API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Apr 27th, 2012
91
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 54.40 KB | None | 0 0
raw download clone embed print report
  1. OTL logfile created on: 27.4.2012 15:40:45 - Run 2
  2. OTL by OldTimer - Version 3.2.42.0 Folder = C:\Documents and Settings\Nensy Fensy\Desktop
  3. Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
  4. Internet Explorer (Version = 8.0.6001.18702)
  5. Locale: 0000041A | Country: Croatia | Language: HRV | Date Format: d.M.yyyy
  6.  
  7. 510,92 Mb Total Physical Memory | 283,59 Mb Available Physical Memory | 55,51% Memory free
  8. 1,22 Gb Paging File | 0,80 Gb Available in Paging File | 65,90% Paging File free
  9. Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
  10.  
  11. %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
  12. Drive C: | 44,92 Gb Total Space | 31,30 Gb Free Space | 69,69% Space Free | Partition Type: NTFS
  13. Drive D: | 48,23 Gb Total Space | 34,64 Gb Free Space | 71,83% Space Free | Partition Type: NTFS
  14.  
  15. Computer Name: TTSPRO-7A60427 | User Name: Nensy Fensy | Logged in as Administrator.
  16. Boot Mode: Normal | Scan Mode: Current user | Quick Scan
  17. Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
  18.  
  19. [color=#E56717]========== Processes (SafeList) ==========[/color]
  20.  
  21. PRC - [2012.04.25 15:37:08 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Nensy Fensy\Desktop\OTL.exe
  22. PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
  23. PRC - [2011.08.15 21:07:40 | 000,098,304 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  24. PRC - [2011.08.15 21:05:00 | 000,086,073 | ---- | M] (SigmaTel Inc.) -- C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
  25. PRC - [2011.08.15 20:51:28 | 000,073,728 | ---- | M] (TOSHIBA Corp.) -- C:\WINDOWS\system32\TFNF5.exe
  26. PRC - [2011.08.15 20:48:56 | 000,155,648 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\RAMASST.exe
  27. PRC - [2011.08.15 20:48:56 | 000,106,496 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\DVDRAMSV.exe
  28. PRC - [2011.06.15 17:33:20 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE
  29. PRC - [2010.08.12 14:16:26 | 000,810,144 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
  30. PRC - [2010.08.12 14:16:12 | 002,215,064 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
  31. PRC - [2010.04.12 10:46:00 | 000,152,944 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
  32. PRC - [2009.11.12 13:48:56 | 000,071,096 | ---- | M] () -- C:\Program Files\CDBurnerXP\NMSAccessU.exe
  33. PRC - [2009.11.03 15:48:54 | 000,874,768 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe
  34. PRC - [2009.11.03 15:45:48 | 001,372,160 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe
  35. PRC - [2009.11.03 15:42:00 | 000,909,312 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
  36. PRC - [2009.11.03 15:35:14 | 001,202,448 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
  37. PRC - [2009.11.03 15:33:48 | 000,473,360 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
  38. PRC - [2008.08.29 18:27:30 | 000,143,360 | ---- | M] (Vimicro Corporation) -- C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe
  39. PRC - [2008.04.14 14:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
  40. PRC - [2004.08.11 10:57:04 | 000,253,952 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\00THotkey.exe
  41. PRC - [2004.06.28 09:29:28 | 000,266,240 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSMain.exe
  42. PRC - [2004.06.28 09:28:42 | 000,040,960 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSBattM.exe
  43. PRC - [2004.06.16 16:44:00 | 000,036,864 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe
  44. PRC - [2003.08.25 11:37:04 | 000,102,400 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA Controls\TFncKy.exe
  45. PRC - [2003.03.11 13:56:30 | 000,122,880 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TouchED\TouchED.exe
  46.  
  47.  
  48. [color=#E56717]========== Modules (No Company Name) ==========[/color]
  49.  
  50. MOD - [2009.11.12 13:48:56 | 000,071,096 | ---- | M] () -- C:\Program Files\CDBurnerXP\NMSAccessU.exe
  51. MOD - [2009.11.03 15:35:46 | 000,200,704 | ---- | M] () -- C:\Program Files\Intel\WiFi\bin\iWMSProv.dll
  52. MOD - [2009.07.13 20:50:04 | 000,325,120 | ---- | M] () -- C:\Program Files\TeraCopy\TeraCopy.dll
  53. MOD - [2009.06.21 23:26:00 | 000,305,664 | ---- | M] () -- C:\Program Files\TeraCopy\TeraCopyExt.dll
  54. MOD - [2008.04.14 14:00:00 | 000,059,904 | ---- | M] () -- C:\WINDOWS\system32\devenum.dll
  55. MOD - [2008.04.14 14:00:00 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
  56.  
  57.  
  58. [color=#E56717]========== Win32 Services (SafeList) ==========[/color]
  59.  
