OTL logfile created on: 2012-07-14 23:58:18 - Run 1
OTL by OldTimer - Version 3.2.54.0     Folder = C:\Users\Marysia\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000415 | Country: Poland | Language: PLK | Date Format: yyyy-MM-dd
 
2,87 Gb Total Physical Memory | 2,01 Gb Available Physical Memory | 70,07% Memory free
5,74 Gb Paging File | 5,06 Gb Available in Paging File | 88,08% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 288,62 Gb Total Space | 178,33 Gb Free Space | 61,79% Space Free | Partition Type: NTFS
Drive D: | 588,24 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: MARYSIA-PC | User Name: Marysia | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - [2012-07-14 23:47:29 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Marysia\Desktop\OTL.exe
PRC - [2011-02-25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
[color=#E56717]========== Modules (No Company Name) ==========[/color]
 
 
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
 
SRV - [2012-07-12 15:31:22 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012-07-03 18:21:29 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Stopped] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010-10-12 19:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2010-05-20 03:00:28 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009-09-24 06:07:52 | 000,117,640 | R--- | M] (Symantec Corporation) [Auto | Stopped] -- C:\Program Files\Norton Internet Security\Engine\16.7.0.30\ccSvcHst.exe -- (Norton Internet Security)
SRV - [2009-08-17 19:48:42 | 000,051,512 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2009-08-12 01:09:54 | 000,185,712 | ---- | M] (TOSHIBA Corporation) [Auto | Stopped] -- C:\Program Files\TOSHIBA\TECO\TecoService.exe -- (TOSHIBA eco Utility Service)
SRV - [2009-08-11 04:55:46 | 000,185,712 | ---- | M] (TOSHIBA CORPORATION) [Auto | Stopped] -- C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe -- (cfWiMAXService)
SRV - [2009-08-07 02:04:56 | 000,685,424 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe -- (TPCHSrv)
SRV - [2009-08-05 23:18:50 | 000,464,224 | ---- | M] (TOSHIBA Corporation) [Auto | Stopped] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV - [2009-08-04 03:16:32 | 000,111,960 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
SRV - [2009-07-29 00:43:04 | 000,128,344 | ---- | M] (TOSHIBA Corporation) [Auto | Stopped] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv)
SRV - [2009-07-14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009-07-14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009-03-11 03:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) [Auto | Stopped] -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\RtsUCcid.sys -- (USBCCID)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\Rts516xIR.sys -- (RtsUIR)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090713.024\NAVEX15.SYS -- (NAVEX15)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090713.024\NAVENG.SYS -- (NAVENG)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard)
DRV - [2012-07-03 18:21:54 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012-07-03 18:21:53 | 000,721,000 | ---- | M] (AVAST Software) [File_System | System | Stopped] -- C:\windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012-07-03 18:21:53 | 000,353,688 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012-07-03 18:21:53 | 000,057,656 | ---- | M] (AVAST Software) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2012-07-03 18:21:53 | 000,044,784 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr2.sys -- (aswRdr)
DRV - [2012-07-03 18:21:53 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Stopped] -- C:\windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2011-03-01 11:41:00 | 000,008,192 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vmulti.sys -- (vmulti)
DRV - [2010-11-20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010-06-09 14:40:42 | 000,010,240 | ---- | M] (Nicomsoft Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\ddcdrv.sys -- (WinI2C-DDC)
DRV - [2009-10-22 15:41:00 | 000,057,800 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ftdibus.sys -- (FTDIBUS)
DRV - [2009-10-22 15:39:00 | 000,072,520 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ftser2k.sys -- (FTSER2K)
DRV - [2009-09-24 06:07:53 | 000,308,272 | ---- | M] (Symantec Corporation) [File_System | System | Stopped] -- C:\Windows\System32\drivers\NIS\1007000.01E\srtsp.sys -- (SRTSP)
DRV - [2009-09-24 06:07:53 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\NIS\1007000.01E\srtspx.sys -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2009-08-28 07:19:22 | 000,859,136 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8192se.sys -- (rtl8192se)
