Solved 0i763f66bz.exe

M

Meian

Posts: 11   +0
Hello

I recently started noticing something strange when my Microsoft Security Essentials was informing me it wasn't an installed service. The same occurred with Windows Firewall. Next thing I noticed was hearing random sounds being played in the background at random times. The sounds consisted of old asian flute music to weight loss ads.

I had run Malwarebytes and found a few things as shown here:
malware1Edit.png

but the problems persisted after removing them.

Searching through Task Manager I found 0i763f66bz.exe being run, something that did not seem normal to me. I found where it was located and tried to delete it but with no success.

I run Win 7 64 bit, not sure what other information I should bring up.
 
Welcome aboard
yahooo.gif


Please, observe following rules:
  • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
  • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
  • Please refrain from running tools or applying updates other than those I suggest.
  • Never run more than one scan at a time.
  • Keep updating me regarding your computer behavior, good, or bad.
  • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
  • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
  • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

==============================================

For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:
  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

    • Startup Repair
      System Restore
      Windows Complete PC Restore
      Windows Memory Diagnostic Tool
      Command Prompt
  • Select Command Prompt
  • In the command window type in notepad and press Enter.
  • The notepad opens. Under File menu select Open.
  • Select "Computer" and find your flash drive letter and close the notepad.
  • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
 
Thanks for taking the time to help me out. Here is the txt you requested:

Scan result of Farbar Recovery Scan Tool Version: 03-07-2012 01
Ran by SYSTEM at 03-07-2012 18:13:02
Running from F:\
Windows 7 Home Premium (X64) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1271168 2012-03-26] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49152 2006-12-10] (Hewlett-Packard Co.)
HKLM-x32\...\Run: [PWRISOVM.EXE] "C:\Program Files (x86)\PowerISO\PWRISOVM.EXE" [180224 2010-04-12] (PowerISO Computing, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe" [40368 2011-08-30] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [TkBellExe] "C:\Program Files (x86)\real\realplayer\update\realsched.exe" -osboot [273528 2011-11-08] (RealNetworks, Inc.)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2012-02-20] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2011-10-24] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2012-03-27] (Apple Inc.)
HKLM-x32\...\Run: [Regedit32] C:\Windows\system32\regedit.exe [x]
HKU\Carlos\...\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe [163328 2010-11-20] (Microsoft Corporation)
HKU\Carlos\...\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKU\Carlos\...\Run: [0i763f66bz] C:\Users\Carlos\0i763f66bz.exe [40960 2012-06-22] (SmoothCandle)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

==================== Services (Whitelisted) ======

3 getPlusHelper; C:\Program Files (x86)\NOS\bin\getPlus_Helper.dll [67360 2010-02-19] (NOS Microsystems Ltd.)
4 NetTcpPortSharing; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
2 RalinkRegistryWriter; "C:\Program Files (x86)\Belkin\F9L1103\v1\Common\RaRegistry.exe" [374112 2011-11-22] (Ralink Technology, Corp.)
2 RalinkRegistryWriter64; "C:\Program Files (x86)\Belkin\F9L1103\v1\Common\RaRegistry64.exe" [451936 2011-11-22] (Ralink Technology, Corp.)
2 TabletServiceWacom; C:\Windows\system32\Wacom_Tablet.exe [5521192 2009-11-24] (Wacom Technology, Corp.)

========================== Drivers (Whitelisted) =============

0 7f06e87cd967bf44; C:\Windows\System32\Drivers\7f06e87cd967bf44.sys [74184 2012-06-23] ()
2 cpuz133; \??\C:\Windows\system32\drivers\cpuz133_x64.sys [20968 2010-03-30] (Windows (R) Win 7 DDK provider)
3 hamachi; C:\Windows\System32\Drivers\hamachi.sys [33344 2009-07-28] (LogMeIn, Inc.)
2 inpoutx64; C:\Windows\System32\Drivers\inpoutx64.sys [15008 2012-05-21] (Highresolution Enterprises [www.highrez.co.uk])
3 netr28ux; C:\Windows\System32\Drivers\netr28ux.sys [1675840 2011-12-16] (Ralink Technology Corp.)
3 prwntdrv; \??\C:\Windows\system32\prwntdrv.sys [16776 2010-08-25] ()
4 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-03-10] (Duplex Secure Ltd.)