  60. SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
  61. SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
  62. SRV - [2011.08.15 20:48:56 | 000,106,496 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) [Auto | Running] -- C:\WINDOWS\system32\DVDRAMSV.exe -- (DVD-RAM_Service)
  63. SRV - [2011.07.07 19:31:08 | 000,195,336 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
  64. SRV - [2011.06.15 17:33:20 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
  65. SRV - [2010.08.12 14:18:40 | 000,033,584 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)
  66. SRV - [2010.08.12 14:16:26 | 000,810,144 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
  67. SRV - [2010.04.12 10:46:00 | 000,152,944 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
  68. SRV - [2009.11.12 13:48:56 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Program Files\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)
  69. SRV - [2009.11.03 15:48:54 | 000,874,768 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) Intel(R)
  70. SRV - [2009.11.03 15:42:00 | 000,909,312 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\S24EvMon.exe -- (S24EventMonitor) Intel(R)
  71. SRV - [2009.11.03 15:33:48 | 000,473,360 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) Intel(R)
  72. SRV - [2004.06.16 16:44:00 | 000,036,864 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe -- (CFSvcs)
  73.  
  74.  
  75. [color=#E56717]========== Driver Services (SafeList) ==========[/color]
  76.  
  77. DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
  78. DRV - File not found [Kernel | On_Demand | Stopped] -- -- (Tosrfcom)
  79. DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
  80. DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
  81. DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
  82. DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
  83. DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
  84. DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
  85. DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
  86. DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
  87. DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\NENSYF~1\LOCALS~1\Temp\catchme.sys -- (catchme)
  88. DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
  89. DRV - [2011.08.15 21:05:00 | 000,230,416 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\stac97.sys -- (STAC97) Audio Driver (WDM)
  90. DRV - [2011.08.15 20:55:02 | 001,265,388 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
  91. DRV - [2011.08.15 20:52:06 | 000,038,425 | ---- | M] (SMC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)
  92. DRV - [2011.08.15 20:48:56 | 000,090,480 | ---- | M] (Matsushita Electric Industrial Co.,Ltd.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\meiudf.sys -- (meiudf)
  93. DRV - [2010.08.04 11:50:36 | 000,140,752 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon)
  94. DRV - [2010.08.03 13:28:36 | 000,095,896 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdir.sys -- (epfwtdir)
  95. DRV - [2010.07.29 13:31:26 | 000,115,008 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv)
  96. DRV - [2010.04.28 07:44:02 | 000,054,760 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr)
  97. DRV - [2009.12.18 11:58:52 | 000,011,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\SystemRequirementsLab\cpudrv.sys -- (cpudrv)
  98. DRV - [2009.11.12 13:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
  99. DRV - [2009.11.11 04:26:02 | 002,216,064 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Intel(R)
  100. DRV - [2008.08.29 16:29:44 | 000,256,512 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VMUVC.sys -- (VMUVC)
  101. DRV - [2008.08.13 16:23:56 | 000,011,904 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
  102. DRV - [2008.07.01 12:12:32 | 000,398,720 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vvftUVC.sys -- (vvftUVC)
  103. DRV - [2004.02.16 12:34:28 | 000,009,216 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\TVALZ.SYS -- (TVALZ)
  104. DRV - [2003.01.29 14:35:00 | 000,012,032 | ---- | M] (TOSHIBA Corporation.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Netdevio.sys -- (Netdevio)
  105.  
  106.  
  107. [color=#E56717]========== Standard Registry (SafeList) ==========[/color]
  108.  
  109.  
  110. [color=#E56717]========== Internet Explorer ==========[/color]
  111.  
  112. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
  113. IE - HKLM\..\SearchScopes,DefaultScope =
  114.  
  115. IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
  116. IE - HKCU\..\SearchScopes,DefaultScope =
  117. IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  118.  
  119. [color=#E56717]========== FireFox ==========[/color]
  120.  
  121. FF - prefs.js..browser.search.defaultengine: "Web Search"
  122. FF - prefs.js..browser.search.defaultenginename: "Web Search"
  123. FF - prefs.js..browser.search.order.1: "Web Search"
  124. FF - prefs.js..browser.search.selectedEngine: "Google"
  125. FF - prefs.js..browser.startup.homepage: "http://www.google.hr/"
  126. FF - user.js - File not found
  127.  
  128. FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
  129. FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
  130. FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
  131. FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
  132. FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
  133. FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
  134. FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
  135. FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=0.9.8a: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
  136. FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
  137.  
  138. FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.18 12:59:33 | 000,000,000 | ---D | M]
  139. FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.01.20 01:21:15 | 000,000,000 | ---D | M]
  140. FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2011.08.16 10:38:42 | 000,000,000 | ---D | M]
  141.  
