OTL logfile created on: 2012-07-22 12:15:50 - Run 3 OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\Gregorio\Documents\Downloads Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1,99 Gb Total Physical Memory | 1,57 Gb Available Physical Memory | 79,10% Memory free 4,21 Gb Paging File | 3,94 Gb Available in Paging File | 93,61% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 69,65 Gb Total Space | 16,38 Gb Free Space | 23,53% Space Free | Partition Type: NTFS Drive D: | 69,64 Gb Total Space | 31,26 Gb Free Space | 44,89% Space Free | Partition Type: NTFS Computer Name: GREGORIO-PC | User Name: Gregorio | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: All users Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2012-07-21 00:10:06 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Gregorio\Documents\Downloads\OTL.exe PRC - [2009-04-11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2008-09-10 20:36:50 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Auto | Stopped] -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon -- (CLTNetCnService) SRV - [2010-02-19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2009-06-02 10:10:08 | 000,637,952 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2008-02-05 18:22:36 | 000,141,848 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\logishrd\SrvLnch\SrvLnch.exe -- (LVSrvLauncher) SRV - [2008-02-05 18:20:42 | 000,150,040 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv) SRV - [2008-02-05 18:18:48 | 000,186,904 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\logishrd\LVCOMSER\LVComSer.exe -- (LVCOMSer) SRV - [2008-01-19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008-01-19 09:36:49 | 000,365,568 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm) SRV - [2008-01-19 09:36:15 | 000,167,936 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr) SRV - [2007-12-10 10:23:02 | 000,024,576 | ---- | M] () [Auto | Stopped] -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe -- (eSettingsService) SRV - [2007-10-30 18:45:48 | 000,167,936 | ---- | M] (acer) [Auto | Stopped] -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe -- (WMIService) SRV - [2007-09-10 15:28:18 | 000,057,344 | ---- | M] (Acer Inc.) [Auto | Stopped] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService) SRV - [2007-06-13 16:54:36 | 000,135,168 | R--- | M] (Acer Inc.) [Auto | Stopped] -- C:\Acer\Empowering Technology\eNet\eNet Service.exe -- (eNet Service) SRV - [2007-04-25 16:34:30 | 000,457,512 | ---- | M] (HiTRSUT) [Auto | Stopped] -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe -- (eDataSecurity Service) SRV - [2007-03-21 13:00:04 | 000,355,096 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R) SRV - [2006-11-24 12:57:54 | 000,107,008 | ---- | M] () [Auto | Stopped] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService) SRV - [2005-09-30 19:22:50 | 000,096,341 | ---- | M] (Canon Inc.) [Auto | Stopped] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - [2009-10-10 00:41:20 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd) DRV - [2009-01-13 09:45:00 | 000,954,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2008-11-11 11:00:00 | 000,876,112 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Symantec\Definitions\VirusDefs\20081208.003\NAVEX15.SYS -- (NAVEX15) DRV - [2008-11-11 11:00:00 | 000,089,104 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Symantec\Definitions\VirusDefs\20081208.003\NAVENG.SYS -- (NAVENG) DRV - [2008-09-12 09:33:24 | 000,270,384 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\ProgramData\Symantec\Definitions\SymcData\idsdefs\20081205.001\IDSvix86.sys -- (IDSvix86) DRV - [2008-09-10 17:07:19 | 000,123,952 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent) DRV - [2008-09-09 10:00:00 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl) DRV - [2008-09-09 10:00:00 | 000,099,376 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv) DRV - [2008-08-26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2008-02-06 04:21:25 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta) DRV - [2008-02-06 04:20:40 | 000,628,760 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS) DRV - [2008-02-06 04:17:37 | 002,570,520 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI) DRV - [2008-02-06 04:17:26 | 000,013,848 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lv302af.sys -- (pepifilter) DRV - [2008-02-05 18:20:08 | 000,025,624 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon) DRV - [2008-02-05 18:18:12 | 000,689,176 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Lvckap.sys -- (LVcKap) DRV - [2008-01-10 03:34:43 | 000,005,120 | ---- | M] (Samsung Electronics) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\SSPORT.SYS -- (SSPORT) DRV - [2008-01-10 03:34:42 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\DGIVECP.SYS -- (DgiVecp) DRV - [2007-11-30 23:57:12 | 000,317,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\srtspl.sys -- (SRTSPL) DRV - [2007-11-30 23:57:12 | 000,279,088 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\srtsp.sys -- (SRTSP) DRV - [2007-11-30 23:57:12 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\srtspx.sys -- (SRTSPX) DRV - [2007-11-30 15:51:34 | 000,015,392 | ---- | M] (Acer, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\int15.sys -- (int15) DRV - [2007-05-02 13:52:00 | 000,290,816 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tifm21.sys -- (tifm21) DRV - [2006-11-29 02:44:52 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio) DRV - [2006-11-02 09:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD) DRV - [2006-11-02 09:30:54 | 001,781,760 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Sterownik karty Intel(R) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://pl.intl.acer.yahoo.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = IE - HKLM\..\SearchScopes,DefaultScope = {93474F44-C419-41A5-B812-AB41D5B7A6F5} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{93474F44-C419-41A5-B812-AB41D5B7A6F5}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://global.acer.com [binary data] IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://global.acer.com [binary data] IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2582580472-3220378888-3125756241-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie IE - HKU\S-1-5-21-2582580472-3220378888-3125756241-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKU\S-1-5-21-2582580472-3220378888-3125756241-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search IE - HKU\S-1-5-21-2582580472-3220378888-3125756241-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 IE - HKU\S-1-5-21-2582580472-3220378888-3125756241-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/news/ IE - HKU\S-1-5-21-2582580472-3220378888-3125756241-1003\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-2582580472-3220378888-3125756241-1003\..\SearchScopes,DefaultScope = {93474F44-C419-41A5-B812-AB41D5B7A6F5} IE - HKU\S-1-5-21-2582580472-3220378888-3125756241-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-2582580472-3220378888-3125756241-1003\..\SearchScopes\{93474F44-C419-41A5-B812-AB41D5B7A6F5}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_en IE - HKU\S-1-5-21-2582580472-3220378888-3125756241-1003\..\SearchScopes\{A29308D8-AEED-45FA-9635-1C32A06F2F0C}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 IE - HKU\S-1-5-21-2582580472-3220378888-3125756241-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2582580472-3220378888-3125756241-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultengine: "" FF - prefs.js..browser.search.defaultenginename: "" FF - prefs.js..browser.search.order.1: "" FF - prefs.js..browser.search.selectedEngine: "" FF - prefs.js..browser.startup.homepage: "" FF - prefs.js..network.proxy.no_proxies_on: "*.local" FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-11-03 23:34:22 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.28\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012-04-05 16:56:57 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.28\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012-07-22 11:50:26 | 000,000,000 | ---D | M] [2010-12-19 13:06:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Gregorio\AppData\Roaming\mozilla\Extensions [2012-07-20 18:15:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Gregorio\AppData\Roaming\mozilla\Firefox\Profiles\2wtg5zl7.default\extensions [2010-12-19 13:14:36 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Gregorio\AppData\Roaming\mozilla\Firefox\Profiles\2wtg5zl7.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-12-19 13:04:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2012-03-29 20:38:06 | 000,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml [2012-03-29 20:38:06 | 000,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml [2012-03-29 20:38:06 | 000,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml [2012-03-29 20:38:06 | 000,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml [2012-03-29 20:38:06 | 000,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml [2012-03-29 20:38:06 | 000,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml [color=#E56717]========== Chrome ==========[/color] CHR - default_search_provider: Google () CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms} CHR - homepage: http://www.google.pl/ O1 HOSTS File: ([2006-09-18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST) O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST) O3 - HKU\S-1-5-21-2582580472-3220378888-3125756241-1003\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST) O3 - HKU\S-1-5-21-2582580472-3220378888-3125756241-1003\..\Toolbar\WebBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST) O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe (HiTRUST) O4 - HKLM..\Run: [eRecoveryService] File not found O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation) O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe () O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe () O4 - HKLM..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.) O4 - HKLM..\Run: [TkBellExe] c:\program files\real\realplayer\Update\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-2582580472-3220378888-3125756241-1003..\Run: [Gadu-Gadu 10] C:\Program Files\Gadu-Gadu 10\gg.exe (GG Network S.A.) O4 - HKU\S-1-5-21-2582580472-3220378888-3125756241-1003..\RunOnce: [Report] C:\AdwCleaner[S1].txt () O4 - Startup: C:\Users\Gregorio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = File not found O7 - HKU\S-1-5-21-2582580472-3220378888-3125756241-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 00 00 00 [binary data] O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O13 - gopher Prefix: missing O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.49.46.1 193.138.140.6 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{369B9055-FA2D-4191-9735-6B534E8F6CE4}: DhcpNameServer = 212.49.46.1 193.138.140.6 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5CC00B90-C6F0-47E8-AA76-8517B41B4D72}: DhcpNameServer = 212.49.46.1 193.138.140.6 193.138.140.5 O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Gregorio\AppData\Roaming\Microsoft\Windows Photo Gallery\Tapeta z Galerii fotografii systemu Windows.jpg O24 - Desktop BackupWallPaper: C:\Users\Gregorio\AppData\Roaming\Microsoft\Windows Photo Gallery\Tapeta z Galerii fotografii systemu Windows.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006-09-18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{45253df3-ce07-11dd-873d-806e6f6e6963}\Shell\AutoRun\command - "" = G:\USBNB.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2012-07-22 11:50:22 | 000,000,000 | ---D | C] -- C:\_OTL [2012-07-20 17:30:36 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{6AB4994C-0B2C-48E9-B47B-B9C366025ABD} [2012-07-20 17:28:05 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{815DB108-65C5-4E5E-8EB9-7897C1A6CFC5} [2012-07-19 21:13:48 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{BB6EB44E-E970-4CBB-A49F-1EDEC2518F5D} [2012-07-19 21:11:16 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{3304B45D-5DCE-46F8-B70C-20D454E63B67} [2012-07-18 17:06:17 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{F561C9BF-E025-429E-864A-675C7030BDA9} [2012-07-18 17:03:43 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{530C89A5-1EF0-454C-A2A0-8C988F2C9572} [2012-07-17 19:16:36 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{CEC915FB-0CE8-43F5-BB8B-6E585A519E63} [2012-07-16 22:37:34 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{0031AF9C-098D-49DC-A4A1-B373EAE5A51A} [2012-07-16 22:35:04 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{513AD77D-E9CA-4D4E-A554-16BA5E436A40} [2012-07-15 19:25:52 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{12C0CD37-F784-4DC1-A047-1DA3EB748E11} [2012-07-15 19:23:16 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{E23F23B9-4806-4C38-9DE0-D8BB9204AAB7} [2012-07-14 08:12:10 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{DF95889D-5D98-4C5D-8A91-EB37C5A1FB46} [2012-07-14 08:09:38 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{231EE1D3-A896-490F-B34F-004E362615F7} [2012-07-13 20:06:54 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{14191F7B-DCD3-40FA-8DBF-3E1BF1EF9D32} [2012-07-13 20:04:23 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{7354DC24-8FB5-4F46-AFCC-8251BF0D80FF} [2012-07-12 15:57:32 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{A422C4FF-A4BB-4DF4-8C91-711E82FDBFC2} [2012-07-12 15:54:58 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{63F36181-6DB5-4510-A9DC-34737FD269D6} [2012-07-11 22:10:07 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{1B95C6CC-7326-4B09-A5FB-4B252DE31E8B} [2012-07-10 21:41:00 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{211D426E-39B7-406F-94E4-72A59C94C044} [2012-07-10 21:38:19 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{2352C422-8BB4-42A3-AA5F-5320DD1BC748} [2012-07-09 21:37:07 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{F94FE320-4741-4627-BDAD-502E73BD9256} [2012-07-08 18:41:45 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{0F2232FE-79D3-4372-A692-8E9267D0DBA2} [2012-07-08 18:39:12 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{8674F36D-DA18-42D5-9084-19AD45AA31D5} [2012-07-08 06:36:17 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{609433EF-A83A-4477-8A4B-C384802E8892} [2012-07-08 06:33:48 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{598F6BF9-E372-4043-9A22-8970F79491B0} [2012-07-07 14:22:17 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{E80799A7-DD8B-4D4F-9542-93CD9B98D139} [2012-07-07 14:19:31 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{2C6FB255-B725-4319-A8AC-58F322911A2B} [2012-07-06 17:40:03 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{480F119A-C41F-42E0-9FE5-E4C61F443B19} [2012-07-06 17:37:31 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{33617ED7-523C-4ABC-B5AD-D00C11698C32} [2012-07-05 18:00:45 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{03C675BA-9599-454F-8D98-AADDC5CAB98C} [2012-07-05 17:58:13 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{1F9E18FD-F724-4AC3-8476-E25E6AC3EC5B} [2012-07-04 18:06:32 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{8BEA39EA-36B6-4989-B630-0BA851227B9B} [2012-07-04 18:04:00 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{99881124-C8EE-4F89-B006-2710D1B99582} [2012-07-03 21:02:23 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{7FACE27D-BD58-456C-8537-CC4A738B654F} [2012-07-03 20:59:51 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{BE30441B-155E-4B8A-8C36-C9D44D75987C} [2012-06-30 18:39:30 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{12793B5C-284D-4ABC-8929-AFBEA76DA129} [2012-06-30 18:36:58 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{66D6ACC9-96FD-4C12-AD67-9EECEFDEC210} [2012-06-30 10:15:18 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{AF0D157B-6D1A-4770-A350-5E22BA1C5047} [2012-06-30 10:12:48 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{7A5052BA-252B-471E-B344-08002985D6AE} [2012-06-29 22:12:20 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{4E08E577-1FC3-4308-92D4-F821BC8B0807} [2012-06-29 22:11:58 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{507C5671-F836-4F9E-A14D-2A52D7A719AA} [2012-06-29 10:09:10 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{C15E57F4-11A1-49A9-B032-EC802ACD672F} [2012-06-29 10:06:38 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{8870005D-22AD-4B52-89BC-4170580CC12D} [2012-06-28 17:13:44 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{AD5686C9-0120-4104-9C6F-18D244B9C636} [2012-06-28 17:11:12 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{016F6F17-9B99-4C1C-B6F7-B9E69CD7E67B} [2012-06-28 00:27:44 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\Macromedia [2012-06-27 17:36:13 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{8A5F45E7-844F-43B1-871A-A1A4EDDCD614} [2012-06-27 17:33:41 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{F0ED0657-C5C1-4174-AF68-D07E72520C0D} [2012-06-26 17:23:36 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{0C3E074F-E4FC-4B26-AB58-DE367C8A635F} [2012-06-26 17:21:03 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{8896A4BF-AC79-446D-B499-9B4C84A99B42} [2012-06-25 16:43:38 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{83AFB837-461E-433F-84B6-0110A60E22E7} [2012-06-25 16:41:04 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{E45F9CC8-3686-47EC-8C67-4019025768CC} [2012-06-24 23:05:32 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{09AA1235-7688-4238-92AF-1E60B55DDB69} [2012-06-24 23:02:59 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{BBCACAE4-03A9-4D31-A6FD-B6A37EA7C432} [2012-06-23 09:11:28 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{F4F4295A-D168-4A28-BA00-C58B18FBD9D3} [2012-06-23 09:08:56 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{777D530F-1AA9-4E84-9741-608CF02FD393} [2012-06-22 18:02:34 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{61071813-794A-4B49-BEC8-816BDB1A95DE} [2012-06-22 17:59:56 | 000,000,000 | ---D | C] -- C:\Users\Gregorio\AppData\Local\{3DF914EA-B522-4C97-B2E9-953056989410} [2002-03-11 11:06:30 | 001,822,520 | ---- | C] (Microsoft Corporation) -- C:\Users\Gregorio\instmsiw.exe [2002-03-11 10:45:04 | 001,708,856 | ---- | C] (Microsoft Corporation) -- C:\Users\Gregorio\instmsia.exe [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2012-07-22 12:12:38 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012-07-22 12:09:33 | 000,001,356 | ---- | M] () -- C:\Users\Gregorio\AppData\Local\d3d9caps.dat [2012-07-22 11:44:04 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012-07-22 11:44:04 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012-07-21 11:51:13 | 099,946,175 | ---- | M] () -- C:\Windows\MEMORY.DMP [2012-07-21 10:58:00 | 000,001,040 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012-07-21 10:44:34 | 000,001,036 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012-07-21 00:19:52 | 000,678,394 | ---- | M] () -- C:\Windows\System32\perfh015.dat [2012-07-21 00:19:52 | 000,601,806 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012-07-21 00:19:52 | 000,133,276 | ---- | M] () -- C:\Windows\System32\perfc015.dat [2012-07-21 00:19:52 | 000,106,418 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012-07-12 15:52:46 | 003,949,704 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012-06-29 22:49:08 | 000,001,742 | ---- | M] () -- C:\Users\Gregorio\Desktop\Goa_apres — skrót.lnk [color=#E56717]========== Files Created - No Company Name ==========[/color] [2011-11-11 21:46:34 | 000,017,408 | ---- | C] () -- C:\Users\Gregorio\AppData\Local\WebpageIcons.db [2011-07-11 21:42:33 | 000,001,456 | ---- | C] () -- C:\Users\Gregorio\AppData\Local\Adobe Save for Web 12.0 Prefs [2011-01-14 21:52:36 | 000,258,048 | ---- | C] () -- C:\Windows\System32\libFLAC.dll [2009-04-29 17:43:47 | 000,692,744 | ---- | C] () -- C:\Users\Gregorio\AppData\Local\unins000.exe [2009-04-29 17:43:47 | 000,004,430 | ---- | C] () -- C:\Users\Gregorio\AppData\Local\unins000.dat [2009-01-21 18:14:40 | 009,780,224 | ---- | C] () -- C:\Users\Gregorio\openofficeorg30.msi [2008-12-23 04:28:01 | 000,001,356 | ---- | C] () -- C:\Users\Gregorio\AppData\Local\d3d9caps.dat [2008-12-17 12:17:14 | 000,426,776 | ---- | C] () -- C:\Users\Gregorio\setup.exe [2008-10-01 23:03:38 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2008-09-10 16:27:08 | 000,049,152 | ---- | C] () -- C:\Users\Gregorio\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [color=#E56717]========== LOP Check ==========[/color] [2011-01-15 20:53:19 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\.ABC [2008-09-14 09:09:05 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\Canon [2009-10-10 14:42:41 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\DAEMON Tools [2009-10-10 15:02:35 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\DAEMON Tools Lite [2009-10-10 14:42:41 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\DAEMON Tools Pro [2009-04-29 17:40:52 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\e-Deklaracje.A1909296681C7ACEFE45687D3A64758C8659BF46.1 [2008-10-01 23:10:56 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\eMule [2008-09-10 18:01:42 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\Gadu-Gadu [2010-03-29 19:53:54 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\Gadu-Gadu 10 [2012-04-14 21:40:04 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\ipla [2008-10-06 12:50:57 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\Leadertech [2009-10-31 17:50:23 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\My Games [2009-10-22 19:09:56 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\Nokia [2009-03-09 17:20:04 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\Nowe Gadu-Gadu [2009-11-10 18:59:05 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\OpenFM [2008-10-14 21:29:30 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\OpenOffice.org [2009-10-22 19:10:03 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\PC Suite [2010-02-13 13:50:35 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\Publish Providers [2008-11-06 14:11:21 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\Qualcomm [2010-02-13 13:50:24 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\Sony [2011-02-28 22:06:09 | 000,000,000 | ---D | M] -- C:\Users\Gregorio\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2012-07-22 11:44:12 | 000,032,544 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:D1B5B4F1 @Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:92412C7B < End of report >