OTL logfile created on: 2012-08-10 10:05:11 - Run 3
OTL by OldTimer - Version 3.2.56.0     Folder = C:\Documents and Settings\Adrian Lipa\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000415 | Country: Poland | Language: PLK | Date Format: yyyy-MM-dd
 
2,75 Gb Total Physical Memory | 2,45 Gb Available Physical Memory | 89,20% Memory free
4,60 Gb Paging File | 4,50 Gb Available in Paging File | 97,85% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 39,06 Gb Total Space | 21,79 Gb Free Space | 55,79% Space Free | Partition Type: NTFS
Drive D: | 109,98 Gb Total Space | 5,56 Gb Free Space | 5,06% Space Free | Partition Type: NTFS
 
Computer Name: BHP-D696E675499 | User Name: Adrian Lipa | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - [2012-08-08 11:38:46 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Adrian Lipa\Desktop\OTL.exe
PRC - [2010-07-17 17:01:46 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2008-07-03 13:38:24 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
 
 
[color=#E56717]========== Modules (No Company Name) ==========[/color]
 
MOD - [2009-11-04 02:14:04 | 000,054,272 | ---- | M] () -- C:\Program Files\Notepad++\NppShell_01.dll
MOD - [2006-09-14 01:20:24 | 000,126,464 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
 