========================== NetSvcs (Whitelisted) ===========


============ One Month Created Files and Folders ==============

2012-07-03 18:12 - 2012-07-03 18:13 - 00000000 ____D C:\FRST
2012-07-03 13:51 - 2012-07-03 13:51 - 01431259 ____A C:\Users\Carlos\Downloads\FRST64.exe
2012-07-03 06:56 - 2012-07-03 06:56 - 00000000 ____D C:\Users\Carlos\AppData\Local\{50A56ABD-182E-41F9-A468-A8AAEA3C46B8}
2012-07-03 06:56 - 2012-07-03 06:56 - 00000000 ____D C:\Users\Carlos\AppData\Local\{0CCD1172-2775-47A0-8BA1-B5D958C7D2F5}
2012-07-02 18:52 - 2012-07-02 18:52 - 00000000 ____D C:\Users\Carlos\AppData\Local\{FB9406C0-5ED3-4600-B4AB-CEDDAD7F32C7}
2012-07-02 18:52 - 2012-07-02 18:52 - 00000000 ____D C:\Users\Carlos\AppData\Local\{A3A479C8-DE3B-4CBD-8256-24E2D18E7C03}
2012-07-02 09:20 - 2012-07-02 09:21 - 00000000 ____D C:\Windows\erdnt
2012-07-02 09:20 - 2012-07-02 09:21 - 00000000 ____D C:\Qoobox
2012-07-02 06:52 - 2012-07-02 06:52 - 00000000 ____D C:\Users\Carlos\AppData\Local\{A7A1CE4D-0BC7-42B7-8785-EF0C64F0D8DD}
2012-07-02 06:51 - 2012-07-02 06:52 - 00000000 ____D C:\Users\Carlos\AppData\Local\{0BB7AC93-42F7-4DC1-B8CC-6064DC8356CD}
2012-07-01 18:51 - 2012-07-01 18:51 - 00000000 ____D C:\Users\Carlos\AppData\Local\{C5BFECCE-17B3-4CF7-8013-0AA59E8761BF}
2012-07-01 18:51 - 2012-07-01 18:51 - 00000000 ____D C:\Users\Carlos\AppData\Local\{7C9DA5E3-96A7-4261-AA35-CA096A6F5294}
2012-07-01 06:50 - 2012-07-01 06:51 - 00000000 ____D C:\Users\Carlos\AppData\Local\{D0D6AF60-E3E0-44F2-AC6B-3ABECB50CD04}
2012-07-01 06:50 - 2012-07-01 06:50 - 00000000 ____D C:\Users\Carlos\AppData\Local\{CFF61F80-79D7-4FEE-8B7F-7E0B84973207}
2012-06-30 18:27 - 2012-06-30 18:27 - 00000000 ____D C:\Users\Carlos\AppData\Local\{061C8D3B-C540-47DD-900D-B8BD3EACEDD8}
2012-06-30 18:27 - 2012-06-30 18:27 - 00000000 ____D C:\Users\Carlos\AppData\Local\{050238AC-665C-44C9-8141-55109AF8FFB2}
2012-06-30 06:27 - 2012-06-30 06:27 - 00000000 ____D C:\Users\Carlos\AppData\Local\{846DDCB7-FCBF-440F-B526-6C383D81215C}
2012-06-30 06:27 - 2012-06-30 06:27 - 00000000 ____D C:\Users\Carlos\AppData\Local\{78AD8AAC-B6D4-4DAA-95DB-CA28C6AEE0BF}
2012-06-29 18:26 - 2012-06-29 18:26 - 00000000 ____D C:\Users\Carlos\AppData\Local\{B1AE387A-D42E-47FC-84BB-07B9B8E91045}
2012-06-29 18:26 - 2012-06-29 18:26 - 00000000 ____D C:\Users\Carlos\AppData\Local\{1DEBABCC-0645-4218-BF46-3955BF7C738A}
2012-06-29 06:26 - 2012-06-29 06:26 - 00000000 ____D C:\Users\Carlos\AppData\Local\{3D4F756E-CACC-46FF-BE90-F4300188908C}
2012-06-29 06:25 - 2012-06-29 06:26 - 00000000 ____D C:\Users\Carlos\AppData\Local\{E17F65C7-EE4C-458E-9BA8-F428F1F0E913}
2012-06-28 18:25 - 2012-06-28 18:25 - 00000000 ____D C:\Users\Carlos\AppData\Local\{A596E329-FE68-4FC1-8FDF-5117AD6CAE8F}
2012-06-28 18:25 - 2012-06-28 18:25 - 00000000 ____D C:\Users\Carlos\AppData\Local\{395AE415-FB10-4959-BDBE-DB2F68854D93}
2012-06-28 06:24 - 2012-06-28 06:25 - 00000000 ____D C:\Users\Carlos\AppData\Local\{4194A6D9-EE63-48D6-BBB9-A1853634875D}
2012-06-28 06:24 - 2012-06-28 06:24 - 00000000 ____D C:\Users\Carlos\AppData\Local\{5D5CC49C-5347-4E68-B14A-8B6F8A64E598}
2012-06-27 18:23 - 2012-06-27 18:24 - 00000000 ____D C:\Users\Carlos\AppData\Local\{98D721EC-CD19-4939-A570-DE56507CC399}
2012-06-27 06:23 - 2012-06-27 06:23 - 00000000 ____D C:\Users\Carlos\AppData\Local\{272D91CC-B551-4B8B-BCF6-3FB4744214F0}
2012-06-27 06:22 - 2012-06-27 18:23 - 00000000 ____D C:\Users\Carlos\AppData\Local\{3BB47CD0-16CB-40B6-B45C-2AA7C2916D8D}
2012-06-26 18:22 - 2012-06-26 18:22 - 00000000 ____D C:\Users\Carlos\AppData\Local\{99307A59-BF99-4C3F-A306-97CD244571A1}
2012-06-26 18:22 - 2012-06-26 18:22 - 00000000 ____D C:\Users\Carlos\AppData\Local\{51DCC8AA-A830-45CD-9944-ED2A8A594812}
2012-06-26 06:21 - 2012-06-26 06:21 - 00000000 ____D C:\Users\Carlos\AppData\Local\{F9B4269E-BA96-481F-811C-B0A85779770D}
2012-06-26 06:21 - 2012-06-26 06:21 - 00000000 ____D C:\Users\Carlos\AppData\Local\{4A1BC596-BD9D-4895-B04B-E8A06F4E1367}
2012-06-25 18:20 - 2012-06-25 18:21 - 00000000 ____D C:\Users\Carlos\AppData\Local\{4DAC7DF7-7C93-40C0-9C9E-3BAE401FBDD5}
2012-06-25 18:20 - 2012-06-25 18:20 - 00000000 ____D C:\Users\Carlos\AppData\Local\{5DD2BB67-C7B4-4A9B-A75C-C198703AC01A}
2012-06-25 10:11 - 2012-06-25 10:11 - 00013991 ____A C:\Users\Carlos\.recently-used.xbel
2012-06-25 06:20 - 2012-06-25 06:20 - 00000000 ____D C:\Users\Carlos\AppData\Local\{55E60FCA-F759-48FB-9F69-FD8401B0C022}
2012-06-25 06:19 - 2012-06-25 06:20 - 00000000 ____D C:\Users\Carlos\AppData\Local\{EFFFB26C-FB73-4C51-9EF1-09859ECB253C}
2012-06-24 18:19 - 2012-06-24 18:19 - 00000000 ____D C:\Users\Carlos\AppData\Local\{843A9C73-9DA4-467E-9C32-FFA8E8498724}
2012-06-24 18:19 - 2012-06-24 18:19 - 00000000 ____D C:\Users\Carlos\AppData\Local\{3F8C297D-BAE0-4FC9-852B-CFD44D6B8E1D}
2012-06-24 06:18 - 2012-06-24 06:18 - 00000000 ____D C:\Users\Carlos\AppData\Local\{E37FFF4E-2DDB-4A50-894B-FAAE556CABD6}
2012-06-24 06:18 - 2012-06-24 06:18 - 00000000 ____D C:\Users\Carlos\AppData\Local\{90558A72-339E-4D77-B955-69A68E611C19}
2012-06-23 18:18 - 2012-06-23 18:18 - 00000000 ____D C:\Users\Carlos\AppData\Local\{67873581-29DC-445F-A99B-A7D53581DF3E}
2012-06-23 18:17 - 2012-06-23 18:18 - 00000000 ____D C:\Users\Carlos\AppData\Local\{87FC6A0D-7432-4226-B622-FAFBEDF8650B}
2012-06-23 10:43 - 2012-06-23 10:43 - 01012656 ____A C:\Users\Carlos\Desktop\rkill.exe
2012-06-23 08:35 - 2012-06-23 08:35 - 00290256 ____A C:\Windows\Minidump\062312-28532-01.dmp
2012-06-23 06:17 - 2012-06-23 06:17 - 00000000 ____D C:\Users\Carlos\AppData\Local\{B51B0FFE-5D37-42A1-9740-7AD9376A826A}
2012-06-23 06:17 - 2012-06-23 06:17 - 00000000 ____D C:\Users\Carlos\AppData\Local\{4352480B-5E26-4882-8520-A610C6230C58}
2012-06-23 05:55 - 2012-06-23 05:55 - 00074184 ____A C:\Windows\System32\Drivers\7f06e87cd967bf44.sys
2012-06-22 21:09 - 2012-06-22 21:09 - 00000000 __SHD C:\Windows\System32\%APPDATA%
2012-06-22 20:45 - 2012-06-22 20:45 - 00040960 ____A (SmoothCandle) C:\Users\Carlos\0i763f66bz.exe
2012-06-22 18:04 - 2012-06-22 18:04 - 00000000 ____D C:\Users\Carlos\AppData\Local\{9B57D155-ACC9-4258-ABAC-D2A77D590DA8}
2012-06-22 18:04 - 2012-06-22 18:04 - 00000000 ____D C:\Users\Carlos\AppData\Local\{16778133-6A07-4D7F-8E07-16B50483B186}
2012-06-22 06:03 - 2012-06-22 06:04 - 00000000 ____D C:\Users\Carlos\AppData\Local\{369B6ECE-A765-44CA-A9D4-AA11795E3C53}
2012-06-22 06:03 - 2012-06-22 06:03 - 00000000 ____D C:\Users\Carlos\AppData\Local\{B912EDAD-1770-4352-B61F-1102C54ED898}
2012-06-22 05:06 - 2012-06-02 14:19 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-22 05:06 - 2012-06-02 14:19 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-22 05:06 - 2012-06-02 14:19 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-22 05:06 - 2012-06-02 14:15 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-22 05:05 - 2012-06-02 14:19 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-22 05:05 - 2012-06-02 14:19 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-22 05:05 - 2012-06-02 14:15 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-22 05:05 - 2012-06-02 11:19 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-22 05:05 - 2012-06-02 11:15 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-21 18:03 - 2012-06-21 18:03 - 00000000 ____D C:\Users\Carlos\AppData\Local\{C7B4A9A6-17C5-4C5B-B58F-26A4F97BB06F}
2012-06-21 18:03 - 2012-06-21 18:03 - 00000000 ____D C:\Users\Carlos\AppData\Local\{50505B50-1A50-4726-AB63-C5A747991AF4}
2012-06-21 06:02 - 2012-06-21 06:03 - 00000000 ____D C:\Users\Carlos\AppData\Local\{F2CFF39D-747E-4EF8-9FBF-8C48F71AB09C}
2012-06-21 06:02 - 2012-06-21 06:02 - 00000000 ____D C:\Users\Carlos\AppData\Local\{61BC137F-DD1F-405E-B0C7-C550201787F3}
2012-06-20 18:02 - 2012-06-20 18:02 - 00000000 ____D C:\Users\Carlos\AppData\Local\{E05C0359-B168-42FC-B3BA-16EB6F4D89E0}
2012-06-20 18:01 - 2012-06-20 18:02 - 00000000 ____D C:\Users\Carlos\AppData\Local\{DE5C7823-37FA-4CB4-AF72-49614F619A94}
2012-06-20 06:01 - 2012-06-20 06:01 - 00000000 ____D C:\Users\Carlos\AppData\Local\{5482445B-6241-40B1-872E-CDAA84D39CA3}
2012-06-20 06:01 - 2012-06-20 06:01 - 00000000 ____D C:\Users\Carlos\AppData\Local\{093F8D80-5659-4D3E-8569-425FD603A441}
2012-06-20 03:42 - 2012-07-03 13:30 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-06-19 18:01 - 2012-06-19 18:01 - 00000000 ____D C:\Users\Carlos\AppData\Local\{619A4459-9AE5-46A6-A8B6-5F07E7C1A642}
2012-06-19 18:00 - 2012-06-19 18:01 - 00000000 ____D C:\Users\Carlos\AppData\Local\{12A52148-1C4E-47AE-9EDA-108AAFEE3F02}
2012-06-19 15:22 - 2012-06-19 15:23 - 15565619 ____A C:\Users\Carlos\Desktop\pvk_fort_sand_fox.rar
2012-06-19 15:22 - 2012-06-19 15:22 - 00340670 ____A C:\Users\Carlos\Desktop\pvk_hellpit.zip
2012-06-19 15:21 - 2012-06-19 15:21 - 02417652 ____A C:\Users\Carlos\Desktop\surf school.zip
2012-06-19 15:21 - 2012-06-19 15:21 - 02234646 ____A C:\Users\Carlos\Desktop\pvk molten.zip
2012-06-19 15:21 - 2012-06-19 15:21 - 00202882 ____A C:\Users\Carlos\Desktop\pvk_shooting_range.rar
2012-06-19 15:20 - 2012-06-19 15:21 - 11979751 ____A C:\Users\Carlos\Desktop\pvk_parrot-play-house.zip
2012-06-19 15:20 - 2012-06-19 15:20 - 04277269 ____A C:\Users\Carlos\Desktop\pvk_orchard.zip
2012-06-19 15:20 - 2012-06-19 15:20 - 01005752 ____A C:\Users\Carlos\Desktop\pvk_tourny_archeryrange_beta2.rar
2012-06-19 15:19 - 2012-06-19 15:19 - 01479931 ____A C:\Users\Carlos\Desktop\pvk_vikingraid.zip
2012-06-19 15:18 - 2012-06-19 15:19 - 14649411 ____A C:\Users\Carlos\Desktop\Hg_UnderWorld_b4.rar
2012-06-19 15:18 - 2012-06-19 15:18 - 08251234 ____A C:\Users\Carlos\Desktop\zm_miniature_room_v1.rar
2012-06-19 15:17 - 2012-06-19 15:17 - 06161782 ____A C:\Users\Carlos\Desktop\Pvk_warbots_beta1.rar
2012-06-19 15:17 - 2012-06-19 15:17 - 03292809 ____A C:\Users\Carlos\Desktop\pvk_seas_day_beta.rar
2012-06-19 15:15 - 2012-06-19 15:16 - 13817392 ____A C:\Users\Carlos\Desktop\pvk_rush_beta1.zip
2012-06-19 15:15 - 2012-06-19 15:15 - 07642216 ____A C:\Users\Carlos\Desktop\pvk_ruins_b1.zip
2012-06-19 15:14 - 2012-06-19 15:14 - 00624400 ____A C:\Users\Carlos\Desktop\pvk_iceland_b1.zip
2012-06-19 15:13 - 2012-06-19 15:13 - 05613590 ____A C:\Users\Carlos\Desktop\pvk_pact_beta6.zip
2012-06-19 15:13 - 2012-06-19 15:13 - 00384572 ____A C:\Users\Carlos\Desktop\pvk shore b1.zip
2012-06-19 15:12 - 2012-06-19 15:12 - 07798043 ____A C:\Users\Carlos\Desktop\pvk_rumble_beta11.rar
2012-06-19 15:12 - 2012-06-19 15:12 - 00006492 ____A C:\Users\Carlos\Desktop\pvk_trillian_beta18.rar
2012-06-19 08:29 - 2012-06-19 08:29 - 10364047 ____A C:\Users\Carlos\Downloads\_Inuboshi_ The Light of Tsukimi Manor 2 _ENG_ _Hayama_Kotono_.rar
2012-06-19 06:00 - 2012-06-19 06:00 - 00000000 ____D C:\Users\Carlos\AppData\Local\{2A878910-3777-4615-A765-D2BEAE4A3E60}
2012-06-19 06:00 - 2012-06-19 06:00 - 00000000 ____D C:\Users\Carlos\AppData\Local\{1FFF8EEB-F4CE-41EB-B6C8-5B6AB22873AD}
2012-06-18 17:59 - 2012-06-18 18:00 - 00000000 ____D C:\Users\Carlos\AppData\Local\{0D124C6D-3286-4AB9-9FB2-104ECB20284F}
2012-06-18 17:59 - 2012-06-18 17:59 - 00000000 ____D C:\Users\Carlos\AppData\Local\{41C8FEA3-8350-4B03-950B-7525FFBADB34}
2012-06-18 05:59 - 2012-06-18 05:59 - 00000000 ____D C:\Users\Carlos\AppData\Local\{2BA8F88C-4ABE-4FE3-9464-86D64059E544}
2012-06-17 18:00 - 2012-06-17 18:00 - 00000000 ____D C:\Users\Carlos\AppData\Local\Macromedia
2012-06-17 17:49 - 2012-06-17 17:49 - 00000000 ____D C:\Users\Carlos\AppData\Local\{E01876B6-B5A4-4E6E-8153-3E2BCE616C5E}
2012-06-17 05:48 - 2012-06-17 05:49 - 00000000 ____D C:\Users\Carlos\AppData\Local\{DBF12B65-B76A-4BE4-AF76-4E00E162749B}
2012-06-16 17:48 - 2012-06-16 17:48 - 00000000 ____D C:\Users\Carlos\AppData\Local\{769D054D-1EBF-4DC5-9200-9B93920D1FAC}
2012-06-16 05:47 - 2012-06-16 05:48 - 00000000 ____D C:\Users\Carlos\AppData\Local\{99D9648B-B0C6-44C9-B436-FB813B8D6B40}
2012-06-15 17:41 - 2012-06-15 17:41 - 00000000 ____D C:\Users\Carlos\AppData\Local\{F29650C5-BA69-4E42-8BA7-2CE1B0F44628}
2012-06-15 05:41 - 2012-06-15 05:41 - 00000000 ____D C:\Users\Carlos\AppData\Local\{55900A0D-D9CE-48F0-8107-A01B4DA3572A}
2012-06-14 17:40 - 2012-06-14 17:40 - 00000000 ____D C:\Users\Carlos\AppData\Local\{21146C11-D068-4A3C-BD14-67657F10C34E}
2012-06-14 05:40 - 2012-06-14 05:40 - 00000000 ____D C:\Users\Carlos\AppData\Local\{A06DA23C-DBC6-429A-82F2-F2B51807E103}
2012-06-14 05:39 - 2012-06-14 05:40 - 00000000 ____D C:\Users\Carlos\AppData\Local\{E2928178-ED64-409E-839A-691FA92156C3}
2012-06-13 22:03 - 2012-05-17 18:47 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-06-13 22:03 - 2012-05-17 18:16 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-06-13 22:03 - 2012-05-17 18:06 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-06-13 22:03 - 2012-05-17 17:59 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-06-13 22:03 - 2012-05-17 17:59 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-06-13 22:03 - 2012-05-17 17:58 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-06-13 22:03 - 2012-05-17 17:58 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-06-13 22:03 - 2012-05-17 17:56 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-06-13 22:03 - 2012-05-17 17:55 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-06-13 22:03 - 2012-05-17 17:55 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-06-13 22:03 - 2012-05-17 17:54 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-06-13 22:03 - 2012-05-17 17:51 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-06-13 22:03 - 2012-05-17 17:51 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-06-13 22:03 - 2012-05-17 17:47 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-06-13 22:03 - 2012-05-17 15:11 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-06-13 22:03 - 2012-05-17 14:48 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-06-13 22:03 - 2012-05-17 14:45 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2012-06-13 22:03 - 2012-05-17 14:36 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-06-13 22:03 - 2012-05-17 14:35 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2012-06-13 22:03 - 2012-05-17 14:35 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-06-13 22:03 - 2012-05-17 14:33 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-06-13 22:03 - 2012-05-17 14:31 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-06-13 22:03 - 2012-05-17 14:29 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2012-06-13 22:03 - 2012-05-17 14:29 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2012-06-13 22:03 - 2012-05-17 14:27 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-06-13 22:03 - 2012-05-17 14:25 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-06-13 22:03 - 2012-05-17 14:24 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-06-13 22:03 - 2012-05-17 14:20 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-06-13 17:35 - 2012-06-13 17:35 - 00000000 ____D C:\Users\Carlos\AppData\Local\{1CFD7F87-EE43-4C38-9561-23C7D57859ED}
2012-06-13 17:34 - 2012-06-13 17:35 - 00000000 ____D C:\Users\Carlos\AppData\Local\{45366686-94F2-4480-B2D9-701BA6F2C07C}
2012-06-13 05:45 - 2012-04-30 21:40 - 00209920 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2012-06-13 05:45 - 2012-04-25 21:41 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-06-13 05:45 - 2012-04-25 21:41 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-06-13 05:45 - 2012-04-25 21:34 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-06-13 05:44 - 2012-05-14 17:32 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-06-13 05:44 - 2012-05-04 03:06 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-06-13 05:44 - 2012-05-04 02:03 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-06-13 05:44 - 2012-05-04 02:03 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-06-13 05:44 - 2012-04-27 19:55 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-06-13 05:44 - 2012-04-23 21:37 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-06-13 05:44 - 2012-04-23 21:37 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-06-13 05:44 - 2012-04-23 21:37 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-06-13 05:44 - 2012-04-23 20:36 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2012-06-13 05:44 - 2012-04-23 20:36 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2012-06-13 05:44 - 2012-04-23 20:36 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2012-06-13 05:44 - 2012-04-07 04:31 - 03216384 ____A (Microsoft Corporation) C:\Windows\System32\msi.dll
2012-06-13 05:44 - 2012-04-07 03:26 - 02342400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2012-06-13 05:34 - 2012-06-13 05:34 - 00000000 ____D C:\Users\Carlos\AppData\Local\{2DF9603F-904E-4B9F-89BC-10B18A52202D}
2012-06-13 05:33 - 2012-06-13 05:34 - 00000000 ____D C:\Users\Carlos\AppData\Local\{E1A97B1E-47C5-4CA0-813F-106B56EBAD12}
2012-06-12 17:21 - 2012-06-12 17:21 - 00000000 ____D C:\Users\Carlos\AppData\Local\{1ECDF240-AC25-4810-8EDD-84DEBE0CD77F}
2012-06-12 11:27 - 2012-06-12 11:27 - 05270559 ____A C:\Users\Carlos\Downloads\SoundsZUN.rar
2012-06-12 05:20 - 2012-06-12 05:20 - 00000000 ____D C:\Users\Carlos\AppData\Local\{23A0B06D-BD58-4DC8-B070-6C691C796568}
2012-06-12 05:19 - 2012-06-12 17:21 - 00000000 ____D C:\Users\Carlos\AppData\Local\{E2BC1F30-5C45-4072-BE4E-0E7F2B330674}
2012-06-11 16:57 - 2012-06-11 16:57 - 00065746 ____A C:\Users\Carlos\Desktop\[Elysium]To.Aru.Kagaku.no.Railgun(BD.1080p.FLAC).torrent
2012-06-11 12:26 - 2012-06-11 12:26 - 00000000 ____D C:\Users\Carlos\AppData\Local\{1FBD0E5D-5DC9-4146-8876-0601B545CFFD}
2012-06-11 12:25 - 2012-06-11 12:26 - 00000000 ____D C:\Users\Carlos\AppData\Local\{5C477F20-BBD6-478D-A4F7-8DAB88EF7F5B}
2012-06-10 18:34 - 2012-06-10 18:34 - 00000000 ____D C:\Users\Carlos\AppData\Local\{F5E57EBD-25CB-4686-BB2C-8D2CFE6079DA}
2012-06-10 18:34 - 2012-06-10 18:34 - 00000000 ____D C:\Users\Carlos\AppData\Local\{1B07C986-C836-4687-8C2B-BAB4A58A90D0}
2012-06-10 18:26 - 2012-06-10 18:57 - 1942752948 ____A C:\Users\Carlos\Downloads\TimeScapes 2012 720p WEB-DL AAC 2.0 x264-DON.mkv
2012-06-10 06:33 - 2012-06-10 06:33 - 00000000 ____D C:\Users\Carlos\AppData\Local\{AE49D1AA-1B32-4E1D-A1EE-FCFEBB122618}
2012-06-10 06:33 - 2012-06-10 06:33 - 00000000 ____D C:\Users\Carlos\AppData\Local\{28B4370B-182C-43AF-AF69-663E6E543AF8}
2012-06-09 18:33 - 2012-06-09 18:33 - 00000000 ____D C:\Users\Carlos\AppData\Local\{CDC8D8C3-2EB5-4A09-96D0-D637B18EC7F5}
2012-06-09 18:32 - 2012-06-09 18:33 - 00000000 ____D C:\Users\Carlos\AppData\Local\{F31FA3F6-5169-4066-B353-F2940CD8D9A3}
2012-06-09 15:55 - 2012-06-09 15:55 - 00000000 ____D C:\Users\Carlos\AppData\Roaming\Gensokyo.org
2012-06-09 15:45 - 2012-06-09 15:45 - 01385984 ____A C:\Users\Carlos\Downloads\th13e_patch_1.0.exe
2012-06-09 12:12 - 2012-06-09 12:44 - 00000000 ____D C:\Users\Carlos\Downloads\Sonic Comics
2012-06-09 06:32 - 2012-06-09 06:32 - 00000000 ____D C:\Users\Carlos\AppData\Local\{F7901265-8317-4F98-A94D-DAE5C7FFE9DB}
2012-06-09 06:32 - 2012-06-09 06:32 - 00000000 ____D C:\Users\Carlos\AppData\Local\{4DAFDEDD-361C-4524-B45D-D2F4E1168862}
2012-06-08 19:59 - 2012-06-08 19:59 - 00001783 ____A C:\Users\Public\Desktop\iTunes.lnk
2012-06-08 19:58 - 2012-06-08 19:59 - 00000000 ____D C:\Program Files\iTunes
2012-06-08 19:58 - 2012-06-08 19:59 - 00000000 ____D C:\Program Files (x86)\iTunes
2012-06-08 19:58 - 2012-06-08 19:58 - 00000000 ____D C:\Program Files\iPod
2012-06-08 18:32 - 2012-06-08 18:32 - 00000000 ____D C:\Users\Carlos\AppData\Local\{E400AC3F-1DFB-4987-8357-CBA63F17BBAB}
2012-06-08 18:31 - 2012-06-08 18:32 - 00000000 ____D C:\Users\Carlos\AppData\Local\{091B2036-E6C6-4748-BF58-D434BBB00855}
2012-06-08 06:31 - 2012-06-08 06:31 - 00000000 ____D C:\Users\Carlos\AppData\Local\{45CF9F66-95A7-4100-B834-C819841E1CA0}
2012-06-08 06:31 - 2012-06-08 06:31 - 00000000 ____D C:\Users\Carlos\AppData\Local\{2BCB0C3D-E4EF-481D-B19A-275CC4865D64}
2012-06-07 18:30 - 2012-06-07 18:31 - 00000000 ____D C:\Users\Carlos\AppData\Local\{2AE24939-56F2-4D9D-80C5-04191DB3F6F6}
2012-06-07 18:30 - 2012-06-07 18:30 - 00000000 ____D C:\Users\Carlos\AppData\Local\{59BDA837-3A4F-467F-90D3-EE87F82CF285}
2012-06-07 06:30 - 2012-06-07 06:30 - 00000000 ____D C:\Users\Carlos\AppData\Local\{E369C4E2-E8D9-4492-AFD9-51A99EE66F21}
2012-06-07 06:30 - 2012-06-07 06:30 - 00000000 ____D C:\Users\Carlos\AppData\Local\{1701314C-9CCB-43F4-8856-8DD165EB1E82}
2012-06-06 18:29 - 2012-06-06 18:30 - 00000000 ____D C:\Users\Carlos\AppData\Local\{0095D850-1866-44EF-A021-D611584D425F}
2012-06-06 18:29 - 2012-06-06 18:29 - 00000000 ____D C:\Users\Carlos\AppData\Local\{CAF36263-1AAA-4D71-810E-6C9830EB525A}
2012-06-06 06:29 - 2012-06-06 06:29 - 00000000 ____D C:\Users\Carlos\AppData\Local\{45AC9A1C-4CB6-4A03-AD05-5A194F714C88}
2012-06-06 06:29 - 2012-06-06 06:29 - 00000000 ____D C:\Users\Carlos\AppData\Local\{0ED4525C-D4AA-4619-8216-827CCB0B7AB1}
2012-06-05 18:28 - 2012-06-05 18:29 - 00000000 ____D C:\Users\Carlos\AppData\Local\{8FDCA22C-6683-402D-920E-208B3BF06C83}
2012-06-05 18:28 - 2012-06-05 18:28 - 00000000 ____D C:\Users\Carlos\AppData\Local\{DB905604-F3C5-4BAD-9E3A-35B9D491A1D7}
2012-06-05 13:20 - 2012-06-05 13:20 - 00137177 ____A C:\Users\Carlos\Downloads\Wiki-background
2012-06-05 13:07 - 2012-06-05 13:08 - 00290584 ____A C:\Windows\Minidump\060512-22682-01.dmp
2012-06-05 06:28 - 2012-06-05 06:28 - 00000000 ____D C:\Users\Carlos\AppData\Local\{F6D328D0-40A4-40AF-B67F-9DDBF5456A99}
2012-06-05 06:28 - 2012-06-05 06:28 - 00000000 ____D C:\Users\Carlos\AppData\Local\{56211B06-75B4-4CA3-8002-48BD06D1E891}
2012-06-04 18:27 - 2012-06-04 18:27 - 00000000 ____D C:\Users\Carlos\AppData\Local\{D6724278-C353-4007-9B6B-7C13B027DB86}
2012-06-04 18:27 - 2012-06-04 18:27 - 00000000 ____D C:\Users\Carlos\AppData\Local\{77F77F72-3DB8-4F7E-BC37-B9DB42046B5A}
2012-06-04 06:27 - 2012-06-04 06:27 - 00000000 ____D C:\Users\Carlos\AppData\Local\{45B5AC8C-5EE7-4486-B042-A38B71510994}
2012-06-04 06:26 - 2012-06-04 06:27 - 00000000 ____D C:\Users\Carlos\AppData\Local\{DBC1C892-886A-486B-8643-A5939B3E683E}
2012-06-03 18:26 - 2012-06-03 18:26 - 00000000 ____D C:\Users\Carlos\AppData\Local\{E4270B16-5974-49A8-A31E-50058888419F}
2012-06-03 18:26 - 2012-06-03 18:26 - 00000000 ____D C:\Users\Carlos\AppData\Local\{60F98057-931E-438E-A685-E823B8FC27AE}
2012-06-03 05:51 - 2012-06-03 05:51 - 00000000 ____D C:\Users\Carlos\AppData\Local\{BD8E17A2-C3DA-4261-B7FF-59CBD76CEE7A}
2012-06-03 05:51 - 2012-06-03 05:51 - 00000000 ____D C:\Users\Carlos\AppData\Local\{53F70BD4-2658-4B14-AE18-4F60A151DB92}

