API tools faq
paste
Guest User

bleeping computer

a guest
Nov 19th, 2012
566
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 131.76 KB | None | 0 0
raw download clone embed print report
  1. OTL logfile created on: 11/19/2012 5:34:48 PM - Run 1
  2. OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Arowana\Desktop
  3. Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
  4. Internet Explorer (Version = 9.0.8112.16421)
  5. Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
  6.  
  7. 2.99 Gb Total Physical Memory | 1.65 Gb Available Physical Memory | 55.10% Memory free
  8. 6.21 Gb Paging File | 4.86 Gb Available in Paging File | 78.38% Paging File free
  9. Paging file location(s): ?:\pagefile.sys [binary data]
  10.  
  11. %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
  12. Drive C: | 109.25 Gb Total Space | 50.31 Gb Free Space | 46.05% Space Free | Partition Type: NTFS
  13.  
  14. Computer Name: AROWANA-PC | User Name: Arowana | Logged in as Administrator.
  15. Boot Mode: Normal | Scan Mode: All users
  16. Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 90 Days
  17.  
  18. [color=#E56717]========== Processes (SafeList) ==========[/color]
  19.  
  20. PRC - [2012/11/19 17:31:47 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Arowana\Desktop\OTL.scr
  21. PRC - [2012/10/28 13:31:48 | 000,917,984 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
  22. PRC - [2012/09/20 12:19:28 | 020,383,336 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
  23. PRC - [2012/09/12 16:25:24 | 000,287,824 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\NisSrv.exe
  24. PRC - [2012/09/12 16:25:22 | 000,280,088 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MpCmdRun.exe
  25. PRC - [2012/09/12 16:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
  26. PRC - [2012/09/12 16:19:44 | 000,947,176 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
  27. PRC - [2012/01/18 05:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
  28. PRC - [2009/11/01 21:30:00 | 002,508,104 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
  29. PRC - [2009/09/28 16:56:18 | 000,140,640 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
  30. PRC - [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
  31. PRC - [2009/04/11 01:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
  32. PRC - [2007/09/07 13:40:34 | 000,132,392 | ---- | M] (Wacom Technology, Corp.) -- C:\Windows\System32\WTablet\Wacom_TabletUser.exe
  33. PRC - [2007/09/07 13:40:04 | 001,373,480 | ---- | M] (Wacom Technology, Corp.) -- C:\Windows\System32\Wacom_Tablet.exe
  34. PRC - [2007/03/20 16:43:50 | 000,315,392 | ---- | M] () -- C:\Windows\System32\ATWTUSB.EXE
  35. PRC - [2006/11/02 07:35:35 | 000,176,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wpcumi.exe
  36.  
  37.  
  38. [color=#E56717]========== Modules (No Company Name) ==========[/color]
  39.  
  40. MOD - [2012/11/13 21:10:56 | 000,476,672 | ---- | M] () -- C:\Users\Arowana\AppData\Roaming\wisnit.dll
  41. MOD - [2012/10/28 13:31:03 | 002,295,264 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
  42. MOD - [2011/03/17 00:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
  43. MOD - [2007/03/20 16:43:50 | 000,315,392 | ---- | M] () -- C:\Windows\System32\ATWTUSB.EXE
  44.  
  45.  
  46. [color=#E56717]========== Services (SafeList) ==========[/color]
  47.  
  48. SRV - File not found [Auto | Stopped] -- c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe -- (McAfee SiteAdvisor Service)
  49. SRV - [2012/10/29 18:57:59 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
  50. SRV - [2012/10/28 13:31:47 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
  51. SRV - [2012/09/12 16:25:24 | 000,287,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
  52. SRV - [2012/09/12 16:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
  53. SRV - [2012/07/13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
  54. SRV - [2012/01/18 05:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
  55. SRV - [2008/01/20 21:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
  56. SRV - [2007/09/07 13:40:04 | 001,373,480 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Windows\System32\Wacom_Tablet.exe -- (TabletServiceWacom)
  57.  
  58.  
  59. [color=#E56717]========== Driver Services (SafeList) ==========[/color]
  60.  
  61. DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\wdcsam.sys -- (WDC_SAM)
  62. DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
  63. DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
  64. DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\Arowana\AppData\Local\Temp\mbr.sys -- (mbr)
  65. DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
  66. DRV - [2012/11/19 12:59:40 | 000,029,904 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4DD64E23-2B6B-4B08-8635-221AE5C14C99}\MpKsle397a4b4.sys -- (MpKsle397a4b4)
  67. DRV - [2012/08/30 21:03:50 | 000,099,272 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
  68. DRV - [2012/01/18 05:44:52 | 004,332,960 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC)
  69. DRV - [2008/01/25 00:46:40 | 000,106,496 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
  70. DRV - [2007/07/18 17:40:00 | 000,281,088 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8187B.sys -- (RTL8187B)
  71. DRV - [2007/02/16 14:12:36 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacommousefilter.sys -- (wacommousefilter)
  72. DRV - [2007/02/16 13:30:12 | 000,012,848 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacomvhid.sys -- (wacomvhid)
  73. DRV - [2007/02/15 19:11:28 | 000,011,440 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WacomVKHid.sys -- (WacomVKHid)
  74. DRV - [2006/11/02 02:41:50 | 000,983,552 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
  75. DRV - [2006/06/06 08:51:06 | 000,022,528 | ---- | M] (WALTOP International Corp.) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\aiptektp.sys -- (aiptektp)
  76.  
  77.  
  78. [color=#E56717]========== Standard Registry (All) ==========[/color]
  79.  
  80.  
  81. [color=#E56717]========== Internet Explorer ==========[/color]
  82.  
  83. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  84. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  85. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
  86. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
  87. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
  88. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  89. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
  90. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  91. IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  92. IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  93.  
  94.  
  95. IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  96.  
  97. IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  98.  
  99. IE - HKU\S-1-5-19\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
  100.  
  101. IE - HKU\S-1-5-20\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
  102.  
  103. IE - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
  104. IE - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  105. IE - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=Z016&form=ZGAPHP
  106. IE - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://go.microsoft.com/fwlink/?LinkId=69157
  107. IE - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
  108. IE - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
  109. IE - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000\..\SearchScopes,DefaultScope = {8A64D544-98BB-C260-590A-335EB1FB0846}
  110. IE - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
  111. IE - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000\..\SearchScopes\{8A64D544-98BB-C260-590A-335EB1FB0846}: "URL" = http://www.bing.com/search?q={searchTerms}&pc=Z016&form=ZGAIDF
  112. IE - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  113.  
  114. [color=#E56717]========== FireFox ==========[/color]
  115.  
  116. FF - prefs.js..browser.startup.homepage: "http://www.google.com/firefox"
  117. FF - prefs.js..extensions.enabledAddons: properties@darktrojan.net:7
  118. FF - prefs.js..extensions.enabledAddons: {89eb568c-2e00-11e2-8271-b8ac6f996f26}:2.0.14
  119. FF - prefs.js..extensions.enabledAddons: {972ce4c6-7e08-4474-a285-3208198ce6fd}:16.0.2
  120. FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10
  121. FF - prefs.js..extensions.enabledItems: properties@darktrojan.net:6
  122. FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25
  123. FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:0.0.0
  124. FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.6.0.8442
  125. FF - prefs.js..extensions.enabledItems: {4ED1F68A-5463-4931-9384-8FFF5ED91D92}:3.4.0
  126. FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
  127. FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.23
  128. FF - prefs.js..keyword.URL: "http://www.bing.com/search?pc=Z016&form=ZGAADF&q="
  129. FF - user.js - File not found
  130.  
  131. FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
  132. FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
  133. FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
  134. FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
  135. FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
  136. FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MI1933~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
  137. FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MI1933~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
  138. FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
  139. FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
  140.  
  141. FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2010/02/15 21:48:23 | 000,000,000 | ---D | M]
  142. FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/10/28 13:31:49 | 000,000,000 | ---D | M]
  143. FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/10/28 13:30:52 | 000,000,000 | ---D | M]
  144. FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/10/28 13:31:49 | 000,000,000 | ---D | M]
  145. FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/10/28 13:30:52 | 000,000,000 | ---D | M]
  146.  
  147. [2010/02/14 18:18:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Arowana\AppData\Roaming\Mozilla\Extensions
  148. [2010/02/14 18:18:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Arowana\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
  149. [2012/11/15 23:46:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Arowana\AppData\Roaming\Mozilla\Firefox\Profiles\gkxfny74.default\extensions
  150. [2012/06/21 00:12:05 | 000,097,400 | ---- | M] () (No name found) -- C:\Users\Arowana\AppData\Roaming\Mozilla\Firefox\Profiles\gkxfny74.default\extensions\properties@darktrojan.net.xpi
  151. [2012/11/19 12:37:57 | 000,004,001 | ---- | M] () (No name found) -- C:\Users\Arowana\AppData\Roaming\Mozilla\Firefox\Profiles\gkxfny74.default\extensions\{89eb568c-2e00-11e2-8271-b8ac6f996f26}.xpi
  152. [2012/07/26 22:24:54 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Arowana\AppData\Roaming\Mozilla\Firefox\Profiles\gkxfny74.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
  153. [2011/03/24 10:32:47 | 000,001,919 | ---- | M] () -- C:\Users\Arowana\AppData\Roaming\Mozilla\Firefox\Profiles\gkxfny74.default\searchplugins\bing-zugo.xml
  154. [2012/10/28 13:30:29 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
  155. [2012/10/28 13:30:29 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
  156. [2012/10/28 13:31:49 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
  157. [2012/10/28 13:31:48 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
  158. [2012/07/30 16:52:13 | 000,103,904 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll
  159. [2012/10/17 19:09:47 | 000,001,607 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
  160. [2012/10/17 19:09:46 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
  161. [2012/10/17 19:09:46 | 000,001,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml
  162. [2012/10/17 19:09:46 | 000,003,581 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
  163. [2012/10/17 19:09:46 | 000,002,058 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml
  164. [2012/10/17 19:09:46 | 000,001,391 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
  165. [2012/10/17 19:09:46 | 000,001,309 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml
  166.  
  167. O1 HOSTS File: ([2006/09/18 16:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
  168. O1 - Hosts: 127.0.0.1 localhost
  169. O1 - Hosts: ::1 localhost
  170. O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
  171. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
  172. O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
  173. O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
  174. O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
  175. O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
  176. O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
  177. O3 - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000\..\Toolbar\WebBrowser: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
  178. O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
  179. O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
  180. O4 - HKLM..\Run: [atwtusb] C:\Windows\System32\ATWTUSB.EXE ()
  181. O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
  182. O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
  183. O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe (Intel Corporation)
  184. O4 - HKLM..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe (Intel Corporation)
  185. O4 - HKLM..\Run: [IJNetworkScanUtility] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
  186. O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
  187. O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation)
  188. O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
  189. O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
  190. O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
  191. O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
  192. O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
  193. O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
  194. O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
  195. O4 - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000..\Run: [ehTray.exe] C:\Windows\ehome\ehtray.exe (Microsoft Corporation)
  196. O4 - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
  197. O4 - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
  198. O4 - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000..\Run: [wisnit] C:\Users\Arowana\AppData\Roaming\wisnit.dll ()
  199. O4 - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
  200. O4 - HKLM..\RunOnce: [AvgUninstallURL] C:\Windows\System32\cmd.exe (Microsoft Corporation)
  201. O4 - Startup: C:\Users\Arowana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
  202. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BindDirectlyToPropertySetStorage = 0
  203. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2
  204. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
  205. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
  206. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
  207. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
  208. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
  209. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
  210. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
  211. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
  212. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
  213. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
  214. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
  215. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
  216. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
  217. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
  218. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
  219. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
  220. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
  221. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
  222. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
  223. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
  224. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
  225. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
  226. O7 - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
  227. O7 - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
  228. O7 - HKU\S-1-5-21-1057668760-3532095340-2781703691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
  229. O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
  230. O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
  231. O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
  232. O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
  233. O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
  234. O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
  235. O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
  236. O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
  237. O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation)
  238. O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)
  239. O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
  240. O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
  241. O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  242. O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)
  243. O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
  244. O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
  245. O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
  246. O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
  247. O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
  248. O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
  249. O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
  250. O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
  251. O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  252. O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  253. O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  254. O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  255. O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  256. O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  257. O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  258. O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  259. O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  260. O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  261. O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
  262. O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  263. O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  264. O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  265. O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  266. O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  267. O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  268. O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  269. O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  270. O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  271. O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  272. O10 - Protocol_Catalog9\Catalog_Entries\000000000030 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  273. O10 - Protocol_Catalog9\Catalog_Entries\000000000031 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
  274. O13 - gopher Prefix: missing
  275. O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 192.168.1.254
  276. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4C968701-19E3-47B7-A7FC-76A6BEB134CC}: DhcpNameServer = 192.168.1.254 192.168.1.254
  277. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{57BFD262-B468-427F-8498-A97A03184DD0}: DhcpNameServer = 192.168.1.254 192.168.1.254
  278. O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
  279. O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
  280. O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
  281. O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
  282. O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
  283. O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
  284. O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
  285. O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
  286. O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
  287. O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
  288. O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
  289. O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)
  290. O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
  291. O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
  292. O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
  293. O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
  294. O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
  295. O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
  296. O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
  297. O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
  298. O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
  299. O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
  300. O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
  301. O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
  302. O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
  303. O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
  304. O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\Windows\System32\shell32.dll (Microsoft Corporation)
  305. O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\Windows\System32\sysdm.cpl (Microsoft Corporation)
  306. O20 - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\System32\igfxdev.dll (Intel Corporation)
  307. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)
  308. O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\System32\browseui.dll (Microsoft Corporation)
  309. O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img19.jpg
  310. O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img19.jpg
  311. O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)
  312. O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
  313. O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)
  314. O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
  315. O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)
  316. O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)
  317. O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)
  318. O31 - SafeBoot: AlternateShell - cmd.exe
  319. O32 - HKLM CDRom: AutoRun - 1
  320. O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
  321. O34 - HKLM BootExecute: (autocheck autochk *)
  322. O35 - HKLM\..comfile [open] -- "%1" %*
  323. O35 - HKLM\..exefile [open] -- "%1" %*
  324. O37 - HKLM\...com [@ = comfile] -- "%1" %*
  325. O37 - HKLM\...exe [@ = exefile] -- "%1" %*
  326. O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
  327. O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
  328.  
