OTL.txt (cont..)
========== Internet Explorer ==========
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C2 99 83 82 A5 6D CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "http://www.google.com/ig"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.7.2
FF - prefs.js..extensions.enabledItems:
firebug@software.joehewitt.com:1.5.4
FF - prefs.js..extensions.enabledItems:
personas@christopher.beard:1.6.1
FF - prefs.js..extensions.enabledItems: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}:7.0.0.1
FF - prefs.js..extensions.enabledItems: {3335F91D-2AEF-4097-B831-C96C60349822}:1.4.3
FF - prefs.js..extensions.enabledItems:
foxyproxy@eric.h.jung:2.22.1
FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.85
FF - prefs.js..extensions.enabledItems: {01A8CA0A-4C96-465b-A49B-65C46FAD54F9}:6.0
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.11
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.2.1
FF - prefs.js..keyword.URL: "http://www.google.com.my/search?q="
FF - HKLM\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010/07/10 12:17:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2010/07/10 21:32:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/23 18:04:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/10/13 22:21:29 | 000,000,000 | ---D | M]
[2010/09/08 17:25:40 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\Mozilla\Extensions
[2010/09/08 17:24:42 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\Mozilla\Extensions\Coder Preset
[2010/09/08 17:25:40 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\Mozilla\Extensions\MediaCoder
[2010/10/18 12:58:23 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\Mozilla\Firefox\Profiles\wtgp5iib.default\extensions
[2010/08/13 01:17:55 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\ENDZYM3\AppData\Roaming\Mozilla\Firefox\Profiles\wtgp5iib.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2010/10/14 14:57:13 | 000,000,000 | ---D | M] (FlashGot) -- C:\Users\ENDZYM3\AppData\Roaming\Mozilla\Firefox\Profiles\wtgp5iib.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2010/07/06 16:46:29 | 000,000,000 | ---D | M] (Leet Key) -- C:\Users\ENDZYM3\AppData\Roaming\Mozilla\Firefox\Profiles\wtgp5iib.default\extensions\{3335F91D-2AEF-4097-B831-C96C60349822}
[2010/09/12 19:20:31 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\ENDZYM3\AppData\Roaming\Mozilla\Firefox\Profiles\wtgp5iib.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
[2010/10/14 14:57:14 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\ENDZYM3\AppData\Roaming\Mozilla\Firefox\Profiles\wtgp5iib.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
[2010/10/14 14:57:16 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\ENDZYM3\AppData\Roaming\Mozilla\Firefox\Profiles\wtgp5iib.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/08/18 10:50:31 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\ENDZYM3\AppData\Roaming\Mozilla\Firefox\Profiles\wtgp5iib.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/10/08 14:00:05 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Users\ENDZYM3\AppData\Roaming\Mozilla\Firefox\Profiles\wtgp5iib.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010/09/05 17:59:00 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\ENDZYM3\AppData\Roaming\Mozilla\Firefox\Profiles\wtgp5iib.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/06/24 16:48:35 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\Mozilla\Firefox\Profiles\wtgp5iib.default\extensions\firebug@software.joehewitt.com
[2010/08/31 17:36:53 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\Mozilla\Firefox\Profiles\wtgp5iib.default\extensions\foxyproxy@eric.h.jung
[2010/09/12 01:30:30 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\Mozilla\Firefox\Profiles\wtgp5iib.default\extensions\personas@christopher.beard
[2010/10/18 12:58:23 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/03/27 18:06:04 | 000,067,032 | ---- | M] (Adobe Systems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npContribute.dll
[2010/07/12 09:33:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npwachk.dll