============ 3 Months Modified Files ========================

2012-07-03 14:08 - 2010-06-16 08:40 - 00010048 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-07-03 14:08 - 2010-06-16 08:40 - 00010048 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-07-03 14:00 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-07-03 14:00 - 2009-07-13 20:51 - 06688827 ____A C:\Windows\setupact.log
2012-07-03 13:53 - 2009-07-13 21:13 - 00806224 ____A C:\Windows\System32\PerfStringBackup.INI
2012-07-03 13:51 - 2012-07-03 13:51 - 01431259 ____A C:\Users\Carlos\Downloads\FRST64.exe
2012-07-03 13:30 - 2012-06-20 03:42 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-07-02 11:24 - 2010-06-16 09:52 - 00000258 _RASH C:\Users\All Users\ntuser.pol
2012-07-02 11:24 - 2010-06-16 09:18 - 00032666 ____A C:\Windows\PFRO.log
2012-06-25 10:11 - 2012-06-25 10:11 - 00013991 ____A C:\Users\Carlos\.recently-used.xbel
2012-06-23 10:44 - 2012-01-03 07:17 - 00000581 ____A C:\rkill.log
2012-06-23 10:43 - 2012-06-23 10:43 - 01012656 ____A C:\Users\Carlos\Desktop\rkill.exe
2012-06-23 10:36 - 2011-01-26 06:11 - 00002198 ____A C:\Windows\epplauncher.mif
2012-06-23 10:34 - 2011-01-26 05:54 - 00000378 ____A C:\Windows\System32\Wacom_Tablet.dat
2012-06-23 08:35 - 2012-06-23 08:35 - 00290256 ____A C:\Windows\Minidump\062312-28532-01.dmp
2012-06-23 08:34 - 2012-05-28 07:15 - 541988766 ____A C:\Windows\MEMORY.DMP
2012-06-23 07:30 - 2012-04-01 05:59 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-06-23 07:30 - 2011-05-19 04:48 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-06-23 05:55 - 2012-06-23 05:55 - 00074184 ____A C:\Windows\System32\Drivers\7f06e87cd967bf44.sys
2012-06-22 22:45 - 2010-06-16 09:37 - 01263377 ____A C:\Windows\WindowsUpdate.log
2012-06-22 20:45 - 2012-06-22 20:45 - 00040960 ____A (SmoothCandle) C:\Users\Carlos\0i763f66bz.exe
2012-06-19 15:23 - 2012-06-19 15:22 - 15565619 ____A C:\Users\Carlos\Desktop\pvk_fort_sand_fox.rar
2012-06-19 15:22 - 2012-06-19 15:22 - 00340670 ____A C:\Users\Carlos\Desktop\pvk_hellpit.zip
2012-06-19 15:21 - 2012-06-19 15:21 - 02417652 ____A C:\Users\Carlos\Desktop\surf school.zip
2012-06-19 15:21 - 2012-06-19 15:21 - 02234646 ____A C:\Users\Carlos\Desktop\pvk molten.zip
2012-06-19 15:21 - 2012-06-19 15:21 - 00202882 ____A C:\Users\Carlos\Desktop\pvk_shooting_range.rar
2012-06-19 15:21 - 2012-06-19 15:20 - 11979751 ____A C:\Users\Carlos\Desktop\pvk_parrot-play-house.zip
2012-06-19 15:20 - 2012-06-19 15:20 - 04277269 ____A C:\Users\Carlos\Desktop\pvk_orchard.zip
2012-06-19 15:20 - 2012-06-19 15:20 - 01005752 ____A C:\Users\Carlos\Desktop\pvk_tourny_archeryrange_beta2.rar
2012-06-19 15:19 - 2012-06-19 15:19 - 01479931 ____A C:\Users\Carlos\Desktop\pvk_vikingraid.zip
2012-06-19 15:19 - 2012-06-19 15:18 - 14649411 ____A C:\Users\Carlos\Desktop\Hg_UnderWorld_b4.rar
2012-06-19 15:18 - 2012-06-19 15:18 - 08251234 ____A C:\Users\Carlos\Desktop\zm_miniature_room_v1.rar
2012-06-19 15:17 - 2012-06-19 15:17 - 06161782 ____A C:\Users\Carlos\Desktop\Pvk_warbots_beta1.rar
2012-06-19 15:17 - 2012-06-19 15:17 - 03292809 ____A C:\Users\Carlos\Desktop\pvk_seas_day_beta.rar
2012-06-19 15:16 - 2012-06-19 15:15 - 13817392 ____A C:\Users\Carlos\Desktop\pvk_rush_beta1.zip
2012-06-19 15:15 - 2012-06-19 15:15 - 07642216 ____A C:\Users\Carlos\Desktop\pvk_ruins_b1.zip
2012-06-19 15:14 - 2012-06-19 15:14 - 00624400 ____A C:\Users\Carlos\Desktop\pvk_iceland_b1.zip
2012-06-19 15:13 - 2012-06-19 15:13 - 05613590 ____A C:\Users\Carlos\Desktop\pvk_pact_beta6.zip
2012-06-19 15:13 - 2012-06-19 15:13 - 00384572 ____A C:\Users\Carlos\Desktop\pvk shore b1.zip
2012-06-19 15:12 - 2012-06-19 15:12 - 07798043 ____A C:\Users\Carlos\Desktop\pvk_rumble_beta11.rar
2012-06-19 15:12 - 2012-06-19 15:12 - 00006492 ____A C:\Users\Carlos\Desktop\pvk_trillian_beta18.rar
2012-06-19 08:29 - 2012-06-19 08:29 - 10364047 ____A C:\Users\Carlos\Downloads\_Inuboshi_ The Light of Tsukimi Manor 2 _ENG_ _Hayama_Kotono_.rar
2012-06-14 05:36 - 2009-07-13 20:45 - 00435560 ____A C:\Windows\System32\FNTCACHE.DAT
2012-06-13 22:10 - 2010-07-14 07:43 - 58957832 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-06-12 19:25 - 2010-10-17 08:28 - 00007597 ____A C:\Users\Carlos\AppData\Local\Resmon.ResmonCfg
2012-06-12 11:27 - 2012-06-12 11:27 - 05270559 ____A C:\Users\Carlos\Downloads\SoundsZUN.rar
2012-06-11 16:57 - 2012-06-11 16:57 - 00065746 ____A C:\Users\Carlos\Desktop\[Elysium]To.Aru.Kagaku.no.Railgun(BD.1080p.FLAC).torrent
2012-06-10 18:57 - 2012-06-10 18:26 - 1942752948 ____A C:\Users\Carlos\Downloads\TimeScapes 2012 720p WEB-DL AAC 2.0 x264-DON.mkv
2012-06-09 15:45 - 2012-06-09 15:45 - 01385984 ____A C:\Users\Carlos\Downloads\th13e_patch_1.0.exe
2012-06-08 19:59 - 2012-06-08 19:59 - 00001783 ____A C:\Users\Public\Desktop\iTunes.lnk
2012-06-05 13:20 - 2012-06-05 13:20 - 00137177 ____A C:\Users\Carlos\Downloads\Wiki-background
2012-06-05 13:08 - 2012-06-05 13:07 - 00290584 ____A C:\Windows\Minidump\060512-22682-01.dmp
2012-06-02 14:19 - 2012-06-22 05:06 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-02 14:19 - 2012-06-22 05:06 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-02 14:19 - 2012-06-22 05:06 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-02 14:19 - 2012-06-22 05:05 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-02 14:19 - 2012-06-22 05:05 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-02 14:15 - 2012-06-22 05:06 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-02 14:15 - 2012-06-22 05:05 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-02 11:19 - 2012-06-22 05:05 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-02 11:15 - 2012-06-22 05:05 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-05-28 11:09 - 2010-06-09 09:03 - 00000646 ____A C:\Windows\kaillera.ini
2012-05-28 07:17 - 2012-05-28 07:17 - 00386792 ____A C:\Windows\Minidump\052812-36644-01.dmp
2012-05-28 07:15 - 2012-05-28 07:15 - 00000000 ____A C:\Windows\Minidump\052812-27206-01.dmp
2012-05-28 07:04 - 2010-07-26 16:17 - 00050720 ____A C:\Windows\DirectX.log
2012-05-27 19:57 - 2009-07-13 21:08 - 00032640 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-05-25 17:35 - 2012-05-25 17:35 - 00000699 ____A C:\Users\Public\Desktop\µTorrent.lnk
2012-05-25 17:34 - 2010-12-17 08:34 - 00880496 ____A (BitTorrent, Inc.) C:\Users\Carlos\Downloads\utorrent.exe
2012-05-21 21:30 - 2012-05-21 21:30 - 00015008 ____A (Highresolution Enterprises [www.highrez.co.uk]) C:\Windows\System32\Drivers\inpoutx64.sys
2012-05-17 18:47 - 2012-06-13 22:03 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-05-17 18:16 - 2012-06-13 22:03 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-05-17 18:06 - 2012-06-13 22:03 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-05-17 17:59 - 2012-06-13 22:03 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-05-17 17:59 - 2012-06-13 22:03 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-05-17 17:58 - 2012-06-13 22:03 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-05-17 17:58 - 2012-06-13 22:03 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-05-17 17:56 - 2012-06-13 22:03 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-05-17 17:55 - 2012-06-13 22:03 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-05-17 17:55 - 2012-06-13 22:03 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-05-17 17:54 - 2012-06-13 22:03 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-05-17 17:51 - 2012-06-13 22:03 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-05-17 17:51 - 2012-06-13 22:03 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-05-17 17:47 - 2012-06-13 22:03 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-05-17 15:11 - 2012-06-13 22:03 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-05-17 14:48 - 2012-06-13 22:03 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-05-17 14:45 - 2012-06-13 22:03 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2012-05-17 14:36 - 2012-06-13 22:03 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-05-17 14:35 - 2012-06-13 22:03 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2012-05-17 14:35 - 2012-06-13 22:03 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-05-17 14:33 - 2012-06-13 22:03 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-05-17 14:31 - 2012-06-13 22:03 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-05-17 14:29 - 2012-06-13 22:03 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2012-05-17 14:29 - 2012-06-13 22:03 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2012-05-17 14:27 - 2012-06-13 22:03 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-05-17 14:25 - 2012-06-13 22:03 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-05-17 14:24 - 2012-06-13 22:03 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-05-17 14:20 - 2012-06-13 22:03 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-05-15 21:42 - 2010-06-16 08:42 - 00799948 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2012-05-15 02:48 - 2012-06-02 12:39 - 25743168 ____A (NVIDIA Corporation) C:\Windows\System32\nvoglv64.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 25248064 ____A (NVIDIA Corporation) C:\Windows\System32\nvcompiler.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 19607872 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 18044224 ____A (NVIDIA Corporation) C:\Windows\System32\nvd3dumx.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 17551680 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 15322432 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 14298944 ____A (NVIDIA Corporation) C:\Windows\System32\Drivers\nvlddmkm.sys
2012-05-15 02:48 - 2012-06-02 12:39 - 08139072 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuda.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 05982528 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 02881856 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuvenc.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 02741568 ____A (NVIDIA Corporation) C:\Windows\System32\nvapi64.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 02681664 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuvid.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 02524992 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 02445120 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 02368832 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 00949056 ____A (NVIDIA Corporation) C:\Windows\System32\nvumdshimx.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 00818496 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 00364352 ____A (NVIDIA Corporation) C:\Windows\System32\nvdecodemft.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 00301376 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvdecodemft.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 00246592 ____A (NVIDIA Corporation) C:\Windows\System32\nvinitx.dll
2012-05-15 02:48 - 2012-06-02 12:39 - 00202048 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2012-05-15 02:48 - 2012-03-29 12:36 - 01738048 ____A (NVIDIA Corporation) C:\Windows\System32\nvdispco64.dll
2012-05-15 02:48 - 2012-03-29 12:36 - 01468224 ____A (NVIDIA Corporation) C:\Windows\System32\nvgenco64.dll
2012-05-15 02:48 - 2012-03-29 12:36 - 00068928 ____A (Khronos Group) C:\Windows\System32\OpenCL.dll
2012-05-15 02:48 - 2012-03-29 12:36 - 00061248 ____A (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2012-05-15 02:48 - 2011-05-21 03:01 - 08105280 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2012-05-15 02:48 - 2010-12-20 21:47 - 10194752 ____A (NVIDIA Corporation) C:\Windows\System32\nvwgf2umx.dll
2012-05-15 02:48 - 2010-10-05 09:14 - 00014324 ____A C:\Windows\System32\nvinfo.pb
2012-05-15 01:29 - 2012-06-02 12:22 - 02621723 ____A C:\Windows\System32\nvcoproc.bin
2012-05-15 01:29 - 2010-10-16 10:13 - 03149632 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvc64.dll
2012-05-15 01:29 - 2010-10-16 10:13 - 00889664 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
2012-05-15 01:29 - 2010-10-16 10:13 - 00118080 ____A (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll
2012-05-15 01:29 - 2009-07-14 10:08 - 00063296 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll
2012-05-15 01:28 - 2010-10-16 10:13 - 06151488 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll
2012-05-14 22:21 - 2012-05-14 22:21 - 00423744 ____A C:\Windows\SysWOW64\nvStreaming.exe
2012-05-14 17:32 - 2012-06-13 05:44 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-05-06 05:59 - 2010-06-16 09:53 - 00119112 ____A C:\Users\Carlos\AppData\Local\GDIPFONTCACHEV1.DAT
2012-05-05 13:43 - 2012-05-05 13:43 - 00157472 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaws.exe
2012-05-05 13:43 - 2012-05-05 13:43 - 00149280 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaw.exe
2012-05-05 13:43 - 2012-05-05 13:43 - 00149280 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\java.exe
2012-05-05 13:28 - 2012-05-05 13:28 - 00544032 ____A (Sun Microsystems, Inc.) C:\Windows\System32\npdeployJava1.dll
2012-05-05 13:28 - 2012-05-05 13:28 - 00525600 ____A (Sun Microsystems, Inc.) C:\Windows\System32\deployJava1.dll
2012-05-05 13:28 - 2012-05-05 13:28 - 00191264 ____A (Sun Microsystems, Inc.) C:\Windows\System32\javaws.exe
2012-05-05 13:28 - 2012-05-05 13:28 - 00172320 ____A (Sun Microsystems, Inc.) C:\Windows\System32\javaw.exe
2012-05-05 13:28 - 2012-05-05 13:28 - 00172320 ____A (Sun Microsystems, Inc.) C:\Windows\System32\java.exe
2012-05-05 13:05 - 2012-05-05 13:05 - 00476960 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\npdeployJava1.dll
2012-05-05 13:05 - 2010-05-10 09:50 - 00472864 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\deployJava1.dll
2012-05-05 13:04 - 2012-04-01 16:14 - 00008145 ____A C:\Users\Carlos\Desktop\TimeGalMap.txt
2012-05-05 05:43 - 2012-05-05 05:43 - 00514290 ____A C:\Users\Carlos\Desktop\timegal.rar
2012-05-04 13:42 - 2012-05-04 13:42 - 00000423 ____A C:\Users\Carlos\Documents\nursing1.txt
2012-05-04 03:06 - 2012-06-13 05:44 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-05-04 02:03 - 2012-06-13 05:44 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-05-04 02:03 - 2012-06-13 05:44 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-04-30 21:40 - 2012-06-13 05:45 - 00209920 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2012-04-28 21:48 - 2012-04-28 21:48 - 00131116 ____A C:\Users\Carlos\Desktop\RollChan2Edit.tga
2012-04-27 19:55 - 2012-06-13 05:44 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-04-25 21:41 - 2012-06-13 05:45 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-04-25 21:41 - 2012-06-13 05:45 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-04-25 21:34 - 2012-06-13 05:45 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-04-24 20:58 - 2012-04-24 20:58 - 00009451 ____A C:\Users\Carlos\Documents\nursingprerequistes.txt
2012-04-23 21:37 - 2012-06-13 05:44 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-04-23 21:37 - 2012-06-13 05:44 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-04-23 21:37 - 2012-06-13 05:44 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-04-23 20:36 - 2012-06-13 05:44 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2012-04-23 20:36 - 2012-06-13 05:44 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2012-04-23 20:36 - 2012-06-13 05:44 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2012-04-21 08:28 - 2012-04-21 08:28 - 00000592 ____A C:\Users\Carlos\Desktop\ModMii.lnk
2012-04-18 09:08 - 2012-06-02 12:39 - 01451840 ____A (NVIDIA Corporation) C:\Windows\System32\nvhdagenco6420103.dll
2012-04-18 09:08 - 2012-06-02 12:39 - 00188736 ____A (NVIDIA Corporation) C:\Windows\System32\Drivers\nvhda64v.sys
2012-04-18 09:08 - 2012-06-02 12:39 - 00031040 ____A (NVIDIA Corporation) C:\Windows\System32\nvhdap64.dll
2012-04-07 04:31 - 2012-06-13 05:44 - 03216384 ____A (Microsoft Corporation) C:\Windows\System32\msi.dll
2012-04-07 03:26 - 2012-06-13 05:44 - 02342400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2012-04-05 08:59 - 2012-04-05 08:59 - 00123247 ____A C:\Users\Carlos\Desktop\kokoz5_color.zip