  329. NetSvcs: FastUserSwitchingCompatibility - File not found
  330. NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
  331. NetSvcs: Nla - File not found
  332. NetSvcs: Ntmssvc - File not found
  333. NetSvcs: NWCWorkstation - File not found
  334. NetSvcs: Nwsapagent - File not found
  335. NetSvcs: SRService - File not found
  336. NetSvcs: WmdmPmSp - File not found
  337. NetSvcs: LogonHours - File not found
  338. NetSvcs: PCAudit - File not found
  339. NetSvcs: helpsvc - File not found
  340. NetSvcs: uploadmgr - File not found
  341.  
  342.  
  343. SafeBootMin: AppMgmt - Service
  344. SafeBootMin: Base - Driver Group
  345. SafeBootMin: Boot Bus Extender - Driver Group
  346. SafeBootMin: Boot file system - Driver Group
  347. SafeBootMin: File system - Driver Group
  348. SafeBootMin: Filter - Driver Group
  349. SafeBootMin: HelpSvc - Service
  350. SafeBootMin: MsMpSvc - c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
  351. SafeBootMin: NTDS - File not found
  352. SafeBootMin: PCI Configuration - Driver Group
  353. SafeBootMin: PNP Filter - Driver Group
  354. SafeBootMin: Primary disk - Driver Group
  355. SafeBootMin: sacsvr - Service
  356. SafeBootMin: SCSI Class - Driver Group
  357. SafeBootMin: System Bus Extender - Driver Group
  358. SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
  359. SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
  360. SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
  361. SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
  362. SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
  363. SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
  364. SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
  365. SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
  366. SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
  367. SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
  368. SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
  369. SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
  370. SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
  371. SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
  372. SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
  373. SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
  374. SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
  375. SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
  376.  
  377. SafeBootNet: AppMgmt - Service
  378. SafeBootNet: Base - Driver Group
  379. SafeBootNet: Boot Bus Extender - Driver Group
  380. SafeBootNet: Boot file system - Driver Group
  381. SafeBootNet: File system - Driver Group
  382. SafeBootNet: Filter - Driver Group
  383. SafeBootNet: HelpSvc - Service
  384. SafeBootNet: Messenger - Service
  385. SafeBootNet: MsMpSvc - c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
  386. SafeBootNet: NDIS Wrapper - Driver Group
  387. SafeBootNet: NetBIOSGroup - Driver Group
  388. SafeBootNet: NetDDEGroup - Driver Group
  389. SafeBootNet: Network - Driver Group
  390. SafeBootNet: NetworkProvider - Driver Group
  391. SafeBootNet: NTDS - File not found
  392. SafeBootNet: PCI Configuration - Driver Group
  393. SafeBootNet: PNP Filter - Driver Group
  394. SafeBootNet: PNP_TDI - Driver Group
  395. SafeBootNet: Primary disk - Driver Group
  396. SafeBootNet: rdsessmgr - Service
  397. SafeBootNet: sacsvr - Service
  398. SafeBootNet: SCSI Class - Driver Group
  399. SafeBootNet: Streams Drivers - Driver Group
  400. SafeBootNet: System Bus Extender - Driver Group
  401. SafeBootNet: TDI - Driver Group
  402. SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
  403. SafeBootNet: WudfPf - Driver
  404. SafeBootNet: WudfUsbccidDriver - Driver
  405. SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
  406. SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
  407. SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
  408. SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
  409. SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
  410. SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
  411. SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
  412. SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
  413. SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
  414. SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
  415. SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
  416. SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
  417. SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
  418. SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
  419. SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
  420. SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
  421. SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
  422. SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
  423. SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
  424. SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
  425. SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
  426. SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
  427.  
  428. ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
  429. ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
  430. ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
  431. ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
  432. ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
  433. ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
  434. ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
  435. ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
  436. ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
  437. ActiveX: {4B9673DF-D0AB-8CC5-1392-C06F783283F4} - Microsoft Windows Media Player
  438. ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
  439. ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
  440. ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
  441. ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
  442. ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
  443. ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
  444. ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
  445. ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
  446. ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
  447. ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
  448. ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
  449. ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
  450. ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
  451. ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} -
  452. ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
  453. ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
  454. ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
  455. ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
  456. ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
  457.  
  458. Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
  459. Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
  460. Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
  461. Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
  462. Drivers32: vidc.i420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
  463.  
  464. [color=#E56717]========== Files/Folders - Created Within 90 Days ==========[/color]
  465.  
  466. [2012/11/19 17:31:42 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Arowana\Desktop\OTL.scr
  467. [2012/11/19 12:57:59 | 000,688,901 | R--- | C] (Swearware) -- C:\Users\Arowana\Desktop\dds.com
  468. [2012/11/19 12:42:54 | 000,000,000 | ---D | C] -- C:\Users\Arowana\Documents\Askew Electric
  469. [2012/11/18 03:03:47 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
  470. [2012/11/18 03:03:45 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
  471. [2012/11/18 03:03:45 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
  472. [2012/11/18 03:03:45 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
  473. [2012/11/18 03:03:44 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
  474. [2012/11/18 03:03:43 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
  475. [2012/11/18 03:03:43 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
  476. [2012/11/18 03:03:40 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
  477. [2012/11/15 23:59:42 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\synceng.dll
  478. [2012/11/15 23:59:23 | 002,047,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
  479. [2012/10/29 18:59:10 | 000,000,000 | ---D | C] -- C:\Users\Arowana\AppData\Local\Macromedia
  480. [2012/10/29 18:57:58 | 000,696,760 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
  481. [2012/10/28 13:30:25 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
  482. [2012/10/10 18:46:40 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
  483. [2012/10/10 18:46:02 | 003,602,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
  484. [2012/10/10 18:46:01 | 003,550,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
  485. [2012/10/09 20:38:16 | 000,000,000 | ---D | C] -- C:\Users\Arowana\Documents\AdobeStockPhotos
  486. [2012/10/08 18:34:32 | 000,000,000 | ---D | C] -- C:\Users\Arowana\AppData\Local\Canon Easy-PhotoPrint EX
  487. [2012/10/08 18:32:46 | 000,000,000 | ---D | C] -- C:\Users\Arowana\AppData\Roaming\Canon
  488. [2012/10/08 18:14:57 | 000,000,000 | ---D | C] -- C:\Users\Arowana\Documents\Updater
  489. [2012/10/08 18:02:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon IJ Network Utilities
  490. [2012/10/08 18:02:02 | 001,310,720 | ---- | C] (CANON INC.) -- C:\Windows\System32\CNC350C.dll
  491. [2012/10/08 18:02:02 | 000,110,592 | ---- | C] (CANON INC.) -- C:\Windows\System32\CNC350I.dll
  492. [2012/10/08 18:02:01 | 000,307,200 | ---- | C] (CANON INC.) -- C:\Windows\System32\CNC350L.dll
  493. [2012/10/08 18:02:01 | 000,102,400 | ---- | C] (CANON INC.) -- C:\Windows\System32\CNC350U.dll
  494. [2012/10/08 18:02:01 | 000,015,872 | ---- | C] (CANON INC.) -- C:\Windows\System32\CNHMCA.dll
  495. [2012/10/08 17:44:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MX350 series User Registration
  496. [2012/10/08 17:43:51 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\CANON
  497. [2012/10/08 17:41:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
  498. [2012/10/08 17:40:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MX350 series Manual
  499. [2012/10/08 17:39:07 | 000,000,000 | ---D | C] -- C:\Program Files\Canon
  500. [2012/10/08 17:27:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
  501. [2012/10/08 17:27:21 | 000,821,736 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll
  502. [2012/10/08 17:27:21 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
  503. [2012/10/08 17:27:04 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
  504. [2012/10/08 17:27:04 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe
  505. [2012/10/08 17:27:04 | 000,093,672 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
  506. [2012/10/08 17:26:26 | 000,000,000 | ---D | C] -- C:\Program Files\Java
  507. [2012/09/25 16:21:01 | 000,000,000 | ---D | C] -- C:\Windows\System32\STRING
  508. [2012/09/25 16:21:00 | 000,354,816 | ---- | C] (CANON INC.) -- C:\Windows\System32\CNMNPPM.DLL
  509. [2012/09/25 16:21:00 | 000,137,216 | ---- | C] (CANON INC.) -- C:\Windows\System32\CNMNPUI.DLL
  510. [2012/09/25 16:20:57 | 000,000,000 | ---D | C] -- C:\Windows\System32\CHM
  511. [2012/09/25 16:20:04 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonBJ
  512. [2012/09/25 16:19:08 | 000,000,000 | -H-D | C] -- C:\Windows\System32\CanonIJ Uninstaller Information
  513. [2012/09/25 16:19:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MX350 series
  514. [2012/09/25 16:15:15 | 000,277,504 | ---- | C] (CANON INC.) -- C:\Windows\System32\CNMLMA6.DLL
  515. [2012/09/25 16:14:02 | 000,003,072 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlTH.DLL
  516. [2012/09/25 16:14:02 | 000,003,072 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlKR.DLL
  517. [2012/09/25 16:14:02 | 000,002,560 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlTW.DLL
  518. [2012/09/25 16:14:02 | 000,002,560 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlCN.DLL
  519. [2012/09/25 16:14:01 | 000,003,584 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlSE.DLL
  520. [2012/09/25 16:14:01 | 000,003,584 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlID.DLL
  521. [2012/09/25 16:14:01 | 000,003,584 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlGR.DLL
  522. [2012/09/25 16:14:01 | 000,003,584 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlFI.DLL
  523. [2012/09/25 16:14:01 | 000,003,072 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlTR.DLL
  524. [2012/09/25 16:14:01 | 000,003,072 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlNO.DLL
  525. [2012/09/25 16:14:01 | 000,003,072 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlDK.DLL
  526. [2012/09/25 16:14:01 | 000,003,072 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlAR.DLL
  527. [2012/09/25 16:14:00 | 000,003,584 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlRU.DLL
  528. [2012/09/25 16:14:00 | 000,003,584 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlPT.DLL
  529. [2012/09/25 16:14:00 | 000,003,584 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlPL.DLL
  530. [2012/09/25 16:14:00 | 000,003,584 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlNL.DLL
  531. [2012/09/25 16:14:00 | 000,003,584 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlIT.DLL
  532. [2012/09/25 16:14:00 | 000,003,584 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlFR.DLL
  533. [2012/09/25 16:14:00 | 000,003,584 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlES.DLL
  534. [2012/09/25 16:14:00 | 000,003,584 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlDE.DLL
  535. [2012/09/25 16:14:00 | 000,003,072 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlUS.DLL
  536. [2012/09/25 16:14:00 | 000,003,072 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlHU.DLL
  537. [2012/09/25 16:14:00 | 000,003,072 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlCZ.DLL
  538. [2012/09/25 16:14:00 | 000,002,560 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFLlJP.DLL
  539. [2012/09/25 16:13:58 | 000,168,448 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCFMSl.EXE
  540. [2012/09/25 16:13:57 | 000,296,960 | ---- | C] (Canon Inc.) -- C:\Windows\System32\CNCF2Ll.DLL
  541. [2012/09/25 16:13:49 | 000,179,200 | ---- | C] (CANON INC.) -- C:\Windows\System32\CNMIUA6.DLL
  542. [2012/09/25 16:13:35 | 000,000,000 | -H-D | C] -- C:\Program Files\CanonBJ
  543. [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
  544.  
  545. [color=#E56717]========== Files - Modified Within 90 Days ==========[/color]
  546.  
  547. [2012/11/19 17:31:47 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Arowana\Desktop\OTL.scr
  548. [2012/11/19 17:31:07 | 000,651,460 | ---- | M] () -- C:\Windows\System32\perfh009.dat
  549. [2012/11/19 17:31:07 | 000,122,062 | ---- | M] () -- C:\Windows\System32\perfc009.dat
  550. [2012/11/19 17:29:48 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
  551. [2012/11/19 17:29:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
  552. [2012/11/19 12:58:05 | 000,688,901 | R--- | M] (Swearware) -- C:\Users\Arowana\Desktop\dds.com
  553. [2012/11/19 12:37:52 | 000,002,571 | ---- | M] () -- C:\Users\Arowana\Desktop\Microsoft Excel 2010.lnk
  554. [2012/11/19 12:35:39 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
  555. [2012/11/19 12:35:39 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
  556. [2012/11/19 12:35:25 | 3209,138,176 | -HS- | M] () -- C:\hiberfil.sys
  557. [2012/11/18 21:47:42 | 000,000,044 | ---- | M] () -- C:\Users\Arowana\AppData\Roaming\mbam.context.scan
  558. [2012/11/18 03:35:39 | 000,341,160 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
  559. [2012/11/15 13:28:31 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
  560. [2012/11/13 21:10:56 | 000,476,672 | ---- | M] () -- C:\Users\Arowana\AppData\Roaming\wisnit.dll
  561. [2012/10/29 18:57:59 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
  562. [2012/10/29 18:57:58 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
  563. [2012/10/16 20:07:47 | 000,130,037 | ---- | M] () -- C:\Users\Arowana\Desktop\photo 2.JPG
  564. [2012/10/16 20:06:42 | 000,133,210 | ---- | M] () -- C:\Users\Arowana\Desktop\photo.JPG
  565. [2012/10/16 16:05:44 | 000,017,920 | ---- | M] () -- C:\Users\Arowana\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
  566. [2012/10/16 15:46:08 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
  567. [2012/10/12 09:29:30 | 002,047,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
  568. [2012/10/08 17:29:45 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
  569. [2012/10/08 17:26:46 | 000,093,672 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
  570. [2012/10/08 17:26:35 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
  571. [2012/10/08 17:26:35 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
  572. [2012/10/08 17:26:34 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\java.exe
  573. [2012/10/08 17:26:33 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll
  574. [2012/10/08 17:26:33 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\deployJava1.dll
  575. [2012/10/08 17:18:07 | 000,001,887 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
  576. [2012/10/08 02:56:24 | 001,800,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
  577. [2012/10/08 02:47:44 | 001,427,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
  578. [2012/10/08 02:46:32 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\url.dll
  579. [2012/10/08 02:45:17 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
  580. [2012/10/08 02:44:05 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
  581. [2012/10/08 02:42:31 | 000,607,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
  582. [2012/10/08 02:40:56 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
  583. [2012/10/08 02:37:23 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
  584. [2012/09/29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
  585. [2012/09/25 11:19:41 | 000,075,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\synceng.dll
  586. [2012/09/13 08:28:08 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
  587. [2012/09/10 23:36:06 | 548,964,352 | ---- | M] () -- C:\Users\Arowana\Desktop\LouiseTwilley.avi
  588. [2012/08/30 21:03:50 | 000,099,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\NisDrvWFP.sys
  589. [2012/08/29 06:27:41 | 003,602,816 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
  590. [2012/08/29 06:27:41 | 003,550,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
  591. [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
  592.  
