OTL
OTL logfile created on: 8/23/2012 6:08:02 PM - Run 1
OTL by OldTimer - Version 3.2.58.1 Folder = C:\Users\Mel\Desktop
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
1.96 Gb Total Physical Memory | 0.66 Gb Available Physical Memory | 33.50% Memory free
3.92 Gb Paging File | 2.50 Gb Available in Paging File | 63.66% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 87.11 Gb Total Space | 50.27 Gb Free Space | 57.71% Space Free | Partition Type: NTFS
Drive D: | 130.67 Gb Total Space | 128.38 Gb Free Space | 98.24% Space Free | Partition Type: NTFS
Computer Name: MEL-PC | User Name: Mel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2012/08/22 09:09:54 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Mel\Desktop\OTL.exe
PRC - [2012/08/21 18:18:54 | 000,307,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
PRC - [2012/07/29 20:52:22 | 000,976,728 | ---- | M] (Trusteer Ltd.) -- C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
PRC - [2012/07/29 20:52:20 | 001,673,048 | ---- | M] (Trusteer Ltd.) -- C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
PRC - [2012/07/27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/03/26 17:08:12 | 000,931,200 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2011/08/18 17:03:02 | 000,284,512 | ---- | M] () -- C:\Program Files\Common Files\Iconix\IconixService.exe
PRC - [2011/03/07 12:21:00 | 000,107,008 | ---- | M] (Eastman Kodak Company) -- C:\Program Files\Kodak\KODAK Share Button App\Listener.exe
PRC - [2011/02/26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011/02/25 10:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE
PRC - [2010/10/27 19:17:52 | 000,207,424 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
PRC - [2010/04/20 14:26:44 | 000,300,912 | ---- | M] () -- C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe
PRC - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2010/01/19 11:34:48 | 002,201,192 | ---- | M] (SEC) -- C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
PRC - [2009/12/07 12:50:54 | 001,069,568 | ---- | M] (Alcatel-Lucent) -- C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe
PRC - [2009/12/07 12:50:52 | 001,584,640 | ---- | M] (Alcatel-Lucent) -- C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe
PRC - [2009/11/04 05:11:48 | 000,835,072 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
PRC - [2009/10/26 12:53:14 | 000,091,136 | ---- | M] (SAMSUNG Electronics) -- C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
PRC - [2009/10/13 11:03:04 | 000,716,800 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
PRC - [2009/08/13 21:58:10 | 000,044,312 | ---- | M] () -- C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
PRC - [2009/07/14 02:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/06/03 12:59:02 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2009/04/15 15:52:06 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
========== Modules (No Company Name) ==========
MOD - [2012/05/28 21:43:53 | 000,520,464 | ---- | M] () -- C:\ProgramData\Trusteer\Rapport\store\exts\RapportMS\39624\RapportMS.dll
MOD - [2012/02/01 14:43:10 | 000,557,056 | ---- | M] () -- C:\Program Files\Trusteer\Rapport\bin\js32.dll
MOD - [2010/04/20 14:26:44 | 000,300,912 | ---- | M] () -- C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe
MOD - [2010/04/16 14:11:02 | 000,155,648 | ---- | M] () -- C:\Program Files\Samsung\Samsung Update Plus\HMXML.dll
MOD - [2009/06/03 12:59:14 | 000,013,096 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll
MOD - [2009/06/03 12:59:02 | 000,619,816 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll
MOD - [2006/08/12 04:48:40 | 000,049,152 | ---- | M] () -- C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll
========== Win32 Services (SafeList) ==========
SRV - [2012/08/22 18:11:56 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/29 20:52:22 | 000,976,728 | ---- | M] (Trusteer Ltd.) [Auto | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe -- (RapportMgmtService)
SRV - [2012/07/27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/03/26 17:03:40 | 000,214,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012/02/15 14:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011/08/18 17:03:02 | 000,284,512 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\Iconix\IconixService.exe -- (IconixService)
SRV - [2011/02/28 18:44:14 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/02/25 10:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2010/07/13 18:01:42 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/08/13 21:58:10 | 000,044,312 | ---- | M] () [Auto | Running] -- C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe -- (OberonGameConsoleService)
SRV - [2009/07/14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS -- (MRESP50a64)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS -- (MRENDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS -- (MREMPR5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS -- (MREMP50a64)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Mel\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2012/08/22 21:28:54 | 000,029,904 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F072BA30-CED3-4349-8E6A-C90D1E18171B}\MpKsl0a77de59.sys -- (MpKsl0a77de59)
DRV - [2012/08/06 16:09:46 | 000,228,376 | ---- | M] () [Kernel | System | Running] -- C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_42020.sys -- (RapportCerberus_42020)