[2010/08/21 23:59:58 | 000,003,803 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\MyHeritage.xml
O1 HOSTS File: ([2010/10/17 16:57:07 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\Snagit 9\SnagitBHO.dll (TechSmith Corporation)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Babylon IE plugin) - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O3 - HKLM\..\Toolbar: (Snagit) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 9\SnagitIEAddin.dll (TechSmith Corporation)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe (Google)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [Microsoft Default Manager] C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [WireLessMouse] C:\Program Files\Mouse Driver\StartAutorun.exe MouseDrv.exe File not found
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [LxrAutorun] C:\Users\ENDZYM3\AppData\Local\Lexar Media\LxrAutorun.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Translate this web page with Babylon - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O8 - Extra context menu item: Translate with Babylon - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O9 - Extra 'Tools' menuitem : Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501}
http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072}
http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - C:\Program Files\Stardock\Object Desktop\IconPackager\iprepair.dll (Stardock.net, Inc)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
NetSvcs: FastUserSwitchingCompatibility - C:\Windows\System32\FastUv32.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.vorbis - C:\Windows\System32\vorbis.acm (HMS
http://hp.vector.co.jp/authors/VA012897/)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.i420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
========== Files/Folders - Created Within 90 Days ==========
[2010/10/18 18:20:48 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Users\ENDZYM3\Desktop\OTL.exe
[2010/10/18 17:28:29 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010/10/18 16:59:34 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010/10/17 16:55:10 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010/10/17 16:55:10 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Local\temp
[2010/10/17 15:31:37 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010/10/17 15:31:37 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010/10/17 15:31:36 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010/10/17 15:31:23 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010/10/17 15:29:17 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/10/17 13:24:11 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2010/10/17 08:11:32 | 000,165,584 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2010/10/17 08:11:32 | 000,017,744 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2010/10/17 08:11:29 | 000,023,376 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2010/10/17 08:11:25 | 000,046,672 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2010/10/17 08:11:18 | 000,050,768 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2010/10/17 08:10:41 | 000,167,592 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2010/10/17 08:10:41 | 000,038,848 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2010/10/17 08:10:35 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2010/10/17 07:34:31 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Roaming\Malwarebytes
[2010/10/17 07:34:08 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/10/17 07:34:06 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/10/17 07:34:06 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware (NEW)
[2010/10/17 07:34:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010/10/16 19:52:19 | 000,000,000 | ---D | C] -- C:\Windows\System32\MpEngineStore
[2010/10/16 19:27:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Update
[2010/10/13 22:21:29 | 000,000,000 | ---D | C] -- C:\Program Files\Winamp Detect
[2010/10/11 21:12:16 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt
[2010/10/11 19:36:04 | 000,000,000 | ---D | C] -- C:\Program Files\Rosetta Stone