  593. [color=#E56717]========== Files Created - No Company Name ==========[/color]
  594.  
  595. [2012/11/19 12:37:32 | 000,002,571 | ---- | C] () -- C:\Users\Arowana\Desktop\Microsoft Excel 2010.lnk
  596. [2012/11/18 21:47:42 | 000,000,044 | ---- | C] () -- C:\Users\Arowana\AppData\Roaming\mbam.context.scan
  597. [2012/11/15 13:28:31 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
  598. [2012/11/13 21:10:54 | 000,476,672 | ---- | C] () -- C:\Users\Arowana\AppData\Roaming\wisnit.dll
  599. [2012/10/29 18:57:59 | 000,000,830 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
  600. [2012/10/16 20:07:46 | 000,130,037 | ---- | C] () -- C:\Users\Arowana\Desktop\photo 2.JPG
  601. [2012/10/16 20:06:27 | 000,133,210 | ---- | C] () -- C:\Users\Arowana\Desktop\photo.JPG
  602. [2012/10/16 15:46:08 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
  603. [2012/10/08 18:02:01 | 000,014,592 | ---- | C] () -- C:\Windows\System32\CNC1742D.TBL
  604. [2012/10/08 17:18:07 | 000,001,887 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
  605. [2012/09/11 12:32:20 | 548,964,352 | ---- | C] () -- C:\Users\Arowana\Desktop\LouiseTwilley.avi
  606. [2012/06/06 21:20:24 | 000,000,632 | RHS- | C] () -- C:\Users\Arowana\ntuser.pol
  607. [2012/01/18 05:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll
  608. [2012/01/18 05:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll
  609. [2012/01/18 05:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe
  610. [2012/01/18 05:22:54 | 000,028,418 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
  611. [2011/05/16 20:30:33 | 000,000,048 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
  612. [2011/03/24 10:24:29 | 000,017,920 | ---- | C] () -- C:\Users\Arowana\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
  613. [2010/02/10 19:07:50 | 025,315,840 | ---- | C] () -- C:\ProgramData\SOSHOME2009-RB.bak
  614. [2010/02/10 15:33:22 | 000,000,680 | ---- | C] () -- C:\Users\Arowana\AppData\Local\d3d9caps.dat
  615.  
  616. [color=#E56717]========== ZeroAccess Check ==========[/color]
  617.  
  618. [2006/11/02 07:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
  619.  
  620. [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  621.  
  622. [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
  623.  
  624. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  625. "" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 12:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
  626. "ThreadingModel" = Apartment
  627.  
  628. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
  629. "" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 01:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
  630. "ThreadingModel" = Free
  631.  
  632. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
  633. "" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 01:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
  634. "ThreadingModel" = Both
  635.  
  636. [color=#E56717]========== LOP Check ==========[/color]
  637.  
  638. [2012/05/04 11:59:30 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\.minecraft
  639. [2012/10/10 19:52:19 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Canon
  640. [2012/07/12 09:04:48 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Dropbox
  641. [2011/04/23 10:16:26 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\EurekaLog
  642. [2012/07/27 17:46:17 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\FileZilla
  643. [2011/03/24 10:34:27 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\HamsterSoft
  644. [2010/07/18 13:37:25 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Image Zone Express
  645. [2011/04/15 15:24:16 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Jasc
  646. [2012/08/09 19:54:28 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Notepad++
  647. [2011/05/19 23:34:00 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Opera
  648. [2010/07/18 13:31:40 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Printer Info Cache
  649. [2012/02/01 17:27:15 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\SecondLife
  650. [2011/03/23 10:53:05 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\svBuilder
  651. [2012/06/07 10:19:37 | 000,000,000 | ---D | M] -- C:\Users\Cheyenne\AppData\Roaming\.minecraft
  652. [2012/06/07 17:11:00 | 000,000,000 | ---D | M] -- C:\Users\Cheyenne\AppData\Roaming\SecondLife
  653.  
  654. [color=#E56717]========== Purity Check ==========[/color]
  655.  
  656.  
  657.  
  658. [color=#E56717]========== Custom Scans ==========[/color]
  659.  
  660. [color=#A23BEC]< %SYSTEMDRIVE%\*.* >[/color]
  661. [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
  662. [2009/04/11 01:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
  663. [2010/02/10 18:19:47 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
  664. [2006/09/18 16:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
  665. [2008/04/11 09:07:18 | 000,003,820 | ---- | M] () -- C:\eula.1028.txt
  666. [2008/04/11 09:07:18 | 000,015,428 | ---- | M] () -- C:\eula.1031.txt
  667. [2008/04/11 09:07:18 | 000,010,058 | ---- | M] () -- C:\eula.1033.txt
  668. [2008/04/11 09:07:18 | 000,012,246 | ---- | M] () -- C:\eula.1036.txt
  669. [2008/04/11 09:07:18 | 000,013,912 | ---- | M] () -- C:\eula.1040.txt
  670. [2008/04/11 09:07:18 | 000,005,868 | ---- | M] () -- C:\eula.1041.txt
  671. [2008/04/11 09:07:18 | 000,005,970 | ---- | M] () -- C:\eula.1042.txt
  672. [2008/04/11 09:07:18 | 000,010,134 | ---- | M] () -- C:\eula.1049.txt
  673. [2008/04/11 09:07:18 | 000,003,814 | ---- | M] () -- C:\eula.2052.txt
  674. [2008/04/11 09:07:18 | 000,012,936 | ---- | M] () -- C:\eula.3082.txt
  675. [2008/04/11 09:07:18 | 000,001,110 | ---- | M] () -- C:\globdata.ini
  676. [2012/11/19 12:35:25 | 3209,138,176 | -HS- | M] () -- C:\hiberfil.sys
  677. [2008/04/11 07:03:48 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe
  678. [2008/04/11 09:07:18 | 000,000,843 | ---- | M] () -- C:\install.ini
  679. [2008/04/11 07:03:48 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll
  680. [2008/04/11 07:03:48 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll
  681. [2008/04/11 07:03:48 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll
  682. [2008/04/11 07:03:48 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll
  683. [2008/04/11 07:03:48 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll
  684. [2008/04/11 07:03:48 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll
  685. [2008/04/11 07:03:48 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll
  686. [2008/04/11 09:09:24 | 000,093,200 | ---- | M] (Microsoft Corporation) -- C:\install.res.1049.dll
  687. [2008/04/11 07:03:48 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll
  688. [2008/04/11 07:03:48 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll
  689. [2012/11/19 12:35:22 | 3524,980,736 | -HS- | M] () -- C:\pagefile.sys
  690. [2008/04/11 09:07:18 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp
  691. [2008/04/11 09:09:38 | 003,797,292 | ---- | M] () -- C:\VC_RED.cab
  692. [2008/04/11 09:11:40 | 000,233,472 | ---- | M] () -- C:\VC_RED.MSI
  693.  
  694. [color=#A23BEC]< %USERPROFILE%\*.* >[/color]
  695. [2012/11/19 17:34:58 | 003,670,016 | -HS- | M] () -- C:\Users\Arowana\NTUSER.DAT
  696. [2012/11/19 17:34:58 | 000,262,144 | -H-- | M] () -- C:\Users\Arowana\ntuser.dat.LOG1
  697. [2010/02/10 15:33:20 | 000,000,000 | -H-- | M] () -- C:\Users\Arowana\ntuser.dat.LOG2
  698. [2012/11/18 22:12:59 | 000,065,536 | -HS- | M] () -- C:\Users\Arowana\NTUSER.DAT{0d3ea54e-c5e5-11df-b03f-001644c73dd0}.TM.blf
  699. [2012/11/18 22:12:59 | 000,524,288 | -HS- | M] () -- C:\Users\Arowana\NTUSER.DAT{0d3ea54e-c5e5-11df-b03f-001644c73dd0}.TMContainer00000000000000000001.regtrans-ms
  700. [2010/09/21 20:02:56 | 000,524,288 | -HS- | M] () -- C:\Users\Arowana\NTUSER.DAT{0d3ea54e-c5e5-11df-b03f-001644c73dd0}.TMContainer00000000000000000002.regtrans-ms
  701. [2010/09/18 19:29:29 | 000,065,536 | -HS- | M] () -- C:\Users\Arowana\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
  702. [2010/09/18 19:29:29 | 000,524,288 | -HS- | M] () -- C:\Users\Arowana\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
  703. [2010/02/10 15:50:43 | 000,524,288 | -HS- | M] () -- C:\Users\Arowana\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
  704. [2010/02/10 15:33:21 | 000,000,020 | -HS- | M] () -- C:\Users\Arowana\ntuser.ini
  705. [2012/06/06 21:24:22 | 000,000,632 | RHS- | M] () -- C:\Users\Arowana\ntuser.pol
  706.  
  707. [color=#A23BEC]< %USERPROFILE%\temp\*.exe >[/color]
  708.  
  709. [color=#A23BEC]< %USERPROFILE%\AppData\Local\*.* >[/color]
  710. [2010/02/14 17:30:34 | 000,000,680 | ---- | M] () -- C:\Users\Arowana\AppData\Local\d3d9caps.dat
  711. [2012/10/16 16:05:44 | 000,017,920 | ---- | M] () -- C:\Users\Arowana\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
  712. [2012/07/14 22:02:02 | 000,094,000 | ---- | M] () -- C:\Users\Arowana\AppData\Local\GDIPFONTCACHEV1.DAT
  713. [2012/11/18 22:12:52 | 002,119,268 | -H-- | M] () -- C:\Users\Arowana\AppData\Local\IconCache.db
  714.  
  715. [color=#A23BEC]< %USERPROFILE%\AppData\Local\*. >[/color]
  716. [2012/01/13 11:18:53 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Local\Adobe
  717. [2010/02/10 15:33:21 | 000,000,000 | -HSD | M] -- C:\Users\Arowana\AppData\Local\Application Data
  718. [2011/06/06 18:52:58 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Local\Apps
  719. [2012/10/10 20:19:58 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Local\Canon Easy-PhotoPrint EX
  720. [2012/04/18 20:36:11 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Local\CrashRpt
  721. [2012/08/09 19:52:51 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Local\Google
  722. [2010/02/10 15:33:21 | 000,000,000 | -HSD | M] -- C:\Users\Arowana\AppData\Local\History
  723. [2010/05/06 19:28:51 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Local\HP
  724. [2010/08/29 16:07:17 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Local\InstallAgent
  725. [2012/02/01 17:25:45 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Local\Kitely
  726. [2012/10/29 18:59:10 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Local\Macromedia
  727. [2012/11/18 18:43:21 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Local\Microsoft
  728. [2012/10/20 15:33:44 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Local\Microsoft Games
  729. [2012/07/05 13:08:27 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Local\Microsoft Help
  730. [2010/02/14 18:18:10 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Local\Mozilla
  731. [2011/05/25 22:53:18 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Local\Roblox
  732. [2012/06/22 12:21:22 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Local\SecondLife
  733. [2012/11/19 17:31:42 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Local\Temp
  734. [2010/02/10 15:33:21 | 000,000,000 | -HSD | M] -- C:\Users\Arowana\AppData\Local\Temporary Internet Files
  735. [2010/05/06 19:31:23 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Local\VirtualStore
  736.  
  737. [color=#A23BEC]< %USERPROFILE%\AppData\Local\temp\*.exe >[/color]
  738. [2010/06/11 19:18:56 | 000,149,352 | R--- | M] (Microsoft Corporation) -- C:\Users\Arowana\AppData\Local\temp\ose00000.exe
  739. [7 C:\Users\Arowana\AppData\Local\temp\*.tmp files -> C:\Users\Arowana\AppData\Local\temp\*.tmp -> ]
  740.  
  741. [color=#A23BEC]< %USERPROFILE%\AppData\Roaming\*.* >[/color]
  742. [2012/11/18 21:47:42 | 000,000,044 | ---- | M] () -- C:\Users\Arowana\AppData\Roaming\mbam.context.scan
  743. [2012/11/13 21:10:56 | 000,476,672 | ---- | M] () -- C:\Users\Arowana\AppData\Roaming\wisnit.dll
  744.  
  745. [color=#A23BEC]< %USERPROFILE%\AppData\Roaming\*. >[/color]
  746. [2012/05/04 11:59:30 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\.minecraft
  747. [2012/02/08 14:17:18 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Adobe
  748. [2012/10/10 19:52:19 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Canon
  749. [2012/07/12 09:04:48 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Dropbox
  750. [2011/04/23 10:16:26 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\EurekaLog
  751. [2012/07/27 17:46:17 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\FileZilla
  752. [2011/03/24 10:34:27 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\HamsterSoft
  753. [2010/05/06 19:31:15 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\HP
  754. [2010/06/01 09:42:09 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\HpUpdate
  755. [2010/02/10 15:33:27 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Identities
  756. [2010/07/18 13:37:25 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Image Zone Express
  757. [2010/02/14 17:18:44 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\InstallShield
  758. [2011/04/15 15:24:16 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Jasc
  759. [2010/09/16 10:30:39 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Jasc Software Inc
  760. [2010/02/14 18:05:26 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Macromedia
  761. [2010/02/14 18:20:00 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Malwarebytes
  762. [2006/11/02 07:37:34 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Media Center Programs
  763. [2012/10/29 18:59:10 | 000,000,000 | --SD | M] -- C:\Users\Arowana\AppData\Roaming\Microsoft
  764. [2010/02/14 18:18:20 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Mozilla
  765. [2012/08/09 19:54:28 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Notepad++
  766. [2011/05/19 23:34:00 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Opera
  767. [2010/07/18 13:31:40 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Printer Info Cache
  768. [2012/02/01 17:27:15 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\SecondLife
  769. [2012/08/09 19:33:49 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\Skype
  770. [2011/06/28 16:56:33 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\skypePM
  771. [2011/03/23 10:53:05 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\svBuilder
  772. [2012/11/19 12:35:54 | 000,000,000 | ---D | M] -- C:\Users\Arowana\AppData\Roaming\WTablet
  773.  
