API tools faq
paste
spaski

Untitled

spaski
Apr 25th, 2012
91
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 24.64 KB | None | 0 0
raw download clone embed print report diff
  1. OTL logfile created on: 4/26/2012 2:00:48 AM - Run 1
  2. OTL by OldTimer - Version 3.2.42.0 Folder = C:\Users\Spaski\Desktop
  3. 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
  4. Internet Explorer (Version = 8.0.7601.17514)
  5. Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
  6.  
  7. 4.00 Gb Total Physical Memory | 2.69 Gb Available Physical Memory | 67.37% Memory free
  8. 8.00 Gb Paging File | 6.55 Gb Available in Paging File | 81.96% Paging File free
  9. Paging file location(s): ?:\pagefile.sys [binary data]
  10.  
  11. %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
  12. Drive C: | 97.66 Gb Total Space | 82.41 Gb Free Space | 84.39% Space Free | Partition Type: NTFS
  13. Drive D: | 658.07 Gb Total Space | 15.81 Gb Free Space | 2.40% Space Free | Partition Type: NTFS
  14. Drive E: | 175.78 Gb Total Space | 8.94 Gb Free Space | 5.08% Space Free | Partition Type: NTFS
  15.  
  16. Computer Name: SPASKI-PC | User Name: Spaski | Logged in as Administrator.
  17. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
  18. Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
  19.  
  20. [color=#E56717]========== Processes (SafeList) ==========[/color]
  21.  
  22. PRC - [2012/04/26 01:59:33 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Spaski\Desktop\OTL.scr
  23. PRC - [2012/04/26 01:45:19 | 000,353,440 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_233_ActiveX.exe
  24. PRC - [2009/06/10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
  25. PRC - [2009/02/06 14:23:36 | 000,727,720 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
  26.  
  27.  
  28. [color=#E56717]========== Modules (No Company Name) ==========[/color]
  29.  
  30.  
  31. [color=#E56717]========== Win32 Services (SafeList) ==========[/color]
  32.  
  33. SRV:[b]64bit:[/b] - [2009/07/14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
  34. SRV:[b]64bit:[/b] - [2009/07/14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
  35. SRV:[b]64bit:[/b] - [2009/02/06 14:27:10 | 000,023,296 | ---- | M] (ESET) [On_Demand | Unknown] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)
  36. SRV:[b]64bit:[/b] - [2009/02/06 14:23:36 | 000,727,720 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe -- (ekrn)
  37. SRV - [2012/04/26 01:45:19 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
  38. SRV - [2009/06/10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
  39.  
  40.  
  41. [color=#E56717]========== Driver Services (SafeList) ==========[/color]
  42.  
  43. DRV:[b]64bit:[/b] - [2010/11/21 05:24:43 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
  44. DRV:[b]64bit:[/b] - [2010/11/21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
  45. DRV:[b]64bit:[/b] - [2010/11/21 05:23:48 | 000,117,248 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tsusbhub.sys -- (tsusbhub)
  46. DRV:[b]64bit:[/b] - [2010/11/21 05:23:48 | 000,088,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Synth3dVsc.sys -- (Synth3dVsc)
  47. DRV:[b]64bit:[/b] - [2010/11/21 05:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
  48. DRV:[b]64bit:[/b] - [2010/11/21 05:23:48 | 000,034,816 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\terminpt.sys -- (terminpt)
  49. DRV:[b]64bit:[/b] - [2010/11/21 05:23:47 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
  50. DRV:[b]64bit:[/b] - [2010/11/21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
  51. DRV:[b]64bit:[/b] - [2010/11/21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
  52. DRV:[b]64bit:[/b] - [2010/11/21 05:23:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
  53. DRV:[b]64bit:[/b] - [2009/07/14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
  54. DRV:[b]64bit:[/b] - [2009/07/14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
  55. DRV:[b]64bit:[/b] - [2009/07/14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
  56. DRV:[b]64bit:[/b] - [2009/07/14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
  57. DRV:[b]64bit:[/b] - [2009/06/10 22:35:42 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
  58. DRV:[b]64bit:[/b] - [2009/06/10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
  59. DRV:[b]64bit:[/b] - [2009/06/10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
  60. DRV:[b]64bit:[/b] - [2009/06/10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
  61. DRV:[b]64bit:[/b] - [2009/06/10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
  62. DRV:[b]64bit:[/b] - [2009/02/06 14:24:50 | 000,120,128 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\epfwwfpr.sys -- (epfwwfpr)
  63. DRV:[b]64bit:[/b] - [2009/02/06 14:23:20 | 000,132,464 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ehdrv.sys -- (ehdrv)
  64. DRV:[b]64bit:[/b] - [2009/02/06 14:19:56 | 000,141,728 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\eamon.sys -- (eamon)
  65. DRV - [2009/07/14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
  66.  