 
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
 
SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2012-08-04 09:58:24 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2010-07-17 17:02:24 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2010-05-08 13:48:36 | 000,229,376 | ---- | M] () [Auto | Stopped] -- C:\Documents and Settings\All Users\Application Data\DatacardService\DCService.exe -- (DCService.exe)
SRV - [2009-07-22 17:54:14 | 000,081,920 | ---- | M] (Firebird Project) [Auto | Stopped] -- C:\Program Files\Firebird\bin\fbguard.exe -- (FirebirdGuardianDefaultInstance)
SRV - [2009-07-22 17:53:44 | 002,736,128 | ---- | M] (Firebird Project) [On_Demand | Stopped] -- C:\Program Files\Firebird\bin\fbserver.exe -- (FirebirdServerDefaultInstance)
SRV - [2008-07-17 17:55:00 | 002,549,248 | R--- | M] (Aladdin Knowledge Systems Ltd.) [Auto | Stopped] -- C:\WINDOWS\system32\hasplms.exe -- (hasplms)
SRV - [2007-05-28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Stopped] -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2006-08-04 11:35:54 | 000,217,088 | ---- | M] (VMware, Inc.) [Auto | Stopped] -- C:\Program Files\VMware\VMware Workstation\vmware-authd.exe -- (VMAuthdService)
SRV - [2006-08-04 11:35:52 | 000,135,168 | ---- | M] (VMware, Inc.) [Auto | Stopped] -- C:\WINDOWS\system32\vmnat.exe -- (VMware NAT Service)
SRV - [2006-08-04 11:35:52 | 000,106,496 | ---- | M] (VMware, Inc.) [Auto | Stopped] -- C:\WINDOWS\system32\vmnetdhcp.exe -- (VMnetDHCP)
SRV - [2006-08-04 11:28:58 | 000,262,144 | ---- | M] (VMware, Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe -- (vmount2)
SRV - [2002-08-01 11:22:40 | 000,065,536 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\hpzipm12.exe -- (Pml Driver HPZ12)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\wudfrd.sys -- (WudfRd)
DRV - File not found [Kernel | Boot | Stopped] -- C:\WINDOWS\system32\WudfPf.sys -- (WudfPf)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\UIUSYS.SYS -- (UIUSys)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\PCAMPR5.SYS -- (PCAMPR5)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | Auto | Stopped] --  -- (adfs)
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (a5nz1qle)
DRV - [2011-05-06 20:53:27 | 000,243,152 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2010-11-13 16:01:59 | 000,685,816 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2010-07-17 17:01:47 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2010-06-01 14:07:00 | 000,117,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbnet.sys -- (ewusbnet)
DRV - [2010-05-22 14:48:20 | 000,070,656 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ew_jubusenum.sys -- (huawei_enumerator)
DRV - [2010-03-25 10:08:30 | 000,105,728 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2010-03-20 11:56:04 | 000,101,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV - [2009-11-12 06:14:27 | 000,057,320 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nvhda32.sys -- (NVHDA)
DRV - [2008-04-27 11:52:00 | 001,310,464 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
DRV - [2008-04-22 08:20:04 | 000,737,792 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CHDAU32.sys -- (CnxtHdAudService)
DRV - [2008-03-18 17:19:42 | 000,350,720 | R--- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\aksfridge.sys -- (aksfridge)
DRV - [2008-03-13 15:51:52 | 000,057,536 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ftdibus.sys -- (FTDIBUS)
DRV - [2008-03-13 15:50:02 | 000,072,000 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ftser2k.sys -- (FTSER2K)
DRV - [2008-02-11 18:40:16 | 000,586,240 | R--- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (hardlock)
DRV - [2008-02-08 10:46:36 | 000,057,408 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wsimd.sys -- (WSIMD)
DRV - [2007-09-14 20:31:10 | 000,029,712 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Stopped] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2007-09-11 16:40:30 | 000,238,976 | R--- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\akshasp.sys -- (akshasp)
DRV - [2007-09-11 16:40:30 | 000,046,336 | R--- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\akshhl.sys -- (akshhl)
DRV - [2007-09-11 16:40:30 | 000,014,976 | R--- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\aksusb.sys -- (aksusb)
DRV - [2006-08-04 11:35:56 | 000,023,296 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\vmnetbridge.sys -- (VMnetBridge)
DRV - [2006-08-04 11:35:56 | 000,015,616 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\vmnetuserif.sys -- (VMnetuserif)
DRV - [2006-08-04 11:35:56 | 000,009,600 | R--- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV - [2006-08-04 11:35:54 | 000,022,016 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\hcmon.sys -- (hcmon)
DRV - [2006-08-04 11:35:52 | 000,094,848 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\vmx86.sys -- (vmx86)
DRV - [2006-08-04 11:28:58 | 000,011,520 | ---- | M] (VMware, Inc.) [Kernel | Auto | Stopped] -- C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vstor2.sys -- (vstor2)
DRV - [2003-12-08 21:53:48 | 000,053,600 | ---- | M] (THOMSON) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\alcan5wn.sys -- (alcan5wn)
DRV - [2003-12-08 21:53:46 | 000,070,688 | ---- | M] (THOMSON) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\alcaudsl.sys -- (alcaudsl)
DRV - [2003-08-04 13:22:44 | 000,016,128 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\PCANDIS5.SYS -- (PCANDIS5)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\S-1-5-21-515967899-1993962763-1417001333-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
IE - HKU\S-1-5-21-515967899-1993962763-1417001333-1002\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-515967899-1993962763-1417001333-1002\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\S-1-5-21-515967899-1993962763-1417001333-1002\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/web/{searchTerms}?babsrc=SP_ss&affID=100474&mntrId=e41e467c00000000000000265e49bc29
IE - HKU\S-1-5-21-515967899-1993962763-1417001333-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-515967899-1993962763-1417001333-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
[color=#E56717]========== FireFox ==========[/color]
 
FF - prefs.js..browser.startup.homepage: "http://www.onet.pl/"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.911
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}:1.1
FF - prefs.js..keyword.URL: "http://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=e41e467c00000000000000265e49bc29&tlver=1.4.35.10&affID=100474"
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2007-09-15 11:07:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012-06-19 04:55:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011-06-30 06:56:55 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey\Extensions\\mozilla_cc@internetdownloadmanager.com: C:\Documents and Settings\Adrian Lipa\Application Data\IDM\idmmzcc5
 
[2010-02-19 20:08:20 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Adrian Lipa\Application Data\Mozilla\Extensions
[2009-11-08 22:41:58 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Adrian Lipa\Application Data\Mozilla\Firefox\Profiles\vnss7l20.default\extensions
[2009-11-08 22:41:54 | 000,000,000 | ---D | M] (flashget3 Extension) -- C:\Documents and Settings\Adrian Lipa\Application Data\Mozilla\Firefox\Profiles\vnss7l20.default\extensions\{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}
[2009-11-08 22:41:57 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011-01-20 22:52:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2007-09-15 11:07:48 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG9\FIREFOX
[2011-01-20 22:52:00 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011-01-20 22:51:59 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010-10-22 21:27:30 | 000,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml
[2011-09-08 18:16:27 | 000,002,288 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2010-10-22 21:27:30 | 000,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml
[2010-10-22 21:27:30 | 000,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml
[2010-10-22 21:27:30 | 000,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml
[2010-10-22 21:27:31 | 000,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml
[2010-10-22 21:27:31 | 000,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml
 
O1 HOSTS File: ([2010-10-28 16:27:53 | 000,000,764 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [MDS_Menu] C:\Program Files\Olympus\ib\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] nwiz.exe /installquiet File not found
O4 - HKLM..\Run: [RelevantKnowledge] C:\program files\relevantknowledge\rlvknlg.exe (TMRG,  Inc.)
O4 - HKLM..\Run: [StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe (Hewlett-Packard)
O4 - HKLM..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe (Hewlett-Packard)
O4 - HKLM..\Run: [xzfpgmopevjzyub] C:\Documents and Settings\All Users\Application Data\xzfpgmop.exe (Intel)
O4 - HKU\S-1-5-21-515967899-1993962763-1417001333-1002..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team)
O4 - HKU\S-1-5-21-515967899-1993962763-1417001333-1002..\Run: [Olympus ib] C:\Program Files\Olympus\ib\olycamdetect.exe (OLYMPUS IMAGING CORP.)
O4 - HKU\S-1-5-21-515967899-1993962763-1417001333-1002..\Run: [xzfpgmopevjzyub] C:\Documents and Settings\All Users\Application Data\xzfpgmop.exe (Intel)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware (cleanup)] C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-515967899-1993962763-1417001333-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 00 00 00  [binary data]
O8 - Extra context menu item: ????3?? - Reg Error: Value error. File not found
O8 - Extra context menu item: ????3?????? - Reg Error: Value error. File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: 使用快车3下载 - C:\Documents and Settings\Adrian Lipa\Application Data\FlashGetBHO\GetUrl.htm ()
O8 - Extra context menu item: 使用快车3下载全部链接 - C:\Documents and Settings\Adrian Lipa\Application Data\FlashGetBHO\GetAllUrl.htm ()
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-1_4_0_03-win.cab (Java Plug-in 1.4.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - (avgrsstx.dll) - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop WallPaper: C:\Documents and Settings\Adrian Lipa\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Adrian Lipa\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2011-07-12 19:44:53 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2010-02-09 01:48:16 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{0fa5b884-83e5-11e1-9ff4-00265e49bc29}\Shell\AutoRun\command - "" = I:\12gn6id2.exe
O33 - MountPoints2\{0fa5b884-83e5-11e1-9ff4-00265e49bc29}\Shell\open\Command - "" = I:\12gn6id2.exe
O33 - MountPoints2\{242ecad3-a5a8-11e0-9f23-00265e49bc29}\Shell - "" = AutoRun
O33 - MountPoints2\{242ecad3-a5a8-11e0-9f23-00265e49bc29}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{242ecad3-a5a8-11e0-9f23-00265e49bc29}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a
O33 - MountPoints2\{242ecad4-a5a8-11e0-9f23-00265e49bc29}\Shell\AutoRun\command - "" = lpl.exe
O33 - MountPoints2\{242ecad4-a5a8-11e0-9f23-00265e49bc29}\Shell\open\Command - "" = lpl.exe
O33 - MountPoints2\{35e79aa5-7b45-11e1-9fe6-00265e49bc29}\Shell\AutoRun\command - "" = I:\setupSNK.exe
O33 - MountPoints2\{3ba2508e-dde4-11de-9f73-00265e49bc29}\Shell - "" = AutoRun
O33 - MountPoints2\{3ba2508e-dde4-11de-9f73-00265e49bc29}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3ba2508e-dde4-11de-9f73-00265e49bc29}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{5cb58e08-41ed-11e5-9f3f-00265e49bc29}\Shell - "" = Autorun
O33 - MountPoints2\{5cb58e08-41ed-11e5-9f3f-00265e49bc29}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5cb58e08-41ed-11e5-9f3f-00265e49bc29}\Shell\AutoRun\command - "" = C:\WINDOWS\System32\setup.exe -- [2008-04-14 14:00:00 | 000,023,040 | ---- | M] (Microsoft Corporation)
O33 - MountPoints2\{6d217104-4bf5-11e0-9ec8-00265e49bc29}\Shell\AutoRun\command - "" = I:\et3ypes.exe
O33 - MountPoints2\{6d217104-4bf5-11e0-9ec8-00265e49bc29}\Shell\open\Command - "" = I:\et3ypes.exe
O33 - MountPoints2\{746c9df2-dd28-11e1-a0ba-00265e49bc29}\Shell - "" = AutoRun
O33 - MountPoints2\{746c9df2-dd28-11e1-a0ba-00265e49bc29}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{746c9df2-dd28-11e1-a0ba-00265e49bc29}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{cf53d882-172d-11df-9bfb-000e50affbe0}\Shell\AutoRun\command - "" = G:\Launcher.exe
O33 - MountPoints2\{d4028877-28c5-11e0-9e7f-00265e49bc29}\Shell\AutoRun\command - "" = et3ypes.exe
O33 - MountPoints2\{d4028877-28c5-11e0-9e7f-00265e49bc29}\Shell\open\Command - "" = et3ypes.exe
O33 - MountPoints2\{fb8a0d00-7402-11e0-9f04-00265e49bc29}\Shell - "" = AutoRun
O33 - MountPoints2\{fb8a0d00-7402-11e0-9f04-00265e49bc29}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fb8a0d00-7402-11e0-9f04-00265e49bc29}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2015-08-14 21:22:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Program aktualizujący aparaty cyfrowe OLYMPUS
[2015-08-14 21:22:32 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
[2015-08-04 22:55:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Adrian Lipa\My Documents\Leawo
[2015-08-04 22:55:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Adrian Lipa\Application Data\Leawo
[2015-08-04 22:55:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Leawo
[2015-08-04 22:54:57 | 000,606,208 | ---- | C] (http://www.xvid.org) -- C:\WINDOWS\System32\xvidcore.dll
[2015-08-04 22:54:57 | 000,139,264 | ---- | C] (http://www.xvid.org) -- C:\WINDOWS\System32\xvid.ax
[2015-08-04 22:54:17 | 000,000,000 | ---D | C] -- C:\Program Files\Nidesoft Studio
[2015-08-04 22:16:01 | 000,000,000 | ---D | C] -- C:\OutputFolder
[2015-08-04 22:14:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Ultra AVI Converter
[2015-08-04 22:14:41 | 000,000,000 | ---D | C] -- C:\Program Files\Ultra AVI Converter
[2015-08-04 18:25:06 | 000,000,000 | ---D | C] -- C:\Program Files\Eltima Software
[2015-08-04 18:18:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NCH Software
[2015-08-04 18:16:32 | 000,000,000 | ---D | C] -- C:\Program Files\NCH Software
[2015-08-04 18:16:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Adrian Lipa\Application Data\NCH Software
[2012-08-09 21:04:29 | 000,000,000 | ---D | C] -- C:\Avenger
[2012-08-09 15:01:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Adrian Lipa\Application Data\Malwarebytes
[2012-08-09 15:00:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012-08-09 15:00:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2012-08-09 15:00:22 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012-08-09 15:00:22 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012-08-08 15:49:48 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Adrian Lipa\Desktop\OTL.exe
[2012-08-08 11:26:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\RelevantKnowledge
[2012-08-08 11:05:22 | 000,087,552 | ---- | C] (Intel) -- C:\Documents and Settings\All Users\Application Data\fkvepoaj.exe
[2012-08-08 11:05:21 | 000,087,552 | ---- | C] (Intel) -- C:\Documents and Settings\All Users\Application Data\xzfpgmop.exe
[2012-08-08 11:05:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\smzxodwxeqcyjqw
[2012-08-04 07:23:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Adrian Lipa\Desktop\New Folder
[2012-07-14 13:50:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Adrian Lipa\Desktop\mercedes
[9 C:\Documents and Settings\Adrian Lipa\Desktop\*.tmp files -> C:\Documents and Settings\Adrian Lipa\Desktop\*.tmp -> ]
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2015-08-08 13:07:43 | 000,004,096 | -H-- | M] () -- C:\Documents and Settings\Adrian Lipa\Local Settings\Application Data\keyfile3.drm
[2015-07-28 22:23:34 | 000,186,736 | ---- | M] () -- C:\WINDOWS\unins000.dat