  774. [color=#A23BEC]< %Public%\Documents\Softwrap\YOYOGAMESGM70FINAL\*.exe >[/color]
  775.  
  776. [color=#A23BEC]< %Public%\Documents\Fonts\*.exe >[/color]
  777.  
  778. [color=#A23BEC]< %Public%\Documents\Config\*.exe >[/color]
  779.  
  780. [color=#A23BEC]< %Public%\Documents\*.* >[/color]
  781. [2008/01/20 21:43:21 | 000,000,280 | -HS- | M] () -- C:\Users\Public\Documents\desktop.ini
  782.  
  783. [color=#A23BEC]< %ProgramData%\*.* >[/color]
  784. [2011/05/16 20:30:33 | 000,000,048 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat
  785. [2012/07/12 09:01:53 | 000,006,107 | ---- | M] () -- C:\ProgramData\hpzinstall.log
  786. [2010/02/10 19:07:52 | 025,315,840 | ---- | M] () -- C:\ProgramData\SOSHOME2009-RB.bak
  787.  
  788. [color=#A23BEC]< %ProgramData%\*. >[/color]
  789. [2012/01/13 11:16:40 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe
  790. [2010/09/16 10:44:08 | 000,000,000 | ---D | M] -- C:\ProgramData\Adobe Systems
  791. [2010/08/29 16:12:14 | 000,000,000 | ---D | M] -- C:\ProgramData\AOP
  792. [2010/06/24 20:53:41 | 000,000,000 | ---D | M] -- C:\ProgramData\AppData
  793. [2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
  794. [2012/01/13 11:25:40 | 000,000,000 | ---D | M] -- C:\ProgramData\avg9
  795. [2012/09/25 16:20:04 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonBJ
  796. [2011/03/14 10:25:32 | 000,000,000 | -H-D | M] -- C:\ProgramData\Common Files
  797. [2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
  798. [2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
  799. [2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
  800. [2010/05/06 19:27:28 | 000,000,000 | ---D | M] -- C:\ProgramData\Hewlett-Packard
  801. [2012/07/12 09:01:24 | 000,000,000 | ---D | M] -- C:\ProgramData\HP
  802. [2010/02/14 18:19:54 | 000,000,000 | ---D | M] -- C:\ProgramData\Malwarebytes
  803. [2012/08/09 19:12:59 | 000,000,000 | ---D | M] -- C:\ProgramData\McAfee
  804. [2012/01/20 17:13:35 | 000,000,000 | --SD | M] -- C:\ProgramData\Microsoft
  805. [2012/11/18 03:05:52 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft Help
  806. [2010/02/14 16:36:48 | 000,000,000 | ---D | M] -- C:\ProgramData\Motive
  807. [2012/05/19 22:48:42 | 000,000,000 | ---D | M] -- C:\ProgramData\Mozilla
  808. [2012/09/25 16:31:04 | 000,000,000 | ---D | M] -- C:\ProgramData\Skype
  809. [2011/06/28 17:06:42 | 000,000,000 | ---D | M] -- C:\ProgramData\Skype Extras
  810. [2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
  811. [2011/05/05 19:56:32 | 000,000,000 | ---D | M] -- C:\ProgramData\Sun
  812. [2010/06/24 20:45:23 | 000,000,000 | ---D | M] -- C:\ProgramData\Tablet
  813. [2006/11/02 08:02:04 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
  814. [2010/05/06 19:29:00 | 000,000,000 | ---D | M] -- C:\ProgramData\WEBREG
  815. [2012/08/09 19:38:07 | 000,000,000 | ---D | M] -- C:\ProgramData\Western Digital
  816. [2012/01/18 23:01:56 | 000,000,000 | ---D | M] -- C:\ProgramData\WindowsSearch
  817.  
  818. [color=#A23BEC]< %CommonProgramFiles%\*.* >[/color]
  819.  
  820. [color=#A23BEC]< %CommonProgramFiles%\ComObjects*.exe >[/color]
  821. Invalid Environment Variable: commonprogramfiles(x86)
  822.  
  823. [color=#A23BEC]< %programfiles%\*.* >[/color]
  824. [2008/01/20 21:43:21 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini
  825.  
  826. [color=#A23BEC]< %programfiles%\*. >[/color]
  827. [2012/08/09 20:15:28 | 000,000,000 | ---D | M] -- C:\Program Files\7-Zip
  828. [2012/08/09 19:55:48 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
  829. [2012/07/12 08:50:00 | 000,000,000 | ---D | M] -- C:\Program Files\AOP
  830. [2010/02/14 18:13:05 | 000,000,000 | ---D | M] -- C:\Program Files\AVG
  831. [2010/02/10 16:43:54 | 000,000,000 | ---D | M] -- C:\Program Files\Business Objects
  832. [2012/10/08 18:02:14 | 000,000,000 | ---D | M] -- C:\Program Files\Canon
  833. [2012/09/25 16:13:35 | 000,000,000 | -H-D | M] -- C:\Program Files\CanonBJ
  834. [2012/10/08 17:43:51 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
  835. [2012/08/09 19:33:37 | 000,000,000 | ---D | M] -- C:\Program Files\FileZilla FTP Client
  836. [2012/07/12 08:51:29 | 000,000,000 | ---D | M] -- C:\Program Files\Hamster Soft
  837. [2012/07/12 08:58:09 | 000,000,000 | ---D | M] -- C:\Program Files\HP
  838. [2010/09/16 10:46:29 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
  839. [2012/11/18 03:32:28 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
  840. [2012/10/08 17:26:26 | 000,000,000 | ---D | M] -- C:\Program Files\Java
  841. [2012/11/15 13:28:33 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
  842. [2012/01/20 17:07:30 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Analysis Services
  843. [2006/11/02 07:37:34 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Games
  844. [2012/01/20 17:13:46 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
  845. [2012/10/08 17:29:41 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Security Client
  846. [2012/05/19 22:41:52 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Silverlight
  847. [2011/03/22 22:36:10 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft SQL Server
  848. [2012/01/20 17:13:35 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft.NET
  849. [2011/05/14 17:58:14 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
  850. [2012/10/28 13:31:49 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
  851. [2012/11/10 20:40:26 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Maintenance Service
  852. [2006/11/02 07:37:34 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
  853. [2012/01/09 19:37:05 | 000,000,000 | ---D | M] -- C:\Program Files\MSECache
  854. [2010/05/09 17:23:32 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 4.0
  855. [2012/08/09 19:54:28 | 000,000,000 | ---D | M] -- C:\Program Files\Notepad++
  856. [2010/02/14 17:18:56 | 000,000,000 | ---D | M] -- C:\Program Files\Realtek
  857. [2010/02/14 18:02:22 | 000,000,000 | ---D | M] -- C:\Program Files\REALTEK USB Wireless LAN Driver
  858. [2006/11/02 07:37:34 | 000,000,000 | ---D | M] -- C:\Program Files\Reference Assemblies
  859. [2012/07/12 08:50:13 | 000,000,000 | ---D | M] -- C:\Program Files\Search Toolbar
  860. [2012/09/25 16:30:55 | 000,000,000 | R--D | M] -- C:\Program Files\Skype
  861. [2010/09/18 19:22:20 | 000,000,000 | ---D | M] -- C:\Program Files\Tablet
  862. [2006/11/02 08:01:55 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
  863. [2012/08/09 19:51:33 | 000,000,000 | ---D | M] -- C:\Program Files\VideoLAN
  864. [2011/05/14 17:58:15 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Calendar
  865. [2011/05/14 17:58:13 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Collaboration
  866. [2011/05/14 17:58:08 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Defender
  867. [2012/05/13 16:49:00 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Journal
  868. [2012/04/11 20:25:57 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Mail
  869. [2011/05/14 17:58:13 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
  870. [2006/11/02 07:37:34 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
  871. [2011/05/14 17:58:12 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Photo Gallery
  872. [2011/05/15 14:15:41 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Portable Devices
  873. [2011/05/14 17:58:13 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Sidebar
  874. Invalid Environment Variable: ProgramFiles(x86)
  875. Invalid Environment Variable: ProgramFiles(x86)
  876.  
  877. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\AppData\Local\*.* >[/color]
  878. [2010/02/10 15:31:38 | 000,001,356 | ---- | M] () -- C:\Windows\system32\config\systemprofile\AppData\Local\d3d9caps.dat
  879. [2006/11/02 08:01:48 | 000,000,006 | -HS- | M] () -- C:\Windows\system32\config\systemprofile\AppData\Local\desktop.ini
  880. [2010/02/10 15:31:18 | 000,048,600 | ---- | M] () -- C:\Windows\system32\config\systemprofile\AppData\Local\GDIPFONTCACHEV1.DAT
  881.  
  882. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\AppData\Roaming\*.* >[/color]
  883.  
  884. [color=#A23BEC]< %windir%\SysWOW64\config\systemprofile\AppData\Local\*.* >[/color]
  885.  
  886. [color=#A23BEC]< %windir%\SysWOW64\config\systemprofile\AppData\Roaming\*.* >[/color]
  887.  
  888. [color=#A23BEC]< %windir%\ServiceProfiles\LocalService\AppData\Local\Temp\*.tlb >[/color]
  889.  
  890. [color=#A23BEC]< %windir%\ServiceProfiles\NetworkService\AppData\Local\Temp\*.tlb >[/color]
  891.  
  892. [color=#A23BEC]< %windir%\temp\*.exe >[/color]
  893. [2010/10/26 16:03:06 | 000,497,296 | ---- | M] (McAfee, Inc.) -- C:\Windows\temp\contentDATs.exe
  894. [4 C:\Windows\temp\*.tmp files -> C:\Windows\temp\*.tmp -> ]
  895.  