ZeroAccess:
C:\Windows\Installer\{89f52674-e3ed-4203-6826-09f3b466a189}
C:\Windows\Installer\{89f52674-e3ed-4203-6826-09f3b466a189}\L
C:\Windows\Installer\{89f52674-e3ed-4203-6826-09f3b466a189}\U

ZeroAccess:
C:\Users\Carlos\AppData\Local\{89f52674-e3ed-4203-6826-09f3b466a189}
C:\Users\Carlos\AppData\Local\{89f52674-e3ed-4203-6826-09f3b466a189}\@
C:\Users\Carlos\AppData\Local\{89f52674-e3ed-4203-6826-09f3b466a189}\L
C:\Users\Carlos\AppData\Local\{89f52674-e3ed-4203-6826-09f3b466a189}\n
C:\Users\Carlos\AppData\Local\{89f52674-e3ed-4203-6826-09f3b466a189}\U
C:\Users\Carlos\AppData\Local\{89f52674-e3ed-4203-6826-09f3b466a189}\U\00000001.@
C:\Users\Carlos\AppData\Local\{89f52674-e3ed-4203-6826-09f3b466a189}\U\80000000.@
C:\Users\Carlos\AppData\Local\{89f52674-e3ed-4203-6826-09f3b466a189}\U\800000cb.@

========================= Known DLLs (Whitelisted) ============


========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe 014A9CB92514E27C0107614DF764BC06 ZeroAccess <==== ATTENTION!.
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

========================= Memory info ======================

Percentage of memory in use: 15%
Total physical RAM: 4094.49 MB
Available physical RAM: 3479.39 MB
Total Pagefile: 4092.64 MB
Available Pagefile: 3479.11 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

======================= Partitions =========================

2 Drive c: () (Fixed) (Total:465.76 GB) (Free:65.1 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
4 Drive e: (U3 System) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS
5 Drive f: () (Removable) (Total:1.86 GB) (Free:0.76 GB) FAT32
6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 465 GB 0 B
Disk 1 Online 1908 MB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 465 GB 1024 KB

==================================================================================

Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 465 GB Healthy

==================================================================================

Partitions of Disk 1:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 1907 MB 64 KB

==================================================================================

Disk: 1
Partition 1
Type : 0B
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 F FAT32 Removable 1907 MB Healthy

==================================================================================

==========================================================

Last Boot: 2012-06-29 10:39

======================= End Of Log ==========================
 
In Vista or Windows 7: Boot to System Recovery Options and run FRST.
In Windows XP: Please boot to UBCD and run FRST.
Type the following in the edit box after "Search:".

services.exe

Click Search button and post the log (Search.txt) it makes to your reply.
 
Here we are

Farbar Recovery Scan Tool Version: 03-07-2012 01
Ran by SYSTEM at 2012-07-03 21:47:58
Running from F:\

================== Search: "services.exe" ===================

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\System32\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 014A9CB92514E27C0107614DF764BC06

====== End Of Search ======
 
Download attached fixlist.txt file and save it to the very same USB flash drive you've been using. Plug the drive back in.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.
On Windows XP: Now please boot into the UBCD.
Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Next...

Restart normally.

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  • Never rename Combofix unless instructed.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  • Double click on combofix.exe & follow the prompts.

  • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
    NOTE 2. If Combofix asks you to update the program, always do so.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt"
**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click Rkill and choose Run as Administrator
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.exe
  • Double-click on the Rkill icon to run the tool.
  • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
  • Do not reboot until instructed.
  • If the tool does not run from any of the links provided, please let me know.
Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
 

Attachments

  • fixlist.txt
    858 bytes · Views: 3
Here you go again once more

ComboFix 12-07-02.01 - Carlos 07/04/2012 0:46.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4094.2828 [GMT -4:00]
Running from: c:\users\Carlos\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\users\Carlos\0i763f66bz.exe
c:\users\Carlos\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp8B95.tmp
c:\users\Carlos\Documents\pokemon_platinum_b.duc
c:\windows\apppatch\AppLoc.exe
c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb
c:\windows\Installer\{89f52674-e3ed-4203-6826-09f3b466a189}\@
c:\windows\Installer\{89f52674-e3ed-4203-6826-09f3b466a189}\n
c:\windows\Installer\{89f52674-e3ed-4203-6826-09f3b466a189}\U\00000001.@
c:\windows\Installer\{89f52674-e3ed-4203-6826-09f3b466a189}\U\80000000.@
.
.
((((((((((((((((((((((((( Files Created from 2012-06-04 to 2012-07-04 )))))))))))))))))))))))))))))))
.
.
2012-07-04 02:12 . 2012-07-04 02:13 -------- d-----w- C:\FRST
2012-06-23 05:09 . 2012-06-23 05:09 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-06-22 13:06 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-22 13:06 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-22 13:06 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-22 13:06 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-22 13:05 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-22 13:05 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-22 13:05 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-22 13:05 . 2012-06-02 19:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-22 13:05 . 2012-06-02 19:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-06-18 02:00 . 2012-06-18 02:00 -------- d-----w- c:\users\Carlos\AppData\Local\Macromedia
2012-06-13 13:45 . 2012-04-26 05:41 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-13 13:45 . 2012-04-26 05:41 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-06-13 13:45 . 2012-04-26 05:34 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-06-13 13:45 . 2012-05-01 05:40 209920 ----a-w- c:\windows\system32\profsvc.dll
2012-06-09 23:55 . 2012-06-09 23:55 -------- d-----w- c:\users\Carlos\AppData\Roaming\Gensokyo.org
2012-06-09 03:58 . 2012-06-09 03:58 -------- d-----w- c:\program files\iPod
2012-06-09 03:58 . 2012-06-09 03:59 -------- d-----w- c:\program files\iTunes
2012-06-09 03:58 . 2012-06-09 03:59 -------- d-----w- c:\program files (x86)\iTunes
2012-06-07 14:08 . 2012-06-07 14:08 770384 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll
2012-06-07 14:08 . 2012-06-07 14:08 421200 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-23 15:30 . 2012-04-01 13:59 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-23 15:30 . 2011-05-19 12:48 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-31 04:04 . 2012-06-21 13:21 9013136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8ED89227-433F-49C8-9103-5C6EDF23DD49}\mpengine.dll
2012-05-31 04:04 . 2012-06-20 11:44 9013136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-05-22 05:30 . 2012-05-22 05:30 15008 ----a-w- c:\windows\system32\drivers\inpoutx64.sys
2012-05-15 10:48 . 2012-06-02 20:39 949056 ----a-w- c:\windows\system32\nvumdshimx.dll
2012-05-15 10:48 . 2012-06-02 20:39 818496 ----a-w- c:\windows\SysWow64\nvumdshim.dll
2012-05-15 10:48 . 2012-06-02 20:39 25743168 ----a-w- c:\windows\system32\nvoglv64.dll
2012-05-15 10:48 . 2012-06-02 20:39 8139072 ----a-w- c:\windows\system32\nvcuda.dll
2012-05-15 10:48 . 2012-06-02 20:39 5982528 ----a-w- c:\windows\SysWow64\nvcuda.dll
2012-05-15 10:48 . 2012-06-02 20:39 364352 ----a-w- c:\windows\system32\nvdecodemft.dll
2012-05-15 10:48 . 2012-06-02 20:39 301376 ----a-w- c:\windows\SysWow64\nvdecodemft.dll
2012-05-15 10:48 . 2012-06-02 20:39 2881856 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-05-15 10:48 . 2012-06-02 20:39 2741568 ----a-w- c:\windows\system32\nvapi64.dll
2012-05-15 10:48 . 2012-06-02 20:39 2681664 ----a-w- c:\windows\system32\nvcuvid.dll
2012-05-15 10:48 . 2012-06-02 20:39 2524992 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2012-05-15 10:48 . 2012-06-02 20:39 25248064 ----a-w- c:\windows\system32\nvcompiler.dll
2012-05-15 10:48 . 2012-06-02 20:39 246592 ----a-w- c:\windows\system32\nvinitx.dll
2012-05-15 10:48 . 2012-06-02 20:39 2445120 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2012-05-15 10:48 . 2012-06-02 20:39 2368832 ----a-w- c:\windows\SysWow64\nvapi.dll
2012-05-15 10:48 . 2012-06-02 20:39 202048 ----a-w- c:\windows\SysWow64\nvinit.dll
2012-05-15 10:48 . 2012-06-02 20:39 19607872 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2012-05-15 10:48 . 2012-06-02 20:39 18044224 ----a-w- c:\windows\system32\nvd3dumx.dll
2012-05-15 10:48 . 2012-06-02 20:39 17551680 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2012-05-15 10:48 . 2012-06-02 20:39 15322432 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2012-05-15 10:48 . 2012-06-02 20:39 14298944 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2012-05-15 10:48 . 2012-03-29 20:36 68928 ----a-w- c:\windows\system32\OpenCL.dll
2012-05-15 10:48 . 2012-03-29 20:36 61248 ----a-w- c:\windows\SysWow64\OpenCL.dll
2012-05-15 10:48 . 2012-03-29 20:36 1738048 ----a-w- c:\windows\system32\nvdispco64.dll
2012-05-15 10:48 . 2012-03-29 20:36 1468224 ----a-w- c:\windows\system32\nvgenco64.dll
2012-05-15 10:48 . 2011-05-21 11:01 8105280 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2012-05-15 10:48 . 2010-12-21 05:47 10194752 ----a-w- c:\windows\system32\nvwgf2umx.dll
2012-05-15 09:29 . 2010-10-16 18:13 889664 ----a-w- c:\windows\system32\nvvsvc.exe
2012-05-15 09:29 . 2010-10-16 18:13 118080 ----a-w- c:\windows\system32\nvmctray.dll
2012-05-15 09:29 . 2009-07-14 18:08 63296 ----a-w- c:\windows\system32\nvshext.dll
2012-05-15 09:29 . 2012-06-02 20:22 2621723 ----a-w- c:\windows\system32\nvcoproc.bin
2012-05-15 09:29 . 2010-10-16 18:13 3149632 ----a-w- c:\windows\system32\nvsvc64.dll
2012-05-15 09:28 . 2010-10-16 18:13 6151488 ----a-w- c:\windows\system32\nvcpl.dll
2012-05-15 06:21 . 2012-05-15 06:21 423744 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2012-05-05 21:28 . 2012-05-05 21:28 544032 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-05-05 21:28 . 2012-05-05 21:28 525600 ----a-w- c:\windows\system32\deployJava1.dll
2012-05-05 21:05 . 2012-05-05 21:05 476960 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2012-05-05 21:05 . 2010-05-10 17:50 472864 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-04-18 17:08 . 2012-06-02 20:39 31040 ----a-w- c:\windows\system32\nvhdap64.dll
2012-04-18 17:08 . 2012-06-02 20:39 188736 ----a-w- c:\windows\system32\drivers\nvhda64v.sys
2012-04-18 17:08 . 2012-06-02 20:39 1451840 ----a-w- c:\windows\system32\nvhdagenco6420103.dll
2008-11-21 04:44 . 2008-11-21 04:43 1389235809 ----a-w- c:\program files\Blackout RO Game Client [0824].exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2010-11-20 163328]
"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152]
"PWRISOVM.EXE"="c:\program files (x86)\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"TkBellExe"="c:\program files (x86)\real\realplayer\update\realsched.exe" [2011-11-09 273528]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\prwntdrv]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-05-03 158856]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-18 113120]
R3 netr28ux;Belkin Wireless Adapter Driver;c:\windows\system32\DRIVERS\netr28ux.sys [2011-12-17 1675840]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-21 98688]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2009-08-27 18216]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-18 1255736]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-03-10 834544]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 cpuz133;cpuz133;c:\windows\system32\drivers\cpuz133_x64.sys [2010-03-31 20968]
S2 inpoutx64;inpoutx64;c:\windows\system32\Drivers\inpoutx64.sys [2012-05-22 15008]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-05-15 1262400]
S2 RalinkRegistryWriter64;Ralink Registry Writer 64;c:\program files (x86)\Belkin\F9L1103\v1\Common\RaRegistry64.exe [2011-11-22 451936]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-05-15 382272]
S2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2009-11-24 5521192]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2012-04-18 188736]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 15:31]
.
2010-12-21 c:\windows\Tasks\WebReg Officejet 7300 series.job
- c:\program files (x86)\HP\Digital Imaging\bin\hpqwrg.exe [2006-12-11 02:36]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 13:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 13:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 13:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 13:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 13:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 13:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 13:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 13:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 13:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.yahoo.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: aol.com\*.aimexpress
Trusted Zone: aol.com\aimexpress
Trusted Zone: blackout-gaming.net\cp
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Carlos\AppData\Roaming\Mozilla\Firefox\Profiles\mvurx7rq.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-0i763f66bz - c:\users\Carlos\0i763f66bz.exe
SafeBoot-MsMpSvc
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-dBpowerAMP Music Converter - c:\windows\system32\SpoonUninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-385827607-1593914869-2355075119-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*2“]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-385827607-1593914869-2355075119-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*2“\OpenWithList]
@Class="Shell"
"a"="editdisk.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-385827607-1593914869-2355075119-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*2“]
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
"0"=hex:71,67,b9,65,01,5c,54,9b,2e,00,32,93,00,00,66,00,36,00,00,00,00,00,00,
00,00,00,00,00,71,67,b9,65,01,5c,54,9b,2e,00,32,93,2e,00,6c,00,6e,00,6b,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Belkin\F9L1103\v1\Common\RaRegistry.exe
c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
.
**************************************************************************
.
Completion time: 2012-07-04 01:14:36 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-04 05:14
.
Pre-Run: 70,278,590,464 bytes free
Post-Run: 70,097,518,592 bytes free
.
- - End Of File - - CB5BDB7D064FAFAC5D758A3DF77262DA
 
You got it now :)

Any current issues?