  142. [2011.08.17 23:29:37 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Nensy Fensy\Application Data\Mozilla\Extensions
  143. [2012.04.26 13:06:28 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Nensy Fensy\Application Data\Mozilla\Firefox\Profiles\z49iwjkv.default\extensions
  144. [2012.02.02 20:44:55 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
  145. [2011.12.29 03:10:08 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
  146. [2012.03.18 12:59:31 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
  147. [2011.11.10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
  148. [2011.10.27 15:45:50 | 000,083,456 | ---- | M] (LiveVDO ) -- C:\Program Files\mozilla firefox\plugins\npvsharetvplg.dll
  149. [2011.08.12 05:16:35 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
  150. [2011.11.09 01:09:59 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml
  151.  
  152. O1 HOSTS File: ([2012.04.26 15:24:59 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
  153. O1 - Hosts: 127.0.0.1 localhost
  154. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
  155. O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
  156. O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
  157. O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
  158. O4 - HKLM..\Run: [000StTHK] C:\WINDOWS\System32\000StTHK.exe ()
  159. O4 - HKLM..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corporation)
  160. O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
  161. O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
  162. O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe (Intel(R) Corporation)
  163. O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)
  164. O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
  165. O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
  166. O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
  167. O4 - HKLM..\Run: [SigmaTel StacMon] C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe (SigmaTel Inc.)
  168. O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
  169. O4 - HKLM..\Run: [TFncKy] TFncKy.exe File not found
  170. O4 - HKLM..\Run: [TFNF5] C:\WINDOWS\System32\TFNF5.exe (TOSHIBA Corp.)
  171. O4 - HKLM..\Run: [TouchED] C:\Program Files\Toshiba\TouchED\TouchED.exe (TOSHIBA Corporation)
  172. O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)
  173. O4 - HKLM..\Run: [VMonitorVMUVC] C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe (Vimicro Corporation)
  174. O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe (Matsushita Electric Industrial Co., Ltd.)
  175. O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
  176. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
  177. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
  178. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
  179. O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  180. O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
  181. O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
  182. O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
  183. O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
  184. O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
  185. O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
  186. O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
  187. O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
  188. O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.4.24.0.cab (SysInfo Class)
  189. O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://active.macromedia.com/flash2/cabs/swflash.cab (Shockwave Flash Object)
  190. O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
  191. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0A6A0D60-080E-4236-9864-8D474ECD1C28}: DhcpNameServer = 192.168.1.15
  192. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{331BD86E-DA82-40CF-8D1C-02DBBE02D656}: DhcpNameServer = 192.168.1.1
  193. O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
  194. O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
  195. O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
  196. O24 - Desktop WallPaper: C:\Documents and Settings\Nensy Fensy\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
  197. O24 - Desktop BackupWallPaper: C:\Documents and Settings\Nensy Fensy\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
  198. O32 - HKLM CDRom: AutoRun - 1
  199. O32 - AutoRun File - [2011.08.04 17:42:14 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
  200. O34 - HKLM BootExecute: (autocheck autochk *)
  201. O35 - HKLM\..comfile [open] -- "%1" %*
  202. O35 - HKLM\..exefile [open] -- "%1" %*
  203. O37 - HKLM\...com [@ = ComFile] -- "%1" %*
  204. O37 - HKLM\...exe [@ = exefile] -- "%1" %*
  205. O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
  206. O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
  207.  
  208.  
  209. SafeBootMin: Base - Driver Group
  210. SafeBootMin: Boot Bus Extender - Driver Group
  211. SafeBootMin: Boot file system - Driver Group
  212. SafeBootMin: File system - Driver Group
  213. SafeBootMin: Filter - Driver Group
  214. SafeBootMin: PCI Configuration - Driver Group
  215. SafeBootMin: PNP Filter - Driver Group
  216. SafeBootMin: Primary disk - Driver Group
  217. SafeBootMin: SCSI Class - Driver Group
  218. SafeBootMin: sermouse.sys - Driver
  219. SafeBootMin: System Bus Extender - Driver Group
  220. SafeBootMin: vga.sys - Driver
  221. SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
  222. SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
  223. SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
  224. SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
  225. SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
  226. SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
  227. SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
  228. SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
  229. SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
  230. SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
  231. SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
  232. SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
  233. SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
  234.  
  235. ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)
  236. ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
  237. ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
  238. ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370)
  239. ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
  240. ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
  241. ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
  242. ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
  243. ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
  244. ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
  245. ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
  246. ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
  247. ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
  248. ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
  249. ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
  250. ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
  251. ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
  252. ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
  253. ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
  254. ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
  255. ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
  256. ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Security Update for Windows XP (KB923789)
  257. ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
  258. ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
  259. ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
  260. ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
  261. ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
  262. ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
  263. ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
  264. ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
  265. ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
  266. ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
  267. ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
  268. ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
  269. ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
  270. ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
  271. ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
  272. ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
  273. ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
  274. ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
  275. ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
  276. ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
  277. ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
  278. ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
  279. ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
  280. ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
  281. ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
  282. ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
  283. ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
  284. ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
  285. ActiveX: Microsoft Base Smart Card Crypto Provider Package -
  286.  