  896. [color=#A23BEC]< %windir%\*. >[/color]
  897. [2011/05/14 17:57:25 | 000,000,000 | ---D | M] -- C:\Windows\AppPatch
  898. [2012/11/18 03:49:10 | 000,000,000 | R-SD | M] -- C:\Windows\assembly
  899. [2008/01/20 21:32:37 | 000,000,000 | ---D | M] -- C:\Windows\Boot
  900. [2006/11/02 07:37:35 | 000,000,000 | ---D | M] -- C:\Windows\Branding
  901. [2010/06/24 20:44:46 | 000,000,000 | ---D | M] -- C:\Windows\calib_da
  902. [2006/11/02 07:37:35 | 000,000,000 | ---D | M] -- C:\Windows\Cursors
  903. [2011/03/09 16:25:40 | 000,000,000 | ---D | M] -- C:\Windows\Debug
  904. [2008/01/20 21:34:51 | 000,000,000 | ---D | M] -- C:\Windows\DigitalLocker
  905. [2012/01/20 16:52:52 | 000,000,000 | --SD | M] -- C:\Windows\Downloaded Program Files
  906. [2012/01/14 03:01:10 | 000,000,000 | ---D | M] -- C:\Windows\ehome
  907. [2006/11/02 07:42:32 | 000,000,000 | ---D | M] -- C:\Windows\en-US
  908. [2012/07/12 09:01:24 | 000,000,000 | R-SD | M] -- C:\Windows\Fonts
  909. [2006/11/02 05:22:47 | 000,000,000 | ---D | M] -- C:\Windows\Globalization
  910. [2006/11/02 07:42:30 | 000,000,000 | ---D | M] -- C:\Windows\Help
  911. [2010/06/01 09:41:34 | 000,000,000 | ---D | M] -- C:\Windows\Hewlett-Packard
  912. [2011/05/14 17:58:01 | 000,000,000 | ---D | M] -- C:\Windows\IME
  913. [2012/11/19 17:31:07 | 000,000,000 | ---D | M] -- C:\Windows\inf
  914. [2012/11/18 03:17:16 | 000,000,000 | -HSD | M] -- C:\Windows\Installer
  915. [2008/01/20 21:34:51 | 000,000,000 | ---D | M] -- C:\Windows\L2Schemas
  916. [2012/11/15 19:49:50 | 000,000,000 | ---D | M] -- C:\Windows\LiveKernelReports
  917. [2010/02/14 18:11:13 | 000,000,000 | ---D | M] -- C:\Windows\Logs
  918. [2012/10/08 18:02:02 | 000,000,000 | R-SD | M] -- C:\Windows\Media
  919. [2012/11/18 03:49:52 | 000,000,000 | ---D | M] -- C:\Windows\Microsoft.NET
  920. [2012/07/14 21:57:09 | 000,000,000 | ---D | M] -- C:\Windows\Minidump
  921. [2006/11/02 05:23:07 | 000,000,000 | ---D | M] -- C:\Windows\ModemLogs
  922. [2008/01/20 21:34:54 | 000,000,000 | ---D | M] -- C:\Windows\MSAgent
  923. [2006/11/02 06:18:35 | 000,000,000 | ---D | M] -- C:\Windows\nap
  924. [2012/01/20 16:52:55 | 000,000,000 | R--D | M] -- C:\Windows\Offline Web Pages
  925. [2010/02/10 18:25:22 | 000,000,000 | ---D | M] -- C:\Windows\Panther
  926. [2010/02/10 16:37:50 | 000,000,000 | ---D | M] -- C:\Windows\PCHEALTH
  927. [2006/11/02 07:37:35 | 000,000,000 | ---D | M] -- C:\Windows\Performance
  928. [2006/11/02 06:18:36 | 000,000,000 | ---D | M] -- C:\Windows\PLA
  929. [2012/01/20 16:52:55 | 000,000,000 | ---D | M] -- C:\Windows\PolicyDefinitions
  930. [2012/11/19 17:32:05 | 000,000,000 | ---D | M] -- C:\Windows\Prefetch
  931. [2006/11/02 06:18:36 | 000,000,000 | ---D | M] -- C:\Windows\Provisioning
  932. [2011/03/22 22:31:01 | 000,000,000 | ---D | M] -- C:\Windows\Registration
  933. [2012/10/11 19:37:58 | 000,000,000 | ---D | M] -- C:\Windows\rescache
  934. [2006/11/02 06:18:36 | 000,000,000 | ---D | M] -- C:\Windows\Resources
  935. [2006/11/02 05:24:41 | 000,000,000 | ---D | M] -- C:\Windows\SchCache
  936. [2006/11/02 07:37:34 | 000,000,000 | ---D | M] -- C:\Windows\schemas
  937. [2006/11/02 06:18:36 | 000,000,000 | ---D | M] -- C:\Windows\security
  938. [2006/11/02 07:47:53 | 000,000,000 | ---D | M] -- C:\Windows\ServiceProfiles
  939. [2011/05/14 17:58:08 | 000,000,000 | ---D | M] -- C:\Windows\servicing
  940. [2006/11/02 07:47:56 | 000,000,000 | ---D | M] -- C:\Windows\Setup
  941. [2012/01/20 17:07:45 | 000,000,000 | ---D | M] -- C:\Windows\ShellNew
  942. [2011/03/15 19:12:41 | 000,000,000 | ---D | M] -- C:\Windows\SoftwareDistribution
  943. [2006/11/02 07:42:30 | 000,000,000 | ---D | M] -- C:\Windows\Speech
  944. [2010/02/10 16:41:36 | 000,000,000 | ---D | M] -- C:\Windows\SQL9_KB954606_ENU
  945. [2011/03/17 11:51:01 | 000,000,000 | ---D | M] -- C:\Windows\SQL9_KB970892_ENU
  946. [2010/02/10 16:43:10 | 000,000,000 | ---D | M] -- C:\Windows\SQLTools9_KB954606_ENU
  947. [2011/03/17 11:53:32 | 000,000,000 | ---D | M] -- C:\Windows\SQLTools9_KB970892_ENU
  948. [2006/11/02 07:37:35 | 000,000,000 | ---D | M] -- C:\Windows\system
  949. [2012/11/19 17:31:07 | 000,000,000 | ---D | M] -- C:\Windows\System32
  950. [2006/11/02 06:18:49 | 000,000,000 | ---D | M] -- C:\Windows\tapi
  951. [2012/10/29 18:57:59 | 000,000,000 | ---D | M] -- C:\Windows\Tasks
  952. [2012/11/19 17:39:40 | 000,000,000 | ---D | M] -- C:\Windows\Temp
  953. [2006/11/02 05:23:06 | 000,000,000 | ---D | M] -- C:\Windows\tracing
  954. [2012/10/08 18:02:04 | 000,000,000 | ---D | M] -- C:\Windows\twain_32
  955. [2010/06/24 20:44:47 | 000,000,000 | ---D | M] -- C:\Windows\udtablet
  956. [2006/11/02 07:37:34 | 000,000,000 | ---D | M] -- C:\Windows\Web
  957. [2006/11/02 07:42:32 | 000,000,000 | ---D | M] -- C:\Windows\WindowsMobile
  958. [2012/11/18 03:12:14 | 000,000,000 | ---D | M] -- C:\Windows\winsxs
  959. [2010/05/06 19:18:54 | 000,000,000 | ---D | M] -- C:\Windows\yellowtail+1
  960.  
  961. [color=#A23BEC]< %windir%\installer\*. >[/color]
  962. [2010/02/10 16:41:59 | 000,000,000 | -HSD | M] -- C:\Windows\installer\$PatchCache$
  963. [2010/08/29 16:12:41 | 000,000,000 | ---D | M] -- C:\Windows\installer\MSI17A6.tmp-
  964. [2010/08/29 16:12:42 | 000,000,000 | ---D | M] -- C:\Windows\installer\MSI1A55.tmp-
  965. [2012/07/12 08:44:32 | 000,000,000 | ---D | M] -- C:\Windows\installer\MSI2902.tmp-
  966. [2010/08/29 16:12:06 | 000,000,000 | ---D | M] -- C:\Windows\installer\MSI88AC.tmp-
  967. [2010/08/29 16:08:55 | 000,000,000 | ---D | M] -- C:\Windows\installer\MSI9BBA.tmp-
  968. [2010/08/29 16:12:12 | 000,000,000 | ---D | M] -- C:\Windows\installer\MSIA004.tmp-
  969. [2012/07/12 08:49:59 | 000,000,000 | ---D | M] -- C:\Windows\installer\MSIA34F.tmp-
  970. [2010/08/29 16:10:19 | 000,000,000 | ---D | M] -- C:\Windows\installer\MSIAB16.tmp-
  971. [2010/08/29 16:10:20 | 000,000,000 | ---D | M] -- C:\Windows\installer\MSIEFE4.tmp-
  972. [2012/04/28 22:04:42 | 000,000,000 | ---D | M] -- C:\Windows\installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}
  973. [2010/09/16 10:39:47 | 000,000,000 | ---D | M] -- C:\Windows\installer\{236BB7C4-4419-42FD-0409-1E257A25E34D}
  974. [2011/03/22 22:36:36 | 000,000,000 | ---D | M] -- C:\Windows\installer\{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}
  975. [2011/03/22 22:33:09 | 000,000,000 | ---D | M] -- C:\Windows\installer\{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}
  976. [2010/06/01 09:33:15 | 000,000,000 | ---D | M] -- C:\Windows\installer\{3700194C-C5DD-439A-BE06-A66960CA4C70}
  977. [2010/05/06 19:25:07 | 000,000,000 | ---D | M] -- C:\Windows\installer\{5109C064-813E-4e87-B0DE-C8AF7B5BC02B}
  978. [2011/03/22 22:35:47 | 000,000,000 | ---D | M] -- C:\Windows\installer\{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}
  979. [2011/03/22 22:30:25 | 000,000,000 | ---D | M] -- C:\Windows\installer\{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}
  980. [2010/05/09 17:23:34 | 000,000,000 | ---D | M] -- C:\Windows\installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
  981. [2012/05/19 01:01:02 | 000,000,000 | ---D | M] -- C:\Windows\installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
  982. [2012/11/18 03:05:31 | 000,000,000 | ---D | M] -- C:\Windows\installer\{90120000-0020-0409-0000-0000000FF1CE}
  983. [2012/11/18 03:05:49 | 000,000,000 | ---D | M] -- C:\Windows\installer\{90140000-003D-0000-0000-0000000FF1CE}
  984. [2012/01/20 18:26:47 | 000,000,000 | ---D | M] -- C:\Windows\installer\{90140000-006E-0409-0000-0000000FF1CE}
  985. [2012/10/10 21:26:49 | 000,000,000 | ---D | M] -- C:\Windows\installer\{90850409-6000-11D3-8CFE-0150048383C9}
  986. [2012/10/08 17:29:36 | 000,000,000 | ---D | M] -- C:\Windows\installer\{98EABC7F-B1A1-43A5-B505-5B4EC3908DCD}
  987. [2012/10/08 17:18:23 | 000,000,000 | ---D | M] -- C:\Windows\installer\{AC76BA86-7AD7-1033-7B44-A95000000001}
  988. [2012/04/18 22:05:33 | 000,000,000 | ---D | M] -- C:\Windows\installer\{B6CF2967-C81E-40C0-9815-C05774FEF120}
  989. [2010/09/16 10:40:18 | 000,000,000 | ---D | M] -- C:\Windows\installer\{B74D4E10-1033-0000-0000-000000000001}
  990. [2011/03/22 22:31:21 | 000,000,000 | ---D | M] -- C:\Windows\installer\{E7084B89-69E0-46B3-A118-8F99D06988CD}
  991. [2010/09/16 10:41:17 | 000,000,000 | ---D | M] -- C:\Windows\installer\{E9787678-1033-0000-8E67-000000000001}
  992. [2012/07/12 08:58:12 | 000,000,000 | ---D | M] -- C:\Windows\installer\{EB21A812-671B-4D08-B974-2A347F0D8F70}
  993. [2012/09/25 16:31:03 | 000,000,000 | ---D | M] -- C:\Windows\installer\{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}
  994. [2010/05/10 17:07:43 | 000,000,000 | ---D | M] -- C:\Windows\installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
  995.  
  996. [color=#A23BEC]< %windir%\system32\*. >[/color]
  997. [2006/11/02 07:42:32 | 000,000,000 | ---D | M] -- C:\Windows\system32\0409
  998. [2011/05/14 17:57:54 | 000,000,000 | ---D | M] -- C:\Windows\system32\AdvancedInstallers
  999. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\ar-SA
  1000. [2011/05/15 14:15:37 | 000,000,000 | ---D | M] -- C:\Windows\system32\bg-BG
  1001. [2011/05/14 17:57:16 | 000,000,000 | ---D | M] -- C:\Windows\system32\Boot
  1002. [2006/11/02 07:42:32 | 000,000,000 | ---D | M] -- C:\Windows\system32\Branding
  1003. [2011/05/14 17:58:01 | 000,000,000 | ---D | M] -- C:\Windows\system32\ca-ES
  1004. [2012/09/25 16:19:08 | 000,000,000 | -H-D | M] -- C:\Windows\system32\CanonIJ Uninstaller Information
  1005. [2012/11/18 03:04:16 | 000,000,000 | ---D | M] -- C:\Windows\system32\catroot
  1006. [2012/11/18 03:04:15 | 000,000,000 | ---D | M] -- C:\Windows\system32\catroot2
  1007. [2012/09/25 16:20:59 | 000,000,000 | ---D | M] -- C:\Windows\system32\CHM
  1008. [2006/11/02 07:57:28 | 000,000,000 | ---D | M] -- C:\Windows\system32\CodeIntegrity
  1009. [2008/01/20 21:34:49 | 000,000,000 | ---D | M] -- C:\Windows\system32\com
  1010. [2008/01/20 22:14:18 | 000,000,000 | ---D | M] -- C:\Windows\system32\config
  1011. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\cs-CZ
  1012. [2011/05/15 14:15:35 | 000,000,000 | ---D | M] -- C:\Windows\system32\da-DK
  1013. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\de-DE
  1014. [2012/11/18 21:47:54 | 000,000,000 | ---D | M] -- C:\Windows\system32\drivers
  1015. [2006/11/02 08:03:37 | 000,000,000 | ---D | M] -- C:\Windows\system32\DriverStore
  1016. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\el-GR
  1017. [2011/05/14 17:57:53 | 000,000,000 | ---D | M] -- C:\Windows\system32\en
  1018. [2012/10/11 19:19:07 | 000,000,000 | ---D | M] -- C:\Windows\system32\en-US
  1019. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\es-ES
  1020. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\et-EE
  1021. [2011/05/14 17:57:54 | 000,000,000 | ---D | M] -- C:\Windows\system32\eu-ES
  1022. [2011/05/14 10:22:58 | 000,000,000 | ---D | M] -- C:\Windows\system32\EventProviders
  1023. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\fi-FI
  1024. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\fr-FR
  1025. [2012/06/06 21:20:24 | 000,000,000 | -H-D | M] -- C:\Windows\system32\GroupPolicy
  1026. [2012/06/06 21:20:24 | 000,000,000 | -H-D | M] -- C:\Windows\system32\GroupPolicyUsers
  1027. [2011/05/15 14:15:37 | 000,000,000 | ---D | M] -- C:\Windows\system32\he-IL
  1028. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\hr-HR
  1029. [2011/05/15 14:15:37 | 000,000,000 | ---D | M] -- C:\Windows\system32\hu-HU
  1030. [2008/01/20 21:34:27 | 000,000,000 | ---D | M] -- C:\Windows\system32\ias
  1031. [2008/01/20 21:34:20 | 000,000,000 | ---D | M] -- C:\Windows\system32\icsxml
  1032. [2006/11/02 06:18:42 | 000,000,000 | ---D | M] -- C:\Windows\system32\IME
  1033. [2006/11/02 05:33:01 | 000,000,000 | ---D | M] -- C:\Windows\system32\inetsrv
  1034. [2011/05/15 14:15:37 | 000,000,000 | ---D | M] -- C:\Windows\system32\it-IT
  1035. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\ja-JP
  1036. [2011/05/15 14:15:37 | 000,000,000 | ---D | M] -- C:\Windows\system32\ko-KR
  1037. [2006/11/02 07:37:35 | 000,000,000 | ---D | M] -- C:\Windows\system32\licensing
  1038. [2010/03/13 18:14:08 | 000,000,000 | ---D | M] -- C:\Windows\system32\LogFiles
  1039. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\lt-LT
  1040. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\lv-LV
  1041. [2010/02/10 16:43:40 | 000,000,000 | ---D | M] -- C:\Windows\system32\Macromed
  1042. [2011/05/14 17:57:53 | 000,000,000 | ---D | M] -- C:\Windows\system32\manifeststore
  1043. [2006/11/02 07:47:46 | 000,000,000 | --SD | M] -- C:\Windows\system32\Microsoft
  1044. [2012/11/18 03:32:28 | 000,000,000 | ---D | M] -- C:\Windows\system32\migration
  1045. [2011/05/14 17:57:49 | 000,000,000 | ---D | M] -- C:\Windows\system32\migwiz
  1046. [2006/11/02 08:04:14 | 000,000,000 | ---D | M] -- C:\Windows\system32\Msdtc
  1047. [2006/11/02 07:42:31 | 000,000,000 | ---D | M] -- C:\Windows\system32\MUI
  1048. [2011/05/15 14:15:35 | 000,000,000 | ---D | M] -- C:\Windows\system32\nb-NO
  1049. [2010/02/10 15:39:56 | 000,000,000 | ---D | M] -- C:\Windows\system32\NDF
  1050. [2006/11/02 06:18:43 | 000,000,000 | ---D | M] -- C:\Windows\system32\networklist
  1051. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\nl-NL