==========================================

Download Malwarebytes' Anti-Malware (MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.
NOTE. If you already have MBAM installed, update it before running the scan.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

======================================

Download OTL to your Desktop.

  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Click the Scan All Users checkbox.
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
 
The firewall seems to be working and haven't heard the sounds in a long time so far
However, Windows Security Essentials continues to say it does not exist as an installed service.

Had to upload the OTL and Extras because of the character limit.

Malware log:

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.07.04.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Carlos :: DIEGO [administrator]

7/4/2012 1:01:41 PM
mbam-log-2012-07-04 (13-01-41).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 262410
Time elapsed: 4 minute(s), 48 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
 

Attachments

  • Extras.Txt
    84.6 KB · Views: 1
  • OTL.Txt
    110.2 KB · Views: 1
Reinstall MSE.

Please observe forum rules:
All required logs have to be PASTED. Attached logs will NOT be reviewed.

If a log or logs exceed the limit for one reply, you may use more than one reply. The above rule will be strictly enforced.

Pasted logs can be handled easier and faster by malware helper.
Click to expand...
 
Ahh my apologizes then
OTL log part 1:


OTL logfile created on: 7/4/2012 1:08:35 PM - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\Carlos\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.11 Gb Available Physical Memory | 52.74% Memory free
8.00 Gb Paging File | 5.88 Gb Available in Paging File | 73.51% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465.76 Gb Total Space | 65.19 Gb Free Space | 14.00% Space Free | Partition Type: NTFS

Computer Name: DIEGO | User Name: Carlos | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/07/04 13:07:01 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Carlos\Desktop\OTL.exe
PRC - [2012/06/23 11:30:10 | 001,535,176 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe
PRC - [2012/06/18 10:34:58 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012/05/15 06:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012/05/15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2011/11/22 17:31:38 | 000,374,112 | ---- | M] (Ralink Technology, Corp.) -- C:\Program Files (x86)\Belkin\F9L1103\v1\Common\RaRegistry.exe
PRC - [2011/11/08 23:17:11 | 000,273,528 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\real\realplayer\Update\realsched.exe
PRC - [2010/04/12 04:40:16 | 000,180,224 | ---- | M] (PowerISO Computing, Inc.) -- C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe


========== Modules (No Company Name) ==========

MOD - [2012/06/23 11:30:10 | 009,459,912 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll
MOD - [2012/06/18 10:34:57 | 002,042,848 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2012/05/15 02:21:26 | 000,368,448 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll
MOD - [2011/11/02 00:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/11/02 00:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/05/09 18:40:56 | 000,958,976 | ---- | M] () -- C:\Program Files (x86)\SplitMediaLabs\XSplit\avformat-53.dll
MOD - [2011/05/09 18:40:56 | 000,239,616 | ---- | M] () -- C:\Program Files (x86)\SplitMediaLabs\XSplit\swscale-0.dll
MOD - [2011/05/09 18:40:54 | 007,006,208 | ---- | M] () -- C:\Program Files (x86)\SplitMediaLabs\XSplit\avcodec-53.dll
MOD - [2011/05/09 18:40:54 | 000,132,096 | ---- | M] () -- C:\Program Files (x86)\SplitMediaLabs\XSplit\avutil-51.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2012/03/26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2009/11/24 15:25:32 | 005,521,192 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Windows\SysNative\Wacom_Tablet.exe -- (TabletServiceWacom)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2012/06/23 11:31:21 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/06/20 08:00:24 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012/06/18 10:34:57 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/05/15 06:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012/05/15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012/05/03 08:34:50 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011/11/22 17:31:38 | 000,451,936 | ---- | M] (Ralink Technology, Corp.) [Auto | Running] -- C:\Program Files (x86)\Belkin\F9L1103\v1\Common\RaRegistry64.exe -- (RalinkRegistryWriter64)
SRV - [2011/11/22 17:31:38 | 000,374,112 | ---- | M] (Ralink Technology, Corp.) [Auto | Running] -- C:\Program Files (x86)\Belkin\F9L1103\v1\Common\RaRegistry.exe -- (RalinkRegistryWriter)
SRV - [2010/06/08 10:45:43 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/19 19:30:16 | 000,067,360 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2009/10/29 02:02:00 | 003,407,292 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/03/25 21:23:58 | 000,894,976 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/05/22 01:30:39 | 000,015,008 | ---- | M] (Highresolution Enterprises [www.highrez.co.uk]) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\inpoutx64.sys -- (inpoutx64)
DRV:64bit: - [2012/04/18 13:08:03 | 000,188,736 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012/03/20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2012/03/01 02:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/12/16 22:17:40 | 001,675,840 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netr28ux.sys -- (netr28ux)
DRV:64bit: - [2011/06/10 07:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011/03/11 02:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 02:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 09:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 07:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/04/12 04:55:00 | 000,091,568 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\scdemu.sys -- (SCDEmu)
DRV:64bit: - [2010/03/30 23:35:04 | 000,020,968 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\cpuz133_x64.sys -- (cpuz133)
DRV:64bit: - [2010/03/10 14:01:40 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2009/08/27 18:06:34 | 000,018,216 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wacmoumonitor.sys -- (wacmoumonitor)
DRV:64bit: - [2009/07/28 18:29:29 | 000,033,344 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/20 14:54:06 | 000,015,656 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wacomvhid.sys -- (wacomvhid)
DRV:64bit: - [2009/05/18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009/03/06 09:06:18 | 000,197,120 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rtlh64.sys -- (RTL8169)
DRV:64bit: - [2007/02/16 14:12:36 | 000,012,848 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV - [2009/07/13 21:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-385827607-1593914869-2355075119-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKU\S-1-5-21-385827607-1593914869-2355075119-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-385827607-1593914869-2355075119-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-385827607-1593914869-2355075119-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-385827607-1593914869-2355075119-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-385827607-1593914869-2355075119-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.9.9
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: [email protected]:3.3.2.1
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@parallelgraphics.com/Cortona: C:\Program Files (x86)\Common Files\ParallelGraphics\Cortona\npcortona.dll (ParallelGraphics)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.669: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.669: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: c:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKCU\Software\MozillaPlugins\BYOND: C:\Program Files (x86)\BYOND\bin\npbyond.dll (BYOND)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/11/08 23:17:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/06/18 10:34:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/05/05 17:05:21 | 000,000,000 | ---D | M]

[2010/06/16 13:10:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Carlos\AppData\Roaming\mozilla\Extensions
[2012/07/03 22:04:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Carlos\AppData\Roaming\mozilla\Firefox\Profiles\mvurx7rq.default\extensions
[2010/06/16 13:10:15 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Carlos\AppData\Roaming\mozilla\Firefox\Profiles\mvurx7rq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/05/30 17:22:47 | 000,000,000 | ---D | M] (ST-Eng7 Community Toolbar) -- C:\Users\Carlos\AppData\Roaming\mozilla\Firefox\Profiles\mvurx7rq.default\extensions\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}
[2012/04/21 12:44:27 | 000,000,000 | ---D | M] (ChatZilla) -- C:\Users\Carlos\AppData\Roaming\mozilla\Firefox\Profiles\mvurx7rq.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
[2011/03/25 09:59:14 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Carlos\AppData\Roaming\mozilla\Firefox\Profiles\mvurx7rq.default\extensions\[email protected]
[2012/05/11 01:45:59 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/05/30 16:22:26 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/06/29 09:35:31 | 000,525,327 | ---- | M] () (No name found) -- C:\USERS\CARLOS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MVURX7RQ.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
[2012/07/03 22:04:36 | 000,340,684 | ---- | M] () (No name found) -- C:\USERS\CARLOS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MVURX7RQ.DEFAULT\EXTENSIONS\{A7C6CF7F-112C-4500-A7EA-39801A327E5F}.XPI
[2012/06/18 10:34:58 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/06/07 10:08:21 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/06/07 10:08:21 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/07/04 01:05:03 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-385827607-1593914869-2355075119-1000..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-21-385827607-1593914869-2355075119-1006..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-385827607-1593914869-2355075119-1006..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-385827607-1593914869-2355075119-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-385827607-1593914869-2355075119-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-385827607-1593914869-2355075119-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-385827607-1593914869-2355075119-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-385827607-1593914869-2355075119-1000\..Trusted Domains: aol.com ([*.aimexpress] https in Trusted sites)
O15 - HKU\S-1-5-21-385827607-1593914869-2355075119-1000\..Trusted Domains: aol.com ([aimexpress] https in Trusted sites)
O15 - HKU\S-1-5-21-385827607-1593914869-2355075119-1000\..Trusted Domains: blackout-gaming.net ([cp] https in Trusted sites)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} http://photoservices.van.fedex.com/skins/fxk/resources/software/ImageUploader4.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4ADA9D33-66A8-46C8-9B91-BE40C8997440}: DhcpNameServer = 24.178.162.3 66.189.0.100 24.217.201.67
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F3B418AE-D901-45C4-873E-274469B88972}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O24 - Desktop WallPaper: C:\Users\Carlos\Downloads\kasumik1.jpg
O24 - Desktop BackupWallPaper: C:\Users\Carlos\Downloads\kasumik1.jpg
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========