  287. Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
  288. Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
  289. Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
  290. Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
  291. Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
  292. Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
  293. Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
  294. Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
  295. Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
  296. Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
  297.  
  298. NetSvcs: 6to4 - File not found
  299. NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
  300. NetSvcs: Ias - File not found
  301. NetSvcs: Iprip - File not found
  302. NetSvcs: NWCWorkstation - File not found
  303. NetSvcs: Nwsapagent - File not found
  304. NetSvcs: WmdmPmSp - File not found
  305.  
  306. [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
  307.  
  308. [2012.04.27 12:22:25 | 000,000,000 | -HSD | C] -- C:\RECYCLER
  309. [2012.04.26 15:17:45 | 000,000,000 | RHSD | C] -- C:\cmdcons
  310. [2012.04.26 15:15:53 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
  311. [2012.04.26 15:15:53 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
  312. [2012.04.26 15:15:53 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
  313. [2012.04.26 15:15:53 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
  314. [2012.04.26 15:15:43 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
  315. [2012.04.26 15:15:36 | 000,000,000 | ---D | C] -- C:\Qoobox
  316. [2012.04.26 15:15:29 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Nensy Fensy\Start Menu\Programs\Administrative Tools
  317. [2012.04.26 15:02:21 | 004,477,246 | R--- | C] (Swearware) -- C:\Documents and Settings\Nensy Fensy\Desktop\ComboFix.exe
  318. [2012.04.26 10:57:31 | 000,000,000 | ---D | C] -- C:\_OTL
  319. [2012.04.26 00:41:47 | 002,074,160 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Nensy Fensy\Desktop\tdsskiller.exe
  320. [2012.04.26 00:38:53 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Nensy Fensy\Desktop\aswMBR.exe
  321. [2012.04.25 15:36:22 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Nensy Fensy\Desktop\OTL.exe
  322. [2012.04.25 14:22:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Nensy Fensy\Application Data\Malwarebytes
  323. [2012.04.25 14:22:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
  324. [2012.04.25 14:22:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
  325. [2012.04.25 14:22:28 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
  326. [2012.04.25 14:22:27 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
  327. [2012.04.23 17:04:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office Live Add-in
  328. [2012.04.08 22:38:00 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Nensy Fensy\Recent
  329.  
  330. [color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
  331.  
  332. [2012.04.27 14:59:46 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Nensy Fensy\Desktop\MBRCheck.exe
  333. [2012.04.27 14:50:33 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
  334. [2012.04.27 14:50:11 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
  335. [2012.04.27 14:50:10 | 535,810,048 | -HS- | M] () -- C:\hiberfil.sys
  336. [2012.04.27 14:47:44 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Nensy Fensy\Desktop\MBR.dat
  337. [2012.04.26 15:24:59 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
  338. [2012.04.26 15:17:50 | 000,000,327 | RHS- | M] () -- C:\boot.ini
  339. [2012.04.26 15:03:43 | 004,477,246 | R--- | M] (Swearware) -- C:\Documents and Settings\Nensy Fensy\Desktop\ComboFix.exe
  340. [2012.04.26 00:42:15 | 002,074,160 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Nensy Fensy\Desktop\tdsskiller.exe
  341. [2012.04.26 00:39:02 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Nensy Fensy\Desktop\aswMBR.exe
  342. [2012.04.25 21:27:33 | 000,008,192 | ---- | M] () -- C:\Documents and Settings\Nensy Fensy\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
  343. [2012.04.25 15:37:08 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Nensy Fensy\Desktop\OTL.exe
  344. [2012.04.25 14:22:32 | 000,000,790 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
  345. [2012.04.24 15:42:04 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
  346. [2012.04.18 20:49:00 | 000,000,420 | ---- | M] () -- C:\WINDOWS\tasks\Defraggler Volume C Task.job
  347. [2012.04.18 19:07:57 | 000,000,420 | ---- | M] () -- C:\WINDOWS\tasks\Defraggler Volume D Task.job
  348. [2012.04.11 16:33:13 | 000,485,476 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
  349. [2012.04.11 16:33:13 | 000,081,340 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
  350. [2012.04.11 16:22:33 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
  351. [2012.04.08 00:05:42 | 000,084,010 | ---- | M] () -- C:\Documents and Settings\Nensy Fensy\Desktop\Ap5oOqgCAAAgY9z_large.jpg
  352. [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
  353.  
  354. [color=#E56717]========== Files Created - No Company Name ==========[/color]
  355.  
