Solved Sirefef.AE/Patched.A.Gen/Agent.BA Trojan

[hokokhua]

Hi guys,

I was infected by the above trojans today. Detected by Eset but it doesn't seem to be able to remove it completely. Appreciate your help. Thanks guys!!

FRST txt below:

 

[hokokhua]

===
Scan result of Farbar Recovery Scan Tool Version: 07-07-2012 04
Ran by user at 08-07-2012 21:20:22
Running from C:\Users\user\Desktop
Service Pack 1 (X64) OS Language: English(US)
Attention: Could not load system hive.ERROR: The process cannot access the file because it is being used by another process.

ATTENTION:=====> THE TOOL IS NOT RUN FROM RECOVERY ENVIRONMENT AND WILL NOT FUNTION PROPERLY.


============ One Month Created Files and Folders ==============

2012-07-08 21:20 - 2012-07-08 21:20 - 00000000 ____D C:\FRST
2012-07-08 21:17 - 2012-07-08 21:17 - 01432863 ____A C:\Users\user\Desktop\FRST64.exe
2012-07-08 20:26 - 2012-06-14 12:31 - 02267096 ____A (Threat Expert Ltd.) C:\Windows\PCTBDCore.dll
2012-07-08 20:26 - 2012-06-14 12:31 - 01681368 ____A (Threat Expert Ltd.) C:\Windows\PCTBDRes.dll
2012-07-08 20:26 - 2012-06-14 12:31 - 00767960 ____A C:\Windows\BDTSupport.dll
2012-07-08 20:26 - 2012-06-14 12:31 - 00149464 ____A (PC Tools) C:\Windows\SGDetectionTool.dll
2012-07-08 20:26 - 2012-06-14 12:31 - 00085224 ____A (PC Tools) C:\Windows\System32\Drivers\PCTBD64.sys
2012-07-08 20:26 - 2012-06-14 11:03 - 00003488 ____A C:\Windows\UDB.zip
2012-07-08 20:26 - 2012-06-14 11:03 - 00000882 ____A C:\Windows\RegSDImport.xml
2012-07-08 20:26 - 2012-06-14 11:03 - 00000879 ____A C:\Windows\RegISSImport.xml
2012-07-08 20:26 - 2012-06-14 11:03 - 00000131 ____A C:\Windows\IDB.zip
2012-07-08 20:25 - 2012-05-11 11:14 - 00092896 ____A (PC Tools) C:\Windows\System32\Drivers\pctplsg64.sys
2012-07-08 20:25 - 2012-05-11 11:13 - 00014776 ____A (PC Tools) C:\Windows\System32\Drivers\pctBTFix64.sys
2012-07-08 20:25 - 2012-05-11 11:09 - 00145432 ____A (PC Tools) C:\Windows\System32\Drivers\pctwfpfilter64.sys
2012-07-08 20:25 - 2012-05-11 11:08 - 00341168 ____A (PC Tools) C:\Windows\System32\Drivers\pctgntdi64.sys
2012-07-08 20:23 - 2012-07-08 20:25 - 00000000 ____D C:\Users\All Users\PC Tools
2012-07-08 20:23 - 2012-07-08 20:25 - 00000000 ____D C:\Program Files (x86)\PC Tools
2012-07-08 20:23 - 2012-07-08 20:24 - 01631086 ____A C:\Windows\System32\Drivers\Cat.DB
2012-07-08 20:23 - 2012-07-08 20:23 - 00000000 ____D C:\Users\user\AppData\Roaming\TestApp
2012-07-08 20:23 - 2012-05-11 11:14 - 00251528 ____A (PC Tools) C:\Windows\System32\Drivers\PCTSD64.sys
2012-07-08 20:23 - 2012-04-23 12:36 - 00426616 ____A (PC Tools) C:\Windows\System32\Drivers\PCTCore64.sys
2012-07-08 20:23 - 2012-02-28 11:43 - 01096176 ____A (PC Tools) C:\Windows\System32\Drivers\pctEFA64.sys
2012-07-08 20:23 - 2012-02-28 11:43 - 00453896 ____A (PC Tools) C:\Windows\System32\Drivers\pctDS64.sys
2012-07-08 19:39 - 2012-07-08 19:39 - 00051000 ____A C:\Users\user\Desktop\Sirefef AgentBA PatchedBGen Trojan.xml
2012-07-08 18:48 - 2012-07-08 18:48 - 00000000 ____D C:\Users\user\Documents\Simply Super Software
2012-07-08 18:48 - 2012-07-08 18:48 - 00000000 ____D C:\Users\user\AppData\Roaming\Simply Super Software
2012-07-08 18:48 - 2012-07-08 18:48 - 00000000 ____D C:\Users\All Users\Simply Super Software
2012-07-08 18:48 - 2012-07-08 18:48 - 00000000 ____D C:\Program Files (x86)\Trojan Remover
2012-07-08 18:37 - 2012-07-08 18:37 - 00000000 ____D C:\Users\user\AppData\Roaming\Malwarebytes
2012-07-08 18:36 - 2012-07-08 18:36 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-07-08 18:36 - 2012-07-08 18:36 - 00000000 ____D C:\Users\All Users\Malwarebytes
2012-07-08 18:36 - 2012-07-08 18:36 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-07-08 18:36 - 2012-04-04 15:56 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-07-08 17:59 - 2012-07-08 17:59 - 00000000 __SHD C:\Windows\SysWOW64\%APPDATA%
2012-07-07 09:49 - 2012-07-07 10:00 - 00000000 ____D C:\Users\user\Downloads\The Universal Book of Mathematics
2012-07-07 09:42 - 2012-07-07 09:47 - 00000000 ____D C:\Users\user\Downloads\The Golds Gym Beginners Guide to Fitness -Mantesh
2012-07-07 09:16 - 2012-07-07 13:42 - 00000000 ____D C:\Users\user\Downloads\voltron.vehicle.force.dvdrip.merchant
2012-07-06 22:49 - 2012-07-07 15:31 - 00000000 ____D C:\Users\user\Downloads\Meditation Buddhist Reincarnation Yogi Tibet SuperPack
2012-07-06 22:49 - 2012-07-07 09:24 - 00000000 ____D C:\Users\user\Downloads\Quantum Mind Power
2012-07-06 22:20 - 2012-07-06 22:24 - 01572610 ____A C:\Users\user\Downloads\TheEssentialsofRealEstateInvestments.zip
2012-07-06 22:16 - 2012-07-07 11:53 - 00000000 ____D C:\Users\user\Downloads\Johnny Test [Seasons 3 and 4]
2012-07-06 22:16 - 2012-07-07 10:16 - 00000000 ____D C:\Users\user\Downloads\Johnny Test [Seasons 1 and 2]
2012-07-06 22:10 - 2012-07-06 22:11 - 00000000 ____D C:\Users\user\Desktop\Books record
2012-07-05 20:10 - 2012-07-05 22:32 - 657831936 ____A
2012-07-01 20:57 - 2012-07-01 20:58 - 00000000 ____D C:\Users\user\Desktop\旋?下?网_???.-.[?曲情怀~???II].??.(ape)_tencd.com
2012-06-24 17:52 - 2012-06-03 06:19 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-24 17:52 - 2012-06-03 06:19 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-24 17:52 - 2012-06-03 06:19 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-24 17:52 - 2012-06-03 06:19 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-24 17:52 - 2012-06-03 06:19 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-24 17:52 - 2012-06-03 06:15 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-24 17:52 - 2012-06-03 06:15 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-24 17:52 - 2012-06-02 15:19 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-24 17:52 - 2012-06-02 15:15 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-24 17:50 - 2012-07-08 17:46 - 00000000 ____D C:\Users\user\Downloads\Edgar Cayce Foundation - Be Your Own Psychic
2012-06-23 18:38 - 2012-06-23 18:39 - 00000000 ____D C:\Users\user\Desktop\Power Rangers
2012-06-23 14:16 - 2012-06-23 14:16 - 00821248 ____A C:\Users\user\Desktop\FreeISOBurner.exe
2012-06-23 14:07 - 2012-06-23 14:07 - 00000000 ____D C:\Program Files (x86)\MagicDisc
2012-06-23 14:07 - 2009-02-24 18:35 - 00255552 ____A (MagicISO, Inc.) C:\Windows\SysWOW64\Drivers\mcdbus.sys
2012-06-23 14:07 - 2009-02-24 18:35 - 00255552 ____A (MagicISO, Inc.) C:\Windows\System32\Drivers\mcdbus.sys
2012-06-22 18:01 - 2012-06-26 20:21 - 00000000 ____D C:\Program Files (x86)\Roozz
2012-06-22 09:30 - 2012-06-22 09:32 - 00000000 ____D C:\Users\user\Desktop\Ebook DRM Removal
2012-06-20 12:44 - 2012-06-20 12:44 - 02214564 ____A C:\Users\user\Desktop\subaru.wma
2012-06-20 12:28 - 2012-06-20 12:32 - 00000000 ____D C:\Users\user\Desktop\???.-.[天碟大?].??.(ape)
2012-06-18 13:36 - 2012-06-18 13:36 - 00000768 ____A C:\Users\Public\Desktop\Sigil.lnk
2012-06-18 13:36 - 2012-06-18 13:36 - 00000000 ____D C:\Users\user\AppData\Local\sigil-ebook
2012-06-18 13:36 - 2012-06-18 13:36 - 00000000 ____D C:\Program Files\Sigil
2012-06-16 17:15 - 2012-06-16 19:16 - 00000000 ____D C:\Users\user\Desktop\Wrath of the Titans (2012) [1080p]
2012-06-16 16:50 - 2012-06-16 16:50 - 00000000 ____D C:\Users\user\Documents\My Digital Editions
2012-06-14 14:12 - 2012-05-18 10:47 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-06-14 14:12 - 2012-05-18 10:16 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-06-14 14:12 - 2012-05-18 10:06 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-06-14 14:12 - 2012-05-18 09:59 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-06-14 14:12 - 2012-05-18 09:59 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-06-14 14:12 - 2012-05-18 09:58 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-06-14 14:12 - 2012-05-18 09:58 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-06-14 14:12 - 2012-05-18 09:56 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-06-14 14:12 - 2012-05-18 09:55 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-06-14 14:12 - 2012-05-18 09:55 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-06-14 14:12 - 2012-05-18 09:54 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-06-14 14:12 - 2012-05-18 09:51 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-06-14 14:12 - 2012-05-18 09:51 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-06-14 14:12 - 2012-05-18 09:47 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-06-14 14:12 - 2012-05-18 07:11 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-06-14 14:12 - 2012-05-18 06:48 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-06-14 14:12 - 2012-05-18 06:45 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2012-06-14 14:12 - 2012-05-18 06:36 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-06-14 14:12 - 2012-05-18 06:35 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2012-06-14 14:12 - 2012-05-18 06:35 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-06-14 14:12 - 2012-05-18 06:33 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-06-14 14:12 - 2012-05-18 06:31 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-06-14 14:12 - 2012-05-18 06:29 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2012-06-14 14:12 - 2012-05-18 06:29 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2012-06-14 14:12 - 2012-05-18 06:27 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-06-14 14:12 - 2012-05-18 06:25 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-06-14 14:12 - 2012-05-18 06:24 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-06-14 14:12 - 2012-05-18 06:20 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-06-14 13:32 - 2012-05-15 09:32 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-06-14 13:32 - 2012-05-04 19:06 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-06-14 13:32 - 2012-05-04 18:03 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-06-14 13:32 - 2012-05-04 18:03 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-06-14 13:32 - 2012-05-01 13:40 - 00209920 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2012-06-14 13:32 - 2012-04-28 11:55 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-06-14 13:32 - 2012-04-26 13:41 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-06-14 13:32 - 2012-04-26 13:41 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-06-14 13:32 - 2012-04-26 13:34 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-06-14 13:32 - 2012-04-24 13:37 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-06-14 13:32 - 2012-04-24 13:37 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-06-14 13:32 - 2012-04-24 13:37 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-06-14 13:32 - 2012-04-24 12:36 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2012-06-14 13:32 - 2012-04-24 12:36 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2012-06-14 13:32 - 2012-04-24 12:36 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2012-06-14 13:32 - 2012-04-07 20:31 - 03216384 ____A (Microsoft Corporation) C:\Windows\System32\msi.dll
2012-06-14 13:32 - 2012-04-07 19:26 - 02342400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2012-06-11 21:10 - 2012-06-11 21:31 - 00000600 ____A C:\Users\user\AppData\Roaming\winscp.rnd
2012-06-11 21:10 - 2012-06-11 21:10 - 00000000 ____D C:\Program Files (x86)\WinSCP
2012-06-10 23:28 - 2012-06-10 23:28 - 00002845 ____A C:\Users\Public\Desktop\ABBYY FineReader 11.lnk
2012-06-10 23:22 - 2012-06-10 23:29 - 00000000 ____D C:\Program Files (x86)\ABBYY FineReader 11
2012-06-10 23:01 - 2012-06-10 23:01 - 00000000 ____D C:\Users\user\AppData\Roaming\ABBYY
2012-06-10 22:51 - 2012-06-17 16:21 - 00000000 ____D C:\Users\user\AppData\Local\ABBYY
2012-06-10 22:51 - 2012-06-10 23:22 - 00000000 ____D C:\Users\All Users\ABBYY
2012-06-10 22:22 - 2012-06-10 22:22 - 00018224 ____A C:\Windows\System32\results.xml
2012-06-10 22:18 - 2011-12-26 04:02 - 00120832 ____A (Intel Corporation) C:\Windows\System32\IntelOpenCL64.dll
2012-06-10 22:17 - 2012-06-10 22:17 - 00000000 ____D C:\Program Files\Common Files\Intel
2012-06-10 22:17 - 2011-12-26 04:07 - 00086016 ____A (Intel Corporation) C:\Windows\SysWOW64\IntelOpenCL32.dll
2012-06-10 20:41 - 2012-03-27 19:16 - 00272629 ____A C:\Windows\System32\Drivers\RTAIODAT.DAT
2012-06-10 20:41 - 2012-03-27 17:03 - 04015592 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\Drivers\RTKVHD64.sys
2012-06-10 20:41 - 2012-03-21 15:55 - 02886656 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RCoRes64.dat
2012-06-10 20:41 - 2012-03-20 10:47 - 03608680 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtkAPO64.dll
2012-06-10 20:41 - 2012-03-19 19:01 - 00102504 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RCoInstII64.dll
2012-06-10 20:41 - 2012-03-16 16:25 - 02670696 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtPgEx64.dll
2012-06-10 20:41 - 2012-03-13 11:21 - 01251432 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RTCOM64.dll
2012-06-10 20:41 - 2012-03-07 11:09 - 00824424 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtkApi64.dll
2012-06-10 20:41 - 2012-02-21 19:45 - 02605400 ____A (Waves Audio Ltd.) C:\Windows\System32\WavesGUILib.dll
2012-06-10 20:41 - 2012-02-17 15:54 - 00396632 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxVolumeSDAPO.dll
2012-06-10 20:41 - 2012-02-14 00:05 - 08363864 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioRealtek.dll
2012-06-10 20:41 - 2012-02-13 22:35 - 00978776 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioAPOShell64.dll
2012-06-10 20:41 - 2012-01-30 11:43 - 00836544 ____A (TOSHIBA Corporation) C:\Windows\System32\tadefxapo264.dll
2012-06-10 20:41 - 2012-01-10 10:20 - 00065944 ____A (TOSHIBA CORPORATION.) C:\Windows\System32\tepeqapo64.dll
2012-06-10 20:41 - 2011-12-20 15:32 - 00331880 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtlCPAPI64.dll
2012-06-10 20:41 - 2011-12-20 05:43 - 00220776 ____A (Sony Corporation) C:\Windows\System32\SFSS_APO.dll
2012-06-10 20:41 - 2011-12-18 17:58 - 02131288 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioEQ.dll
2012-06-10 20:41 - 2011-12-18 17:58 - 01247576 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioRealtek264.dll
2012-06-10 20:41 - 2011-12-15 13:16 - 07163744 ____A (Dolby Laboratories) C:\Windows\System32\R4EEP64A.dll
2012-06-10 20:41 - 2011-12-15 13:16 - 00433504 ____A (Dolby Laboratories) C:\Windows\System32\R4EED64A.dll
2012-06-10 20:41 - 2011-12-15 13:16 - 00137056 ____A (Dolby Laboratories) C:\Windows\System32\R4EEL64A.dll
2012-06-10 20:41 - 2011-12-15 13:16 - 00120160 ____A (Dolby Laboratories) C:\Windows\System32\R4EEA64A.dll
2012-06-10 20:41 - 2011-12-15 13:16 - 00075104 ____A (Dolby Laboratories) C:\Windows\System32\R4EEG64A.dll
2012-06-10 20:41 - 2011-12-13 16:58 - 01560168 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RTSnMg64.cpl
2012-06-10 20:41 - 2011-11-22 16:28 - 00014952 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtkCoLDR64.dll
2012-06-10 20:41 - 2011-09-02 14:21 - 00221024 ____A (Synopsys, Inc.) C:\Windows\System32\SFNHK64.dll
2012-06-10 20:41 - 2011-09-02 14:21 - 00081248 ____A (Synopsys, Inc.) C:\Windows\System32\SFCOM64.dll
2012-06-10 20:41 - 2011-09-02 14:21 - 00078688 ____A (Synopsys, Inc.) C:\Windows\System32\SFAPO64.dll
2012-06-10 20:41 - 2011-08-23 17:00 - 00603984 ____A (Knowles Acoustics ) C:\Windows\System32\KAAPORT64.dll
2012-06-10 20:41 - 2011-03-17 12:17 - 01361336 ____A (TOSHIBA Corporation) C:\Windows\System32\tosade.dll
2012-06-10 20:41 - 2011-03-07 17:11 - 00148416 ____A (TOSHIBA Corporation) C:\Windows\System32\tadefxapo.dll
2012-06-10 20:41 - 2010-11-08 07:31 - 00375128 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RTEEP64A.dll
2012-06-10 20:41 - 2010-11-08 07:31 - 00310104 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RP3DHT64.dll
2012-06-10 20:41 - 2010-11-08 07:31 - 00310104 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RP3DAA64.dll
2012-06-10 20:41 - 2010-11-08 07:31 - 00204120 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RTEED64A.dll
2012-06-10 20:41 - 2010-11-08 07:31 - 00101208 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RTEEL64A.dll
2012-06-10 20:41 - 2010-11-08 07:31 - 00078680 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RTEEG64A.dll
2012-06-10 20:41 - 2010-11-03 18:30 - 00149608 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtkCfg64.dll
2012-06-10 20:41 - 2010-10-03 13:46 - 00341336 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioAPO30.dll
2012-06-10 20:41 - 2010-09-27 09:34 - 00318808 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioAPO20.dll
2012-06-10 20:41 - 2010-07-22 16:48 - 00074064 ____A (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll
2012-06-10 20:41 - 2009-11-24 09:55 - 00518896 ____A (SRS Labs, Inc.) C:\Windows\System32\SRSTSX64.dll
2012-06-10 20:41 - 2009-11-24 09:55 - 00211184 ____A (SRS Labs, Inc.) C:\Windows\System32\SRSTSH64.dll
2012-06-10 20:41 - 2009-11-24 09:55 - 00198896 ____A (SRS Labs, Inc.) C:\Windows\System32\SRSHP64.dll
2012-06-10 20:41 - 2009-11-24 09:55 - 00155888 ____A (SRS Labs, Inc.) C:\Windows\System32\SRSWOW64.dll
2012-06-10 20:40 - 2012-03-08 11:47 - 00202336 ____A (Andrea Electronics Corporation) C:\Windows\System32\AERTAC64.dll
2012-06-10 20:40 - 2012-03-08 11:47 - 00108640 ____A (Andrea Electronics Corporation) C:\Windows\System32\AERTAR64.dll
2012-06-10 20:40 - 2012-02-21 14:26 - 02528832 ____A (Fortemedia Corporation) C:\Windows\System32\FMAPO64.dll
2012-06-10 20:40 - 2012-01-23 22:30 - 00537456 ____A (DTS) C:\Windows\System32\DTSU2PLFX64.dll
2012-06-10 20:40 - 2012-01-23 22:30 - 00524656 ____A (DTS) C:\Windows\System32\DTSU2PGFX64.dll
2012-06-10 20:40 - 2012-01-23 22:30 - 00449392 ____A (DTS) C:\Windows\System32\DTSU2PREC64.dll
2012-06-10 20:40 - 2011-12-13 11:01 - 01698408 ____A (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2012-06-10 20:40 - 2011-05-31 09:42 - 01756264 ____A (DTS) C:\Windows\System32\DTSS2SpeakerDLL64.dll
2012-06-10 20:40 - 2011-05-31 09:42 - 01568360 ____A (DTS) C:\Windows\System32\DTSS2HeadphoneDLL64.dll
2012-06-10 20:40 - 2011-05-31 09:42 - 01486952 ____A (DTS) C:\Windows\System32\DTSBoostDLL64.dll
2012-06-10 20:40 - 2011-05-31 09:42 - 00728680 ____A (DTS) C:\Windows\System32\DTSBassEnhancementDLL64.dll
2012-06-10 20:40 - 2011-05-31 09:42 - 00712296 ____A (DTS) C:\Windows\System32\DTSSymmetryDLL64.dll
2012-06-10 20:40 - 2011-05-31 09:42 - 00693352 ____A (DTS) C:\Windows\System32\DTSVoiceClarityDLL64.dll
2012-06-10 20:40 - 2011-05-31 09:42 - 00491112 ____A (DTS) C:\Windows\System32\DTSNeoPCDLL64.dll
2012-06-10 20:40 - 2011-05-31 09:42 - 00432744 ____A (DTS) C:\Windows\System32\DTSLimiterDLL64.dll
2012-06-10 20:40 - 2011-05-31 09:42 - 00428648 ____A (DTS) C:\Windows\System32\DTSGainCompensatorDLL64.dll
2012-06-10 20:40 - 2011-05-31 09:42 - 00242792 ____A (DTS) C:\Windows\System32\DTSLFXAPO64.dll
2012-06-10 20:40 - 2011-05-31 09:42 - 00242792 ____A (DTS) C:\Windows\System32\DTSGFXAPO64.dll
2012-06-10 20:40 - 2011-05-31 09:42 - 00241768 ____A (DTS) C:\Windows\System32\DTSGFXAPONS64.dll
2012-06-10 20:31 - 2012-06-10 20:31 - 04022504 ____A C:\Windows\SysWOW64\SpoonUninstall.exe
2012-06-10 20:31 - 2012-06-10 20:31 - 00033846 ____A C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp Music Converter.bmp
2012-06-10 20:31 - 2012-06-10 20:31 - 00033846 ____A C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp DSP Effects.bmp
2012-06-10 20:31 - 2012-06-10 20:31 - 00017950 ____A C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp Music Converter.dat
2012-06-10 20:31 - 2012-06-10 20:31 - 00013082 ____A C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp DSP Effects.dat
2012-06-10 20:31 - 2012-06-10 20:31 - 00000000 ____D C:\Users\user\AppData\Roaming\AccurateRip
2012-06-10 20:31 - 2012-06-10 20:31 - 00000000 ____D C:\Program Files (x86)\Illustrate
2012-06-10 20:24 - 2012-06-10 20:24 - 01263200 ____A (Acronis) C:\Windows\System32\Drivers\tdrpm273.sys
2012-06-10 20:24 - 2012-06-10 20:24 - 00970336 ____A (Acronis) C:\Windows\System32\Drivers\timntr.sys
2012-06-10 20:24 - 2012-06-10 20:24 - 00279136 ____A (Acronis) C:\Windows\System32\Drivers\afcdp.sys
2012-06-10 20:24 - 2012-06-10 20:24 - 00001139 ____A C:\Users\Public\Desktop\Acronis True Image Home 2011.lnk
2012-06-10 20:24 - 2012-06-10 20:24 - 00000000 ____D C:\Program Files (x86)\Acronis
2012-06-10 20:23 - 2012-06-10 20:24 - 00000000 ____D C:\Users\user\Documents\Quick-PDF PDF to Word
2012-06-10 20:23 - 2012-06-10 20:23 - 00000000 ____D C:\Program Files (x86)\PDF to Word
2012-06-10 20:22 - 2012-06-10 20:25 - 00000000 ____D C:\Users\All Users\Acronis
2012-06-10 20:16 - 2012-06-10 20:16 - 00000000 ____D C:\Users\All Users\Intel
2012-06-10 20:16 - 2012-06-10 20:16 - 00000000 ____D C:\Program Files\Intel
2012-06-10 20:15 - 2011-11-10 02:04 - 00060184 ____A (Intel Corporation) C:\Windows\System32\Drivers\HECIx64.sys
2012-06-10 20:12 - 2012-06-10 20:15 - 118258657 ____A (Acronis) C:\Users\user\Desktop\ATIH2011_full_en-US.exe
2012-06-10 20:07 - 2012-06-10 20:10 - 00000000 ____D C:\Users\user\AppData\Roaming\driveridentifier
2012-06-10 20:02 - 2012-06-10 22:13 - 00000000 ____D C:\Users\All Users\Downloaded Installations
2012-06-10 19:47 - 2012-06-26 22:18 - 00000000 ____D C:\Users\All Users\DriverGenius
2012-06-10 19:47 - 2012-06-10 19:51 - 00000000 ____D C:\Users\Public\Documents\DriverGenius
2012-06-10 19:43 - 2012-06-10 19:46 - 13834726 ____A C:\Users\user\Desktop\Driver.Genius.Pro.v11.0.0.1128[A4].rar
2012-06-10 19:40 - 2012-06-10 19:40 - 00000000 ____D C:\Users\user\Documents\DriverGenius
2012-06-10 19:39 - 2012-06-10 19:47 - 00001211 ____A C:\Users\user\Desktop\Driver Genius Professional Edition.lnk
2012-06-10 19:39 - 2012-06-10 19:40 - 00000000 ____D C:\Users\user\Desktop\dMC-R14.2-Ref-Registered
2012-06-10 19:39 - 2012-06-10 19:39 - 00000000 ____D C:\Program Files (x86)\Driver-Soft

 

[hokokhua]

