OTL logfile created on: 2012-07-31 16:25:30 - Run 3
OTL by OldTimer - Version 3.2.55.0     Folder = F:\
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19120)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
 
1,99 Gb Total Physical Memory | 1,64 Gb Available Physical Memory | 82,32% Memory free
4,21 Gb Paging File | 4,02 Gb Available in Paging File | 95,58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,22 Gb Total Space | 20,65 Gb Free Space | 27,82% Space Free | Partition Type: NTFS
Drive D: | 74,83 Gb Total Space | 45,24 Gb Free Space | 60,46% Space Free | Partition Type: NTFS
Drive F: | 3,73 Gb Total Space | 1,29 Gb Free Space | 34,68% Space Free | Partition Type: FAT32
 
Computer Name: USER-PC | User Name: User | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - [2012-07-29 13:04:04 | 000,597,504 | ---- | M] (OldTimer Tools) -- F:\OTL.exe
PRC - [2009-04-11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
[color=#E56717]========== Modules (No Company Name) ==========[/color]
 
 
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
 
SRV - File not found [Disabled | Stopped] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
SRV - [2011-04-06 16:40:00 | 000,694,864 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfeeScanAndRepair\McAfeeScanRepairSvc.exe -- (McAfee ScanAndRepair Svc)
SRV - [2010-11-16 15:37:38 | 000,264,704 | ---- | M] () [Auto | Stopped] -- C:\ProgramData\DataCardService\HWDeviceService.exe -- (HWDeviceService.exe)
SRV - [2008-10-24 20:27:40 | 000,069,632 | ---- | M] (France Telecom SA) [Auto | Stopped] -- C:\Program Files\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe -- (FTRTSVC)
SRV - [2008-02-15 18:25:34 | 000,102,400 | ---- | M] (IDT, Inc.) [Auto | Stopped] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\stacsv.exe -- (STacSV)
SRV - [2008-01-21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007-09-20 15:31:10 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) [Auto | Stopped] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\AEstSrv.exe -- (AESTFilters)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\BCM42RLY.sys -- (BCM42RLY)
DRV - [2011-05-07 16:07:25 | 000,243,152 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2010-10-09 14:48:36 | 000,072,576 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_jubusenum.sys -- (huawei_enumerator)
DRV - [2010-08-27 13:53:46 | 000,116,736 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbnet.sys -- (ewusbnet)
DRV - [2010-08-07 17:48:42 | 000,106,880 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2010-07-27 09:52:02 | 000,102,784 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV - [2010-07-19 23:21:04 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2010-06-03 13:58:38 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Stopped] -- C:\Windows\System32\drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2008-10-14 12:07:48 | 000,103,936 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV - [2008-10-14 12:07:48 | 000,103,936 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnmeaext.sys -- (ZTEusbnmeaext)
DRV - [2008-10-14 12:07:48 | 000,103,936 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV - [2008-10-14 12:07:48 | 000,103,936 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV - [2008-02-15 18:27:02 | 000,330,752 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2007-06-06 23:21:32 | 000,111,616 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService)
DRV - [2007-03-21 22:02:04 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007-02-24 14:42:22 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2007-01-23 16:40:20 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3847399528-368483531-3802800962-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
IE - HKU\S-1-5-21-3847399528-368483531-3802800962-1000\..\SearchScopes,DefaultScope = {F215995D-5368-41A7-92E9-1AB609DAF577}
IE - HKU\S-1-5-21-3847399528-368483531-3802800962-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3847399528-368483531-3802800962-1000\..\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}: "URL" = http://toolbar.ask.com/toolbarv/askRedirect?gct=&gc=1&q={searchTerms}&crm=1&toolbar=UT2
IE - HKU\S-1-5-21-3847399528-368483531-3802800962-1000\..\SearchScopes\{F215995D-5368-41A7-92E9-1AB609DAF577}: "URL" = http://www.google.com/search?hl=pl&q={searchTerms}&rlz=
IE - HKU\S-1-5-21-3847399528-368483531-3802800962-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
[color=#E56717]========== FireFox ==========[/color]
 
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012-02-25 10:12:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012-03-12 13:49:31 | 000,000,000 | ---D | M]
 
[2011-11-01 20:51:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Extensions
[2012-05-17 22:06:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\1gsoir39.default\extensions
[2011-11-01 20:51:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012-02-25 10:12:14 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012-02-25 10:12:07 | 000,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml
[2012-02-25 10:12:07 | 000,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml
[2012-02-25 10:12:07 | 000,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml
[2012-02-25 10:12:07 | 000,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml
[2012-02-25 10:12:07 | 000,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml
[2012-02-25 10:12:07 | 000,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml
 