DRV - [2009-07-31 02:45:56 | 000,022,912 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV - [2009-07-25 00:57:06 | 000,275,536 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\tos_sps32.sys -- (tos_sps32)
DRV - [2009-07-15 00:28:42 | 000,023,512 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\TVALZ_O.SYS -- (TVALZ)
DRV - [2009-07-14 00:13:48 | 001,035,776 | ---- | M] (LSI Corp) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2009-07-14 00:09:17 | 004,194,816 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009-07-07 17:53:06 | 000,007,680 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\FwLnk.sys -- (FwLnk)
DRV - [2009-06-23 02:04:58 | 000,024,064 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PGEffect.sys -- (PGEffect)
DRV - [2009-06-20 04:31:08 | 000,012,920 | ---- | M] (TOSHIBA Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\TVALZFL.sys -- (TVALZFL)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
IE - HKLM\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - C:\Program Files\BrotherSoft_Extreme\tbBrot.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {73F54505-165B-4F52-A6C1-A74D7A2675B3}
IE - HKLM\..\SearchScopes\{73F54505-165B-4F52-A6C1-A74D7A2675B3}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2776682
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2776682
IE - HKCU\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - C:\Program Files\BrotherSoft_Extreme\tbBrot.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {73F54505-165B-4F52-A6C1-A74D7A2675B3}
IE - HKCU\..\SearchScopes\{73F54505-165B-4F52-A6C1-A74D7A2675B3}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA_enUS357US360
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2776682
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
[color=#E56717]========== FireFox ==========[/color]
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@ganymede/GanymedeNetPlugin,version=1.0: C:\Program Files\Ganymede\Plugins\npganymedenet.dll ( )
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files\WildTangent Games\App\BrowserIntegration\Registered\14\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-11-17 10:33:18 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-11-17 10:33:18 | 000,000,000 | ---D | M]
 
 
[color=#E56717]========== Chrome  ==========[/color]
 
CHR - homepage: http://www.google.com
CHR - homepage: http://www.google.com
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\20.0.1132.57\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\20.0.1132.57\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\windows\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.140.8 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeploytk.dll
CHR - plugin: Java(TM) Platform SE 6 U14 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: GanymedeNet.Detector (Enabled) = C:\Program Files\Ganymede\Plugins\npganymedenet.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\Marysia\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Marysia\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: avast! WebRep = C:\Users\Marysia\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1456_0\
CHR - Extension: Gmail = C:\Users\Marysia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2009-06-10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Groove Folder Synchronization) - {13DF3DB2-1C90-53EE-6A24-650C294B08E4} - C:\Windows\System32\iesetuup.dll ()
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (BrotherSoft Extreme Toolbar) - {51a86bb3-6602-4c85-92a5-130ee4864f13} - C:\Program Files\BrotherSoft_Extreme\tbBrot.dll (Conduit Ltd.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.0.30\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.0.30\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) -  - No CLSID value found.
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (BrotherSoft Extreme Toolbar) - {51a86bb3-6602-4c85-92a5-130ee4864f13} - C:\Program Files\BrotherSoft_Extreme\tbBrot.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.0.30\CoIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (BrotherSoft Extreme Toolbar) - {51A86BB3-6602-4C85-92A5-130EE4864F13} - C:\Program Files\BrotherSoft_Extreme\tbBrot.dll (Conduit Ltd.)
O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe (Toshiba)
O4 - HKLM..\Run: [Onet.pl AutoUpdate] "C:\Program Files\Common Files\Onet.pl\NewAutoUpdate.exe" /updateexetsr File not found
O4 - HKLM..\Run: [SmartFaceVWatcher] C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Teco] C:\Program Files\TOSHIBA\TECO\Teco.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosWaitSrv] C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TWebCamera] C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe (TOSHIBA CORPORATION.)
O4 - HKCU..\Run: [ChomikBox] C:\Program Files\ChomikBox\chomikbox.exe ( )
O4 - HKCU..\Run: [Gadu-Gadu 10] C:\Program Files\Gadu-Gadu 10\gg.exe (GG Network S.A.)