============ 3 Months Modified Files ========================

2012-07-08 21:17 - 2012-07-08 21:17 - 01432863 ____A C:\Users\user\Desktop\FRST64.exe
2012-07-08 20:50 - 2011-11-30 19:52 - 01386920 ____A C:\Windows\WindowsUpdate.log
2012-07-08 20:46 - 2012-04-02 15:09 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-07-08 20:42 - 2009-07-14 12:45 - 00022080 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-07-08 20:42 - 2009-07-14 12:45 - 00022080 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-07-08 20:35 - 2009-07-14 13:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-07-08 20:35 - 2009-07-14 12:51 - 00085498 ____A C:\Windows\setupact.log
2012-07-08 20:24 - 2012-07-08 20:23 - 01631086 ____A C:\Windows\System32\Drivers\Cat.DB
2012-07-08 19:40 - 2012-02-05 12:06 - 01101312 __ASH C:\Users\user\Desktop\Thumbs.db
2012-07-08 19:39 - 2012-07-08 19:39 - 00051000 ____A C:\Users\user\Desktop\Sirefef AgentBA PatchedBGen Trojan.xml
2012-07-08 19:31 - 2011-11-30 21:07 - 00000904 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3892454325-3400438884-1050192996-1000UA.job
2012-07-08 19:31 - 2011-11-30 21:07 - 00000852 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3892454325-3400438884-1050192996-1000Core.job
2012-07-08 18:36 - 2012-07-08 18:36 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-07-07 23:37 - 2009-07-14 13:13 - 00726444 ____A C:\Windows\System32\PerfStringBackup.INI
2012-07-06 21:37 - 2012-02-02 22:06 - 00483840 __ASH C:\Users\user\Downloads\Thumbs.db
2012-07-06 19:47 - 2012-01-06 20:54 - 00012170 ____A C:\Users\user\AppData\Roaming\SmarThruOptions.xml
2012-07-06 16:15 - 2012-04-02 15:09 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-07-06 16:15 - 2011-12-14 20:20 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-06-23 20:46 - 2012-04-02 15:46 - 09815752 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2012-06-23 14:16 - 2012-06-23 14:16 - 00821248 ____A C:\Users\user\Desktop\FreeISOBurner.exe
2012-06-20 12:44 - 2012-06-20 12:44 - 02214564 ____A C:\Users\user\Desktop\subaru.wma
2012-06-18 13:36 - 2012-06-18 13:36 - 00000768 ____A C:\Users\Public\Desktop\Sigil.lnk
2012-06-14 19:59 - 2009-07-14 12:45 - 00310648 ____A C:\Windows\System32\FNTCACHE.DAT
2012-06-14 14:16 - 2011-11-30 21:06 - 58957832 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-06-14 12:31 - 2012-07-08 20:26 - 02267096 ____A (Threat Expert Ltd.) C:\Windows\PCTBDCore.dll
2012-06-14 12:31 - 2012-07-08 20:26 - 01681368 ____A (Threat Expert Ltd.) C:\Windows\PCTBDRes.dll
2012-06-14 12:31 - 2012-07-08 20:26 - 00767960 ____A C:\Windows\BDTSupport.dll
2012-06-14 12:31 - 2012-07-08 20:26 - 00149464 ____A (PC Tools) C:\Windows\SGDetectionTool.dll
2012-06-14 12:31 - 2012-07-08 20:26 - 00085224 ____A (PC Tools) C:\Windows\System32\Drivers\PCTBD64.sys
2012-06-14 11:03 - 2012-07-08 20:26 - 00003488 ____A C:\Windows\UDB.zip
2012-06-14 11:03 - 2012-07-08 20:26 - 00000882 ____A C:\Windows\RegSDImport.xml
2012-06-14 11:03 - 2012-07-08 20:26 - 00000879 ____A C:\Windows\RegISSImport.xml
2012-06-14 11:03 - 2012-07-08 20:26 - 00000131 ____A C:\Windows\IDB.zip
2012-06-11 21:31 - 2012-06-11 21:10 - 00000600 ____A C:\Users\user\AppData\Roaming\winscp.rnd
2012-06-10 23:37 - 2012-01-14 16:09 - 372410176 ____A C:\Users\user\Desktop\?音碟.-.[?音示范碟.音?].??.(APE).rar
2012-06-10 23:30 - 2012-01-16 21:03 - 399476704 ____A C:\Users\user\Desktop\?音碟.-.[Pony.Canyon.Audiophile.Test.CD.2002].??.(ape).ape
2012-06-10 23:28 - 2012-06-10 23:28 - 00002845 ____A C:\Users\Public\Desktop\ABBYY FineReader 11.lnk
2012-06-10 22:22 - 2012-06-10 22:22 - 00018224 ____A C:\Windows\System32\results.xml
2012-06-10 20:39 - 2010-11-21 11:47 - 00019974 ____A C:\Windows\PFRO.log
2012-06-10 20:31 - 2012-06-10 20:31 - 04022504 ____A C:\Windows\SysWOW64\SpoonUninstall.exe
2012-06-10 20:31 - 2012-06-10 20:31 - 00033846 ____A C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp Music Converter.bmp
2012-06-10 20:31 - 2012-06-10 20:31 - 00033846 ____A C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp DSP Effects.bmp
2012-06-10 20:31 - 2012-06-10 20:31 - 00017950 ____A C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp Music Converter.dat
2012-06-10 20:31 - 2012-06-10 20:31 - 00013082 ____A C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp DSP Effects.dat
2012-06-10 20:24 - 2012-06-10 20:24 - 01263200 ____A (Acronis) C:\Windows\System32\Drivers\tdrpm273.sys
2012-06-10 20:24 - 2012-06-10 20:24 - 00970336 ____A (Acronis) C:\Windows\System32\Drivers\timntr.sys
2012-06-10 20:24 - 2012-06-10 20:24 - 00279136 ____A (Acronis) C:\Windows\System32\Drivers\afcdp.sys
2012-06-10 20:24 - 2012-06-10 20:24 - 00001139 ____A C:\Users\Public\Desktop\Acronis True Image Home 2011.lnk
2012-06-10 20:24 - 2012-03-31 18:46 - 00277088 ____A (Acronis) C:\Windows\System32\Drivers\snapman.sys
2012-06-10 20:15 - 2012-06-10 20:12 - 118258657 ____A (Acronis) C:\Users\user\Desktop\ATIH2011_full_en-US.exe
2012-06-10 19:47 - 2012-06-10 19:39 - 00001211 ____A C:\Users\user\Desktop\Driver Genius Professional Edition.lnk
2012-06-10 19:46 - 2012-06-10 19:43 - 13834726 ____A C:\Users\user\Desktop\Driver.Genius.Pro.v11.0.0.1128[A4].rar
2012-06-06 19:52 - 2009-07-14 13:08 - 00032600 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-06-05 21:24 - 2012-06-05 21:24 - 507326510 ____A C:\Windows\MEMORY.DMP
2012-06-05 21:24 - 2012-06-05 21:24 - 00303160 ____A C:\Windows\Minidump\060512-15428-01.dmp
2012-06-04 19:32 - 2012-01-07 21:08 - 00198832 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
2012-06-04 19:31 - 2012-01-07 21:08 - 00006656 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll
2012-06-04 19:31 - 2012-01-07 21:08 - 00005632 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll
2012-06-04 19:31 - 2011-09-16 14:21 - 00499712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2012-06-04 19:31 - 2011-09-16 14:21 - 00348160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2012-06-04 19:31 - 2008-09-04 09:47 - 00272896 ____A (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll
2012-06-03 06:19 - 2012-06-24 17:52 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-03 06:19 - 2012-06-24 17:52 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-03 06:19 - 2012-06-24 17:52 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-03 06:19 - 2012-06-24 17:52 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-03 06:19 - 2012-06-24 17:52 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-03 06:15 - 2012-06-24 17:52 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-03 06:15 - 2012-06-24 17:52 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-02 15:19 - 2012-06-24 17:52 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-02 15:15 - 2012-06-24 17:52 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-01 22:44 - 2011-12-15 23:00 - 296968276 ____A C:\Users\user\Desktop\Various.Artists.-.[Audiophile.Female.Voices.2008].??.(Flac).flac
2012-06-01 17:07 - 2012-03-31 11:11 - 00032266 ____A C:\Windows\DPINST.LOG
2012-05-31 12:21 - 2012-05-31 11:27 - 00901101 ____N C:\Windows\Minidump\053112-16005-01.dmp
2012-05-31 11:27 - 2012-05-31 11:27 - 00303288 ____A C:\Windows\Minidump\053112-18220-01.dmp
2012-05-25 01:27 - 2012-05-31 14:48 - 11175424 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\Drivers\atikmdag.sys
2012-05-25 01:15 - 2012-05-31 14:48 - 00245944 ____A C:\Windows\SysWOW64\atiapfxx.blb
2012-05-25 01:15 - 2012-05-31 14:48 - 00245944 ____A C:\Windows\System32\atiapfxx.blb
2012-05-25 01:13 - 2012-05-31 14:48 - 00159744 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\atiapfxx.exe
2012-05-25 01:13 - 2011-05-25 11:07 - 00909312 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\aticfx32.dll
2012-05-25 01:11 - 2011-05-25 11:06 - 01067520 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\aticfx64.dll
2012-05-25 01:08 - 2012-05-31 14:48 - 00442368 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\ATIDEMGX.dll
2012-05-25 01:08 - 2011-07-28 21:36 - 00503296 ____A (AMD) C:\Windows\System32\atieclxx.exe
2012-05-25 01:07 - 2011-07-28 21:35 - 00236544 ____A (AMD) C:\Windows\System32\atiesrxx.exe
2012-05-25 01:06 - 2012-05-31 14:48 - 00120320 ____A (AMD) C:\Windows\System32\atitmm64.dll
2012-05-25 01:05 - 2012-05-31 14:48 - 00059392 ____A (ATI Technologies, Inc.) C:\Windows\System32\atiedu64.dll
2012-05-25 01:05 - 2012-05-31 14:48 - 00043520 ____A (ATI Technologies, Inc.) C:\Windows\SysWOW64\ati2edxx.dll
2012-05-25 01:05 - 2012-05-31 14:48 - 00021504 ____A (AMD) C:\Windows\System32\atimuixx.dll
2012-05-25 01:04 - 2011-07-28 21:30 - 06800896 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atidxx32.dll
2012-05-25 00:53 - 2012-05-31 14:48 - 26181632 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\atio6axx.dll
2012-05-25 00:43 - 2011-05-25 10:49 - 07479296 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atidxx64.dll
2012-05-25 00:42 - 2011-11-30 20:47 - 00064000 ____A (AMD) C:\Windows\System32\coinst.dll
2012-05-25 00:33 - 2012-05-31 14:48 - 19753984 ____A (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atioglxx.dll
2012-05-25 00:20 - 2011-05-25 10:39 - 06203392 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdag.dll
2012-05-25 00:18 - 2012-05-31 14:48 - 01831424 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdmv.dll
2012-05-25 00:18 - 2012-05-31 14:48 - 01120768 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiumd6v.dll
2012-05-25 00:17 - 2012-05-31 14:48 - 04731904 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiumd6a.dll
2012-05-25 00:14 - 2012-05-31 14:48 - 16090624 ____A (Advanced Micro Devices Inc.) C:\Windows\System32\aticaldd64.dll
2012-05-25 00:14 - 2012-05-31 14:48 - 00051200 ____A (Advanced Micro Devices Inc.) C:\Windows\System32\aticalrt64.dll
2012-05-25 00:14 - 2012-05-31 14:48 - 00046080 ____A (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalrt.dll
2012-05-25 00:14 - 2012-05-31 14:48 - 00044544 ____A (Advanced Micro Devices Inc.) C:\Windows\System32\aticalcl64.dll
2012-05-25 00:14 - 2012-05-31 14:48 - 00044032 ____A (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalcl.dll
2012-05-25 00:13 - 2012-05-31 14:48 - 02631008 ____A C:\Windows\System32\atiumd6a.cap
2012-05-25 00:13 - 2012-05-31 14:48 - 00204952 ____A C:\Windows\SysWOW64\ativvsvl.dat
2012-05-25 00:13 - 2012-05-31 14:48 - 00204952 ____A C:\Windows\System32\ativvsvl.dat
2012-05-25 00:13 - 2012-05-31 14:48 - 00157144 ____A C:\Windows\SysWOW64\ativvsva.dat
2012-05-25 00:13 - 2012-05-31 14:48 - 00157144 ____A C:\Windows\System32\ativvsva.dat
2012-05-25 00:09 - 2012-05-31 14:48 - 13764096 ____A (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticaldd.dll
2012-05-25 00:08 - 2012-05-31 14:48 - 07431680 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiumd64.dll
2012-05-25 00:07 - 2011-05-25 10:50 - 04795904 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdva.dll
2012-05-25 00:06 - 2012-05-31 14:48 - 02664704 ____A C:\Windows\SysWOW64\atiumdva.cap
2012-05-24 23:55 - 2012-05-31 14:48 - 00360448 ____A (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atiadlxy.dll
2012-05-24 23:55 - 2011-11-10 10:13 - 00514560 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\atiadlxx.dll
2012-05-24 23:54 - 2012-05-31 14:48 - 00343040 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\Drivers\atikmpag.sys
2012-05-24 23:54 - 2012-05-31 14:48 - 00041984 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atig6txx.dll
2012-05-24 23:54 - 2012-05-31 14:48 - 00033280 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atigktxx.dll
2012-05-24 23:54 - 2012-05-31 14:48 - 00017408 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atig6pxx.dll
2012-05-24 23:54 - 2012-05-31 14:48 - 00014848 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiglpxx.dll
2012-05-24 23:54 - 2012-05-31 14:48 - 00014848 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiglpxx.dll
2012-05-24 23:53 - 2012-05-31 14:48 - 00044544 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiu9p64.dll
2012-05-24 23:53 - 2011-07-28 20:53 - 00041984 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiuxpag.dll
2012-05-24 23:53 - 2011-05-25 10:24 - 00054784 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiuxp64.dll
2012-05-24 23:53 - 2011-05-25 10:24 - 00032256 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiu9pag.dll
2012-05-24 23:52 - 2012-05-31 14:48 - 00053248 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\Drivers\ati2erec.dll
2012-05-24 23:50 - 2012-05-31 14:48 - 00054784 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atimpc64.dll
2012-05-24 23:50 - 2012-05-31 14:48 - 00054784 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\amdpcom64.dll
2012-05-24 23:50 - 2012-05-31 14:48 - 00053760 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atimpc32.dll
2012-05-24 23:50 - 2012-05-31 14:48 - 00053760 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdpcom32.dll
2012-05-22 19:52 - 2012-05-22 19:52 - 00700112 ____N C:\Windows\Minidump\052212-17565-01.dmp
2012-05-19 21:38 - 2012-01-15 00:42 - 394761734 ____A C:\Users\user\Desktop\?音碟.-.[安??音碟II].??.(ape).rar
2012-05-18 10:47 - 2012-06-14 14:12 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-05-18 10:16 - 2012-06-14 14:12 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-05-18 10:06 - 2012-06-14 14:12 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-05-18 09:59 - 2012-06-14 14:12 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-05-18 09:59 - 2012-06-14 14:12 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-05-18 09:58 - 2012-06-14 14:12 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-05-18 09:58 - 2012-06-14 14:12 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-05-18 09:56 - 2012-06-14 14:12 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-05-18 09:55 - 2012-06-14 14:12 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-05-18 09:55 - 2012-06-14 14:12 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-05-18 09:54 - 2012-06-14 14:12 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-05-18 09:51 - 2012-06-14 14:12 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-05-18 09:51 - 2012-06-14 14:12 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-05-18 09:47 - 2012-06-14 14:12 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-05-18 07:11 - 2012-06-14 14:12 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-05-18 06:48 - 2012-06-14 14:12 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-05-18 06:45 - 2012-06-14 14:12 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2012-05-18 06:36 - 2012-06-14 14:12 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-05-18 06:35 - 2012-06-14 14:12 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2012-05-18 06:35 - 2012-06-14 14:12 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-05-18 06:33 - 2012-06-14 14:12 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-05-18 06:31 - 2012-06-14 14:12 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-05-18 06:29 - 2012-06-14 14:12 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2012-05-18 06:29 - 2012-06-14 14:12 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2012-05-18 06:27 - 2012-06-14 14:12 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-05-18 06:25 - 2012-06-14 14:12 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-05-18 06:24 - 2012-06-14 14:12 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-05-18 06:20 - 2012-06-14 14:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-05-15 09:32 - 2012-06-14 13:32 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-05-12 05:28 - 2012-05-12 05:28 - 00274712 ____A (Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
2012-05-12 05:28 - 2012-05-12 05:28 - 00170264 ____A (Intel Corporation) C:\Windows\System32\igfxtray.exe
2012-05-12 05:27 - 2012-05-12 05:27 - 05894424 ____A (Intel Corporation) C:\Windows\System32\GfxUI.exe
2012-05-12 05:27 - 2012-05-12 05:27 - 00509208 ____A (Intel Corporation) C:\Windows\System32\igfxsrvc.exe
2012-05-12 05:27 - 2012-05-12 05:27 - 00439064 ____A (Intel Corporation) C:\Windows\System32\igfxpers.exe
2012-05-12 05:27 - 2012-05-12 05:27 - 00398616 ____A (Intel Corporation) C:\Windows\System32\hkcmd.exe
2012-05-12 05:27 - 2012-05-12 05:27 - 00249624 ____A (Intel Corporation) C:\Windows\System32\igfxext.exe
2012-05-12 05:27 - 2012-05-12 05:27 - 00184600 ____A (Intel Corporation) C:\Windows\System32\difx64.exe
2012-05-11 11:14 - 2012-07-08 20:25 - 00092896 ____A (PC Tools) C:\Windows\System32\Drivers\pctplsg64.sys
2012-05-11 11:14 - 2012-07-08 20:23 - 00251528 ____A (PC Tools) C:\Windows\System32\Drivers\PCTSD64.sys
2012-05-11 11:13 - 2012-07-08 20:25 - 00014776 ____A (PC Tools) C:\Windows\System32\Drivers\pctBTFix64.sys
2012-05-11 11:09 - 2012-07-08 20:25 - 00145432 ____A (PC Tools) C:\Windows\System32\Drivers\pctwfpfilter64.sys
2012-05-11 11:08 - 2012-07-08 20:25 - 00341168 ____A (PC Tools) C:\Windows\System32\Drivers\pctgntdi64.sys
2012-05-10 16:33 - 2012-05-10 16:33 - 00217600 ____A (Renesas Electronics Corporation) C:\Windows\System32\Drivers\nusb3xhc.sys
2012-05-10 16:33 - 2012-05-10 16:33 - 00097792 ____A (Renesas Electronics Corporation) C:\Windows\System32\Drivers\nusb3hub.sys
2012-05-09 20:00 - 2012-05-09 20:00 - 00000076 ____A C:\Windows\SysWOW64\llbiirc.dll
2012-05-08 05:45 - 2012-05-09 20:00 - 00380544 ____N (JRiver, Inc.) C:\Windows\SysWOW64\MC17.exe
2012-05-08 05:45 - 2012-05-09 20:00 - 00380544 ____N (JRiver, Inc.) C:\Windows\System32\MC17.exe
2012-05-04 19:06 - 2012-06-14 13:32 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-05-04 19:00 - 2012-06-26 22:15 - 00366592 ____A (Microsoft Corporation) C:\Windows\System32\qdvd.dll
2012-05-04 18:03 - 2012-06-14 13:32 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-05-04 18:03 - 2012-06-14 13:32 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-05-04 17:59 - 2012-06-26 22:15 - 00514560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2012-05-01 13:40 - 2012-06-14 13:32 - 00209920 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2012-04-30 19:49 - 2011-11-30 22:30 - 00038946 ____A C:\Users\user\Desktop\Poo Poo Chart.xlsx
2012-04-30 10:25 - 2012-04-30 10:25 - 00016892 ____A C:\Windows\System32\iglhxs64.vp
2012-04-30 10:13 - 2012-04-30 10:13 - 00090112 ____A (Intel Corporation) C:\Windows\System32\igfxCoIn_v2747.dll
2012-04-30 10:08 - 2012-04-30 10:08 - 08913440 ____A (Intel Corporation) C:\Windows\System32\Drivers\igdkmd64.sys
2012-04-30 10:08 - 2012-04-30 10:08 - 07924736 ____A (Intel Corporation) C:\Windows\System32\igdumd64.dll
2012-04-30 10:07 - 2012-04-30 10:07 - 00080896 ____A C:\Windows\System32\igdde64.dll
2012-04-30 10:05 - 2012-03-19 23:26 - 06368256 ____A (Intel Corporation) C:\Windows\SysWOW64\igdumd32.dll
2012-04-30 10:04 - 2012-04-30 10:04 - 00064512 ____A C:\Windows\SysWOW64\igdde32.dll
2012-04-30 10:03 - 2012-03-19 23:22 - 07912960 ____A (Intel Corporation) C:\Windows\System32\igd10umd64.dll
2012-04-30 09:45 - 2012-04-30 09:45 - 06300160 ____A (Intel Corporation) C:\Windows\SysWOW64\igd10umd32.dll
2012-04-30 09:08 - 2012-04-30 09:08 - 12851200 ____A (Intel Corporation) C:\Windows\System32\ig4icd64.dll
2012-04-30 09:01 - 2012-04-30 09:01 - 10640896 ____A (Intel Corporation) C:\Windows\SysWOW64\ig4icd32.dll
2012-04-30 09:00 - 2012-04-30 09:00 - 00222341 ____A C:\Windows\System32\Gfxres.th-TH.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00208899 ____A C:\Windows\System32\Gfxres.el-GR.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00193160 ____A C:\Windows\System32\Gfxres.ru-RU.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00162584 ____A C:\Windows\System32\Gfxres.ja-JP.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00158244 ____A C:\Windows\System32\Gfxres.he-IL.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00148991 ____A C:\Windows\System32\Gfxres.it-IT.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00147358 ____A C:\Windows\System32\Gfxres.ko-KR.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00146676 ____A C:\Windows\System32\Gfxres.es-ES.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00146490 ____A C:\Windows\System32\Gfxres.de-DE.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00145320 ____A C:\Windows\System32\Gfxres.ro-RO.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00144820 ____A C:\Windows\System32\Gfxres.fr-FR.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00144053 ____A C:\Windows\System32\Gfxres.tr-TR.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00143629 ____A C:\Windows\System32\Gfxres.pt-BR.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00143300 ____A C:\Windows\System32\Gfxres.nl-NL.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00143285 ____A C:\Windows\System32\Gfxres.hu-HU.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00142613 ____A C:\Windows\System32\Gfxres.pt-PT.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00142258 ____A C:\Windows\System32\Gfxres.sv-SE.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00142021 ____A C:\Windows\System32\Gfxres.pl-PL.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00141560 ____A C:\Windows\System32\Gfxres.fi-FI.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00141204 ____A C:\Windows\System32\Gfxres.sk-SK.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00140420 ____A C:\Windows\System32\Gfxres.hr-HR.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00137296 ____A C:\Windows\System32\Gfxres.sl-SI.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00137220 ____A C:\Windows\System32\Gfxres.nb-NO.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00136561 ____A C:\Windows\System32\Gfxres.da-DK.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00125721 ____A C:\Windows\System32\Gfxres.zh-TW.resources
2012-04-30 09:00 - 2012-04-30 09:00 - 00124195 ____A C:\Windows\System32\Gfxres.zh-CN.resources
2012-04-30 08:59 - 2012-04-30 08:59 - 00440320 ____A (Intel Corporation) C:\Windows\System32\igfxrell.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00439808 ____A (Intel Corporation) C:\Windows\System32\igfxrfra.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00439808 ____A (Intel Corporation) C:\Windows\System32\igfxresn.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00439296 ____A (Intel Corporation) C:\Windows\System32\igfxrrus.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00439296 ____A (Intel Corporation) C:\Windows\System32\igfxrrom.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00438784 ____A (Intel Corporation) C:\Windows\System32\igfxrsky.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00438784 ____A (Intel Corporation) C:\Windows\System32\igfxrptg.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00438784 ____A (Intel Corporation) C:\Windows\System32\igfxrplk.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00438784 ____A (Intel Corporation) C:\Windows\System32\igfxrnld.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00438784 ____A (Intel Corporation) C:\Windows\System32\igfxrita.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00438784 ____A (Intel Corporation) C:\Windows\System32\igfxrhrv.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00438784 ____A (Intel Corporation) C:\Windows\System32\igfxrdeu.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00438272 ____A (Intel Corporation) C:\Windows\System32\igfxrhun.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00438272 ____A (Intel Corporation) C:\Windows\System32\igfxrfin.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00438272 ____A (Intel Corporation) C:\Windows\System32\igfxrcsy.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00437760 ____A (Intel Corporation) C:\Windows\System32\igfxrtrk.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00437760 ____A (Intel Corporation) C:\Windows\System32\igfxrsve.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00437760 ____A (Intel Corporation) C:\Windows\System32\igfxrslv.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00437760 ____A (Intel Corporation) C:\Windows\System32\igfxrptb.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00437760 ____A (Intel Corporation) C:\Windows\System32\igfxrnor.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00437248 ____A (Intel Corporation) C:\Windows\System32\igfxrtha.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00437248 ____A (Intel Corporation) C:\Windows\System32\igfxrdan.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00435712 ____A (Intel Corporation) C:\Windows\System32\igfxrheb.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00435712 ____A (Intel Corporation) C:\Windows\System32\igfxrara.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00432128 ____A (Intel Corporation) C:\Windows\System32\igfxrjpn.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00431104 ____A (Intel Corporation) C:\Windows\System32\igfxrkor.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00429056 ____A (Intel Corporation) C:\Windows\System32\igfxrcht.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00428544 ____A (Intel Corporation) C:\Windows\System32\igfxrchs.lrc
2012-04-30 08:59 - 2012-04-30 08:59 - 00410624 ____A (Intel Corporation) C:\Windows\System32\igfxTMM.dll
2012-04-30 08:59 - 2012-04-30 08:59 - 00390144 ____A (Intel Corporation) C:\Windows\System32\igfxpph.dll
2012-04-30 08:59 - 2012-04-30 08:59 - 00165366 ____A C:\Windows\System32\Gfxres.ar-SA.resources
2012-04-30 08:59 - 2012-04-30 08:59 - 00141764 ____A C:\Windows\System32\Gfxres.cs-CZ.resources
2012-04-30 08:59 - 2012-04-30 08:59 - 00132105 ____A C:\Windows\System32\Gfxres.en-US.resources
2012-04-30 08:59 - 2012-04-30 08:59 - 00126976 ____A (Intel Corporation) C:\Windows\System32\igfxcpl.cpl
2012-04-30 08:59 - 2012-04-30 08:59 - 00028672 ____A (Intel Corporation) C:\Windows\System32\igfxexps.dll
2012-04-30 08:59 - 2012-03-19 22:17 - 00062976 ____A (Intel Corporation) C:\Windows\System32\igfxsrvc.dll
2012-04-30 08:58 - 2012-04-30 08:58 - 00437760 ____A (Intel Corporation) C:\Windows\System32\igfxdev.dll
2012-04-30 08:58 - 2012-04-30 08:58 - 00286208 ____A (Intel Corporation) C:\Windows\System32\igfxrenu.lrc
2012-04-30 08:58 - 2012-04-30 08:58 - 00172032 ____A (Intel Corporation) C:\Windows\System32\gfxSrvc.dll
2012-04-30 08:58 - 2012-04-30 08:58 - 00009216 ____A ( ) C:\Windows\System32\IGFXDEVLib.dll
2012-04-30 08:58 - 2012-03-19 22:17 - 00110592 ____A (Intel Corporation) C:\Windows\System32\hccutils.dll
2012-04-30 08:57 - 2012-04-30 08:57 - 00142336 ____A (Intel Corporation) C:\Windows\System32\igfxdo.dll
2012-04-30 08:57 - 2012-04-30 08:57 - 00025088 ____A (Intel Corporation) C:\Windows\SysWOW64\igfxexps32.dll
2012-04-30 08:57 - 2012-03-19 22:16 - 09007616 ____A (Intel Corporation) C:\Windows\System32\igfxress.dll
2012-04-30 08:56 - 2012-04-30 08:56 - 00326656 ____A (Intel Corporation) C:\Windows\SysWOW64\igfxdv32.dll
2012-04-30 08:54 - 2012-04-30 08:54 - 00963388 ____A C:\Windows\SysWOW64\igcodeckrng600.bin
2012-04-30 08:54 - 2012-04-30 08:54 - 00963388 ____A C:\Windows\System32\igcodeckrng600.bin
2012-04-30 08:54 - 2012-04-30 08:54 - 00524800 ____A (Intel Corporation) C:\Windows\System32\iglhsip64.dll
2012-04-30 08:54 - 2012-04-30 08:54 - 00519680 ____A (Intel Corporation) C:\Windows\SysWOW64\iglhsip32.dll
2012-04-30 08:54 - 2012-04-30 08:54 - 00272888 ____A C:\Windows\SysWOW64\igvpkrng600.bin
2012-04-30 08:54 - 2012-04-30 08:54 - 00272888 ____A C:\Windows\System32\igvpkrng600.bin
2012-04-30 08:54 - 2012-04-30 08:54 - 00243712 ____A (Intel Corporation) C:\Windows\System32\iglhcp64.dll
2012-04-30 08:54 - 2012-04-30 08:54 - 00201216 ____A (Intel Corporation) C:\Windows\SysWOW64\iglhcp32.dll
2012-04-28 11:55 - 2012-06-14 13:32 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-04-26 13:41 - 2012-06-14 13:32 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-04-26 13:41 - 2012-06-14 13:32 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-04-26 13:34 - 2012-06-14 13:32 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-04-24 13:37 - 2012-06-14 13:32 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-04-24 13:37 - 2012-06-14 13:32 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-04-24 13:37 - 2012-06-14 13:32 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-04-24 12:36 - 2012-06-14 13:32 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2012-04-24 12:36 - 2012-06-14 13:32 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2012-04-24 12:36 - 2012-06-14 13:32 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2012-04-23 12:36 - 2012-07-08 20:23 - 00426616 ____A (PC Tools) C:\Windows\System32\Drivers\PCTCore64.sys
2012-04-18 09:16 - 2012-05-31 14:51 - 00090624 ____A (Advanced Micro Devices) C:\Windows\System32\Drivers\AtihdW86.sys
2012-04-14 20:26 - 2012-04-14 20:26 - 00303224 ____A C:\Windows\Minidump\041412-15662-01.dmp

ZeroAccess:
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\@
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\L
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\U
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\L\00000004.@
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\L\1afb2d56
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\U\00000004.@
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\U\000000cb.@
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\U\80000032.@
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\U\80000064.@

ZeroAccess:
C:\Windows\assembly\GAC_32\Desktop.ini

ZeroAccess:
C:\Windows\assembly\GAC_64\Desktop.ini

========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe
[2009-07-14 07:19] - [2009-07-14 09:39] - 0329216 ____A () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\System32\services.exe IS INFECTED. <===== ATTENTION!

C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

========================= Memory info ======================

Percentage of memory in use: 48%
Total physical RAM: 8109.43 MB
Available physical RAM: 4178.05 MB
Total Pagefile: 16217.05 MB
Available Pagefile: 12069.96 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

======================= Partitions =========================

1 Drive c: () (Fixed) (Total:999.9 GB) (Free:143.92 GB) NTFS
2 Drive d: () (Fixed) (Total:863.02 GB) (Free:338.94 GB) NTFS
3 Drive e: (MY_DATA_042411) (CDROM) (Total:0.1 GB) (Free:0 GB) CDFS

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 1863 GB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 100 MB 1024 KB
Partition 2 Primary 999 GB 101 MB
Partition 3 Primary 863 GB 1000 GB

==================================================================================

Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 System Rese NTFS Partition 100 MB Healthy System (partition with boot components)

==================================================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 C NTFS Partition 999 GB Healthy Boot

==================================================================================

Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 D NTFS Partition 863 GB Healthy

==================================================================================

==========================================================

Last Boot: 2012-07-01 13:47

======================= End Of Log ==========================

 

[Broni]

Welcome aboard

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running tools or applying updates other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=========================================

You ran the tool from within Windows.
That's not the correct way.