  1052. [2010/02/10 18:19:25 | 000,000,000 | ---D | M] -- C:\Windows\system32\OEM
  1053. [2011/05/14 17:57:56 | 000,000,000 | ---D | M] -- C:\Windows\system32\oobe
  1054. [2011/05/15 14:15:37 | 000,000,000 | ---D | M] -- C:\Windows\system32\pl-PL
  1055. [2006/11/02 07:42:31 | 000,000,000 | ---D | M] -- C:\Windows\system32\Printing_Admin_Scripts
  1056. [2011/05/15 14:15:37 | 000,000,000 | ---D | M] -- C:\Windows\system32\pt-BR
  1057. [2011/05/15 14:15:37 | 000,000,000 | ---D | M] -- C:\Windows\system32\pt-PT
  1058. [2008/01/20 21:34:26 | 000,000,000 | ---D | M] -- C:\Windows\system32\ras
  1059. [2006/11/02 06:18:43 | 000,000,000 | ---D | M] -- C:\Windows\system32\RemInst
  1060. [2010/02/10 16:48:06 | 000,000,000 | ---D | M] -- C:\Windows\system32\restore
  1061. [2011/05/15 14:15:35 | 000,000,000 | ---D | M] -- C:\Windows\system32\ro-RO
  1062. [2011/05/15 14:15:35 | 000,000,000 | ---D | M] -- C:\Windows\system32\ru-RU
  1063. [2011/05/14 17:57:54 | 000,000,000 | ---D | M] -- C:\Windows\system32\setup
  1064. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\sk-SK
  1065. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\sl-SI
  1066. [2006/11/02 07:42:32 | 000,000,000 | ---D | M] -- C:\Windows\system32\slmgr
  1067. [2011/05/14 17:57:54 | 000,000,000 | ---D | M] -- C:\Windows\system32\SLUI
  1068. [2006/11/02 06:18:43 | 000,000,000 | ---D | M] -- C:\Windows\system32\SMI
  1069. [2006/11/02 07:37:35 | 000,000,000 | ---D | M] -- C:\Windows\system32\Speech
  1070. [2006/11/02 07:55:01 | 000,000,000 | ---D | M] -- C:\Windows\system32\spool
  1071. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\sr-Latn-CS
  1072. [2012/09/25 16:21:02 | 000,000,000 | ---D | M] -- C:\Windows\system32\STRING
  1073. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\sv-SE
  1074. [2008/01/20 21:58:27 | 000,000,000 | ---D | M] -- C:\Windows\system32\sysprep
  1075. [2012/10/29 18:57:59 | 000,000,000 | ---D | M] -- C:\Windows\system32\Tasks
  1076. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\th-TH
  1077. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\tr-TR
  1078. [2011/05/15 14:15:37 | 000,000,000 | ---D | M] -- C:\Windows\system32\uk-UA
  1079. [2011/05/14 17:57:51 | 000,000,000 | ---D | M] -- C:\Windows\system32\vi-VN
  1080. [2012/01/20 16:52:54 | 000,000,000 | ---D | M] -- C:\Windows\system32\wbem
  1081. [2006/11/02 07:42:31 | 000,000,000 | ---D | M] -- C:\Windows\system32\WCN
  1082. [2012/07/12 02:32:02 | 000,000,000 | ---D | M] -- C:\Windows\system32\WDI
  1083. [2006/11/02 08:02:50 | 000,000,000 | ---D | M] -- C:\Windows\system32\wfp
  1084. [2011/02/23 18:21:54 | 000,000,000 | ---D | M] -- C:\Windows\system32\WindowsPowerShell
  1085. [2006/11/02 06:18:43 | 000,000,000 | ---D | M] -- C:\Windows\system32\winevt
  1086. [2006/11/02 07:42:32 | 000,000,000 | ---D | M] -- C:\Windows\system32\winrm
  1087. [2010/09/18 19:21:14 | 000,000,000 | ---D | M] -- C:\Windows\system32\WTablet
  1088. [2010/02/14 19:36:20 | 000,000,000 | ---D | M] -- C:\Windows\system32\x64
  1089. [2012/05/13 16:48:56 | 000,000,000 | ---D | M] -- C:\Windows\system32\XPSViewer
  1090. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\zh-CN
  1091. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\zh-HK
  1092. [2011/05/15 14:15:36 | 000,000,000 | ---D | M] -- C:\Windows\system32\zh-TW
  1093.  
  1094. [color=#A23BEC]< %windir%\sysnative\*. >[/color]
  1095.  
  1096. [color=#A23BEC]< %Temp%\smtmp\1\*.* >[/color]
  1097.  
  1098. [color=#A23BEC]< %Temp%\smtmp\2\*.* >[/color]
  1099.  
  1100. [color=#A23BEC]< %Temp%\smtmp\3\*.* >[/color]
  1101.  
  1102. [color=#A23BEC]< %Temp%\smtmp\4\*.* >[/color]
  1103.  
  1104. [color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color]
  1105. [2 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
  1106.  
  1107. [color=#A23BEC]< %systemroot%\syswow64\*.dll /lockedfiles >[/color]
  1108.  
  1109. [color=#A23BEC]< %systemroot%\Tasks\*.job /lockedfiles >[/color]
  1110.  
  1111. [color=#A23BEC]< %systemroot%\system32\drivers\*.sys /90 >[/color]
  1112. [2012/09/29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\system32\drivers\mbam.sys
  1113. [2012/08/30 21:03:50 | 000,193,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\drivers\MpFilter.sys
  1114. [2012/08/30 21:03:50 | 000,099,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\drivers\NisDrvWFP.sys
  1115.  
  1116. [color=#A23BEC]< %systemroot%\system32\drivers\*.sys /lockedfiles >[/color]
  1117.  
  1118. [color=#A23BEC]< %systemroot%\syswow64\drivers\*.sys /90 >[/color]
  1119.  
  1120. [color=#A23BEC]< %systemroot%\syswow64\drivers\*.sys /lockedfiles >[/color]
  1121.  
  1122. [color=#A23BEC]< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >[/color]
  1123. [2010/05/16 04:00:00 | 000,027,136 | ---- | M] (CANON INC.) -- C:\Windows\system32\Spool\prtprocs\w32x86\CNMPDA6.DLL
  1124. [2010/05/16 04:00:00 | 000,070,656 | ---- | M] (CANON INC.) -- C:\Windows\system32\Spool\prtprocs\w32x86\CNMPPA6.DLL
  1125. [2007/12/03 17:55:24 | 000,278,016 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\Spool\prtprocs\w32x86\hpzpp5mu.dll
  1126. [2008/01/20 21:23:14 | 000,089,600 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\Spool\prtprocs\w32x86\HPZPPLHN.DLL
  1127. [2006/11/02 07:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\Spool\prtprocs\w32x86\jnwppr.dll
  1128.  
  1129. [color=#A23BEC]< %systemroot%\*. /rp /s >[/color]
  1130.  
  1131. [color=#A23BEC]< %systemroot%\assembly\tmp\*.* /S /MD5 >[/color]
  1132.  
  1133. [color=#A23BEC]< %systemroot%\assembly\temp\*.* /S /MD5 >[/color]
  1134.  
  1135. [color=#A23BEC]< %systemroot%\assembly\GAC\*.ini >[/color]
  1136.  
  1137. [color=#A23BEC]< %systemroot%\assembly\GAC_32\*.ini >[/color]
  1138.  
  1139. [color=#A23BEC]< %systemroot%\assembly\GAC_64\*.ini >[/color]
  1140.  
  1141. [color=#A23BEC]< %SystemRoot%\assembly\GAC_MSIL\*.ini >[/color]
  1142.  
  1143. [color=#A23BEC]< wsSystemRoot|l,n,u,@;True;False;True;$,{ /fn >[/color]
  1144.  
  1145. [color=#A23BEC]< %systemdrive%\$Recycle.Bin|@;true;true;true /fp >[/color]
  1146.  
  1147. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} /s >[/color]
  1148. "" = PSFactoryBuffer
  1149. [HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32]
  1150. "" = %systemroot%\system32\wbem\wbemsvc.dll -- [2009/04/11 01:28:25 | 000,049,152 | ---- | M] (Microsoft Corporation)
  1151. "ThreadingModel" = Both
  1152.  
  1153. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s >[/color]
  1154. "" = Microsoft WBEM New Event Subsystem
  1155. [HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32]
  1156. "" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 01:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
  1157. "ThreadingModel" = Both
  1158.  
  1159. [color=#A23BEC]< HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s >[/color]
  1160.  
  1161. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s >[/color]
  1162. "" = Microsoft WBEM New Event Subsystem
  1163. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32]
  1164. "" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 01:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
  1165. "ThreadingModel" = Both
  1166.  
  1167. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s >[/color]
  1168. "" = MruPidlList
  1169. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  1170. "" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 12:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
  1171. "ThreadingModel" = Apartment
  1172.  
  1173. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} /s >[/color]
  1174. "" = Start Menu Pin
  1175. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}\InProcServer32]
  1176. "" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 12:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
  1177. "ThreadingModel" = Apartment
  1178.  
  1179. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} /s >[/color]
  1180. "" = PSFactoryBuffer
  1181. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32]
  1182. "" = %systemroot%\system32\wbem\wbemsvc.dll -- [2009/04/11 01:28:25 | 000,049,152 | ---- | M] (Microsoft Corporation)
  1183. "ThreadingModel" = Both
  1184.  
  1185. [color=#A23BEC]< HKEY_CLASSES_ROOT\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s >[/color]
  1186. "" = Microsoft WBEM _WbemFetchRefresherMgr Proxy Helper
  1187. [HKEY_CLASSES_ROOT\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32]
  1188. "" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 01:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
  1189. "ThreadingModel" = Free
  1190.  
  1191. [color=#A23BEC]< HKEY_CLASSES_ROOT\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9} /s >[/color]
  1192. "" = ShellFolder for CD Burning
  1193. [HKEY_CLASSES_ROOT\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
  1194. "" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 12:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
  1195. "ThreadingModel" = Apartment
  1196. [HKEY_CLASSES_ROOT\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\MergedFolder]
  1197. "Attributes" = 0x0
  1198. "AttributeMask" = 0xffffffff
  1199. "Location" = @shell32.dll,-12591 -- [2012/06/08 12:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
  1200. "ConflictOverlayIcon" = %SystemRoot%\system32\imageres.dll,-169 -- [2006/11/02 04:39:37 | 015,821,312 | ---- | M] (Microsoft Corporation)
  1201.  
  1202. [color=#A23BEC]< HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9} /s >[/color]
  1203.  
  1204. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s >[/color]
  1205. "" = Microsoft WBEM _WbemFetchRefresherMgr Proxy Helper
  1206. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32]
  1207. "" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 01:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
  1208. "ThreadingModel" = Free
  1209.  
  1210. [color=#A23BEC]< HKEY_CURRENT_USER\Software\Classes\clsid\{12d0253a-7c96-815c-11e0-3034bbd97cc0}] /s >[/color]
  1211.  
  1212. [color=#A23BEC]< HKEY_CURRENT_USER\Software\MSOLoad /s >[/color]
  1213.  
  1214. [color=#A23BEC]< bcdedit /enum all /v >C:\boot.txt /c >[/color]
  1215. Windows Boot Manager
  1216. --------------------
  1217. identifier {9dea862c-5cdd-4e70-acc1-f32b344d4795}
  1218. device partition=C:
  1219. description Windows Boot Manager
  1220. locale en-US
  1221. inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
  1222. default {c6aba95e-169a-11df-a1f9-acf513e00cae}
  1223. resumeobject {c6aba95f-169a-11df-a1f9-acf513e00cae}
  1224. displayorder {c6aba95e-169a-11df-a1f9-acf513e00cae}
  1225. toolsdisplayorder {b2721d73-1db4-4c62-bf78-c548a880142d}
  1226. timeout 30
  1227. resume No
  1228. Windows Boot Loader
  1229. -------------------
  1230. identifier {c6aba95e-169a-11df-a1f9-acf513e00cae}
  1231. device partition=C:
  1232. path \Windows\system32\winload.exe
  1233. description Microsoft Windows Vista
  1234. locale en-US
  1235. inherit {6efb52bf-1766-41db-a6b3-0ee5eff72bd7}
  1236. osdevice partition=C:
  1237. systemroot \Windows
  1238. resumeobject {c6aba95f-169a-11df-a1f9-acf513e00cae}
  1239. nx OptIn
  1240. Resume from Hibernate
  1241. ---------------------
  1242. identifier {c6aba95f-169a-11df-a1f9-acf513e00cae}
  1243. device partition=C:
  1244. path \Windows\system32\winresume.exe
  1245. description Windows Resume Application
  1246. locale en-US
  1247. inherit {1afa9c49-16ab-4a5c-901b-212802da9460}
  1248. filedevice partition=C:
  1249. filepath \hiberfil.sys
  1250. pae Yes
  1251. debugoptionenabled No
  1252. Windows Memory Tester
  1253. ---------------------
  1254. identifier {b2721d73-1db4-4c62-bf78-c548a880142d}
  1255. device partition=C:
  1256. path \boot\memtest.exe
  1257. description Windows Memory Diagnostic
  1258. locale en-US
  1259. inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
  1260. badmemoryaccess Yes
  1261. Windows Legacy OS Loader
  1262. ------------------------
  1263. identifier {466f5a88-0af2-4f76-9038-095b170dc21c}
  1264. device partition=C:
  1265. path \ntldr
  1266. description Earlier Version of Windows
  1267. EMS Settings
  1268. ------------
  1269. identifier {0ce4991b-e6b3-4b16-b23c-5e0d9250e5d9}
  1270. bootems Yes
  1271. Debugger Settings
  1272. -----------------
  1273. identifier {4636856e-540f-4170-a130-a84776f4c654}
  1274. debugtype Serial
  1275. debugport 1
  1276. baudrate 115200
  1277. RAM Defects
  1278. -----------
  1279. identifier {5189b25c-5558-4bf2-bca4-289b11bd29e2}
  1280. Global Settings
  1281. ---------------
  1282. identifier {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
  1283. inherit {4636856e-540f-4170-a130-a84776f4c654}
  1284. {0ce4991b-e6b3-4b16-b23c-5e0d9250e5d9}
  1285. {5189b25c-5558-4bf2-bca4-289b11bd29e2}
  1286. Boot Loader Settings
  1287. --------------------
  1288. identifier {6efb52bf-1766-41db-a6b3-0ee5eff72bd7}
  1289. inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
  1290. Resume Loader Settings
  1291. ----------------------
  1292. identifier {1afa9c49-16ab-4a5c-901b-212802da9460}
  1293. inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
  1294.  