  67.  
  68. [color=#E56717]========== Standard Registry (SafeList) ==========[/color]
  69.  
  70.  
  71. [color=#E56717]========== Internet Explorer ==========[/color]
  72.  
  73. IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  74. IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  75. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
  76. IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  77. IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  78.  
  79. IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
  80. IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
  81. IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
  82. IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = FC E9 C9 62 3C 23 CD 01 [binary data]
  83. IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  84. IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
  85. IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  86.  
  87.  
  88. FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2012/04/26 01:36:13 | 000,000,000 | ---D | M]
  89.  
  90.  
  91. O1 HOSTS File: ([2009/06/10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
  92. O4:[b]64bit:[/b] - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
  93. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
  94. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
  95. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
  96. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
  97. O13[b]64bit:[/b] - gopher Prefix: missing
  98. O13 - gopher Prefix: missing
  99. O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
  100. O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.16.1
  101. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EA34F33F-7074-46F2-B36C-F844CA338550}: DhcpNameServer = 192.168.16.1
  102. O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
  103. O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
  104. O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
  105. O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) - File not found
  106. O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
  107. O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
  108. O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
  109. O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  110. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  111. O32 - HKLM CDRom: AutoRun - 1
  112. O34 - HKLM BootExecute: (autocheck autochk *)
  113. O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
  114. O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
  115. O35 - HKLM\..comfile [open] -- "%1" %*
  116. O35 - HKLM\..exefile [open] -- "%1" %*
  117. O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
  118. O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
  119. O37 - HKLM\...com [@ = comfile] -- "%1" %*
  120. O37 - HKLM\...exe [@ = exefile] -- "%1" %*
  121. O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
  122. O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
  123. O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
  124.  
  125. NetSvcs:[b]64bit:[/b] AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
  126.  
  127. CREATERESTOREPOINT
  128. Restore point Set: OTL Restore Point
  129.  
  130. [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
  131.  
  132. [2012/04/26 11:24:10 | 000,000,000 | ---D | C] -- C:\Windows\Panther
  133. [2012/04/26 11:23:56 | 000,000,000 | -HSD | C] -- C:\Boot
  134. [2012/04/26 10:25:33 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
  135. [2012/04/26 10:25:02 | 000,000,000 | -HSD | C] -- C:\System Volume Information
  136. [2012/04/26 01:59:29 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Spaski\Desktop\OTL.scr
  137. [2012/04/26 01:58:54 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Spaski\Desktop\OTL.com
  138. [2012/04/26 01:45:25 | 000,000,000 | ---D | C] -- C:\Users\Spaski\AppData\Roaming\Macromedia
  139. [2012/04/26 01:45:24 | 000,000,000 | ---D | C] -- C:\Users\Spaski\AppData\Roaming\Adobe
  140. [2012/04/26 01:43:26 | 000,249,656 | ---- | C] (Doctor Web, Ltd.) -- C:\Users\Spaski\Desktop\te94decrypt.exe
  141. [2012/04/26 01:38:48 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