O4 - HKCU..\Run: [GameXN GO] C:\ProgramData\GameXN\GameXNGO.exe (EasyBits Software AS)
O4 - HKCU..\Run: [MyTOSHIBA] C:\Program Files\TOSHIBA\My Toshiba\MyToshiba.exe (TOSHIBA)
O4 - HKCU..\Run: [ommvdeqvuomyjrx] C:\ProgramData\ommvdeqv.exe ()
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\windows\system32\Macromed\Flash\FlashUtil32_11_3_300_257_ActiveX.exe -update activex File not found
O4 - Startup: C:\Users\Marysia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.179.1.62 62.179.1.63
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2F58CEC5-D032-4F12-A6BB-1D797BA410F2}: DhcpNameServer = 62.179.1.62 62.179.1.63
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{436251CF-F051-442E-A3AC-CAD7BDBF3AE8}: DhcpNameServer = 172.31.16.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.0.30\CoIEPlg.dll (Symantec Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009-06-10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2004-05-12 00:13:12 | 000,000,046 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{4ec35bd2-a8be-11de-bdd4-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{4ec35bd2-a8be-11de-bdd4-806e6f6e6963}\Shell\AutoRun\command - "" = D:\SETUP.EXE -- [2004-05-21 16:36:50 | 000,032,768 | R--- | M] ()
O33 - MountPoints2\{a372af98-77ce-11e1-a731-001e33f57379}\Shell - "" = AutoRun
O33 - MountPoints2\{a372af98-77ce-11e1-a731-001e33f57379}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{a372af9e-77ce-11e1-a731-001e33f57379}\Shell - "" = AutoRun
O33 - MountPoints2\{a372af9e-77ce-11e1-a731-001e33f57379}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2012-07-14 23:47:29 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Marysia\Desktop\OTL.exe
[2012-07-14 20:19:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012-07-14 20:19:24 | 000,353,688 | ---- | C] (AVAST Software) -- C:\windows\System32\drivers\aswSP.sys
[2012-07-14 20:19:24 | 000,021,256 | ---- | C] (AVAST Software) -- C:\windows\System32\drivers\aswFsBlk.sys
[2012-07-14 20:19:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2012-07-14 20:19:22 | 000,721,000 | ---- | C] (AVAST Software) -- C:\windows\System32\drivers\aswSnx.sys
[2012-07-14 20:19:22 | 000,057,656 | ---- | C] (AVAST Software) -- C:\windows\System32\drivers\aswMonFlt.sys
[2012-07-14 20:19:22 | 000,054,232 | ---- | C] (AVAST Software) -- C:\windows\System32\drivers\aswTdi.sys
[2012-07-14 20:19:22 | 000,044,784 | ---- | C] (AVAST Software) -- C:\windows\System32\drivers\aswRdr2.sys
[2012-07-14 20:19:09 | 000,227,648 | ---- | C] (AVAST Software) -- C:\windows\System32\aswBoot.exe
[2012-07-14 20:19:09 | 000,041,224 | ---- | C] (AVAST Software) -- C:\windows\avastSS.scr
[2012-07-14 20:18:58 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2012-07-14 20:18:58 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2012-07-14 19:57:08 | 000,000,000 | ---D | C] -- C:\ProgramData\jzgzlvydujfxqrw
[2012-07-14 19:14:51 | 000,000,000 | ---D | C] -- C:\Users\Marysia\AppData\Roaming\Anuman
[2012-07-12 03:08:06 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mshtml.tlb
[2012-07-12 03:08:05 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieui.dll
[2012-07-12 03:08:04 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieUnatt.exe
[2012-07-12 03:08:04 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jsproxy.dll
[2012-07-12 03:08:03 | 001,800,192 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jscript9.dll
[2012-07-12 03:08:03 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\url.dll
[2012-07-12 03:08:02 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\inetcpl.cpl
[2012-07-12 03:01:59 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\win32k.sys
[2012-07-11 06:00:40 | 000,219,136 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ncrypt.dll
[2012-07-11 06:00:39 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\cdosys.dll
[2012-07-11 06:00:39 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msxml3r.dll
[2012-07-02 09:39:22 | 009,757,336 | ---- | C] (Blizzard Entertainment) -- C:\Users\Marysia\Desktop\D2Patch_113c.exe
[2012-07-01 23:32:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012-07-01 22:51:38 | 000,000,000 | ---D | C] -- C:\Users\Marysia\AppData\Local\Macromedia
[2012-07-01 22:43:46 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2012-07-01 22:35:01 | 000,000,000 | ---D | C] -- C:\Users\Marysia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2012-07-01 21:56:08 | 000,106,496 | ---- | C] (Blizzard Entertainment) -- C:\windows\DIIUnin.exe