For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
• Restart your computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

• • 
    Startup Repair
    System Restore
    Windows Complete PC Restore
    Windows Memory Diagnostic Tool
    Command Prompt
• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

 

[hokokhua]

Sorry for the tardy response. I don't have access to my home PC at work. here it is again:
===
Scan result of Farbar Recovery Scan Tool Version: 07-07-2012 04
Ran by SYSTEM at 09-07-2012 07:51:21
Running from G:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
The current controlset is ControlSet001
========================== Registry (Whitelisted) =============
HKLM\...\Run: [MouseDriver] TiltWheelMouse.exe [x]
HKLM\...\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice [4035152 2011-09-21] (ESET)
HKLM\...\Run: [Acronis Scheduler2 Service] "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [390712 2010-08-21] (Acronis)
HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [12459112 2012-03-27] (Realtek Semiconductor)
HKLM\...\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe [170264 2012-05-11] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [398616 2012-05-11] (Intel Corporation)
HKLM\...\Run: [Persistence] C:\Windows\system32\igfxpers.exe [439064 2012-05-11] (Intel Corporation)
HKLM-x32\...\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\ssmmgr.exe /autorun [606208 2009-10-13] ()
HKLM-x32\...\Run: [WheelMouse] C:\ADVANC~1\wh_exec.exe [147456 1999-12-31] ()
HKLM-x32\...\Run: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-11-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2011-12-07] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-02] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-17] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [3508624 2011-11-29] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [115048 2011-09-15] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot [296056 2012-06-04] (RealNetworks, Inc.)
HKLM-x32\...\Run: [TaskTray] [x]
HKLM-x32\...\Run: [Driver Genius] [x]
HKLM-x32\...\Run: [SAOB Monitor] C:\Program Files (x86)\Acronis\OnlineBackupStandalone\TrueImageMonitor.exe [2536752 2010-08-20] (Acronis)
HKLM-x32\...\Run: [TrueImageMonitor.exe] "C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe" [5459136 2010-08-21] (Acronis)
HKLM-x32\...\Run: [Bonus.SSR.FR11] "C:\Program Files (x86)\ABBYY FineReader 11\Bonus.ScreenshotReader.exe" /autorun [933640 2012-01-18] (ABBYY.)
HKLM-x32\...\Run: [TrojanScanner] C:\Program Files (x86)\Trojan Remover\Trjscan.exe /boot [1244432 2012-07-03] (Simply Super Software)
HKU\user\...\Run: [Google Update] "C:\Users\user\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-11-30] (Google Inc.)
HKU\user\...\Run: [PPAP] "C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" -background [436088 2011-12-14] (PPLive Corporation)
HKU\user\...\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe /s [935312 2011-11-29] (Samsung)
HKU\user\...\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21392 2011-11-29] ()
HKU\user\...\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED [880496 2012-05-20] (BitTorrent, Inc.)
HKLM\...\Runonce: [*WerKernelReporting] %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [x]
Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Startup: C:\Users\user\Start Menu\Programs\Startup\MagicDisc.lnk
ShortcutTarget: MagicDisc.lnk -> C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
==================== Services (Whitelisted) ======
2 ABBYY.Licensing.FineReader.Corporate.11.0; "C:\Program Files (x86)\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe" -service [818952 2011-12-22] (ABBYY)
2 AcrSch2Svc; "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe" [779944 2010-08-21] (Acronis)
2 afcdpsrv; C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [3975088 2012-06-10] (Acronis)
2 ekrn; "C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe" [974944 2011-09-21] (ESET)
2 Intel(R) Capability Licensing Service Interface; "C:\Program Files\Intel\iCLS Client\HeciServer.exe" [628448 2012-02-02] (Intel(R) Corporation)
3 Media Center 17 Service; C:\Program Files (x86)\J River\Media Center 17\JRService.exe [392320 2012-05-07] (JRiver, Inc.)
2 NitroReaderDriverReadSpool2; "C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe" [341800 2011-12-19] (Nitro PDF Software)
3 PCTSFileEnum; C:\Program Files (x86)\PC Tools\DMScanning\PCTSFiles.exe [89016 2012-05-10] (PC Tools)
2 Roozz Updater; "C:\Program Files (x86)\Roozz\RoozzUpdater.exe" [382464 2012-06-25] (Roozz)
3 vds; C:\Windows\System32\vds.exe [533504 2010-11-20] (Microsoft Corporation)
2 WDFME; "C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe" [1066896 2011-03-08] ()
2 WDSC; "C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSC.exe" [491920 2011-03-08] ()
2 XLServicePlatform; C:\Program Files (x86)\Common Files\Thunder Network\ServicePlatform\XLSP.dll [87728 2011-11-24] (ShenZhen Xunlei Networking Technologies,LTD)
========================== Drivers (Whitelisted) =============
3 afcdp; C:\Windows\System32\Drivers\afcdp.sys [279136 2012-06-10] (Acronis)
3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW86.sys [90624 2012-04-17] (Advanced Micro Devices)
2 DgiVecp; C:\Windows\System32\Drivers\DgiVecp.sys [53816 2009-03-25] (Samsung Electronics Co., Ltd.)
2 eamonm; C:\Windows\System32\Drivers\eamonm.sys [202576 2011-08-08] (ESET)
1 ehdrv; C:\Windows\System32\Drivers\ehdrv.sys [146432 2011-08-03] (ESET)
2 epfw; C:\Windows\System32\Drivers\epfw.sys [187632 2011-08-03] (ESET)
1 EpfwLWF; C:\Windows\System32\Drivers\EpfwLWF.sys [38288 2011-08-03] (ESET)
0 epfwwfp; C:\Windows\System32\Drivers\epfwwfp.sys [62496 2011-08-03] (ESET)
0 MxEFUF; C:\Windows\System32\DRIVERS\MxEFUF64.sys [157696 2011-10-19] (Matrox Graphics Inc.)
3 PCTBD; C:\Windows\System32\Drivers\PCTBD64.sys [85224 2012-06-13] (PC Tools)
0 PCTCore; C:\Windows\System32\drivers\PCTCore64.sys [426616 2012-04-22] (PC Tools)
0 pctDS; C:\Windows\System32\drivers\pctDS64.sys [453896 2012-02-27] (PC Tools)
0 pctEFA; C:\Windows\System32\drivers\pctEFA64.sys [1096176 2012-02-27] (PC Tools)
1 PCTSD; C:\Windows\System32\Drivers\PCTSD64.sys [251528 2012-05-10] (PC Tools)
0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [17720 2010-11-26] ()
0 snapman; C:\Windows\System32\Drivers\snapman.sys [277088 2012-06-10] (Acronis)
0 tdrpman273; C:\Windows\System32\DRIVERS\tdrpm273.sys [1263200 2012-06-10] (Acronis)
0 timounter; C:\Windows\System32\DRIVERS\timntr.sys [970336 2012-06-10] (Acronis)
3 t_mouse.sys; C:\Windows\System32\DRIVERS\t_mouse.sys [25088 2009-04-15] ()
0 vidsflt53; C:\Windows\System32\DRIVERS\vsflt53.sys [141920 2012-03-31] (Acronis)
3 whfltr2k; C:\Windows\System32\Drivers\whfltr2k.sys [10368 1999-12-31] ()
========================== NetSvcs (Whitelisted) ===========
============ One Month Created Files and Folders ==============
2012-07-08 05:20 - 2012-07-08 05:37 - 00060984 ____A C:\Users\user\Desktop\FRST.txt
2012-07-08 05:20 - 2012-07-08 05:37 - 00000000 ____D C:\FRST
2012-07-08 05:17 - 2012-07-08 05:17 - 01432863 ____A C:\Users\user\Desktop\FRST64.exe
2012-07-08 05:04 - 2012-07-08 05:04 - 00000000 ____D C:\Users\user\Downloads\Spyware Doctor 2012 + Serial~~(TIMETHIEF)
2012-07-08 04:26 - 2012-06-13 20:31 - 02267096 ____A (Threat Expert Ltd.) C:\Windows\PCTBDCore.dll
2012-07-08 04:26 - 2012-06-13 20:31 - 01681368 ____A (Threat Expert Ltd.) C:\Windows\PCTBDRes.dll
2012-07-08 04:26 - 2012-06-13 20:31 - 00767960 ____A C:\Windows\BDTSupport.dll
2012-07-08 04:26 - 2012-06-13 20:31 - 00149464 ____A (PC Tools) C:\Windows\SGDetectionTool.dll
2012-07-08 04:26 - 2012-06-13 20:31 - 00085224 ____A (PC Tools) C:\Windows\System32\Drivers\PCTBD64.sys
2012-07-08 04:26 - 2012-06-13 19:03 - 00003488 ____A C:\Windows\UDB.zip
2012-07-08 04:26 - 2012-06-13 19:03 - 00000882 ____A C:\Windows\RegSDImport.xml
2012-07-08 04:26 - 2012-06-13 19:03 - 00000879 ____A C:\Windows\RegISSImport.xml
2012-07-08 04:26 - 2012-06-13 19:03 - 00000131 ____A C:\Windows\IDB.zip
2012-07-08 04:25 - 2012-05-10 19:14 - 00092896 ____A (PC Tools) C:\Windows\System32\Drivers\pctplsg64.sys
2012-07-08 04:25 - 2012-05-10 19:13 - 00014776 ____A (PC Tools) C:\Windows\System32\Drivers\pctBTFix64.sys
2012-07-08 04:25 - 2012-05-10 19:09 - 00145432 ____A (PC Tools) C:\Windows\System32\Drivers\pctwfpfilter64.sys
2012-07-08 04:25 - 2012-05-10 19:08 - 00341168 ____A (PC Tools) C:\Windows\System32\Drivers\pctgntdi64.sys
2012-07-08 04:23 - 2012-07-08 04:25 - 00000000 ____D C:\Users\All Users\PC Tools
2012-07-08 04:23 - 2012-07-08 04:25 - 00000000 ____D C:\Program Files (x86)\PC Tools
2012-07-08 04:23 - 2012-07-08 04:24 - 01631086 ____A C:\Windows\System32\Drivers\Cat.DB
2012-07-08 04:23 - 2012-07-08 04:23 - 00000000 ____D C:\Users\user\AppData\Roaming\TestApp
2012-07-08 04:23 - 2012-05-10 19:14 - 00251528 ____A (PC Tools) C:\Windows\System32\Drivers\PCTSD64.sys
2012-07-08 04:23 - 2012-04-22 20:36 - 00426616 ____A (PC Tools) C:\Windows\System32\Drivers\PCTCore64.sys
2012-07-08 04:23 - 2012-02-27 19:43 - 01096176 ____A (PC Tools) C:\Windows\System32\Drivers\pctEFA64.sys
2012-07-08 04:23 - 2012-02-27 19:43 - 00453896 ____A (PC Tools) C:\Windows\System32\Drivers\pctDS64.sys
2012-07-08 03:39 - 2012-07-08 03:39 - 00051000 ____A C:\Users\user\Desktop\Sirefef AgentBA PatchedBGen Trojan.xml
2012-07-08 02:48 - 2012-07-08 02:48 - 00000000 ____D C:\Users\user\Documents\Simply Super Software
2012-07-08 02:48 - 2012-07-08 02:48 - 00000000 ____D C:\Users\user\AppData\Roaming\Simply Super Software
2012-07-08 02:48 - 2012-07-08 02:48 - 00000000 ____D C:\Users\All Users\Simply Super Software
2012-07-08 02:48 - 2012-07-08 02:48 - 00000000 ____D C:\Program Files (x86)\Trojan Remover
2012-07-08 02:37 - 2012-07-08 02:37 - 00000000 ____D C:\Users\user\AppData\Roaming\Malwarebytes
2012-07-08 02:36 - 2012-07-08 02:36 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-07-08 02:36 - 2012-07-08 02:36 - 00000000 ____D C:\Users\All Users\Malwarebytes
2012-07-08 02:36 - 2012-07-08 02:36 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-07-08 02:36 - 2012-04-03 23:56 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-07-08 01:59 - 2012-07-08 01:59 - 00000000 __SHD C:\Windows\SysWOW64\%APPDATA%
2012-07-06 17:49 - 2012-07-06 18:00 - 00000000 ____D C:\Users\user\Downloads\The Universal Book of Mathematics
2012-07-06 17:42 - 2012-07-06 17:47 - 00000000 ____D C:\Users\user\Downloads\The Golds Gym Beginners Guide to Fitness -Mantesh
2012-07-06 17:16 - 2012-07-06 21:42 - 00000000 ____D C:\Users\user\Downloads\voltron.vehicle.force.dvdrip.merchant
2012-07-06 06:49 - 2012-07-06 23:31 - 00000000 ____D C:\Users\user\Downloads\Meditation Buddhist Reincarnation Yogi Tibet SuperPack
2012-07-06 06:49 - 2012-07-06 17:24 - 00000000 ____D C:\Users\user\Downloads\Quantum Mind Power
2012-07-06 06:20 - 2012-07-06 06:24 - 01572610 ____A C:\Users\user\Downloads\TheEssentialsofRealEstateInvestments.zip
2012-07-06 06:16 - 2012-07-06 19:53 - 00000000 ____D C:\Users\user\Downloads\Johnny Test [Seasons 3 and 4]
2012-07-06 06:16 - 2012-07-06 18:16 - 00000000 ____D C:\Users\user\Downloads\Johnny Test [Seasons 1 and 2]
2012-07-06 06:10 - 2012-07-06 06:11 - 00000000 ____D C:\Users\user\Desktop\Books record
2012-07-05 04:10 - 2012-07-06 17:12 - 00000000 ____D C:\Users\user\Downloads\Camelot Season 1 Complete 720p
2012-07-05 04:10 - 2012-07-05 06:32 - 657831936 ____A C:\Users\user\Desktop\Word.World.Lucky.Duck.DVDRip.Prism.www.iwannadownload.com.NORARS.avi
2012-07-01 04:57 - 2012-07-01 04:58 - 00000000 ____D C:\Users\user\Desktop\?????_???.-.[????~???II].??.(ape)_tencd.com
2012-06-26 06:15 - 2012-05-04 03:00 - 00366592 ____A (Microsoft Corporation) C:\Windows\System32\qdvd.dll
2012-06-26 06:15 - 2012-05-04 01:59 - 00514560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2012-06-24 01:52 - 2012-06-02 14:19 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-24 01:52 - 2012-06-02 14:19 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-24 01:52 - 2012-06-02 14:19 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-24 01:52 - 2012-06-02 14:19 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-24 01:52 - 2012-06-02 14:19 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-24 01:52 - 2012-06-02 14:15 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-24 01:52 - 2012-06-02 14:15 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-24 01:52 - 2012-06-01 23:19 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-24 01:52 - 2012-06-01 23:15 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-24 01:50 - 2012-07-08 01:46 - 00000000 ____D C:\Users\user\Downloads\Edgar Cayce Foundation - Be Your Own Psychic
2012-06-23 02:38 - 2012-06-23 02:39 - 00000000 ____D C:\Users\user\Desktop\Power Rangers
2012-06-22 22:16 - 2012-06-22 22:16 - 00821248 ____A C:\Users\user\Desktop\FreeISOBurner.exe
2012-06-22 22:07 - 2012-06-22 22:07 - 00000000 ____D C:\Program Files (x86)\MagicDisc
2012-06-22 22:07 - 2009-02-24 02:35 - 00255552 ____A (MagicISO, Inc.) C:\Windows\SysWOW64\Drivers\mcdbus.sys
2012-06-22 22:07 - 2009-02-24 02:35 - 00255552 ____A (MagicISO, Inc.) C:\Windows\System32\Drivers\mcdbus.sys
2012-06-22 02:01 - 2012-06-26 04:21 - 00000000 ____D C:\Program Files (x86)\Roozz
2012-06-19 20:44 - 2012-06-19 20:44 - 02214564 ____A C:\Users\user\Desktop\subaru.wma
2012-06-19 20:28 - 2012-06-19 20:32 - 00000000 ____D C:\Users\user\Desktop\???.-.[????].??.(ape)
2012-06-17 21:36 - 2012-06-17 21:36 - 00000768 ____A C:\Users\Public\Desktop\Sigil.lnk
2012-06-17 21:36 - 2012-06-17 21:36 - 00000000 ____D C:\Users\user\AppData\Local\sigil-ebook
2012-06-17 21:36 - 2012-06-17 21:36 - 00000000 ____D C:\Program Files\Sigil
2012-06-16 01:15 - 2012-06-16 03:16 - 00000000 ____D C:\Users\user\Desktop\Wrath of the Titans (2012) [1080p]
2012-06-16 00:50 - 2012-06-16 00:50 - 00000000 ____D C:\Users\user\Documents\My Digital Editions
2012-06-13 22:12 - 2012-05-17 18:47 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-06-13 22:12 - 2012-05-17 18:16 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-06-13 22:12 - 2012-05-17 18:06 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-06-13 22:12 - 2012-05-17 17:59 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-06-13 22:12 - 2012-05-17 17:59 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-06-13 22:12 - 2012-05-17 17:58 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-06-13 22:12 - 2012-05-17 17:58 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-06-13 22:12 - 2012-05-17 17:56 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-06-13 22:12 - 2012-05-17 17:55 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-06-13 22:12 - 2012-05-17 17:55 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-06-13 22:12 - 2012-05-17 17:54 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-06-13 22:12 - 2012-05-17 17:51 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-06-13 22:12 - 2012-05-17 17:51 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-06-13 22:12 - 2012-05-17 17:47 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-06-13 22:12 - 2012-05-17 15:11 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-06-13 22:12 - 2012-05-17 14:48 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-06-13 22:12 - 2012-05-17 14:45 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2012-06-13 22:12 - 2012-05-17 14:36 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-06-13 22:12 - 2012-05-17 14:35 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2012-06-13 22:12 - 2012-05-17 14:35 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-06-13 22:12 - 2012-05-17 14:33 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-06-13 22:12 - 2012-05-17 14:31 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-06-13 22:12 - 2012-05-17 14:29 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2012-06-13 22:12 - 2012-05-17 14:29 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2012-06-13 22:12 - 2012-05-17 14:27 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-06-13 22:12 - 2012-05-17 14:25 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-06-13 22:12 - 2012-05-17 14:24 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-06-13 22:12 - 2012-05-17 14:20 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-06-13 21:32 - 2012-05-14 17:32 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-06-13 21:32 - 2012-05-04 03:06 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-06-13 21:32 - 2012-05-04 02:03 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-06-13 21:32 - 2012-05-04 02:03 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-06-13 21:32 - 2012-04-30 21:40 - 00209920 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2012-06-13 21:32 - 2012-04-27 19:55 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-06-13 21:32 - 2012-04-25 21:41 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-06-13 21:32 - 2012-04-25 21:41 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-06-13 21:32 - 2012-04-25 21:34 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-06-13 21:32 - 2012-04-23 21:37 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-06-13 21:32 - 2012-04-23 21:37 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-06-13 21:32 - 2012-04-23 21:37 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-06-13 21:32 - 2012-04-23 20:36 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2012-06-13 21:32 - 2012-04-23 20:36 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2012-06-13 21:32 - 2012-04-23 20:36 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2012-06-13 21:32 - 2012-04-07 04:31 - 03216384 ____A (Microsoft Corporation) C:\Windows\System32\msi.dll
2012-06-13 21:32 - 2012-04-07 03:26 - 02342400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2012-06-11 05:10 - 2012-06-11 05:31 - 00000600 ____A C:\Users\user\AppData\Roaming\winscp.rnd
2012-06-11 05:10 - 2012-06-11 05:10 - 00000000 ____D C:\Program Files (x86)\WinSCP
2012-06-10 07:28 - 2012-06-10 07:28 - 00002845 ____A C:\Users\Public\Desktop\ABBYY FineReader 11.lnk
2012-06-10 07:22 - 2012-06-10 07:29 - 00000000 ____D C:\Program Files (x86)\ABBYY FineReader 11
2012-06-10 07:01 - 2012-06-10 07:01 - 00000000 ____D C:\Users\user\AppData\Roaming\ABBYY
2012-06-10 06:51 - 2012-06-17 00:21 - 00000000 ____D C:\Users\user\AppData\Local\ABBYY
2012-06-10 06:51 - 2012-06-10 07:22 - 00000000 ____D C:\Users\All Users\ABBYY
2012-06-10 06:22 - 2012-06-10 06:22 - 00018224 ____A C:\Windows\System32\results.xml
2012-06-10 06:18 - 2011-12-25 12:02 - 00120832 ____A (Intel Corporation) C:\Windows\System32\IntelOpenCL64.dll
2012-06-10 06:17 - 2012-06-10 06:17 - 00000000 ____D C:\Program Files\Common Files\Intel
2012-06-10 06:17 - 2011-12-25 12:07 - 00086016 ____A (Intel Corporation) C:\Windows\SysWOW64\IntelOpenCL32.dll
2012-06-10 04:41 - 2012-03-27 03:16 - 00272629 ____A C:\Windows\System32\Drivers\RTAIODAT.DAT
2012-06-10 04:41 - 2012-03-27 01:03 - 04015592 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\Drivers\RTKVHD64.sys
2012-06-10 04:41 - 2012-03-20 23:55 - 02886656 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RCoRes64.dat
2012-06-10 04:41 - 2012-03-19 18:47 - 03608680 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtkAPO64.dll
2012-06-10 04:41 - 2012-03-19 03:01 - 00102504 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RCoInstII64.dll
2012-06-10 04:41 - 2012-03-16 00:25 - 02670696 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtPgEx64.dll
2012-06-10 04:41 - 2012-03-12 19:21 - 01251432 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RTCOM64.dll
2012-06-10 04:41 - 2012-03-06 19:09 - 00824424 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtkApi64.dll
2012-06-10 04:41 - 2012-02-21 03:45 - 02605400 ____A (Waves Audio Ltd.) C:\Windows\System32\WavesGUILib.dll
2012-06-10 04:41 - 2012-02-16 23:54 - 00396632 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxVolumeSDAPO.dll
2012-06-10 04:41 - 2012-02-13 08:05 - 08363864 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioRealtek.dll
2012-06-10 04:41 - 2012-02-13 06:35 - 00978776 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioAPOShell64.dll
2012-06-10 04:41 - 2012-01-29 19:43 - 00836544 ____A (TOSHIBA Corporation) C:\Windows\System32\tadefxapo264.dll
2012-06-10 04:41 - 2012-01-09 18:20 - 00065944 ____A (TOSHIBA CORPORATION.) C:\Windows\System32\tepeqapo64.dll
2012-06-10 04:41 - 2011-12-19 23:32 - 00331880 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtlCPAPI64.dll
2012-06-10 04:41 - 2011-12-19 13:43 - 00220776 ____A (Sony Corporation) C:\Windows\System32\SFSS_APO.dll
2012-06-10 04:41 - 2011-12-18 01:58 - 02131288 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioEQ.dll
2012-06-10 04:41 - 2011-12-18 01:58 - 01247576 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioRealtek264.dll
2012-06-10 04:41 - 2011-12-14 21:16 - 07163744 ____A (Dolby Laboratories) C:\Windows\System32\R4EEP64A.dll
2012-06-10 04:41 - 2011-12-14 21:16 - 00433504 ____A (Dolby Laboratories) C:\Windows\System32\R4EED64A.dll
2012-06-10 04:41 - 2011-12-14 21:16 - 00137056 ____A (Dolby Laboratories) C:\Windows\System32\R4EEL64A.dll
2012-06-10 04:41 - 2011-12-14 21:16 - 00120160 ____A (Dolby Laboratories) C:\Windows\System32\R4EEA64A.dll
2012-06-10 04:41 - 2011-12-14 21:16 - 00075104 ____A (Dolby Laboratories) C:\Windows\System32\R4EEG64A.dll
2012-06-10 04:41 - 2011-12-13 00:58 - 01560168 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RTSnMg64.cpl
2012-06-10 04:41 - 2011-11-22 00:28 - 00014952 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtkCoLDR64.dll
2012-06-10 04:41 - 2011-09-01 22:21 - 00221024 ____A (Synopsys, Inc.) C:\Windows\System32\SFNHK64.dll
2012-06-10 04:41 - 2011-09-01 22:21 - 00081248 ____A (Synopsys, Inc.) C:\Windows\System32\SFCOM64.dll
2012-06-10 04:41 - 2011-09-01 22:21 - 00078688 ____A (Synopsys, Inc.) C:\Windows\System32\SFAPO64.dll
2012-06-10 04:41 - 2011-08-23 01:00 - 00603984 ____A (Knowles Acoustics ) C:\Windows\System32\KAAPORT64.dll
2012-06-10 04:41 - 2011-03-16 20:17 - 01361336 ____A (TOSHIBA Corporation) C:\Windows\System32\tosade.dll
2012-06-10 04:41 - 2011-03-07 01:11 - 00148416 ____A (TOSHIBA Corporation) C:\Windows\System32\tadefxapo.dll
2012-06-10 04:41 - 2010-11-07 15:31 - 00375128 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RTEEP64A.dll
2012-06-10 04:41 - 2010-11-07 15:31 - 00310104 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RP3DHT64.dll
2012-06-10 04:41 - 2010-11-07 15:31 - 00310104 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RP3DAA64.dll
2012-06-10 04:41 - 2010-11-07 15:31 - 00204120 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RTEED64A.dll
2012-06-10 04:41 - 2010-11-07 15:31 - 00101208 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RTEEL64A.dll
2012-06-10 04:41 - 2010-11-07 15:31 - 00078680 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RTEEG64A.dll
2012-06-10 04:41 - 2010-11-03 02:30 - 00149608 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtkCfg64.dll
2012-06-10 04:41 - 2010-10-02 21:46 - 00341336 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioAPO30.dll
2012-06-10 04:41 - 2010-09-26 17:34 - 00318808 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioAPO20.dll
2012-06-10 04:41 - 2010-07-22 00:48 - 00074064 ____A (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll
2012-06-10 04:41 - 2009-11-23 17:55 - 00518896 ____A (SRS Labs, Inc.) C:\Windows\System32\SRSTSX64.dll
2012-06-10 04:41 - 2009-11-23 17:55 - 00211184 ____A (SRS Labs, Inc.) C:\Windows\System32\SRSTSH64.dll
2012-06-10 04:41 - 2009-11-23 17:55 - 00198896 ____A (SRS Labs, Inc.) C:\Windows\System32\SRSHP64.dll
2012-06-10 04:41 - 2009-11-23 17:55 - 00155888 ____A (SRS Labs, Inc.) C:\Windows\System32\SRSWOW64.dll
2012-06-10 04:40 - 2012-03-07 19:47 - 00202336 ____A (Andrea Electronics Corporation) C:\Windows\System32\AERTAC64.dll
2012-06-10 04:40 - 2012-03-07 19:47 - 00108640 ____A (Andrea Electronics Corporation) C:\Windows\System32\AERTAR64.dll
2012-06-10 04:40 - 2012-02-20 22:26 - 02528832 ____A (Fortemedia Corporation) C:\Windows\System32\FMAPO64.dll
2012-06-10 04:40 - 2012-01-23 06:30 - 00537456 ____A (DTS) C:\Windows\System32\DTSU2PLFX64.dll
2012-06-10 04:40 - 2012-01-23 06:30 - 00524656 ____A (DTS) C:\Windows\System32\DTSU2PGFX64.dll
2012-06-10 04:40 - 2012-01-23 06:30 - 00449392 ____A (DTS) C:\Windows\System32\DTSU2PREC64.dll
2012-06-10 04:40 - 2011-12-12 19:01 - 01698408 ____A (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2012-06-10 04:40 - 2011-05-30 17:42 - 01756264 ____A (DTS) C:\Windows\System32\DTSS2SpeakerDLL64.dll
2012-06-10 04:40 - 2011-05-30 17:42 - 01568360 ____A (DTS) C:\Windows\System32\DTSS2HeadphoneDLL64.dll
2012-06-10 04:40 - 2011-05-30 17:42 - 01486952 ____A (DTS) C:\Windows\System32\DTSBoostDLL64.dll
2012-06-10 04:40 - 2011-05-30 17:42 - 00728680 ____A (DTS) C:\Windows\System32\DTSBassEnhancementDLL64.dll
2012-06-10 04:40 - 2011-05-30 17:42 - 00712296 ____A (DTS) C:\Windows\System32\DTSSymmetryDLL64.dll
2012-06-10 04:40 - 2011-05-30 17:42 - 00693352 ____A (DTS) C:\Windows\System32\DTSVoiceClarityDLL64.dll
2012-06-10 04:40 - 2011-05-30 17:42 - 00491112 ____A (DTS) C:\Windows\System32\DTSNeoPCDLL64.dll
2012-06-10 04:40 - 2011-05-30 17:42 - 00432744 ____A (DTS) C:\Windows\System32\DTSLimiterDLL64.dll
2012-06-10 04:40 - 2011-05-30 17:42 - 00428648 ____A (DTS) C:\Windows\System32\DTSGainCompensatorDLL64.dll
2012-06-10 04:40 - 2011-05-30 17:42 - 00242792 ____A (DTS) C:\Windows\System32\DTSLFXAPO64.dll
2012-06-10 04:40 - 2011-05-30 17:42 - 00242792 ____A (DTS) C:\Windows\System32\DTSGFXAPO64.dll
2012-06-10 04:40 - 2011-05-30 17:42 - 00241768 ____A (DTS) C:\Windows\System32\DTSGFXAPONS64.dll
2012-06-10 04:31 - 2012-06-10 04:31 - 04022504 ____A C:\Windows\SysWOW64\SpoonUninstall.exe
2012-06-10 04:31 - 2012-06-10 04:31 - 00033846 ____A C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp Music Converter.bmp
2012-06-10 04:31 - 2012-06-10 04:31 - 00033846 ____A C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp DSP Effects.bmp
2012-06-10 04:31 - 2012-06-10 04:31 - 00017950 ____A C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp Music Converter.dat
2012-06-10 04:31 - 2012-06-10 04:31 - 00013082 ____A C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp DSP Effects.dat
2012-06-10 04:31 - 2012-06-10 04:31 - 00000000 ____D C:\Users\user\AppData\Roaming\AccurateRip
2012-06-10 04:31 - 2012-06-10 04:31 - 00000000 ____D C:\Program Files (x86)\Illustrate
2012-06-10 04:24 - 2012-06-10 04:24 - 01263200 ____A (Acronis) C:\Windows\System32\Drivers\tdrpm273.sys
2012-06-10 04:24 - 2012-06-10 04:24 - 00970336 ____A (Acronis) C:\Windows\System32\Drivers\timntr.sys
2012-06-10 04:24 - 2012-06-10 04:24 - 00279136 ____A (Acronis) C:\Windows\System32\Drivers\afcdp.sys
2012-06-10 04:24 - 2012-06-10 04:24 - 00001139 ____A C:\Users\Public\Desktop\Acronis True Image Home 2011.lnk
2012-06-10 04:24 - 2012-06-10 04:24 - 00000000 ____D C:\Program Files (x86)\Acronis
2012-06-10 04:23 - 2012-06-10 04:24 - 00000000 ____D C:\Users\user\Documents\Quick-PDF PDF to Word
2012-06-10 04:23 - 2012-06-10 04:23 - 00000000 ____D C:\Program Files (x86)\PDF to Word
2012-06-10 04:22 - 2012-06-10 04:25 - 00000000 ____D C:\Users\All Users\Acronis
2012-06-10 04:16 - 2012-06-10 04:16 - 00000000 ____D C:\Users\All Users\Intel
2012-06-10 04:16 - 2012-06-10 04:16 - 00000000 ____D C:\Program Files\Intel
2012-06-10 04:15 - 2011-11-09 10:04 - 00060184 ____A (Intel Corporation) C:\Windows\System32\Drivers\HECIx64.sys
2012-06-10 04:12 - 2012-06-10 04:15 - 118258657 ____A (Acronis) C:\Users\user\Desktop\ATIH2011_full_en-US.exe
2012-06-10 04:07 - 2012-06-10 04:10 - 00000000 ____D C:\Users\user\AppData\Roaming\driveridentifier
2012-06-10 04:02 - 2012-06-10 06:13 - 00000000 ____D C:\Users\All Users\Downloaded Installations
2012-06-10 03:47 - 2012-06-26 06:18 - 00000000 ____D C:\Users\All Users\DriverGenius
2012-06-10 03:47 - 2012-06-10 03:51 - 00000000 ____D C:\Users\Public\Documents\DriverGenius
2012-06-10 03:43 - 2012-06-10 03:46 - 13834726 ____A C:\Users\user\Desktop\Driver.Genius.Pro.v11.0.0.1128[A4].rar
2012-06-10 03:40 - 2012-06-10 03:40 - 00000000 ____D C:\Users\user\Documents\DriverGenius
2012-06-10 03:39 - 2012-06-10 03:47 - 00001211 ____A C:\Users\user\Desktop\Driver Genius Professional Edition.lnk
2012-06-10 03:39 - 2012-06-10 03:40 - 00000000 ____D C:\Users\user\Desktop\dMC-R14.2-Ref-Registered
2012-06-10 03:39 - 2012-06-10 03:39 - 00000000 ____D C:\Program Files (x86)\Driver-Soft