O1 HOSTS File: ([2011-12-25 00:17:59 | 000,000,732 | -H-- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3847399528-368483531-3802800962-1000..\Run: [Gadu-Gadu 10] C:\Program Files\Gadu-Gadu 10\gg.exe (GG Network S.A.)
O4 - HKU\S-1-5-21-3847399528-368483531-3802800962-1000..\Run: [HW_OPENEYE_OUC_] C:\Program Files\PLAY ONLINE\UpdateDog\ouc.exe (Huawei Technologies Co., Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 0
O7 - HKU\S-1-5-21-3847399528-368483531-3802800962-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFolderOptions = 1
O7 - HKU\S-1-5-21-3847399528-368483531-3802800962-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 89.108.195.20 89.108.202.20
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{415F0B2C-E25E-485E-A62E-4B8BE9AA6E1B}: DhcpNameServer = 89.108.195.20 217.17.34.10
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{74C67B51-0E96-482F-BC6D-E8DFE35842D1}: DhcpNameServer = 77.242.236.7 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C4628635-E8F0-4147-89D1-181F1D6BCCF5}: DhcpNameServer = 89.108.195.20 217.17.34.10
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D934FD0F-9075-47FE-8D5F-4A94B7932948}: DhcpNameServer = 89.108.202.21 89.108.195.21
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EE77523C-9AC7-4566-A7E9-533D5CCD4821}: DhcpNameServer = 89.108.195.20 89.108.202.20
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F55F9FB0-9E45-4CDD-96D0-5817BEAFCD3B}: DhcpNameServer = 89.108.195.20 89.108.202.20
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\User\AppData\Roaming\Microsoft\Windows Photo Gallery\Tapeta z Galerii fotografii systemu Windows.jpg
O24 - Desktop BackupWallPaper: C:\Users\User\AppData\Roaming\Microsoft\Windows Photo Gallery\Tapeta z Galerii fotografii systemu Windows.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012-07-31 08:46:55 | 000,000,007 | -HS- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{26e323a5-7ed0-11e0-b2c5-001e101f8aaa}\Shell - "" = AutoRun
O33 - MountPoints2\{26e323a5-7ed0-11e0-b2c5-001e101f8aaa}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{31e44b24-1ceb-11e0-bf38-001fe15dc88a}\Shell - "" = AutoRun
O33 - MountPoints2\{31e44b24-1ceb-11e0-bf38-001fe15dc88a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{42e7ec42-1a9a-11e0-88aa-001fe15dc88a}\Shell - "" = AutoRun
O33 - MountPoints2\{42e7ec42-1a9a-11e0-88aa-001fe15dc88a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{42e7ec45-1a9a-11e0-88aa-001fe15dc88a}\Shell - "" = AutoRun
O33 - MountPoints2\{42e7ec45-1a9a-11e0-88aa-001fe15dc88a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{42e7ec50-1a9a-11e0-88aa-001fe15dc88a}\Shell - "" = AutoRun
O33 - MountPoints2\{42e7ec50-1a9a-11e0-88aa-001fe15dc88a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{4e482514-bb64-11e1-8a06-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{4e482514-bb64-11e1-8a06-806e6f6e6963}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{594fcaa4-24d8-11e0-85f8-00219bcbba8a}\Shell - "" = AutoRun
O33 - MountPoints2\{594fcaa4-24d8-11e0-85f8-00219bcbba8a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{6e474e45-1e81-11e0-8485-001fe15dc88a}\Shell - "" = AutoRun
O33 - MountPoints2\{6e474e45-1e81-11e0-8485-001fe15dc88a}\Shell\AutoRun\command - "" = F:\AutoRunCardDetector.exe
O33 - MountPoints2\{7166ac47-1ff7-11e0-8796-00219bcbba8a}\Shell - "" = AutoRun
O33 - MountPoints2\{7166ac47-1ff7-11e0-8796-00219bcbba8a}\Shell\AutoRun\command - "" = H:\AutoRun.exe
O33 - MountPoints2\{7166ac59-1ff7-11e0-8796-00219bcbba8a}\Shell - "" = AutoRun
O33 - MountPoints2\{7166ac59-1ff7-11e0-8796-00219bcbba8a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{7166ac5b-1ff7-11e0-8796-00219bcbba8a}\Shell - "" = AutoRun
O33 - MountPoints2\{7166ac5b-1ff7-11e0-8796-00219bcbba8a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{7166ac6a-1ff7-11e0-8796-00219bcbba8a}\Shell - "" = AutoRun
O33 - MountPoints2\{7166ac6a-1ff7-11e0-8796-00219bcbba8a}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{7d7b41fd-508c-11e0-b066-00219bcbba8a}\Shell - "" = AutoRun
O33 - MountPoints2\{7d7b41fd-508c-11e0-b066-00219bcbba8a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{826569ac-1a9b-11e0-99cf-00219bcbba8a}\Shell - "" = AutoRun
O33 - MountPoints2\{826569ac-1a9b-11e0-99cf-00219bcbba8a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{826569ad-1a9b-11e0-99cf-00219bcbba8a}\Shell - "" = AutoRun
O33 - MountPoints2\{826569ad-1a9b-11e0-99cf-00219bcbba8a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{826569af-1a9b-11e0-99cf-00219bcbba8a}\Shell - "" = AutoRun
O33 - MountPoints2\{826569af-1a9b-11e0-99cf-00219bcbba8a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{8527161b-6089-11e0-b4a4-001e101f36d9}\Shell - "" = AutoRun
