OTL logfile created on: 2012-07-26 01:52:32 - Run 1 OTL by OldTimer - Version 3.2.54.1 Folder = C:\Users\euro\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 3,93 Gb Total Physical Memory | 2,35 Gb Available Physical Memory | 59,71% Memory free 7,87 Gb Paging File | 6,06 Gb Available in Paging File | 77,02% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 451,07 Gb Total Space | 117,50 Gb Free Space | 26,05% Space Free | Partition Type: NTFS Computer Name: DANIEL | User Name: euro | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2012-07-26 01:42:31 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\euro\Desktop\OTL.exe PRC - [2012-06-15 18:51:19 | 000,874,384 | ---- | M] (Opera Software) -- C:\Program Files (x86)\Opera\opera.exe PRC - [2012-06-15 18:51:19 | 000,800,656 | ---- | M] (Opera Software) -- C:\Program Files (x86)\Opera\pluginwrapper\opera_plugin_wrapper.exe PRC - [2012-06-06 08:16:00 | 000,185,856 | ---- | M] () -- C:\Program Files\Web Assistant\ExtensionUpdaterService.exe PRC - [2012-04-04 14:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012-03-21 12:23:14 | 000,793,048 | ---- | M] (PC Tools) -- C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe PRC - [2011-10-20 14:43:56 | 000,025,464 | ---- | M] (Uniblue Systems Limited) -- C:\Program Files (x86)\Uniblue\DriverScanner\dsmonitor.exe PRC - [2011-02-02 14:08:16 | 000,018,656 | ---- | M] () -- C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe PRC - [2009-09-30 20:01:32 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2009-09-30 20:01:30 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe PRC - [2009-07-22 14:52:12 | 002,384,896 | ---- | M] () -- C:\Program Files (x86)\STMicroelectronics\Accelerometer\FF_Protection.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2012-06-06 08:15:52 | 000,162,816 | ---- | M] () -- C:\Program Files\Web Assistant\Extension32.dll MOD - [2012-05-25 10:20:02 | 008,797,856 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll MOD - [2009-07-22 14:52:12 | 002,384,896 | ---- | M] () -- C:\Program Files (x86)\STMicroelectronics\Accelerometer\FF_Protection.exe [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV:[b]64bit:[/b] - [2012-06-06 08:16:00 | 000,185,856 | ---- | M] () [Auto | Running] -- C:\Program Files\Web Assistant\ExtensionUpdaterService.exe -- (Web Assistant Updater) SRV:[b]64bit:[/b] - [2012-02-14 21:18:33 | 001,431,888 | ---- | M] (Flexera Software, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64) SRV:[b]64bit:[/b] - [2010-01-22 09:01:12 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:[b]64bit:[/b] - [2010-01-20 21:10:00 | 000,244,736 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\stacsv64.exe -- (STacSV) SRV:[b]64bit:[/b] - [2009-11-02 12:48:18 | 000,126,352 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost) SRV:[b]64bit:[/b] - [2009-08-18 03:09:52 | 000,868,128 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- c:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins) SRV:[b]64bit:[/b] - [2009-07-17 02:06:22 | 000,033,280 | ---- | M] () [Auto | Running] -- C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE -- (wltrysvc) SRV:[b]64bit:[/b] - [2009-07-14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:[b]64bit:[/b] - [2009-03-02 19:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\AESTSr64.exe -- (AESTFilters) SRV - [2012-07-05 21:34:21 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012-06-27 12:29:24 | 002,369,960 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\Hamachi\hamachi-2.exe -- (Hamachi2Svc) SRV - [2012-04-04 14:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012-03-21 12:23:14 | 000,793,048 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe -- (PCToolsSSDMonitorSvc) SRV - [2012-02-12 21:35:12 | 000,481,064 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012-01-18 13:38:28 | 000,155,320 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion) SRV - [2011-04-17 15:41:41 | 000,948,775 | ---- | M] (Crawler.com) [Auto | Running] -- C:\Program Files (x86)\Spyware Terminator\sp_rsser.exe -- (sp_rssrv) SRV - [2011-02-02 14:08:16 | 000,018,656 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe -- (Autodesk Content Service) SRV - [2010-03-18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010-01-20 21:10:00 | 000,244,736 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\STacSV64.exe -- (STacSV) SRV - [2009-09-30 20:01:32 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2009-09-30 20:01:30 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2009-06-23 22:02:42 | 000,060,928 