 

[hokokhua]

============ 3 Months Modified Files ========================
2012-07-08 15:47 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-07-08 15:46 - 2012-04-01 23:09 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-07-08 15:46 - 2009-07-13 20:51 - 00086404 ____A C:\Windows\setupact.log
2012-07-08 15:45 - 2011-11-30 03:52 - 01405334 ____A C:\Windows\WindowsUpdate.log
2012-07-08 15:45 - 2009-07-13 20:45 - 00022080 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-07-08 15:45 - 2009-07-13 20:45 - 00022080 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-07-08 15:39 - 2010-11-20 19:47 - 00021572 ____A C:\Windows\PFRO.log
2012-07-08 05:37 - 2012-07-08 05:20 - 00060984 ____A C:\Users\user\Desktop\FRST.txt
2012-07-08 05:31 - 2011-11-30 05:07 - 00000904 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3892454325-3400438884-1050192996-1000UA.job
2012-07-08 05:17 - 2012-07-08 05:17 - 01432863 ____A C:\Users\user\Desktop\FRST64.exe
2012-07-08 04:24 - 2012-07-08 04:23 - 01631086 ____A C:\Windows\System32\Drivers\Cat.DB
2012-07-08 03:40 - 2012-02-04 20:06 - 01101312 __ASH C:\Users\user\Desktop\Thumbs.db
2012-07-08 03:39 - 2012-07-08 03:39 - 00051000 ____A C:\Users\user\Desktop\Sirefef AgentBA PatchedBGen Trojan.xml
2012-07-08 03:31 - 2011-11-30 05:07 - 00000852 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3892454325-3400438884-1050192996-1000Core.job
2012-07-08 02:36 - 2012-07-08 02:36 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-07-07 07:37 - 2009-07-13 21:13 - 00726444 ____A C:\Windows\System32\PerfStringBackup.INI
2012-07-06 06:24 - 2012-07-06 06:20 - 01572610 ____A C:\Users\user\Downloads\TheEssentialsofRealEstateInvestments.zip
2012-07-06 05:37 - 2012-02-02 06:06 - 00483840 __ASH C:\Users\user\Downloads\Thumbs.db
2012-07-06 03:47 - 2012-01-06 04:54 - 00012170 ____A C:\Users\user\AppData\Roaming\SmarThruOptions.xml
2012-07-06 00:15 - 2012-04-01 23:09 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-07-06 00:15 - 2011-12-14 04:20 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-06-23 04:46 - 2012-04-01 23:46 - 09815752 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2012-06-22 22:16 - 2012-06-22 22:16 - 00821248 ____A C:\Users\user\Desktop\FreeISOBurner.exe
2012-06-19 20:44 - 2012-06-19 20:44 - 02214564 ____A C:\Users\user\Desktop\subaru.wma
2012-06-17 21:36 - 2012-06-17 21:36 - 00000768 ____A C:\Users\Public\Desktop\Sigil.lnk
2012-06-14 03:59 - 2009-07-13 20:45 - 00310648 ____A C:\Windows\System32\FNTCACHE.DAT
2012-06-13 22:16 - 2011-11-30 05:06 - 58957832 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-06-13 20:31 - 2012-07-08 04:26 - 02267096 ____A (Threat Expert Ltd.) C:\Windows\PCTBDCore.dll
2012-06-13 20:31 - 2012-07-08 04:26 - 01681368 ____A (Threat Expert Ltd.) C:\Windows\PCTBDRes.dll
2012-06-13 20:31 - 2012-07-08 04:26 - 00767960 ____A C:\Windows\BDTSupport.dll
2012-06-13 20:31 - 2012-07-08 04:26 - 00149464 ____A (PC Tools) C:\Windows\SGDetectionTool.dll
2012-06-13 20:31 - 2012-07-08 04:26 - 00085224 ____A (PC Tools) C:\Windows\System32\Drivers\PCTBD64.sys
2012-06-13 19:03 - 2012-07-08 04:26 - 00003488 ____A C:\Windows\UDB.zip
2012-06-13 19:03 - 2012-07-08 04:26 - 00000882 ____A C:\Windows\RegSDImport.xml
2012-06-13 19:03 - 2012-07-08 04:26 - 00000879 ____A C:\Windows\RegISSImport.xml
2012-06-13 19:03 - 2012-07-08 04:26 - 00000131 ____A C:\Windows\IDB.zip
2012-06-11 05:31 - 2012-06-11 05:10 - 00000600 ____A C:\Users\user\AppData\Roaming\winscp.rnd
2012-06-10 07:37 - 2012-01-14 00:09 - 372410176 ____A C:\Users\user\Desktop\???.-.[?????.??].??.(APE).rar
2012-06-10 07:30 - 2012-01-16 05:03 - 399476704 ____A C:\Users\user\Desktop\???.-.[Pony.Canyon.Audiophile.Test.CD.2002].??.(ape).ape
2012-06-10 07:28 - 2012-06-10 07:28 - 00002845 ____A C:\Users\Public\Desktop\ABBYY FineReader 11.lnk
2012-06-10 06:22 - 2012-06-10 06:22 - 00018224 ____A C:\Windows\System32\results.xml
2012-06-10 04:31 - 2012-06-10 04:31 - 04022504 ____A C:\Windows\SysWOW64\SpoonUninstall.exe
2012-06-10 04:31 - 2012-06-10 04:31 - 00033846 ____A C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp Music Converter.bmp
2012-06-10 04:31 - 2012-06-10 04:31 - 00033846 ____A C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp DSP Effects.bmp
2012-06-10 04:31 - 2012-06-10 04:31 - 00017950 ____A C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp Music Converter.dat
2012-06-10 04:31 - 2012-06-10 04:31 - 00013082 ____A C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp DSP Effects.dat
2012-06-10 04:24 - 2012-06-10 04:24 - 01263200 ____A (Acronis) C:\Windows\System32\Drivers\tdrpm273.sys
2012-06-10 04:24 - 2012-06-10 04:24 - 00970336 ____A (Acronis) C:\Windows\System32\Drivers\timntr.sys
2012-06-10 04:24 - 2012-06-10 04:24 - 00279136 ____A (Acronis) C:\Windows\System32\Drivers\afcdp.sys
2012-06-10 04:24 - 2012-06-10 04:24 - 00001139 ____A C:\Users\Public\Desktop\Acronis True Image Home 2011.lnk
2012-06-10 04:24 - 2012-03-31 02:46 - 00277088 ____A (Acronis) C:\Windows\System32\Drivers\snapman.sys
2012-06-10 04:15 - 2012-06-10 04:12 - 118258657 ____A (Acronis) C:\Users\user\Desktop\ATIH2011_full_en-US.exe
2012-06-10 03:47 - 2012-06-10 03:39 - 00001211 ____A C:\Users\user\Desktop\Driver Genius Professional Edition.lnk
2012-06-10 03:46 - 2012-06-10 03:43 - 13834726 ____A C:\Users\user\Desktop\Driver.Genius.Pro.v11.0.0.1128[A4].rar
2012-06-06 03:52 - 2009-07-13 21:08 - 00032600 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-06-05 05:24 - 2012-06-05 05:24 - 507326510 ____A C:\Windows\MEMORY.DMP
2012-06-05 05:24 - 2012-06-05 05:24 - 00303160 ____A C:\Windows\Minidump\060512-15428-01.dmp
2012-06-04 03:32 - 2012-01-07 05:08 - 00198832 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
2012-06-04 03:31 - 2012-01-07 05:08 - 00006656 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll
2012-06-04 03:31 - 2012-01-07 05:08 - 00005632 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll
2012-06-04 03:31 - 2011-09-15 22:21 - 00499712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2012-06-04 03:31 - 2011-09-15 22:21 - 00348160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2012-06-04 03:31 - 2008-09-03 17:47 - 00272896 ____A (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll
2012-06-02 14:19 - 2012-06-24 01:52 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-02 14:19 - 2012-06-24 01:52 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-02 14:19 - 2012-06-24 01:52 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-02 14:19 - 2012-06-24 01:52 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-02 14:19 - 2012-06-24 01:52 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-02 14:15 - 2012-06-24 01:52 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-02 14:15 - 2012-06-24 01:52 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-01 23:19 - 2012-06-24 01:52 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-01 23:15 - 2012-06-24 01:52 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-01 06:44 - 2011-12-15 07:00 - 296968276 ____A C:\Users\user\Desktop\Various.Artists.-.[Audiophile.Female.Voices.2008].??.(Flac).flac
2012-06-01 01:07 - 2012-03-30 19:11 - 00032266 ____A C:\Windows\DPINST.LOG
2012-05-30 20:21 - 2012-05-30 19:27 - 00901101 ____N C:\Windows\Minidump\053112-16005-01.dmp
2012-05-30 19:27 - 2012-05-30 19:27 - 00303288 ____A C:\Windows\Minidump\053112-18220-01.dmp
2012-05-24 09:27 - 2012-05-30 22:48 - 11175424 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\Drivers\atikmdag.sys
2012-05-24 09:15 - 2012-05-30 22:48 - 00245944 ____A C:\Windows\SysWOW64\atiapfxx.blb
2012-05-24 09:15 - 2012-05-30 22:48 - 00245944 ____A C:\Windows\System32\atiapfxx.blb
2012-05-24 09:13 - 2012-05-30 22:48 - 00159744 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\atiapfxx.exe
2012-05-24 09:13 - 2011-05-24 19:07 - 00909312 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\aticfx32.dll
2012-05-24 09:11 - 2011-05-24 19:06 - 01067520 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\aticfx64.dll
2012-05-24 09:08 - 2012-05-30 22:48 - 00442368 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\ATIDEMGX.dll
2012-05-24 09:08 - 2011-07-28 05:36 - 00503296 ____A (AMD) C:\Windows\System32\atieclxx.exe
2012-05-24 09:07 - 2011-07-28 05:35 - 00236544 ____A (AMD) C:\Windows\System32\atiesrxx.exe
2012-05-24 09:06 - 2012-05-30 22:48 - 00120320 ____A (AMD) C:\Windows\System32\atitmm64.dll
2012-05-24 09:05 - 2012-05-30 22:48 - 00059392 ____A (ATI Technologies, Inc.) C:\Windows\System32\atiedu64.dll
2012-05-24 09:05 - 2012-05-30 22:48 - 00043520 ____A (ATI Technologies, Inc.) C:\Windows\SysWOW64\ati2edxx.dll
2012-05-24 09:05 - 2012-05-30 22:48 - 00021504 ____A (AMD) C:\Windows\System32\atimuixx.dll
2012-05-24 09:04 - 2011-07-28 05:30 - 06800896 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atidxx32.dll
2012-05-24 08:53 - 2012-05-30 22:48 - 26181632 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\atio6axx.dll
2012-05-24 08:43 - 2011-05-24 18:49 - 07479296 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atidxx64.dll
2012-05-24 08:42 - 2011-11-30 04:47 - 00064000 ____A (AMD) C:\Windows\System32\coinst.dll
2012-05-24 08:33 - 2012-05-30 22:48 - 19753984 ____A (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atioglxx.dll
2012-05-24 08:20 - 2011-05-24 18:39 - 06203392 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdag.dll
2012-05-24 08:18 - 2012-05-30 22:48 - 01831424 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdmv.dll
2012-05-24 08:18 - 2012-05-30 22:48 - 01120768 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiumd6v.dll
2012-05-24 08:17 - 2012-05-30 22:48 - 04731904 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiumd6a.dll
2012-05-24 08:14 - 2012-05-30 22:48 - 16090624 ____A (Advanced Micro Devices Inc.) C:\Windows\System32\aticaldd64.dll
2012-05-24 08:14 - 2012-05-30 22:48 - 00051200 ____A (Advanced Micro Devices Inc.) C:\Windows\System32\aticalrt64.dll
2012-05-24 08:14 - 2012-05-30 22:48 - 00046080 ____A (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalrt.dll
2012-05-24 08:14 - 2012-05-30 22:48 - 00044544 ____A (Advanced Micro Devices Inc.) C:\Windows\System32\aticalcl64.dll
2012-05-24 08:14 - 2012-05-30 22:48 - 00044032 ____A (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalcl.dll
2012-05-24 08:13 - 2012-05-30 22:48 - 02631008 ____A C:\Windows\System32\atiumd6a.cap
2012-05-24 08:13 - 2012-05-30 22:48 - 00204952 ____A C:\Windows\SysWOW64\ativvsvl.dat
2012-05-24 08:13 - 2012-05-30 22:48 - 00204952 ____A C:\Windows\System32\ativvsvl.dat
2012-05-24 08:13 - 2012-05-30 22:48 - 00157144 ____A C:\Windows\SysWOW64\ativvsva.dat
2012-05-24 08:13 - 2012-05-30 22:48 - 00157144 ____A C:\Windows\System32\ativvsva.dat
2012-05-24 08:09 - 2012-05-30 22:48 - 13764096 ____A (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticaldd.dll
2012-05-24 08:08 - 2012-05-30 22:48 - 07431680 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiumd64.dll
2012-05-24 08:07 - 2011-05-24 18:50 - 04795904 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdva.dll
2012-05-24 08:06 - 2012-05-30 22:48 - 02664704 ____A C:\Windows\SysWOW64\atiumdva.cap
2012-05-24 07:55 - 2012-05-30 22:48 - 00360448 ____A (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atiadlxy.dll
2012-05-24 07:55 - 2011-11-09 18:13 - 00514560 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\atiadlxx.dll
2012-05-24 07:54 - 2012-05-30 22:48 - 00343040 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\Drivers\atikmpag.sys
2012-05-24 07:54 - 2012-05-30 22:48 - 00041984 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atig6txx.dll
2012-05-24 07:54 - 2012-05-30 22:48 - 00033280 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atigktxx.dll
2012-05-24 07:54 - 2012-05-30 22:48 - 00017408 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atig6pxx.dll
2012-05-24 07:54 - 2012-05-30 22:48 - 00014848 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiglpxx.dll
2012-05-24 07:54 - 2012-05-30 22:48 - 00014848 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiglpxx.dll
2012-05-24 07:53 - 2012-05-30 22:48 - 00044544 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiu9p64.dll
2012-05-24 07:53 - 2011-07-28 04:53 - 00041984 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiuxpag.dll
2012-05-24 07:53 - 2011-05-24 18:24 - 00054784 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atiuxp64.dll
2012-05-24 07:53 - 2011-05-24 18:24 - 00032256 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiu9pag.dll
2012-05-24 07:52 - 2012-05-30 22:48 - 00053248 ____A (Advanced Micro Devices, Inc.) C:\Windows\System32\Drivers\ati2erec.dll
2012-05-24 07:50 - 2012-05-30 22:48 - 00054784 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\atimpc64.dll
2012-05-24 07:50 - 2012-05-30 22:48 - 00054784 ____A (Advanced Micro Devices, Inc. ) C:\Windows\System32\amdpcom64.dll
2012-05-24 07:50 - 2012-05-30 22:48 - 00053760 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atimpc32.dll
2012-05-24 07:50 - 2012-05-30 22:48 - 00053760 ____A (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdpcom32.dll
2012-05-22 03:52 - 2012-05-22 03:52 - 00700112 ____N C:\Windows\Minidump\052212-17565-01.dmp
2012-05-19 05:38 - 2012-01-14 08:42 - 394761734 ____A C:\Users\user\Desktop\???.-.[?????II].??.(ape).rar
2012-05-17 18:47 - 2012-06-13 22:12 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-05-17 18:16 - 2012-06-13 22:12 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-05-17 18:06 - 2012-06-13 22:12 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-05-17 17:59 - 2012-06-13 22:12 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-05-17 17:59 - 2012-06-13 22:12 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-05-17 17:58 - 2012-06-13 22:12 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-05-17 17:58 - 2012-06-13 22:12 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-05-17 17:56 - 2012-06-13 22:12 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-05-17 17:55 - 2012-06-13 22:12 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-05-17 17:55 - 2012-06-13 22:12 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-05-17 17:54 - 2012-06-13 22:12 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-05-17 17:51 - 2012-06-13 22:12 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-05-17 17:51 - 2012-06-13 22:12 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-05-17 17:47 - 2012-06-13 22:12 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-05-17 15:11 - 2012-06-13 22:12 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-05-17 14:48 - 2012-06-13 22:12 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-05-17 14:45 - 2012-06-13 22:12 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2012-05-17 14:36 - 2012-06-13 22:12 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-05-17 14:35 - 2012-06-13 22:12 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2012-05-17 14:35 - 2012-06-13 22:12 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-05-17 14:33 - 2012-06-13 22:12 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-05-17 14:31 - 2012-06-13 22:12 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-05-17 14:29 - 2012-06-13 22:12 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2012-05-17 14:29 - 2012-06-13 22:12 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2012-05-17 14:27 - 2012-06-13 22:12 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-05-17 14:25 - 2012-06-13 22:12 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-05-17 14:24 - 2012-06-13 22:12 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-05-17 14:20 - 2012-06-13 22:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-05-14 17:32 - 2012-06-13 21:32 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-05-11 13:28 - 2012-05-11 13:28 - 00274712 ____A (Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
2012-05-11 13:28 - 2012-05-11 13:28 - 00170264 ____A (Intel Corporation) C:\Windows\System32\igfxtray.exe
2012-05-11 13:27 - 2012-05-11 13:27 - 05894424 ____A (Intel Corporation) C:\Windows\System32\GfxUI.exe
2012-05-11 13:27 - 2012-05-11 13:27 - 00509208 ____A (Intel Corporation) C:\Windows\System32\igfxsrvc.exe
2012-05-11 13:27 - 2012-05-11 13:27 - 00439064 ____A (Intel Corporation) C:\Windows\System32\igfxpers.exe
2012-05-11 13:27 - 2012-05-11 13:27 - 00398616 ____A (Intel Corporation) C:\Windows\System32\hkcmd.exe
2012-05-11 13:27 - 2012-05-11 13:27 - 00249624 ____A (Intel Corporation) C:\Windows\System32\igfxext.exe
2012-05-11 13:27 - 2012-05-11 13:27 - 00184600 ____A (Intel Corporation) C:\Windows\System32\difx64.exe
2012-05-10 19:14 - 2012-07-08 04:25 - 00092896 ____A (PC Tools) C:\Windows\System32\Drivers\pctplsg64.sys
2012-05-10 19:14 - 2012-07-08 04:23 - 00251528 ____A (PC Tools) C:\Windows\System32\Drivers\PCTSD64.sys
2012-05-10 19:13 - 2012-07-08 04:25 - 00014776 ____A (PC Tools) C:\Windows\System32\Drivers\pctBTFix64.sys
2012-05-10 19:09 - 2012-07-08 04:25 - 00145432 ____A (PC Tools) C:\Windows\System32\Drivers\pctwfpfilter64.sys
2012-05-10 19:08 - 2012-07-08 04:25 - 00341168 ____A (PC Tools) C:\Windows\System32\Drivers\pctgntdi64.sys
2012-05-10 00:33 - 2012-05-10 00:33 - 00217600 ____A (Renesas Electronics Corporation) C:\Windows\System32\Drivers\nusb3xhc.sys
2012-05-10 00:33 - 2012-05-10 00:33 - 00097792 ____A (Renesas Electronics Corporation) C:\Windows\System32\Drivers\nusb3hub.sys
2012-05-09 04:00 - 2012-05-09 04:00 - 00000076 ____A C:\Windows\SysWOW64\llbiirc.dll
2012-05-07 13:45 - 2012-05-09 04:00 - 00380544 ____N (JRiver, Inc.) C:\Windows\SysWOW64\MC17.exe
2012-05-07 13:45 - 2012-05-09 04:00 - 00380544 ____N (JRiver, Inc.) C:\Windows\System32\MC17.exe
2012-05-04 03:06 - 2012-06-13 21:32 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-05-04 03:00 - 2012-06-26 06:15 - 00366592 ____A (Microsoft Corporation) C:\Windows\System32\qdvd.dll
2012-05-04 02:03 - 2012-06-13 21:32 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-05-04 02:03 - 2012-06-13 21:32 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-05-04 01:59 - 2012-06-26 06:15 - 00514560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2012-04-30 21:40 - 2012-06-13 21:32 - 00209920 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2012-04-30 03:49 - 2011-11-30 06:30 - 00038946 ____A C:\Users\user\Desktop\Poo Poo Chart.xlsx
2012-04-29 18:25 - 2012-04-29 18:25 - 00016892 ____A C:\Windows\System32\iglhxs64.vp
2012-04-29 18:13 - 2012-04-29 18:13 - 00090112 ____A (Intel Corporation) C:\Windows\System32\igfxCoIn_v2747.dll
2012-04-29 18:08 - 2012-04-29 18:08 - 08913440 ____A (Intel Corporation) C:\Windows\System32\Drivers\igdkmd64.sys
2012-04-29 18:08 - 2012-04-29 18:08 - 07924736 ____A (Intel Corporation) C:\Windows\System32\igdumd64.dll
2012-04-29 18:07 - 2012-04-29 18:07 - 00080896 ____A C:\Windows\System32\igdde64.dll
2012-04-29 18:05 - 2012-03-19 07:26 - 06368256 ____A (Intel Corporation) C:\Windows\SysWOW64\igdumd32.dll
2012-04-29 18:04 - 2012-04-29 18:04 - 00064512 ____A C:\Windows\SysWOW64\igdde32.dll
2012-04-29 18:03 - 2012-03-19 07:22 - 07912960 ____A (Intel Corporation) C:\Windows\System32\igd10umd64.dll
2012-04-29 17:45 - 2012-04-29 17:45 - 06300160 ____A (Intel Corporation) C:\Windows\SysWOW64\igd10umd32.dll
2012-04-29 17:08 - 2012-04-29 17:08 - 12851200 ____A (Intel Corporation) C:\Windows\System32\ig4icd64.dll
2012-04-29 17:01 - 2012-04-29 17:01 - 10640896 ____A (Intel Corporation) C:\Windows\SysWOW64\ig4icd32.dll
2012-04-29 17:00 - 2012-04-29 17:00 - 00222341 ____A C:\Windows\System32\Gfxres.th-TH.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00208899 ____A C:\Windows\System32\Gfxres.el-GR.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00193160 ____A C:\Windows\System32\Gfxres.ru-RU.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00162584 ____A C:\Windows\System32\Gfxres.ja-JP.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00158244 ____A C:\Windows\System32\Gfxres.he-IL.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00148991 ____A C:\Windows\System32\Gfxres.it-IT.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00147358 ____A C:\Windows\System32\Gfxres.ko-KR.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00146676 ____A C:\Windows\System32\Gfxres.es-ES.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00146490 ____A C:\Windows\System32\Gfxres.de-DE.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00145320 ____A C:\Windows\System32\Gfxres.ro-RO.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00144820 ____A C:\Windows\System32\Gfxres.fr-FR.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00144053 ____A C:\Windows\System32\Gfxres.tr-TR.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00143629 ____A C:\Windows\System32\Gfxres.pt-BR.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00143300 ____A C:\Windows\System32\Gfxres.nl-NL.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00143285 ____A C:\Windows\System32\Gfxres.hu-HU.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00142613 ____A C:\Windows\System32\Gfxres.pt-PT.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00142258 ____A C:\Windows\System32\Gfxres.sv-SE.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00142021 ____A C:\Windows\System32\Gfxres.pl-PL.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00141560 ____A C:\Windows\System32\Gfxres.fi-FI.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00141204 ____A C:\Windows\System32\Gfxres.sk-SK.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00140420 ____A C:\Windows\System32\Gfxres.hr-HR.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00137296 ____A C:\Windows\System32\Gfxres.sl-SI.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00137220 ____A C:\Windows\System32\Gfxres.nb-NO.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00136561 ____A C:\Windows\System32\Gfxres.da-DK.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00125721 ____A C:\Windows\System32\Gfxres.zh-TW.resources
2012-04-29 17:00 - 2012-04-29 17:00 - 00124195 ____A C:\Windows\System32\Gfxres.zh-CN.resources
2012-04-29 16:59 - 2012-04-29 16:59 - 00440320 ____A (Intel Corporation) C:\Windows\System32\igfxrell.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00439808 ____A (Intel Corporation) C:\Windows\System32\igfxrfra.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00439808 ____A (Intel Corporation) C:\Windows\System32\igfxresn.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00439296 ____A (Intel Corporation) C:\Windows\System32\igfxrrus.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00439296 ____A (Intel Corporation) C:\Windows\System32\igfxrrom.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00438784 ____A (Intel Corporation) C:\Windows\System32\igfxrsky.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00438784 ____A (Intel Corporation) C:\Windows\System32\igfxrptg.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00438784 ____A (Intel Corporation) C:\Windows\System32\igfxrplk.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00438784 ____A (Intel Corporation) C:\Windows\System32\igfxrnld.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00438784 ____A (Intel Corporation) C:\Windows\System32\igfxrita.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00438784 ____A (Intel Corporation) C:\Windows\System32\igfxrhrv.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00438784 ____A (Intel Corporation) C:\Windows\System32\igfxrdeu.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00438272 ____A (Intel Corporation) C:\Windows\System32\igfxrhun.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00438272 ____A (Intel Corporation) C:\Windows\System32\igfxrfin.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00438272 ____A (Intel Corporation) C:\Windows\System32\igfxrcsy.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00437760 ____A (Intel Corporation) C:\Windows\System32\igfxrtrk.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00437760 ____A (Intel Corporation) C:\Windows\System32\igfxrsve.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00437760 ____A (Intel Corporation) C:\Windows\System32\igfxrslv.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00437760 ____A (Intel Corporation) C:\Windows\System32\igfxrptb.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00437760 ____A (Intel Corporation) C:\Windows\System32\igfxrnor.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00437248 ____A (Intel Corporation) C:\Windows\System32\igfxrtha.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00437248 ____A (Intel Corporation) C:\Windows\System32\igfxrdan.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00435712 ____A (Intel Corporation) C:\Windows\System32\igfxrheb.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00435712 ____A (Intel Corporation) C:\Windows\System32\igfxrara.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00432128 ____A (Intel Corporation) C:\Windows\System32\igfxrjpn.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00431104 ____A (Intel Corporation) C:\Windows\System32\igfxrkor.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00429056 ____A (Intel Corporation) C:\Windows\System32\igfxrcht.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00428544 ____A (Intel Corporation) C:\Windows\System32\igfxrchs.lrc
2012-04-29 16:59 - 2012-04-29 16:59 - 00410624 ____A (Intel Corporation) C:\Windows\System32\igfxTMM.dll
2012-04-29 16:59 - 2012-04-29 16:59 - 00390144 ____A (Intel Corporation) C:\Windows\System32\igfxpph.dll
2012-04-29 16:59 - 2012-04-29 16:59 - 00165366 ____A C:\Windows\System32\Gfxres.ar-SA.resources
2012-04-29 16:59 - 2012-04-29 16:59 - 00141764 ____A C:\Windows\System32\Gfxres.cs-CZ.resources
2012-04-29 16:59 - 2012-04-29 16:59 - 00132105 ____A C:\Windows\System32\Gfxres.en-US.resources
2012-04-29 16:59 - 2012-04-29 16:59 - 00126976 ____A (Intel Corporation) C:\Windows\System32\igfxcpl.cpl
2012-04-29 16:59 - 2012-04-29 16:59 - 00028672 ____A (Intel Corporation) C:\Windows\System32\igfxexps.dll
2012-04-29 16:59 - 2012-03-19 06:17 - 00062976 ____A (Intel Corporation) C:\Windows\System32\igfxsrvc.dll
2012-04-29 16:58 - 2012-04-29 16:58 - 00437760 ____A (Intel Corporation) C:\Windows\System32\igfxdev.dll
2012-04-29 16:58 - 2012-04-29 16:58 - 00286208 ____A (Intel Corporation) C:\Windows\System32\igfxrenu.lrc
2012-04-29 16:58 - 2012-04-29 16:58 - 00172032 ____A (Intel Corporation) C:\Windows\System32\gfxSrvc.dll
2012-04-29 16:58 - 2012-04-29 16:58 - 00009216 ____A ( ) C:\Windows\System32\IGFXDEVLib.dll
2012-04-29 16:58 - 2012-03-19 06:17 - 00110592 ____A (Intel Corporation) C:\Windows\System32\hccutils.dll
2012-04-29 16:57 - 2012-04-29 16:57 - 00142336 ____A (Intel Corporation) C:\Windows\System32\igfxdo.dll
2012-04-29 16:57 - 2012-04-29 16:57 - 00025088 ____A (Intel Corporation) C:\Windows\SysWOW64\igfxexps32.dll
2012-04-29 16:57 - 2012-03-19 06:16 - 09007616 ____A (Intel Corporation) C:\Windows\System32\igfxress.dll
2012-04-29 16:56 - 2012-04-29 16:56 - 00326656 ____A (Intel Corporation) C:\Windows\SysWOW64\igfxdv32.dll
2012-04-29 16:54 - 2012-04-29 16:54 - 00963388 ____A C:\Windows\SysWOW64\igcodeckrng600.bin
2012-04-29 16:54 - 2012-04-29 16:54 - 00963388 ____A C:\Windows\System32\igcodeckrng600.bin
2012-04-29 16:54 - 2012-04-29 16:54 - 00524800 ____A (Intel Corporation) C:\Windows\System32\iglhsip64.dll
2012-04-29 16:54 - 2012-04-29 16:54 - 00519680 ____A (Intel Corporation) C:\Windows\SysWOW64\iglhsip32.dll
2012-04-29 16:54 - 2012-04-29 16:54 - 00272888 ____A C:\Windows\SysWOW64\igvpkrng600.bin
2012-04-29 16:54 - 2012-04-29 16:54 - 00272888 ____A C:\Windows\System32\igvpkrng600.bin
2012-04-29 16:54 - 2012-04-29 16:54 - 00243712 ____A (Intel Corporation) C:\Windows\System32\iglhcp64.dll
2012-04-29 16:54 - 2012-04-29 16:54 - 00201216 ____A (Intel Corporation) C:\Windows\SysWOW64\iglhcp32.dll
2012-04-27 19:55 - 2012-06-13 21:32 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-04-25 21:41 - 2012-06-13 21:32 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-04-25 21:41 - 2012-06-13 21:32 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-04-25 21:34 - 2012-06-13 21:32 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-04-23 21:37 - 2012-06-13 21:32 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-04-23 21:37 - 2012-06-13 21:32 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-04-23 21:37 - 2012-06-13 21:32 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-04-23 20:36 - 2012-06-13 21:32 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2012-04-23 20:36 - 2012-06-13 21:32 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2012-04-23 20:36 - 2012-06-13 21:32 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2012-04-22 20:36 - 2012-07-08 04:23 - 00426616 ____A (PC Tools) C:\Windows\System32\Drivers\PCTCore64.sys
2012-04-17 17:16 - 2012-05-30 22:51 - 00090624 ____A (Advanced Micro Devices) C:\Windows\System32\Drivers\AtihdW86.sys
2012-04-14 04:26 - 2012-04-14 04:26 - 00303224 ____A C:\Windows\Minidump\041412-15662-01.dmp
ZeroAccess:
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\@
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\L
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\U
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\L\00000004.@
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\L\00000008.@
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\L\1afb2d56
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\U\00000004.@
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\U\00000008.@
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\U\000000cb.@
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\U\80000000.@
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\U\80000032.@
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2}\U\80000064.@
ZeroAccess:
C:\Windows\assembly\GAC_32\Desktop.ini
ZeroAccess:
C:\Windows\assembly\GAC_64\Desktop.ini
========================= Known DLLs (Whitelisted) ============
========================= Bamital & volsnap Check ============
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe 50BEA589F7D7958BDD2528A8F69D05CC ZeroAccess <==== ATTENTION!.
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
========================= Memory info ======================
Percentage of memory in use: 9%
Total physical RAM: 8109.43 MB
Available physical RAM: 7311.21 MB
Total Pagefile: 8107.63 MB
Available Pagefile: 7302.77 MB
Total Virtual: 8192 MB
Available Virtual: 8191.91 MB
======================= Partitions =========================
1 Drive c: () (Fixed) (Total:999.9 GB) (Free:143.8 GB) NTFS
2 Drive e: () (Fixed) (Total:863.02 GB) (Free:338.94 GB) NTFS
3 Drive f: (MY_DATA_042411) (CDROM) (Total:0.1 GB) (Free:0 GB) CDFS
4 Drive g: () (Removable) (Total:3.76 GB) (Free:3.76 GB) FAT32
5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
6 Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 1863 GB 0 B
Disk 1 Online 3861 MB 0 B
Partitions of Disk 0:
===============
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 100 MB 1024 KB
Partition 2 Primary 999 GB 101 MB
Partition 3 Primary 863 GB 1000 GB
==================================================================================
Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y System Rese NTFS Partition 100 MB Healthy
==================================================================================
Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 999 GB Healthy
==================================================================================
Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 E NTFS Partition 863 GB Healthy
==================================================================================
Partitions of Disk 1:
===============
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 3855 MB 5628 KB
==================================================================================
Disk: 1
Partition 1
Type : 0C
Hidden: No
Active: Yes
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 G FAT32 Removable 3855 MB Healthy
==================================================================================
==========================================================
Last Boot: 2012-06-30 21:47
======================= End Of Log ==========================