DRV - [2012/07/29 20:52:38 | 000,166,840 | ---- | M] (Trusteer Ltd.) [Kernel | System | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys -- (RapportPG)
DRV - [2012/07/29 20:52:38 | 000,071,480 | ---- | M] (Trusteer Ltd.) [Kernel | System | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys -- (RapportEI)
DRV - [2012/07/29 20:52:38 | 000,065,848 | ---- | M] (Trusteer Ltd.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\RapportKELL.sys -- (RapportKELL)
DRV - [2012/05/28 21:43:53 | 000,021,520 | ---- | M] (Trusteer Ltd.) [Kernel | On_Demand | Running] -- c:\ProgramData\Trusteer\Rapport\store\exts\RapportMS\39624\RapportIaso.sys -- (RapportIaso)
DRV - [2012/03/20 20:44:12 | 000,074,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2011/05/26 16:03:56 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
DRV - [2011/05/26 16:03:50 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
DRV - [2010/11/23 18:10:44 | 001,249,792 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009/09/28 10:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009/07/14 00:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/07/10 14:44:52 | 000,122,880 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService)
DRV - [2009/05/01 15:41:06 | 000,384,896 | ---- | M] (Phoenix Technologies Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CryptOSD.sys -- (CryptOSD)
DRV - [2005/08/17 08:46:26 | 000,093,872 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm)
DRV - [2005/08/17 08:46:20 | 000,008,272 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl)
DRV - [2005/08/17 08:45:00 | 000,058,352 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" =
http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" =
http://www.google.com/search?source...nputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" =
http://www.google.com/search?q={sea...putEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://bt.yahoo.com
IE - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" =
http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\..\SearchScopes\{43886E28-D02F-4033-BCC4-8726ECC4E733}: "URL" =
http://uk.news.search.yahoo.com/search/news?ei=UTF-8&p={searchTerms}&fr=yessv
IE - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\..\SearchScopes\{522C795D-7BDA-4D84-97CD-C320365EF868}: "URL" =
http://uk.search.yahoo.com/search/audio?ei=UTF-8&p={searchTerms}&fr=yessv
IE - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" =
http://www.google.com/search?source...nputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
IE - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" =
http://www.google.com/search?q={sea...coding}&sourceid=ie7&rlz=1I7SMSN_enGB388GB388
IE - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\..\SearchScopes\{6CFE568E-E7CB-435B-B49C-4190EE95686A}: "URL" =
http://uk.search.yahoo.com/search/video?ei=UTF-8&p={searchTerms}&fr=yessv
IE - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\..\SearchScopes\{7E02B1C0-6039-4060-AD14-E13EFF9CB04F}: "URL" =
http://uk.search.yahoo.com/search?fr=mcafee&p={SearchTerms}
IE - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\..\SearchScopes\{847AC258-8706-4960-8570-0D4BA486ED8D}: "URL" =
http://uk.local.yahoo.com/search.ht...w=uctid,fw,belongto&type=GugiXML&cs=&fr=yessv
IE - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\..\SearchScopes\{BDBDF478-9023-4271-8912-6A7F26995F62}: "URL" =
http://uk.search.yahoo.com/search/dir?ei=UTF-8&p={searchTerms}&fr=yessv
IE - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\..\SearchScopes\{BF8C4D74-7EF8-4879-86E7-489CE4F63C63}: "URL" =
http://shopping.yahoo.co.uk/ctl/do/search?catId=100164013&siteSearchQuery={searchTerms}&fr=yessv
IE - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" =
http://uk.search.yahoo.com/search?p={searchTerms}&fr=yessv
IE - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\..\SearchScopes\{E7A58AD5-4ECD-4CF0-ADE6-E938BA3FE019}: "URL" =
http://uk.search.yahoo.com/search/images?ei=UTF-8&p={searchTerms}&fr=yessv
IE - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Motive, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
[2010/12/20 11:50:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mel\AppData\Roaming\Mozilla\Extensions
[2010/09/05 21:16:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mel\AppData\Roaming\Mozilla\Extensions\
mozswing@mozswing.org
[2010/12/20 11:50:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mel\AppData\Roaming\Mozilla\Firefox\Profiles\iv4dkxa0.default\extensions
[2010/12/20 11:50:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/12/03 18:47:02 | 000,001,538 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2010/12/03 18:47:02 | 000,000,947 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2010/12/03 18:47:02 | 000,000,769 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2010/12/20 11:50:35 | 000,002,027 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\McSiteAdvisor.xml
[2010/12/03 18:47:02 | 000,001,135 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml
O1 HOSTS File: ([2012/08/21 18:11:34 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (IconixBHOClass Class) - {761233B6-F228-49E4-8F6B-668499D4E55A} - C:\Program Files\Iconix\IEAddOn\IconixBHO_46.dll ()
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (no name) - AutorunsDisabled - No CLSID value found.