O33 - MountPoints2\{8527161b-6089-11e0-b4a4-001e101f36d9}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{9071d1b9-9926-11e0-a11e-001e101f36d9}\Shell - "" = AutoRun
O33 - MountPoints2\{9071d1b9-9926-11e0-a11e-001e101f36d9}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{9dc68021-79fd-11e0-b6a0-001e101f63cf}\Shell - "" = AutoRun
O33 - MountPoints2\{9dc68021-79fd-11e0-b6a0-001e101f63cf}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{ab529fed-607d-11e0-8fa0-001fe15dc88a}\Shell - "" = AutoRun
O33 - MountPoints2\{ab529fed-607d-11e0-8fa0-001fe15dc88a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{abe39d66-474f-11e0-9d27-00219bcbba8a}\Shell - "" = AutoRun
O33 - MountPoints2\{abe39d66-474f-11e0-9d27-00219bcbba8a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{b6552244-4f19-11e0-8230-001fe15dc88a}\Shell - "" = AutoRun
O33 - MountPoints2\{b6552244-4f19-11e0-8230-001fe15dc88a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{d0b5dea0-56a0-11df-bad0-00219bcbba8a}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\explore.exe
O33 - MountPoints2\{e9198278-c3a6-11de-92c8-001fe15dc88a}\Shell - "" = AutoRun
O33 - MountPoints2\{e9198278-c3a6-11de-92c8-001fe15dc88a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{ef26c55b-c719-11e0-a9d4-001e101f57d0}\Shell - "" = AutoRun
O33 - MountPoints2\{ef26c55b-c719-11e0-a9d4-001e101f57d0}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{f21fbcff-24b7-11e0-913e-00219bcbba8a}\Shell - "" = AutoRun
O33 - MountPoints2\{f21fbcff-24b7-11e0-913e-00219bcbba8a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2012-07-31 08:20:38 | 000,000,000 | ---D | C] -- C:\_OTL
[2012-07-31 08:18:06 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\Bron.tok-10-31
[2012-07-30 16:42:20 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012-07-30 16:42:19 | 000,000,000 | --SD | C] -- C:\32788R22FWJFW
[2012-07-30 16:41:50 | 004,722,436 | R--- | C] (Swearware) -- C:\Users\User\Desktop\ComboFix.exe
[2012-07-30 16:39:44 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\Bron.tok-10-30
[2012-07-29 13:07:32 | 000,597,504 | ---- | C] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2012-07-31 16:30:13 | 000,680,254 | ---- | M] () -- C:\Windows\System32\perfh015.dat
[2012-07-31 16:30:13 | 000,607,768 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012-07-31 16:30:13 | 000,138,992 | ---- | M] () -- C:\Windows\System32\perfc015.dat
[2012-07-31 16:30:13 | 000,111,392 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012-07-31 16:23:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012-07-31 08:46:55 | 000,000,007 | -HS- | M] () -- C:\autoexec.bat
[2012-07-31 08:26:44 | 000,000,460 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{A983AF70-9B0F-42B5-86CB-C0E3BAC03196}.job
[2012-07-31 08:22:34 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012-07-31 08:22:34 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012-07-30 16:39:58 | 004,722,436 | R--- | M] (Swearware) -- C:\Users\User\Desktop\ComboFix.exe
[2012-07-29 13:04:16 | 000,302,592 | ---- | M] () -- C:\Users\User\Desktop\i1cukpc2.exe
[2012-07-29 13:04:04 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe
[2012-07-12 22:14:55 | 000,077,312 | ---- | M] () -- C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012-07-04 08:33:00 | 192,863,358 | ---- | M] () -- C:\Windows\MEMORY.DMP
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2012-07-29 13:07:32 | 000,302,592 | ---- | C] () -- C:\Users\User\Desktop\i1cukpc2.exe
[2011-08-21 22:51:11 | 000,246,272 | ---- | C] () -- C:\Windows\unrar.exe
[2011-08-21 22:48:27 | 000,000,000 | ---- | C] () -- C:\Windows\loader2.exe_ok
[2010-11-21 19:57:34 | 000,369,753 | ---- | C] () -- C:\Users\User\krs_form_wf.rtf
[2009-11-03 18:00:43 | 000,077,312 | ---- | C] () -- C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-10-23 15:24:41 | 000,000,680 | ---- | C] () -- C:\Users\User\AppData\Local\d3d9caps.dat
 
[color=#E56717]========== LOP Check ==========[/color]
 
[2010-10-20 17:30:09 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\BitTorrent
[2012-02-22 22:59:26 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Gadu-Gadu 10
[2011-11-26 20:15:15 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Lite
[2010-02-28 20:59:33 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\OpenFM
[2011-04-22 21:52:48 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\PLAY ONLINE
[2009-10-23 16:08:08 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\TMP
[2010-05-30 19:08:43 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\uTorrent
[2012-07-30 20:36:22 | 000,032,564 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012-07-31 08:26:44 | 000,000,460 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{A983AF70-9B0F-42B5-86CB-C0E3BAC03196}.job
 
[color=#E56717]========== Purity Check ==========[/color]
 
 

< End of report >