 

[Broni]

In Vista or Windows 7: Boot to System Recovery Options and run FRST.
In Windows XP: Please boot to UBCD and run FRST.
Type the following in the edit box after "Search:".

services.exe

Click Search button and post the log (Search.txt) it makes to your reply.

 

[hokokhua]

hi broni, results as follows:

===
Farbar Recovery Scan Tool Version: 07-07-2012 04
Ran by SYSTEM at 2012-07-09 10:08:25
Running from G:\

================== Search: "services.exe" ===================

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\System32\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0329216 ____A (Microsoft Corporation) 50BEA589F7D7958BDD2528A8F69D05CC

====== End Of Search ======

 

[Broni]

Download attached fixlist.txt file and save it to the very same USB flash drive you've been using. Plug the drive back in.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.
On Windows XP: Now please boot into the UBCD.
Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Next...

Restart normally.

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Never rename Combofix unless instructed.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
• Close any open browsers.
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
• Double click on combofix.exe & follow the prompts.

• 
  NOTE1. If Combofix asks you to install Recovery Console, please allow it.
  NOTE 2. If Combofix asks you to update the program, always do so.

• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click Rkill and choose Run as Administrator
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.exe

• Double-click on the Rkill icon to run the tool.
• If using Vista or Windows 7 right-click on it and choose Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• If not, delete the file, then download and use the one provided in Link 2.
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
• Do not reboot until instructed.
• If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

 

[hokokhua]