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\STMicroelectronics\Accelerometer\InstallFilterService.exe -- (InstallFilterService) SRV - [2009-06-10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009-03-02 19:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\AESTSr64.exe -- (AESTFilters) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV:[b]64bit:[/b] - [2012-04-04 14:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:[b]64bit:[/b] - [2012-03-05 20:33:01 | 000,042,888 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btcusb.sys -- (Btcsrusb) DRV:[b]64bit:[/b] - [2012-03-05 20:32:38 | 000,076,800 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\risdsne64.sys -- (risdsnpe) DRV:[b]64bit:[/b] - [2012-03-05 20:29:07 | 000,093,712 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:[b]64bit:[/b] - [2012-03-05 18:31:17 | 000,093,696 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimssne64.sys -- (rimspci) DRV:[b]64bit:[/b] - [2012-03-05 18:29:55 | 000,098,344 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio) DRV:[b]64bit:[/b] - [2012-03-05 18:29:44 | 000,021,288 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid) DRV:[b]64bit:[/b] - [2012-03-05 18:29:38 | 000,132,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt) DRV:[b]64bit:[/b] - [2012-03-01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:[b]64bit:[/b] - [2011-12-03 12:03:23 | 000,279,616 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV:[b]64bit:[/b] - [2011-10-25 16:35:20 | 000,027,176 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggsemc.sys -- (ggsemc) DRV:[b]64bit:[/b] - [2011-10-25 16:35:20 | 000,013,352 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggflt.sys -- (ggflt) DRV:[b]64bit:[/b] - [2011-10-25 16:31:04 | 000,034,032 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\seehcri.sys -- (seehcri) DRV:[b]64bit:[/b] - [2011-09-02 21:29:54 | 000,019,936 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdrvio.sys -- (pwdrvio) DRV:[b]64bit:[/b] - [2011-09-02 21:29:52 | 000,013,280 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdspio.sys -- (pwdspio) DRV:[b]64bit:[/b] - [2011-06-10 05:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:[b]64bit:[/b] - [2011-03-11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:[b]64bit:[/b] - [2011-03-11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:[b]64bit:[/b] - [2010-11-20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:[b]64bit:[/b] - [2010-11-20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:[b]64bit:[/b] - [2010-11-09 15:35:24 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\cpuz135_x64.sys -- (cpuz135) DRV:[b]64bit:[/b] - [2010-07-07 10:26:46 | 000,050,696 | ---- | M] (Windows (R) Win 7 DDK provider) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\stflt.sys -- (sp_rsdrv2) DRV:[b]64bit:[/b] - [2010-01-22 09:13:24 | 006,233,088 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag) DRV:[b]64bit:[/b] - [2010-01-22 09:13:24 | 006,233,088 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag) DRV:[b]64bit:[/b] - [2010-01-22 08:07:56 | 000,161,280 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:[b]64bit:[/b] - [2010-01-20 21:10:00 | 000,505,856 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA) DRV:[b]64bit:[/b] - [2009-11-02 12:48:02 | 000,013,784 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB) DRV:[b]64bit:[/b] - [2009-09-30 02:34:32 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV:[b]64bit:[/b] - [2009-09-17 05:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) DRV:[b]64bit:[/b] - [2009-08-24 04:20:22 | 000,285,744 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:[b]64bit:[/b] - [2009-07-24 07:13:02 | 000,023,912 | ---- | M] (ST Microelectronics) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Acceler.sys -- (Acceler) DRV:[b]64bit:[/b] - [2009-07-23 18:57:48 | 000,018,792 | ---- | M] (ST Microelectronics) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stdflt.sys -- (stdflt) DRV:[b]64bit:[/b] - [2009-07-17 02:06:20 | 000,022,520 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bcm42rly.sys -- (BCM42RLY) DRV:[b]64bit:[/b] - [2009-07-17 02:06:16 | 002,769,400 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX) DRV:[b]64bit:[/b] - [2009-07-14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:[b]64bit:[/b] - [2009-07-14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:[b]64bit:[/b] - [2009-07-14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:[b]64bit:[/b] - [2009-07-09 09:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:[b]64bit:[/b] - [2009-07-04 12:27:02 | 000,055,808 