OTL logfile created on: 12-07-2011 21:00:54 - Run 2
OTL by OldTimer - Version 3.2.23.0     Folder = C:\Users\Administrator\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000406 | Country: Danmark | Language: DAN | Date Format: dd-MM-yyyy
 
2,97 Gb Total Physical Memory | 2,24 Gb Available Physical Memory | 75,68% Memory free
5,93 Gb Paging File | 5,18 Gb Available in Paging File | 87,31% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 167,13 Gb Free Space | 71,77% Space Free | Partition Type: NTFS
Drive D: | 221,16 Gb Total Space | 221,08 Gb Free Space | 99,96% Space Free | Partition Type: NTFS
Drive F: | 1,92 Gb Total Space | 0,56 Gb Free Space | 29,35% Space Free | Partition Type: FAT
 
Computer Name: KIRSTEN-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - [2011-06-06 20:02:52 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
PRC - [2011-02-25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010-11-20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010-11-20 14:17:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Programmer\Windows Sidebar\sidebar.exe
PRC - [2010-09-21 15:03:14 | 001,710,464 | ---- | M] (Microsoft Corp.) -- C:\Programmer\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2010-09-21 15:03:14 | 000,193,408 | ---- | M] (Microsoft Corp.) -- C:\Programmer\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2010-08-12 15:16:26 | 000,810,144 | ---- | M] (ESET) -- C:\Programmer\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2010-08-12 15:16:12 | 002,215,064 | ---- | M] (ESET) -- C:\Programmer\ESET\ESET NOD32 Antivirus\egui.exe
 
 
[color=#E56717]========== Modules (SafeList) ==========[/color]
 
MOD - [2011-06-06 20:02:52 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
MOD - [2010-11-20 13:55:09 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
 
