8/9/2014 10:54:46 AM | Computer Name = user-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>

 with error: There is not enough space on the disk.  .

 

Error - 8/9/2014 10:54:46 AM | Computer Name = user-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab>

 with error: There is not enough space on the disk.  .

 

Error - 8/9/2014 2:22:06 PM | Computer Name = user-PC | Source = System Restore | ID = 8193

Description = 

 

[ System Events ]

Error - 2/16/2012 11:46:51 AM | Computer Name = user-PC | Source = Disk | ID = 262155

Description = The driver detected a controller error on \Device\Harddisk1\DR1.

 

Error - 2/16/2012 12:02:41 PM | Computer Name = user-PC | Source = Disk | ID = 262155

Description = The driver detected a controller error on \Device\Harddisk1\DR2.

 

Error - 2/16/2012 12:30:29 PM | Computer Name = user-PC | Source = Disk | ID = 262155

Description = The driver detected a controller error on \Device\Harddisk1\DR3.

 

Error - 2/16/2012 5:20:55 PM | Computer Name = user-PC | Source = Disk | ID = 262155

Description = The driver detected a controller error on \Device\Harddisk1\DR1.

 

Error - 2/16/2012 5:20:59 PM | Computer Name = user-PC | Source = Disk | ID = 262155

Description = The driver detected a controller error on \Device\Harddisk1\DR1.

 

Error - 2/18/2012 5:05:01 PM | Computer Name = user-PC | Source = Disk | ID = 262155

Description = The driver detected a controller error on \Device\Harddisk1\DR1.

 

Error - 2/18/2012 5:05:05 PM | Computer Name = user-PC | Source = Disk | ID = 262155

Description = The driver detected a controller error on \Device\Harddisk1\DR1.

 

Error - 5/10/2012 10:48:28 AM | Computer Name = user-PC | Source = BROWSER | ID = 8032

Description = 

 

Error - 8/11/2013 11:14:16 AM | Computer Name = user-PC | Source = EventLog | ID = 6008

Description = The previous system shutdown at 5:57:08 PM on ?8/?11/?2013 was unexpected.

 

Error - 9/14/2013 12:06:38 PM | Computer Name = user-PC | Source = EventLog | ID = 6008

Description = The previous system shutdown at 7:19:09 PM on ?9/?14/?2013 was unexpected.

 

 

< End of report >

[Biscuithd]

A quick quesiton. Before I start removing things from your machine, do you recognize the following files as files or pictures you created and would be legitimate file names on you machine?

 

\مجموعة نزار قباني.doc

\مجموعة نزار قباني.doc

\الكرك.bmp

\الكرك.bmp

 

 

[Ackleholicism]

Yes They are mine,i dont need them anymore tho

[Biscuithd]

No, it not necessary to uninstall those files. I just didn't recognize what they were and was concerned that they might be malware.

 

Ok, before we do anything more we have two issues to address.

 

The first is that you do not have the current Service Pack on your machine. This is a huge Security Risk and I can't do much for you until we fix that.

The second is that you don't have enough free disk space to do the update (which is the reason you came here) and here is why. You have your computer set to Hibernate. In and of itself that's not a bad thing, but it does use a huge amount of disk space and memory. So, you have two choices, turn off Hibernate or buy a much larger hard disk. I don't know your exact situation, but in average home use, Hibernate is rarely necessary and is a huge user of disk and memory.

 

So, you have a decision to make. Turn off Hibernate and update to Service Pack 1. Or, run as you are, but understand you have a huge security risk. Let me know your thoughts and I will help you as best I can.

 

 

 

[Ackleholicism]

I Have given the laptop to a specialist and what he did is install another windows i guess,he renamed the main DISK  to D but the new windows files are on C now the old windows files (Program files,etc) are currently on D which previously was C and i dont want them i wanna get rid of them,how do i do that?

 

He installed a version of windows called Windows Starter which is limited and horrible,il be changing it but how do i get rid of the old windows files?

[Biscuithd]

Wow! To be honest, you've exceeded my knowledge. I'm just a lowly malware guy. However, we have some of the best Hardware, Network and Operating System people over on those areas of our site.

 

Just to comment a little, there is a lot to consider before you start to delete Operating System files. For one, it is quite possibie that the new installation is using/needing a file or two or twenty that are still on the disk that you want to delete. That would be quite problematic.

 

My best suggestion is to go to the Operating System portion of our site and open a topic. Here.