[2012-07-01 21:56:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo II
[2012-07-01 21:45:08 | 000,000,000 | ---D | C] -- C:\Program Files\Diablo II
[2012-06-27 16:48:47 | 000,000,000 | ---D | C] -- C:\Users\Marysia\Desktop\sprawdzian 6
[2012-06-25 11:46:28 | 000,000,000 | ---D | C] -- C:\Users\Marysia\Desktop\Egzamin gimnazjalny
[2012-06-23 10:42:49 | 000,000,000 | ---D | C] -- C:\Users\Marysia\Documents\DeadHungryDiner
[2012-06-23 10:42:49 | 000,000,000 | ---D | C] -- C:\Users\Marysia\AppData\Local\BlackMarketGames
[2012-06-22 18:06:00 | 002,422,272 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wucltux.dll
[2012-06-22 18:06:00 | 000,045,080 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wups2.dll
[2012-06-22 18:05:36 | 000,577,048 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wuapi.dll
[2012-06-22 18:05:36 | 000,088,576 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wudriver.dll
[2012-06-22 18:05:36 | 000,035,864 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wups.dll
[2012-06-22 18:05:13 | 000,171,904 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wuwebv.dll
[2012-06-22 18:05:13 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wuapp.exe
[2012-06-19 19:57:11 | 000,000,000 | ---D | C] -- C:\Users\Marysia\AppData\Roaming\LegacyGames
[2012-06-16 18:20:35 | 000,000,000 | ---D | C] -- C:\Users\Marysia\AppData\Roaming\Happy Artist Studio
[2012-06-16 17:51:55 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2012-06-16 14:12:21 | 000,426,184 | ---- | C] (Adobe Systems Incorporated) -- C:\windows\System32\FlashPlayerApp.exe
[2012-02-20 00:01:58 | 002,371,152 | ---- | C] (DownVision                                                  ) -- C:\Users\Marysia\AppData\Local\setup.exe
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2012-07-14 23:47:29 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Marysia\Desktop\OTL.exe
[2012-07-14 23:37:12 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012-07-14 23:36:30 | 2312,097,792 | -HS- | M] () -- C:\hiberfil.sys
[2012-07-14 23:34:13 | 000,000,882 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012-07-14 23:31:09 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012-07-14 20:19:43 | 000,002,172 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012-07-14 20:19:43 | 000,002,156 | ---- | M] () -- C:\Users\Marysia\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012-07-14 20:19:24 | 000,002,046 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2012-07-14 20:19:22 | 000,002,577 | ---- | M] () -- C:\windows\System32\config.nt
[2012-07-14 20:19:22 | 000,000,350 | -H-- | M] () -- C:\windows\tasks\avast! Emergency Update.job
[2012-07-14 20:18:00 | 089,340,632 | ---- | M] () -- C:\Users\Marysia\Desktop\avast_free_antivirus_setup.exe
[2012-07-14 20:11:07 | 000,015,792 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012-07-14 20:11:07 | 000,015,792 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012-07-14 19:57:09 | 000,000,051 | ---- | M] () -- C:\ProgramData\mrcueawimwoypoe
[2012-07-14 19:57:03 | 000,049,152 | ---- | M] () -- C:\ProgramData\ommvdeqv.exe
[2012-07-14 19:57:03 | 000,049,152 | ---- | M] () -- C:\Users\Marysia\0.31100519786037994.exe
[2012-07-14 19:54:00 | 000,000,886 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012-07-14 19:10:06 | 000,002,591 | ---- | M] () -- C:\Users\Public\Desktop\WildTangent Games App - toshiba.lnk
[2012-07-12 17:42:01 | 000,000,406 | -H-- | M] () -- C:\windows\tasks\Norton Security Scan for Marysia.job
[2012-07-12 15:31:22 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\System32\FlashPlayerApp.exe
[2012-07-12 15:31:22 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\System32\FlashPlayerCPLApp.cpl
[2012-07-12 03:26:25 | 000,444,856 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2012-07-08 11:17:12 | 000,000,350 | ---- | M] () -- C:\windows\tasks\At1.job
[2012-07-04 20:12:49 | 000,822,529 | ---- | M] () -- C:\Users\Marysia\Desktop\scan0002.pdf
[2012-07-04 20:10:55 | 000,832,741 | ---- | M] () -- C:\Users\Marysia\Desktop\scan0001.pdf
[2012-07-03 18:21:54 | 000,054,232 | ---- | M] (AVAST Software) -- C:\windows\System32\drivers\aswTdi.sys
[2012-07-03 18:21:53 | 000,721,000 | ---- | M] (AVAST Software) -- C:\windows\System32\drivers\aswSnx.sys
[2012-07-03 18:21:53 | 000,353,688 | ---- | M] (AVAST Software) -- C:\windows\System32\drivers\aswSP.sys
[2012-07-03 18:21:53 | 000,057,656 | ---- | M] (AVAST Software) -- C:\windows\System32\drivers\aswMonFlt.sys