ComboFix 12-07-08.02 - user 7/2012 Mon 22:21:42.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.950.852.1033.18.8109.5938 [GMT 8:00]
執行位置: c:\users\user\Desktop\ComboFix.exe
AV: ESET Smart Security 5.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET Personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 5.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( 被刪除的檔案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\advanc~1\wh_exec.exe
c:\users\user\AppData\Local\Temp\8aefdf3f-82dc-462e-be91-2ca1c43911cf\CliSecureRT.dll
c:\windows\SysWow64\llbiirc.dll
c:\windows\SysWow64\muzapp.exe
.
.
((((((((((((((((((((((((( 2012-06-09 至 2012-07-09 的新的檔案 )))))))))))))))))))))))))))))))
.
.
2012-07-09 14:27 . 2012-07-09 14:27--------d-----w-c:\users\Default\AppData\Local\temp
2012-07-08 13:20 . 2012-07-08 13:37--------d-----w-C:\FRST
2012-07-08 12:26 . 2012-06-14 04:3185224----a-w-c:\windows\system32\drivers\PCTBD64.sys
2012-07-08 12:23 . 2012-07-08 12:25--------d-----w-c:\program files (x86)\PC Tools
2012-07-08 12:23 . 2012-07-08 12:25--------d-----w-c:\programdata\PC Tools
2012-07-08 12:23 . 2012-07-08 12:23--------d-----w-c:\users\user\AppData\Roaming\TestApp
2012-07-08 10:48 . 2012-07-08 10:48--------d-----w-c:\users\user\AppData\Roaming\Simply Super Software
2012-07-08 10:48 . 2012-07-08 10:48--------d-----w-c:\programdata\Simply Super Software
2012-07-08 10:37 . 2012-07-08 10:37--------d-----w-c:\users\user\AppData\Roaming\Malwarebytes
2012-07-08 10:36 . 2012-07-08 10:36--------d-----w-c:\programdata\Malwarebytes
2012-07-08 09:59 . 2012-07-08 09:59--------d-sh--w-c:\windows\SysWow64\%APPDATA%
2012-06-26 14:15 . 2012-05-04 11:00366592----a-w-c:\windows\system32\qdvd.dll
2012-06-26 14:15 . 2012-05-04 09:59514560----a-w-c:\windows\SysWow64\qdvd.dll
2012-06-24 09:52 . 2012-06-02 22:192428952----a-w-c:\windows\system32\wuaueng.dll
2012-06-24 09:52 . 2012-06-02 22:1957880----a-w-c:\windows\system32\wuauclt.exe
2012-06-24 09:52 . 2012-06-02 22:1944056----a-w-c:\windows\system32\wups2.dll
2012-06-24 09:52 . 2012-06-02 22:152622464----a-w-c:\windows\system32\wucltux.dll
2012-06-24 09:52 . 2012-06-02 22:1938424----a-w-c:\windows\system32\wups.dll
2012-06-24 09:52 . 2012-06-02 22:19701976----a-w-c:\windows\system32\wuapi.dll
2012-06-24 09:52 . 2012-06-02 22:1599840----a-w-c:\windows\system32\wudriver.dll
2012-06-24 09:52 . 2012-06-02 07:19186752----a-w-c:\windows\system32\wuwebv.dll
2012-06-24 09:52 . 2012-06-02 07:1536864----a-w-c:\windows\system32\wuapp.exe
2012-06-23 06:07 . 2009-02-24 10:35255552----a-w-c:\windows\SysWow64\drivers\mcdbus.sys
2012-06-23 06:07 . 2012-06-23 06:07--------d-----w-c:\program files (x86)\MagicDisc
2012-06-23 06:07 . 2009-02-24 10:35255552----a-w-c:\windows\system32\drivers\mcdbus.sys
2012-06-23 05:47 . 2012-06-23 06:51--------d-----w-c:\windows\Edgar Cayce Readings
2012-06-22 10:01 . 2012-06-26 12:21--------d-----w-c:\program files (x86)\Roozz
2012-06-18 05:36 . 2012-06-18 05:36--------d-----w-c:\users\user\AppData\Local\sigil-ebook
2012-06-18 05:36 . 2012-06-18 05:36--------d-----w-c:\program files\Sigil
2012-06-14 05:32 . 2012-04-26 05:4177312----a-w-c:\windows\system32\rdpwsx.dll
2012-06-11 13:10 . 2012-06-11 13:10--------d-----w-c:\program files (x86)\WinSCP
2012-06-10 15:25 . 2012-06-10 15:25--------d-----w-c:\program files (x86)\Common Files\ABBYY
2012-06-10 15:22 . 2012-06-10 15:29--------d-----w-c:\program files (x86)\ABBYY FineReader 11
2012-06-10 15:01 . 2012-06-10 15:01--------d-----w-c:\users\user\AppData\Roaming\ABBYY
2012-06-10 14:51 . 2012-06-17 08:21--------d-----w-c:\users\user\AppData\Local\ABBYY
2012-06-10 14:51 . 2012-06-10 15:22--------d-----w-c:\programdata\ABBYY
2012-06-10 14:18 . 2011-12-25 20:02120832----a-w-c:\windows\system32\IntelOpenCL64.dll
2012-06-10 14:17 . 2011-12-25 20:0786016----a-w-c:\windows\SysWow64\IntelOpenCL32.dll
2012-06-10 14:17 . 2012-06-10 14:17--------d-----w-c:\program files\Common Files\Intel
2012-06-10 14:17 . 2012-06-10 14:17--------d-----w-c:\program files (x86)\Common Files\Intel
2012-06-10 12:40 . 2012-02-21 06:262528832----a-w-c:\windows\system32\FMAPO64.dll
2012-06-10 12:37 . 2012-06-10 12:42--------d--h--w-c:\program files (x86)\Temp
2012-06-10 12:31 . 2012-06-10 12:31--------d-----w-c:\users\user\AppData\Roaming\AccurateRip
2012-06-10 12:31 . 2012-06-10 12:314022504----a-w-c:\windows\SysWow64\SpoonUninstall.exe
2012-06-10 12:31 . 2012-06-10 12:31--------d-----w-c:\program files (x86)\Illustrate
2012-06-10 12:24 . 2012-06-10 12:24279136----a-w-c:\windows\system32\drivers\afcdp.sys
2012-06-10 12:24 . 2012-06-10 12:241263200----a-w-c:\windows\system32\drivers\tdrpm273.sys
2012-06-10 12:24 . 2012-06-10 12:24970336----a-w-c:\windows\system32\drivers\timntr.sys
2012-06-10 12:24 . 2012-06-10 12:24--------d-----w-c:\program files (x86)\Common Files\Acronis
2012-06-10 12:24 . 2012-06-10 12:24--------d-----w-c:\program files (x86)\Acronis
2012-06-10 12:23 . 2012-06-10 12:23--------d-----w-c:\program files (x86)\PDF to Word
2012-06-10 12:16 . 2012-06-10 12:16--------d-----w-c:\programdata\Intel
2012-06-10 12:16 . 2012-06-10 12:16--------d-----w-c:\program files\Intel
2012-06-10 12:16 . 2012-06-10 12:16--------d-----w-c:\program files (x86)\Common Files\postureAgent
2012-06-10 12:15 . 2011-11-09 18:0460184----a-w-c:\windows\system32\drivers\HECIx64.sys
2012-06-10 12:15 . 2012-06-10 12:15--------d-----w-C:\DRIVERS
2012-06-10 12:07 . 2012-06-10 12:10--------d-----w-c:\users\user\AppData\Roaming\driveridentifier
2012-06-10 12:02 . 2012-06-10 14:13--------d-----w-c:\programdata\Downloaded Installations
2012-06-10 11:47 . 2012-06-26 14:18--------d-----w-c:\programdata\DriverGenius
2012-06-10 11:39 . 2012-06-10 11:39--------d-----w-c:\program files (x86)\Driver-Soft
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三個月內被修改的檔案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-06 08:15 . 2012-04-02 07:09426184----a-w-c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-06 08:15 . 2011-12-14 12:2070344----a-w-c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-06-23 12:46 . 2012-04-02 07:469815752----a-w-c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-06-14 03:03 . 2012-07-08 12:263488----a-w-c:\windows\UDB.zip
2012-06-14 03:03 . 2012-07-08 12:26131----a-w-c:\windows\IDB.zip
2012-06-10 12:24 . 2012-03-31 10:46277088----a-w-c:\windows\system32\drivers\snapman.sys
2012-06-04 11:31 . 2011-09-16 06:21499712----a-w-c:\windows\SysWow64\msvcp71.dll
2012-06-04 11:31 . 2011-09-16 06:21348160----a-w-c:\windows\SysWow64\msvcr71.dll
2012-05-24 17:27 . 2012-05-31 06:4811175424----a-w-c:\windows\system32\drivers\atikmdag.sys
2012-05-24 17:13 . 2012-05-31 06:48159744----a-w-c:\windows\system32\atiapfxx.exe
2012-05-24 17:13 . 2011-05-25 03:07909312----a-w-c:\windows\SysWow64\aticfx32.dll
2012-05-24 17:11 . 2011-05-25 03:061067520----a-w-c:\windows\system32\aticfx64.dll
2012-05-24 17:08 . 2012-05-31 06:48442368----a-w-c:\windows\system32\ATIDEMGX.dll
2012-05-24 17:08 . 2011-07-28 13:36503296----a-w-c:\windows\system32\atieclxx.exe
2012-05-24 17:07 . 2011-07-28 13:35236544----a-w-c:\windows\system32\atiesrxx.exe
2012-05-24 17:06 . 2012-05-31 06:48120320----a-w-c:\windows\system32\atitmm64.dll
2012-05-24 17:05 . 2012-05-31 06:4821504----a-w-c:\windows\system32\atimuixx.dll
2012-05-24 17:05 . 2012-05-31 06:4859392----a-w-c:\windows\system32\atiedu64.dll
2012-05-24 17:05 . 2012-05-31 06:4843520----a-w-c:\windows\SysWow64\ati2edxx.dll
2012-05-24 17:04 . 2011-07-28 13:306800896----a-w-c:\windows\SysWow64\atidxx32.dll
2012-05-24 16:53 . 2012-05-31 06:4826181632----a-w-c:\windows\system32\atio6axx.dll
2012-05-24 16:43 . 2011-05-25 02:497479296----a-w-c:\windows\system32\atidxx64.dll
2012-05-24 16:42 . 2011-11-30 12:4764000----a-w-c:\windows\system32\coinst.dll
2012-05-24 16:33 . 2012-05-31 06:4819753984----a-w-c:\windows\SysWow64\atioglxx.dll
2012-05-24 16:20 . 2011-05-25 02:396203392----a-w-c:\windows\SysWow64\atiumdag.dll
2012-05-24 16:18 . 2012-05-31 06:481120768----a-w-c:\windows\system32\atiumd6v.dll
2012-05-24 16:18 . 2012-05-31 06:481831424----a-w-c:\windows\SysWow64\atiumdmv.dll
2012-05-24 16:17 . 2012-05-31 06:484731904----a-w-c:\windows\system32\atiumd6a.dll
2012-05-24 16:14 . 2012-05-31 06:4851200----a-w-c:\windows\system32\aticalrt64.dll
2012-05-24 16:14 . 2012-05-31 06:4846080----a-w-c:\windows\SysWow64\aticalrt.dll
2012-05-24 16:14 . 2012-05-31 06:4844544----a-w-c:\windows\system32\aticalcl64.dll
2012-05-24 16:14 . 2012-05-31 06:4844032----a-w-c:\windows\SysWow64\aticalcl.dll
2012-05-24 16:14 . 2012-05-31 06:4816090624----a-w-c:\windows\system32\aticaldd64.dll
2012-05-24 16:09 . 2012-05-31 06:4813764096----a-w-c:\windows\SysWow64\aticaldd.dll
2012-05-24 16:08 . 2012-05-31 06:487431680----a-w-c:\windows\system32\atiumd64.dll
2012-05-24 16:07 . 2011-05-25 02:504795904----a-w-c:\windows\SysWow64\atiumdva.dll
2012-05-24 15:55 . 2011-11-10 02:13514560----a-w-c:\windows\system32\atiadlxx.dll
2012-05-24 15:55 . 2012-05-31 06:48360448----a-w-c:\windows\SysWow64\atiadlxy.dll
2012-05-24 15:54 . 2012-05-31 06:4817408----a-w-c:\windows\system32\atig6pxx.dll
2012-05-24 15:54 . 2012-05-31 06:4814848----a-w-c:\windows\SysWow64\atiglpxx.dll
2012-05-24 15:54 . 2012-05-31 06:4814848----a-w-c:\windows\system32\atiglpxx.dll
2012-05-24 15:54 . 2012-05-31 06:4841984----a-w-c:\windows\system32\atig6txx.dll
2012-05-24 15:54 . 2012-05-31 06:4833280----a-w-c:\windows\SysWow64\atigktxx.dll
2012-05-24 15:54 . 2012-05-31 06:48343040----a-w-c:\windows\system32\drivers\atikmpag.sys
2012-05-24 15:53 . 2011-05-25 02:2454784----a-w-c:\windows\system32\atiuxp64.dll
2012-05-24 15:53 . 2011-07-28 12:5341984----a-w-c:\windows\SysWow64\atiuxpag.dll
2012-05-24 15:53 . 2012-05-31 06:4844544----a-w-c:\windows\system32\atiu9p64.dll
2012-05-24 15:53 . 2011-05-25 02:2432256----a-w-c:\windows\SysWow64\atiu9pag.dll
2012-05-24 15:52 . 2012-05-31 06:4853248----a-w-c:\windows\system32\drivers\ati2erec.dll
2012-05-24 15:50 . 2012-05-31 06:4854784----a-w-c:\windows\system32\atimpc64.dll
2012-05-24 15:50 . 2012-05-31 06:4854784----a-w-c:\windows\system32\amdpcom64.dll
2012-05-24 15:50 . 2012-05-31 06:4853760----a-w-c:\windows\SysWow64\atimpc32.dll
2012-05-24 15:50 . 2012-05-31 06:4853760----a-w-c:\windows\SysWow64\amdpcom32.dll
2012-05-11 21:28 . 2012-05-11 21:28274712----a-w-c:\windows\SysWow64\IntelCpHeciSvc.exe
2012-05-11 21:28 . 2012-05-11 21:28170264----a-w-c:\windows\system32\igfxtray.exe
2012-05-11 21:27 . 2012-05-11 21:27509208----a-w-c:\windows\system32\igfxsrvc.exe
2012-05-11 21:27 . 2012-05-11 21:27439064----a-w-c:\windows\system32\igfxpers.exe
2012-05-11 21:27 . 2012-05-11 21:27249624----a-w-c:\windows\system32\igfxext.exe
2012-05-11 21:27 . 2012-05-11 21:27398616----a-w-c:\windows\system32\hkcmd.exe
2012-05-11 21:27 . 2012-05-11 21:275894424----a-w-c:\windows\system32\GfxUI.exe
2012-05-11 21:27 . 2012-05-11 21:27184600----a-w-c:\windows\system32\difx64.exe
2012-05-10 08:33 . 2012-05-10 08:33217600----a-w-c:\windows\system32\drivers\nusb3xhc.sys
2012-05-10 08:33 . 2012-05-10 08:3397792----a-w-c:\windows\system32\drivers\nusb3hub.sys
2012-05-07 21:45 . 2012-05-09 12:00380544------w-c:\windows\SysWow64\MC17.exe
2012-05-07 21:45 . 2012-05-09 12:00380544------w-c:\windows\system32\MC17.exe
2012-04-30 02:13 . 2012-04-30 02:1390112----a-w-c:\windows\system32\igfxCoIn_v2747.dll
2012-04-30 02:08 . 2012-04-30 02:087924736----a-w-c:\windows\system32\igdumd64.dll
2012-04-30 02:08 . 2012-04-30 02:088913440----a-w-c:\windows\system32\drivers\igdkmd64.sys
2012-04-30 02:07 . 2012-04-30 02:0780896----a-w-c:\windows\system32\igdde64.dll
2012-04-30 02:05 . 2012-03-19 15:266368256----a-w-c:\windows\SysWow64\igdumd32.dll
2012-04-30 02:04 . 2012-04-30 02:0464512----a-w-c:\windows\SysWow64\igdde32.dll
2012-04-30 02:03 . 2012-03-19 15:227912960----a-w-c:\windows\system32\igd10umd64.dll
2012-04-30 01:45 . 2012-04-30 01:456300160----a-w-c:\windows\SysWow64\igd10umd32.dll
2012-04-30 01:08 . 2012-04-30 01:0812851200----a-w-c:\windows\system32\ig4icd64.dll
2012-04-30 01:01 . 2012-04-30 01:0110640896----a-w-c:\windows\SysWow64\ig4icd32.dll
2012-04-30 00:59 . 2012-04-30 00:59439296----a-w-c:\windows\system32\igfxrrom.lrc
2012-04-30 00:59 . 2012-04-30 00:59438784----a-w-c:\windows\system32\igfxrsky.lrc
2012-04-30 00:59 . 2012-04-30 00:59438784----a-w-c:\windows\system32\igfxrhrv.lrc
2012-04-30 00:59 . 2012-04-30 00:59439808----a-w-c:\windows\system32\igfxresn.lrc
2012-04-30 00:59 . 2012-04-30 00:59439296----a-w-c:\windows\system32\igfxrrus.lrc
2012-04-30 00:59 . 2012-04-30 00:59438784----a-w-c:\windows\system32\igfxrptg.lrc
2012-04-30 00:59 . 2012-04-30 00:59437760----a-w-c:\windows\system32\igfxrtrk.lrc
2012-04-30 00:59 . 2012-04-30 00:59437760----a-w-c:\windows\system32\igfxrsve.lrc
2012-04-30 00:59 . 2012-04-30 00:59437760----a-w-c:\windows\system32\igfxrslv.lrc
2012-04-30 00:59 . 2012-04-30 00:59437248----a-w-c:\windows\system32\igfxrtha.lrc
2012-04-30 00:59 . 2012-04-30 00:59440320----a-w-c:\windows\system32\igfxrell.lrc
2012-04-30 00:59 . 2012-04-30 00:59438784----a-w-c:\windows\system32\igfxrplk.lrc
2012-04-30 00:59 . 2012-04-30 00:59438784----a-w-c:\windows\system32\igfxrita.lrc
2012-04-30 00:59 . 2012-04-30 00:59438272----a-w-c:\windows\system32\igfxrhun.lrc
2012-04-30 00:59 . 2012-04-30 00:59437760----a-w-c:\windows\system32\igfxrptb.lrc
2012-04-30 00:59 . 2012-04-30 00:59437760----a-w-c:\windows\system32\igfxrnor.lrc
2012-04-30 00:59 . 2012-04-30 00:59435712----a-w-c:\windows\system32\igfxrheb.lrc
2012-04-30 00:59 . 2012-04-30 00:59432128----a-w-c:\windows\system32\igfxrjpn.lrc
2012-04-30 00:59 . 2012-04-30 00:59431104----a-w-c:\windows\system32\igfxrkor.lrc
2012-04-30 00:59 . 2012-04-30 00:59439808----a-w-c:\windows\system32\igfxrfra.lrc
2012-04-30 00:59 . 2012-04-30 00:59438784----a-w-c:\windows\system32\igfxrnld.lrc
2012-04-30 00:59 . 2012-04-30 00:59438784----a-w-c:\windows\system32\igfxrdeu.lrc
2012-04-30 00:59 . 2012-04-30 00:59438272----a-w-c:\windows\system32\igfxrfin.lrc
2012-04-30 00:59 . 2012-04-30 00:59438272----a-w-c:\windows\system32\igfxrcsy.lrc
2012-04-30 00:59 . 2012-04-30 00:59437248----a-w-c:\windows\system32\igfxrdan.lrc
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2011-11-17 . C118A82CD78818C29AB228366EBF81C3 . 31232 . . [6.1.7601.17725] .. c:\windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.17725_none_0466c45b7371f20d\lsass.exe
[-] 2011-11-17 . 0A10B74FBB437FF9A23F1D5DE4446A83 . 31232 . . [6.1.7601.21861] .. c:\windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.21861_none_04c1204e8cb39c3f\lsass.exe
[7] 2009-07-14 . 0793F40B9B8A1BDD266296409DBD91EA . 31232 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.17514_none_04709031736ac277\lsass.exe
[-] 2011-11-17 . C118A82CD78818C29AB228366EBF81C3 . 31232 . . [6.1.7601.17725] .. c:\windows\system32\lsass.exe
.
[-] 2012-04-24 . 4F5414602E2544A4554D95517948B705 . 184320 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.17827_none_d41dd577b1743795\cryptsvc.dll
[-] 2012-04-24 . B7337E9C9E5936355BB700AA33E0936E . 186880 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.21979_none_d473633acab895c2\cryptsvc.dll
[7] 2010-11-21 . 15597883FBE9B056F276ADA3AD87D9AF . 177152 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.17514_none_d4259ed3b16ed82a\cryptsvc.dll
[-] 2012-04-24 . 4F5414602E2544A4554D95517948B705 . 184320 . . [6.1.7600.16385] .. c:\windows\system32\cryptsvc.dll
.
[-] 2012-05-18 . DE469470D93DEB4A1A81EDE72B848198 . 17807360 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16446_none_87d0b277f4d8f45c\mshtml.dll
[-] 2012-05-18 . BE1E4779329040ED334651CD877C416D . 17807360 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20551_none_884a7de50e033164\mshtml.dll
[-] 2012-02-28 . D785A16A6F03F76CB862F28C9F8C9672 . 17790976 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16443_none_87cdb199f4dba857\mshtml.dll
[-] 2012-02-28 . 97BB8C752A400556A4FF2E1AAFA0A138 . 17790976 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20548_none_885c4fd70df4c6d4\mshtml.dll
[-] 2011-12-14 . E61288581AD9E647ABEFB1489B250B5C . 17790464 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16441_none_87cbb105f4dd75a9\mshtml.dll
[-] 2011-12-14 . 153963F44A26A7840ACDF52C2CD1B9DC . 17790464 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20546_none_885a4f430df69426\mshtml.dll
[7] 2011-11-30 . 02B4E6CCCA443568764281391635F5A4 . 17781760 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16437_none_87dc82adf4cff1c2\mshtml.dll
[-] 2011-11-04 . 5770C4BA825C42D6EFD9486029747108 . 17786368 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20544_none_88584eaf0df86178\mshtml.dll
[-] 2011-11-04 . E7BD23BEC69CF23436EEDE9B18DE186D . 17786368 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16440_none_87cab0bbf4de5c52\mshtml.dll
[7] 2011-10-01 . 6954EE1BBF29632A73791910E89951A8 . 9011200 . . [8.00.7601.17699] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17699_none_8bd1e33ab007593c\mshtml.dll
[7] 2011-10-01 . 187A4AE835C9C269447A7ACE944744FB . 9011200 . . [8.00.7601.21830] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21830_none_8c935ed9c8fc6a78\mshtml.dll
[7] 2010-11-21 . 1C8B787BAA52DEAD1A6FEC1502D652F0 . 8988160 . . [8.00.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17514_none_8c235f42afcafdda\mshtml.dll
[-] 2012-05-18 . DE469470D93DEB4A1A81EDE72B848198 . 17807360 . . [9.00.8112.16421] .. c:\windows\system32\mshtml.dll
.
[-] 2011-12-16 . C391FC68282A000CDF953F8B6B55D2EF . 634880 . . [7.0.7601.17744] .. c:\windows\winsxs\amd64_microsoft-windows-msvcrt_31bf3856ad364e35_6.1.7601.17744_none_2f5acf97b59df60f\msvcrt.dll
[-] 2011-12-16 . F9A4C695C86CC32048FE2C987A0BD387 . 634880 . . [7.0.7601.21878] .. c:\windows\winsxs\amd64_microsoft-windows-msvcrt_31bf3856ad364e35_6.1.7601.21878_none_2fc7fdc6ced04f08\msvcrt.dll
[7] 2009-07-14 . 7319BB10FA1F86E49E3DCF4136F6C957 . 634880 . . [7.0.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-msvcrt_31bf3856ad364e35_6.1.7600.16385_none_2d4a27c7b8972454\msvcrt.dll
[-] 2011-12-16 . C391FC68282A000CDF953F8B6B55D2EF . 634880 . . [7.0.7601.17744] .. c:\windows\system32\msvcrt.dll
.
[-] 2012-05-18 . 870ECFEBD41C7B8F9C6777748368D51F . 1392128 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.16446_none_7676935974828b26\wininet.dll
[-] 2012-05-18 . BDC16D105BF011D4B1C3F09CF7A64314 . 1392128 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.20551_none_76f05ec68dacc82e\wininet.dll
[-] 2012-02-28 . 228443FF3A1FB0B974D278F7C6403FAD . 1390080 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.16443_none_7673927b74853f21\wininet.dll
[-] 2012-02-28 . B70CDC073F70E6D082A62AB5880D6B07 . 1390080 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.20548_none_770230b88d9e5d9e\wininet.dll
[-] 2011-12-14 . B1AC85B6ADC005CF3F9EB4E28DFDCCE6 . 1390080 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.16441_none_767191e774870c73\wininet.dll
[-] 2011-12-14 . C2FA4DBD6BB91D1AFD7D155120654AB9 . 1390080 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.20546_none_770030248da02af0\wininet.dll
[7] 2011-11-30 . 271E8FB1354AA205A214F280A6766E30 . 1389056 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.16437_none_7682638f7479888c\wininet.dll
[-] 2011-11-04 . 244D45F786E33C169A93F70BA63BABF8 . 1390080 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.20544_none_76fe2f908da1f842\wininet.dll
[-] 2011-11-04 . 69151E566295E5A977FE71FFAFD3B3F8 . 1390080 . . [9.00.8112.16421] .. c:\windows\winsxs\amd64_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.16440_none_7670919d7487f31c\wininet.dll
[7] 2011-08-20 . DB33A1489C1DA1F37AC2D84CB9756DD1 . 1188864 . . [8.00.7601.17671] .. c:\windows\winsxs\amd64_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_8.0.7601.17671_none_7a8561a42fa7ed6c\wininet.dll
[7] 2011-08-20 . 2B4973A8A9D0336EEF6E10DBD6E5B87D . 1189376 . . [8.00.7601.21795] .. c:\windows\winsxs\amd64_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_8.0.7601.21795_none_7afd5fbf48d22a74\wininet.dll
[7] 2010-11-21 . F6C5302E1F4813D552F41A0AC82455E5 . 1188864 . . [8.00.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_8.0.7601.17514_none_7ac940242f7494a4\wininet.dll
[-] 2012-05-18 . 870ECFEBD41C7B8F9C6777748368D51F . 1392128 . . [9.00.8112.16421] .. c:\windows\system32\wininet.dll
.
[-] 2012-04-24 . 06E771AA596B8761107AB57E99F128D7 . 140288 . . [6.1.7600.16385] .. c:\windows\SysWOW64\cryptsvc.dll
[-] 2012-04-24 . 06E771AA596B8761107AB57E99F128D7 . 140288 . . [6.1.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.17827_none_77ff39f3f916c65f\cryptsvc.dll
[-] 2012-04-24 . 21993009E0CCB9B4FA195F14D3408626 . 142336 . . [6.1.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.21979_none_7854c7b7125b248c\cryptsvc.dll
[7] 2010-11-21 . A585BEBF7D054BD9618EDA0922D5484A . 136192 . . [6.1.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.17514_none_7807034ff91166f4\cryptsvc.dll
.
[-] 2012-05-17 . 9FB58F71104107D44540AF1195F7A14D . 12314624 . . [9.00.8112.16421] .. c:\windows\SysWOW64\mshtml.dll
[-] 2012-05-17 . 9FB58F71104107D44540AF1195F7A14D . 12314624 . . [9.00.8112.16421] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16446_none_92255cca2939b657\mshtml.dll
[-] 2012-05-17 . 761D9111F5A2619CB5060661D36FBFFF . 12314624 . . [9.00.8112.16421] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20551_none_929f28374263f35f\mshtml.dll
[-] 2012-02-28 . F82BF2CB075B49E9FAB5FF213C45C020 . 12281856 . . [9.00.8112.16421] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16443_none_92225bec293c6a52\mshtml.dll
[-] 2012-02-28 . B9E083B14B1994F1255983F2DF31C7DF . 12281856 . . [9.00.8112.16421] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20548_none_92b0fa29425588cf\mshtml.dll
[-] 2011-12-14 . 497C9C3DB953A60EC4F43A097E15F75E . 12282368 . . [9.00.8112.16421] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16441_none_92205b58293e37a4\mshtml.dll
[-] 2011-12-14 . A29CFD4B9F6F2BBE06C8D64B6D07F1D4 . 12282368 . . [9.00.8112.16421] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20546_none_92aef99542575621\mshtml.dll
[7] 2011-11-30 . 04E0CD31A63DFC0D73725A3D1768FB5A . 12275200 . . [9.00.8112.16421] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16437_none_92312d002930b3bd\mshtml.dll
[-] 2011-11-03 . A21B983E40578D0E6CFA9864AC4E1219 . 12279808 . . [9.00.8112.16421] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20544_none_92acf90142592373\mshtml.dll
[-] 2011-11-03 . 66C0AEE61D1C5C35BF1B4642A153B114 . 12279808 . . [9.00.8112.16421] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16440_none_921f5b0e293f1e4d\mshtml.dll
[7] 2011-10-01 . E16F0A71B984E06FE0A90A2E2E227B23 . 5991936 . . [8.00.7601.21830] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.21830_none_96e8092bfd5d2c73\mshtml.dll
[7] 2011-10-01 . 009751094A5A9041723D635AF249DC6F . 5990400 . . [8.00.7601.17699] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17699_none_96268d8ce4681b37\mshtml.dll
[7] 2010-11-21 . C50799F0D47DFB9774F721521B6C41D5 . 5977600 . . [8.00.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17514_none_96780994e42bbfd5\mshtml.dll
.
[-] 2011-12-16 . 2F740C4B458331357E825E94AFB0953A . 690688 . . [7.0.7601.21878] .. c:\windows\winsxs\x86_microsoft-windows-msvcrt_31bf3856ad364e35_6.1.7601.21878_none_d3a962431672ddd2\msvcrt.dll
[-] 2011-12-16 . 9DC80A8AAAAAC397BDAB3C67165A824E . 690688 . . [7.0.7601.17744] .. c:\windows\SysWOW64\msvcrt.dll
[-] 2011-12-16 . 9DC80A8AAAAAC397BDAB3C67165A824E . 690688 . . [7.0.7601.17744] .. c:\windows\winsxs\x86_microsoft-windows-msvcrt_31bf3856ad364e35_6.1.7601.17744_none_d33c3413fd4084d9\msvcrt.dll
[7] 2009-07-14 . E46D48A7FE961401F1CBF85531CDF05D . 690688 . . [7.0.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-msvcrt_31bf3856ad364e35_6.1.7600.16385_none_d12b8c440039b31e\msvcrt.dll
.
[-] 2012-05-17 . 1C191A4F0960F21B5D58C8A65BAF5427 . 1129472 . . [9.00.8112.16421] .. c:\windows\SysWOW64\wininet.dll
[-] 2012-05-17 . 1C191A4F0960F21B5D58C8A65BAF5427 . 1129472 . . [9.00.8112.16421] .. c:\windows\winsxs\x86_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.16446_none_1a57f7d5bc2519f0\wininet.dll
[-] 2012-05-17 . 43BAC67996D8765A5F1B3A4EA6231E21 . 1129472 . . [9.00.8112.16421] .. c:\windows\winsxs\x86_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.20551_none_1ad1c342d54f56f8\wininet.dll
[-] 2012-02-28 . 44465367256D1C72B58F5ABAA19E7016 . 1127424 . . [9.00.8112.16421] .. c:\windows\winsxs\x86_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.16443_none_1a54f6f7bc27cdeb\wininet.dll
[-] 2012-02-28 . 11A34DCA08EB2A586246F2D6C2A81D58 . 1127424 . . [9.00.8112.16421] .. c:\windows\winsxs\x86_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.20548_none_1ae39534d540ec68\wininet.dll
[-] 2011-12-14 . 1D94FA7C81D2FFE494AF094619BA706F . 1127424 . . [9.00.8112.16421] .. c:\windows\winsxs\x86_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.16441_none_1a52f663bc299b3d\wininet.dll
[-] 2011-12-14 . 022A78194E2C7106F5AF9F2BC6AC8774 . 1127424 . . [9.00.8112.16421] .. c:\windows\winsxs\x86_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.20546_none_1ae194a0d542b9ba\wininet.dll
[7] 2011-11-30 . D3788D91530CFA005BD516189A4C676E . 1126912 . . [9.00.8112.16421] .. c:\windows\winsxs\x86_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.16437_none_1a63c80bbc1c1756\wininet.dll
[-] 2011-11-03 . 32569DF2F9BEF05DD7D56E30590EDFD9 . 1127424 . . [9.00.8112.16421] .. c:\windows\winsxs\x86_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.20544_none_1adf940cd544870c\wininet.dll
[-] 2011-11-03 . 02F98B5C0E397AD06124D84428CF8F1A . 1127424 . . [9.00.8112.16421] .. c:\windows\winsxs\x86_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_9.4.8112.16440_none_1a51f619bc2a81e6\wininet.dll
[7] 2011-08-20 . 7570FA3FC82E08FB637E32D2D95DB41D . 981504 . . [8.00.7601.21795] .. c:\windows\winsxs\x86_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_8.0.7601.21795_none_1edec43b9074b93e\wininet.dll
[7] 2011-08-20 . DBF24E87CB605A4F6E7424DD86F7A62C . 981504 . . [8.00.7601.17671] .. c:\windows\winsxs\x86_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_8.0.7601.17671_none_1e66c620774a7c36\wininet.dll
[7] 2010-11-21 . 44214C94911C7CFB1D52CB64D5E8368D . 980992 . . [8.00.7601.17514] .. c:\windows\winsxs\x86_microsoft-windows-I..tocolimplementation_31bf3856ad364e35_8.0.7601.17514_none_1eaaa4a07717236e\wininet.dll
.
((((((((((((((((((((((((((((((((((((( 重要登入點 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白與合法缺省登錄將不會被顯示
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AAADesktopTips]
@="{4562B511-62E9-4533-B7B2-56A8BB10B482}"
[HKEY_CLASSES_ROOT\CLSID\{4562B511-62E9-4533-B7B2-56A8BB10B482}]
2011-09-29 07:38251504----a-w-c:\program files (x86)\Common Files\Thunder Network\Kankan\xappex.1.1.1.29.(630).dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PPAP"="c:\program files (x86)\Common Files\PPLiveNetwork\PPAP.exe" [2011-12-15 436088]
"KiesHelper"="c:\program files (x86)\Samsung\Kies\KiesHelper.exe" [2011-11-29 935312]
"KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2011-11-29 21392]
"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2012-05-21 880496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\ssmmgr.exe" [2009-10-13 606208]
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-12-07 421736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2011-11-29 3508624]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2011-09-16 115048]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2012-06-04 296056]
"SAOB Monitor"="c:\program files (x86)\Acronis\OnlineBackupStandalone\TrueImageMonitor.exe" [2010-08-20 2536752]
"TrueImageMonitor.exe"="c:\program files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe" [2010-08-21 5459136]
"Bonus.SSR.FR11"="c:\program files (x86)\ABBYY FineReader 11\Bonus.ScreenshotReader.exe" [2012-01-19 933640]
.
c:\users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MagicDisc.lnk - c:\program files (x86)\MagicDisc\MagicDisc.exe [2012-6-23 576000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
"OldEnableShellExecuteHooks"= 1 (0x1)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{4562B511-62E9-4533-B7B2-56A8BB10B482}"= "c:\program files (x86)\Common Files\Thunder Network\KanKan\xappex.1.1.1.29.(630).dll" [2011-09-29 251504]
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-06 257224]
R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2012-05-24 11175424]
R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2012-05-24 343040]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW86.sys [2012-04-18 90624]
R3 cphs;Intel(R) Content Protection HECI Service;c:\windows\SysWow64\IntelCpHeciSvc.exe [2012-05-11 274712]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-02-15 99384]
R3 Media Center 17 Service;Media Center 17 Service;c:\program files (x86)\J River\Media Center 17\JRService.exe [2012-05-07 392320]
R3 PCTBD;PC Tools Browser Defender Driver;c:\windows\system32\Drivers\PCTBD64.sys [2012-06-14 85224]
R3 PCTSFileEnum;PCTSFileEnum;c:\program files (x86)\PC Tools\DMScanning\PCTSFiles.exe [2012-05-11 89016]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-02-15 203320]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-08-02 51712]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-11-30 1255736]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2011-08-04 62496]
S0 MxEFUF;Matrox Extio Upper Function Filter;c:\windows\system32\DRIVERS\MxEFUF64.sys [2011-10-20 157696]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore64.sys [2012-04-23 426616]
S0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS64.sys [2012-02-28 453896]
S0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA64.sys [2012-02-28 1096176]
S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys [2010-11-26 17720]
S0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);c:\windows\system32\DRIVERS\tdrpm273.sys [2012-06-10 1263200]
S0 vidsflt53;Acronis Disk Storage Filter (53);c:\windows\system32\DRIVERS\vsflt53.sys [2012-03-31 141920]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2011-08-04 146432]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [2011-08-04 38288]
S1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\Drivers\PCTSD64.sys [2012-05-11 251528]
S2 ABBYY.Licensing.FineReader.Corporate.11.0;ABBYY FineReader 11 CE Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe [2011-12-22 818952]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 afcdpsrv;Acronis Nonstop Backup service;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2012-06-10 3975088]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-05-24 236544]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2011-08-09 202576]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-09-22 974944]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe [2012-02-02 628448]
S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2011-12-20 341800]
S2 Roozz Updater;Roozz Updater;c:\program files (x86)\Roozz\RoozzUpdater.exe [2012-06-26 382464]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2007-08-13 11576]
S2 WDDMService;WDDMService;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [2011-03-09 288768]
S2 WDFME;WD File Management Engine;c:\program files (x86)\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe [2011-03-09 1066896]
S2 WDSC;WD File Management Shadow Engine;c:\program files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSC.exe [2011-03-09 491920]
S2 XLServicePlatform;XLServicePlatform;c:\windows\system32\svchost [x]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [2012-06-10 279136]
S3 busenum;Synology Virtual USB Hub;c:\windows\system32\DRIVERS\busenum.sys [2011-02-18 56160]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2011-12-06 331264]
S3 MEIx64;Intel(R) Management Engine Interface ;c:\windows\system32\DRIVERS\HECIx64.sys [2011-11-09 60184]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2012-05-10 97792]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2012-05-10 217600]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2000-01-01 685672]
S3 t_mouse.sys;iBall Advanced Mouse;c:\windows\system32\DRIVERS\t_mouse.sys [2009-04-16 25088]
S3 whfltr2k;WheelMouse USB Lower Filter Driver;c:\windows\system32\DRIVERS\whfltr2k.sys [2000-01-01 10368]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
XLServicePlatformREG_MULTI_SZ XLServicePlatform
.
‘計劃任務’ 文件夾 裡的內容
.
2012-07-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 08:15]
.
2012-07-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3892454325-3400438884-1050192996-1000Core.job
- c:\users\user\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-30 13:07]
.
2012-07-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3892454325-3400438884-1050192996-1000UA.job
- c:\users\user\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-30 13:07]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{004B0726-A010-4ABF-8556-FCDB7F1FCA1E}]
2011-11-25 06:27627888----a-w-c:\program files (x86)\Thunder Network\Thunder\BHO\XunleiBHO647.2.4.3312.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MouseDriver"="TiltWheelMouse.exe" [2010-10-31 241152]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-09-22 4035152]
"Acronis Scheduler2 Service"="c:\program files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [2010-08-21 390712]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-03-27 12459112]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-05-11 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-05-11 398616]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-05-11 439064]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files (x86)\Stardock\Fences\FencesMenu64.dll" [2010-06-22 253288]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- 而外的掃描 -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com.sg/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: &E1OA&N﹐A×AeIsIAOO - c:\program files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm
IE: &E1OA&N﹐A×IAOO - c:\program files (x86)\Thunder Network\Thunder\BHO\geturl.htm
IE: &E1OA&N﹐A×IAOOE?2?A’?O - c:\program files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: SmarThru4 Capture Selection - c:\program files (x86)\SmarThru 4\WebCapture.dll2.htm
IE: SmarThru4 Save as HTML - c:\program files (x86)\SmarThru 4\WebCapture.dll1.htm
IE: SmarThru4 Save Selected Text - c:\program files (x86)\SmarThru 4\WebCapture.dll.htm
IE: SmarThru4 Web Capture - c:\program files (x86)\SmarThru 4\WebCapture.dll
IE: 使用迅雷看看播放器播放 - c:\users\Public\Thunder Network\XMP4\core\program\XmpIEMenu.htm
LSP: c:\program files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll
TCP: DhcpNameServer = 192.168.0.1
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
URLSearchHooks-{687578b9-7132-4a7a-80e4-30ee31099e03} - (no file)
Wow6432Node-HKLM-Run-WheelMouse - c:\advanc~1\wh_exec.exe
Wow6432Node-HKLM-Run-TaskTray - (no file)
Wow6432Node-HKLM-Run-Driver Genius - (no file)
WebBrowser-{687578B9-7132-4A7A-80E4-30EE31099E03} - (no file)
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-Browser Defender_is1 - c:\program files (x86)\PC Tools\PC Tools Security\BDT\unins000.exe
AddRemove-dBpoweramp DSP Effects - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Music Converter - c:\windows\system32\SpoonUninstall.exe
AddRemove-HaaliMkx - c:\program files (x86)\Matroska Pack\haali\uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ 其他運行進程 ------------------------
.
c:\program files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\IObit\Smart Defrag 2\SmartDefrag.exe
c:\windows\System32\TiltWheelMouse.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
完成時間: 2012-07-09 22:36:21 - 電腦已重新啟動
ComboFix-quarantined-files.txt 2012-07-09 14:36
.
Pre-Run: 148,767,555,584 bytes free
Post-Run: 154,622,128,128 bytes free
.
- - End Of File - - 36727F1636F2F533769543818E9C3928

 

[hokokhua]

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 07-07-2012 04
Ran by SYSTEM at 2012-07-09 22:06:13 Run:1
Running from G:\
==============================================
HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\SubSystems\\Windows No ZeroAccess entry found.
C:\Windows\System32\consrv.dll not found.
C:\Windows\Installer\{33bda3d4-bef4-a4a6-898b-619368dc1cd2} moved successfully.
C:\Windows\assembly\GAC_32\Desktop.ini moved successfully.
C:\Windows\assembly\GAC_64\Desktop.ini moved successfully.
C:\Windows\System32\services.exe moved successfully.
C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe copied successfully to C:\Windows\System32\services.exe
==== End of Fixlog ====

 

[hokokhua]

sorry again for the late reply. I'm based in asia.

 

[Broni]

Looks good

Any current issues?

==================================

Download Malwarebytes' Anti-Malware (MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.
NOTE. If you already have MBAM installed, update it before running the scan.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

==========================================

Download OTL to your Desktop.
Alternate download: http://www.smartestcomputing.us.com/files/file/5-otl/

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Click the Scan All Users checkbox.
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
• When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

 

[hokokhua]

thanks broni ... my eset is still detecting a threat but this time it's from the files in c:\FRST\Quarantine. Can I delete those files?

 

[Broni]

You can remove a whole FRST folder if you wish.

 

[hokokhua]

having some problems removing the FRST folder. Need administrative rights? Let me try again ...

 

[Broni]

Leave it alone.
We'll take care of it with other tools.
Go ahead with other steps.

 

[hokokhua]

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.07.09.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
user :: USER-PC [administrator]

10/7/2012 12:00:30 PM
mbam-log-2012-07-10 (12-00-30).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 234003
Time elapsed: 2 minute(s), 9 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

 

[hokokhua]

OTL logfile created on: 10/7/2012 12:12:56 PM - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\user\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00004809 | Country: Singapore | Language: ENE | Date Format: d/M/yyyy

7.92 Gb Total Physical Memory | 6.11 Gb Available Physical Memory | 77.14% Memory free
15.84 Gb Paging File | 14.01 Gb Available in Paging File | 88.44% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 999.90 Gb Total Space | 143.50 Gb Free Space | 14.35% Space Free | Partition Type: NTFS
Drive D: | 863.02 Gb Total Space | 338.93 Gb Free Space | 39.27% Space Free | Partition Type: NTFS

Computer Name: USER-PC | User Name: user | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found --
PRC - [2012/07/10 12:11:25 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
PRC - [2012/06/26 15:26:48 | 000,382,464 | ---- | M] (Roozz) -- C:\Program Files (x86)\Roozz\RoozzUpdater.exe
PRC - [2012/06/10 20:24:33 | 003,975,088 | ---- | M] (Acronis) -- C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
PRC - [2012/06/04 19:31:51 | 000,296,056 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
PRC - [2012/01/04 14:26:46 | 001,606,488 | ---- | M] (IObit) -- C:\Program Files (x86)\IObit\Smart Defrag 2\SmartDefrag.exe
PRC - [2012/01/03 21:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/12/22 19:11:20 | 000,818,952 | ---- | M] (ABBYY) -- C:\Program Files (x86)\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe
PRC - [2011/12/16 11:37:26 | 000,277,784 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2011/12/15 15:55:50 | 000,436,088 | ---- | M] (PPLive Corporation) -- C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe
PRC - [2011/11/29 20:58:56 | 000,021,392 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
PRC - [2011/11/29 20:58:46 | 003,508,624 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
PRC - [2011/09/22 12:03:30 | 000,974,944 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
PRC - [2011/09/16 14:39:24 | 000,115,048 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
PRC - [2011/03/09 11:41:08 | 001,066,896 | ---- | M] () -- C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe
PRC - [2010/08/21 18:16:16 | 000,390,712 | ---- | M] (Acronis) -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
PRC - [2010/08/21 18:16:12 | 000,779,944 | ---- | M] (Acronis) -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
PRC - [2010/08/21 18:15:32 | 005,459,136 | ---- | M] (Acronis) -- C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
PRC - [2010/08/20 21:18:30 | 002,536,752 | ---- | M] (Acronis) -- C:\Program Files (x86)\Acronis\OnlineBackupStandalone\TrueImageMonitor.exe


========== Modules (No Company Name) ==========

MOD - [2012/07/09 22:31:02 | 000,115,137 | ---- | M] () -- C:\Users\user\AppData\Local\Temp\8aefdf3f-82dc-462e-be91-2ca1c43911cf\CliSecureRT.dll
MOD - [2012/07/03 20:45:02 | 000,398,792 | ---- | M] () -- C:\Program Files (x86)\Common Files\PPLiveNetwork\tipsclient.dll
MOD - [2012/06/14 14:20:05 | 018,019,840 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\e3e0f9d002a4bca6be00c0c8fb512a0d\PresentationFramework.ni.dll
MOD - [2012/06/14 14:19:57 | 011,522,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\1a1a2743caf019ebbda385820b47bd17\PresentationCore.ni.dll
MOD - [2012/06/14 14:19:55 | 013,198,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\655a34519a581ee2e53804ed8f1fb178\System.Windows.Forms.ni.dll
MOD - [2012/06/14 14:19:50 | 003,881,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\506205184c1d721fc14eee0a1fdc4f9f\WindowsBase.ni.dll
MOD - [2012/06/14 14:19:50 | 001,666,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\d11f1e17d9563f435c404b95f9c7c195\System.Drawing.ni.dll
MOD - [2012/05/23 09:30:36 | 000,083,416 | ---- | M] () -- C:\Program Files (x86)\Common Files\PPLiveNetwork\tipsdone.dll
MOD - [2012/05/09 10:15:57 | 001,218,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\cb1dd51684db6b1d2f1965b6034a163f\System.Management.ni.dll
MOD - [2012/05/09 10:15:06 | 000,762,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\c405b8f8c5849d56c664491de2ce8a54\System.Runtime.Remoting.ni.dll
MOD - [2012/05/09 10:15:02 | 001,782,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\2c93e8f49eb8cce1ff2a14db155cfd6e\System.Xaml.ni.dll
MOD - [2012/05/09 09:46:50 | 000,595,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\b40522a7c8ba9adbbee614723396ba24\PresentationFramework.Aero.ni.dll
MOD - [2012/05/09 09:44:34 | 007,069,184 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\63f45de6449058b4cbe4d11f8992d097\System.Core.ni.dll
MOD - [2012/05/09 09:44:32 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b46ba0f6a2ac19fabf9fb9ad8ad3aef5\System.Xml.ni.dll
MOD - [2012/05/09 09:44:29 | 009,092,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ecc103accf59cb5a9ddef725b4054433\System.ni.dll
MOD - [2012/05/09 09:44:26 | 014,415,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\792ddf0e6f1b8139aabe2dc19874fe54\mscorlib.ni.dll
MOD - [2012/01/01 16:55:29 | 000,034,152 | ---- | M] () -- C:\Program Files (x86)\Common Files\PPLiveNetwork\tipsstatistic.dll
MOD - [2011/12/15 15:55:46 | 000,426,344 | ---- | M] () -- C:\Program Files (x86)\Common Files\PPLiveNetwork\MngModule.dll
MOD - [2011/12/15 15:55:38 | 000,116,584 | ---- | M] () -- C:\Program Files (x86)\Common Files\PPLiveNetwork\kernel\FWUpnp.dll
MOD - [2011/11/29 20:58:56 | 000,021,392 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MOD - [2011/11/01 23:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/11/01 23:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/08/19 16:33:28 | 000,047,960 | ---- | M] () -- C:\Program Files (x86)\IObit\Smart Defrag 2\NtfsData.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2012/05/25 01:07:32 | 000,236,544 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2012/02/02 22:29:52 | 000,628,448 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\iCLS Client\HeciServer.exe -- (Intel(R) Capability Licensing Service Interface) Intel(R)
SRV:64bit: - [2011/12/20 10:11:48 | 000,341,800 | ---- | M] (Nitro PDF Software) [Auto | Running] -- C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe -- (NitroReaderDriverReadSpool2)
SRV:64bit: - [2011/09/22 12:03:30 | 000,974,944 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe -- (ekrn)
SRV:64bit: - [2011/03/09 11:10:40 | 000,288,768 | ---- | M] (WDC) [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe -- (WDDMService)
SRV:64bit: - [2009/07/14 09:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2012/07/06 16:15:34 | 000,257,224 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/06/26 15:26:48 | 000,382,464 | ---- | M] (Roozz) [Auto | Running] -- C:\Program Files (x86)\Roozz\RoozzUpdater.exe -- (Roozz Updater)
SRV - [2012/06/10 20:24:33 | 003,975,088 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe -- (afcdpsrv)
SRV - [2012/05/12 05:28:04 | 000,274,712 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs) Intel(R)
SRV - [2012/05/11 11:13:36 | 000,089,016 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Tools\DMScanning\PCTSFiles.exe -- (PCTSFileEnum)
SRV - [2012/05/08 05:45:13 | 000,392,320 | ---- | M] (JRiver, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\J River\Media Center 17\JRService.exe -- (Media Center 17 Service)
SRV - [2012/01/03 21:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/12/22 19:11:20 | 000,818,952 | ---- | M] (ABBYY) [Auto | Running] -- C:\Program Files (x86)\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe -- (ABBYY.Licensing.FineReader.Corporate.11.0)
SRV - [2011/12/16 11:37:26 | 000,277,784 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2011/11/25 14:25:46 | 000,087,728 | ---- | M] (ShenZhen Xunlei Networking Technologies,LTD) [Auto | Running] -- C:\Program Files (x86)\Common Files\Thunder Network\ServicePlatform\XLSP.dll -- (XLServicePlatform)
SRV - [2011/03/09 11:41:10 | 000,491,920 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSC.exe -- (WDSC)
SRV - [2011/03/09 11:41:08 | 001,066,896 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe -- (WDFME)
SRV - [2010/08/21 18:16:12 | 000,779,944 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/11 05:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/06/14 12:31:44 | 000,085,224 | ---- | M] (PC Tools) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PCTBD64.sys -- (PCTBD)
DRV:64bit: - [2012/06/10 20:24:35 | 000,279,136 | ---- | M] (Acronis) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\afcdp.sys -- (afcdp)
DRV:64bit: - [2012/06/10 20:24:29 | 001,263,200 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\tdrpm273.sys -- (tdrpman273) Acronis Try&Decide and Restore Points filter (build 273)
DRV:64bit: - [2012/06/10 20:24:27 | 000,970,336 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\timntr.sys -- (timounter)
DRV:64bit: - [2012/06/10 20:24:22 | 000,277,088 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\snapman.sys -- (snapman)
DRV:64bit: - [2012/05/25 01:27:42 | 011,175,424 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2012/05/24 23:54:34 | 000,343,040 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2012/05/11 11:14:26 | 000,251,528 | ---- | M] (PC Tools) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\PCTSD64.sys -- (PCTSD)
DRV:64bit: - [2012/05/10 16:33:56 | 000,217,600 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2012/05/10 16:33:54 | 000,097,792 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2012/04/30 10:08:34 | 008,913,440 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2012/04/23 12:36:50 | 000,426,616 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PCTCore64.sys -- (PCTCore)
DRV:64bit: - [2012/04/18 09:16:50 | 000,090,624 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtihdW86.sys -- (AtiHDAudioService)
DRV:64bit: - [2012/03/31 18:47:18 | 000,141,920 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vsflt53.sys -- (vidsflt53) Acronis Disk Storage Filter (53)
DRV:64bit: - [2012/03/01 14:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012/02/28 11:43:18 | 001,096,176 | ---- | M] (PC Tools) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\pctEFA64.sys -- (pctEFA)
DRV:64bit: - [2012/02/28 11:43:12 | 000,453,896 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\pctDS64.sys -- (pctDS)
DRV:64bit: - [2012/02/16 00:24:40 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.)
DRV:64bit: - [2012/02/16 00:24:38 | 000,099,384 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)
DRV:64bit: - [2011/12/29 13:37:44 | 000,035,120 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LPCFilter.sys -- (LPCFilter)
DRV:64bit: - [2011/12/06 19:23:08 | 000,331,264 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2011/11/10 02:04:14 | 000,060,184 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)
DRV:64bit: - [2011/10/20 11:24:06 | 000,157,696 | ---- | M] (Matrox Graphics Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\MxEFUF64.sys -- (MxEFUF)
DRV:64bit: - [2011/08/09 14:24:52 | 000,202,576 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\eamonm.sys -- (eamonm)
DRV:64bit: - [2011/08/04 09:20:38 | 000,187,632 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\epfw.sys -- (epfw)
DRV:64bit: - [2011/08/04 09:20:38 | 000,146,432 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ehdrv.sys -- (ehdrv)
DRV:64bit: - [2011/08/04 09:20:38 | 000,062,496 | ---- | M] (ESET) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\epfwwfp.sys -- (epfwwfp)
DRV:64bit: - [2011/08/04 09:20:38 | 000,038,288 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\EpfwLWF.sys -- (EpfwLWF)
DRV:64bit: - [2011/08/02 17:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/03/11 14:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 14:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/02/18 14:20:34 | 000,056,160 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\busenum.sys -- (busenum)
DRV:64bit: - [2011/01/16 00:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010/12/17 06:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2010/11/26 18:02:18 | 000,017,720 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\SmartDefragDriver.sys -- (SmartDefragDriver)
DRV:64bit: - [2010/11/21 11:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/21 11:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/21 11:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2009/07/14 09:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/14 09:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/14 09:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/14 08:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009/06/11 04:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/11 04:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/11 04:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/11 04:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009/04/16 13:45:38 | 000,025,088 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\t_mouse.sys -- (t_mouse.sys)
DRV:64bit: - [2009/03/25 19:44:39 | 000,053,816 | R--- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\DgivEcp.sys -- (DgiVecp)
DRV:64bit: - [2009/02/24 18:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mcdbus.sys -- (mcdbus)
DRV:64bit: - [2008/05/06 16:06:00 | 000,014,464 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wdcsam64.sys -- (WDC_SAM)
DRV:64bit: - [2007/08/13 20:51:18 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\SSPORT.SYS -- (SSPORT)
DRV:64bit: - [2000/01/01 08:00:00 | 000,685,672 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2000/01/01 08:00:00 | 000,010,368 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\whfltr2k.sys -- (whfltr2k)
DRV - [2009/07/14 09:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009/02/24 18:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\mcdbus.sys -- (mcdbus)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-3892454325-3400438884-1050192996-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.sg/
IE - HKU\S-1-5-21-3892454325-3400438884-1050192996-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-SG
IE - HKU\S-1-5-21-3892454325-3400438884-1050192996-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 18 FF C9 66 CA FA CC 01 [binary data]
IE - HKU\S-1-5-21-3892454325-3400438884-1050192996-1000\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - No CLSID value found
IE - HKU\S-1-5-21-3892454325-3400438884-1050192996-1000\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-3892454325-3400438884-1050192996-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3892454325-3400438884-1050192996-1000\..\SearchScopes\{254A1BBD-7B84-422A-A2D4-A31AADC7AA06}: "URL" = http://websearch.ask.com/redirect?c...pn_sauid=28E5B3B6-29BC-41A0-99A6-550AD5C8CB0E
IE - HKU\S-1-5-21-3892454325-3400438884-1050192996-1000\..\SearchScopes\{83439A09-DFC0-4CDC-B834-C0D6CCB638B0}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253
IE - HKU\S-1-5-21-3892454325-3400438884-1050192996-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={...1a66c90ef&lang=en&ds=is015&pr=sa&d=2012-05-31 14:36:17&v=11.1.0.7&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-3892454325-3400438884-1050192996-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro PDF\Reader 2\npnitromozilla.dll ( )
FF - HKLM\Software\MozillaPlugins\@pptv.com/plugin: C:\Program Files (x86)\Internet Explorer\PPLite\plugin\npplugin2.dll (PPLive Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@Roozz.com/RoozzPlugin: C:\Program Files (x86)\Roozz\nproozz.dll (Roozz.com)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@xunlei.com/DapCtrl: C:\Program Files (x86)\Common Files\Thunder Network\KanKan\npDapCtrl.3.1.0.1.(630).dll (ShenZhen Thunder Networking Technologies Ltd.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\user\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\user\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/06/04 19:32:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\Firefox\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2012/01/06 21:34:41 | 000,000,000 | ---D | M]

[2012/05/21 10:01:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\Mozilla\Firefox\extensions
[2012/05/21 10:01:30 | 000,000,000 | ---D | M] (uTorrentControl2 Community Toolbar) -- C:\Users\user\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}

 

[hokokhua]

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms},
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\Application\20.0.1132.47\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Thunder DapCtrl NPAPI Plugin (Enabled) = C:\Program Files (x86)\Common Files\Thunder Network\KanKan\npDapCtrl.3.1.0.1.(630).dll
CHR - plugin: PPLive PPTV Plugin (Enabled) = C:\Program Files (x86)\Internet Explorer\PPLite\plugin\npplugin2.dll
CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Nitro PDF Plug-In (Enabled) = C:\Program Files (x86)\Nitro PDF\Reader 2\npnitromozilla.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: RealNetworks(tm) Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: Google Update (Enabled) = C:\Users\user\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - Extension: Entanglement = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd\2.7.9_0\
CHR - Extension: Flash render quality = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbkhhhlbomjpenealmjakmfmlgnbimep\0.10.1.10_1\
CHR - Extension: Plugins = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\chemohaemmfhjpmlgkmkanfpfbkaihop\0.7.0_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: MaximizeFlash = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\lljjmflmcnaigbhnheldbdbplkbhngnl\1.1_0\
CHR - Extension: Poppit = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi\2.2_0\
CHR - Extension: FlashControl = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfidmkgnfgnkihnjeklbekckimkipmoe\3.0.7_0\
CHR - Extension: FastestChrome - Browse Faster = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmffncokckfccddfenhkhnllmlobdahm\6.2.6_0\
CHR - Extension: Docs PDF/PowerPoint Viewer (by Google) = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnbmlagghjjcbdhgmkedmbmedengocbn\3.9_0\
CHR - Extension: Fast save = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\olallcgfigihdnkbnklebmdpckbfnjfc\1.1_0\
CHR - Extension: Evernote Web Clipper = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc\5.5.1_0\

O1 HOSTS File: ([2012/07/09 22:29:46 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (ѸÀ×ÏÂÔØÖ§³Ö) - {004B0726-A010-4ABF-8556-FCDB7F1FCA1E} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO647.2.4.3312.dll (深圳市迅雷网络技术有限公司)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (ѸÀ×ÏÂÔØÖ§³Ö) - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO7.2.4.3312.dll (深圳市迅雷网络技术有限公司)
O3 - HKLM\..\Toolbar: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKU\S-1-5-21-3892454325-3400438884-1050192996-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
O4:64bit: - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [MouseDriver] C:\Windows\SysNative\TiltWheelMouse.exe (Pixart Imaging Inc)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [Bonus.SSR.FR11] C:\Program Files (x86)\ABBYY FineReader 11\Bonus.ScreenshotReader.exe (ABBYY.)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\ssmmgr.exe ()
O4 - HKLM..\Run: [SAOB Monitor] C:\Program Files (x86)\Acronis\OnlineBackupStandalone\TrueImageMonitor.exe (Acronis)
O4 - HKLM..\Run: [TkBellExe] c:\program files (x86)\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - HKU\S-1-5-21-3892454325-3400438884-1050192996-1000..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKU\S-1-5-21-3892454325-3400438884-1050192996-1000..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKU\S-1-5-21-3892454325-3400438884-1050192996-1000..\Run: [PPAP] C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe (PPLive Corporation)
O4 - Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: OldEnableShellExecuteHooks = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3892454325-3400438884-1050192996-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3892454325-3400438884-1050192996-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: &ʹÓÃ&ѸÀ×ÀëÏßÏÂÔØ - C:\Program Files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm ()
O8:64bit: - Extra context menu item: &ʹÓÃ&ѸÀ×ÏÂÔØ - C:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm ()
O8:64bit: - Extra context menu item: &ʹÓÃ&ѸÀ×ÏÂÔØÈ«²¿Á´½Ó - C:\Program Files (x86)\Thunder Network\Thunder\BHO\getAllurl.htm ()
O8:64bit: - Extra context menu item: SmarThru4 Capture Selection - C:\Program Files (x86)\SmarThru 4\WebCapture.dll2.htm File not found
O8:64bit: - Extra context menu item: SmarThru4 Save as HTML - C:\Program Files (x86)\SmarThru 4\WebCapture.dll1.htm File not found
O8:64bit: - Extra context menu item: SmarThru4 Save Selected Text - C:\Program Files (x86)\SmarThru 4\WebCapture.dll.htm File not found
O8:64bit: - Extra context menu item: SmarThru4 Web Capture - C:\Program Files (x86)\SmarThru 4\WebCapture.dll File not found
O8:64bit: - Extra context menu item: 使用迅雷看看播放器播放 - C:\Users\Public\Thunder Network\XMP4\core\program\XmpIEMenu.htm ()
O8 - Extra context menu item: &ʹÓÃ&ѸÀ×ÀëÏßÏÂÔØ - C:\Program Files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm ()
O8 - Extra context menu item: &ʹÓÃ&ѸÀ×ÏÂÔØ - C:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm ()
O8 - Extra context menu item: &ʹÓÃ&ѸÀ×ÏÂÔØÈ«²¿Á´½Ó - C:\Program Files (x86)\Thunder Network\Thunder\BHO\getAllurl.htm ()
O8 - Extra context menu item: SmarThru4 Capture Selection - C:\Program Files (x86)\SmarThru 4\WebCapture.dll2.htm File not found
O8 - Extra context menu item: SmarThru4 Save as HTML - C:\Program Files (x86)\SmarThru 4\WebCapture.dll1.htm File not found
O8 - Extra context menu item: SmarThru4 Save Selected Text - C:\Program Files (x86)\SmarThru 4\WebCapture.dll.htm File not found
O8 - Extra context menu item: SmarThru4 Web Capture - C:\Program Files (x86)\SmarThru 4\WebCapture.dll File not found
O8 - Extra context menu item: 使用迅雷看看播放器播放 - C:\Users\Public\Thunder Network\XMP4\core\program\XmpIEMenu.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll (PC Tools Research Pty Ltd.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll (PC Tools Research Pty Ltd.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll (PC Tools Research Pty Ltd.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll (PC Tools Research Pty Ltd.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll (PC Tools Research Pty Ltd.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll (PC Tools Research Pty Ltd.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000017 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll (PC Tools Research Pty Ltd.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{53F2BC1E-01F1-4806-B216-8F6AAF184D2D}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{574A8165-F901-4AC7-AD08-ECD917D8F33D}: NameServer = 98.158.112.60 199.127.248.22
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O22:64bit: - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - C:\Program Files (x86)\Stardock\Fences\FencesMenu64.dll (Stardock)
O28 - HKLM ShellExecuteHooks: {4562B511-62E9-4533-B7B2-56A8BB10B482} - C:\Program Files (x86)\Common Files\Thunder Network\Kankan\xappex.1.1.1.29.(630).dll (深圳市迅雷网络技术有限公司)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/07/10 12:11:13 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
[2012/07/09 22:54:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/07/09 22:54:45 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/07/09 22:54:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/07/09 22:52:04 | 010,063,000 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\user\Desktop\mbam-setup-1.61.0.1400.exe
[2012/07/09 22:36:24 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/07/09 22:29:54 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/07/09 22:19:32 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/07/09 22:19:32 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/07/09 22:19:32 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/07/09 22:18:55 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/07/09 22:18:18 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012/07/09 22:10:17 | 004,574,937 | R--- | C] (Swearware) -- C:\Users\user\Desktop\ComboFix.exe
[2012/07/08 20:26:15 | 002,267,096 | ---- | C] (Threat Expert Ltd.) -- C:\Windows\PCTBDCore.dll
[2012/07/08 20:26:15 | 001,681,368 | ---- | C] (Threat Expert Ltd.) -- C:\Windows\PCTBDRes.dll
[2012/07/08 20:26:15 | 000,149,464 | ---- | C] (PC Tools) -- C:\Windows\SGDetectionTool.dll
[2012/07/08 20:26:15 | 000,085,224 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\PCTBD64.sys
[2012/07/08 20:25:46 | 000,341,168 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\pctgntdi64.sys
[2012/07/08 20:25:46 | 000,145,432 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\pctwfpfilter64.sys
[2012/07/08 20:25:38 | 000,014,776 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\pctBTFix64.sys
[2012/07/08 20:25:31 | 000,092,896 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\pctplsg64.sys
[2012/07/08 20:23:18 | 001,096,176 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\pctEFA64.sys
[2012/07/08 20:23:18 | 000,453,896 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\pctDS64.sys
[2012/07/08 20:23:16 | 000,426,616 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\PCTCore64.sys
[2012/07/08 20:23:15 | 000,251,528 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\PCTSD64.sys
[2012/07/08 20:23:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PC Tools
[2012/07/08 20:23:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PC Tools
[2012/07/08 20:23:02 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2012/07/08 20:23:01 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\TestApp
[2012/07/08 18:48:31 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\Simply Super Software
[2012/07/08 18:48:31 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Simply Super Software
[2012/07/08 18:48:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software
[2012/07/08 18:37:03 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Malwarebytes
[2012/07/08 18:36:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/07/08 17:59:14 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA%
[2012/06/23 14:07:41 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MagicDisc
[2012/06/23 14:07:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MagicDisc
[2012/06/23 14:07:11 | 000,255,552 | ---- | C] (MagicISO, Inc.) -- C:\Windows\SysWow64\drivers\mcdbus.sys
[2012/06/23 14:07:10 | 000,255,552 | ---- | C] (MagicISO, Inc.) -- C:\Windows\SysNative\drivers\mcdbus.sys
[2012/06/23 14:07:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MagicDisc
[2012/06/22 18:01:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roozz
[2012/06/22 18:01:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Roozz
[2012/06/22 09:30:57 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Ebook DRM Removal
[2012/06/18 13:36:42 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\sigil-ebook
[2012/06/18 13:36:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sigil
[2012/06/18 13:36:24 | 000,000,000 | ---D | C] -- C:\Program Files\Sigil
[2012/06/16 17:15:39 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Wrath of the Titans (2012) [1080p]
[2012/06/16 16:50:59 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\My Digital Editions
[2012/06/16 16:45:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
[2012/06/11 21:10:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinSCP
[2012/06/11 21:10:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinSCP
[2012/06/10 23:28:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ABBYY FineReader 11
[2012/06/10 23:25:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ABBYY
[2012/06/10 23:22:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ABBYY FineReader 11
[2012/06/10 23:01:02 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\ABBYY
[2012/06/10 22:51:39 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\ABBYY
[2012/06/10 22:51:38 | 000,000,000 | ---D | C] -- C:\ProgramData\ABBYY
[2012/06/10 22:17:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel
[2012/06/10 22:17:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Intel
[2012/06/10 20:41:55 | 002,605,400 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\WavesGUILib.dll
[2012/06/10 20:41:54 | 000,518,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll
[2012/06/10 20:41:54 | 000,211,184 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll
[2012/06/10 20:41:54 | 000,198,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll
[2012/06/10 20:41:54 | 000,155,888 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll
[2012/06/10 20:41:53 | 000,221,024 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SFNHK64.dll
[2012/06/10 20:41:53 | 000,081,248 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SFCOM64.dll
[2012/06/10 20:41:53 | 000,078,688 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SFAPO64.dll
[2012/06/10 20:41:53 | 000,074,064 | ---- | C] (Virage Logic Corporation / Sonic Focus) -- C:\Windows\SysWow64\SFCOM.dll
[2012/06/10 20:41:48 | 000,375,128 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll
[2012/06/10 20:41:48 | 000,204,120 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll
[2012/06/10 20:41:48 | 000,101,208 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll
[2012/06/10 20:41:48 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll
[2012/06/10 20:41:47 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll
[2012/06/10 20:41:46 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll
[2012/06/10 20:41:40 | 007,163,744 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEP64A.dll
[2012/06/10 20:41:40 | 000,433,504 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EED64A.dll
[2012/06/10 20:41:40 | 000,137,056 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEL64A.dll
[2012/06/10 20:41:40 | 000,120,160 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEA64A.dll
[2012/06/10 20:41:40 | 000,075,104 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEG64A.dll
[2012/06/10 20:41:38 | 000,396,632 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxVolumeSDAPO.dll
[2012/06/10 20:41:37 | 001,247,576 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioRealtek264.dll
[2012/06/10 20:41:35 | 008,363,864 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioRealtek.dll
[2012/06/10 20:41:33 | 002,131,288 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioEQ.dll
[2012/06/10 20:41:32 | 000,978,776 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPOShell64.dll
[2012/06/10 20:41:32 | 000,341,336 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO30.dll
[2012/06/10 20:41:32 | 000,318,808 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll
[2012/06/10 20:41:31 | 000,603,984 | ---- | C] (Knowles Acoustics ) -- C:\Windows\SysNative\KAAPORT64.dll
[2012/06/10 20:40:53 | 002,528,832 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll
[2012/06/10 20:40:53 | 000,693,352 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSVoiceClarityDLL64.dll
[2012/06/10 20:40:52 | 000,537,456 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSU2PLFX64.dll
[2012/06/10 20:40:52 | 000,449,392 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSU2PREC64.dll
[2012/06/10 20:40:51 | 000,524,656 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSU2PGFX64.dll
[2012/06/10 20:40:50 | 001,756,264 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2SpeakerDLL64.dll
[2012/06/10 20:40:50 | 000,712,296 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSSymmetryDLL64.dll
[2012/06/10 20:40:49 | 001,568,360 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2HeadphoneDLL64.dll
[2012/06/10 20:40:48 | 000,491,112 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSNeoPCDLL64.dll
[2012/06/10 20:40:48 | 000,432,744 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLimiterDLL64.dll
[2012/06/10 20:40:48 | 000,242,792 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLFXAPO64.dll
[2012/06/10 20:40:48 | 000,242,792 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPO64.dll
[2012/06/10 20:40:48 | 000,241,768 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPONS64.dll
[2012/06/10 20:40:47 | 001,486,952 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBoostDLL64.dll
[2012/06/10 20:40:47 | 000,428,648 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGainCompensatorDLL64.dll
[2012/06/10 20:40:46 | 000,728,680 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBassEnhancementDLL64.dll
[2012/06/10 20:37:20 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp
[2012/06/10 20:31:49 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\AccurateRip
[2012/06/10 20:31:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\dBpoweramp Music Converter
[2012/06/10 20:31:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Illustrate
[2012/06/10 20:24:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Acronis
[2012/06/10 20:24:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Acronis
[2012/06/10 20:23:59 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2012/06/10 20:23:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF to Word
[2012/06/10 20:23:49 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\Quick-PDF PDF to Word
[2012/06/10 20:23:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDF to Word
[2012/06/10 20:22:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Acronis
[2012/06/10 20:16:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Intel
[2012/06/10 20:16:41 | 000,000,000 | ---D | C] -- C:\Program Files\Intel
[2012/06/10 20:16:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\postureAgent
[2012/06/10 20:15:06 | 000,000,000 | ---D | C] -- C:\DRIVERS
[2012/06/10 20:07:27 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\driveridentifier
[2012/06/10 20:02:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Downloaded Installations
[2012/06/10 19:47:19 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\DriverGenius
[2012/06/10 19:47:09 | 000,000,000 | ---D | C] -- C:\ProgramData\DriverGenius
[2012/06/10 19:40:52 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\DriverGenius
[2012/06/10 19:39:49 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\dMC-R14.2-Ref-Registered
[2012/06/10 19:39:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Genius Professional Edition
[2012/06/10 19:39:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Driver-Soft
[1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/10 12:15:01 | 000,022,080 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/10 12:15:01 | 000,022,080 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/10 12:11:25 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
[2012/07/10 12:06:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/07/10 12:06:32 | 2082,545,663 | -HS- | M] () -- C:\hiberfil.sys
[2012/07/10 11:46:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/07/10 11:31:00 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3892454325-3400438884-1050192996-1000UA.job
[2012/07/09 22:54:46 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/09 22:54:15 | 010,063,000 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\user\Desktop\mbam-setup-1.61.0.1400.exe
[2012/07/09 22:29:46 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012/07/09 22:10:30 | 004,574,937 | R--- | M] (Swearware) -- C:\Users\user\Desktop\ComboFix.exe
[2012/07/09 07:59:43 | 000,726,444 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/07/09 07:59:43 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/07/09 07:59:43 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/07/08 21:17:20 | 001,432,863 | ---- | M] () -- C:\Users\user\Desktop\FRST64.exe
[2012/07/08 20:24:01 | 001,631,086 | ---- | M] () -- C:\Windows\SysNative\drivers\Cat.DB
[2012/07/08 19:39:26 | 000,051,000 | ---- | M] () -- C:\Users\user\Desktop\Sirefef AgentBA PatchedBGen Trojan.xml
[2012/07/08 19:31:24 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3892454325-3400438884-1050192996-1000Core.job
[2012/07/08 17:43:05 | 055,000,004 | ---- | M] () -- C:\Users\user\Desktop\New Scientist.pdf
[2012/07/06 19:47:06 | 000,012,170 | ---- | M] () -- C:\Users\user\AppData\Roaming\SmarThruOptions.xml
[2012/06/23 14:16:50 | 000,821,248 | ---- | M] () -- C:\Users\user\Desktop\FreeISOBurner.exe
[2012/06/23 14:07:42 | 000,000,993 | ---- | M] () -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk
[2012/06/20 12:44:34 | 002,214,564 | ---- | M] () -- C:\Users\user\Desktop\subaru.wma
[2012/06/18 13:36:30 | 000,000,768 | ---- | M] () -- C:\Users\Public\Desktop\Sigil.lnk
[2012/06/16 18:46:29 | 000,002,251 | ---- | M] () -- C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\ѸÀ×7.lnk
[2012/06/16 16:45:26 | 000,002,206 | ---- | M] () -- C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Adobe Digital Editions.lnk
[2012/06/14 19:59:55 | 000,310,648 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/06/14 12:31:44 | 000,085,224 | ---- | M] (PC Tools) -- C:\Windows\SysNative\drivers\PCTBD64.sys
[2012/06/14 12:31:22 | 002,267,096 | ---- | M] (Threat Expert Ltd.) -- C:\Windows\PCTBDCore.dll
[2012/06/14 12:31:22 | 001,681,368 | ---- | M] (Threat Expert Ltd.) -- C:\Windows\PCTBDRes.dll
[2012/06/14 12:31:22 | 000,149,464 | ---- | M] (PC Tools) -- C:\Windows\SGDetectionTool.dll
[2012/06/14 12:31:00 | 000,767,960 | ---- | M] () -- C:\Windows\BDTSupport.dll
[2012/06/14 11:03:42 | 000,003,488 | ---- | M] () -- C:\Windows\UDB.zip
[2012/06/14 11:03:42 | 000,000,882 | ---- | M] () -- C:\Windows\RegSDImport.xml
[2012/06/14 11:03:42 | 000,000,879 | ---- | M] () -- C:\Windows\RegISSImport.xml
[2012/06/14 11:03:42 | 000,000,131 | ---- | M] () -- C:\Windows\IDB.zip
[2012/06/11 21:31:57 | 000,000,600 | ---- | M] () -- C:\Users\user\AppData\Roaming\winscp.rnd
[2012/06/10 23:28:23 | 000,002,845 | ---- | M] () -- C:\Users\Public\Desktop\ABBYY FineReader 11.lnk
[2012/06/10 22:22:16 | 000,018,224 | ---- | M] () -- C:\Windows\SysNative\results.xml
[2012/06/10 20:31:45 | 000,013,082 | ---- | M] () -- C:\Windows\SysWow64\SpoonUninstall-dBpoweramp DSP Effects.dat
[2012/06/10 20:31:43 | 000,033,846 | ---- | M] () -- C:\Windows\SysWow64\SpoonUninstall-dBpoweramp DSP Effects.bmp
[2012/06/10 20:31:42 | 004,022,504 | ---- | M] () -- C:\Windows\SysWow64\SpoonUninstall.exe
[2012/06/10 20:31:42 | 000,017,950 | ---- | M] () -- C:\Windows\SysWow64\SpoonUninstall-dBpoweramp Music Converter.dat
[2012/06/10 20:31:27 | 000,033,846 | ---- | M] () -- C:\Windows\SysWow64\SpoonUninstall-dBpoweramp Music Converter.bmp
[2012/06/10 20:24:17 | 000,001,139 | ---- | M] () -- C:\Users\Public\Desktop\Acronis True Image Home 2011.lnk
[2012/06/10 19:47:06 | 000,001,211 | ---- | M] () -- C:\Users\user\Desktop\Driver Genius Professional Edition.lnk
[2012/06/10 19:46:08 | 013,834,726 | ---- | M] () -- C:\Users\user\Desktop\Driver.Genius.Pro.v11.0.0.1128[A4].rar
[1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/09 22:54:46 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/09 22:19:32 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/07/09 22:19:32 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/07/09 22:19:32 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/07/09 22:19:32 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/07/09 22:19:32 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/07/08 21:17:15 | 001,432,863 | ---- | C] () -- C:\Users\user\Desktop\FRST64.exe
[2012/07/08 20:26:15 | 000,767,960 | ---- | C] () -- C:\Windows\BDTSupport.dll
[2012/07/08 20:26:15 | 000,003,488 | ---- | C] () -- C:\Windows\UDB.zip
[2012/07/08 20:26:15 | 000,000,882 | ---- | C] () -- C:\Windows\RegSDImport.xml
[2012/07/08 20:26:15 | 000,000,879 | ---- | C] () -- C:\Windows\RegISSImport.xml
[2012/07/08 20:26:15 | 000,000,131 | ---- | C] () -- C:\Windows\IDB.zip
[2012/07/08 20:23:21 | 001,631,086 | ---- | C] () -- C:\Windows\SysNative\drivers\Cat.DB
[2012/07/08 19:39:25 | 000,051,000 | ---- | C] () -- C:\Users\user\Desktop\Sirefef AgentBA PatchedBGen Trojan.xml
[2012/06/23 14:16:42 | 000,821,248 | ---- | C] () -- C:\Users\user\Desktop\FreeISOBurner.exe
[2012/06/23 14:07:42 | 000,000,993 | ---- | C] () -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk
[2012/06/20 12:44:00 | 002,214,564 | ---- | C] () -- C:\Users\user\Desktop\subaru.wma
[2012/06/18 13:36:30 | 000,000,768 | ---- | C] () -- C:\Users\Public\Desktop\Sigil.lnk
[2012/06/16 16:45:26 | 000,002,206 | ---- | C] () -- C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Adobe Digital Editions.lnk
[2012/06/16 16:45:26 | 000,002,194 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions.lnk
[2012/06/11 21:10:49 | 000,000,600 | ---- | C] () -- C:\Users\user\AppData\Roaming\winscp.rnd
[2012/06/10 23:28:23 | 000,002,845 | ---- | C] () -- C:\Users\Public\Desktop\ABBYY FineReader 11.lnk
[2012/06/10 22:22:16 | 000,018,224 | ---- | C] () -- C:\Windows\SysNative\results.xml
[2012/06/10 20:41:47 | 000,272,629 | ---- | C] () -- C:\Windows\SysNative\drivers\RTAIODAT.DAT
[2012/06/10 20:31:45 | 000,033,846 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall-dBpoweramp DSP Effects.bmp
[2012/06/10 20:31:45 | 000,013,082 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall-dBpoweramp DSP Effects.dat
[2012/06/10 20:31:42 | 004,022,504 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall.exe
[2012/06/10 20:31:42 | 000,033,846 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall-dBpoweramp Music Converter.bmp
[2012/06/10 20:31:42 | 000,017,950 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall-dBpoweramp Music Converter.dat
[2012/06/10 20:24:17 | 000,001,139 | ---- | C] () -- C:\Users\Public\Desktop\Acronis True Image Home 2011.lnk
[2012/06/10 19:39:40 | 000,001,211 | ---- | C] () -- C:\Users\user\Desktop\Driver Genius Professional Edition.lnk
[2012/05/31 14:48:51 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012/05/31 14:48:51 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012/05/31 14:48:45 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2012/04/30 10:04:44 | 000,064,512 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2012/04/30 08:54:18 | 000,272,888 | ---- | C] () -- C:\Windows\SysWow64\igvpkrng600.bin
[2012/04/30 08:54:16 | 000,963,388 | ---- | C] () -- C:\Windows\SysWow64\igcodeckrng600.bin
[2012/03/19 23:31:16 | 000,963,912 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2012/03/19 23:31:16 | 000,261,208 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2012/03/19 23:31:16 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2012/02/02 22:08:26 | 000,001,536 | ---- | C] () -- C:\Windows\SysWow64\IusEventLog.dll
[2012/01/23 20:57:20 | 000,000,025 | ---- | C] () -- C:\Users\user\AppData\Roaming\CoreAVC.ini
[2012/01/06 20:54:10 | 000,012,170 | ---- | C] () -- C:\Users\user\AppData\Roaming\SmarThruOptions.xml
[2011/12/04 09:43:55 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2011/12/04 09:43:51 | 000,243,200 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2011/12/04 09:43:51 | 000,074,752 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2011/12/01 21:25:13 | 000,000,020 | ---- | C] () -- C:\Windows\SysWow64\pub_store.dat
[2011/12/01 07:23:33 | 000,019,968 | ---- | C] () -- C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/11/30 21:53:34 | 000,142,128 | ---- | C] () -- C:\Windows\wiainst64.exe
[2011/11/30 21:04:32 | 000,021,005 | ---- | C] () -- C:\Windows\SysWow64\w3qmh.dll
[2011/11/30 20:58:12 | 000,482,408 | ---- | C] () -- C:\Windows\ssndii.exe
[2011/11/30 20:57:54 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\SvcMan.exe
[2011/11/30 20:57:46 | 000,000,136 | ---- | C] () -- C:\Windows\Readiris.ini
[2011/11/30 20:57:44 | 000,023,040 | ---- | C] () -- C:\Windows\SysWow64\irisco32.dll
[2011/11/30 20:56:20 | 000,113,768 | R--- | C] () -- C:\Windows\Wiainst.exe
[2011/11/30 20:51:43 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011/11/29 16:38:18 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011/11/09 22:39:44 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011/11/09 22:39:32 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011/10/31 11:22:40 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011/10/31 11:22:40 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011/10/31 11:22:40 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011/10/31 11:22:38 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll

========== LOP Check ==========

[2012/03/31 18:50:13 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Acronis
[2012/05/12 15:23:15 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Audacity
[2012/06/11 22:01:06 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\calibre
[2011/12/25 00:04:48 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Downloaded Installations
[2012/06/10 20:10:23 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\driveridentifier
[2012/01/06 21:36:37 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\ESET
[2012/07/01 21:04:57 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\foobar2000
[2012/04/06 18:02:05 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\HandBrake
[2012/01/01 20:40:59 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\IObit
[2012/05/09 20:00:21 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\J River
[2012/03/24 13:58:47 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Leawo
[2012/02/05 11:54:47 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mkvtoolnix
[2012/05/26 10:35:43 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Mp3tag
[2012/05/11 19:40:53 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Nitro PDF
[2011/12/01 20:55:53 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Philipp Winterberg
[2012/01/01 16:50:02 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\PPLive
[2011/12/31 19:44:45 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\PPStream
[2012/03/24 15:03:42 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Samsung
[2012/07/08 18:48:31 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Simply Super Software
[2011/11/30 22:43:32 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Stardock
[2012/05/31 18:59:10 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\SystemRequirementsLab
[2011/11/30 22:51:46 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\TeraCopy
[2012/07/08 20:23:01 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\TestApp
[2012/03/24 13:59:15 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\tiger-k
[2012/06/06 19:52:46 | 000,032,600 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Files - Unicode (All) ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 157 bytes -> C:\ProgramData\TEMPFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84

< End of report >

 

[hokokhua]

OTL Extras logfile created on: 10/7/2012 12:12:56 PM - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\user\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00004809 | Country: Singapore | Language: ENE | Date Format: d/M/yyyy

7.92 Gb Total Physical Memory | 6.11 Gb Available Physical Memory | 77.14% Memory free
15.84 Gb Paging File | 14.01 Gb Available in Paging File | 88.44% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 999.90 Gb Total Space | 143.50 Gb Free Space | 14.35% Space Free | Partition Type: NTFS
Drive D: | 863.02 Gb Total Space | 338.93 Gb Free Space | 39.27% Space Free | Partition Type: NTFS

Computer Name: USER-PC | User Name: user | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0294BB2F-6178-459D-8C46-8D1C40D6AD6B}" = rport=445 | protocol=6 | dir=out | app=system |
"{057550CC-1C7E-4C7B-A2F8-3A8DDC978C8C}" = lport=138 | protocol=17 | dir=in | app=system |
"{08E024BB-596A-4DFF-A430-159062EB67CE}" = lport=10243 | protocol=6 | dir=in | app=system |
"{19A5737B-0BEE-43C8-BCD3-3CC714AA4FD3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{25B9D31D-64EC-44F5-900B-17177C3E5D3C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{295EF879-34FC-4A05-A484-51AA1443280E}" = lport=445 | protocol=6 | dir=in | app=system |
"{2FA65B31-3A9D-4C20-AFC6-469495F0EF44}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4084E937-EAAA-47EE-9520-7BE7CE434C09}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4BF5EB07-06A2-40E2-B5B6-244EF5C49A0F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{5456EA1E-AF45-48BD-9C96-AB99A6CCF1D9}" = lport=139 | protocol=6 | dir=in | app=system |
"{61367282-B091-4F1B-99AC-7A20DDF7F8B4}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6364B77A-8796-4078-B3CC-5963A3E70B4F}" = rport=139 | protocol=6 | dir=out | app=system |
"{6EFD3216-D4DB-448C-81DA-E8838C66FFD2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7C7BD74E-D59D-40F9-8481-A74C4729E9DD}" = rport=138 | protocol=17 | dir=out | app=system |
"{86444BB3-291D-4D31-A046-BB4AA3243C28}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{95E4B182-5E42-489D-BE06-D9A40A97DBC1}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AF8150A9-8B4A-4262-900E-D368942052B3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BE10AB93-C4A6-464B-BE93-069E778BFF99}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C232D951-55E7-4D04-9346-F88A07FC0B22}" = lport=137 | protocol=17 | dir=in | app=system |
"{C428A183-FD79-40B5-990D-895328F43AC8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CF0676E6-E2EC-438A-9741-7029DEBD00CE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F534D21D-02A4-4E48-A237-A3745ED5E6D3}" = rport=137 | protocol=17 | dir=out | app=system |
"{F9C1EEE5-72B7-40C6-BC7C-64E9DF7DEB39}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{003C7A18-60D9-4C89-94D8-DE42C1AA1D76}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{02A4D600-582A-4C14-ADFE-C125CF0CB18F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1473D86F-6F04-46A3-9153-CD04272511DC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{32CA2DAE-D2D5-488F-80D8-0DFE4FEC3734}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 |
"{4849799C-D8E9-4360-8F9A-6B5F2BCC7EA4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{56E808A1-BFD0-4B79-B567-B9FA848D697F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{5D451D47-C822-4117-A2D5-1552A7FC0154}" = protocol=58 | dir=in | app=system |
"{61FB8AD2-C831-45AB-9DFB-D685C3A8300D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{62F27534-2769-4D2F-B42F-E96E62F64F44}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{65901CFC-D156-4C8F-90EA-C26D256CA195}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{68F6992D-6E9D-4F14-88EC-3E0B8BEC7EFF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8642AF85-31DC-4BB3-8E9D-1E478C224084}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A5589677-56C4-46C1-A86B-1F0B5425786F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB3FBA72-52C3-4476-9A38-230DBE05659B}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BC7833D1-AE4B-4CAB-BDD5-6EA587E5C763}" = protocol=6 | dir=out | app=system |
"{CE504808-152F-4073-8BB9-0F8E7C4D30C6}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D3648D1D-2BA3-4973-9B7E-EDC907B6E342}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E8715BB0-E132-4617-B344-62E03BFE2C1C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E926E57D-011D-4F63-BCC5-FFCFDC28D091}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{EFA98652-B437-42AA-B7D3-EFFD71ED4ECD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F7DCF881-DB9D-4779-8D1C-CCCBAC7C73FF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{AF60584B-974A-432D-88BB-964BA5A2296F}C:\program files (x86)\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"TCP Query User{D0B7B5FB-263B-4D42-9A38-EFEDF76A0F4D}C:\program files (x86)\common files\pplivenetwork\ppap.exe" = protocol=6 | dir=in | app=c:\program files (x86)\common files\pplivenetwork\ppap.exe |
"UDP Query User{3321E8B5-2FB8-4659-ABA7-86B23A142CFB}C:\program files (x86)\common files\pplivenetwork\ppap.exe" = protocol=17 | dir=in | app=c:\program files (x86)\common files\pplivenetwork\ppap.exe |
"UDP Query User{937E6093-470A-4478-B82F-F0B4C93513F7}C:\program files (x86)\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07179D37-D5FE-4373-90D9-A25B992EFB3E}" = WD SmartWare
"{09536BA1-E498-4CC3-B834-D884A67D7E34}" = Intel® Trusted Connect Service Client
"{0BD776F3-057D-4C11-020C-4FA9B13D04F9}" = AMD Catalyst Install Manager
"{10CD364B-FFCC-48BE-B469-B9622A033075}" = Fences
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{5586CBEA-C071-4616-B809-6E11815D2190}" = ESET Smart Security
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{75104836-CAC7-444E-A39E-3F54151942F5}" = Apple Mobile Device Support
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D66F0C3C-24F2-4463-9E2F-4381E5C40A26}" = iTunes
"{D8CC254C-C671-4664-9A38-FA368D1E2C97}" = SES Driver
"{DE6C496B-D0E2-4906-83F2-7C7493B7DD04}" = Nitro Reader 2
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"4CA7CFBB29889F25ACB3DF6E3A42BAE29EB43B20" = Windows Driver Package - Western Digital Technologies (WDC_SAM) WDC_SAM (01/19/2011 1.0.0009.0)
"CutePDF Writer Installation" = CutePDF Writer 2.8
"KLiteCodecPack64_is1" = K-Lite Codec Pack 5.5.0 (64-bit)
"MediaInfo" = MediaInfo 0.7.53
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Sigil_is1" = Sigil 0.5.901
"TeraCopy_is1" = TeraCopy 2.27

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04A3A6B0-8E19-49BB-82FF-65C5A55F917D}" = Acronis True Image Home 2011
"{0DB87EAC-F695-4D59-9609-C93119AE6B35}" = SAMSUNG Dr.Printer
"{14D08502-FEE4-40E5-90D3-8A967A1D8BA2}" = Readiris Pro 10
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90F1943D-EA4A-4460-B59F-30023F3BA69A}" = SmarThru 4
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.3)
"{C01AE05C-3C8C-75B3-C9F0-1B525DD3697C}" = Catalyst Control Center InstallProxy
"{C5DA59CF-2BB8-48D5-8E5B-17F2E0F0FEE4}" = System Requirements Lab for Intel
"{D14F064B-F549-462F-BABD-857830FEA0B6}_is1" = PC Tools on-the-fly Scanner 9.0
"{E6CBC979-E613-49E6-A37B-3C342DE35235}_is1" = PDF to Word
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F1100000-0010-0000-0000-074957833700}" = ABBYY FineReader 11 Corporate Edition
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F656270D-66A6-41D9-828A-436EE0228D3B}" = calibre
"{FCB3772C-B7D0-4933-B1A9-3707EBACC573}" = Intel(R) OpenCL CPU Runtime
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Audacity_is1" = Audacity 2.0
"Browser Defender_is1" = Browser Guard 4.0
"dBpoweramp DSP Effects" = dBpoweramp DSP Effects
"dBpoweramp Music Converter" = dBpoweramp Music Converter
"Digital Editions" = Adobe Digital Editions
"Driver Genius Professional Edition_is1" = Driver Genius Professional Edition
"Fences" = Fences
"FLAC" = FLAC 1.2.1b (remove only)
"foobar2000" = foobar2000 v1.1.9
"FormatFactory" = FormatFactory 2.90
"Free RAR Extract Frog" = Free RAR Extract Frog
"HaaliMkx" = Haali Media Splitter
"HandBrake" = HandBrake 0.9.6
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 8.0.0
"LADSPA_plugins-win_is1" = LADSPA_plugins-win-0.4.15
"Magic ISO Maker v5.5 (build 0281)" = Magic ISO Maker v5.5 (build 0281)
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"Media Center 17" = Media Center 17
"MKVToolNix" = MKVToolNix 5.2.1
"Mp3tag" = Mp3tag v2.50
"pdfsam" = pdfsam
"PPLite" = PPLite 1.0.0.0082
"RealPlayer 15.0" = RealPlayer
"Revo Uninstaller" = Revo Uninstaller 1.93
"Roozz plugin_is1" = Roozz plugin 2.9.8
"Samsung CLX-3170 Series" = Samsung CLX-3170 Series
"Smart Defrag 2_is1" = Smart Defrag 2
"thunder_is1" = ѸÀ×7
"uTorrent" = µTorrent
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 2.0.1
"WheelMouse" = Advanced Wheel Mouse 6.0.0.011
"winscp3_is1" = WinSCP 4.3.2
"迅雷看看播放器" = 迅雷看看播放器Beta
"迅雷看看高清播放组件" = 迅雷看看高清播放组件

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3892454325-3400438884-1050192996-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"MyFreeCodec" = MyFreeCodec

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 8/7/2012 1:32:23 AM | Computer Name = user-PC | Source = Application Hang | ID = 1002
Description = The program chrome.exe version 20.0.1132.47 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 7dc Start
Time: 01cd5cc507680228 Termination Time: 5 Application Path: C:\Users\user\AppData\Local\Google\Chrome\Application\chrome.exe

Report
Id: 4801b2f9-c8be-11e1-ad24-1c6f65c9515d

Error - 8/7/2012 5:34:08 AM | Computer Name = user-PC | Source = RasClient | ID = 20227
Description =

Error - 8/7/2012 5:34:08 AM | Computer Name = user-PC | Source = RasClient | ID = 20227
Description =

Error - 8/7/2012 5:48:39 AM | Computer Name = user-PC | Source = Application Error | ID = 1000
Description = Faulting application name: InstallFlashPlayer.exe, version: 11.0.1.152,
time stamp: 0x4e7d1453 Faulting module name: InstallFlashPlayer.exe, version: 11.0.1.152,
time stamp: 0x4e7d1453 Exception code: 0xc0000005 Fault offset: 0x000071ad Faulting
process id: 0x1c1c Faulting application start time: 0x01cd5ceecffe2b42 Faulting application
path: C:\Users\user\AppData\Local\Temp\InstallFlashPlayer.exe Faulting module path:
C:\Users\user\AppData\Local\Temp\InstallFlashPlayer.exe Report Id: 17e26e67-c8e2-11e1-ad24-1c6f65c9515d

Error - 8/7/2012 8:29:22 AM | Computer Name = user-PC | Source = Application Error | ID = 1000
Description = Faulting application name: services.exe, version: 0.0.0.0, time stamp:
0x4a5bc10e Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp:
0x4ec4aa8e Exception code: 0xc0000374 Fault offset: 0x00000000000c40f2 Faulting process
id: 0x384 Faulting application start time: 0x01cd5d01b9b96e34 Faulting application
path: C:\Windows\system32\services.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report
Id: 8b9f6461-c8f8-11e1-acd0-1c6f65c9515d

Error - 8/7/2012 8:49:37 AM | Computer Name = user-PC | Source = Application Hang | ID = 1002
Description = The program uTorrent.exe version 3.1.3.27220 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 640 Start
Time: 01cd5d0631d34a06 Termination Time: 7 Application Path: C:\Program Files (x86)\uTorrent\uTorrent.exe

Report
Id: 5d234e24-c8fb-11e1-a5bd-1c6f65c9515d

Error - 8/7/2012 9:01:16 AM | Computer Name = user-PC | Source = Application Hang | ID = 1002
Description = The program uTorrent.exe version 3.1.3.27220 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 1938 Start
Time: 01cd5d0822c798b8 Termination Time: 7 Application Path: C:\Program Files (x86)\uTorrent\uTorrent.exe

Report
Id: fe7989f1-c8fc-11e1-a5bd-1c6f65c9515d

Error - 8/7/2012 8:38:32 PM | Computer Name = user-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Common
Files\Nitro PDF\Reader\2.0\NitroPrinterInstallerx64.exe". Dependent Assembly Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 9/7/2012 1:41:36 AM | Computer Name = user-PC | Source = Application Error | ID = 1000
Description = Faulting application name: ekrn.exe, version: 5.0.94.0, time stamp:
0x4e7b0032 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception
code: 0xc0000005 Fault offset: 0x00c534e4 Faulting process id: 0x870 Faulting application
start time: 0x01cd5d7a166706c0 Faulting application path: C:\Program Files\ESET\ESET
NOD32 Antivirus\x86\ekrn.exe Faulting module path: unknown Report Id: bf250da5-c988-11e1-be36-1c6f65c9515d

Error - 9/7/2012 10:37:50 AM | Computer Name = user-PC | Source = Application Hang | ID = 1002
Description = The program chrome.exe version 20.0.1132.47 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: f14 Start
Time: 01cd5de049ea790d Termination Time: 5 Application Path: C:\Users\user\AppData\Local\Google\Chrome\Application\chrome.exe

Report
Id: 9e7941cc-c9d3-11e1-a1f4-1c6f65c9515d

Error - 9/7/2012 11:37:45 PM | Computer Name = user-PC | Source = Application Hang | ID = 1002
Description = The program chrome.exe version 20.0.1132.47 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: df8 Start
Time: 01cd5e49f542c767 Termination Time: 5 Application Path: C:\Users\user\AppData\Local\Google\Chrome\Application\chrome.exe

Report
Id: 94e841bb-ca40-11e1-aa8e-1c6f65c9515d

Error - 9/7/2012 11:56:24 PM | Computer Name = user-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Common
Files\Nitro PDF\Reader\2.0\NitroPrinterInstallerx64.exe". Dependent Assembly Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"
could not be found. Please use sxstrace.exe for detailed diagnosis.

[ System Events ]
Error - 8/5/2012 7:37:24 AM | Computer Name = user-PC | Source = Service Control Manager | ID = 7000
Description = The DgiVecp service failed to start due to the following error: %%20

Error - 8/5/2012 7:48:39 AM | Computer Name = user-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Definition Update for Windows Defender - KB915597 (Definition
1.125.1373.0).

Error - 8/5/2012 8:48:34 AM | Computer Name = user-PC | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetBT_Tcpip_{CAEDDDBA-E755-435D-A6A7-AE8177702119}
because another computer on the network has the same name. The server could not
start.

Error - 8/5/2012 11:01:25 AM | Computer Name = user-PC | Source = RasSstp | ID = 1
Description =

Error - 8/5/2012 11:03:31 AM | Computer Name = user-PC | Source = RasSstp | ID = 1
Description =

Error - 8/5/2012 11:05:37 AM | Computer Name = user-PC | Source = RasSstp | ID = 1
Description =

Error - 8/5/2012 11:07:43 AM | Computer Name = user-PC | Source = RasSstp | ID = 1
Description =

Error - 8/5/2012 12:06:53 PM | Computer Name = user-PC | Source = DCOM | ID = 10010
Description =

Error - 8/5/2012 9:08:15 PM | Computer Name = user-PC | Source = Service Control Manager | ID = 7000
Description = The DgiVecp service failed to start due to the following error: %%20

Error - 8/5/2012 9:25:44 PM | Computer Name = user-PC | Source = Service Control Manager | ID = 7034
Description = The WD File Management Engine service terminated unexpectedly. It
has done this 1 time(s).


< End of report >

 

[Broni]

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  O3 - HKLM\..\Toolbar: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
  O3 - HKU\S-1-5-21-3892454325-3400438884-1050192996-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
  O8:64bit: - Extra context menu item: SmarThru4 Capture Selection - C:\Program Files (x86)\SmarThru 4\WebCapture.dll2.htm File not found
  O8:64bit: - Extra context menu item: SmarThru4 Save as HTML - C:\Program Files (x86)\SmarThru 4\WebCapture.dll1.htm File not found
  O8:64bit: - Extra context menu item: SmarThru4 Save Selected Text - C:\Program Files (x86)\SmarThru 4\WebCapture.dll.htm File not found
  O8:64bit: - Extra context menu item: SmarThru4 Web Capture - C:\Program Files (x86)\SmarThru 4\WebCapture.dll File not found
  O8 - Extra context menu item: SmarThru4 Capture Selection - C:\Program Files (x86)\SmarThru 4\WebCapture.dll2.htm File not found
  O8 - Extra context menu item: SmarThru4 Save as HTML - C:\Program Files (x86)\SmarThru 4\WebCapture.dll1.htm File not found
  O8 - Extra context menu item: SmarThru4 Save Selected Text - C:\Program Files (x86)\SmarThru 4\WebCapture.dll.htm File not found
  O8 - Extra context menu item: SmarThru4 Web Capture - C:\Program Files (x86)\SmarThru 4\WebCapture.dll File not found
  @Alternate Data Stream - 157 bytes -> C:\ProgramData\TEMP:DFC5A2B2
  @Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
  
  :Services
  
  :Reg
  
  :Files
  C:\FRST
  
  :Commands
  [purity]
  [emptytemp]
  [emptyjava]
  [emptyflash]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• You will get a log that shows the results of the fix. Please post it.

===============================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

• Double-click SecurityCheck.exe
• Follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  
  NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

• Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

3. Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

• Double click on TFC.exe to run the program.
• Click on Start button to begin cleaning process.
• TFC will close all running programs, and it may ask you to restart computer.

4. Please, run F-Secure Online Scanner

• Disable your Antivirus program.
• Checkmark I have read and accepted the license terms.
• Click on Run Check button.
• Quick scan (recommended) option will come pre-checked. Don't change it.
• Click on Start button.
• When scan is done, in Step 3: Clean the files, leave all settings as they're.
• Click Next button.
• Click Full report... button.
• Copy report's content and paste it into your next reply.

 

[hokokhua]

Managed to clear the FRST files earlier. here are the scan reports:

===
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{472734EA-242A-422B-ADF8-83D1E48CC825} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{472734EA-242A-422B-ADF8-83D1E48CC825}\ not found.
Registry value HKEY_USERS\S-1-5-21-3892454325-3400438884-1050192996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\SmarThru4 Capture Selection\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\SmarThru4 Save as HTML\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\SmarThru4 Save Selected Text\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\SmarThru4 Web Capture\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\SmarThru4 Capture Selection\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\SmarThru4 Save as HTML\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\SmarThru4 Save Selected Text\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\SmarThru4 Web Capture\ not found.
ADS C:\ProgramData\TEMPFC5A2B2 deleted successfully.
ADS C:\ProgramData\TEMP:430C6D84 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File\Folder C:\FRST not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: PlayOnHD
->Temp folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: user
->Temp folder emptied: 22973962 bytes
->Temporary Internet Files folder emptied: 87985628 bytes
->Java cache emptied: 382383 bytes
->Google Chrome cache emptied: 109367493 bytes
->Flash cache emptied: 346201 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 107552 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 539648 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 211.00 mb


[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: PlayOnHD

User: Public

User: user
->Java cache emptied: 0 bytes

Total Java Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: PlayOnHD

User: Public

User: user
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.53.1 log created on 07112012_091607

Files\Folders moved on Reboot...
C:\Users\user\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Windows\temp\etilqs_dvGdEJSZWdenmhlBoRZN not found!
File\Folder C:\Windows\temp\etilqs_hzGva66dCXdyvwVhfugr not found!
File\Folder C:\Windows\temp\etilqs_Kjopbh8UqgeIKWTfWA1F not found!
File\Folder C:\Windows\temp\etilqs_ZRCHODvWJw9sl4ZTViXO not found!

PendingFileRenameOperations files...
File C:\Users\user\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
File C:\Windows\temp\etilqs_dvGdEJSZWdenmhlBoRZN not found!
File C:\Windows\temp\etilqs_hzGva66dCXdyvwVhfugr not found!
File C:\Windows\temp\etilqs_Kjopbh8UqgeIKWTfWA1F not found!
File C:\Windows\temp\etilqs_ZRCHODvWJw9sl4ZTViXO not found!

Registry entries deleted on Reboot...

 

[hokokhua]

checkup txt

===

Results of screen317's Security Check version 0.99.24
Windows 7 x64 (UAC is enabled)
Internet Explorer 9
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
```````````````````````````````
Anti-malware/Other Utilities Check:
Java(TM) 6 Update 31
Adobe Flash Player 11.3.300.262
Adobe Reader X (10.1.3)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Acronis OnlineBackupStandalone TrueImageMonitor.exe
``````````End of Log````````````

 

[hokokhua]

Farbar Service Scanner Version: 08-07-2012
Ran by user (administrator) on 11-07-2012 at 09:42:13
Running from "C:\Users\user\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****