[2010/10/10 00:21:17 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\Documents\Snagit Stamps
[2010/10/07 11:33:11 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet
[2010/10/07 11:32:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Rosetta Stone
[2010/10/02 14:04:46 | 000,000,000 | ---D | C] -- C:\ProgramData\2DBoy
[2010/10/02 12:32:56 | 000,000,000 | -H-D | C] -- C:\ProgramData\{1C533CDB-BAC7-4600-B3DE-0B628D9AC643}
[2010/10/02 12:32:43 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Stardock
[2010/10/02 12:32:43 | 000,000,000 | ---D | C] -- C:\Program Files\Stardock
[2010/09/26 16:18:35 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\.dvdcss
[2010/09/26 16:14:20 | 000,000,000 | ---D | C] -- C:\Program Files\PS3 Media Server
[2010/09/26 16:03:53 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Local\Microsoft Games
[2010/09/19 17:52:40 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010/09/19 17:52:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2010/09/14 13:38:37 | 000,140,288 | ---- | C] (Lexar Media, Inc.) -- C:\Windows\System32\LxrSII1.dll
[2010/09/14 13:38:37 | 000,065,536 | ---- | C] (Lexar Media, Inc.) -- C:\Windows\System32\LxrSII1s.exe
[2010/09/14 13:38:37 | 000,063,448 | ---- | C] (Lexar Media, Inc.) -- C:\Windows\System32\drivers\LxrSII1d.sys
[2010/09/14 13:38:35 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Local\Lexar Media
[2010/09/08 17:24:36 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Local\Broad Intelligence
[2010/09/07 19:40:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Macrovision Shared
[2010/09/06 22:34:21 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Local\Babylon
[2010/09/06 22:33:05 | 000,000,000 | ---D | C] -- C:\Program Files\Babylon
[2010/09/06 22:32:09 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Roaming\Babylon
[2010/09/06 22:32:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2010/09/06 17:22:49 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Roaming\Broad Intelligence
[2010/09/06 17:22:45 | 000,000,000 | ---D | C] -- C:\Program Files\MediaCoder
[2010/09/04 12:06:00 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Roaming\Crayon Physics Deluxe
[2010/09/04 12:01:05 | 000,000,000 | ---D | C] -- C:\Program Files\WorldOfGoo
[2010/09/04 12:00:27 | 000,000,000 | ---D | C] -- C:\Program Files\Crayon Physics Deluxe
[2010/09/04 02:04:14 | 000,000,000 | ---D | C] -- C:\Program Files\Aspell
[2010/09/02 16:55:57 | 000,000,000 | ---D | C] -- C:\Program Files\ASIO4ALL v2
[2010/09/02 16:55:31 | 000,225,280 | ---- | C] (Propellerhead Software AB) -- C:\Windows\System32\rewire.dll
[2010/09/02 16:55:30 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\Documents\Image-Line
[2010/09/02 16:54:51 | 000,000,000 | ---D | C] -- C:\Program Files\Outsim
[2010/09/02 16:51:40 | 000,000,000 | ---D | C] -- C:\Program Files\Image-Line
[2010/09/02 15:49:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Guitar Pro 6
[2010/09/02 15:39:59 | 000,000,000 | ---D | C] -- C:\Program Files\Guitar Pro 6
[2010/09/02 15:34:09 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Roaming\Guitar Pro 6
[2010/09/02 01:10:46 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Roaming\AVS4YOU
[2010/09/02 01:04:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AVSMedia
[2010/09/02 01:03:52 | 000,000,000 | ---D | C] -- C:\ProgramData\AVS4YOU
[2010/09/02 01:03:52 | 000,000,000 | ---D | C] -- C:\Program Files\AVS4YOU
[2010/09/02 00:08:27 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\Documents\Snagit
[2010/08/31 16:56:50 | 000,000,000 | ---D | C] -- C:\Program Files\Bethesda Softworks
[2010/08/31 11:59:37 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\Documents\Outlook Files
[2010/08/30 03:11:35 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\Documents\ClubBing
[2010/08/30 03:04:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Digidesign
[2010/08/30 02:55:21 | 000,000,000 | ---D | C] -- C:\Program Files\VstPlugins
[2010/08/30 02:37:57 | 000,000,000 | ---D | C] -- C:\Program Files\Cakewalk
[2010/08/30 02:26:52 | 000,000,000 | ---D | C] -- C:\ProgramData\TechSmith
[2010/08/30 02:26:46 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Local\TechSmith