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [APLangApp] C:\Program Files\AnyPC Client\APLangApp.exe (DoctorSoft)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [btbb_McciTrayApp] C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe (Alcatel-Lucent)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [IconixOEAddOn] C:\Program Files\Iconix\OEAddOn\OEdmn_6.exe ()
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDRShortCut] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Email ID Preferences - {400A6CFA-E326-4d61-A90C-9AD75358DC5F} - C:\Program Files\Iconix\IEAddOn\IconixBHO_46.dll ()
O9 - Extra 'Tools' menuitem : About Email ID - {BC3F6B6D-2E49-4603-B028-7411655713F3} - C:\Program Files\Iconix\IEAddOn\IconixBHO_46.dll ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-1871111397-3539990770-1974983793-1001\..Trusted Domains: motive.com ([pbttbc.bt] https in Trusted sites)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {A9CF3378-D60E-40A8-927D-7EA0D5B0AA98}
http://webalbum.bonusprint.com/ukipc01/downloads//ImageUploader6.cab (Bonusprint Image Uploader Version 6.x Control)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F}
http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.4.24.0.cab (SysInfo Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AB1A6510-6BFF-4E19-8463-AD2024FD9CBE}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\AutorunsDisabled - No CLSID value found
O18 - Protocol\Handler\AutorunsDisabled\dssrequest - No CLSID value found
O18 - Protocol\Handler\AutorunsDisabled\sacore - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2012/08/23 17:52:29 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{66000A6D-0923-47DF-971A-2229C33D7EBF}
[2012/08/22 21:24:07 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Roaming\Malwarebytes
[2012/08/22 21:23:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/08/22 21:23:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/08/22 21:23:44 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2012/08/22 21:23:44 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/08/22 20:39:46 | 000,000,000 | -HSD | C] -- C:\found.000
[2012/08/22 17:54:29 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{171665ED-FFBF-4D73-9639-68D6AFF5D024}
[2012/08/22 17:43:19 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Mel\Desktop\OTL.exe
[2012/08/22 17:43:14 | 010,651,816 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Mel\Desktop\mbam-setup.exe
[2012/08/21 18:11:40 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2012/08/21 18:09:54 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\temp
[2012/08/21 18:09:53 | 000,000,000 | ---D | C] -- C:\windows\temp
[2012/08/21 17:52:40 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe
[2012/08/21 17:52:40 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe
[2012/08/21 17:52:40 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe
[2012/08/21 17:52:25 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/08/21 17:51:53 | 000,000,000 | ---D | C] -- C:\windows\erdnt
[2012/08/21 17:51:17 | 004,734,695 | R--- | C] (Swearware) -- C:\Users\Mel\Desktop\ComboFix.exe
[2012/08/21 03:09:24 | 000,000,000 | ---D | C] -- C:\FRST
[2012/08/18 17:40:26 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{9EDDD808-7CB9-4CE9-B0D4-A19E111F9833}
[2012/08/15 15:16:33 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{7E69D2FF-EA9B-47E6-8605-87BC74A6ED6A}
[2012/08/15 15:16:20 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{52D25E40-A136-4855-B7CA-1FEB1273A206}
[2012/08/15 10:57:49 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{D0620B7A-1CB8-43BD-93A1-2C0CFD9A4883}
[2012/08/15 10:57:35 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{D522BDEE-A7C6-40DE-A602-5CE2539E021D}
[2012/08/12 15:32:55 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{7A6742B0-DA40-4A5E-AC14-25737354EB67}
[2012/08/11 18:45:10 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2012/08/11 18:42:15 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2012/08/11 18:30:03 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{3E821C8F-3217-468B-9898-429F78036245}
[2012/08/11 18:29:52 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{E42A0B2C-F8FC-4C24-91E0-EE51A7B0CE37}
[2012/08/08 19:09:08 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{0605136C-1995-4F60-A3C1-63C068BED8E1}
[2012/08/08 19:08:58 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{8988A371-26D4-4299-9259-7EF35AFBEAF6}
[2012/08/08 06:30:13 | 000,214,024 | ---- | C] (McAfee, Inc.) -- C:\windows\System32\drivers\mfehidk.sys
[2012/08/08 06:30:13 | 000,130,424 | ---- | C] (McAfee, Inc.) -- C:\windows\System32\drivers\Mpfp.sys
[2012/08/08 06:30:13 | 000,079,816 | ---- | C] (McAfee, Inc.) -- C:\windows\System32\drivers\mfeavfk.sys
[2012/08/08 06:30:13 | 000,040,552 | ---- | C] (McAfee, Inc.) -- C:\windows\System32\drivers\mfesmfk.sys
[2012/08/08 06:30:13 | 000,035,272 | ---- | C] (McAfee, Inc.) -- C:\windows\System32\drivers\mfebopk.sys
[2012/08/08 06:30:13 | 000,034,248 | ---- | C] (McAfee, Inc.) -- C:\windows\System32\drivers\mferkdk.sys
[2012/08/07 22:22:39 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{3CCE868C-5FB5-421D-AC62-FEA8290E6243}
[2012/08/07 22:22:28 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{FDFC5DA6-6917-4571-8B04-3304E7D987B2}
[2012/08/07 21:04:19 | 000,000,000 | -HSD | C] -- C:\windows\System32\%APPDATA%
[2012/08/07 20:56:46 | 000,000,000 | ---D | C] -- C:\ProgramData\036DFF850000FF06004D32F64F147CE7
[2012/08/07 08:57:40 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{27123C62-4A4B-40AE-A356-D16A2A357FDE}
[2012/08/06 20:57:11 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{6D6A9B99-6234-45AD-B8D1-575C7A22C5F9}
[2012/08/06 20:56:58 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{64418CBB-227E-4282-B646-313398979A80}
[2012/08/06 08:56:16 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{4FC74F45-2EB3-46A5-8FE7-6DEB631D85D3}
[2012/08/05 20:34:49 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{9679A6B6-C828-45DE-AE36-DC64949FAC40}
[2012/08/05 08:34:09 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{AB77FA79-40B5-4A07-8E4B-B88B78D7E0F8}
[2012/08/04 10:29:13 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{5DE75AE3-B854-4252-90AC-125C5C3EB94F}
[2012/08/03 22:28:48 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{2D539DEC-8065-4B85-AB66-9A4DF6ED8D35}
[2012/08/03 10:28:17 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{CCE6FD3E-C061-4A46-995A-9EAF265937B4}
[2012/08/02 21:47:20 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{ED5F06D2-8712-4357-BCB5-C78C07B12F1E}
[2012/08/02 09:46:51 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{71D83874-15B8-4F49-8838-92149D59EA93}
[2012/08/01 21:46:20 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{185CE77A-F548-43C1-9302-07188B0E0088}
[2012/08/01 13:27:52 | 000,643,696 | ---- | C] (Sysinternals -
www.sysinternals.com) -- C:\Users\Mel\Desktop\autoruns.exe
[2012/08/01 09:41:04 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{CA116D98-48A2-4B88-98D6-E4362161E6A7}
[2012/07/31 21:29:30 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{A84E0210-60F7-46BD-9B59-676D20EBFDD2}
[2012/07/31 21:29:11 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{52409671-594E-450E-87DA-A22C7DE94F97}
[2012/07/31 09:09:13 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{A1FFD0F4-8583-48B5-845E-9CD62C0C48D1}
[2012/07/30 20:42:37 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{F31E2C86-7902-4247-B3E3-051747A6E553}
[2012/07/30 20:42:24 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{B038AF1B-C3BF-434A-B36D-7FA6EB170692}
[2012/07/30 08:36:01 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{079D706C-E7EE-4002-AEA6-6FA7EE6FB5E9}
[2012/07/29 20:52:38 | 000,065,848 | ---- | C] (Trusteer Ltd.) -- C:\windows\System32\drivers\RapportKELL.sys
[2012/07/29 20:00:54 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{CEA00740-452F-4534-885C-4D342A1A49B7}
[2012/07/29 20:00:41 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{F14ADDFE-B98B-4B9F-8AF9-2A6FBA6C83EB}
[2012/07/29 07:55:19 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{003C5020-531A-477B-BAEC-FFA66DADB2E3}
[2012/07/28 18:54:08 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{BDD7539D-0E82-4B42-A574-619DF5612C8C}
[2012/07/28 18:53:57 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{1CDB025F-A542-48A8-B380-B4177D4BEFFB}
[2012/07/28 06:53:29 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{CAD33808-96C4-491F-991E-43850F2BFC23}
[2012/07/28 06:53:18 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{F9270D9F-07EB-4EA2-B0BF-6FD46C2258EE}
[2012/07/27 14:40:17 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{3F8A4562-1289-4CFF-A494-3210220516B4}
[2012/07/26 21:47:51 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{7670DACB-DAFE-4C27-8324-FCF515F11286}
[2012/07/26 09:32:25 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{04433229-71E0-4476-A33E-590BA1054AB9}
[2012/07/25 20:29:04 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{38C4050A-376A-411F-A794-63E079EA4E7F}
[2012/07/25 06:19:39 | 000,000,000 | ---D | C] -- C:\Users\Mel\AppData\Local\{5F144EDA-EBDC-4B72-A3A4-E18C433E94D2}
========== Files - Modified Within 30 Days ==========
[2012/08/23 18:12:02 | 000,000,886 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/08/23 18:11:01 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012/08/23 18:02:31 | 000,002,127 | ---- | M] () -- C:\windows\epplauncher.mif
[2012/08/23 17:59:41 | 000,014,736 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/23 17:59:41 | 000,014,736 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/23 17:51:33 | 000,000,882 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/23 17:50:58 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012/08/23 17:50:52 | 1579,630,592 | -HS- | M] () -- C:\hiberfil.sys
[2012/08/22 21:20:15 | 000,003,672 | ---- | M] () -- C:\bootsqm.dat
[2012/08/22 17:59:23 | 000,007,601 | ---- | M] () -- C:\Users\Mel\AppData\Local\Resmon.ResmonCfg
[2012/08/22 17:46:48 | 000,537,139 | ---- | M] () -- C:\Users\Mel\Desktop\Autoruns.zip
[2012/08/22 09:09:54 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Mel\Desktop\OTL.exe
[2012/08/22 07:35:26 | 000,002,290 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012/08/21 18:11:34 | 000,000,027 | ---- | M] () -- C:\windows\System32\drivers\etc\hosts
[2012/08/21 08:53:32 | 004,734,695 | R--- | M] (Swearware) -- C:\Users\Mel\Desktop\ComboFix.exe
[2012/08/19 18:31:54 | 010,651,816 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Mel\Desktop\mbam-setup.exe
[2012/08/11 18:45:14 | 000,618,222 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012/08/11 18:45:14 | 000,107,502 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012/08/07 22:13:17 | 000,072,268 | ---- | M] () -- C:\Users\Mel\procexp.chm
[2012/08/07 22:12:49 | 000,049,648 | ---- | M] () -- C:\Users\Mel\autoruns.chm
[2012/08/01 13:27:52 | 000,643,696 | ---- | M] (Sysinternals -
www.sysinternals.com) -- C:\Users\Mel\Desktop\autoruns.exe
[2012/07/29 20:52:38 | 000,065,848 | ---- | M] (Trusteer Ltd.) -- C:\windows\System32\drivers\RapportKELL.sys
========== Files Created - No Company Name ==========
[2012/08/22 21:20:15 | 000,003,672 | ---- | C] () -- C:\bootsqm.dat
[2012/08/22 17:59:23 | 000,007,601 | ---- | C] () -- C:\Users\Mel\AppData\Local\Resmon.ResmonCfg
[2012/08/22 17:48:03 | 000,537,139 | ---- | C] () -- C:\Users\Mel\Desktop\Autoruns.zip
[2012/08/21 17:52:40 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe
[2012/08/21 17:52:40 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe
[2012/08/21 17:52:40 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe
[2012/08/21 17:52:40 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe
[2012/08/21 17:52:40 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe
[2012/08/11 18:45:16 | 000,001,915 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2011/11/05 13:52:32 | 000,049,648 | ---- | C] () -- C:\Users\Mel\autoruns.chm
[2011/03/15 22:30:00 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/03/24 11:09:04 | 000,072,268 | ---- | C] () -- C:\Users\Mel\procexp.chm
========== LOP Check ==========
[2010/10/09 10:20:00 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\Trusteer
[2010/10/09 10:20:00 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\Trusteer
[2011/03/10 09:36:25 | 000,000,000 | ---D | M] -- C:\Users\Mel\AppData\Roaming\Iconix
[2011/08/22 12:15:43 | 000,000,000 | ---D | M] -- C:\Users\Mel\AppData\Roaming\Skinux
[2010/07/13 16:01:14 | 000,000,000 | ---D | M] -- C:\Users\Mel\AppData\Roaming\Trusteer
[2010/11/08 15:35:31 | 000,000,000 | ---D | M] -- C:\Users\Mel\AppData\Roaming\Windows Live Writer
[2012/08/11 19:28:52 | 000,032,620 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:E1F04E8D
< End of report >