[2012-08-10 09:32:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012-08-09 15:00:31 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012-08-09 08:40:47 | 000,272,291 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2012-08-09 08:40:46 | 000,001,042 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012-08-08 15:21:10 | 000,368,896 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012-08-08 11:38:46 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Adrian Lipa\Desktop\OTL.exe
[2012-08-08 11:05:22 | 000,000,051 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\vevsdiucwhlzere
[2012-08-08 11:04:53 | 000,087,552 | ---- | M] (Intel) -- C:\Documents and Settings\All Users\Application Data\xzfpgmop.exe
[2012-08-08 11:04:53 | 000,087,552 | ---- | M] (Intel) -- C:\Documents and Settings\All Users\Application Data\fkvepoaj.exe
[2012-08-08 11:00:13 | 103,185,501 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2012-08-08 10:58:00 | 000,000,930 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012-08-08 08:33:00 | 000,001,046 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012-08-07 12:24:53 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012-08-06 11:06:38 | 005,856,454 | ---- | M] () -- C:\Documents and Settings\Adrian Lipa\Desktop\kostka schody wzor.bmp
[2012-08-04 09:58:23 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012-08-04 09:58:23 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012-08-02 06:47:21 | 000,000,046 | ---- | M] () -- C:\Documents and Settings\Adrian Lipa\My Documents\Asystent5-16.dat
[2012-08-01 11:53:03 | 000,036,616 | ---- | M] () -- C:\Documents and Settings\Adrian Lipa\My Documents\CEIDG.tif
[2012-07-30 15:11:17 | 009,600,522 | ---- | M] () -- C:\Documents and Settings\Adrian Lipa\Desktop\Untitled6.mp3
[2012-07-24 08:16:50 | 000,032,763 | ---- | M] () -- C:\Documents and Settings\Adrian Lipa\Desktop\1.pdf
[2012-07-21 21:14:39 | 000,033,280 | ---- | M] () -- C:\Documents and Settings\Adrian Lipa\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012-07-11 14:04:47 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[9 C:\Documents and Settings\Adrian Lipa\Desktop\*.tmp files -> C:\Documents and Settings\Adrian Lipa\Desktop\*.tmp -> ]
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2015-08-08 13:07:43 | 000,004,096 | -H-- | C] () -- C:\Documents and Settings\Adrian Lipa\Local Settings\Application Data\keyfile3.drm
[2012-08-09 15:00:31 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012-08-08 11:04:53 | 000,000,051 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\vevsdiucwhlzere
[2012-08-06 11:06:37 | 005,856,454 | ---- | C] () -- C:\Documents and Settings\Adrian Lipa\Desktop\kostka schody wzor.bmp
[2012-08-01 11:53:03 | 000,036,616 | ---- | C] () -- C:\Documents and Settings\Adrian Lipa\My Documents\CEIDG.tif
[2012-07-30 15:10:39 | 009,600,522 | ---- | C] () -- C:\Documents and Settings\Adrian Lipa\Desktop\Untitled6.mp3
[2012-04-02 08:30:20 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012-01-25 17:24:46 | 008,676,883 | ---- | C] () -- C:\WINDOWS\System32\NCMedia2.dll
[2012-01-25 17:24:46 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2011-12-16 16:41:37 | 000,008,192 | -HS- | C] () -- C:\WINDOWS\o2cLicStore.bin
[2011-09-08 18:16:42 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2011-07-12 21:16:47 | 000,368,248 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-515967899-1993962763-1417001333-1002-0.dat
[2011-07-12 21:16:47 | 000,302,018 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2011-01-24 23:25:08 | 002,392,064 | ---- | C] () -- C:\WINDOWS\System32\videotrans.dll
[2011-01-24 23:25:08 | 000,215,040 | ---- | C] () -- C:\WINDOWS\System32\videoformat.dll
[2011-01-24 23:25:08 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\imgscaler.dll
[2011-01-24 23:25:08 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\img_utils.dll
[2011-01-24 23:25:08 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\videocore.dll
[2010-11-13 16:27:59 | 000,000,145 | ---- | C] () -- C:\WINDOWS\StarryNight.ini
[2010-11-05 19:38:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Aslan.INI
[2010-07-16 18:29:31 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\Adrian Lipa\Application Data\$_hpcst$.hpc
[2010-02-09 18:42:09 | 000,033,280 | ---- | C] () -- C:\Documents and Settings\Adrian Lipa\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
[color=#E56717]========== LOP Check ==========[/color]
 