[2010/08/30 02:26:15 | 000,000,000 | ---D | C] -- C:\Program Files\TechSmith
[2010/08/30 02:22:10 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard
[2010/08/30 02:11:07 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Local\Google
[2010/08/30 02:11:03 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2010/08/30 02:10:02 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2010/08/28 23:29:58 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\Documents\My Chat Logs
[2010/08/28 23:28:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Messenger Plus!
[2010/08/28 23:25:24 | 000,000,000 | ---D | C] -- C:\Program Files\Messenger Plus! Live
[2010/08/28 22:47:56 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live SkyDrive
[2010/08/28 20:33:58 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Roaming\Logitech
[2010/08/28 20:07:54 | 000,000,000 | ---D | C] -- C:\ProgramData\LogiShrd
[2010/08/28 20:06:02 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\Documents\SightSpeed Recordings
[2010/08/28 20:06:00 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Local\LogiShrd
[2010/08/28 20:02:30 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Roaming\Leadertech
[2010/08/28 20:02:13 | 000,000,000 | ---D | C] -- C:\Windows\System32\logishrd
[2010/08/28 20:01:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Logitech
[2010/08/28 20:01:23 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\LWS
[2010/08/28 20:00:53 | 000,000,000 | ---D | C] -- C:\Program Files\Logitech
[2010/08/28 19:55:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\logishrd
[2010/08/27 00:17:21 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\Documents\Untitled
[2010/08/26 23:15:12 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Roaming\ResourceCentral.E6E1B28A311BC518DB6C6883EA3757FDE0E90ADC.1
[2010/08/26 22:10:58 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\Documents\MPUISnap
[2010/08/21 23:59:57 | 000,000,000 | ---D | C] -- C:\Program Files\Celebrity Toolbar
[2010/08/03 15:10:59 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Roaming\dvdcss
[2010/07/31 12:08:00 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\Documents\Algodoo
[2010/07/31 11:59:44 | 000,000,000 | ---D | C] -- C:\Program Files\Algodoo
[2010/07/31 10:54:00 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Local\Dan_Dixon
[2010/07/31 10:53:57 | 000,000,000 | ---D | C] -- C:\Users\ENDZYM3\AppData\Local\Dan Dixon
[2010/07/30 15:07:11 | 000,000,000 | ---D | C] -- C:\Program Files\Medieval Software
[2010/07/26 19:12:28 | 000,000,000 | ---D | C] -- C:\Program Files\Synaptics
========== Files - Modified Within 90 Days ==========
[2010/10/18 18:25:02 | 000,000,916 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1737863448-878849073-962364827-1000UA.job
[2010/10/18 18:25:01 | 000,000,864 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1737863448-878849073-962364827-1000Core.job
[2010/10/18 18:20:54 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\ENDZYM3\Desktop\OTL.exe
[2010/10/18 18:16:16 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/10/18 16:49:12 | 000,627,082 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/10/18 16:49:12 | 000,107,366 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/10/17 20:02:14 | 000,017,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/10/17 20:02:14 | 000,017,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/10/17 19:54:46 | 2211,483,648 | -HS- | M] () -- C:\hiberfil.sys
[2010/10/17 16:57:07 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010/10/17 13:23:56 | 409,546,788 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010/10/17 08:11:17 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2010/10/17 08:09:09 | 000,000,580 | ---- | M] () -- C:\Users\ENDZYM3\Documents\cc_20101017_080905.reg
[2010/10/17 08:00:54 | 000,000,580 | ---- | M] () -- C:\Users\ENDZYM3\Documents\cc_20101017_080045.reg
[2010/10/16 19:59:34 | 000,007,158 | ---- | M] () -- C:\Users\ENDZYM3\Documents\cc_20101016_195929.reg
[2010/10/16 19:29:31 | 000,184,328 | ---- | M] () -- C:\Windows\System32\T7M6S0.TAL