  356. [2012.04.27 14:59:41 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\Nensy Fensy\Desktop\MBRCheck.exe
  357. [2012.04.26 15:17:50 | 000,000,211 | ---- | C] () -- C:\Boot.bak
  358. [2012.04.26 15:17:47 | 000,260,272 | RHS- | C] () -- C:\cmldr
  359. [2012.04.26 15:15:53 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
  360. [2012.04.26 15:15:53 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
  361. [2012.04.26 15:15:53 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
  362. [2012.04.26 15:15:53 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
  363. [2012.04.26 15:15:53 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
  364. [2012.04.26 12:52:36 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Nensy Fensy\Desktop\MBR.dat
  365. [2012.04.25 14:22:32 | 000,000,790 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
  366. [2012.04.11 16:22:32 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
  367. [2012.04.08 00:05:27 | 000,084,010 | ---- | C] () -- C:\Documents and Settings\Nensy Fensy\Desktop\Ap5oOqgCAAAgY9z_large.jpg
  368. [2012.03.17 18:51:29 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
  369. [2012.02.15 10:29:07 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
  370. [2011.08.31 16:55:36 | 000,008,192 | ---- | C] () -- C:\Documents and Settings\Nensy Fensy\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
  371. [2011.08.18 23:32:34 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
  372. [2011.08.18 23:23:06 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
  373. [2011.08.16 10:52:07 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\tcleanup.exe
  374. [2011.08.16 10:37:05 | 000,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini
  375. [2011.08.16 10:37:05 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll
  376. [2011.08.16 10:37:05 | 000,010,165 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini
  377. [2011.08.16 10:37:05 | 000,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini
  378. [2011.08.16 10:34:14 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll
  379. [2011.08.16 10:24:37 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\000StTHK.exe
  380. [2011.08.04 17:45:48 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
  381. [2011.08.04 17:38:40 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
  382. [2011.08.01 18:25:31 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
  383. [2011.08.01 18:24:16 | 000,265,416 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
  384.  
  385. [color=#E56717]========== LOP Check ==========[/color]
  386.  
  387. [2011.08.18 23:23:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
  388. [2011.08.16 10:38:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ESET
  389. [2011.08.18 23:23:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nensy Fensy\Application Data\Canneverbe Limited
  390. [2011.08.19 07:07:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nensy Fensy\Application Data\TeamViewer
  391. [2012.04.27 15:00:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nensy Fensy\Application Data\TeraCopy
  392. [2011.08.16 17:22:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Nensy Fensy\Application Data\toshiba
  393. [2012.04.18 20:49:00 | 000,000,420 | ---- | M] () -- C:\WINDOWS\Tasks\Defraggler Volume C Task.job
  394. [2012.04.18 19:07:57 | 000,000,420 | ---- | M] () -- C:\WINDOWS\Tasks\Defraggler Volume D Task.job
  395.  
  396. [color=#E56717]========== Purity Check ==========[/color]
  397.  
  398.  
  399.  
  400. [color=#E56717]========== Custom Scans ==========[/color]
  401.  
  402. [color=#A23BEC]< "%WinDir%\$NtUninstallKB*$." /30 >[/color]
  403.  
  404. [color=#A23BEC]< C:\Program Files\Common Files\ComObjects\*.* /s >[/color]
  405.  
  406. [color=#A23BEC]< %systemroot%\*. /mp /s >[/color]
  407.  
  408. [color=#A23BEC]< %systemroot%\*. /rp /s >[/color]
  409.  
  410. [color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color]
  411.  
  412. [color=#A23BEC]< %systemroot%\Tasks\*.job /lockedfiles >[/color]
  413.  
  414. [color=#A23BEC]< %systemroot%\system32\drivers\*.sys /lockedfiles >[/color]
  415.  
  416. [color=#A23BEC]< %systemroot%\System32\config\*.sav >[/color]
  417. [2011.08.01 18:23:25 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
  418. [2011.08.01 18:23:25 | 001,089,536 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
  419. [2011.08.01 18:23:25 | 000,901,120 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
  420.  
  421. [color=#A23BEC]< %systemroot%\system32\drivers\*.sys /90 >[/color]
  422. [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\system32\drivers\mbam.sys
  423.  
  424. [color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color]
  425.  
  426. [color=#A23BEC]< %USERPROFILE%\Local Settings\Temp\*.exe >[/color]
  427.  
  428. [color=#A23BEC]< %USERPROFILE%\Local Settings\Temp\*.dll >[/color]
  429. [2010.12.09 17:15:09 | 000,718,336 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Nensy Fensy\Local Settings\Temp\ntdll.dll
  430.  
  431. [color=#A23BEC]< %USERPROFILE%\Application Data\*.exe >[/color]
  432.  
  433. [color=#A23BEC]< %USERPROFILE%\AppData\Local\*.* >[/color]
  434.  
  435. [color=#A23BEC]< %USERPROFILE%\AppData\Roaming\*.* >[/color]
  436.  