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rixdpe64.sys -- (rixdpcie) DRV:[b]64bit:[/b] - [2009-07-01 11:31:58 | 000,080,896 | ---- | M] (REDC) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\risdpe64.sys -- (risdpcie) DRV:[b]64bit:[/b] - [2009-06-25 10:04:20 | 000,067,584 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rimmpx64.sys -- (rimmptsk) DRV:[b]64bit:[/b] - [2009-06-25 09:38:52 | 000,057,856 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rixdpx64.sys -- (rismxdp) DRV:[b]64bit:[/b] - [2009-06-25 09:13:44 | 000,055,296 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rimspx64.sys -- (rimsptsk) DRV:[b]64bit:[/b] - [2009-06-15 19:06:42 | 000,172,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt) DRV:[b]64bit:[/b] - [2009-06-10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:[b]64bit:[/b] - [2009-06-10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:[b]64bit:[/b] - [2009-06-10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:[b]64bit:[/b] - [2009-06-10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:[b]64bit:[/b] - [2009-04-07 08:33:08 | 000,035,104 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap) DRV:[b]64bit:[/b] - [2009-03-18 17:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi) DRV - [2009-07-14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1036494683-2414142033-743646022-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www1.euro.dell.com/content/default.aspx?c=pl&l=pl&s=pad IE - HKU\S-1-5-21-1036494683-2414142033-743646022-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://isearch.avg.com/?cid={8BE9BDF7-9704-4073-97C3-8A8A0054DCE4}&mid=1475733ab94947d0bbfb2104e4a5b14c-86eae9a32db71099dd19801d5e96803a7ff27065&lang=pl&ds=gm011&pr=sa&d=2012-05-18 17:15:42&v=11.1.0.7&sap=hp IE - HKU\S-1-5-21-1036494683-2414142033-743646022-1000\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233} IE - HKU\S-1-5-21-1036494683-2414142033-743646022-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-1036494683-2414142033-743646022-1000\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = http://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 IE - HKU\S-1-5-21-1036494683-2414142033-743646022-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={8BE9BDF7-9704-4073-97C3-8A8A0054DCE4}&mid=1475733ab94947d0bbfb2104e4a5b14c-86eae9a32db71099dd19801d5e96803a7ff27065&lang=pl&ds=gm011&pr=sa&d=2012-05-18 17:15:42&v=11.1.0.7&sap=dsp&q={searchTerms} IE - HKU\S-1-5-21-1036494683-2414142033-743646022-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredibar.com/mb165/?search={searchTerms}&loc=IB_DS&a=6OyFtfDytq&i=26 IE - HKU\S-1-5-21-1036494683-2414142033-743646022-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultenginename: "MyStart Search" FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search" FF - prefs.js..browser.search.update: false FF - prefs.js..browser.startup.homepage: "google.pl" FF - prefs.js..keyword.URL: "http://isearch.avg.com/search?cid=%7Ba1d17fa3-5e7f-4f90-b4d6-4134285767c6%7D&mid=1475733ab94947d0bbfb2104e4a5b14c-86eae9a32db71099dd19801d5e96803a7ff27065&ds=gm011&v=11.1.0.7&lang=pl&pr=sa&d=2012-05-18%2017%3A15%3A42&sap=ku&q=" FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF - HKLM\Software\MozillaPlugins\@ganymede/GanymedeNetPlugin,version=1.0: C:\Program Files (x86)\Ganymede\Plugins\npganymedenet.dll ( ) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.0.61118.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX [2012-06-20 01:19:11 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-04-17 17:59:25 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012-06-20 01:19:11 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012-07-05 21:34:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012-05-24 16:48:43 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-04-17 17:59:25 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{C524CDBF-C6C8-11E1-8270-B8AC6F996F26}: C:\Users\euro\AppData\Local\{C524CDBF-C6C8-11E1-8270-B8AC6F996F26}\ [2012-07-05 18:42:15 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012-07-05 21:34:21 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012-05-24 16:48:43 | 000,000,000 | ---D | M] [2011-04-21 22:02:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\euro\AppData\Roaming\mozilla\Extensions [2012-06-20 01:19:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\euro\AppData\Roaming\mozilla\Firefox\Profiles\3p6e8ms9.default\extensions [2012-03-05 13:01:12 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\euro\AppData\Roaming\mozilla\Firefox\Profiles\3p6e8ms9.