  1295. [color=#A23BEC]< type c:\diskreport.txt /c >[/color]
  1296. Microsoft DiskPart version 6.0.6002
  1297. Copyright (C) 1999-2007 Microsoft Corporation.
  1298. On computer: AROWANA-PC
  1299. Volume ### Ltr Label Fs Type Size Status Info
  1300. ---------- --- ----------- ----- ---------- ------- --------- --------
  1301. Volume 0 D DVD-ROM 0 B No Media
  1302. Volume 1 C NTFS Partition 109 GB Healthy System
  1303. Volume 2 E Removable 0 B No Media
  1304.  
  1305. [color=#A23BEC]< MD5 for: AFD.SYS >[/color]
  1306. [2011/04/21 08:58:27 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=3911B972B55FEA0478476B2E777B29FA -- C:\Windows\System32\drivers\afd.sys
  1307. [2011/04/21 08:58:27 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=3911B972B55FEA0478476B2E777B29FA -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18457_none_d99fb42e5bb59d9b\afd.sys
  1308. [2011/04/21 08:16:42 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=48EB99503533C27AC6135648E5474457 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18639_none_d7d0e0cc5e7d461c\afd.sys
  1309. [2011/04/21 08:28:53 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=70EE0FC7A0F384DBD929A01384AEEB4B -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.22629_none_da4bc33774b91967\afd.sys
  1310. [2008/01/20 21:24:17 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=763E172A55177E478CB419F88FD0BA03 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_d7e842925e6d1f50\afd.sys
  1311. [2009/04/10 23:47:03 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=A201207363AA900ABF1A388468688570 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18005_none_d9d3bb9e5b8eea9c\afd.sys
  1312. [2011/04/21 08:12:21 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=C8AF25017CECB75906A571AC70D2D306 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.22905_none_d876efff77862705\afd.sys
  1313.  
  1314. [color=#A23BEC]< MD5 for: ATAPI.SYS >[/color]
  1315. [2009/04/11 01:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
  1316. [2009/04/11 01:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
  1317. [2009/04/11 01:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
  1318. [2008/01/20 21:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
  1319. [2008/01/20 21:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
  1320. [2006/11/02 04:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
  1321.  
  1322. [color=#A23BEC]< MD5 for: CNGAUDIT.DLL >[/color]
  1323. [2006/11/02 04:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
  1324. [2006/11/02 04:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
  1325.  
  1326. [color=#A23BEC]< MD5 for: DFSC.SYS >[/color]
  1327. [2009/04/10 23:14:12 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=218D8AE46C88E82014F5D73D0236D9B2 -- C:\Windows\winsxs\x86_microsoft-windows-dfsclient_31bf3856ad364e35_6.0.6002.18005_none_8985a6e9e33db02a\dfsc.sys
  1328. [2011/04/14 09:36:03 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=3A3436F7DFE0E0C58CD5C3B6C9F21634 -- C:\Windows\winsxs\x86_microsoft-windows-dfsclient_31bf3856ad364e35_6.0.6002.22625_none_89f9ad5afc6b7999\dfsc.sys
  1329. [2011/04/14 09:59:03 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=622C41A07CA7E6DD91770F50D532CB6C -- C:\Windows\System32\drivers\dfsc.sys
  1330. [2011/04/14 09:59:03 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=622C41A07CA7E6DD91770F50D532CB6C -- C:\Windows\winsxs\x86_microsoft-windows-dfsclient_31bf3856ad364e35_6.0.6002.18451_none_894b9dbde369cb1f\dfsc.sys
  1331. [2008/01/20 21:24:55 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=9E635AE5E8AD93E2B5989E2E23679F97 -- C:\Windows\winsxs\x86_microsoft-windows-dfsclient_31bf3856ad364e35_6.0.6001.18000_none_879a2ddde61be4de\dfsc.sys
  1332. [2011/04/14 09:24:14 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=A3E9FA213F443AC77C7746119D13FEEC -- C:\Windows\winsxs\x86_microsoft-windows-dfsclient_31bf3856ad364e35_6.0.6001.18633_none_877cca5be63173a0\dfsc.sys
  1333. [2011/04/13 08:22:40 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=E20FB30D720810646ED24FB7CA9899A2 -- C:\Windows\winsxs\x86_microsoft-windows-dfsclient_31bf3856ad364e35_6.0.6001.22899_none_87cb8b40ff7a5041\dfsc.sys
  1334.  
  1335. [color=#A23BEC]< MD5 for: DISK.SYS >[/color]
  1336. [2009/04/11 01:32:31 | 000,053,736 | ---- | M] (Microsoft Corporation) MD5=5D4AEFC3386920236A548271F8F1AF6A -- C:\Windows\System32\drivers\disk.sys
  1337. [2009/04/11 01:32:31 | 000,053,736 | ---- | M] (Microsoft Corporation) MD5=5D4AEFC3386920236A548271F8F1AF6A -- C:\Windows\System32\DriverStore\FileRepository\disk.inf_5c850fad\disk.sys
  1338. [2009/04/11 01:32:31 | 000,053,736 | ---- | M] (Microsoft Corporation) MD5=5D4AEFC3386920236A548271F8F1AF6A -- C:\Windows\winsxs\x86_disk.inf_31bf3856ad364e35_6.0.6002.18005_none_fbb1faf0714e4ea6\disk.sys
  1339. [2008/01/20 21:23:20 | 000,055,352 | ---- | M] (Microsoft Corporation) MD5=64109E623ABD6955C8FB110B592E68B7 -- C:\Windows\System32\DriverStore\FileRepository\disk.inf_90722180\disk.sys
  1340. [2008/01/20 21:23:20 | 000,055,352 | ---- | M] (Microsoft Corporation) MD5=64109E623ABD6955C8FB110B592E68B7 -- C:\Windows\winsxs\x86_disk.inf_31bf3856ad364e35_6.0.6001.18000_none_f9c681e4742c835a\disk.sys
  1341. [2006/11/02 04:49:51 | 000,052,840 | ---- | M] (Microsoft Corporation) MD5=841AF4C4D41D3E3B2F244E976B0F7963 -- C:\Windows\System32\DriverStore\FileRepository\disk.inf_e0b0b355\disk.sys
  1342.  
  1343. [color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color]
  1344. [2008/10/29 01:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
  1345. [2008/10/29 01:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
  1346. [2008/10/29 22:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
  1347. [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
  1348. [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
  1349. [2008/10/27 21:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
  1350. [2008/01/20 21:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
  1351.  
  1352. [color=#A23BEC]< MD5 for: I8042PRT.SYS >[/color]
  1353. [2006/11/02 03:51:13 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1060F1377F395A242E27719440ECE602 -- C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_93b1c41f\i8042prt.sys
  1354. [2006/11/02 03:51:13 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1060F1377F395A242E27719440ECE602 -- C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_3dfa3917\i8042prt.sys
  1355. [2008/01/20 21:09:47 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1C9EE072BAA3ABB460B91D7EE9152660 -- C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_a81145df\i8042prt.sys
  1356. [2008/01/20 21:09:47 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1C9EE072BAA3ABB460B91D7EE9152660 -- C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_f4514c17\i8042prt.sys
  1357. [2008/01/20 21:09:47 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1C9EE072BAA3ABB460B91D7EE9152660 -- C:\Windows\winsxs\x86_keyboard.inf_31bf3856ad364e35_6.0.6000.16609_none_957131ccdbca3f9c\i8042prt.sys
  1358. [2008/01/20 21:09:47 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=1C9EE072BAA3ABB460B91D7EE9152660 -- C:\Windows\winsxs\x86_msmouse.inf_31bf3856ad364e35_6.0.6000.16609_none_4c56cf70d52c8670\i8042prt.sys
  1359. [2008/01/20 21:23:20 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\System32\drivers\i8042prt.sys
  1360. [2008/01/20 21:23:23 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_da7e599e\i8042prt.sys
  1361. [2008/01/20 21:23:23 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_f55d5e51\i8042prt.sys
  1362. [2008/01/20 21:23:20 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_8b7c4328\i8042prt.sys
  1363. [2008/01/20 21:23:23 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\winsxs\x86_keyboard.inf_31bf3856ad364e35_6.0.6001.18000_none_974e6dd8d8f8ec7e\i8042prt.sys
  1364. [2008/01/20 21:23:23 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\winsxs\x86_keyboard.inf_31bf3856ad364e35_6.0.6002.18005_none_9939e6e4d61ab7ca\i8042prt.sys
  1365. [2008/01/20 21:23:20 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=22D56C8184586B7A1F6FA60BE5F5A2BD -- C:\Windows\winsxs\x86_msmouse.inf_31bf3856ad364e35_6.0.6001.18000_none_4e340b7cd25b3352\i8042prt.sys
  1366. [2008/01/20 21:09:47 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=BEA9838CD25D36BEBA3F94386A761D60 -- C:\Windows\winsxs\x86_keyboard.inf_31bf3856ad364e35_6.0.6000.20734_none_95d55d61f504b486\i8042prt.sys
  1367. [2008/01/20 21:09:47 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=BEA9838CD25D36BEBA3F94386A761D60 -- C:\Windows\winsxs\x86_msmouse.inf_31bf3856ad364e35_6.0.6000.20734_none_4cbafb05ee66fb5a\i8042prt.sys
  1368.  
  1369. [color=#A23BEC]< MD5 for: LSASS.EXE >[/color]
  1370. [2009/06/15 07:51:56 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=203D86EBD6D8E4C8501B222421E81506 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.22152_none_a886901f7335e2fc\lsass.exe
  1371. [2009/09/10 09:44:14 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=2D3AC5E7AC01E905F3ABD2D745FE3A9B -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.22223_none_a8a80213731ca5a7\lsass.exe
  1372. [2009/06/15 07:48:49 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=3978F3540329E16C0AC3BCF677E5669F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.18051_none_a7fbf30a5a1929db\lsass.exe
  1373. [2009/02/13 02:26:04 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=59DE082968FDD257FFF0D209B9A5B460 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.16820_none_a44eb0105fb4d975\lsass.exe
  1374. [2012/06/01 17:37:38 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=613DEB66A91820F0A41915B40BB8833F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.22869_none_a882cf8373379c5f\lsass.exe
  1375. [2009/06/15 08:03:38 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=6F1F23D3599EAE17734451936B7F17C6 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.22450_none_a69e1da376115b2a\lsass.exe
  1376. [2011/11/16 09:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\System32\lsass.exe
  1377. [2011/11/16 09:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.18541_none_a806cc745a10ffad\lsass.exe
  1378. [2011/11/16 09:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A3E186B4B935905B829219502557314E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.18643_none_a808ceee5a0f2f82\lsass.exe
  1379. [2009/06/15 07:57:59 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=A911ECAC81F94ADEAFBE8E3F7873EDB0 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.18272_none_a600dfae5d0228c9\lsass.exe
  1380. [2009/02/12 23:58:37 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=AFF8A58280863629CA4FFA9E0B259F1E -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.21010_none_a4e2f4e978ca9090\lsass.exe
  1381. [2009/06/15 07:59:08 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=BA9A67672E025078C77967731BCFC560 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.21067_none_a4b3e75378eccda6\lsass.exe
  1382. [2009/06/15 08:10:12 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=C731B1FE449D4E9CEA358C9D55B69BE9 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.16870_none_a418a0745fdd652a\lsass.exe
  1383. [2009/09/09 06:09:38 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=CB7E838C140B4087B2DA323F2D4523C5 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.22518_none_a6d1618975e9b345\lsass.exe
  1384. [2009/09/10 09:47:51 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=D09A5DA84B7C9CA9B02EBCD7FAE41C8D -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6000.21125_none_a4dd285578ce285b\lsass.exe
  1385. [2008/01/20 21:24:15 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=DCF733788C7D088D814E5F80EB4B3E0F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.18000_none_a64a8ac25ccb3836\lsass.exe
  1386. [2008/01/20 21:24:15 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=DCF733788C7D088D814E5F80EB4B3E0F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.18215_none_a644c0145ccecd28\lsass.exe
  1387. [2008/01/20 21:24:15 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=DCF733788C7D088D814E5F80EB4B3E0F -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.18005_none_a83603ce59ed0382\lsass.exe
  1388. [2011/11/16 08:57:04 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=EBFAEB786C46B407930811F94F08877D -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6002.22742_none_a8916b6f732db5f5\lsass.exe
  1389. [2009/02/13 03:20:29 | 000,009,728 | ---- | M] (Microsoft Corporation) MD5=F4C62B07E5BF96F1FDCA9DB393ECED22 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.0.6001.22376_none_a68e7da1761c2def\lsass.exe
  1390.  
  1391. [color=#A23BEC]< MD5 for: NETBT.SYS >[/color]
  1392. [2008/01/20 21:24:59 | 000,184,320 | ---- | M] (Microsoft Corporation) MD5=7C5FEE5B1C5728507CD96FB4A13E7A02 -- C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.0.6001.18000_none_6064c861f7442765\netbt.sys
  1393. [2009/04/10 23:45:37 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=ECD64230A59CBD93C85F1CD1CAB9F3F6 -- C:\Windows\System32\drivers\netbt.sys
  1394. [2009/04/10 23:45:37 | 000,185,856 | ---- | M] (Microsoft Corporation) MD5=ECD64230A59CBD93C85F1CD1CAB9F3F6 -- C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.0.6002.18005_none_6250416df465f2b1\netbt.sys
  1395.  
