========== Chrome ==========
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google
riginalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Admin\AppData\Local\Google\Chrome\Application\18.0.1025.162\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Admin\AppData\Local\Google\Chrome\Application\18.0.1025.162\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Admin\AppData\Local\Google\Chrome\Application\18.0.1025.162\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll
CHR - plugin: Java Deployment Toolkit 6.0.300.12 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U30 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: Oberon com adapter (Enabled) = C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Zeon Plus (Enabled) = C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Best Buy pc app Detector (Enabled) = C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\Admin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Admin\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: SOE Web Installer (Enabled) = C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\owe6ft38.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}\plugins\npsoe.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: YouTube = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\
CHR - Extension: Facebook = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\boeajhmfdjldchidhphikilcgdacljfm\1.0.3_0\
CHR - Extension: Google Search = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
CHR - Extension: Google Search = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: YouTube Feed = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghmclllfjjmmdmhjobjdgfnggfhljboa\1.3.4.1_0\
CHR - Extension: YouTube Feed = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghmclllfjjmmdmhjobjdgfnggfhljboa\1.3.4.1_0\~
CHR - Extension: Google Mail Checker = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff\3.2_0\
CHR - Extension: Facebook Notifications = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmameahlembdcigphohgiodcgjomcgeo\1.27_0\
CHR - Extension: Gmail = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\
CHR - Extension: Gmail = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2012/07/05 21:48:49 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:
64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:
64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:
64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4:
64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:
64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:
64bit: - HKLM..\Run: [sbser] rundll32.exe "C:\Users\Admin\AppData\Roaming\sbser.dll",Seek File not found
O4:
64bit: - HKLM..\Run: [SynAsusAcpi] C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe (Synaptics Incorporated)
O4:
64bit: - HKLM..\Run: [THXCfg64] C:\Windows\SysNative\THXCfg64.DLL (Creative Technology Ltd.)
O4:
64bit: - HKLM..\Run: [TortoiseHgOverlayIconServer] C:\Program Files\TortoiseHg\TortoiseHgOverlayServer.exe ()
O4:
64bit: - HKLM..\Run: [ustpn] "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\ustpn.dll",CreateAdapterConfigurationPort File not found
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe (ASUS)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\Asus\ATK Package\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [FLxHCIm] C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe (Windows (R) Win 7 DDK provider)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\Asus\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [IJNetworkScanUtility] C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
O4 - HKLM..\Run: [Nuance PDF Reader-reminder] C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [THX TruStudio NB Settings] C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKU\S-1-5-21-862440500-67215502-637098876-1003..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-862440500-67215502-637098876-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Admin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
O4 - Startup: C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-862440500-67215502-637098876-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-862440500-67215502-637098876-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKU\S-1-5-21-862440500-67215502-637098876-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O7 - HKU\S-1-5-21-862440500-67215502-637098876-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-862440500-67215502-637098876-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-862440500-67215502-637098876-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:
64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\.DEFAULT\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: sony.com ([]* in )
O16:
64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16:
64bit: - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16:
64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{06548C3D-61F6-4B16-BD0A-A602C0F86551}: DhcpNameServer = 10.240.0.10 10.240.0.12
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{46BF7897-5AC9-43EF-8C38-6952F52E47AA}: DhcpNameServer = 172.26.38.1 172.26.38.2 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8BB28020-B125-4227-B6F1-13F0F08F4F2A}: DhcpNameServer = 75.75.75.75 75.75.76.76 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D9319B3F-2302-4E61-A4DA-636926BC04BC}: DhcpNameServer = 172.26.38.1 172.26.38.2 8.8.8.8
O18:
64bit: - Protocol\Handler\livecall - No CLSID value found
O18:
64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:
64bit: - Protocol\Handler\msnim - No CLSID value found
O18:
64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:
64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:
64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:
64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:
64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:
64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:
64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:
64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [1996/12/26 19:21:40 | 004,429,073 | R--- | M] (Blizzard Entertainment) - E:\AUTORUN.EXE -- [ CDFS ]
O32 - AutoRun File - [1996/11/20 11:25:44 | 000,000,050 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:
64bit: - HKLM\..comfile [open] -- "%1" %*
O35:
64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:
64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:
64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2012/07/05 22:13:13 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2012/07/05 21:54:38 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/07/05 21:48:56 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2012/07/05 21:33:09 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012/07/05 19:54:51 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/07/05 19:54:51 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/07/05 19:54:51 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/07/05 19:54:45 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/07/05 19:54:18 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012/07/05 19:48:20 | 004,571,524 | R--- | C] (Swearware) -- C:\Users\Admin\Desktop\ComboFix.exe
[2012/07/05 13:50:09 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Admin\Desktop\dds.scr
[2012/07/05 11:11:18 | 000,000,000 | ---D | C] -- C:\FRST
[2012/07/05 08:49:14 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes
[2012/07/05 08:49:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/07/05 08:49:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/07/05 08:49:01 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/07/05 08:49:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/07/05 08:22:41 | 000,000,000 | ---D | C] -- C:\sh4ldr
[2012/07/05 08:22:41 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2012/07/05 08:20:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2012/07/04 14:59:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client
[2012/07/04 14:59:40 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2012/07/04 14:51:59 | 000,000,000 | -HSD | C] -- C:\Windows\SysNative\%APPDATA%
[2012/07/04 14:49:17 | 000,000,000 | ---D | C] -- C:\Windows\scoped_dir_6692_4852
[2012/07/04 14:49:16 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{B637F6F3-C619-11E1-8270-B8AC6F996F26}
[2012/07/04 14:49:16 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{B637C522-C619-11E1-8270-B8AC6F996F26}
[2012/07/04 14:48:24 | 000,000,000 | ---D | C] -- C:\ProgramData\99058D9B000149731FA0F36AB4EB2367
[2012/06/27 20:23:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo
[2012/06/27 20:23:48 | 000,000,000 | ---D | C] -- C:\Diablo
[2012/06/21 21:13:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PC Speed Maximizer
[2012/06/21 21:12:07 | 000,000,000 | ---D | C] -- C:\ProgramData\blekko toolbars
[2012/06/17 22:34:58 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\Work
[2012/06/13 12:50:08 | 000,178,800 | ---- | C] (Sony DADC Austria AG.) -- C:\Windows\SysWow64\CmdLineExt_x64.dll
[2012/06/11 14:13:29 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Macromedia
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012/07/05 22:13:13 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2012/07/05 22:12:36 | 000,010,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/05 22:12:36 | 000,010,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/05 22:05:43 | 000,045,056 | ---- | M] () -- C:\Windows\SysNative\acovcnt.exe
[2012/07/05 22:05:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/07/05 22:05:03 | 2129,526,783 | -HS- | M] () -- C:\hiberfil.sys
[2012/07/05 21:48:49 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012/07/05 21:44:16 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/07/05 20:20:01 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-862440500-67215502-637098876-1000UA.job
[2012/07/05 19:48:47 | 004,571,524 | R--- | M] (Swearware) -- C:\Users\Admin\Desktop\ComboFix.exe
[2012/07/05 18:47:07 | 000,001,435 | ---- | M] () -- C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/07/05 13:50:12 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Admin\Desktop\dds.scr
[2012/07/05 13:20:01 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-862440500-67215502-637098876-1000Core.job
[2012/07/05 09:05:03 | 000,001,107 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/04 14:59:59 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012/07/04 14:59:45 | 000,909,016 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/07/04 14:59:45 | 000,742,396 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/07/04 14:59:45 | 000,152,404 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/07/04 14:46:24 | 000,892,544 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/07/02 15:06:27 | 000,002,182 | ---- | M] () -- C:\Users\Admin\.kdiff3rc
[2012/07/02 14:35:24 | 000,001,118 | ---- | M] () -- C:\Users\Public\Desktop\Unity.lnk
[2012/06/27 20:23:49 | 000,086,528 | ---- | M] () -- C:\Windows\bnetunin.exe
[2012/06/27 20:23:49 | 000,061,440 | ---- | M] () -- C:\Windows\diabunin.exe
[2012/06/14 11:26:50 | 000,333,760 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/06/13 12:50:08 | 000,178,800 | ---- | M] (Sony DADC Austria AG.) -- C:\Windows\SysWow64\CmdLineExt_x64.dll
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012/07/05 19:54:51 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/07/05 19:54:51 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/07/05 19:54:51 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/07/05 19:54:51 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/07/05 19:54:51 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/07/05 09:05:03 | 000,001,107 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/04 14:59:41 | 000,001,899 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2012/07/02 14:35:24 | 000,001,118 | ---- | C] () -- C:\Users\Public\Desktop\Unity.lnk
[2012/06/27 20:23:49 | 000,086,528 | ---- | C] () -- C:\Windows\bnetunin.exe
[2012/06/27 20:23:49 | 000,061,440 | ---- | C] () -- C:\Windows\diabunin.exe
[2012/06/01 15:42:24 | 000,000,218 | ---- | C] () -- C:\Users\Admin\.recently-used.xbel
[2012/05/31 14:04:23 | 000,002,182 | ---- | C] () -- C:\Users\Admin\.kdiff3rc
[2012/05/30 14:27:43 | 000,000,693 | ---- | C] () -- C:\Users\Admin\Mercurial-kiln.ini
[2012/05/30 14:20:45 | 000,000,179 | ---- | C] () -- C:\Users\Admin\mercurial.ini
[2012/03/29 22:50:30 | 000,000,000 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\TS3Patch.lck
[2012/02/09 21:05:44 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011/09/28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011/04/29 18:39:14 | 000,000,246 | ---- | C] () -- C:\Windows\PowerReg.dat
[2011/04/13 21:04:28 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini
[2011/04/11 10:29:26 | 000,909,016 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/02/28 08:30:45 | 000,001,200 | ---- | C] () -- C:\Windows\THXCfg_SP_APOIM.ini
[2011/02/28 08:30:45 | 000,001,099 | ---- | C] () -- C:\Windows\THXCfg_HP_APOIM.ini
[2011/02/28 08:30:45 | 000,001,099 | ---- | C] () -- C:\Windows\THXCfg_APOIM.ini
[2011/02/28 08:30:44 | 000,181,760 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011/02/28 08:30:44 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2011/02/28 08:15:26 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll
========== LOP Check ==========
[2012/02/13 21:26:12 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\.minecraft
[2012/05/26 00:09:10 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Big Fish Games
[2011/11/05 18:34:46 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\blg
[2011/04/27 21:43:12 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Canon
[2012/05/26 19:07:12 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Dereza
[2012/05/26 20:14:26 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\DikobrazGames
[2012/07/05 22:06:09 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Dropbox
[2011/10/24 21:31:20 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\ERS Game Studios
[2012/06/14 13:23:45 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\gtk-2.0
[2011/10/23 18:42:58 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Islands2
[2012/05/25 18:55:03 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Jumb-O-Fun Games
[2012/05/25 19:55:09 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\LegacyGames
[2012/03/31 15:16:32 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\LolClient
[2011/10/24 20:30:57 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\MagicIndie
[2011/10/24 22:11:06 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Merscom
[2012/04/17 14:27:39 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\MonoDevelop-Unity-2.8
[2011/04/23 16:10:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\My Games
[2011/04/22 11:45:44 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Nuance
[2012/03/17 22:30:39 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Oberon Media
[2011/04/21 20:57:37 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\OpenOffice.org
[2012/02/11 17:18:46 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Origin
[2012/04/17 13:16:54 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\PACE Anti-Piracy
[2011/10/23 00:11:56 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\PeaceCraft3
[2012/05/26 18:06:56 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Rainbow
[2011/05/29 22:56:39 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\RIFT
[2012/06/26 22:46:38 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\SoftGrid Client
[2011/07/31 19:08:52 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\SPORE
[2011/12/10 12:45:37 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Spotify
[2011/04/11 10:30:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\TP
[2011/10/26 22:04:51 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\UClick
[2012/04/23 22:58:40 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Unity
[2012/05/26 19:08:07 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\WeatherLord
[2011/11/05 19:22:03 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\YoudaGames
[2011/04/11 23:02:32 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Zeon
[2012/02/08 23:10:52 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Origin
[2012/02/26 19:11:44 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\SoftGrid Client
[2012/07/05 18:25:40 | 000,032,562 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 264 bytes -> C:\ProgramData\Temp:258D2F8B
@Alternate Data Stream - 258 bytes -> C:\ProgramData\Temp:A039EDF9
@Alternate Data Stream - 240 bytes -> C:\ProgramData\Temp:178093AE
@Alternate Data Stream - 157 bytes -> C:\ProgramData\Temp:A5808D58
@Alternate Data Stream - 154 bytes -> C:\ProgramData\Temp
AE59DEF
@Alternate Data Stream - 153 bytes -> C:\ProgramData\Temp:BE02DA6F
@Alternate Data Stream - 151 bytes -> C:\ProgramData\Temp:9FF05345
@Alternate Data Stream - 150 bytes -> C:\ProgramData\Temp:2AAB595E
@Alternate Data Stream - 148 bytes -> C:\ProgramData\Temp:539420FF
@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:FA0F20C6
@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:B790962B
@Alternate Data Stream - 147 bytes -> C:\ProgramData\Temp:0B941A88
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:9D6EAEC3
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:855BDAD7
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:32C264A1
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:157A85BF
@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:3D11302A
@Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:7D288858
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:F98E6C67
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:C244BA18
@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:E1B0CF05
@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:C9283FAF
@Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:41326804
@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:534D0D60
@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:E8AB98F0
@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:4C589A4E
@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:3407BF66
@Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:A1A86E40
@Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:575FD22B
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:7F48775E
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:4A017078
@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:8AC20936
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:C458CC0A
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:3A4676D7
@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:77F45AF2
@Alternate Data Stream - 1190 bytes -> C:\Program Files (x86)\Common Files\System:Bxt5YDcML7JbVx1Pz
@Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:4C71A42B
@Alternate Data Stream - 1148 bytes -> C:\ProgramData\Microsoft:YADtlPPzYtRqY4GKMYusaUb
@Alternate Data Stream - 1143 bytes -> C:\ProgramData\Microsoft:JPHjXO6BUSKPYYjIj3vNhXwo
@Alternate Data Stream - 1118 bytes -> C:\Users\Admin\AppData\Local\Temp:0nXeABATCsRVUJMcoCalh8pb
< End of report >