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011-05-31 13:12:33 | 000,000,000 | ---D | M] (British English Dictionary) -- C:\Users\euro\AppData\Roaming\mozilla\Firefox\Profiles\3p6e8ms9.default\extensions\en-GB@dictionaries.addons.mozilla.org [2012-06-20 01:19:17 | 000,000,000 | ---D | M] (incredibar.com) -- C:\Users\euro\AppData\Roaming\mozilla\Firefox\Profiles\3p6e8ms9.default\extensions\ffxtlbr@incredibar.com [2012-06-20 01:19:08 | 000,002,203 | ---- | M] () -- C:\Users\euro\AppData\Roaming\Mozilla\Firefox\Profiles\3p6e8ms9.default\searchplugins\MyStart Search.xml [2012-07-25 10:51:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012-07-25 10:51:31 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2012-06-20 01:19:11 | 000,000,000 | ---D | M] (Web Assistant) -- C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX [2012-07-05 18:42:15 | 000,000,000 | ---D | M] (Mozilla Safe Browsing) -- C:\USERS\EURO\APPDATA\LOCAL\{C524CDBF-C6C8-11E1-8270-B8AC6F996F26} [2012-07-05 21:34:21 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011-03-21 08:22:04 | 001,680,272 | ---- | M] (Caminova, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdjvu.dll [2011-04-06 10:43:28 | 000,120,296 | ---- | M] ( ) -- C:\Program Files (x86)\mozilla firefox\plugins\npganymedenet.dll [2012-03-06 14:49:04 | 000,002,767 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\allegro-pl.xml [2012-05-18 16:15:37 | 000,003,749 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml [2012-03-06 14:49:04 | 000,001,406 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fbc-pl.xml [2011-04-17 14:56:30 | 000,002,048 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml [2012-03-06 14:49:04 | 000,000,917 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\merlin-pl.xml [2012-03-06 14:49:04 | 000,000,858 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\pwn-pl.xml [2012-03-06 14:49:04 | 000,001,183 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-pl.xml [2012-03-06 14:49:04 | 000,001,683 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wp-pl.xml [color=#E56717]========== Chrome ==========[/color] CHR - homepage: http://isearch.avg.com/?cid={8BE9BDF7-9704-4073-97C3-8A8A0054DCE4}&mid=1475733ab94947d0bbfb2104e4a5b14c-86eae9a32db71099dd19801d5e96803a7ff27065&lang=pl&ds=gm011&pr=sa&d=2012-05-18 17:15:42&v=11.1.0.7&sap=hp CHR - default_search_provider: MyStart Search () CHR - default_search_provider: search_url = http://mystart.incredibar.com/mb165/?loc=IB_DS&search={searchTerms}&a=6OyFtfDytq&i=26 CHR - default_search_provider: suggest_url = CHR - homepage: http://isearch.avg.com/?cid={8BE9BDF7-9704-4073-97C3-8A8A0054DCE4}&mid=1475733ab94947d0bbfb2104e4a5b14c-86eae9a32db71099dd19801d5e96803a7ff27065&lang=pl&ds=gm011&pr=sa&d=2012-05-18 17:15:42&v=11.1.0.7&sap=hp CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll CHR - plugin: DjVu Plugin Viewer (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdjvu.dll CHR - plugin: GanymedeNet.Detector (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npganymedenet.dll CHR - plugin: AVG SiteSafety plugin (Enabled) = C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\\npsitesafety.dll CHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: Java(TM) Platform SE 7 U1 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.0.61118.0\npctrl.dll CHR - Extension: Web Assistant = C:\Users\euro\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.458_0\ O1 HOSTS File: ([2009-06-10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:[b]64bit:[/b] - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension64.dll () O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension32.dll () O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office12\GR469A~1.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:[b]64bit:[/b] - HKLM..\Run: [Broadcom Wireless Manager UI] C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE (Dell Inc.) O4:[b]64bit:[/b] - HKLM..\Run: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\Accelerometer\FF_Protection.exe () O4:[b]64bit:[/b] - HKLM..\Run: [QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.) O4:[b]64bit:[/b] - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.) O4 - HKLM..\Run: [] File not found O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-1036494683-2414142033-743646022-1000..\Run: [hlamp] C:\Users\euro\AppData\Roaming\hlamp.dll (DT Soft Ltd) O4 - HKU\S-1-5-21-1036494683-2414142033-743646022-1000..\Run: [pescpl] C:\Users\euro\AppData\Roaming\pescpl.dll (M-Audio) O4 - HKU\S-1-5-21-1036494683-2414142033-743646022-1000..