  142. [2012/04/26 01:38:48 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
  143. [2012/04/26 01:36:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
  144. [2012/04/26 01:36:13 | 000,000,000 | ---D | C] -- C:\ProgramData\ESET
  145. [2012/04/26 01:36:13 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
  146. [2012/04/26 01:35:44 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
  147. [2012/04/26 01:31:50 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
  148. [2012/04/26 01:30:58 | 000,000,000 | R--D | C] -- C:\Users\Spaski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
  149. [2012/04/26 01:30:58 | 000,000,000 | R--D | C] -- C:\Users\Spaski\Searches
  150. [2012/04/26 01:30:58 | 000,000,000 | R--D | C] -- C:\Users\Spaski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
  151. [2012/04/26 01:30:58 | 000,000,000 | -H-D | C] -- C:\Users\Spaski\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
  152. [2012/04/26 01:30:51 | 000,000,000 | ---D | C] -- C:\Users\Spaski\AppData\Roaming\Identities
  153. [2012/04/26 01:30:49 | 000,000,000 | R--D | C] -- C:\Users\Spaski\Contacts
  154. [2012/04/26 01:30:48 | 000,000,000 | ---D | C] -- C:\Users\Spaski\AppData\Local\VirtualStore
  155. [2012/04/26 01:30:41 | 000,000,000 | --SD | C] -- C:\Users\Spaski\AppData\Roaming\Microsoft
  156. [2012/04/26 01:30:41 | 000,000,000 | R--D | C] -- C:\Users\Spaski\Videos
  157. [2012/04/26 01:30:41 | 000,000,000 | R--D | C] -- C:\Users\Spaski\Saved Games
  158. [2012/04/26 01:30:41 | 000,000,000 | R--D | C] -- C:\Users\Spaski\Pictures
  159. [2012/04/26 01:30:41 | 000,000,000 | R--D | C] -- C:\Users\Spaski\Music
  160. [2012/04/26 01:30:41 | 000,000,000 | R--D | C] -- C:\Users\Spaski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
  161. [2012/04/26 01:30:41 | 000,000,000 | R--D | C] -- C:\Users\Spaski\Links
  162. [2012/04/26 01:30:41 | 000,000,000 | R--D | C] -- C:\Users\Spaski\Favorites
  163. [2012/04/26 01:30:41 | 000,000,000 | R--D | C] -- C:\Users\Spaski\Downloads
  164. [2012/04/26 01:30:41 | 000,000,000 | R--D | C] -- C:\Users\Spaski\Documents
  165. [2012/04/26 01:30:41 | 000,000,000 | R--D | C] -- C:\Users\Spaski\Desktop
  166. [2012/04/26 01:30:41 | 000,000,000 | R--D | C] -- C:\Users\Spaski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
  167. [2012/04/26 01:30:41 | 000,000,000 | -HSD | C] -- C:\Users\Spaski\AppData\Local\Temporary Internet Files
  168. [2012/04/26 01:30:41 | 000,000,000 | -HSD | C] -- C:\Users\Spaski\Templates
  169. [2012/04/26 01:30:41 | 000,000,000 | -HSD | C] -- C:\Users\Spaski\Start Menu
  170. [2012/04/26 01:30:41 | 000,000,000 | -HSD | C] -- C:\Users\Spaski\SendTo
  171. [2012/04/26 01:30:41 | 000,000,000 | -HSD | C] -- C:\Users\Spaski\Recent
  172. [2012/04/26 01:30:41 | 000,000,000 | -HSD | C] -- C:\Users\Spaski\PrintHood
  173. [2012/04/26 01:30:41 | 000,000,000 | -HSD | C] -- C:\Users\Spaski\NetHood
  174. [2012/04/26 01:30:41 | 000,000,000 | -HSD | C] -- C:\Users\Spaski\Documents\My Videos
  175. [2012/04/26 01:30:41 | 000,000,000 | -HSD | C] -- C:\Users\Spaski\Documents\My Pictures
  176. [2012/04/26 01:30:41 | 000,000,000 | -HSD | C] -- C:\Users\Spaski\Documents\My Music
  177. [2012/04/26 01:30:41 | 000,000,000 | -HSD | C] -- C:\Users\Spaski\My Documents
  178. [2012/04/26 01:30:41 | 000,000,000 | -HSD | C] -- C:\Users\Spaski\Local Settings
  179. [2012/04/26 01:30:41 | 000,000,000 | -HSD | C] -- C:\Users\Spaski\AppData\Local\History
  180. [2012/04/26 01:30:41 | 000,000,000 | -HSD | C] -- C:\Users\Spaski\Cookies
  181. [2012/04/26 01:30:41 | 000,000,000 | -HSD | C] -- C:\Users\Spaski\Application Data
  182. [2012/04/26 01:30:41 | 000,000,000 | -HSD | C] -- C:\Users\Spaski\AppData\Local\Application Data
  183. [2012/04/26 01:30:41 | 000,000,000 | -H-D | C] -- C:\Users\Spaski\AppData
  184. [2012/04/26 01:30:41 | 000,000,000 | ---D | C] -- C:\Users\Spaski\AppData\Local\Temp
  185. [2012/04/26 01:30:41 | 000,000,000 | ---D | C] -- C:\Users\Spaski\AppData\Local\Microsoft
  186. [2012/04/26 01:30:41 | 000,000,000 | ---D | C] -- C:\Users\Spaski\AppData\Roaming\Media Center Programs
  187. [2012/04/26 01:30:31 | 000,000,000 | -HSD | C] -- C:\Recovery
  188.  