[2010/10/16 19:29:31 | 000,177,800 | ---- | M] () -- C:\Windows\System32\T7M6S1.TAL
[2010/10/16 19:29:31 | 000,176,736 | ---- | M] () -- C:\Windows\System32\T7M6S3.TAL
[2010/10/16 19:29:31 | 000,166,456 | ---- | M] () -- C:\Windows\System32\T7M6S2.TAL
[2010/10/16 19:27:52 | 000,164,396 | ---- | M] () -- C:\Windows\System32\0R75L2.TAL
[2010/10/16 19:27:52 | 000,144,404 | ---- | M] () -- C:\Windows\System32\0R75L1.TAL
[2010/10/16 19:27:52 | 000,139,172 | ---- | M] () -- C:\Windows\System32\0R75L3.TAL
[2010/10/16 19:27:52 | 000,138,332 | ---- | M] () -- C:\Windows\System32\0R75L0.TAL
[2010/10/14 13:50:01 | 000,042,759 | ---- | M] () -- C:\Users\ENDZYM3\Desktop\The Netherlands.png
[2010/10/14 13:46:03 | 000,042,983 | ---- | M] () -- C:\Users\ENDZYM3\Desktop\Format for Mailing.png
[2010/10/13 18:43:01 | 003,782,088 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/10/13 18:39:06 | 000,004,656 | ---- | M] () -- C:\Users\ENDZYM3\Documents\cc_20101013_183858.reg
[2010/10/12 14:46:34 | 000,001,456 | ---- | M] () -- C:\Users\ENDZYM3\AppData\Local\Adobe Save for Web 12.0 Prefs
[2010/10/12 09:28:55 | 000,000,132 | ---- | M] () -- C:\Users\ENDZYM3\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2010/10/10 00:23:01 | 000,001,999 | ---- | M] () -- C:\Users\ENDZYM3\Application Data\Microsoft\Internet Explorer\Quick Launch\Snagit 9.lnk
[2010/10/07 11:10:38 | 000,003,222 | ---- | M] () -- C:\Users\ENDZYM3\Documents\cc_20101007_111021.reg
[2010/10/04 03:00:41 | 000,001,225 | ---- | M] () -- C:\Windows\System32\blush censored cum cum_in_mouth fellatio futa_on_female futanari group_sex horns oral orange_eyes pantyhose penis purple_eyes purple_hair school_uniform serafuku sex siblings tail threesome torn_clo.lnk
[2010/10/02 11:54:18 | 000,031,998 | ---- | M] () -- C:\Users\ENDZYM3\Documents\cc_20101002_115413.reg
[2010/09/28 23:59:29 | 000,004,048 | ---- | M] () -- C:\Windows\System32\FireShot capture #025 - 'Facebook I Seth Chase I WANT MY SYSTEM BACK!!!' - www_facebook_com_home_php_#!_profile_php_id=100000990030362&v=wall&story_fbid=153858604646647&ref=notif¬if_t=share_reply.lnk
[2010/09/26 16:07:16 | 000,000,362 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2010/09/23 02:32:29 | 000,000,132 | ---- | M] () -- C:\Users\ENDZYM3\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2010/09/19 16:03:12 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_ZuneDriver_01_09_00.Wdf
[2010/09/19 16:03:12 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_WinUSB_01009.Wdf
[2010/09/13 10:18:15 | 000,073,932 | ---- | M] () -- C:\Users\ENDZYM3\Documents\cc_20100913_101809.reg
[2010/09/11 14:09:45 | 000,000,132 | ---- | M] () -- C:\Users\ENDZYM3\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2010/09/07 08:12:17 | 000,038,848 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2010/09/07 08:11:54 | 000,167,592 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2010/09/07 07:52:25 | 000,046,672 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2010/09/07 07:52:03 | 000,165,584 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2010/09/07 07:47:46 | 000,023,376 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2010/09/07 07:47:30 | 000,050,768 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2010/09/07 07:47:07 | 000,017,744 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2010/08/30 02:38:58 | 000,199,992 | ---- | M] () -- C:\Windows\_detmp.1
[2010/08/26 22:11:32 | 000,000,098 | ---- | M] () -- C:\Users\ENDZYM3\AppData\Roaming\MPUI.ini
[2010/08/07 22:52:51 | 000,004,056 | ---- | M] () -- C:\Users\ENDZYM3\Documents\cc_20100807_225219.reg
[2010/07/27 08:03:20 | 010,829,656 | ---- | M] () -- C:\Windows\System32\LogiDPP.dll
[2010/07/27 08:03:20 | 000,102,744 | ---- | M] () -- C:\Windows\System32\LogiDPPApp.exe
[2010/07/27 08:03:18 | 000,290,648 | ---- | M] () -- C:\Windows\System32\DevManagerCore.dll
[2010/07/27 07:56:40 | 000,266,828 | ---- | M] () -- C:\Windows\System32\drivers\LVAFT.cfg
[2010/07/27 07:56:04 | 000,090,411 | ---- | M] () -- C:\Windows\System32\lvcoinst.ini
[2010/07/27 07:55:50 | 000,037,518 | ---- | M] () -- C:\Windows\System32\Repository.reg
[2010/07/25 18:07:43 | 000,015,876 | ---- | M] () -- C:\Users\ENDZYM3\Documents\cc_20100725_180738.reg