\Run: [tusvig] C:\Users\euro\AppData\Roaming\tusvig.dll (M-Audio) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKU\S-1-5-21-1036494683-2414142033-743646022-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149 O8:[b]64bit:[/b] - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found O8:[b]64bit:[/b] - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\euro\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8:[b]64bit:[/b] - Extra context menu item: Wyślij obraz do urządzenia &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8:[b]64bit:[/b] - Extra context menu item: Wyślij stronę do urządzenia &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\euro\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Wyślij obraz do urządzenia &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Wyślij stronę do urządzenia &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9:[b]64bit:[/b] - Extra Button: @c:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9:[b]64bit:[/b] - Extra 'Tools' menuitem : @c:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: Wyślij do interfejsu Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Wyślij do urządzenia &Bluetooth... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O13[b]64bit:[/b] - gopher Prefix: missing O13 - gopher Prefix: missing O16:[b]64bit:[/b] - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16:[b]64bit:[/b] - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16:[b]64bit:[/b] - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 10.1.0) O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.7.0_01) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4EC7A2D5-4D45-494B-A704-B048447AECF4}: DhcpNameServer = 194.168.4.100 194.168.8.100 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C952BDEF-2995-48D2-B54F-4D597C7C73E5}: DhcpNameServer = 62.121.0.2 195.54.225.10 O18:[b]64bit:[/b] - Protocol\Handler\grooveLocalGWS - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\ms-help - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\ms-itss - No CLSID value found O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~2\Office12\GRA32A~1.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\SYSTEM32\Userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~2\Office12\GR469A~1.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{5eac4580-fee0-11e0-9bb7-f04da24158bf}\Shell - "" = AutoRun O33 - MountPoints2\{5eac4580-fee0-11e0-9bb7-f04da24158bf}\Shell\AutoRun\command - "" = G:\Startme.exe O33 - MountPoints2\{6c4311be-7106-11e0-8425-c44619e001cf}\Shell - "" = AutoRun O33 - MountPoints2\{6c4311be-7106-11e0-8425-c44619e001cf}\Shell\AutoRun\command - "" = E:\setup.exe O33 - MountPoints2\{a3a8c704-429c-11e1-8b01-f04da24158bf}\Shell - "" = AutoRun O33 - MountPoints2\{a3a8c704-429c-11e1-8b01-f04da24158bf}\Shell\AutoRun\command - "" = F:\SETUP.EXE O33 - MountPoints2\{b6273eac-1d94-11e1-86a1-f04da24158bf}\Shell - "" = AutoRun O33 - MountPoints2\{b6273eac-1d94-11e1-86a1-f04da24158bf}\Shell\AutoRun\command - "" = E:\SETUP.EXE O33 - MountPoints2\{f1157f3d-cd6a-11e0-88fd-b8ac6f683578}\Shell - "" = AutoRun O33 - MountPoints2\{f1157f3d-cd6a-11e0-88fd-b8ac6f683578}\Shell\AutoRun\command - "" = F:\SETUP.EXE O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\Startme.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %* O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2012-07-26 01:42:31 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\euro\Desktop\OTL.exe [2012-07-26 01:38:14 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012-07-26 01:38:14 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012-07-26 01:38:13 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012-07-26 01:38:13 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012-07-26 01:38:12 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012-07-26 01:38:12 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012-07-26 01:38:12 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2012-07-26 01:38:12 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2012-07-26 01:38:11 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012-07-26 01:38:10 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2012-07-26 01:38:10 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012-07-26 01:38:10 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012-07-26 01:38:10 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012-07-26 01:37:19 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll [2012-07-26 01:37:17 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll [2012-07-26 01:37:17 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll [2012-07-26 01:37:16 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll [2012-07-26 01:37:16 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll [2012-07-26 01:19:31 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\catroot2 [2012-07-26 01:04:22 | 000,181,064 | ---- | C] (Sysinternals) -- C:\Windows\PSEXESVC.EXE [2012-07-26 01:03:46 | 000,381,816 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\Windows\SysNative\PsExec.exe [2012-07-26 00:04:35 | 001,101,824 | ---- | C] (Woodbury Associates Limited) -- C:\Windows\SysWow64\UniBox210.ocx [2012-07-26 00:04:35 | 000,880,640 | ---- | C] (Woodbury Associates Limited) -- C:\Windows\SysWow64\UniBox10.ocx [2012-07-26 00:04:35 | 000,212,992 | ---- | C] (Woodbury Associates Limited) -- C:\Windows\SysWow64\UniBoxVB12.ocx [2012-07-26 00:04:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Tools Registry Mechanic [2012-07-26 00:04:34 | 000,512,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml.dll [2012-07-25 23:27:01 | 000,556,968 | ---- | C] (Helge Klein) -- C:\Windows\SetACL.exe [2012-07-25 16:23:41 | 000,482,304 | ---- | C] (M-Audio) -- C:\Users\euro\AppData\Roaming\pescpl.dll [2012-07-25 10:51:26 | 000,214,408 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe [2012-07-25 10:51:25 | 000,173,960 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe [2012-07-25 10:51:25 | 000,173,960 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe [2012-07-24 22:21:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Windows Genuine Advantage [2012-07-24 21:00:36 | 000,000,000 | ---D | C] -- C:\Users\euro\AppData\Roaming\Registry Mechanic [2012-07-24 19:57:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PC Tools [2012-07-24 19:57:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PC Tools [2012-07-24 19:57:43 | 000,000,000 | ---D | C] -- C:\Users\euro\AppData\Roaming\Product_RM [2012-07-24 19:57:43 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools [2012-07-16 19:56:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack [2012-07-09 10:07:35 | 000,417,792 | ---- | C] (M-Audio) -- C:\Users\euro\AppData\Roaming\tusvig.dll [2012-07-05 18:49:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi [2012-07-05 18:49:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Hamachi [2012-07-05 18:44:22 | 000,000,000 | -HSD | C] -- C:\Windows\SysNative\%APPDATA% [2012-07-05 18:42:15 | 000,000,000 | ---D | C] -- C:\Users\euro\AppData\Local\{C524CDBF-C6C8-11E1-8270-B8AC6F996F26} [2012-07-05 18:42:14 | 000,385,024 | ---- | C] (Voyetra Turtle Beach, Inc.) -- C:\Users\euro\AppData\Roaming\wpsnsc.dll [2012-07-05 18:41:09 | 000,000,000 | ---D | C] -- C:\ProgramData\99058D65000094D100012309B4EB2367 [2012-07-05 18:41:08 | 000,131,584 | -HS- | C] (DT Soft Ltd) -- C:\Users\euro\AppData\Roaming\hlamp.dll [2012-07-05 18:41:08 | 000,000,000 | ---D | C] -- C:\Users\euro\AppData\Local\MS [2012-06-29 17:08:16 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\DAEMON Tools Images [2012-06-29 16:46:52 | 000,106,496 | ---- | C] (Blizzard Entertainment) -- C:\Windows\DIIUnin.exe [2012-06-29 16:32:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Diablo II [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2012-07-26 02:02:00 | 000,001,044 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012-07-26 01:53:45 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012-07-26 01:53:45 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012-07-26 01:52:45 | 001,663,484 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012-07-26 01:52:45 | 000,738,208 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat [2012-07-26 01:52:45 | 000,652,376 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012-07-26 01:52:45 | 000,154,864 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat [2012-07-26 01:52:45 | 000,121,308 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012-07-26 01:47:01 | 000,000,300 | ---- | M] () -- C:\Windows\tasks\RMAutoUpdate.job [2012-07-26 01:46:49 | 000,001,040 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012-07-26 01:46:45 | 000,000,338 | ---- | M] () -- C:\Windows\tasks\DriverScanner.job [2012-07-26 01:46:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012-07-26 01:46:08 | 000,500,184 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012-07-26 01:45:09 | 3168,165,888 | -HS- | M] () -- C:\hiberfil.sys [2012-07-26 01:42:31 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\euro\Desktop\OTL.exe [2012-07-26 01:04:22 | 000,181,064 | ---- | M] (Sysinternals) -- C:\Windows\PSEXESVC.EXE [2012-07-26 01:00:37 | 000,006,416 | ---- | M] () -- C:\BITSWin7.reg [2012-07-26 00:17:03 | 000,000,302 | ---- | M] () -- C:\Windows\tasks\RMSchedule.job [2012-07-26 00:15:37 | 005,476,352 | ---- | M] () -- C:\Users\euro\s-1-5-21-1036494683-2414142033-743646022-1000.rrr [2012-07-26 00:04:35 | 000,001,347 | ---- | M] () -- C:\Users\Public\Desktop\PC Tools Registry Mechanic.lnk [2012-07-25 16:23:42 | 000,482,304 | ---- | M] (M-Audio) -- C:\Users\euro\AppData\Roaming\pescpl.dll [2012-07-24 19:05:51 | 173,721,600 | ---- | M] () -- C:\Users\euro\Desktop\Windows-7-64-bit-Repair-Disc.iso [2012-07-22 17:36:50 | 000,556,968 | ---- | M] (Helge Klein) -- C:\Windows\SetACL.exe [2012-07-17 18:42:38 | 000,000,011 | R--- | M] () -- C:\Windows\amunres.lsl [2012-07-17 00:13:25 | 000,209,544 | ---- | M] () -- C:\Users\euro\Desktop\GeneratePDFTickets.pdf [2012-07-12 00:54:37 | 226,105,094 | ---- | M] () -- C:\Users\euro\Desktop\Cristiano Ronaldo - Granice Ludzkich MoĹĽliwoĹ›ci.avi.webm [2012-07-09 10:07:53 | 000,417,792 | ---- | M] (M-Audio) -- C:\Users\euro\AppData\Roaming\tusvig.dll [2012-07-07 11:34:18 | 000,007,597 | ---- | M] () -- C:\Users\euro\AppData\Local\Resmon.ResmonCfg [2012-07-05 19:12:17 | 000,048,030 | ---- | M] () -- C:\Users\euro\Desktop\CV Daniel Gawlowski.rtf [2012-07-05 18:42:15 | 000,385,024 | ---- | M] (Voyetra Turtle Beach, Inc.) -- C:\Users\euro\AppData\Roaming\wpsnsc.dll [2012-07-05 18:41:27 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012-07-05 18:41:27 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012-07-05 18:41:00 | 000,131,584 | -HS- | M] (DT Soft Ltd) -- C:\Users\euro\AppData\Roaming\hlamp.dll [2012-06-29 17:44:17 | 000,040,830 | ---- | M] () -- C:\Windows\DIIUnin.dat [2012-06-29 17:40:52 | 000,002,279 | ---- | M] () -- C:\Users\euro\Desktop\D2 LOD.lnk [2012-06-29 17:29:24 | 000,021,840 | ---- | M] () -- C:\Windows\SysWow64\SIntfNT.dll [2012-06-29 17:29:24 | 000,017,212 | ---- | M] () -- C:\Windows\SysWow64\SIntf32.dll [2012-06-29 17:29:24 | 000,012,067 | ---- | M] () -- C:\Windows\SysWow64\SIntf16.dll [2012-06-29 16:46:52 | 000,106,496 | ---- | M] (Blizzard Entertainment) -- C:\Windows\DIIUnin.exe [2012-06-29 16:46:52 | 000,002,829 | ---- | M] () -- C:\Windows\DIIUnin.pif [2012-06-28 13:47:45 | 003,259,546 | ---- | M] () -- C:\Users\euro\Desktop\Ćwiczenie nr 8,9,10,11,12,13,14,16.pdf [2012-06-28 13:46:44 | 001,419,870 | ---- | M] () -- C:\Users\euro\Desktop\Ćwiczenie nr 1,2,3.pdf [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2012-07-26 01:00:37 | 000,006,416 | ---- | C] () -- C:\BITSWin7.reg [2012-07-26 00:04:48 | 000,000,302 | ---- | C] () -- C:\Windows\tasks\RMSchedule.job [2012-07-26 00:04:44 | 000,000,300 | ---- | C] () -- C:\Windows\tasks\RMAutoUpdate.job [2012-07-26 00:04:35 | 000,001,347 | ---- | C] () -- C:\Users\Public\Desktop\PC Tools Registry Mechanic.lnk [2012-07-26 00:04:34 | 000,040,408 | ---- | C] () -- C:\Windows\SysNative\CleanMFT64.exe [2012-07-24 21:09:07 | 005,476,352 | ---- | C] () -- C:\Users\euro\s-1-5-21-1036494683-2414142033-743646022-1000.rrr [2012-07-24 18:56:13 | 173,721,600 | ---- | C] () -- C:\Users\euro\Desktop\Windows-7-64-bit-Repair-Disc.iso [2012-07-17 18:42:38 | 000,000,011 | R--- | C] () -- C:\Windows\amunres.lsl [2012-07-17 00:13:25 | 000,209,544 | ---- | C] () -- C:\Users\euro\Desktop\GeneratePDFTickets.pdf [2012-07-13 09:56:20 | 000,016,896 | ---- | C] () -- C:\Users\euro\AppData\Local\{f5ce5a49-3400-f769-2a0a-d3cdcda7ac68}\U\80000000.@ [2012-07-13 09:56:18 | 000,001,696 | ---- | C] () -- C:\Users\euro\AppData\Local\{f5ce5a49-3400-f769-2a0a-d3cdcda7ac68}\U\00000001.@ [2012-07-11 22:14:27 | 226,105,094 | ---- | C] () -- C:\Users\euro\Desktop\Cristiano Ronaldo - Granice Ludzkich MoĹĽliwoĹ›ci.avi.webm [2012-07-05 18:41:11 | 000,022,016 | ---- | C] () -- C:\Windows\Installer\{f5ce5a49-3400-f769-2a0a-d3cdcda7ac68}\U\800000cb.@ [2012-07-05 18:41:11 | 000,016,896 | ---- | C] () -- C:\Windows\Installer\{f5ce5a49-3400-f769-2a0a-d3cdcda7ac68}\U\80000000.@ [2012-07-05 18:41:11 | 000,001,696 | ---- | C] () -- C:\Windows\Installer\{f5ce5a49-3400-f769-2a0a-d3cdcda7ac68}\U\00000001.