[2010-02-12 21:02:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\Acoustica
[2012-08-06 23:52:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\AIMP
[2011-07-12 20:11:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\Autodesk
[2011-09-08 18:16:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\Babylon
[2010-10-21 21:40:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\BabylonToolbar
[2009-11-09 16:43:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\BITS
[2010-11-13 16:08:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\DAEMON Tools Pro
[2010-02-12 20:54:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\DeepBurner
[2012-01-11 17:34:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\DMCache
[2012-02-07 19:23:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\e-pity
[2011-08-26 07:23:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\EditPlus 3
[2011-09-09 21:45:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\FileZilla
[2009-11-08 22:41:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\FlashGet
[2009-11-08 22:41:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\FlashGetBHO
[2010-02-09 05:04:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\Gadu-Gadu
[2010-09-28 16:08:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\GoldWaveCDDB
[2012-02-15 16:19:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\IDM
[2015-08-04 22:55:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\Leawo
[2010-08-17 21:49:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\Notepad++
[2010-11-21 13:03:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\OpenOffice.org
[2011-10-16 18:09:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\Rovio
[2010-02-19 01:06:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\Stellarium
[2011-01-25 00:22:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adrian Lipa\Application Data\Xilisoft
[2011-07-12 19:46:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Autodesk
[2010-05-23 12:40:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2011-09-08 18:16:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Babylon
[2011-03-15 13:45:21 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011-05-01 16:56:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DatacardService
[2010-08-17 20:11:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GoldWave
[2010-09-28 16:08:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GoldWaveCDDB
[2012-06-15 06:55:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\install_clap
[2015-08-04 22:55:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Leawo
[2012-08-08 11:05:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\smzxodwxeqcyjqw
[2011-02-18 00:06:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sprytne Katalogowanie
[2015-08-04 22:43:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
 
[color=#E56717]========== Purity Check ==========[/color]
 
 
 
[color=#E56717]========== Alternate Data Streams ==========[/color]
 
@Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7B471B25
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C8B8CEBD

< End of report >