[2010/07/25 16:50:15 | 000,033,600 | ---- | M] () -- C:\Users\ENDZYM3\Documents\cc_20100725_165003.reg
========== Files Created - No Company Name ==========
[2010/10/17 15:31:37 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010/10/17 15:31:37 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010/10/17 15:31:37 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010/10/17 15:31:36 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010/10/17 15:31:36 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010/10/17 13:23:56 | 409,546,788 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010/10/17 08:09:07 | 000,000,580 | ---- | C] () -- C:\Users\ENDZYM3\Documents\cc_20101017_080905.reg
[2010/10/17 08:00:48 | 000,000,580 | ---- | C] () -- C:\Users\ENDZYM3\Documents\cc_20101017_080045.reg
[2010/10/16 19:59:32 | 000,007,158 | ---- | C] () -- C:\Users\ENDZYM3\Documents\cc_20101016_195929.reg
[2010/10/16 19:29:31 | 000,184,328 | ---- | C] () -- C:\Windows\System32\T7M6S0.TAL
[2010/10/16 19:29:31 | 000,177,800 | ---- | C] () -- C:\Windows\System32\T7M6S1.TAL
[2010/10/16 19:29:31 | 000,176,736 | ---- | C] () -- C:\Windows\System32\T7M6S3.TAL
[2010/10/16 19:29:31 | 000,166,456 | ---- | C] () -- C:\Windows\System32\T7M6S2.TAL
[2010/10/16 19:27:52 | 000,164,396 | ---- | C] () -- C:\Windows\System32\0R75L2.TAL
[2010/10/16 19:27:52 | 000,144,404 | ---- | C] () -- C:\Windows\System32\0R75L1.TAL
[2010/10/16 19:27:52 | 000,139,172 | ---- | C] () -- C:\Windows\System32\0R75L3.TAL
[2010/10/16 19:27:52 | 000,138,332 | ---- | C] () -- C:\Windows\System32\0R75L0.TAL
[2010/10/14 13:50:01 | 000,042,759 | ---- | C] () -- C:\Users\ENDZYM3\Desktop\The Netherlands.png
[2010/10/14 13:46:03 | 000,042,983 | ---- | C] () -- C:\Users\ENDZYM3\Desktop\Format for Mailing.png
[2010/10/13 18:39:04 | 000,004,656 | ---- | C] () -- C:\Users\ENDZYM3\Documents\cc_20101013_183858.reg
[2010/10/12 14:46:34 | 000,001,456 | ---- | C] () -- C:\Users\ENDZYM3\AppData\Local\Adobe Save for Web 12.0 Prefs
[2010/10/07 11:10:25 | 000,003,222 | ---- | C] () -- C:\Users\ENDZYM3\Documents\cc_20101007_111021.reg
[2010/10/04 03:00:41 | 000,001,225 | ---- | C] () -- C:\Windows\System32\blush censored cum cum_in_mouth fellatio futa_on_female futanari group_sex horns oral orange_eyes pantyhose penis purple_eyes purple_hair school_uniform serafuku sex siblings tail threesome torn_clo.lnk
[2010/10/02 11:54:15 | 000,031,998 | ---- | C] () -- C:\Users\ENDZYM3\Documents\cc_20101002_115413.reg
[2010/09/28 23:59:29 | 000,004,048 | ---- | C] () -- C:\Windows\System32\FireShot capture #025 - 'Facebook I Seth Chase I WANT MY SYSTEM BACK!!!' - www_facebook_com_home_php_#!_profile_php_id=100000990030362&v=wall&story_fbid=153858604646647&ref=notif¬if_t=share_reply.lnk
[2010/09/26 16:06:56 | 000,000,362 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010/09/19 16:03:12 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_ZuneDriver_01_09_00.Wdf
[2010/09/19 16:03:12 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_WinUSB_01009.Wdf
[2010/09/14 13:38:37 | 000,023,934 | -H-- | C] () -- C:\Windows\LxrEncVlt.ico
[2010/09/14 13:38:37 | 000,003,262 | -H-- | C] () -- C:\Windows\LxrSgeEnc.ico
[2010/09/13 10:18:12 | 000,073,932 | ---- | C] () -- C:\Users\ENDZYM3\Documents\cc_20100913_101809.reg
[2010/09/11 14:09:45 | 000,000,132 | ---- | C] () -- C:\Users\ENDZYM3\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2010/09/09 18:57:12 | 000,000,132 | ---- | C] () -- C:\Users\ENDZYM3\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2010/09/08 18:43:52 | 000,199,992 | ---- | C] () -- C:\Windows\_detmp.1
[2010/08/30 02:38:07 | 000,005,727 | ---- | C] () -- C:\Windows\System32\VcakeD.vxd
[2010/08/30 02:27:01 | 000,001,999 | ---- | C] () -- C:\Users\ENDZYM3\Application Data\Microsoft\Internet Explorer\Quick Launch\Snagit 9.lnk
[2010/08/30 02:12:44 | 000,000,916 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1737863448-878849073-962364827-1000UA.job
[2010/08/30 02:12:42 | 000,000,864 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1737863448-878849073-962364827-1000Core.job
[2010/08/26 22:11:32 | 000,000,098 | ---- | C] () -- C:\Users\ENDZYM3\AppData\Roaming\MPUI.ini