[2012-07-03 18:21:53 | 000,044,784 | ---- | M] (AVAST Software) -- C:\windows\System32\drivers\aswRdr2.sys
[2012-07-03 18:21:53 | 000,021,256 | ---- | M] (AVAST Software) -- C:\windows\System32\drivers\aswFsBlk.sys
[2012-07-03 18:21:32 | 000,041,224 | ---- | M] (AVAST Software) -- C:\windows\avastSS.scr
[2012-07-03 18:21:28 | 000,227,648 | ---- | M] (AVAST Software) -- C:\windows\System32\aswBoot.exe
[2012-07-03 07:56:14 | 000,624,178 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012-07-03 07:56:14 | 000,106,522 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012-07-03 07:44:53 | 000,039,936 | ---- | M] () -- C:\Users\Marysia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012-07-03 07:40:35 | 000,032,967 | ---- | M] () -- C:\Users\Marysia\Desktop\ANG1.jpg
[2012-07-02 09:39:37 | 000,018,308 | ---- | M] () -- C:\windows\DIIUnin.dat
[2012-07-02 09:39:22 | 009,757,336 | ---- | M] (Blizzard Entertainment) -- C:\Users\Marysia\Desktop\D2Patch_113c.exe
[2012-07-01 22:52:40 | 000,001,955 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2012-07-01 22:35:39 | 000,021,840 | ---- | M] () -- C:\windows\System32\SIntfNT.dll
[2012-07-01 22:35:39 | 000,017,212 | ---- | M] () -- C:\windows\System32\SIntf32.dll
[2012-07-01 22:35:39 | 000,012,067 | ---- | M] () -- C:\windows\System32\SIntf16.dll
[2012-07-01 21:56:09 | 000,001,818 | ---- | M] () -- C:\Users\Public\Desktop\Diablo II.lnk
[2012-07-01 21:56:08 | 000,106,496 | ---- | M] (Blizzard Entertainment) -- C:\windows\DIIUnin.exe
[2012-07-01 21:56:08 | 000,002,829 | ---- | M] () -- C:\windows\DIIUnin.pif
[2012-06-28 10:14:07 | 000,069,632 | ---- | M] () -- C:\Users\Marysia\Desktop\egzamin gimnazjalny.xlt
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2012-07-14 20:19:43 | 000,002,172 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012-07-14 20:19:43 | 000,002,156 | ---- | C] () -- C:\Users\Marysia\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012-07-14 20:19:24 | 000,002,046 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2012-07-14 20:19:22 | 000,000,350 | -H-- | C] () -- C:\windows\tasks\avast! Emergency Update.job
[2012-07-14 20:17:24 | 089,340,632 | ---- | C] () -- C:\Users\Marysia\Desktop\avast_free_antivirus_setup.exe
[2012-07-14 19:57:09 | 000,049,152 | ---- | C] () -- C:\ProgramData\ommvdeqv.exe
[2012-07-14 19:57:04 | 000,000,051 | ---- | C] () -- C:\ProgramData\mrcueawimwoypoe
[2012-07-14 19:57:03 | 000,049,152 | ---- | C] () -- C:\Users\Marysia\0.31100519786037994.exe
[2012-07-04 20:12:50 | 000,822,529 | ---- | C] () -- C:\Users\Marysia\Desktop\scan0002.pdf
[2012-07-04 20:10:56 | 000,832,741 | ---- | C] () -- C:\Users\Marysia\Desktop\scan0001.pdf
[2012-07-03 07:40:35 | 000,032,967 | ---- | C] () -- C:\Users\Marysia\Desktop\ANG1.jpg
[2012-07-01 23:15:32 | 000,000,830 | ---- | C] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012-07-01 22:52:06 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2012-07-01 22:52:06 | 000,001,955 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2012-07-01 22:35:03 | 000,021,840 | ---- | C] () -- C:\windows\System32\SIntfNT.dll
[2012-07-01 22:35:03 | 000,017,212 | ---- | C] () -- C:\windows\System32\SIntf32.dll
[2012-07-01 22:35:03 | 000,012,067 | ---- | C] () -- C:\windows\System32\SIntf16.dll
[2012-07-01 21:56:09 | 000,018,308 | ---- | C] () -- C:\windows\DIIUnin.dat
[2012-07-01 21:56:09 | 000,001,818 | ---- | C] () -- C:\Users\Public\Desktop\Diablo II.lnk
[2012-07-01 21:56:08 | 000,002,829 | ---- | C] () -- C:\windows\DIIUnin.pif
[2012-06-28 10:14:06 | 000,069,632 | ---- | C] () -- C:\Users\Marysia\Desktop\egzamin gimnazjalny.xlt
[2012-06-03 19:25:25 | 000,002,079 | ---- | C] () -- C:\Users\Marysia\.recently-used.xbel
[2012-06-03 17:42:18 | 000,039,936 | ---- | C] () -- C:\Users\Marysia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011-06-09 08:10:58 | 000,221,184 | ---- | C] () -- C:\windows\System32\AuxiliaryyDisplayCpl.dll
[2011-06-09 08:10:50 | 000,221,184 | ---- | C] () -- C:\windows\System32\prntvptt.dll
[2011-06-09 08:10:23 | 000,221,184 | ---- | C] () -- C:\windows\System32\ddxmasf.dll
[2010-11-17 10:25:54 | 000,166,026 | ---- | C] () -- C:\windows\hpoins45.dat
[2009-12-14 23:39:53 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
 
[color=#E56717]========== LOP Check ==========[/color]
 
[2011-01-25 20:36:33 | 000,000,000 | -HSD | M] -- C:\Users\Marysia\AppData\Roaming\.#