 
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
 
SRV - [2010-08-12 15:18:40 | 000,033,584 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)
SRV - [2010-08-12 15:16:26 | 000,810,144 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2010-06-24 19:34:53 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009-07-14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009-07-14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programmer\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV - [2010-11-20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010-11-20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010-07-29 14:31:26 | 000,136,632 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\System32\drivers\eamonm.sys -- (eamonm)
DRV - [2010-07-29 14:31:26 | 000,115,008 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\System32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2010-07-29 14:31:26 | 000,096,920 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\epfwwfpr.sys -- (epfwwfpr)
DRV - [2010-06-25 18:11:14 | 000,278,984 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2010-04-29 19:11:57 | 000,025,416 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009-11-13 09:47:50 | 000,058,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1C62x86.sys -- (L1C)
DRV - [2009-10-05 16:31:50 | 001,221,632 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009-07-14 01:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\serial.sys -- (Serial)
DRV - [2009-07-14 01:45:20 | 000,007,680 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\acpials.sys -- (acpials)
DRV - [2009-07-02 00:59:00 | 009,786,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007-07-31 02:39:00 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-973436937-1761095272-684487950-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.stofanet.dk/
IE - HKU\S-1-5-21-973436937-1761095272-684487950-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://dk.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-973436937-1761095272-684487950-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = da-DK
IE - HKU\S-1-5-21-973436937-1761095272-684487950-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-973436937-1761095272-684487950-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010-11-08 23:44:46 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2011-06-07 00:00:47 | 000,000,808 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Programmer\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\KirstenKaroline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Screen Clipper and Launcher til OneNote 2007.lnk = C:\Programmer\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 2
O7 - HKU\S-1-5-21-973436937-1761095272-684487950-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Programmer\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmer\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmer\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programmer\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programmer\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programmer\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programmer\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programmer\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programmer\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.42.145
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programmer\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programmer\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programmer\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programmer\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programmer\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programmer\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009-06-10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010-01-28 10:29:20 | 000,000,151 | ---- | M] () - F:\Autorun.inf -- [ FAT ]
O33 - MountPoints2\{952a8897-5231-11df-9440-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{952a8897-5231-11df-9440-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Autorun.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = laucher.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2011-07-12 20:54:34 | 000,000,000 | ---D | C] -- C:\_OTL
[2011-07-12 20:53:19 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\log 1
[2011-07-12 01:40:12 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
[2011-07-12 01:06:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
[2011-07-12 01:04:30 | 009,435,312 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Administrator\Desktop\mbam-setup.exe
[2011-07-11 15:45:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft-BackupByAdAwarePortable
[2011-07-11 00:21:19 | 000,000,000 | ---D | C] -- C:\Users\Administrator\DoctorWeb
[2011-07-10 15:10:26 | 000,000,000 | ---D | C] -- C:\bd_logs
[2011-07-09 15:49:44 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\{62755991-CE94-44F9-BDEF-69C98B53D458}
[2011-07-07 12:12:12 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\{BB725DBA-86F7-442D-97FA-7DE6F8798745}
[2011-07-07 11:07:18 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview
[2011-07-07 11:05:55 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2011-07-07 10:49:22 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\{6EA8A5B1-1452-4287-8F7C-8EF9BB5CE78E}
[2011-07-04 16:30:15 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\{464C1E06-3F90-4A07-995E-58652F34C7B4}
[2011-07-03 12:33:56 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\{4F9E3B34-6844-4FD2-A592-3278C0DE9C5C}
[2011-07-02 16:00:21 | 001,549,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tquery.dll
[2011-07-02 16:00:20 | 001,401,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssrch.dll
[2011-07-02 16:00:10 | 000,666,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssvp.dll
[2011-07-02 16:00:10 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssph.dll
[2011-07-02 16:00:10 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssphtb.dll
[2011-07-02 16:00:08 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msscntrs.dll
[2011-07-02 15:40:07 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\{625FEEA4-AC7C-4A6E-8923-2A45C37306F7}
[2011-06-19 11:42:30 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\{AE9A8B53-8124-4609-BE72-6B8D5E65F816}
[2011-06-18 22:11:38 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\{8AF1E9A2-EF3B-417A-8287-D442AFE6F8E7}
[2011-06-17 20:46:12 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\{BBE9EEB2-7E79-4379-AEC2-A650C773C8A6}
[2011-06-16 16:02:59 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011-06-16 16:02:58 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2011-06-16 16:02:57 | 001,797,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2011-06-16 16:02:57 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2011-06-16 14:08:34 | 000,187,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\FWPKCLNT.SYS
[2011-06-16 13:47:49 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\{D07C72CB-CBA8-49D3-A1BC-6CE31A164448}
[2011-06-15 15:41:13 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\{11BE3384-817C-4FBA-BC87-3546CB4C8A8A}
[2011-06-14 19:05:16 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\{7092D11F-12F6-435A-9212-016FE15FE6CC}
[2011-06-13 15:36:11 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\{1BDE945E-5089-4AA0-A6E3-BCC1303D950A}
[2011-02-11 18:40:40 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2011-07-12 21:06:54 | 000,013,440 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011-07-12 21:06:54 | 000,013,440 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011-07-12 20:58:24 | 000,000,916 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011-07-12 20:57:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011-07-12 20:57:10 | 2388,410,368 | -HS- | M] () -- C:\hiberfil.sys
[2011-07-12 20:36:00 | 000,000,920 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011-07-12 11:10:02 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011-07-12 11:10:02 | 000,470,324 | ---- | M] () -- C:\Windows\System32\perfh006.dat
[2011-07-12 11:10:02 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011-07-12 11:10:02 | 000,079,926 | ---- | M] () -- C:\Windows\System32\perfc006.dat
[2011-07-12 11:02:53 | 000,000,568 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Daily).job
[2011-07-12 01:34:12 | 001,008,041 | ---- | M] () -- C:\Users\Administrator\Desktop\rkill.exe
[2011-07-12 01:20:14 | 000,302,592 | ---- | M] () -- C:\Users\Administrator\Desktop\jfnkdt99.exe
[2011-07-12 00:21:24 | 009,435,312 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Administrator\Desktop\mbam-setup.exe
[2011-07-11 22:22:37 | 328,090,238 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011-07-11 15:42:54 | 000,000,044 | ---- | M] () -- C:\Windows\System32\statistics.dat
[2011-07-11 15:42:50 | 000,000,054 | ---- | M] () -- C:\Windows\System32\rp_stats.dat
[2011-07-11 15:42:50 | 000,000,039 | ---- | M] () -- C:\Windows\System32\rp_rules.dat
[2011-07-09 15:55:23 | 000,308,192 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011-07-07 11:17:15 | 000,152,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msclmd.dll
[2011-07-02 22:39:12 | 000,002,293 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2011-07-12 10:50:48 | 000,015,688 | ---- | C] () -- C:\Windows\System32\lsdelete.exe
[2011-07-12 01:38:39 | 001,008,041 | ---- | C] () -- C:\Users\Administrator\Desktop\rkill.exe
[2011-07-12 01:28:30 | 000,302,592 | ---- | C] () -- C:\Users\Administrator\Desktop\jfnkdt99.exe
[2011-07-12 01:08:23 | 000,000,568 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Update (Daily).job
[2011-07-11 22:22:37 | 328,090,238 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011-07-11 15:42:54 | 000,000,044 | ---- | C] () -- C:\Windows\System32\statistics.dat
[2011-07-11 15:42:50 | 000,000,054 | ---- | C] () -- C:\Windows\System32\rp_stats.dat
[2011-07-11 15:42:50 | 000,000,039 | ---- | C] () -- C:\Windows\System32\rp_rules.dat
[2011-05-15 21:23:43 | 000,000,000 | ---- | C] () -- C:\Users\Administrator\AppData\Local\{6456E032-1A78-46A3-B45E-BEC33E409216}
[2010-12-19 18:19:15 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2010-12-10 09:55:35 | 000,100,216 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2010-08-25 20:30:02 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2010-08-25 20:30:00 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2010-08-25 20:30:00 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2010-05-01 16:16:37 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll
[2010-04-29 19:11:57 | 000,278,984 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2010-04-29 19:11:57 | 000,025,416 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2010-02-11 00:12:08 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2009-08-03 16:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009-08-03 16:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2009-07-14 10:38:21 | 000,470,324 | ---- | C] () -- C:\Windows\System32\perfh006.dat
[2009-07-14 10:38:21 | 000,306,636 | ---- | C] () -- C:\Windows\System32\perfi006.dat
[2009-07-14 10:38:21 | 000,079,926 | ---- | C] () -- C:\Windows\System32\perfc006.dat
[2009-07-14 10:38:21 | 000,039,236 | ---- | C] () -- C:\Windows\System32\perfd006.dat
[2009-07-14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009-07-14 06:33:53 | 000,308,192 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009-07-14 04:05:48 | 000,616,008 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009-07-14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009-07-14 04:05:48 | 000,106,388 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009-07-14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009-07-14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009-07-14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009-07-14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009-07-14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009-07-14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009-07-14 00:09:19 | 000,139,824 | ---- | C] () -- C:\Windows\System32\igfcg500.bin
[2009-06-10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
 