[2010/08/07 22:52:28 | 000,004,056 | ---- | C] () -- C:\Users\ENDZYM3\Documents\cc_20100807_225219.reg
[2010/07/27 08:03:20 | 010,829,656 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll
[2010/07/27 08:03:20 | 000,102,744 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe
[2010/07/27 08:03:18 | 000,290,648 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll
[2010/07/27 07:56:40 | 000,266,828 | ---- | C] () -- C:\Windows\System32\drivers\LVAFT.cfg
[2010/07/27 07:56:04 | 000,090,411 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2010/07/27 07:55:50 | 000,037,518 | ---- | C] () -- C:\Windows\System32\Repository.reg
[2010/07/25 18:07:41 | 000,015,876 | ---- | C] () -- C:\Users\ENDZYM3\Documents\cc_20100725_180738.reg
[2010/07/25 16:50:06 | 000,033,600 | ---- | C] () -- C:\Users\ENDZYM3\Documents\cc_20100725_165003.reg
[2010/07/13 18:00:20 | 000,000,132 | ---- | C] () -- C:\Users\ENDZYM3\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2010/06/26 04:15:22 | 000,000,096 | ---- | C] () -- C:\Users\ENDZYM3\AppData\Roaming\7e0d9dca.dat
[2010/05/07 18:46:36 | 000,014,168 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll
[2010/05/07 18:43:30 | 000,025,824 | ---- | C] () -- C:\Windows\System32\drivers\LVPr2Mon.sys
[2009/07/13 16:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 16:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[1998/03/22 13:50:02 | 000,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll
========== LOP Check ==========
[2010/06/29 10:08:10 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\abgx360
[2010/10/13 22:25:00 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\Babylon
[2010/09/08 17:24:36 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\Broad Intelligence
[2010/09/04 13:17:37 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\Crayon Physics Deluxe
[2010/07/10 11:50:50 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\DAEMON Tools Lite
[2010/07/09 12:14:02 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\FireShot
[2010/09/02 15:49:27 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\Guitar Pro 6
[2010/06/29 11:36:28 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\ImgBurn
[2010/08/28 20:02:30 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\Leadertech
[2010/07/26 19:28:50 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\Rainmeter
[2010/08/26 23:15:12 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\ResourceCentral.E6E1B28A311BC518DB6C6883EA3757FDE0E90ADC.1
[2010/05/15 16:34:06 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\System
[2010/10/16 17:50:34 | 000,000,000 | ---D | M] -- C:\Users\ENDZYM3\AppData\Roaming\uTorrent
[2010/10/17 15:11:58 | 000,020,928 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.* >
[2009/06/10 14:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009/07/13 18:38:58 | 000,383,562 | RHS- | M] () -- C:\bootmgr
[2010/06/24 16:09:35 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2010/10/18 17:29:51 | 000,015,836 | ---- | M] () -- C:\ComboFix.txt
[2009/06/10 14:42:20 | 000,000,010 | ---- | M] () -- C:\config.sys
[2010/06/24 15:22:11 | 000,203,836 | RHS- | M] () -- C:\grldr
[2010/10/17 19:54:46 | 2211,483,648 | -HS- | M] () -- C:\hiberfil.sys
[2010/07/11 11:57:40 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/07/11 11:57:40 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010/10/17 19:54:48 | 124,780,543 | -HS- | M] () -- C:\pagefile.sys
[2010/07/10 22:06:02 | 000,007,944 | ---- | M] () -- C:\sqmnoopt00.sqm
[2010/06/24 15:22:12 | 000,000,000 | RHS- | M] () -- C:\winx.ld
< %systemroot%\Fonts\*.com >
[2009/07/13 21:52:25 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 21:52:25 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 21:52:25 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 21:52:25 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont
< %systemroot%\Fonts\*.dll >
< %systemroot%\Fonts\*.ini >
[2009/06/10 14:31:19 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini
< %systemroot%\Fonts\*.ini2 >
< %systemroot%\Fonts\*.exe >