  1396. [color=#A23BEC]< MD5 for: NETLOGON.DLL >[/color]
  1397. [2009/04/11 01:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
  1398. [2009/04/11 01:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
  1399. [2008/01/20 21:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
  1400.  
  1401. [color=#A23BEC]< MD5 for: SCECLI.DLL >[/color]
  1402. [2008/01/20 21:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
  1403. [2009/04/11 01:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
  1404. [2009/04/11 01:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
  1405.  
  1406. [color=#A23BEC]< MD5 for: SERIAL.SYS >[/color]
  1407. [2008/01/20 21:23:26 | 000,083,456 | ---- | M] (Microsoft Corporation) MD5=6D663022DB3E7058907784AE14B69898 -- C:\Windows\System32\DriverStore\FileRepository\hiddigi.inf_33048ac2\serial.sys
  1408. [2008/01/20 21:23:01 | 000,083,456 | ---- | M] (Microsoft Corporation) MD5=6D663022DB3E7058907784AE14B69898 -- C:\Windows\System32\DriverStore\FileRepository\msports.inf_44880ea7\serial.sys
  1409. [2008/01/20 21:23:26 | 000,083,456 | ---- | M] (Microsoft Corporation) MD5=6D663022DB3E7058907784AE14B69898 -- C:\Windows\winsxs\x86_hiddigi.inf_31bf3856ad364e35_6.0.6001.18000_none_955c449145dbf667\serial.sys
  1410. [2008/01/20 21:23:01 | 000,083,456 | ---- | M] (Microsoft Corporation) MD5=6D663022DB3E7058907784AE14B69898 -- C:\Windows\winsxs\x86_msports.inf_31bf3856ad364e35_6.0.6001.18000_none_f897b0b1b85e4433\serial.sys
  1411. [2006/11/02 03:51:30 | 000,083,456 | ---- | M] (Microsoft Corporation) MD5=C70D69A918B178D3C3B06339B40C2E1B -- C:\Windows\System32\drivers\serial.sys
  1412. [2006/11/02 03:51:30 | 000,083,456 | ---- | M] (Microsoft Corporation) MD5=C70D69A918B178D3C3B06339B40C2E1B -- C:\Windows\System32\DriverStore\FileRepository\hiddigi.inf_9d4661e2\serial.sys
  1413. [2006/11/02 03:51:30 | 000,083,456 | ---- | M] (Microsoft Corporation) MD5=C70D69A918B178D3C3B06339B40C2E1B -- C:\Windows\System32\DriverStore\FileRepository\msports.inf_ac874de4\serial.sys
  1414.  
  1415. [color=#A23BEC]< MD5 for: SERVICES.EXE >[/color]
  1416. [2008/01/20 21:24:48 | 000,279,040 | ---- | M] (Microsoft Corporation) MD5=2B336AB6286D6C81FA02CBAB914E3C6C -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.exe
  1417. [2009/04/11 01:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\System32\services.exe
  1418. [2009/04/11 01:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe
  1419.  
  1420. [color=#A23BEC]< MD5 for: SVCHOST.EXE >[/color]
  1421. [2008/01/20 21:23:43 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\System32\svchost.exe
  1422. [2008/01/20 21:23:43 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe
  1423. [2012/09/29 19:54:26 | 000,218,184 | ---- | M] () MD5=8846E87210AD131CF71E3E2E49F647B0 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
  1424.  
  1425. [color=#A23BEC]< MD5 for: TCPIP.SYS >[/color]
  1426. [2008/04/26 03:08:16 | 000,891,448 | ---- | M] (Microsoft Corporation) MD5=01EC1E92595F839BEE70D439C46796E3 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22167_none_b36dd19b7fae39c7\tcpip.sys
  1427. [2009/04/11 01:33:02 | 000,897,000 | ---- | M] (Microsoft Corporation) MD5=0E6B0885C3D5E4643ED2D043DE3433D8 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18005_none_b5098b5e63880c42\tcpip.sys
  1428. [2011/09/20 16:02:55 | 000,913,280 | ---- | M] (Microsoft Corporation) MD5=16731B631F28F63CD9F4CB60940E7DDD -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22719_none_b58c64c97caa1c43\tcpip.sys
  1429. [2009/12/08 15:52:30 | 000,897,624 | ---- | M] (Microsoft Corporation) MD5=1ACBB7A47E78F4CC82D2EFFB72901528 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18377_none_b2d96a966698ad63\tcpip.sys
  1430. [2009/08/15 16:30:53 | 000,816,640 | ---- | M] (Microsoft Corporation) MD5=2512B4D1353370D6688B1AF1F5AFA1CF -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.21108_none_6030d425ab49af00\tcpip.sys
  1431. [2009/08/14 12:01:55 | 000,900,168 | ---- | M] (Microsoft Corporation) MD5=2608E71AAD54564647D4BB984E1925AA -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22497_none_b34d67897fc6850f\tcpip.sys
  1432. [2011/06/17 15:13:55 | 000,905,104 | ---- | M] (Microsoft Corporation) MD5=2756186E287139310997090797E0182B -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18484_none_b4b2134c63c9c70f\tcpip.sys
  1433. [2012/03/30 07:39:11 | 000,905,600 | ---- | M] (Microsoft Corporation) MD5=27D470DABC77BC60D0A3B0E4DEB6CB91 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18604_none_b50896786388e1d5\tcpip.sys
  1434. [2010/02/18 06:51:51 | 000,818,688 | ---- | M] (Microsoft Corporation) MD5=2C1F7005AA3B62721BFDB307BD5F5010 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.21226_none_6019359fab5bb15b\tcpip.sys
  1435. [2010/02/18 09:49:38 | 000,898,952 | ---- | M] (Microsoft Corporation) MD5=2EAE4500984C2F8DACFB977060300A15 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18427_none_b30f7c1866701ed5\tcpip.sys
  1436. [2009/08/14 09:24:47 | 000,813,568 | ---- | M] (Microsoft Corporation) MD5=300208927321066EA53761FDC98747C6 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16908_none_5fa75f38922bdbf4\tcpip.sys
  1437. [2009/12/08 15:15:00 | 000,907,832 | ---- | M] (Microsoft Corporation) MD5=46E6685F3E92AEC743773ADD4CD54F57 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22283_none_b53aaa1b7ce8560d\tcpip.sys
  1438. [2010/02/18 09:07:16 | 000,904,576 | ---- | M] (Microsoft Corporation) MD5=48CBE6D53632D0067C2D6B20F90D84CA -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18209_none_b50d905263846bec\tcpip.sys
  1439. [2010/02/18 07:05:37 | 000,815,104 | ---- | M] (Microsoft Corporation) MD5=4A82FA8F0DF67AA354580C3FAAF8BDE3 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.17021_none_5f8a957c924295b7\tcpip.sys
  1440. [2009/12/08 15:37:09 | 000,900,696 | ---- | M] (Microsoft Corporation) MD5=5653230D480A9C54D169E1B080B72CF5 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22577_none_b36309477fb64a54\tcpip.sys
  1441. [2010/06/16 10:55:58 | 000,902,032 | ---- | M] (Microsoft Corporation) MD5=6216A954ED7045B62880A92D6C9B9FC7 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys
  1442. [2009/08/14 11:27:34 | 000,904,776 | ---- | M] (Microsoft Corporation) MD5=65877AA1B6A7CB797488E831698973E9 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18091_none_b4a43aea63d4a25f\tcpip.sys
  1443. [2011/06/17 15:13:55 | 000,913,296 | ---- | M] (Microsoft Corporation) MD5=6647FCE6FC4970DAAFE5C64C794513D3 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22662_none_b54f51417cd8f970\tcpip.sys
  1444. [2010/06/16 11:39:32 | 000,912,776 | ---- | M] (Microsoft Corporation) MD5=6A10AFCE0B38371064BE41C1FBFD3C6B -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22425_none_b57d8e037cb5db63\tcpip.sys
  1445. [2010/06/16 10:59:54 | 000,898,952 | ---- | M] (Microsoft Corporation) MD5=782568AB6A43160A159B6215B70BCCE9 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18493_none_b2bfcb7c66ac7d10\tcpip.sys
  1446. [2011/09/20 16:02:55 | 000,905,088 | ---- | M] (Microsoft Corporation) MD5=814A1C66FBD4E1B310A517221F1456BF -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18519_none_b502c618638c7f52\tcpip.sys
  1447. [2008/04/26 03:26:49 | 000,891,448 | ---- | M] (Microsoft Corporation) MD5=82E266BEE5F0167E41C6ECFDD2A79C02 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18063_none_b2e033a8669434a1\tcpip.sys
  1448. [2009/12/08 12:58:13 | 000,813,568 | ---- | M] (Microsoft Corporation) MD5=8734BD051FFDCBF8425CF222141C3741 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.16973_none_5f56ae52926920d8\tcpip.sys
  1449. [2009/08/14 12:07:56 | 000,897,608 | ---- | M] (Microsoft Corporation) MD5=8A7AD2A214233F684242F289ED83EBC3 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18311_none_b3144862666d6db3\tcpip.sys
  1450. [2010/02/18 12:36:50 | 000,902,024 | ---- | M] (Microsoft Corporation) MD5=93A5655CD9CD2F080EF1CB71A3666215 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys
  1451. [2010/06/16 11:04:57 | 000,905,088 | ---- | M] (Microsoft Corporation) MD5=A474879AFA4A596B3A531F3E69730DBF -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18272_none_b4baded863c37e22\tcpip.sys
  1452. [2010/04/05 12:03:01 | 000,902,024 | ---- | M] (Microsoft Corporation) MD5=A6A02EF5B5E40FBD31A1ADC577DA54BB -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22665_none_b36bda857faff8dc\tcpip.sys
  1453. [2009/12/08 12:45:32 | 000,816,640 | ---- | M] (Microsoft Corporation) MD5=CA3A5756672013A66BB9D547A5A62DCA -- C:\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.0.6000.21175_none_5fe223d3ab852692\tcpip.sys
  1454. [2010/04/05 15:00:48 | 000,910,208 | ---- | M] (Microsoft Corporation) MD5=CC9993701AC57F995554C696DDA49C12 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22377_none_b5497d157cdc9c9f\tcpip.sys
  1455. [2010/02/18 09:22:11 | 000,910,216 | ---- | M] (Microsoft Corporation) MD5=D9F5DD5BBC8348E8F8220CCBF14C022E -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22341_none_b563eb1d7cc9b0c2\tcpip.sys
  1456. [2009/12/08 15:01:08 | 000,904,776 | ---- | M] (Microsoft Corporation) MD5=DA467E7619AE5F4588E6262C13C8940A -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.18160_none_b4c3ac4a63bd325c\tcpip.sys
  1457. [2012/03/30 07:39:11 | 000,914,304 | ---- | M] (Microsoft Corporation) MD5=EE7E10BED85C312C1D5D30C435BDDA9F -- C:\Windows\System32\drivers\tcpip.sys
  1458. [2012/03/30 07:39:11 | 000,914,304 | ---- | M] (Microsoft Corporation) MD5=EE7E10BED85C312C1D5D30C435BDDA9F -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22828_none_b58096797cb31c04\tcpip.sys
  1459. [2008/01/20 21:25:03 | 000,891,448 | ---- | M] (Microsoft Corporation) MD5=FC6E2835D667774D409C7C7021EAF9C4 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_b31e1252666640f6\tcpip.sys
  1460. [2009/08/14 11:33:50 | 000,905,784 | ---- | M] (Microsoft Corporation) MD5=FF71856BD4CD6D4367F9FD84BE79A874 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6002.22200_none_b58e289d7caa2a80\tcpip.sys
  1461.  
  1462. [color=#A23BEC]< MD5 for: USERINIT.EXE >[/color]
  1463. [2008/01/20 21:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
  1464. [2008/01/20 21:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
  1465.  
  1466. [color=#A23BEC]< MD5 for: VOLSNAP.SYS >[/color]
  1467. [2006/11/02 04:51:18 | 000,208,488 | ---- | M] (Microsoft Corporation) MD5=11EF6C1CAEF76B685233450A126125D6 -- C:\Windows\System32\DriverStore\FileRepository\volume.inf_9320b452\volsnap.sys
  1468. [2009/04/11 01:32:55 | 000,226,280 | ---- | M] (Microsoft Corporation) MD5=147281C01FCB1DF9252DE2A10D5E7093 -- C:\Windows\System32\drivers\volsnap.sys
  1469. [2009/04/11 01:32:55 | 000,226,280 | ---- | M] (Microsoft Corporation) MD5=147281C01FCB1DF9252DE2A10D5E7093 -- C:\Windows\System32\DriverStore\FileRepository\volume.inf_1e6030e4\volsnap.sys
  1470. [2009/04/11 01:32:55 | 000,226,280 | ---- | M] (Microsoft Corporation) MD5=147281C01FCB1DF9252DE2A10D5E7093 -- C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6002.18005_none_17a2308cf936c619\volsnap.sys
  1471. [2008/01/20 21:23:21 | 000,227,896 | ---- | M] (Microsoft Corporation) MD5=D8B4A53DD2769F226B3EB374374987C9 -- C:\Windows\System32\DriverStore\FileRepository\volume.inf_f53a1785\volsnap.sys
  1472. [2008/01/20 21:23:21 | 000,227,896 | ---- | M] (Microsoft Corporation) MD5=D8B4A53DD2769F226B3EB374374987C9 -- C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.0.6001.18000_none_15b6b780fc14facd\volsnap.sys
  1473.  
  1474. [color=#A23BEC]< MD5 for: WININIT.EXE >[/color]
  1475. [2008/01/20 21:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
  1476. [2008/01/20 21:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
  1477.  
  1478. [color=#A23BEC]< MD5 for: WINLOGON.EXE >[/color]
  1479. [2012/09/29 19:54:26 | 000,218,184 | ---- | M] () MD5=8846E87210AD131CF71E3E2E49F647B0 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
  1480. [2009/04/11 01:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
  1481. [2009/04/11 01:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
  1482. [2008/01/20 21:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
  1483.  
  1484. < End of report >
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!