[2012/07/04 13:07:00 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Carlos\Desktop\OTL.exe
[2012/07/04 01:17:52 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{C0FF6126-ABEE-43A3-A0DD-705991575A22}
[2012/07/04 01:17:40 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{FFEE6E19-E4D0-42CF-9976-1DECE703413C}
[2012/07/04 01:05:06 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2012/07/04 00:43:31 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/07/04 00:43:31 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/07/04 00:43:31 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/07/03 23:22:26 | 004,568,951 | R--- | C] (Swearware) -- C:\Users\Carlos\Desktop\ComboFix.exe
[2012/07/03 22:12:53 | 000,000,000 | ---D | C] -- C:\FRST
[2012/07/03 10:56:33 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{50A56ABD-182E-41F9-A468-A8AAEA3C46B8}
[2012/07/03 10:56:22 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{0CCD1172-2775-47A0-8BA1-B5D958C7D2F5}
[2012/07/02 22:52:41 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{A3A479C8-DE3B-4CBD-8256-24E2D18E7C03}
[2012/07/02 22:52:30 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{FB9406C0-5ED3-4600-B4AB-CEDDAD7F32C7}
[2012/07/02 13:20:40 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/07/02 13:20:36 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012/07/02 10:52:04 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{A7A1CE4D-0BC7-42B7-8785-EF0C64F0D8DD}
[2012/07/02 10:51:53 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{0BB7AC93-42F7-4DC1-B8CC-6064DC8356CD}
[2012/07/01 22:51:26 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{7C9DA5E3-96A7-4261-AA35-CA096A6F5294}
[2012/07/01 22:51:15 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{C5BFECCE-17B3-4CF7-8013-0AA59E8761BF}
[2012/07/01 10:50:59 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{D0D6AF60-E3E0-44F2-AC6B-3ABECB50CD04}
[2012/07/01 10:50:46 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{CFF61F80-79D7-4FEE-8B7F-7E0B84973207}
[2012/06/30 22:27:37 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{050238AC-665C-44C9-8141-55109AF8FFB2}
[2012/06/30 22:27:26 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{061C8D3B-C540-47DD-900D-B8BD3EACEDD8}
[2012/06/30 10:27:12 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{846DDCB7-FCBF-440F-B526-6C383D81215C}
[2012/06/30 10:27:01 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{78AD8AAC-B6D4-4DAA-95DB-CA28C6AEE0BF}
[2012/06/29 22:26:33 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{1DEBABCC-0645-4218-BF46-3955BF7C738A}
[2012/06/29 22:26:21 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{B1AE387A-D42E-47FC-84BB-07B9B8E91045}
[2012/06/29 10:26:08 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{3D4F756E-CACC-46FF-BE90-F4300188908C}
[2012/06/29 10:25:57 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{E17F65C7-EE4C-458E-9BA8-F428F1F0E913}
[2012/06/28 22:25:30 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{A596E329-FE68-4FC1-8FDF-5117AD6CAE8F}
[2012/06/28 22:25:19 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{395AE415-FB10-4959-BDBE-DB2F68854D93}
[2012/06/28 10:24:51 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{4194A6D9-EE63-48D6-BBB9-A1853634875D}
[2012/06/28 10:24:28 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{5D5CC49C-5347-4E68-B14A-8B6F8A64E598}
[2012/06/27 22:23:59 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{98D721EC-CD19-4939-A570-DE56507CC399}
[2012/06/27 10:23:20 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{272D91CC-B551-4B8B-BCF6-3FB4744214F0}
[2012/06/27 10:22:57 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{3BB47CD0-16CB-40B6-B45C-2AA7C2916D8D}
[2012/06/26 22:22:31 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{51DCC8AA-A830-45CD-9944-ED2A8A594812}
[2012/06/26 22:22:09 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{99307A59-BF99-4C3F-A306-97CD244571A1}
[2012/06/26 10:21:43 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{4A1BC596-BD9D-4895-B04B-E8A06F4E1367}
[2012/06/26 10:21:21 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{F9B4269E-BA96-481F-811C-B0A85779770D}
[2012/06/25 22:20:53 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{4DAC7DF7-7C93-40C0-9C9E-3BAE401FBDD5}
[2012/06/25 22:20:31 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{5DD2BB67-C7B4-4A9B-A75C-C198703AC01A}
[2012/06/25 10:20:17 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{55E60FCA-F759-48FB-9F69-FD8401B0C022}
[2012/06/25 10:19:55 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{EFFFB26C-FB73-4C51-9EF1-09859ECB253C}
[2012/06/24 22:19:28 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{843A9C73-9DA4-467E-9C32-FFA8E8498724}
[2012/06/24 22:19:06 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{3F8C297D-BAE0-4FC9-852B-CFD44D6B8E1D}
[2012/06/24 10:18:39 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{90558A72-339E-4D77-B955-69A68E611C19}
[2012/06/24 10:18:27 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{E37FFF4E-2DDB-4A50-894B-FAAE556CABD6}
[2012/06/23 22:18:00 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{67873581-29DC-445F-A99B-A7D53581DF3E}
[2012/06/23 22:17:49 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{87FC6A0D-7432-4226-B622-FAFBEDF8650B}
[2012/06/23 10:17:20 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{4352480B-5E26-4882-8520-A610C6230C58}
[2012/06/23 10:17:07 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{B51B0FFE-5D37-42A1-9740-7AD9376A826A}
[2012/06/23 01:09:33 | 000,000,000 | -HSD | C] -- C:\Windows\SysNative\%APPDATA%
[2012/06/22 22:04:25 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{16778133-6A07-4D7F-8E07-16B50483B186}
[2012/06/22 22:04:12 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{9B57D155-ACC9-4258-ABAC-D2A77D590DA8}
[2012/06/22 10:03:58 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{369B6ECE-A765-44CA-A9D4-AA11795E3C53}
[2012/06/22 10:03:46 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{B912EDAD-1770-4352-B61F-1102C54ED898}
[2012/06/21 22:03:18 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{50505B50-1A50-4726-AB63-C5A747991AF4}
[2012/06/21 22:03:06 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{C7B4A9A6-17C5-4C5B-B58F-26A4F97BB06F}
[2012/06/21 10:02:52 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{F2CFF39D-747E-4EF8-9FBF-8C48F71AB09C}
[2012/06/21 10:02:41 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{61BC137F-DD1F-405E-B0C7-C550201787F3}
[2012/06/20 22:02:12 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{E05C0359-B168-42FC-B3BA-16EB6F4D89E0}
[2012/06/20 22:01:59 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{DE5C7823-37FA-4CB4-AF72-49614F619A94}
[2012/06/20 10:01:45 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{5482445B-6241-40B1-872E-CDAA84D39CA3}
[2012/06/20 10:01:34 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{093F8D80-5659-4D3E-8569-425FD603A441}
[2012/06/19 22:01:06 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{619A4459-9AE5-46A6-A8B6-5F07E7C1A642}
[2012/06/19 22:00:53 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{12A52148-1C4E-47AE-9EDA-108AAFEE3F02}
[2012/06/19 10:00:39 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{2A878910-3777-4615-A765-D2BEAE4A3E60}
[2012/06/19 10:00:28 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{1FFF8EEB-F4CE-41EB-B6C8-5B6AB22873AD}
[2012/06/18 21:59:55 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{0D124C6D-3286-4AB9-9FB2-104ECB20284F}
[2012/06/18 21:59:43 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{41C8FEA3-8350-4B03-950B-7525FFBADB34}
[2012/06/18 09:59:31 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{2BA8F88C-4ABE-4FE3-9464-86D64059E544}
[2012/06/17 22:00:01 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\Macromedia
[2012/06/17 21:49:08 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{E01876B6-B5A4-4E6E-8153-3E2BCE616C5E}
[2012/06/17 09:48:54 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{DBF12B65-B76A-4BE4-AF76-4E00E162749B}
[2012/06/16 21:48:22 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{769D054D-1EBF-4DC5-9200-9B93920D1FAC}
[2012/06/16 09:47:57 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{99D9648B-B0C6-44C9-B436-FB813B8D6B40}
[2012/06/15 21:41:41 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{F29650C5-BA69-4E42-8BA7-2CE1B0F44628}
[2012/06/15 09:41:05 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{55900A0D-D9CE-48F0-8107-A01B4DA3572A}
[2012/06/14 21:40:29 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{21146C11-D068-4A3C-BD14-67657F10C34E}
[2012/06/14 09:40:12 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{A06DA23C-DBC6-429A-82F2-F2B51807E103}
[2012/06/14 09:39:46 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{E2928178-ED64-409E-839A-691FA92156C3}
[2012/06/13 21:35:08 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{1CFD7F87-EE43-4C38-9561-23C7D57859ED}
[2012/06/13 21:34:45 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{45366686-94F2-4480-B2D9-701BA6F2C07C}
[2012/06/13 09:34:24 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{2DF9603F-904E-4B9F-89BC-10B18A52202D}
[2012/06/13 09:33:59 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{E1A97B1E-47C5-4CA0-813F-106B56EBAD12}
[2012/06/12 21:21:19 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{1ECDF240-AC25-4810-8EDD-84DEBE0CD77F}
[2012/06/12 09:20:37 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{23A0B06D-BD58-4DC8-B070-6C691C796568}
[2012/06/12 09:19:45 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{E2BC1F30-5C45-4072-BE4E-0E7F2B330674}
[2012/06/11 16:26:18 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{1FBD0E5D-5DC9-4146-8876-0601B545CFFD}
[2012/06/11 16:25:05 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{5C477F20-BBD6-478D-A4F7-8DAB88EF7F5B}
[2012/06/10 22:34:12 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{F5E57EBD-25CB-4686-BB2C-8D2CFE6079DA}
[2012/06/10 22:34:00 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{1B07C986-C836-4687-8C2B-BAB4A58A90D0}
[2012/06/10 10:33:46 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{AE49D1AA-1B32-4E1D-A1EE-FCFEBB122618}
[2012/06/10 10:33:34 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{28B4370B-182C-43AF-AF69-663E6E543AF8}
[2012/06/09 22:33:07 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{CDC8D8C3-2EB5-4A09-96D0-D637B18EC7F5}
[2012/06/09 22:32:56 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{F31FA3F6-5169-4066-B353-F2940CD8D9A3}
[2012/06/09 19:55:17 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Roaming\Gensokyo.org
[2012/06/09 10:32:42 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{4DAFDEDD-361C-4524-B45D-D2F4E1168862}
[2012/06/09 10:32:31 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{F7901265-8317-4F98-A94D-DAE5C7FFE9DB}
[2012/06/08 23:59:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/06/08 23:58:40 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012/06/08 23:58:39 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012/06/08 23:58:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2012/06/08 22:32:04 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{E400AC3F-1DFB-4987-8357-CBA63F17BBAB}
[2012/06/08 22:31:53 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{091B2036-E6C6-4748-BF58-D434BBB00855}
[2012/06/08 10:31:39 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{45CF9F66-95A7-4100-B834-C819841E1CA0}
[2012/06/08 10:31:27 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{2BCB0C3D-E4EF-481D-B19A-275CC4865D64}
[2012/06/07 22:30:59 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{2AE24939-56F2-4D9D-80C5-04191DB3F6F6}
[2012/06/07 22:30:48 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{59BDA837-3A4F-467F-90D3-EE87F82CF285}
[2012/06/07 10:30:34 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{E369C4E2-E8D9-4492-AFD9-51A99EE66F21}
[2012/06/07 10:30:23 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{1701314C-9CCB-43F4-8856-8DD165EB1E82}
[2012/06/06 22:29:55 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{0095D850-1866-44EF-A021-D611584D425F}
[2012/06/06 22:29:43 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{CAF36263-1AAA-4D71-810E-6C9830EB525A}
[2012/06/06 10:29:30 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{0ED4525C-D4AA-4619-8216-827CCB0B7AB1}
[2012/06/06 10:29:19 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{45AC9A1C-4CB6-4A03-AD05-5A194F714C88}
[2012/06/05 22:28:53 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{8FDCA22C-6683-402D-920E-208B3BF06C83}
[2012/06/05 22:28:41 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{DB905604-F3C5-4BAD-9E3A-35B9D491A1D7}
[2012/06/05 10:28:15 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{F6D328D0-40A4-40AF-B67F-9DDBF5456A99}
[2012/06/05 10:28:03 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{56211B06-75B4-4CA3-8002-48BD06D1E891}
[2012/06/04 22:27:35 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{77F77F72-3DB8-4F7E-BC37-B9DB42046B5A}
[2012/06/04 22:27:23 | 000,000,000 | ---D | C] -- C:\Users\Carlos\AppData\Local\{D6724278-C353-4007-9B6B-7C13B027DB86}
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/04 13:07:01 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Carlos\Desktop\OTL.exe
[2012/07/04 12:30:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/07/04 10:25:47 | 000,010,048 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/04 10:25:47 | 000,010,048 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/04 10:16:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/07/04 10:16:54 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys
[2012/07/04 01:05:03 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012/07/04 01:04:58 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2012/07/03 23:22:30 | 004,568,951 | R--- | M] (Swearware) -- C:\Users\Carlos\Desktop\ComboFix.exe
[2012/07/03 17:53:59 | 000,806,224 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/07/03 17:53:59 | 000,678,238 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/07/03 17:53:59 | 000,129,066 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/06/28 11:49:31 | 000,326,235 | ---- | M] () -- C:\Users\Carlos\Desktop\CPRCard1.JPG
[2012/06/28 11:48:40 | 000,262,289 | ---- | M] () -- C:\Users\Carlos\Desktop\Cert1.png
[2012/06/25 14:11:49 | 000,013,991 | ---- | M] () -- C:\Users\Carlos\.recently-used.xbel
[2012/06/23 14:43:26 | 001,012,656 | ---- | M] () -- C:\Users\Carlos\Desktop\rkill.exe
[2012/06/23 14:36:12 | 000,002,198 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012/06/23 14:34:20 | 000,000,378 | ---- | M] () -- C:\Windows\SysNative\Wacom_Tablet.dat
[2012/06/23 12:34:53 | 541,988,766 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/06/19 19:23:11 | 015,565,619 | ---- | M] () -- C:\Users\Carlos\Desktop\pvk_fort_sand_fox.rar
[2012/06/19 19:22:18 | 000,340,670 | ---- | M] () -- C:\Users\Carlos\Desktop\pvk_hellpit.zip
[2012/06/19 19:21:59 | 002,417,652 | ---- | M] () -- C:\Users\Carlos\Desktop\surf school.zip
[2012/06/19 19:21:32 | 002,234,646 | ---- | M] () -- C:\Users\Carlos\Desktop\pvk molten.zip
[2012/06/19 19:21:12 | 011,979,751 | ---- | M] () -- C:\Users\Carlos\Desktop\pvk_parrot-play-house.zip
[2012/06/19 19:21:12 | 000,202,882 | ---- | M] () -- C:\Users\Carlos\Desktop\pvk_shooting_range.rar
[2012/06/19 19:20:35 | 004,277,269 | ---- | M] () -- C:\Users\Carlos\Desktop\pvk_orchard.zip
[2012/06/19 19:20:04 | 001,005,752 | ---- | M] () -- C:\Users\Carlos\Desktop\pvk_tourny_archeryrange_beta2.rar
[2012/06/19 19:19:22 | 014,649,411 | ---- | M] () -- C:\Users\Carlos\Desktop\Hg_UnderWorld_b4.rar
[2012/06/19 19:19:12 | 001,479,931 | ---- | M] () -- C:\Users\Carlos\Desktop\pvk_vikingraid.zip
[2012/06/19 19:18:41 | 008,251,234 | ---- | M] () -- C:\Users\Carlos\Desktop\zm_miniature_room_v1.rar
[2012/06/19 19:17:53 | 006,161,782 | ---- | M] () -- C:\Users\Carlos\Desktop\Pvk_warbots_beta1.rar
[2012/06/19 19:17:23 | 003,292,809 | ---- | M] () -- C:\Users\Carlos\Desktop\pvk_seas_day_beta.rar
[2012/06/19 19:16:03 | 013,817,392 | ---- | M] () -- C:\Users\Carlos\Desktop\pvk_rush_beta1.zip
[2012/06/19 19:15:23 | 007,642,216 | ---- | M] () -- C:\Users\Carlos\Desktop\pvk_ruins_b1.zip
[2012/06/19 19:14:23 | 000,624,400 | ---- | M] () -- C:\Users\Carlos\Desktop\pvk_iceland_b1.zip
[2012/06/19 19:13:55 | 000,384,572 | ---- | M] () -- C:\Users\Carlos\Desktop\pvk shore b1.zip
[2012/06/19 19:13:23 | 005,613,590 | ---- | M] () -- C:\Users\Carlos\Desktop\pvk_pact_beta6.zip
[2012/06/19 19:12:52 | 000,006,492 | ---- | M] () -- C:\Users\Carlos\Desktop\pvk_trillian_beta18.rar
[2012/06/19 19:12:33 | 007,798,043 | ---- | M] () -- C:\Users\Carlos\Desktop\pvk_rumble_beta11.rar
[2012/06/16 20:56:39 | 000,023,080 | ---- | M] () -- C:\Users\Carlos\Desktop\Pomf2Resize.jpg
[2012/06/14 09:36:01 | 000,435,560 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/06/12 23:25:04 | 000,007,597 | ---- | M] () -- C:\Users\Carlos\AppData\Local\Resmon.ResmonCfg
[2012/06/11 20:57:27 | 000,065,746 | ---- | M] () -- C:\Users\Carlos\Desktop\[Elysium]To.Aru.Kagaku.no.Railgun(BD.1080p.FLAC).torrent
[2012/06/08 23:59:42 | 000,001,783 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/04 00:43:31 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/07/04 00:43:31 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/07/04 00:43:31 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/07/04 00:43:31 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/07/04 00:43:31 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/06/28 11:48:39 | 000,262,289 | ---- | C] () -- C:\Users\Carlos\Desktop\Cert1.png
[2012/06/28 11:45:55 | 000,326,235 | ---- | C] () -- C:\Users\Carlos\Desktop\CPRCard1.JPG
[2012/06/25 14:11:49 | 000,013,991 | ---- | C] () -- C:\Users\Carlos\.recently-used.xbel
[2012/06/23 14:43:24 | 001,012,656 | ---- | C] () -- C:\Users\Carlos\Desktop\rkill.exe
[2012/06/20 07:42:07 | 000,000,830 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/19 19:22:41 | 015,565,619 | ---- | C] () -- C:\Users\Carlos\Desktop\pvk_fort_sand_fox.rar
[2012/06/19 19:22:18 | 000,340,670 | ---- | C] () -- C:\Users\Carlos\Desktop\pvk_hellpit.zip
[2012/06/19 19:21:57 | 002,417,652 | ---- | C] () -- C:\Users\Carlos\Desktop\surf school.zip
[2012/06/19 19:21:29 | 002,234,646 | ---- | C] () -- C:\Users\Carlos\Desktop\pvk molten.zip
[2012/06/19 19:21:12 | 000,202,882 | ---- | C] () -- C:\Users\Carlos\Desktop\pvk_shooting_range.rar
[2012/06/19 19:20:49 | 011,979,751 | ---- | C] () -- C:\Users\Carlos\Desktop\pvk_parrot-play-house.zip
[2012/06/19 19:20:28 | 004,277,269 | ---- | C] () -- C:\Users\Carlos\Desktop\pvk_orchard.zip
[2012/06/19 19:20:03 | 001,005,752 | ---- | C] () -- C:\Users\Carlos\Desktop\pvk_tourny_archeryrange_beta2.rar
[2012/06/19 19:19:11 | 001,479,931 | ---- | C] () -- C:\Users\Carlos\Desktop\pvk_vikingraid.zip
[2012/06/19 19:18:54 | 014,649,411 | ---- | C] () -- C:\Users\Carlos\Desktop\Hg_UnderWorld_b4.rar
[2012/06/19 19:18:30 | 008,251,234 | ---- | C] () -- C:\Users\Carlos\Desktop\zm_miniature_room_v1.rar
[2012/06/19 19:17:44 | 006,161,782 | ---- | C] () -- C:\Users\Carlos\Desktop\Pvk_warbots_beta1.rar
[2012/06/19 19:17:19 | 003,292,809 | ---- | C] () -- C:\Users\Carlos\Desktop\pvk_seas_day_beta.rar
[2012/06/19 19:15:38 | 013,817,392 | ---- | C] () -- C:\Users\Carlos\Desktop\pvk_rush_beta1.zip
[2012/06/19 19:15:07 | 007,642,216 | ---- | C] () -- C:\Users\Carlos\Desktop\pvk_ruins_b1.zip
[2012/06/19 19:14:23 | 000,624,400 | ---- | C] () -- C:\Users\Carlos\Desktop\pvk_iceland_b1.zip
[2012/06/19 19:13:55 | 000,384,572 | ---- | C] () -- C:\Users\Carlos\Desktop\pvk shore b1.zip
[2012/06/19 19:13:15 | 005,613,590 | ---- | C] () -- C:\Users\Carlos\Desktop\pvk_pact_beta6.zip
[2012/06/19 19:12:52 | 000,006,492 | ---- | C] () -- C:\Users\Carlos\Desktop\pvk_trillian_beta18.rar
[2012/06/19 19:12:25 | 007,798,043 | ---- | C] () -- C:\Users\Carlos\Desktop\pvk_rumble_beta11.rar
[2012/06/16 21:35:17 | 000,023,080 | ---- | C] () -- C:\Users\Carlos\Desktop\Pomf2Resize.jpg
[2012/06/11 20:57:19 | 000,065,746 | ---- | C] () -- C:\Users\Carlos\Desktop\[Elysium]To.Aru.Kagaku.no.Railgun(BD.1080p.FLAC).torrent
[2012/06/08 23:59:42 | 000,001,783 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012/05/15 02:21:50 | 000,423,744 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2012/03/01 11:00:55 | 000,014,119 | ---- | C] () -- C:\Windows\SysWow64\RaCoInst.dat
[2012/02/12 22:17:20 | 000,000,451 | ---- | C] () -- C:\Windows\SysWow64\DiagFunc.ini
[2012/02/12 22:17:19 | 000,792,416 | ---- | C] () -- C:\Windows\SysWow64\DiagFunc.dll
[2012/01/05 12:53:48 | 000,000,085 | ---- | C] () -- C:\Windows\wininit.ini
[2012/01/03 10:54:02 | 000,000,200 | ---- | C] () -- C:\ProgramData\~fsXzeeOQEAxmDvr
[2012/01/03 10:54:01 | 000,000,296 | ---- | C] () -- C:\ProgramData\~fsXzeeOQEAxmDv
[2012/01/03 10:53:49 | 000,000,432 | ---- | C] () -- C:\ProgramData\fsXzeeOQEAxmDv
[2011/09/03 16:29:02 | 000,001,979 | ---- | C] () -- C:\Windows\cdiemu.ini
[2011/07/29 18:30:09 | 000,198,184 | ---- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2011/06/14 00:30:09 | 000,000,017 | ---- | C] () -- C:\Users\Carlos\StencylWorks.prefs
[2011/01/05 19:34:26 | 000,000,048 | ---- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010/10/17 12:28:28 | 000,007,597 | ---- | C] () -- C:\Users\Carlos\AppData\Local\Resmon.ResmonCfg
[2010/10/17 10:54:59 | 000,098,696 | ---- | C] () -- C:\Windows\SysWow64\setupprwdrv03.exe
[2010/10/17 10:54:59 | 000,013,704 | ---- | C] () -- C:\Windows\SysWow64\prwntdrv.sys
[2010/09/02 22:09:03 | 000,000,130 | ---- | C] () -- C:\Users\Carlos\webct_upload_applet.properties
[2010/06/16 13:52:26 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010/02/22 18:24:35 | 001,656,416 | ---- | C] () -- C:\Users\Carlos\ro_dll_files.zip
[2008/11/21 00:43:44 | 1389,235,809 | ---- | C] () -- C:\Program Files\Blackout RO Game Client [0824].exe
[2008/10/21 23:30:16 | 051,320,873 | ---- | C] () -- C:\Program Files (x86)\VBAM.zip

========== LOP Check ==========

[2012/05/05 12:27:55 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\Audacity
[2010/07/24 02:07:31 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\Beat Hazard
[2010/06/16 13:10:03 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\Blender Foundation
[2010/06/16 13:10:03 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\DAEMON Tools Lite
[2010/06/07 21:36:28 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\fltk.org
[2012/06/09 19:55:17 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\Gensokyo.org
[2012/06/25 14:11:49 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\gtk-2.0
[2012/07/02 13:18:52 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\HLSW
[2010/06/16 13:10:03 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\ijjigame
[2010/06/16 13:10:03 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\Image Zone Express
[2011/08/21 01:32:02 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\Image-Line
[2010/06/16 13:10:03 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\ImgBurn
[2011/02/19 15:12:00 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\LolClient
[2012/05/23 09:54:50 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\LolClient2
[2010/07/27 10:33:30 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\Natural Selection 2
[2010/06/16 13:10:15 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\Printer Info Cache
[2012/02/25 11:44:05 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\RotMG.Production
[2012/03/10 15:45:01 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\Rovio
[2011/08/26 10:52:59 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\ShanghaiAlice
[2010/12/05 13:03:55 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\Subversion
[2012/05/05 17:50:28 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\Technofovea
[2012/06/16 19:53:34 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\TS3Client
[2012/06/23 12:33:10 | 000,000,000 | ---D | M] -- C:\Users\Carlos\AppData\Roaming\uTorrent
[2012/05/27 23:57:50 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >
 
Extras log:

OTL Extras logfile created on: 7/4/2012 1:08:35 PM - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\Carlos\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.11 Gb Available Physical Memory | 52.74% Memory free
8.00 Gb Paging File | 5.88 Gb Available in Paging File | 73.51% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465.76 Gb Total Space | 65.19 Gb Free Space | 14.00% Space Free | Partition Type: NTFS

Computer Name: DIEGO | User Name: Carlos | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
.reg[@ = regfile] -- C:\Windows\regedit.exe ()

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.reg [@ = regfile] -- C:\Windows\regedit.exe ()

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [open] -- regedit.exe "%1" ()
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [open] -- regedit.exe "%1" ()
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0294BB2F-6178-459D-8C46-8D1C40D6AD6B}" = rport=445 | protocol=6 | dir=out | app=system |
"{057550CC-1C7E-4C7B-A2F8-3A8DDC978C8C}" = lport=138 | protocol=17 | dir=in | app=system |
"{08E024BB-596A-4DFF-A430-159062EB67CE}" = lport=10243 | protocol=6 | dir=in | app=system |
"{19A5737B-0BEE-43C8-BCD3-3CC714AA4FD3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{25B9D31D-64EC-44F5-900B-17177C3E5D3C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{295EF879-34FC-4A05-A484-51AA1443280E}" = lport=445 | protocol=6 | dir=in | app=system |
"{2FA65B31-3A9D-4C20-AFC6-469495F0EF44}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4084E937-EAAA-47EE-9520-7BE7CE434C09}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4BF5EB07-06A2-40E2-B5B6-244EF5C49A0F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |
"{53297926-AF76-41B4-9F35-1F6463F13863}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{5456EA1E-AF45-48BD-9C96-AB99A6CCF1D9}" = lport=139 | protocol=6 | dir=in | app=system |
"{6364B77A-8796-4078-B3CC-5963A3E70B4F}" = rport=139 | protocol=6 | dir=out | app=system |
"{6EFD3216-D4DB-448C-81DA-E8838C66FFD2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7C7BD74E-D59D-40F9-8481-A74C4729E9DD}" = rport=138 | protocol=17 | dir=out | app=system |
"{86444BB3-291D-4D31-A046-BB4AA3243C28}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A7305170-9C00-45DD-8EDF-09DF1DC64C69}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AF8150A9-8B4A-4262-900E-D368942052B3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BE10AB93-C4A6-464B-BE93-069E778BFF99}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C232D951-55E7-4D04-9346-F88A07FC0B22}" = lport=137 | protocol=17 | dir=in | app=system |
"{C428A183-FD79-40B5-990D-895328F43AC8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CF0676E6-E2EC-438A-9741-7029DEBD00CE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F534D21D-02A4-4E48-A237-A3745ED5E6D3}" = rport=137 | protocol=17 | dir=out | app=system |
"{F9C1EEE5-72B7-40C6-BC7C-64E9DF7DEB39}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{003C7A18-60D9-4C89-94D8-DE42C1AA1D76}" = protocol=58 | dir=in | [email protected],-28545 |
"{02A4D600-582A-4C14-ADFE-C125CF0CB18F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1473D86F-6F04-46A3-9153-CD04272511DC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{4849799C-D8E9-4360-8F9A-6B5F2BCC7EA4}" = protocol=1 | dir=in | [email protected],-28543 |
"{56E808A1-BFD0-4B79-B567-B9FA848D697F}" = protocol=1 | dir=out | [email protected],-28544 |
"{61FB8AD2-C831-45AB-9DFB-D685C3A8300D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{62F27534-2769-4D2F-B42F-E96E62F64F44}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{65901CFC-D156-4C8F-90EA-C26D256CA195}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{68F6992D-6E9D-4F14-88EC-3E0B8BEC7EFF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8642AF85-31DC-4BB3-8E9D-1E478C224084}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A5589677-56C4-46C1-A86B-1F0B5425786F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB3FBA72-52C3-4476-9A38-230DBE05659B}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BC7833D1-AE4B-4CAB-BDD5-6EA587E5C763}" = protocol=6 | dir=out | app=system |
"{CE504808-152F-4073-8BB9-0F8E7C4D30C6}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D3648D1D-2BA3-4973-9B7E-EDC907B6E342}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E8715BB0-E132-4617-B344-62E03BFE2C1C}" = protocol=58 | dir=out | [email protected],-28546 |
"{E926E57D-011D-4F63-BCC5-FFCFDC28D091}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{EFA98652-B437-42AA-B7D3-EFFD71ED4ECD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F7DCF881-DB9D-4779-8D1C-CCCBAC7C73FF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{1153B5CE-763C-4E78-A1A3-FE00364EC163}C:\program files (x86)\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"TCP Query User{29EA0B05-B618-416A-89C8-E666E12BB7EB}C:\program files (x86)\playonline\squareenix\playonlineviewer\pol.exe" = protocol=6 | dir=in | app=c:\program files (x86)\playonline\squareenix\playonlineviewer\pol.exe |
"TCP Query User{58132CD8-26CE-4CDE-9659-DF8759AB3446}C:\program files (x86)\windows live\messenger\msnmsgr.exe" = protocol=6 | dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"TCP Query User{6E4EE7C9-F3E0-4427-863E-6D82F59CCCE7}C:\program files (x86)\windows live\contacts\wlcomm.exe" = protocol=6 | dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"TCP Query User{AF7466DA-22D2-4E47-967E-DFE54DE9FA5F}C:\program files (x86)\pando networks\media booster\pmb.exe" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"UDP Query User{027FE483-DB63-43B7-BCAF-05D1B4D3567F}C:\program files (x86)\playonline\squareenix\playonlineviewer\pol.exe" = protocol=17 | dir=in | app=c:\program files (x86)\playonline\squareenix\playonlineviewer\pol.exe |
"UDP Query User{6C756B10-4743-472A-BAEA-EE6DD5649E9D}C:\program files (x86)\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"UDP Query User{B640C26F-C610-4D19-9F46-A09C38F859CD}C:\program files (x86)\windows live\messenger\msnmsgr.exe" = protocol=17 | dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"UDP Query User{C1D50F12-339A-427D-AEF0-E9C7CA3CA704}C:\program files (x86)\windows live\contacts\wlcomm.exe" = protocol=17 | dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"UDP Query User{C5FDB7E9-F5F7-4433-A1F6-A93868E1304F}C:\program files (x86)\pando networks\media booster\pmb.exe" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86416032FF}" = Java(TM) 6 Update 32 (64-bit)
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{639673E9-D53F-44F4-A046-485C8A6ADA16}" = Paint.NET v3.5.6
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{78F697ED-EC97-4D8D-881D-838984EA9855}" = 64 Bit HP CIO Components Installer
"{818AA386-29D5-4DFF-BBB5-3F16133F1409}" = TortoiseSVN 1.6.12.20536 (64 bit)
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{868EA922-5675-4E91-BDA6-BBD0F923C5EF}" = HP Officejet Pro All-In-One Series
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}" = Microsoft Security Client
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 301.42
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.8.15
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD Audio Driver 1.3.16.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}" = Apple Mobile Device Support
"{CB6508F6-EC50-4829-A2C6-02990EFF0059}" = Windows Media Encoder 9 Series x64 Edition
"{CF8FFD12-602B-422D-AF1D-511B411E7632}" = iTunes
"{DDEDFD63-E430-4b0c-8D61-5E4E7280F027}" = Network64
"{DEACDFFA-D424-416F-B849-FA282F55B2CE}" = Cortona3D Viewer
"{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb" = Microsoft Windows Application Compatibility Database
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Blender" = Blender
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.54
"GCFScape_is1" = GCFScape 1.8.2
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"LameACM" = Lame ACM MP3 Codec
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Security Client" = Microsoft Security Essentials
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"VTFEdit_is1" = VTFEdit 1.3.2
"Windows Media Encoder 9" = Windows Media Encoder 9 Series x64 Edition

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{021C4C4F-C93C-4425-BFFD-C2D16776BFAE}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{07A6B206-3F11-4D92-92A1-90E116ADD660}" = Angry Birds
"{0A55CDBB-0566-4AA2-A15B-24C7F27C6FF4}" = BPD_Scan
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0
"{0E2B767B-EA6A-489B-BF83-8083FE1DB661}" = Pcsx2 0.9.6
"{13A5E785-5197-4EAD-8EE3-D660271E49BC}" = Feedback Tool
"{148E08FF-D7C4-46ED-8D4D-601C67FE0AFD}" = Rosetta Stone Version 3
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{24aab420-4e30-4496-9739-3e216f3de6ae}" = Python 2.6.2
"{2510CF9A-3D92-4D1E-9124-080F53F4E293}" = ILLUSION　@ふぉーむメイト
"{26A24AE4-039D-4CA4-87B4-2F83216032FF}" = Java(TM) 6 Update 32
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}" = Belkin N750 Dual Band Wireless USB Adapter
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{394BE3D9-7F57-4638-A8D1-1D88671913B7}" = Microsoft AppLocale
"{3C0619B4-4A2C-4244-8077-488E420DF907}" = FINAL FANTASY XI: Chains of Promathia
"{47004155-7376-403E-89E9-4C9F44AAF0D0}" = PlayOnline Viewer & Tetra Master
"{486E5025-65BC-4ECE-9C2C-0F51D73060AC}" = Blackout Ragnarok Online
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4FB600F5-C478-4DF7-A2BC-57D3807BAC91}" = BPDSoftware_Ini
"{5104B07C-6A3D-4E7E-8BBB-960B52554BDD}" = BPD_HPSU
"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5A347920-4AFC-11D5-9FB0-800649886934}" = SDFormatter
"{5B037ED7-0755-48D4-9554-808E5AF50F17}" = FINAL FANTASY XI: Wings of the Goddess
"{5D9B17E4-5C34-45B2-9C95-8B9DB4CF7AF3}" = HP_Network_UserGuide
"{61150C85-DC0A-4976-922F-5575F388ADA6}" = Notation Player 2.5.2
"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module
"{662CFD19-EA80-4EFE-A0D8-EE10EFEB3C83}" = Livestream Procaster
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{678F6475-D227-432A-94FF-806178A34520}" = FINAL FANTASY XI
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{6FC76C41-8C1D-4B43-85E7-0BAA2002F1BE}" = FINAL FANTASY XI: Rise of the Zilart
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7F9129B6-C438-4CCB-80CB-A97E9F3B6B8C}" = Taksi Desktop Video Recorder v0.765
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8426BA89-CB8C-4D6C-AF14-3BFDE6C8F425}" = XSplit
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8868D822-2CBA-46B2-A286-B400B6185769}" = 7500_7600_7700_Help
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8F968232-15C6-4872-84C2-9FCDAA1AEAB6}" = MPM
"{90024193-9F13-4877-89D5-A1CDF0CBBF28}" = Feedback Tool
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_PROR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_PROR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_PROR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B88DD94-1AAE-41C4-BD95-2D8737D5E9E2}" = Watson
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{9EBDAF91-DADA-47CE-94F2-F5B004007934}" = System Requirements Lab
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A606C6FF-12E7-40BE-B777-D8F360FF00CD}" = FINAL FANTASY XI: Treasures of Aht Urhgan
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}" = Windows 7 Upgrade Advisor
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A83000000003}" = Adobe Reader 8.3.1
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BA688606-4B20-4982-995E-EDADC6A6817E}" = League of Legends
"{BCC899FE-2DAA-460C-A5FB-60291E73D9C3}" = Microsoft SQL Server Compact 3.5 ENU
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{C3E98E64-683E-4271-9D39-88B1AAB1AE7B}" = L7600
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{C892C691-99DC-4B49-BEAA-65B96BB3460D}" = The Last Starfighter
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D45EC259-4A19-4656-B588-C2C360DD18EA}" = Half-Life(R) 2
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DEB9AEF7-3ADA-40a9-9C98-546D54FE9CBD}" = ProductContext
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{ECAD4F6A-0BF3-4028-9C81-E5D9F9606CBA}" = BPDSoftware
"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.9
"{EEEB604C-C1A7-4f8c-B03F-56F9C1C9C45F}" = Fax
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"“Œ•û_—ì•_ ‘ÌŒ±”Å_is1" = “Œ•û_—ì•_ ‘ÌŒ±”Å ver 0.01a
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"ASIO4ALL" = ASIO4ALL
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.14 (Unicode)
"Beavis And Butt-head" = Beavis And Butt-head
"Blender" = Blender (remove only)
"Build Your Own Net Dream" = Build Your Own Net Dream (remove only)
"CamStudio" = CamStudio
"CCleaner" = CCleaner (remove only)
"dBpowerAMP Music Converter" = dBpowerAMP Music Converter
"DVDFab 7_is1" = DVDFab 7.0.6.2 (20/05/2010)
"EASEUS Data Recovery Wizard Free Edition 5.0.1_is1" = EASEUS Data Recovery Wizard Free Edition 5.0.1
"EASEUS Partition Recovery_is1" = EASEUS Partition Recovery 5.0.1
"Finale NotePad 2008" = Finale NotePad 2008
"FL Studio 10" = FL Studio 10
"Fraps" = Fraps (remove only)
"GunboundWC_is1" = GunboundWC
"GundemoniumRecollection_is1" = GundemoniumRecollection 1.00
"HLSW_is1" = HLSW v1.3.3.7b
"IL Download Manager" = IL Download Manager
"ImgBurn" = ImgBurn
"InstallShield_{3C0619B4-4A2C-4244-8077-488E420DF907}" = FINAL FANTASY XI: Chains of Promathia
"InstallShield_{47004155-7376-403E-89E9-4C9F44AAF0D0}" = PlayOnline Viewer & Tetra Master
"InstallShield_{5B037ED7-0755-48D4-9554-808E5AF50F17}" = FINAL FANTASY XI: Wings of the Goddess
"InstallShield_{678F6475-D227-432A-94FF-806178A34520}" = FINAL FANTASY XI
"InstallShield_{6FC76C41-8C1D-4B43-85E7-0BAA2002F1BE}" = FINAL FANTASY XI: Rise of the Zilart
"InstallShield_{A606C6FF-12E7-40BE-B777-D8F360FF00CD}" = FINAL FANTASY XI: Treasures of Aht Urhgan
"InstallShield_{C892C691-99DC-4B49-BEAA-65B96BB3460D}" = The Last Starfighter
"LAME for Audacity_is1" = LAME v3.98.3 for Audacity
"LameACM" = Lame ACM MP3 Codec
"LOLReplay" = LOLReplay
"Magic Workstation_is1" = Magic Workstation 0.94f
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
"Mozilla Firefox 13.0.1 (x86 en-US)" = Mozilla Firefox 13.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MTG GamePack for Magic Workstation_is1" = MTG GamePack for Magic Workstation
"Natural Selection_is1" = Natural Selection 3.2
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OpenAL" = OpenAL
"PowerISO" = PowerISO
"PROR" = Microsoft Office Professional 2007
"PSXMemTool" = PSXMemTool 1.19b (remove only)
"Raganrok Renewal" = Ragnarok Renewal
"RealPlayer 12.0" = RealPlayer
"Softonic-Eng7 Toolbar" = Softonic-Eng7 Toolbar
"StarCraft" = StarCraft
"Steam App 17570" = Pirates, Vikings, & Knights II
"Steam App 200900" = Cave Story+
"Steam App 207420" = Wizorb
"Steam App 211" = Source SDK
"Steam App 218" = Source SDK Base 2007
"Steam App 23390" = FINAL FANTASY XI: Ultimate Collection
"Steam App 400" = Portal
"Steam App 40800" = Super Meat Boy
"Steam App 440" = Team Fortress 2
"Steam App 4920" = Natural Selection 2
"Steam App 70400" = Recettear: An Item Shop's Tale
"Steam App 70420" = Chantelise
"Steam App 94200" = Jamestown
"Steam App 99900" = Spiral Knights
"StencylWorks" = StencylWorks
"SystemRequirementsLab" = System Requirements Lab
"uTorrent" = µTorrent
"Vista Anti-Lag" = Vista Anti-Lag 1.1.1
"VLC media player" = VLC media player 2.0.1
"Wacom Tablet Driver" = Wacom Tablet
"Wacom WebTabletPlugin for IE" = WebTablet IE Plugin
"Wacom WebTabletPlugin for Netscape" = WebTablet Netscape Plugin
"WinAce Archiver" = WinAce Archiver
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinGTK-2_is1" = GTK+ 2.10.13 runtime environment
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Xvid_is1" = Xvid 1.2.2 final uninstall