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/13 18:15:05 | 000,070,144 | ---- | M] (CANON INC.) -- C:\Windows\System32\spool\prtprocs\w32x86\CNBPP3.DLL
[2009/07/13 18:15:35 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2009/07/13 18:16:19 | 000,029,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll
< %systemroot%\REPAIR\*.bak1 >
< %systemroot%\REPAIR\*.ini >
< %systemroot%\system32\*.jpg >
< %systemroot%\*.jpg >
< %systemroot%\*.png >
< %systemroot%\*.scr >
[2010/09/07 08:12:17 | 000,038,848 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2010/04/17 00:04:40 | 000,306,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR
< %systemroot%\*._sy >
< %APPDATA%\Adobe\Update\*.* >
< %ALLUSERSPROFILE%\Favorites\*.* >
< %APPDATA%\Microsoft\*.* >
< %PROGRAMFILES%\*.* >
[2009/07/13 21:41:57 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini
< %APPDATA%\Update\*.* >
< %systemroot%\*. /mp /s >
< %systemroot%\System32\config\*.sav >
< %PROGRAMFILES%\bak. /s >
< %systemroot%\system32\bak. /s >
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
< %systemroot%\system32\config\systemprofile\*.dat /x >
< %systemroot%\*.config >
< %systemroot%\system32\*.db >
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/06/24 15:20:04 | 000,000,221 | -HS- | M] () -- C:\Users\ENDZYM3\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
< %USERPROFILE%\Desktop\*.exe >
[2010/10/18 18:20:54 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\ENDZYM3\Desktop\OTL.exe
< %PROGRAMFILES%\Common Files\*.* >
< %systemroot%\*.src >
< %systemroot%\install\*.* >
< %systemroot%\system32\DLL\*.* >
< %systemroot%\system32\HelpFiles\*.* >
< %systemroot%\system32\rundll\*.* >
< %systemroot%\winn32\*.* >
< %systemroot%\Java\*.* >
< %systemroot%\system32\test\*.* >
< %systemroot%\system32\Rundll32\*.* >
< %systemroot%\AppPatch\Custom\*.* >
< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >
< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >
< %PROGRAMFILES%\Internet Explorer\*.tmp >
< %PROGRAMFILES%\Internet Explorer\*.dat >
< %USERPROFILE%\My Documents\*.exe >
< %USERPROFILE%\*.exe >
< %systemroot%\ADDINS\*.* >
[2009/06/10 14:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\addins\FXSEXT.ecf
< %systemroot%\assembly\*.bak2 >
< %systemroot%\Config\*.* >
< %systemroot%\REPAIR\*.bak2 >
< %systemroot%\SECURITY\Database\*.sdb /x >
< %systemroot%\SYSTEM\*.bak2 >
< %systemroot%\Web\*.bak2 >
< %systemroot%\Driver Cache\*.* >
< %PROGRAMFILES%\Mozilla Firefox\0*.exe >
< %ProgramFiles%\Microsoft Common\*.* >
< %ProgramFiles%\TinyProxy. >
< %USERPROFILE%\Favorites\*.url /x >
[2010/10/02 13:02:29 | 000,000,508 | -HS- | M] () -- C:\Users\ENDZYM3\Favorites\desktop.ini
< %systemroot%\system32\*.bk >
< %systemroot%\*.te >
< %systemroot%\system32\system32\*.* >
< %ALLUSERSPROFILE%\*.dat /x >
[2010/09/26 16:07:16 | 000,000,362 | RHS- | M] () -- C:\ProgramData\ntuser.pol
< %systemroot%\system32\drivers\*.rmv >
< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >
< dir /b "%systemroot%\*.exe" | find /i " " /c >
< %PROGRAMFILES%\Microsoft\*.* >
< %systemroot%\System32\Wbem\proquota.exe >
< %PROGRAMFILES%\Mozilla Firefox\*.dat >
< %USERPROFILE%\Cookies\*.txt /x >
< %SystemRoot%\system32\fonts\*.* >
< %systemroot%\system32\winlog\*.* >
< %systemroot%\system32\Language\*.* >
< %systemroot%\system32\Settings\*.* >
< %systemroot%\system32\*.quo >
< %SYSTEMROOT%\AppPatch\*.exe >
< %SYSTEMROOT%\inf\*.exe >
[1998/09/02 01:46:12 | 000,075,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\inf\unregmp2.exe
< %SYSTEMROOT%\Installer\*.exe >
< %systemroot%\system32\config\*.bak2 >
< %systemroot%\system32\Computers\*.* >
< %SystemRoot%\system32\Sound\*.* >
< %SystemRoot%\system32\SpecialImg\*.* >
< %SystemRoot%\system32\code\*.* >
< %SystemRoot%\system32\draft\*.* >
< %SystemRoot%\system32\MSSSys\*.* >
< %ProgramFiles%\Javascript\*.* >
< %systemroot%\pchealth\helpctr\System\*.exe /s >
< %systemroot%\Web\*.exe >
< %systemroot%\system32\msn\*.* >
< %systemroot%\system32\*.tro >
< %AppData%\Microsoft\Installer\msupdates\*.* >
< %ProgramFiles%\Messenger\*.* >
< %systemroot%\system32\systhem32\*.* >
< %systemroot%\system\*.exe >
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >