OTL logfile created on: 12/07/2014 18:10:24 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Bina Kakhani\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16798) Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy 7.87 Gb Total Physical Memory | 5.67 Gb Available Physical Memory | 72.02% Memory free 11.83 Gb Paging File | 9.54 Gb Available in Paging File | 80.65% Paging File free Paging file location(s): c:\pagefile.sys 4048 4048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 365.39 Gb Total Space | 129.63 Gb Free Space | 35.48% Space Free | Partition Type: NTFS Drive D: | 331.84 Gb Total Space | 248.46 Gb Free Space | 74.87% Space Free | Partition Type: NTFS Computer Name: LIVEBOOK | User Name: Bina Kakhani | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2014/07/12 18:09:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Bina Kakhani\Downloads\OTL.exe PRC - [2014/06/05 14:58:39 | 000,860,488 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe PRC - [2014/04/11 19:45:42 | 001,390,720 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe PRC - [2014/03/03 10:52:32 | 001,748,608 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe PRC - [2013/09/28 18:24:14 | 001,734,680 | ---- | M] (AVG Secure Search) -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.0.1\ToolbarUpdater.exe PRC - [2013/05/29 23:04:14 | 001,983,248 | ---- | M] (Avid) -- C:\Program Files (x86)\Avid\Mbox\AudioDevMon.exe PRC - [2012/11/19 18:17:24 | 002,928,128 | ---- | M] (PACE Anti-Piracy, Inc.) -- C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe PRC - [2009/05/14 18:07:14 | 000,759,048 | ---- | M] (ABBYY) -- C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2014/07/08 08:18:04 | 014,663,856 | ---- | M] () -- C:\Users\Bina Kakhani\AppData\Local\Google\Chrome\User Data\PepperFlash\14.0.0.145\pepflashplayer.dll MOD - [2014/06/05 14:58:38 | 000,414,536 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppgooglenaclpluginchrome.dll MOD - [2014/06/05 14:58:36 | 004,217,672 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll MOD - [2014/06/05 14:58:32 | 000,716,616 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libglesv2.dll MOD - [2014/06/05 14:58:31 | 000,126,280 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libegl.dll MOD - [2014/06/05 14:58:30 | 001,732,424 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll MOD - [2010/01/21 02:34:10 | 008,793,952 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll MOD - [2010/01/09 21:18:18 | 004,254,560 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF [color=#E56717]========== Services (SafeList) ==========[/color] SRV:[b]64bit:[/b] - [2014/06/19 03:56:34 | 002,356,408 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe -- (ClickToRunSvc) SRV:[b]64bit:[/b] - [2013/05/27 06:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:[b]64bit:[/b] - [2012/05/03 06:33:20 | 000,027,760 | ---- | M] (VIA Technologies, Inc.) [Disabled | Stopped] -- C:\Windows\SysNative\ViakaraokeSrv.exe -- (VIAKaraokeService) SRV:[b]64bit:[/b] - [2012/04/20 15:16:12 | 000,635,104 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Program Files\Intel\iCLS Client\HeciServer.exe -- (Intel(R) SRV:[b]64bit:[/b] - [2011/04/07 16:37:16 | 005,352,960 | ---- | M] (Native Instruments GmbH) [Auto | Running] -- C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe -- (NIHardwareService) SRV:[b]64bit:[/b] - [2010/06/07 10:33:02 | 000,167,424 | ---- | M] (Mediafour Corporation) [Auto | Running] -- C:\Program Files\Mediafour\MacDrive 8\MacDrive8ServiceD.exe -- (MacDrive8ServiceD) SRV:[b]64bit:[/b] - [2009/07/14 02:39:31 | 000,045,568 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\rundll32.exe -- (976137e5) SRV:[b]64bit:[/b] - [2009/07/14 02:39:31 | 000,045,568 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\rundll32.exe -- (1a34a8e0) SRV - [2014/04/11 19:45:42 | 001,390,720 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe -- (c2cautoupdatesvc) SRV - [2014/03/14 15:17:00 | 000,036,392 | ---- | M] (Just Develop It) [Auto | Running] -- C:\Program Files (x86)\MyPC Backup\BackupStack.exe -- (BackupStack) SRV - [2014/03/03 10:52:32 | 001,748,608 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe -- (c2cpnrsvc) SRV - [2013/09/28 18:24:14 | 001,734,680 | ---- | M] (AVG Secure Search) [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.0.1\ToolbarUpdater.exe -- (vToolbarUpdater17.0.1) SRV - [2013/05/29 23:04:14 | 001,983,248 | ---- | M] (Avid) [Auto | Running] -- C:\Program Files (x86)\Avid\Mbox\AudioDevMon.exe -- (MboxAudioDevMon) SRV - [2012/12/18 20:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012/12/14 03:42:10 | 000,277,616 | ---- | M] (Intel Corporation) [Disabled | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs) SRV - [2012/11/19 18:17:24 | 002,928,128 | ---- | M] (PACE Anti-Piracy, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe -- (PaceLicenseDServices) SRV - [2012/05/15 08:27:52 | 000,363,800 | R--- | M] (Intel Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2012/05/15 08:27:48 | 000,277,784 | R--- | M] (Intel Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2012/05/15 08:27:32 | 000,165,144 | R--- | M] (Intel Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe -- (jhi_service) SRV - [2011/02/18 16:57:30 | 000,035,328 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\Hotkey\PowerBiosServer.exe -- (PowerBiosServer) SRV - [2010/03/18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009/06/10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009/05/14 18:07:14 | 000,759,048 | ---- | M] (ABBYY) [Auto | Running] -- C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe -- (ABBYY.Licensing.FineReader.Sprint.9.0) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV:[b]64bit:[/b] - [2013/11/23 14:50:43 | 000,294,248 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\VMM.sys -- (vmm) DRV:[b]64bit:[/b] - [2013/06/11 22:35:35 | 000,111,696 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NIWinCDEmu.sys -- (NIWinCDEmu) DRV:[b]64bit:[/b] - [2013/05/29 22:04:12 | 000,464,656 | ---- | M] (Avid) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AvidMbox.sys -- (MBOX) DRV:[b]64bit:[/b] - [2013/05/29 22:04:12 | 000,030,992 | ---- | M] (Avid) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AvidMbox_DFU.sys -- (MBOXDFU) DRV:[b]64bit:[/b] - [2012/12/14 03:42:22 | 005,353,888 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:[b]64bit:[/b] - [2012/11/17 08:24:04 | 000,024,728 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iLokDrvr.sys -- (iLokDrvr) DRV:[b]64bit:[/b] - [2012/11/17 08:22:26 | 000,105,624 | ---- | M] (PACE Anti-Piracy, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\Tpkd.sys -- (Tpkd) DRV:[b]64bit:[/b] - [2012/10/10 10:05:20 | 000,023,384 | ---- | M] (Avid Technology, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\diginet.sys -- (DigiNet) DRV:[b]64bit:[/b] - [2012/08/29 11:50:38 | 000,057,408 | ---- | M] (MusicLab, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mlkumidi.sys -- (mlkumidi) DRV:[b]64bit:[/b] - [2012/08/21 14:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:[b]64bit:[/b] - [2012/07/17 19:12:08 | 000,062,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) DRV:[b]64bit:[/b] - [2012/05/20 17:25:32 | 000,789,824 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3xhc.sys -- (iusb3xhc) DRV:[b]64bit:[/b] - [2012/05/20 17:25:32 | 000,357,184 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3hub.sys -- (iusb3hub) DRV:[b]64bit:[/b] - [2012/05/20 17:25:32 | 000,019,264 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iusb3hcs.sys -- (iusb3hcs) DRV:[b]64bit:[/b] - [2012/05/09 06:06:42 | 000,293,992 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsBaStor.sys -- (RSBASTOR) DRV:[b]64bit:[/b] - [2012/05/03 06:33:12 | 002,196,592 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService) DRV:[b]64bit:[/b] - [2012/03/09 13:41:16 | 000,685,160 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:[b]64bit:[/b] - [2012/03/01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:[b]64bit:[/b] - [2012/02/20 05:36:58 | 011,471,872 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Netwsw00.sys -- (NETwNs64) DRV:[b]64bit:[/b] - [2011/12/05 21:23:08 | 000,331,264 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) DRV:[b]64bit:[/b] - [2011/03/11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:[b]64bit:[/b] - [2011/03/11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:[b]64bit:[/b] - [2010/11/21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:[b]64bit:[/b] - [2010/11/21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:[b]64bit:[/b] - [2010/11/21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:[b]64bit:[/b] - [2010/09/16 12:14:56 | 001,393,200 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:[b]64bit:[/b] - [2010/05/18 10:07:26 | 000,306,280 | ---- | M] (Mediafour Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\MDFSYSNT.SYS -- (MDFSYSNT) DRV:[b]64bit:[/b] - [2010/05/05 10:43:24 | 000,032,352 | ---- | M] (Mediafour Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\MDPMGRNT.SYS -- (MDPMGRNT) DRV:[b]64bit:[/b] - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:[b]64bit:[/b] - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:[b]64bit:[/b] - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:[b]64bit:[/b] - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:[b]64bit:[/b] - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:[b]64bit:[/b] - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:[b]64bit:[/b] - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:[b]64bit:[/b] - [2008/02/05 02:50:42 | 000,079,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMNetSrv.sys -- (VPCNetS2) DRV:[b]64bit:[/b] - [2008/01/22 00:18:00 | 000,016,384 | ---- | M] (nerds.de) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\loopbe30.sys -- (LoopBe30) DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://searchy.easylifeapp.com/ IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://searchy.easylifeapp.com/ IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.b1.org/?bsrc=hmior&chid=c167991 IE - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page Before = http://search.b1.org/?bsrc=hmior&chid=c167991 IE - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com/?ctid=CT3325290&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPDA40DC1A-010C-41D5-9685-3C8B218E3096&SSPV= IE - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Before = http://search.b1.org/?bsrc=hmior&chid=c167991 IE - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp IE - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-GB IE - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 9A EC B6 CC 23 15 CE 01 [binary data] IE - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\..\URLSearchHook: {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No CLSID value found IE - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\..\SearchScopes,DefaultScope = {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} IE - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\..\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}: "URL" = http://search.conduit.com/Results.aspx?ctid=CT3325290&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPDA40DC1A-010C-41D5-9685-3C8B218E3096&q={searchTerms}&SSPV= IE - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR IE - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://www.delta-search.com/?q={searchTerms}&affID=121845&tt=gc_150213_lnkry&babsrc=SP_ss&mntrId=86770090F5CBEAEF IE - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\..\SearchScopes\{3AFE5FC7-3889-4589-ACD5-93ACEBA22FEE}: "URL" = http://www.delta-search.com/?q={searchTerms}&affID=120006&babsrc=SP_ss&mntrId=86770090F5CBEAEF IE - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={962C4793-D758-4AB0-B467-FA877FADDA27}&mid=4c89c7b192a447d38a61d1d9b32f031c-91130ead4f5d4d192c13d1c971c8211902e083b9&lang=en&ds=AVG&pr=sa&d=2013-04-03 21:38:57&v=15.5.0.2&pid=avg&sg=0&sap=dsp&q={searchTerms} IE - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local [color=#E56717]========== FireFox ==========[/color] FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@ilok.com/iLokHelper,version=3.1.0.7: C:\Program Files (x86)\PACE Anti-Piracy\iLok\NPPaceILok.dll ( PACE Anti-Piracy, Inc) FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.169\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.169\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) [2013/03/05 22:49:11 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [color=#E56717]========== Chrome ==========[/color] CHR - default_search_provider: Conduit Search (Enabled) CHR - default_search_provider: search_url = http://search.conduit.com/Results.aspx?ctid=CT3325290&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPDA40DC1A-010C-41D5-9685-3C8B218E3096&q={searchTerms}&SSPV= CHR - default_search_provider: suggest_url = http://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}, CHR - plugin: Error reading preferences file CHR - Extension: No name found = C:\Users\Bina Kakhani\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\ CHR - Extension: No name found = C:\Users\Bina Kakhani\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\ CHR - Extension: No name found = C:\Users\Bina Kakhani\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5019_0\ CHR - Extension: Skype Click to Call = C:\Users\Bina Kakhani\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\7.1.15383.6004_0\ CHR - Extension: Skype Click to Call = C:\Users\Bina Kakhani\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\7.1.15383.6004_1\ CHR - Extension: Skype Click to Call = C:\Users\Bina Kakhani\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\7.2.15747.10003_0\ CHR - Extension: No name found = C:\Users\Bina Kakhani\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkkidmpafdcfdcbkbpnmplgedohaijkd\168\ CHR - Extension: No name found = C:\Users\Bina Kakhani\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_1\ CHR - Extension: No name found = C:\Users\Bina Kakhani\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2009/06/10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:[b]64bit:[/b] - BHO: (Delta SmartbarEngine) - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - mscoree.dll File not found O2:[b]64bit:[/b] - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ochelper.dll (Microsoft Corporation) O2:[b]64bit:[/b] - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\EPSON Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION) O2:[b]64bit:[/b] - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O2:[b]64bit:[/b] - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation) O2:[b]64bit:[/b] - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\urlredir.dll (Microsoft Corporation) O2:[b]64bit:[/b] - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll (Microsoft Corporation) O2 - BHO: (Delta SmartbarEngine) - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - mscoree.dll File not found O2 - BHO: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found. O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\urlredir.dll (Microsoft Corporation) O3:[b]64bit:[/b] - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3:[b]64bit:[/b] - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\EPSON Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION) O3:[b]64bit:[/b] - HKLM\..\Toolbar: (Delta Smartbar) - {ae07101b-46d4-4a98-af68-0333ea26e113} - mscoree.dll File not found O3 - HKLM\..\Toolbar: (Delta Smartbar) - {ae07101b-46d4-4a98-af68-0333ea26e113} - mscoree.dll File not found O3 - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found. O4:[b]64bit:[/b] - HKLM..\Run: [MacDrive 8 application for Digidesign] C:\Program Files\Mediafour\MacDrive 8\MacDriveD.exe (Mediafour Corporation) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-3631653108-633396649-2893303694-1000..\Run: [EPLTarget\P0000000000000000] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIILE.EXE /EPT "EPLTarget\P0000000000000000" /M "XP-205 207 Series" File not found O4 - HKU\S-1-5-21-3631653108-633396649-2893303694-1000..\Run: [UcgiyVubma] regsvr32.exe "C:\ProgramData\UcgiyVubma.dat" File not found O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\Bina Kakhani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk = C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKU\S-1-5-21-3631653108-633396649-2893303694-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9:[b]64bit:[/b] - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\onbttnie.dll (Microsoft Corporation) O9:[b]64bit:[/b] - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\onbttnie.dll (Microsoft Corporation) O9:[b]64bit:[/b] - Extra Button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ochelper.dll (Microsoft Corporation) O9:[b]64bit:[/b] - Extra 'Tools' menuitem : Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ochelper.dll (Microsoft Corporation) O9:[b]64bit:[/b] - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\onbttnielinkednotes.dll (Microsoft Corporation) O9:[b]64bit:[/b] - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\onbttnielinkednotes.dll (Microsoft Corporation) O9:[b]64bit:[/b] - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation) O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\onbttnie.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\onbttnie.dll (Microsoft Corporation) O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\onbttnielinkednotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\onbttnielinkednotes.dll (Microsoft Corporation) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O13[b]64bit:[/b] - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.6.2.cab (DLM Control) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C80F5DD5-D42E-4E97-85B7-9106D32F7F40}: DhcpNameServer = 194.168.4.100 194.168.8.100 O18:[b]64bit:[/b] - Protocol\Handler\ms-help - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\osf - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation) O18 - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\msosb.dll (Microsoft Corporation) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found O18:[b]64bit:[/b] - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found O18:[b]64bit:[/b] - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found O20:[b]64bit:[/b] - AppInit_DLLs: (C:\PROGRA~3\WebPlat\WEBPLA~1.DLL) - C:\ProgramData\WebPlat\WebPlat_x64.dll () O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - File not found O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - File not found O20 - HKLM Winlogon: UserInit - (userinit.exe) - File not found O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - File not found O20:[b]64bit:[/b] - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - File not found O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O29:[b]64bit:[/b] - HKLM SecurityProviders - (credssp.dll) - File not found O29 - HKLM SecurityProviders - (credssp.dll) - File not found O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{6670bdd0-a2d3-11e2-ae45-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{6670bdd0-a2d3-11e2-ae45-806e6f6e6963}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %* O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) CREATERESTOREPOINT Restore point Set: OTL Restore Point [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2014/07/08 19:55:22 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess [2014/07/08 19:55:19 | 000,000,000 | ---D | C] -- C:\Users\Bina Kakhani\Documents\Addictive Keys Logs [2014/07/08 19:46:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\XLN Audio [2014/07/08 19:46:43 | 000,000,000 | ---D | C] -- C:\Users\Bina Kakhani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\XLN Audio [2014/07/08 19:46:43 | 000,000,000 | ---D | C] -- C:\ProgramData\XLN Audio [2014/07/07 18:17:55 | 000,000,000 | -H-D | C] -- C:\ProgramData\{E26B3878-7CEC-469C-B449-5CAA336DF8CD} [2014/07/07 17:55:57 | 000,000,000 | ---D | C] -- C:\ProgramData\{13A9B825-42CB-4973-913D-2194B5A4CF94} [2014/07/07 14:14:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TakeoThoeCoupOOn [2014/07/04 19:06:55 | 000,000,000 | ---D | C] -- C:\Users\Bina Kakhani\AppData\Local\Skype [2014/07/04 19:06:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2014/07/04 19:06:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype [2014/07/03 18:45:43 | 000,000,000 | ---D | C] -- C:\ProgramData\TakeoThoeCoupOOn [2014/07/01 18:23:27 | 000,000,000 | -H-D | C] -- C:\ProgramData\{1CEDDDD4-56D2-463F-BC4E-C5DFFD3533C9} [2014/07/01 18:22:37 | 000,000,000 | -H-D | C] -- C:\ProgramData\{DCC412E7-393B-4016-91FB-9307F059AFB6} [2014/06/18 21:00:27 | 000,000,000 | --SD | C] -- C:\Windows\SysWow64\Microsoft [2014/06/17 18:26:13 | 000,000,000 | ---D | C] -- C:\Program Files\Google [2014/06/17 18:26:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Google [2014/06/17 18:25:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome [2014/06/17 18:23:57 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software [2014/06/17 18:23:25 | 000,000,000 | ---D | C] -- C:\Users\Bina Kakhani\AppData\Roaming\DesktopIconForAmazon [2014/06/17 17:21:18 | 000,000,000 | ---D | C] -- C:\Users\Bina Kakhani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup [2014/06/13 15:25:56 | 000,000,000 | ---D | C] -- C:\Users\Bina Kakhani\Desktop\syl [4 C:\Users\Bina Kakhani\Documents\*.tmp files -> C:\Users\Bina Kakhani\Documents\*.tmp -> ] [1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2014/07/12 17:30:00 | 000,000,910 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2014/07/12 14:41:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2014/07/12 12:51:04 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2014/07/12 12:51:04 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2014/07/12 12:50:05 | 000,730,384 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2014/07/12 12:50:05 | 000,633,714 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2014/07/12 12:50:05 | 000,112,846 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2014/07/12 12:42:53 | 000,000,906 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2014/07/09 12:34:45 | 000,212,992 | ---- | M] () -- C:\ProgramData\UcgiyVubma.dat [2014/07/08 19:54:41 | 000,001,247 | ---- | M] () -- C:\Users\Bina Kakhani\Desktop\Addictive Keys.lnk [2014/07/07 20:34:17 | 000,491,212 | ---- | M] () -- C:\Users\Bina Kakhani\Desktop\ganga.wav [2014/07/07 19:10:55 | 000,491,212 | ---- | M] () -- C:\Users\Bina Kakhani\Desktop\c note.wav [2014/07/07 18:17:53 | 000,001,026 | ---- | M] () -- C:\Users\Public\Desktop\Massive.lnk [2014/07/04 19:06:30 | 000,002,515 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2014/07/02 19:42:46 | 024,497,473 | ---- | M] () -- C:\Users\Bina Kakhani\Desktop\Mixing Audio - Concepts, Practices and Tools - Roey Izhaki .pdf [2014/07/01 18:23:24 | 000,001,050 | ---- | M] () -- C:\Users\Public\Desktop\Guitar Rig 5.lnk [2014/07/01 18:22:37 | 000,001,100 | ---- | M] () -- C:\Users\Public\Desktop\Controller Editor.lnk [2014/06/17 18:32:31 | 000,002,285 | ---- | M] () -- C:\Users\Bina Kakhani\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk [2014/06/17 18:25:59 | 000,002,261 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2014/06/17 17:21:53 | 000,001,975 | ---- | M] () -- C:\Users\Bina Kakhani\Desktop\Sync Folder.lnk [2014/06/17 17:21:18 | 000,001,103 | ---- | M] () -- C:\Users\Bina Kakhani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk [2014/06/17 17:21:18 | 000,001,093 | ---- | M] () -- C:\Users\Bina Kakhani\Desktop\MyPC Backup.lnk [4 C:\Users\Bina Kakhani\Documents\*.tmp files -> C:\Users\Bina Kakhani\Documents\*.tmp -> ] [1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2014/07/08 19:54:41 | 000,001,247 | ---- | C] () -- C:\Users\Bina Kakhani\Desktop\Addictive Keys.lnk [2014/07/08 16:03:32 | 000,212,992 | ---- | C] () -- C:\ProgramData\UcgiyVubma.dat [2014/07/07 20:34:13 | 000,491,212 | ---- | C] () -- C:\Users\Bina Kakhani\Desktop\ganga.wav [2014/07/07 19:10:53 | 000,491,212 | ---- | C] () -- C:\Users\Bina Kakhani\Desktop\c note.wav [2014/07/07 18:17:53 | 000,001,026 | ---- | C] () -- C:\Users\Public\Desktop\Massive.lnk [2014/07/04 19:06:30 | 000,002,515 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk [2014/07/02 19:42:35 | 024,497,473 | ---- | C] () -- C:\Users\Bina Kakhani\Desktop\Mixing Audio - Concepts, Practices and Tools - Roey Izhaki .pdf [2014/07/01 18:23:24 | 000,001,050 | ---- | C] () -- C:\Users\Public\Desktop\Guitar Rig 5.lnk [2014/07/01 18:22:37 | 000,001,100 | ---- | C] () -- C:\Users\Public\Desktop\Controller Editor.lnk [2014/06/17 18:25:59 | 000,002,285 | ---- | C] () -- C:\Users\Bina Kakhani\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk [2014/06/17 18:25:59 | 000,002,261 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2014/06/17 18:25:24 | 000,000,910 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2014/06/17 18:25:22 | 000,000,906 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2014/06/17 17:21:53 | 000,001,975 | ---- | C] () -- C:\Users\Bina Kakhani\Desktop\Sync Folder.lnk [2014/06/17 17:21:18 | 000,001,103 | ---- | C] () -- C:\Users\Bina Kakhani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk [2014/06/17 17:21:18 | 000,001,093 | ---- | C] () -- C:\Users\Bina Kakhani\Desktop\MyPC Backup.lnk [2014/06/04 18:06:36 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2014/05/23 21:40:49 | 000,063,592 | ---- | C] () -- C:\Users\Bina Kakhani\AppData\Local\soulseek-client.dat.1400877649778 [2014/05/09 16:55:25 | 000,063,578 | ---- | C] () -- C:\Users\Bina Kakhani\AppData\Local\soulseek-client.dat.1399650925587 [2014/05/09 16:55:25 | 000,000,000 | ---- | C] () -- C:\Users\Bina Kakhani\AppData\Local\soulseek-client.dat.1399650925617 [2014/05/04 00:29:41 | 000,063,592 | ---- | C] () -- C:\Users\Bina Kakhani\AppData\Local\soulseek-client.dat.1399159781947 [2014/03/17 23:46:55 | 000,196,896 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat [2013/11/26 15:45:15 | 000,724,202 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2013/11/25 00:16:57 | 000,000,000 | ---- | C] () -- C:\Windows\EEventManager.INI [2013/03/07 19:07:31 | 000,000,051 | ---- | C] () -- C:\Users\Bina Kakhani\jagex_cl_runescape_LIVE.dat [2013/03/07 19:03:59 | 000,000,051 | ---- | C] () -- C:\Users\Bina Kakhani\jagex_cl_oldschool_LIVE.dat [2013/03/07 19:03:59 | 000,000,024 | ---- | C] () -- C:\Users\Bina Kakhani\random.dat [2013/03/01 15:01:37 | 000,033,193 | ---- | C] () -- C:\Users\Bina Kakhani\AppData\Roaming\UserTile.png [2013/02/27 15:49:53 | 000,755,572 | ---- | C] () -- C:\Windows\SysWow64\igkrng700.bin [2013/02/27 15:49:53 | 000,559,972 | ---- | C] () -- C:\Windows\SysWow64\igfcg700m.bin [2012/12/14 03:42:30 | 000,064,512 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll [2012/12/14 03:42:24 | 000,754,652 | ---- | C] () -- C:\Windows\SysWow64\igcodeckrng700.bin [2012/12/14 03:42:24 | 000,598,384 | ---- | C] () -- C:\Windows\SysWow64\igvpkrng700.bin [color=#E56717]========== ZeroAccess Check ==========[/color] [2009/07/14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013/07/26 03:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013/07/26 02:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] [color=#E56717]========== LOP Check ==========[/color] [2014/03/31 21:14:05 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\4Front [2013/12/16 23:21:31 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\AVG [2013/03/11 17:49:37 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\Avid [2013/06/12 20:03:35 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\B1Toolbar [2013/03/05 22:49:05 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\Babylon [2013/04/15 15:47:32 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\Chirp.3E67724F17ED2775332FC10D237475858B808A75.1 [2014/06/18 19:23:31 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\DesktopIconForAmazon [2013/02/27 22:09:50 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\Digidesign [2013/05/16 18:47:37 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\DriverCure [2013/11/25 00:11:28 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\Epson [2014/01/05 15:36:30 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\FlowStone [2013/04/15 19:40:59 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\FreeAudioPack [2013/05/16 20:51:51 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\HoolappForAndroid [2013/03/21 20:32:36 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\Image-Line [2013/09/21 18:00:25 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\iZotope [2013/03/18 21:07:10 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\Joyvy [2013/02/28 12:24:09 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\Leadertech [2013/03/05 22:49:03 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\Media Fairy [2014/01/27 00:47:49 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\MusicLab [2013/11/01 19:06:25 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\PACE Anti-Piracy [2013/03/03 11:56:21 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\player [2013/05/16 18:47:37 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\SpeedyPC Software [2013/03/20 17:30:21 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\SynthMaker [2013/02/27 21:45:54 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\Trillium Lane [2013/04/03 21:38:59 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\TuneUp Software [2014/07/10 14:27:48 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\uTorrent [2014/03/01 21:52:31 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\WinZip [2013/03/18 21:05:31 | 000,000,000 | ---D | M] -- C:\Users\Bina Kakhani\AppData\Roaming\YourFileDownloader [2013/04/05 16:33:54 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\TuneUp Software [2013/04/05 16:33:54 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\TuneUp Software [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Custom Scans ==========[/color] [color=#E56717]========== Base Services ==========[/color] SRV:[b]64bit:[/b] - [2009/07/14 02:40:01 | 000,072,192 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\aelupsvc.dll -- (AeLookupSvc) SRV:[b]64bit:[/b] - [2013/02/27 06:47:10 | 000,070,144 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appinfo.dll -- (Appinfo) SRV:[b]64bit:[/b] - [2009/07/14 02:38:55 | 000,079,360 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\alg.exe -- (ALG) SRV:[b]64bit:[/b] - [2010/11/21 04:23:51 | 000,849,920 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\qmgr.dll -- (BITS) SRV:[b]64bit:[/b] - [2010/11/21 04:24:00 | 000,705,024 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\BFE.DLL -- (BFE) SRV:[b]64bit:[/b] - [2013/09/25 02:03:24 | 000,030,720 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\lsass.exe -- (KeyIso) SRV:[b]64bit:[/b] - [2009/07/14 02:40:50 | 000,402,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\es.dll -- (EventSystem) SRV - [2009/07/14 02:15:19 | 000,271,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\es.dll -- (EventSystem) SRV:[b]64bit:[/b] - [2012/07/04 23:13:27 | 000,136,704 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\browser.dll -- (Browser) SRV:[b]64bit:[/b] - [2013/07/09 06:46:20 | 000,184,320 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\cryptsvc.dll -- (CryptSvc) SRV - [2013/07/09 05:46:31 | 000,140,288 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\cryptsvc.dll -- (CryptSvc) SRV:[b]64bit:[/b] - [2010/11/21 04:24:01 | 000,512,000 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (DcomLaunch) SRV:[b]64bit:[/b] - [2010/11/21 04:24:00 | 000,317,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dhcpcore.dll -- (Dhcp) SRV - [2010/11/21 04:24:09 | 000,254,464 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\dhcpcore.dll -- (Dhcp) SRV:[b]64bit:[/b] - [2011/03/03 07:24:16 | 000,183,296 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dnsrslvr.dll -- (Dnscache) SRV:[b]64bit:[/b] - [2009/07/14 02:40:35 | 000,111,104 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\eapsvc.dll -- (EapHost) SRV:[b]64bit:[/b] - [2009/07/14 02:41:00 | 000,038,912 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\hidserv.dll -- (hidserv) SRV - [2009/07/14 02:15:24 | 000,049,152 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\hidserv.dll -- (hidserv) SRV:[b]64bit:[/b] - [2009/07/14 02:41:10 | 000,359,424 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\ipnathlp.dll -- (SharedAccess) SRV:[b]64bit:[/b] - [2010/11/21 04:23:48 | 000,501,248 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IPSECSVC.DLL -- (PolicyAgent) No service found with a name of MsMpSvc No service found with a name of NisSrv SRV:[b]64bit:[/b] - [2009/07/14 02:41:54 | 000,524,288 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\swprv.dll -- (swprv) SRV:[b]64bit:[/b] - [2009/07/14 02:41:26 | 000,067,584 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\mmcss.dll -- (MMCSS) SRV:[b]64bit:[/b] - [2009/07/14 02:41:52 | 000,360,448 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netman.dll -- (Netman) SRV:[b]64bit:[/b] - [2009/07/14 02:41:52 | 000,459,776 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofm.dll -- (netprofm) SRV - [2009/07/14 02:16:03 | 000,360,448 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\netprofm.dll -- (netprofm) SRV:[b]64bit:[/b] - [2012/10/03 18:44:21 | 000,303,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\nlasvc.dll -- (NlaSvc) SRV:[b]64bit:[/b] - [2009/07/14 02:41:53 | 000,025,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\nsisvc.dll -- (nsi) SRV:[b]64bit:[/b] - [2011/05/24 12:42:55 | 000,404,480 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\umpnpmgr.dll -- (PlugPlay) SRV:[b]64bit:[/b] - [2012/02/11 07:36:02 | 000,559,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\spoolsv.exe -- (Spooler) SRV:[b]64bit:[/b] - [2013/09/25 02:03:24 | 000,030,720 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\lsass.exe -- (ProtectedStorage) No service found with a name of EMDMgmt SRV:[b]64bit:[/b] - [2009/07/14 02:41:53 | 000,099,328 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\rasauto.dll -- (RasAuto) SRV:[b]64bit:[/b] - [2010/11/21 04:24:17 | 000,344,064 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\rasmans.dll -- (RasMan) SRV:[b]64bit:[/b] - [2010/11/21 04:24:01 | 000,512,000 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (RpcSs) SRV:[b]64bit:[/b] - [2010/11/21 04:24:16 | 000,030,720 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\seclogon.dll -- (seclogon) SRV:[b]64bit:[/b] - [2013/09/25 02:03:24 | 000,030,720 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsass.exe -- (SamSs) SRV:[b]64bit:[/b] - [2009/07/14 02:41:58 | 000,097,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wscsvc.dll -- (wscsvc) SRV:[b]64bit:[/b] - [2010/11/21 04:23:48 | 000,236,032 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\srvsvc.dll -- (LanmanServer) SRV:[b]64bit:[/b] - [2010/11/21 04:23:55 | 000,370,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\shsvcs.dll -- (ShellHWDetection) SRV - [2010/11/21 04:24:03 | 000,328,192 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\shsvcs.dll -- (ShellHWDetection) No service found with a name of slsvc SRV:[b]64bit:[/b] - [2010/11/21 04:24:16 | 001,110,016 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\schedsvc.dll -- (Schedule) SRV:[b]64bit:[/b] - [2010/11/21 04:24:32 | 000,316,928 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\tapisrv.dll -- (TapiSrv) SRV - [2010/11/21 04:24:00 | 000,242,176 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\tapisrv.dll -- (TapiSrv) SRV:[b]64bit:[/b] - [2009/07/14 02:41:55 | 000,044,544 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\themeservice.dll -- (Themes) SRV:[b]64bit:[/b] - [2012/05/01 06:40:20 | 000,209,920 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\profsvc.dll -- (ProfSvc) SRV:[b]64bit:[/b] - [2010/11/21 04:23:55 | 001,600,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\VSSVC.exe -- (VSS) SRV:[b]64bit:[/b] - [2010/11/21 04:24:32 | 000,679,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\audiosrv.dll -- (AudioSrv) SRV:[b]64bit:[/b] - [2010/11/21 04:24:32 | 000,679,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\audiosrv.dll -- (AudioEndpointBuilder) SRV:[b]64bit:[/b] - [2010/11/21 04:25:06 | 000,170,496 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\sdrsvc.dll -- (SDRSVC) SRV:[b]64bit:[/b] - [2013/05/27 06:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:[b]64bit:[/b] - [2010/11/21 04:23:55 | 001,646,080 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wevtsvc.dll -- (eventlog) SRV:[b]64bit:[/b] - [2010/11/21 04:24:28 | 000,828,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\MPSSVC.dll -- (MpsSvc) SRV:[b]64bit:[/b] - [2010/11/21 04:24:48 | 000,580,096 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wiaservc.dll -- (stisvc) SRV:[b]64bit:[/b] - [2010/11/21 04:24:15 | 000,128,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\msiexec.exe -- (msiserver) SRV - [2010/11/21 04:24:28 | 000,073,216 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWow64\msiexec.exe -- (msiserver) SRV:[b]64bit:[/b] - [2009/07/14 02:41:56 | 000,242,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wbem\WMIsvc.dll -- (Winmgmt) SRV:[b]64bit:[/b] - [2012/06/02 23:19:43 | 002,428,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wuaueng.dll -- (wuauserv) SRV:[b]64bit:[/b] - [2010/11/21 04:24:09 | 000,252,416 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\dot3svc.dll -- (dot3svc) SRV:[b]64bit:[/b] - [2009/07/14 02:41:56 | 000,886,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wlansvc.dll -- (Wlansvc) SRV:[b]64bit:[/b] - [2010/11/21 04:24:32 | 000,118,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wkssvc.dll -- (LanmanWorkstation) [color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color] [color=#A23BEC]< c:\program files (x86)\Google\Desktop >[/color] [2009/07/14 06:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT [2009/07/14 06:08:49 | 000,032,620 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2014/06/17 18:25:22 | 000,000,906 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job [2014/06/17 18:25:24 | 000,000,910 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job [color=#A23BEC]< c:\program files\Google\Desktop >[/color] [color=#A23BEC]< dir "%systemdrive%\*" /S /A:L /C >[/color] Volume in drive C is System Volume Serial Number is 8254-EDCF Directory of C:\ 14/07/2009 06:08 Documents and Settings [C:\Users] 0 File(s) 0 bytes Directory of C:\Program Files (x86)\Image-Line\FL Studio 10\Data\Patches\Plugin presets\Generators\FPC 05/01/2014 15:38 Downloaded [C:\Users\Bina Kakhani\Documents\Image-Line\Data\fpc\] 0 File(s) 0 bytes Directory of C:\Program Files (x86)\Image-Line\FL Studio 10\Data\Patches\Plugin presets\Generators\Harmor 05/01/2014 15:38 Downloaded [C:\Users\Bina Kakhani\Documents\Image-Line\Data\Harmor\] 0 File(s) 0 bytes Directory of C:\Program Files (x86)\Image-Line\FL Studio 10\Data\Patches\Plugin presets\Generators\Ogun 05/01/2014 15:38 Downloaded [C:\Users\Bina Kakhani\Documents\Image-Line\Data\ogun\] 0 File(s) 0 bytes Directory of C:\Program Files (x86)\Image-Line\FL Studio 10\Data\Patches\Plugin presets\Generators\Sawer 05/01/2014 15:38 Downloaded [C:\Users\Bina Kakhani\Documents\Image-Line\Data\sawer\] 0 File(s) 0 bytes Directory of C:\Program Files (x86)\Image-Line\FL Studio 11\Data\Patches\Plugin presets\Generators\FPC 13/06/2014 17:35 Downloaded [C:\Users\Bina Kakhani\Documents\Image-Line\Data\fpc\] 0 File(s) 0 bytes Directory of C:\Program Files (x86)\Image-Line\FL Studio 11\Data\Patches\Plugin presets\Generators\Harmor 13/06/2014 17:35 Downloaded [C:\Users\Bina Kakhani\Documents\Image-Line\Data\Harmor\] 0 File(s) 0 bytes Directory of C:\Program Files (x86)\Image-Line\FL Studio 11\Data\Patches\Plugin presets\Generators\Ogun 13/06/2014 17:35 Downloaded [C:\Users\Bina Kakhani\Documents\Image-Line\Data\ogun\] 0 File(s) 0 bytes Directory of C:\ProgramData 14/07/2009 06:08 Application Data [C:\ProgramData] 14/07/2009 06:08 Desktop [C:\Users\Public\Desktop] 14/07/2009 06:08 Documents [C:\Users\Public\Documents] 14/07/2009 06:08 Favorites [C:\Users\Public\Favorites] 14/07/2009 06:08 Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu] 14/07/2009 06:08 Templates [C:\ProgramData\Microsoft\Windows\Templates] 0 File(s) 0 bytes Directory of C:\Users 14/07/2009 06:08 All Users [C:\ProgramData] 14/07/2009 06:08 Default User [C:\Users\Default] 0 File(s) 0 bytes Directory of C:\Users\All Users 14/07/2009 06:08 Application Data [C:\ProgramData] 14/07/2009 06:08 Desktop [C:\Users\Public\Desktop] 14/07/2009 06:08 Documents [C:\Users\Public\Documents] 14/07/2009 06:08 Favorites [C:\Users\Public\Favorites] 14/07/2009 06:08 Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu] 14/07/2009 06:08 Templates [C:\ProgramData\Microsoft\Windows\Templates] 0 File(s) 0 bytes Directory of C:\Users\Bina Kakhani 27/02/2013 15:45 Application Data [C:\Users\Bina Kakhani\AppData\Roaming] 27/02/2013 15:45 Cookies [C:\Users\Bina Kakhani\AppData\Roaming\Microsoft\Windows\Cookies] 27/02/2013 15:45 Local Settings [C:\Users\Bina Kakhani\AppData\Local] 27/02/2013 15:45 My Documents [C:\Users\Bina Kakhani\Documents] 27/02/2013 15:45 NetHood [C:\Users\Bina Kakhani\AppData\Roaming\Microsoft\Windows\Network Shortcuts] 27/02/2013 15:45 PrintHood [C:\Users\Bina Kakhani\AppData\Roaming\Microsoft\Windows\Printer Shortcuts] 27/02/2013 15:45 Recent [C:\Users\Bina Kakhani\AppData\Roaming\Microsoft\Windows\Recent] 27/02/2013 15:45 SendTo [C:\Users\Bina Kakhani\AppData\Roaming\Microsoft\Windows\SendTo] 27/02/2013 15:45 Start Menu [C:\Users\Bina Kakhani\AppData\Roaming\Microsoft\Windows\Start Menu] 27/02/2013 15:45 Templates [C:\Users\Bina Kakhani\AppData\Roaming\Microsoft\Windows\Templates] 0 File(s) 0 bytes Directory of C:\Users\Bina Kakhani\AppData\Local 27/02/2013 15:45 Application Data [C:\Users\Bina Kakhani\AppData\Local] 27/02/2013 15:45 History [C:\Users\Bina Kakhani\AppData\Local\Microsoft\Windows\History] 27/02/2013 15:45 Temporary Internet Files [C:\Users\Bina Kakhani\AppData\Local\Microsoft\Windows\Temporary Internet Files] 0 File(s) 0 bytes Directory of C:\Users\Bina Kakhani\Documents 27/02/2013 15:45 My Music [C:\Users\Bina Kakhani\Music] 27/02/2013 15:45 My Pictures [C:\Users\Bina Kakhani\Pictures] 27/02/2013 15:45 My Videos [C:\Users\Bina Kakhani\Videos] 0 File(s) 0 bytes Directory of C:\Users\Default 14/07/2009 06:08 Application Data [C:\Users\Default\AppData\Roaming] 14/07/2009 06:08 Cookies [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies] 14/07/2009 06:08 Local Settings [C:\Users\Default\AppData\Local] 14/07/2009 06:08 My Documents [C:\Users\Default\Documents] 14/07/2009 06:08 NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts] 14/07/2009 06:08 PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts] 14/07/2009 06:08 Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent] 14/07/2009 06:08 SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo] 14/07/2009 06:08 Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu] 14/07/2009 06:08 Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates] 0 File(s) 0 bytes Directory of C:\Users\Default\AppData\Local 14/07/2009 06:08 Application Data [C:\Users\Default\AppData\Local] 14/07/2009 06:08 History [C:\Users\Default\AppData\Local\Microsoft\Windows\History] 14/07/2009 06:08 Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files] 0 File(s) 0 bytes Directory of C:\Users\Default\Documents 14/07/2009 06:08 My Music [C:\Users\Default\Music] 14/07/2009 06:08 My Pictures [C:\Users\Default\Pictures] 14/07/2009 06:08 My Videos [C:\Users\Default\Videos] 0 File(s) 0 bytes Directory of C:\Users\Public\Documents 14/07/2009 06:08 My Music [C:\Users\Public\Music] 14/07/2009 06:08 My Pictures [C:\Users\Public\Pictures] 14/07/2009 06:08 My Videos [C:\Users\Public\Videos] 0 File(s) 0 bytes Total Files Listed: 0 File(s) 0 bytes 57 Dir(s) 139,013,898,240 bytes free [color=#A23BEC]< MD5 for: RPCSS.DLL >[/color] [2010/11/21 04:24:01 | 000,512,000 | ---- | M] (Microsoft Corporation) MD5=5C627D1B1138676C0A7AB2C2C190D123 -- C:\Windows\SysNative\rpcss.dll [2010/11/21 04:24:01 | 000,512,000 | ---- | M] (Microsoft Corporation) MD5=5C627D1B1138676C0A7AB2C2C190D123 -- C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_c7f0e16b547f887d\rpcss.dll [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 943 bytes -> C:\ProgramData\Microsoft:dVmF1d7k8E1RTdbILoPsEB @Alternate Data Stream - 1164 bytes -> C:\Users\Bina Kakhani\AppData\Local\1K5WtF1T2rUA:OFjHVihjr2JdFG1DCiUryV2aXp @Alternate Data Stream - 1149 bytes -> C:\ProgramData\Microsoft:MLKXbfNcpxmfoZ25nUCTFTqP8Jy @Alternate Data Stream - 1142 bytes -> C:\ProgramData\Microsoft:wHn07KUIphgrLvXG4kWXPB1PW @Alternate Data Stream - 1135 bytes -> C:\ProgramData\Microsoft:Jucn11KnLDwgzhMTCj7MJFrT @Alternate Data Stream - 1111 bytes -> C:\Users\Bina Kakhani\AppData\Local\U5xd1uYgu9vP:pPjbfYWAQ7a3k8R4bFmG31aWF @Alternate Data Stream - 1071 bytes -> C:\Users\Bina Kakhani\AppData\Local\Temp:sM5d4z9Caz40Ls9nSHsOEAWG @Alternate Data Stream - 1063 bytes -> C:\ProgramData\Microsoft:gcouDhXOgse6Z4OjxjamaDPl8Qe @Alternate Data Stream - 1056 bytes -> C:\ProgramData\Microsoft:PqBZ662uDQBs8gqjk9 @Alternate Data Stream - 1054 bytes -> C:\ProgramData\Microsoft:tC91BBZrlU3XWseiw6xZC @Alternate Data Stream - 1050 bytes -> C:\ProgramData\Microsoft:h6QVyubS31FFCixfpAo < End of report >