  437. [color=#A23BEC]< C:\Windows\assembly\tmp\U\*.* /s >[/color]
  438.  
  439. [color=#A23BEC]< MD5 for: AFD.SYS >[/color]
  440. [2011.08.17 15:49:54 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=1E44BC1E83D8FD2305F8D452DB109CF9 -- C:\WINDOWS\system32\dllcache\afd.sys
  441. [2011.08.17 15:49:54 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=1E44BC1E83D8FD2305F8D452DB109CF9 -- C:\WINDOWS\system32\drivers\afd.sys
  442. [2008.04.14 14:00:00 | 000,138,112 | ---- | M] (Microsoft Corporation) MD5=322D0E36693D6E24A2398BEE62A268CD -- C:\WINDOWS\$NtUninstallKB2509553$\afd.sys
  443. [2011.02.16 15:22:48 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=355556D9E580915118CD7EF736653A89 -- C:\WINDOWS\$NtUninstallKB2592799$\afd.sys
  444. [2008.10.16 17:07:58 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=38D7B715504DA4741DF35E3594FE2099 -- C:\WINDOWS\$hf_mig$\KB2509553\SP3QFE\afd.sys
  445. [2008.10.16 16:43:01 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=7618D5218F2A614672EC61A80D854A37 -- C:\WINDOWS\$NtUninstallKB2503665$\afd.sys
  446. [2011.02.16 15:25:05 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=8D499B1276012EB907E7A9E0F4D8FDA4 -- C:\WINDOWS\$hf_mig$\KB2503665\SP3QFE\afd.sys
  447. [2011.08.17 15:41:46 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=F6B7B1ECD7B41736BDB6FF4B092BCB79 -- C:\WINDOWS\$hf_mig$\KB2592799\SP3QFE\afd.sys
  448.  
  449. [color=#A23BEC]< MD5 for: ATAPI.SYS >[/color]
  450. [2008.04.14 14:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
  451. [2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
  452. [2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
  453. [2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
  454. [2008.04.14 14:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys
  455.  
  456. [color=#A23BEC]< MD5 for: DISK.SYS >[/color]
  457. [2008.04.14 14:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:disk.sys
  458. [2008.04.14 14:00:00 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\system32\drivers\disk.sys
  459.  
  460. [color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color]
  461. [2008.04.14 14:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ERDNT\cache\explorer.exe
  462. [2008.04.14 14:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
  463. [2008.04.14 14:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\system32\dllcache\explorer.exe
  464.  
  465. [color=#A23BEC]< MD5 for: I8042PRT.SYS >[/color]
  466. [2008.04.14 14:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:i8042prt.sys
  467. [2008.04.14 14:00:00 | 000,052,480 | ---- | M] (Microsoft Corporation) MD5=4A0B06AA8943C1E332520F7440C0AA30 -- C:\WINDOWS\system32\drivers\i8042prt.sys
  468. [2008.04.14 14:00:00 | 000,052,480 | ---- | M] (Microsoft Corporation) MD5=4A0B06AA8943C1E332520F7440C0AA30 -- C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\i8042prt.sys
  469.  
  470. [color=#A23BEC]< MD5 for: NETBT.SYS >[/color]
  471. [2008.04.14 14:00:00 | 000,162,816 | ---- | M] (Microsoft Corporation) MD5=74B2B2F5BEA5E9A3DC021D685551BD3D -- C:\WINDOWS\system32\dllcache\netbt.sys
  472. [2008.04.14 14:00:00 | 000,162,816 | ---- | M] (Microsoft Corporation) MD5=74B2B2F5BEA5E9A3DC021D685551BD3D -- C:\WINDOWS\system32\drivers\netbt.sys
  473.  
  474. [color=#A23BEC]< MD5 for: REDBOOK.SYS >[/color]
  475. [2008.04.14 14:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:redbook.sys
  476. [2008.04.14 02:10:28 | 000,057,600 | ---- | M] (Microsoft Corporation) MD5=F828DD7E1419B6653894A8F97A0094C5 -- C:\WINDOWS\system32\drivers\redbook.sys
  477.  
  478. [color=#A23BEC]< MD5 for: SERIAL.SYS >[/color]
  479. [2008.04.14 14:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:serial.sys
  480. [2008.04.14 14:00:00 | 000,064,512 | ---- | M] (Microsoft Corporation) MD5=CCA207A8896D4C6A0C9CE29A4AE411A7 -- C:\WINDOWS\system32\drivers\serial.sys
  481.  
  482. [color=#A23BEC]< MD5 for: SVCHOST.EXE >[/color]
  483. [2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
  484. [2008.04.14 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\ERDNT\cache\svchost.exe
  485. [2008.04.14 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\dllcache\svchost.exe
  486. [2008.04.14 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\svchost.exe
  487.  