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-385827607-1593914869-2355075119-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Shoddy Battle" = Shoddy Battle

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 6/30/2012 9:34:36 PM | Computer Name = Diego | Source = Application Error | ID = 1000
Description = Faulting application name: pol.exe, version: 1.18.13.0, time stamp:
0x4e3bcddc Faulting module name: FFXiMain.dll, version: 3.0.0.0, time stamp: 0x4fd18100
Exception
code: 0xc0000005 Fault offset: 0x001c2458 Faulting process id: 0xc6c Faulting application
start time: 0x01cd56c32803b24c Faulting application path: C:\Program Files (x86)\PlayOnline\SquareEnix\PlayOnlineViewer\pol.exe
Faulting
module path: C:\Program Files (x86)\PlayOnline\SquareEnix\FINAL FANTASY XI\FFXiMain.dll
Report
Id: ea3ed570-c31c-11e1-be44-001d7de92470

Error - 7/1/2012 9:35:14 PM | Computer Name = Diego | Source = Application Error | ID = 1000
Description = Faulting application name: pol.exe, version: 1.18.13.0, time stamp:
0x4e3bcddc Faulting module name: d3d8.dll, version: 6.1.7600.16385, time stamp:
0x4a5bd9a7 Exception code: 0xc0000005 Fault offset: 0x00058eac Faulting process id:
0x1274 Faulting application start time: 0x01cd57996fd5d63a Faulting application path:
C:\Program Files (x86)\PlayOnline\SquareEnix\PlayOnlineViewer\pol.exe Faulting module
path: C:\Windows\system32\d3d8.dll Report Id: 2b67b4f3-c3e6-11e1-8565-001d7de92470

Error - 7/1/2012 11:34:45 PM | Computer Name = Diego | Source = Application Error | ID = 1000
Description = Faulting application name: svchost.exe, version: 6.1.7600.16385, time
stamp: 0x4a5bc3c1 Faulting module name: mshtml.dll, version: 9.0.8112.16446, time
stamp: 0x4fb5b675 Exception code: 0xc0000005 Fault offset: 0x00000000002e9f82 Faulting
process id: 0x19cf4 Faulting application start time: 0x01cd580347c1ad00 Faulting
application path: C:\Windows\system32\svchost.exe Faulting module path: C:\Windows\system32\mshtml.dll
Report
Id: dde2b3bb-c3f6-11e1-8565-001d7de92470

Error - 7/2/2012 1:58:26 PM | Computer Name = Diego | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Python26\Lib\distutils\command\wininst-8_d.exe".
Dependent
Assembly Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 7/2/2012 1:59:36 PM | Computer Name = Diego | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files (x86)\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value
"MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" of attribute
"version" in element "assemblyIdentity" is invalid.

Error - 7/2/2012 2:01:41 PM | Computer Name = Diego | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files (x86)\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program
files (x86)\spybot - search & destroy\DelZip179.dll" on line 8. The value "*" of
attribute "language" in element "assemblyIdentity" is invalid.

Error - 7/2/2012 3:44:14 PM | Computer Name = Diego | Source = Application Error | ID = 1000
Description = Faulting application name: svchost.exe, version: 6.1.7600.16385, time
stamp: 0x4fe34b51 Faulting module name: svchost.exe, version: 6.1.7600.16385, time
stamp: 0x4fe34b51 Exception code: 0xc0000005 Fault offset: 0x0000cecd Faulting process
id: 0xd00 Faulting application start time: 0x01cd588853a55300 Faulting application
path: C:\Windows\SysWOW64\svchost.exe Faulting module path: C:\Windows\SysWOW64\svchost.exe
Report
Id: 4ce57a7e-c47e-11e1-bee9-001d7de92470

Error - 7/3/2012 11:23:45 AM | Computer Name = Diego | Source = Application Error | ID = 1000
Description = Faulting application name: pol.exe, version: 1.18.13.0, time stamp:
0x4e3bcddc Faulting module name: kernel32.dll, version: 6.1.7601.17651, time stamp:
0x4e211318 Exception code: 0xc00000fd Fault offset: 0x00011617 Faulting process id:
0x16cc Faulting application start time: 0x01cd592c2a8dc737 Faulting application path:
C:\Program Files (x86)\PlayOnline\SquareEnix\PlayOnlineViewer\pol.exe Faulting module
path: C:\Windows\syswow64\kernel32.dll Report Id: 13c64bd6-c523-11e1-b15a-001d7de92470

Error - 7/3/2012 2:27:11 PM | Computer Name = Diego | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Python26\Lib\distutils\command\wininst-8_d.exe".
Dependent
Assembly Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 7/3/2012 2:28:28 PM | Computer Name = Diego | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files (x86)\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value
"MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" of attribute
"version" in element "assemblyIdentity" is invalid.

Error - 7/3/2012 2:30:06 PM | Computer Name = Diego | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files (x86)\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program
files (x86)\spybot - search & destroy\DelZip179.dll" on line 8. The value "*" of
attribute "language" in element "assemblyIdentity" is invalid.

Error - 7/3/2012 11:29:31 PM | Computer Name = Diego | Source = TabletServiceWacom | ID = 0
Description =

[ OSession Events ]
Error - 10/19/2010 12:33:54 PM | Computer Name = Diego | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2015
seconds with 720 seconds of active time. This session ended with a crash.

Error - 12/2/2011 6:01:13 PM | Computer Name = Diego | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6565.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 3057
seconds with 840 seconds of active time. This session ended with a crash.

Error - 12/2/2011 6:02:41 PM | Computer Name = Diego | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6565.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 80
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 7/3/2012 11:30:55 PM | Computer Name = Diego | Source = Service Control Manager | ID = 7023
Description = The Computer Browser service terminated with the following error:
%%1060

Error - 7/3/2012 11:31:19 PM | Computer Name = Diego | Source = Service Control Manager | ID = 7023
Description = The Function Discovery Resource Publication service terminated with
the following error: %%-2147024891

Error - 7/3/2012 11:31:19 PM | Computer Name = Diego | Source = Service Control Manager | ID = 7001
Description = The HomeGroup Provider service depends on the Function Discovery Resource
Publication service which failed to start because of the following error: %%-2147024891

Error - 7/4/2012 12:43:05 AM | Computer Name = Diego | Source = Service Control Manager | ID = 7034
Description = The hpqcxs08 service terminated unexpectedly. It has done this 1
time(s).

Error - 7/4/2012 12:43:05 AM | Computer Name = Diego | Source = Service Control Manager | ID = 7034
Description = The HP CUE DeviceDiscovery Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 7/4/2012 12:56:25 AM | Computer Name = Diego | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 7/4/2012 1:01:09 AM | Computer Name = Diego | Source = Application Popup | ID = 1060
Description = \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility
with this system. Please contact your software vendor for a compatible version
of the driver.

Error - 7/4/2012 1:03:36 AM | Computer Name = Diego | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 7/4/2012 1:06:18 AM | Computer Name = Diego | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery Service service hung on starting.

Error - 7/4/2012 10:18:37 AM | Computer Name = Diego | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery Service service hung on starting.


< End of report >
 
Did you reinstall MSE?
Is it working now?

=================================================

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    Code: 
    :OTL
O4 - HKU\S-1-5-21-385827607-1593914869-2355075119-1006..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O15 - HKU\S-1-5-21-385827607-1593914869-2355075119-1000\..Trusted Domains: aol.com ([*.aimexpress] https in Trusted sites)
O15 - HKU\S-1-5-21-385827607-1593914869-2355075119-1000\..Trusted Domains: aol.com ([aimexpress] https in Trusted sites)
O15 - HKU\S-1-5-21-385827607-1593914869-2355075119-1000\..Trusted Domains: blackout-gaming.net ([cp] https in Trusted sites)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} http://photoservices.van.fedex.com/skins/fxk/resources/software/ImageUploader4.cab (Reg Error: Key error.)

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • You will get a log that shows the results of the fix. Please post it.

==================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.
  • Double-click SecurityCheck.exe
  • Follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

    NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center
    • Windows Update
    • Windows Defender
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.


3. Download Temp File Cleaner (TFC)
  • Double click on TFC.exe to run the program.
  • Click on Start button to begin cleaning process.
  • TFC will close all running programs, and it may ask you to restart computer.


4. Please run a free online scan with the ESET Online Scanner

  • Disable your antivirus program
  • Tick the box next to YES, I accept the Terms of Use
  • Click Start
  • Accept any security warnings from your browser.
  • Check Scan archives
  • Click Start
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click on List of found threats
  • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • NOTE. If Eset won't find any threats, it won't produce any log.
 
Reinstalled MSE, works now
Found several threats when having used the ESET Online Scanner, but the Blackout ones are often mistaken for threats when it isn't (they are a popular private server for Ragnarok online)

All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-385827607-1593914869-2355075119-1006\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry key HKEY_USERS\S-1-5-21-385827607-1593914869-2355075119-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\*.aimexpress\ deleted successfully.
Invalid CLSID key: *.aimexpress
Registry key HKEY_USERS\S-1-5-21-385827607-1593914869-2355075119-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\aimexpress\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-385827607-1593914869-2355075119-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\blackout-gaming.net\cp\ deleted successfully.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {EDFCB7CB-942C-4822-AF14-F0B687409848}
C:\Windows\Downloaded Program Files\ImageUploader4.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{EDFCB7CB-942C-4822-AF14-F0B687409848}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EDFCB7CB-942C-4822-AF14-F0B687409848}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{EDFCB7CB-942C-4822-AF14-F0B687409848}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EDFCB7CB-942C-4822-AF14-F0B687409848}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: AppData
->Temp folder emptied: 0 bytes

User: Carlos
->Temp folder emptied: 378262 bytes
->Temporary Internet Files folder emptied: 206855183 bytes
->Java cache emptied: 13800412 bytes
->FireFox cache emptied: 1012984823 bytes
->Flash cache emptied: 2111676 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 41044 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 41044 bytes

User: UpdatusUser.DIEGO
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 41044 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 34015 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 99244953 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1,274.00 mb


[EMPTYJAVA]

User: All Users

User: AppData

User: Carlos
->Java cache emptied: 0 bytes

User: Default

User: Default User

User: Public

User: UpdatusUser

User: UpdatusUser.DIEGO

Total Java Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: All Users

User: AppData

User: Carlos
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: UpdatusUser
->Flash cache emptied: 0 bytes

User: UpdatusUser.DIEGO
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.53.1 log created on 07052012_095450

Files\Folders moved on Reboot...
C:\Users\Carlos\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...
File C:\Users\Carlos\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...


Results of screen317's Security Check version 0.99.24
Windows 7 x64 (UAC is disabled!)
Internet Explorer 9
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Spybot - Search & Destroy
CCleaner (remove only)
Java(TM) 6 Update 32
Out of date Java installed!
Adobe Flash Player 11.3.300.262
Mozilla Firefox (x86 en-US..)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Microsoft Security Essentials msseces.exe
``````````End of Log````````````


Farbar Service Scanner Version: 02-07-2012
Ran by Carlos (administrator) on 05-07-2012 at 10:07:54
Running from "C:\Users\Carlos\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****



C:\FRST\Quarantine\{89f52674-e3ed-4203-6826-09f3b466a189}\{89f52674-e3ed-4203-6826-09f3b466a189}\U\800000cb.@ Win64/Sirefef.T trojan cleaned by deleting - quarantined
C:\Program Files (x86)\Blackout Ragnarok Online\Blackout RO.exe a variant of Win32/Packed.MoleboxUltra application cleaned by deleting - quarantined
C:\Program Files (x86)\Gravity\Blackout RO.exe a variant of Win32/Packed.MoleboxUltra application cleaned by deleting - quarantined
C:\Program Files (x86)\Gravity\Blackout_RO_Lite_Installer_v0221.exe a variant of Win32/Packed.MoleboxUltra application deleted - quarantined
C:\ProgramData\Spybot - Search & Destroy\Recovery\SmitfraudCgp.zip Win32/Bagle.gen.zip worm cleaned by deleting - quarantined
C:\Users\Carlos\Downloads\SoftonicDownloader60361.exe a variant of Win32/SoftonicDownloader.A application cleaned by deleting - quarantined
 
1. Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

2. Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it.
  • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.
  • Do NOT post JavaRa log.

=========================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

  • Under the Custom Scans/Fixes box at the bottom, paste in the following:

Code: 
:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. (Windows XP only) Run defrag at your convenience.

11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

13. Please, let me know, how your computer is doing.
 
Done as you have said and everything seems to be in order so far

Question though, why does it says for XP users only to run defrag? Why would you not use defrag for other OSes like Win 7?

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: AppData
->Temp folder emptied: 0 bytes

User: Carlos
->Temp folder emptied: 1029388872 bytes
->Temporary Internet Files folder emptied: 197670514 bytes
->Java cache emptied: 2027 bytes
->FireFox cache emptied: 328144257 bytes
->Flash cache emptied: 15592 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: UpdatusUser.DIEGO
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 312697 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 6375412 bytes

Total Files Cleaned = 1,490.00 mb


[EMPTYFLASH]

User: All Users

User: AppData

User: Carlos
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: UpdatusUser
->Flash cache emptied: 0 bytes

User: UpdatusUser.DIEGO
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


[EMPTYJAVA]

User: All Users

User: AppData

User: Carlos
->Java cache emptied: 0 bytes

User: Default

User: Default User

User: Public

User: UpdatusUser

User: UpdatusUser.DIEGO

Total Java Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.53.1 log created on 07072012_103131

Files\Folders moved on Reboot...
C:\Users\Carlos\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Carlos\AppData\Local\Temp\~DF23AE5D8790FA36A2.TMP moved successfully.
File\Folder C:\Users\Carlos\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3OYHKOW\ADSAdClient31[1].htm not found!
File\Folder C:\Users\Carlos\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3OYHKOW\direct;auc.5929759762271651122;ai.254301523.280291971.60097972;ac.1340470752-3796637;wi.234;hi.60;cp.0[1].htm not found!
File\Folder C:\Users\Carlos\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3OYHKOW\tt[1].htm not found!

PendingFileRenameOperations files...
File C:\Users\Carlos\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
File C:\Users\Carlos\AppData\Local\Temp\~DF23AE5D8790FA36A2.TMP not found!
File C:\Users\Carlos\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3OYHKOW\ADSAdClient31[1].htm not found!
File C:\Users\Carlos\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3OYHKOW\direct;auc.5929759762271651122;ai.254301523.280291971.60097972;ac.1340470752-3796637;wi.234;hi.60;cp.0[1].htm not found!
File C:\Users\Carlos\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3OYHKOW\tt[1].htm not found!

Registry entries deleted on Reboot...
 
Way to go!!
Good luck and stay safe :)

Vista and 7 have build in defrag program which runs in the background so no 3rd party utility is needed.
 
Ahh yes I understand now what you meant

Thank you very much for all your help! I will be sure to be more cautious in my actions online and recommend you to anyone I know who may be at wits end with malicious malware and the like :D
 
You must log in or register to reply here.

Similar threads

Bob O'Donnell
Google is stitching its fragmented enterprise world into something real
Replies
3
Views
113
Puiu
Puiu
midian182
Instagram boss says it's not secretly using your phone's microphone to record you - here's why you still believe it
Replies
20
Views
570
Cabuzzi
C
midian182
Silicon Valley crosswalks hacked to play fake AI voices of Musk and Zuckerberg
Replies
0
Views
326
midian182
midian182

Latest posts

Back