[2011-06-06 15:22:19 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\A Gypsy's Tale - The Tower of Secrets
[2012-01-16 10:14:14 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Akhra
[2012-04-09 14:04:56 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Alawar
[2011-12-18 15:23:25 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\aliasworlds
[2011-01-01 21:07:59 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Amazonia
[2010-12-04 10:47:51 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Anarchy
[2012-07-14 19:14:51 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Anuman
[2010-05-21 16:40:34 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Arkadium
[2010-11-13 11:58:15 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Ashtons. Family Resort
[2010-05-19 20:40:19 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\AutoUpdate
[2012-01-07 17:52:24 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Awem
[2011-05-31 15:35:06 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\AzuazGames
[2010-05-30 15:33:13 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Beat Hazard
[2010-12-30 18:54:58 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\blg
[2010-12-28 10:02:53 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Boolat Games
[2011-02-07 17:22:46 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Boomzap
[2010-07-07 16:07:18 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Braintonik
[2011-02-02 14:02:46 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Camel101
[2012-01-06 12:06:24 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Casual Arts
[2011-05-17 17:25:04 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Casual Mechanics
[2012-06-07 20:25:41 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\CasualForge
[2012-01-05 11:13:46 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\cerasus.media
[2010-11-03 18:24:13 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\CobiMobi
[2011-08-23 08:48:25 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Cream Software
[2012-01-16 18:03:50 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\DieselPuppet
[2010-11-29 17:25:05 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Divo Games
[2011-05-21 06:03:18 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Dying for Daylight
[2011-05-21 06:03:51 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Dying for Daylight Shared
[2012-02-07 17:56:22 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\EfrenStudios
[2012-01-10 20:54:10 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\EnchantedCavern2
[2010-12-28 15:18:06 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Enlightenus_iWin
[2011-01-03 18:18:36 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Flood Light Games
[2011-02-17 14:11:40 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Floodlight Games
[2010-12-15 15:27:50 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\FloodLightGames
[2010-07-21 22:12:34 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\FlowPlay
[2011-06-30 17:34:09 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\FlyingPigGameStudio
[2010-12-24 13:40:43 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Freeze Tag
[2010-12-31 22:58:53 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Freezetag
[2011-06-27 17:21:16 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Friday's games
[2012-01-26 19:08:55 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\funkitron
[2012-01-25 12:37:34 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Funlinker
[2011-04-07 17:25:04 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Gadu-Gadu 10
[2010-07-19 09:06:49 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Gaijin Ent
[2012-02-02 14:57:26 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\GameHouse
[2011-02-23 22:34:54 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\GameInvest
[2011-06-06 15:44:03 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Gamers Digital
[2010-12-23 14:33:00 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\GamersDigital
[2010-12-27 18:33:36 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Games
[2011-07-14 21:54:32 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\GanymedeNet
[2011-06-07 17:45:26 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\GestaltGames
[2011-03-20 17:17:57 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\GetRightToGo
[2010-10-05 20:15:33 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\GHISLER