  488. [color=#A23BEC]< MD5 for: TCPIP.SYS >[/color]
  489. [2008.04.14 14:00:00 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\$NtUninstallKB2509553$\tcpip.sys
  490. [2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\ERDNT\cache\tcpip.sys
  491. [2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys
  492. [2008.06.20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys
  493. [2008.06.20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB2509553\SP3QFE\tcpip.sys
  494.  
  495. [color=#A23BEC]< MD5 for: VOLSNAP.SYS >[/color]
  496. [2008.04.14 14:00:00 | 000,052,352 | ---- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 -- C:\WINDOWS\system32\dllcache\volsnap.sys
  497. [2008.04.14 14:00:00 | 000,052,352 | ---- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 -- C:\WINDOWS\system32\drivers\volsnap.sys
  498.  
  499. [color=#A23BEC]< MD5 for: WINLOGON.EXE >[/color]
  500. [2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
  501. [2008.04.14 14:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ERDNT\cache\winlogon.exe
  502. [2008.04.14 14:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\dllcache\winlogon.exe
  503. [2008.04.14 14:00:00 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe
  504.  
  505. [color=#A23BEC]< hklm\software\clients\startmenuinternet|command /rs >[/color]
  506. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2012.03.18 12:59:14 | 000,834,712 | ---- | M] (Mozilla Corporation)
  507. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2012.03.18 12:59:14 | 000,834,712 | ---- | M] (Mozilla Corporation)
  508. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2012.03.18 12:59:14 | 000,834,712 | ---- | M] (Mozilla Corporation)
  509. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2012.03.18 12:59:30 | 000,924,600 | ---- | M] (Mozilla Corporation)
  510. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2012.03.18 12:59:30 | 000,924,600 | ---- | M] (Mozilla Corporation)
  511. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2012.03.18 12:59:30 | 000,924,600 | ---- | M] (Mozilla Corporation)
  512. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2012.02.29 14:17:40 | 000,174,080 | ---- | M] (Microsoft Corporation)
  513. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2012.02.29 14:17:40 | 000,174,080 | ---- | M] (Microsoft Corporation)
  514. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2012.02.29 14:17:40 | 000,174,080 | ---- | M] (Microsoft Corporation)
  515. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009.03.08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
  516. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" [2009.03.08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
  517.  
  518. [color=#A23BEC]< hklm\software\clients\startmenuinternet|command /64 /rs >[/color]
  519. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2012.03.18 12:59:14 | 000,834,712 | ---- | M] (Mozilla Corporation)
  520. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2012.03.18 12:59:14 | 000,834,712 | ---- | M] (Mozilla Corporation)
  521. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2012.03.18 12:59:14 | 000,834,712 | ---- | M] (Mozilla Corporation)
  522. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2012.03.18 12:59:30 | 000,924,600 | ---- | M] (Mozilla Corporation)
  523. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2012.03.18 12:59:30 | 000,924,600 | ---- | M] (Mozilla Corporation)
  524. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2012.03.18 12:59:30 | 000,924,600 | ---- | M] (Mozilla Corporation)
  525. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2012.02.29 14:17:40 | 000,174,080 | ---- | M] (Microsoft Corporation)
  526. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2012.02.29 14:17:40 | 000,174,080 | ---- | M] (Microsoft Corporation)
  527. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2012.02.29 14:17:40 | 000,174,080 | ---- | M] (Microsoft Corporation)
  528. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009.03.08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
  529. HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" [2009.03.08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
  530.  
  531. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /s >[/color]
  532. "NvCplDaemon" = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup -- [2008.04.14 14:00:00 | 000,033,280 | ---- | M] (Microsoft Corporation)
  533. "nwiz" = nwiz.exe /installquiet -- [2004.04.15 15:05:00 | 000,323,584 | ---- | M] (NVIDIA Corporation)
  534. "00THotkey" = C:\WINDOWS\system32\00THotkey.exe -- [2004.08.11 10:57:04 | 000,253,952 | ---- | M] (TOSHIBA Corporation)
  535. "000StTHK" = 000StTHK.exe -- [2001.06.23 20:28:06 | 000,024,576 | ---- | M] ()
  536. "TFNF5" = TFNF5.exe -- [2011.08.15 20:51:28 | 000,073,728 | ---- | M] (TOSHIBA Corp.)
  537. "SigmaTel StacMon" = C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe -- [2011.08.15 21:05:00 | 000,086,073 | ---- | M] (SigmaTel Inc.)
  538. "SynTPLpr" = C:\Program Files\Synaptics\SynTP\SynTPLpr.exe -- [2011.08.15 21:07:40 | 000,098,304 | ---- | M] (Synaptics, Inc.)
  539. "SynTPEnh" = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe -- [2011.08.15 21:07:40 | 000,495,616 | ---- | M] (Synaptics, Inc.)
