OTL logfile created on: 2013-03-26 09:51:50 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = E:\
 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = )
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
 
1015,24 Mb Total Physical Memory | 703,32 Mb Available Physical Memory | 69,28% Memory free
1015,24 Mb Paging File | 704,21 Mb Available in Paging File | 69,36% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = X: | %SystemRoot% = X:\windows | %ProgramFiles% = X:\Program Files
Drive C: | 149,05 Gb Total Space | 53,66 Gb Free Space | 36,00% Space Free | Partition Type: NTFS
Drive D: | 3,68 Gb Total Space | 0,56 Gb Free Space | 15,23% Space Free | Partition Type: FAT32
Drive E: | 987,72 Mb Total Space | 892,70 Mb Free Space | 90,38% Space Free | Partition Type: FAT
Drive X: | 30,90 Mb Total Space | 28,47 Mb Free Space | 92,13% Space Free | Partition Type: NTFS
 
Computer Name: MININT-NFFLTA5 | User Name: SYSTEM | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - [2013-03-25 16:52:38 | 000,602,112 | ---- | M] (OldTimer Tools) -- E:\OTL.exe
PRC - [2009-07-14 04:52:48 | 000,602,112 | ---- | M] (Microsoft Corporation) -- X:\sources\recovery\RecEnv.exe
PRC - [2009-07-14 02:14:45 | 000,565,760 | ---- | M] (Microsoft Corporation) -- X:\Windows\System32\winpeshl.exe
PRC - [2009-07-14 02:14:15 | 000,301,568 | ---- | M] (Microsoft Corporation) -- X:\Windows\System32\cmd.exe
PRC - [2009-07-14 02:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- X:\Windows\System32\conhost.exe
 
 
[color=#E56717]========== Modules (No Company Name) ==========[/color]
 
 
[color=#E56717]========== Services (SafeList) ==========[/color]
 
SRV - [2009-07-14 02:16:13 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- X:\Windows\System32\sacsvr.dll -- (sacsvr)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV - [2009-07-14 03:38:07 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- X:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2009-07-14 03:38:07 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- X:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2009-07-14 03:38:07 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- X:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2009-07-14 03:38:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- X:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2009-07-14 02:19:03 | 000,080,464 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- X:\Windows\System32\drivers\sacdrv.sys -- (sacdrv)
DRV - [2009-07-14 00:46:05 | 000,022,016 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- X:\Windows\System32\drivers\ramdisk.sys -- (Ramdisk)
DRV - [2009-07-14 00:18:10 | 000,069,632 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- X:\Windows\System32\drivers\fbwf.sys -- (FBWF)
DRV - [2009-07-14 00:17:59 | 000,053,248 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- X:\windows\System32\drivers\wimfsf.sys -- (WimFsf)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
 
 
 
 
 
 
 
 
 
O1 HOSTS File: ([2009-06-10 22:39:37 | 000,000,824 | ---- | M]) - X:\windows\System32\Drivers\etc\hosts
O4 - Startup: X:\windows\System32\config\systemprofile\ntuser.dat ()
O4 - Startup: X:\windows\System32\config\systemprofile\ntuser.dat.LOG1 ()
O4 - Startup: X:\windows\System32\config\systemprofile\ntuser.dat.LOG2 ()
O4 - Startup: X:\windows\System32\config\systemprofile\ntuser.dat{51c5de55-6e0a-11de-b1c2-001e4f433fa9}.TM.blf ()
O4 - Startup: X:\windows\System32\config\systemprofile\ntuser.dat{51c5de55-6e0a-11de-b1c2-001e4f433fa9}.TMContainer00000000000000000001.regtrans-ms ()
O4 - Startup: X:\windows\System32\config\systemprofile\ntuser.dat{51c5de55-6e0a-11de-b1c2-001e4f433fa9}.TMContainer00000000000000000002.regtrans-ms ()
O4 - Startup: X:\windows\System32\config\systemprofile\AppData [2009-07-14 03:03:24 | 000,000,000 | --SD | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableMIC = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIPI = 0
O13 - ftp Prefix: missing
O13 - gopher Prefix: missing
O13 - home Prefix: missing
O13 - mosaic Prefix: missing
O13 - www Prefix: missing
O20 - HKLM Winlogon: Shell - (cmd.exe) - X:\windows\System32\cmd.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (/k start cmd.exe) -  File not found
O20 - HKLM Winlogon: UserInit - (X:\windows\system32\userinit.exe) - X:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -  File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009-06-10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2013-03-25 16:08:26 | 000,000,500 | RHS- | M] () - D:\autorun.inf -- [ FAT32 ]
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2013-03-25 18:50:09 | 000,000,000 | ---D | C] -- X:\windows\debug
[2013-03-25 18:50:08 | 000,000,000 | ---D | C] -- X:\windows\ServiceProfiles
[2013-03-25 18:50:07 | 000,000,000 | --SD | C] -- X:\windows\System32\Microsoft
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2013-03-26 09:53:11 | 000,076,760 | ---- | M] () -- X:\windows\System32\FNTCACHE.DAT
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2013-03-25 18:50:05 | 000,076,760 | ---- | C] () -- X:\windows\System32\FNTCACHE.DAT
[2013-03-25 18:47:35 | 098,077,435 | ---- | C] () -- \OTLPEStd.exe
[2013-03-25 18:14:54 | 000,911,462 | ---- | C] () -- \FRST.exe
[2013-03-25 16:52:29 | 000,602,112 | ---- | C] () -- \OTL.exe
 
[color=#E56717]========== ZeroAccess Check ==========[/color]
 
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2009-07-14 02:16:14 | 012,866,560 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009-07-14 04:53:10 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009-07-14 04:53:10 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[color=#E56717]========== LOP Check ==========[/color]
 
[2009-07-14 03:03:24 | 000,000,000 | --SD | M] -- X:\windows\system32\config\systemprofile\AppData
 
[color=#E56717]========== Purity Check ==========[/color]
 
 

< End of report >