[2012-07-14 20:03:58 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\go
[2010-07-13 08:08:42 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Gold Casual Games
[2011-07-31 18:33:24 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Green Clover Games
[2012-06-03 19:25:25 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\gtk-2.0
[2011-06-23 11:01:28 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\GuardiansOfMagic
[2012-06-16 18:20:35 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Happy Artist Studio
[2010-06-03 20:40:39 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Happyville__
[2012-03-28 17:39:16 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\HCM Updater
[2011-06-16 21:03:14 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\HdO Adventure
[2011-05-16 09:53:23 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\HitPoint Studios
[2011-05-11 12:35:27 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Hoyle Card Games
[2011-05-11 12:15:00 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Hoyle FaceCreator
[2012-01-13 17:06:09 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\iMaxGen
[2010-06-14 16:47:51 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\iWin
[2012-01-17 12:51:11 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\iWing
[2012-01-12 09:56:47 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\JaiboGames
[2010-11-15 16:50:21 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Jane s Hotel  Family Hero
[2012-04-20 21:53:24 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Jane s Hotel 3
[2011-03-02 20:37:14 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Jewel Keepers Easter Island
[2012-01-17 18:37:09 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Jewel Match 3
[2010-11-26 18:49:47 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\JewelMatch2
[2010-05-22 02:17:09 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Kamerzysta
[2011-02-04 19:22:35 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\KingArthur
[2012-01-25 14:14:26 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Kutawaves Game
[2011-05-05 20:51:45 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Ladia Group
[2010-12-29 17:29:25 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\LaJangada
[2012-06-19 19:57:11 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\LegacyGames
[2011-05-25 17:00:52 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Legends of pirates
[2011-09-17 17:09:12 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Little Worlds Online
[2010-12-07 12:42:58 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Lonely Troops
[2010-07-20 16:48:43 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Ludia
[2012-01-21 17:52:01 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\md studio
[2011-07-21 14:25:41 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Meridian93
[2011-02-16 18:13:50 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Merscom
[2012-01-23 09:37:34 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\MumboJumbo
[2011-06-25 04:25:48 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\My Games
[2011-06-28 15:44:20 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Mystery of Mortlake Mansion
[2010-12-26 14:31:58 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\MysteryStudio
[2010-06-25 15:06:27 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Namco
[2012-04-02 11:10:22 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\NEC Projector User Supportware
[2011-05-27 09:37:25 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\NevoSoft Games
[2011-02-21 17:11:33 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Oberon Media
[2009-12-25 06:51:40 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\OpenFM
[2010-04-27 18:55:32 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\OpenOffice.org
[2011-07-07 19:03:43 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\OtherSide Realm of Eons
[2010-12-10 10:56:33 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Paige Harper and the Tome of Mystery
[2011-07-17 20:32:39 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\PathToSuccess
[2011-12-17 13:09:45 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Ph03nixNewMedia
[2011-01-25 18:00:17 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Pi Eye Games
[2011-07-22 13:04:52 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\PlayFirst