  540. "TouchED" = C:\Program Files\TOSHIBA\TouchED\TouchED.Exe -- [2003.03.11 13:56:30 | 000,122,880 | ---- | M] (TOSHIBA Corporation)
  541. "AGRSMMSG" = AGRSMMSG.exe -- [2011.08.15 20:55:02 | 000,088,363 | ---- | M] (Agere Systems)
  542. "egui" = "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice -- [2010.08.12 14:16:12 | 002,215,064 | ---- | M] (ESET)
  543. "TPSMain" = TPSMain.exe -- [2004.06.28 09:29:28 | 000,266,240 | ---- | M] (TOSHIBA Corporation)
  544. "TFncKy" = TFncKy.exe
  545. "ITSecMng" = %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START -- [2009.07.22 13:40:00 | 000,083,336 | ---- | M] (TOSHIBA CORPORATION)
  546. "IntelZeroConfig" = "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe" -- [2009.11.03 15:45:48 | 001,372,160 | ---- | M] (Intel(R) Corporation)
  547. "IntelWireless" = "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray -- [2009.11.03 15:35:14 | 001,202,448 | ---- | M] (Intel(R) Corporation)
  548. "VMonitorVMUVC" = "C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe" VMUVC -- [2008.08.29 18:27:30 | 000,143,360 | ---- | M] (Vimicro Corporation)
  549. "Adobe Reader Speed Launcher" = "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" -- [2012.01.03 23:51:18 | 000,037,296 | ---- | M] (Adobe Systems Incorporated)
  550. "Adobe ARM" = "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" -- [2012.01.02 11:07:56 | 000,843,712 | R--- | M] (Adobe Systems Incorporated)
  551. "SunJavaUpdateSched" = "C:\Program Files\Common Files\Java\Java Update\jusched.exe" -- [2011.06.09 14:06:06 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.)
  552. "Malwarebytes' Anti-Malware" = "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray -- [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation)
  553. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
  554. "" =
  555. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
  556. "" =
  557. "Installed" = 1
  558. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
  559. "" =
  560. "Installed" = 1
  561. "NoChange" = 1
  562. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
  563. "" =
  564. "Installed" = 1
  565.  
  566. [color=#A23BEC]< HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost /s >[/color]
  567. "HTTPFilter" = HTTPFilter [binary data]
  568. "LocalService" = [Binary data over 100 bytes]
  569. "NetworkService" = DnsCache [binary data]
  570. "netsvcs" = [Binary data over 100 bytes]
  571. "DcomLaunch" = DcomLaunchTermService [binary data]
  572. "rpcss" = RpcSs [binary data] -- [2009.02.09 14:10:48 | 000,401,408 | ---- | M] (Microsoft Corporation)
  573. "eapsvcs" = eaphost [binary data]
  574. "dot3svc" = dot3svc [binary data] -- [2008.04.14 14:00:00 | 000,132,096 | ---- | M] (Microsoft Corporation)
  575. "imgsvc" = StiSvc [binary data]
  576. "termsvcs" = TermService [binary data]
  577. "WudfServiceGroup" = WUDFSvc [binary data] -- [2006.09.28 18:56:14 | 000,055,808 | ---- | M] (Microsoft Corporation)
  578. "WINRM" = WINRM [binary data]
  579. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost\DComLaunch]
  580. "CoInitializeSecurityParam" = 1
  581. "DefaultRpcStackSize" = 8
  582. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost\dot3svc]
  583. "AuthenticationCapabilities" = 12320
  584. "CoInitializeSecurityParam" = 1
  585. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost\eapsvcs]
  586. "AuthenticationCapabilities" = 12320
  587. "CoInitializeSecurityParam" = 1
  588. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost\HTTPFilter]
  589. "CoInitializeSecurityParam" = 1
  590. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost\LocalService]
  591. "CoInitializeSecurityParam" = 1
  592. "AuthenticationCapabilities" = 8192
  593. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs]
  594. "CoInitializeSecurityParam" = 1
  595. "AuthenticationCapabilities" = 12320
  596. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost\PCHealth]
  597. "CoInitializeSecurityParam" = 2
  598. "AuthenticationCapabilities" = 64
  599. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost\termsvcs]
  600. "CoInitializeSecurityParam" = 1
  601. "DefaultRpcStackSize" = 8
  602. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost\WINRM]
  603. "CoInitializeSecurityParam" = 1
  604. "AuthenticationCapabilities" = 12320
  605.  
  606. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >[/color]
  607. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Kmode: %SystemRoot%\system32\win32k.sys [2012.02.03 11:22:18 | 001,860,096 | ---- | M] (Microsoft Corporation)
  608. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
  609. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
  610.  
  611. [color=#E56717]========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========[/color]
  612. [C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790 -> Junction
  613. [C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e -> Junction
  614. [C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492 -> Junction
  615.  
  616. < End of report >
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!