[color=#E56717]========== LOP Check ==========[/color]
 
[2010-12-17 20:46:54 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Awem
[2010-09-10 17:37:49 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\cerasus.media
[2010-12-17 21:19:10 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Jane s Hotel 3
[2010-09-16 14:07:44 | 000,000,000 | ---D | M] -- C:\Users\KirstenKaroline\AppData\Roaming\Friday's games
[2010-08-13 16:40:12 | 000,000,000 | ---D | M] -- C:\Users\KirstenKaroline\AppData\Roaming\Jane s Hotel
[2010-08-14 12:41:06 | 000,000,000 | ---D | M] -- C:\Users\KirstenKaroline\AppData\Roaming\Jane s Hotel  Family Hero
[2010-08-04 18:21:06 | 000,000,000 | ---D | M] -- C:\Users\KirstenKaroline\AppData\Roaming\Merscom
[2010-06-26 11:42:44 | 000,000,000 | ---D | M] -- C:\Users\KirstenKaroline\AppData\Roaming\PlayFirst
[2010-11-06 13:23:38 | 000,000,000 | -HSD | M] -- C:\Users\KirstenKaroline\AppData\Roaming\Smart Engine
[2010-05-14 20:34:43 | 000,000,000 | ---D | M] -- C:\Users\KirstenKaroline\AppData\Roaming\SPORE
[2010-05-14 21:54:44 | 000,000,000 | ---D | M] -- C:\Users\KirstenKaroline\AppData\Roaming\YoudaGames
[2011-07-12 11:02:53 | 000,000,568 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Daily).job
[2011-06-11 21:01:44 | 000,032,550 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
[color=#E56717]========== Purity Check ==========[/color]
 
 
 
[color=#E56717]========== Alternate Data Streams ==========[/color]
 
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:9DF6D7BB
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:DB6FBA83
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:E95E2173
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:DF01DCBC
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:E62C6B68
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:4BC96A99
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:CAEAB336
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:F061428B
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:9FC06D35

< End of report >