@ [2012-06-29 17:29:41 | 000,002,279 | ---- | C] () -- C:\Users\euro\Desktop\D2 LOD.lnk [2012-06-29 17:29:24 | 000,021,840 | ---- | C] () -- C:\Windows\SysWow64\SIntfNT.dll [2012-06-29 17:29:24 | 000,017,212 | ---- | C] () -- C:\Windows\SysWow64\SIntf32.dll [2012-06-29 17:29:24 | 000,012,067 | ---- | C] () -- C:\Windows\SysWow64\SIntf16.dll [2012-06-29 16:46:53 | 000,040,830 | ---- | C] () -- C:\Windows\DIIUnin.dat [2012-06-29 16:46:52 | 000,002,829 | ---- | C] () -- C:\Windows\DIIUnin.pif [2012-06-28 13:47:14 | 003,259,546 | ---- | C] () -- C:\Users\euro\Desktop\Ćwiczenie nr 8,9,10,11,12,13,14,16.pdf [2012-06-28 13:46:38 | 001,419,870 | ---- | C] () -- C:\Users\euro\Desktop\Ćwiczenie nr 1,2,3.pdf [2012-06-26 21:00:59 | 000,048,030 | ---- | C] () -- C:\Users\euro\Desktop\CV Daniel Gawlowski.rtf [2012-06-04 18:27:39 | 000,210,032 | ---- | C] () -- C:\Windows\SysWow64\DBCLIENT.DLL [2012-03-05 21:41:18 | 000,000,001 | ---- | C] () -- C:\Users\euro\AppData\Local\llftool.4.12.agreement [2012-03-05 21:38:54 | 000,010,588 | ---- | C] () -- C:\Windows\SysWow64\drivers\mpfilt.sys [2012-02-14 21:19:37 | 000,000,153 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc [2012-02-14 21:09:41 | 001,639,622 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012-01-11 17:45:42 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{f5ce5a49-3400-f769-2a0a-d3cdcda7ac68}\@ [2012-01-11 17:45:42 | 000,002,048 | -HS- | C] () -- C:\Users\euro\AppData\Local\{f5ce5a49-3400-f769-2a0a-d3cdcda7ac68}\@ [2011-10-14 20:13:00 | 000,000,000 | ---- | C] () -- C:\Users\euro\AppData\Local\{86B0A446-14A2-424D-A4E8-FB4417117EB9} [2011-09-09 19:52:20 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll [2011-07-29 00:46:54 | 000,001,035 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011-05-24 23:44:26 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll [2011-05-09 13:45:25 | 000,007,597 | ---- | C] () -- C:\Users\euro\AppData\Local\Resmon.ResmonCfg [2011-04-17 17:55:18 | 000,172,154 | ---- | C] () -- C:\Windows\hppins20.dat [2011-04-17 17:55:18 | 000,006,259 | ---- | C] () -- C:\Windows\hppmdl20.dat [2011-04-17 15:30:06 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2011-04-17 14:37:33 | 000,000,000 | ---- | C] () -- C:\Users\euro\AppData\Roaming\wklnhst.dat [color=#E56717]========== LOP Check ==========[/color] [2011-12-30 15:39:14 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\.minecraft [2011-07-28 12:16:06 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\Auslogics [2012-02-16 20:15:45 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\Autodesk [2012-07-05 16:54:15 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\BESTplayer [2012-04-09 22:56:10 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\Broad Intelligence [2012-06-29 17:07:44 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\DAEMON Tools Lite [2012-07-26 00:25:01 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\Dropbox [2012-03-05 13:26:55 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\DVDVideoSoft [2012-03-05 17:52:45 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\DVDVideoSoftIEHelpers [2011-04-17 17:52:46 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\EurekaLog [2012-07-25 18:16:51 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\foobar2000 [2011-04-17 17:45:33 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\Foxit Software [2011-10-29 20:00:26 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\GanymedeNet [2011-05-24 19:08:21 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\gtk-2.0 [2011-07-28 11:20:17 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\IObit [2011-07-10 00:56:24 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\Mirillis [2011-12-19 20:06:57 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\NapiProjekt [2011-10-25 16:02:19 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\Notepad++ [2011-09-12 00:04:54 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\Opera [2012-07-24 19:57:43 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\Product_RM [2012-01-15 22:40:20 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\rebol [2012-07-26 00:15:44 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\Registry Mechanic [2012-07-08 09:31:57 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\Spyware Terminator [2011-07-26 12:30:18 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\STV Software [2011-04-17 14:37:35 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\Template [2012-03-05 17:58:01 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\Uniblue [2012-07-20 18:48:05 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\uTorrent [2011-12-11 23:45:26 | 000,000,000 | ---D | M] -- C:\Users\euro\AppData\Roaming\YCanPDF [2012-07-26 01:46:45 | 000,000,338 | ---- | M] () -- C:\Windows\Tasks\DriverScanner.job [2012-07-26 01:47:01 | 000,000,300 | ---- | M] () -- C:\Windows\Tasks\RMAutoUpdate.job [2012-07-26 00:17:03 | 000,000,302 | ---- | M] () -- C:\Windows\Tasks\RMSchedule.job [2012-07-13 09:54:55 | 000,032,604 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 161 bytes -> C:\ProgramData\TEMP:07BF512B @Alternate Data Stream - 154 bytes -> C:\ProgramData\TEMP:D1B5B4F1 < End of report >