[2010-11-25 17:43:48 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Playrix Entertainment
[2012-04-02 10:49:07 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\PolyVision
[2010-07-23 16:57:01 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\PTV Game
[2011-07-02 20:40:25 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Quirky Games
[2012-01-22 14:26:06 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Rainbow
[2011-10-29 22:57:56 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\RenPy
[2011-05-04 20:24:53 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\RobinsonCrusoeWT
[2012-01-17 19:03:05 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Sahmon Games
[2010-08-29 20:49:10 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\ScreenSeven
[2012-05-01 11:23:18 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Shopping Blocks
[2011-06-18 09:33:27 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Silverback Productions
[2012-01-20 16:01:06 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\SMIGames
[2011-06-25 14:03:52 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\SpinTop Games
[2011-05-16 16:48:57 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\SprillBermudeEng
[2011-08-22 14:47:51 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\SquareLogic
[2011-07-28 11:43:08 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Stand O'Food 3
[2011-05-23 12:54:20 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Striped Arts
[2011-01-28 11:01:33 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\SulusGames
[2011-05-25 09:25:29 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Supermarket Mania 2
[2010-11-12 12:08:05 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Tandem Games
[2010-05-29 20:19:10 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\The Inquisitor
[2010-12-26 11:36:03 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\TimeMachine
[2011-05-27 18:30:08 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\TOMI2.THE GATES OF FATE
[2011-05-16 11:11:03 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\TOMI3
[2011-02-21 10:54:12 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Total Eclipse
[2010-05-26 15:45:45 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Trio
[2011-02-19 10:45:59 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\URSE Games
[2010-12-15 10:35:58 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\Valusoft
[2012-07-02 16:46:13 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\VoipDiscount
[2012-06-23 09:42:03 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\VSO
[2012-05-01 21:11:55 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\WeatherLord
[2011-05-19 16:40:01 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\WhiteBirdsProductions
[2012-06-07 20:03:51 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\WildTangent
[2010-11-21 12:24:45 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\WildTangent Janes Realty2
[2010-07-07 11:27:04 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\WildTangentv1000
[2010-07-17 11:50:14 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\WildTangentv1001
[2011-05-28 08:51:31 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\WildTangentv1002
[2010-07-02 21:10:33 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\WildTangentv1005
[2009-12-14 05:25:42 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\WinBatch
[2011-05-13 20:07:47 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\World-LooM
[2012-06-03 14:46:25 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\XNote Stopwatch
[2012-06-23 09:39:16 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\XnView
[2011-11-06 18:16:27 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\YoudaGames
[2012-05-04 11:45:20 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\YourFileDownloader
[2010-11-27 19:00:28 | 000,000,000 | ---D | M] -- C:\Users\Marysia\AppData\Roaming\ZEMNOTT
[2012-07-08 11:17:12 | 000,000,350 | ---- | M] () -- C:\windows\Tasks\At1.job
[2012-07-14 20:19:22 | 000,000,350 | -H-- | M] () -- C:\windows\Tasks\avast! Emergency Update.job
[2012-01-25 18:29:08 | 000,032,644 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
 
[color=#E56717]========== Purity Check ==========[/color]
 
 
 
[color=#E56717]========== Alternate Data Streams ==========[/color]
 
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:D1B5B4F1
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:FB647F34

< End of report >