  189. [color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
  190.  
  191. [2012/04/26 11:23:58 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
  192. [2012/04/26 10:29:06 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
  193. [2012/04/26 10:28:57 | 3220,578,304 | -HS- | M] () -- C:\hiberfil.sys
  194. [2012/04/26 10:28:15 | 000,016,640 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  195. [2012/04/26 10:28:15 | 000,016,640 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  196. [2012/04/26 10:28:12 | 000,116,385 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
  197. [2012/04/26 10:28:12 | 000,116,385 | ---- | M] () -- C:\Windows\SysNative\license.rtf
  198. [2012/04/26 10:25:20 | 000,274,320 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
  199. [2012/04/26 01:59:33 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Spaski\Desktop\OTL.scr
  200. [2012/04/26 01:59:15 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Spaski\Desktop\OTL.com
  201. [2012/04/26 01:45:20 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
  202. [2012/04/26 01:43:37 | 000,249,656 | ---- | M] (Doctor Web, Ltd.) -- C:\Users\Spaski\Desktop\te94decrypt.exe
  203. [2012/04/26 01:37:28 | 000,001,441 | ---- | M] () -- C:\Users\Spaski\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
  204. [2012/04/26 01:34:34 | 000,713,888 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
  205. [2012/04/26 01:34:34 | 000,615,122 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
  206. [2012/04/26 01:34:34 | 000,103,496 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
  207.  
  208. [color=#E56717]========== Files Created - No Company Name ==========[/color]
  209.  
  210. [2012/04/26 11:23:58 | 000,008,192 | RHS- | C] () -- C:\BOOTSECT.BAK
  211. [2012/04/26 11:23:56 | 000,383,786 | RHS- | C] () -- C:\bootmgr
  212. [2012/04/26 10:28:05 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
  213. [2012/04/26 10:27:59 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
  214. [2012/04/26 10:25:03 | 3220,578,304 | -HS- | C] () -- C:\hiberfil.sys
  215. [2012/04/26 01:45:20 | 000,000,830 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
  216. [2012/04/26 01:37:28 | 000,001,441 | ---- | C] () -- C:\Users\Spaski\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
  217. [2012/04/26 01:31:04 | 000,001,413 | ---- | C] () -- C:\Users\Spaski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
  218. [2012/04/26 01:30:59 | 000,001,447 | ---- | C] () -- C:\Users\Spaski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
  219. [2012/04/26 01:30:41 | 000,000,290 | ---- | C] () -- C:\Users\Spaski\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
  220. [2012/04/26 01:30:41 | 000,000,272 | ---- | C] () -- C:\Users\Spaski\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
  221.  
  222. [color=#E56717]========== LOP Check ==========[/color]
  223.  
  224. [2009/07/14 07:08:49 | 000,002,378 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
  225.  
  226. [color=#E56717]========== Purity Check ==========[/color]
  227.  
  228.  
  229.  
  230. [color=#E56717]========== Custom Scans ==========[/color]
  231.  
  232. [color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color]
  233.  
  234. [color=#A23BEC]< MD5 for: AGP440.SYS >[/color]
  235. [2009/07/14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
  236. [2009/07/14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
  237. [2009/07/14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
  238.  
  239. [color=#A23BEC]< MD5 for: ATAPI.SYS >[/color]
  240. [2009/07/14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
  241. [2009/07/14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
  242. [2009/07/14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
  243.  
  244. [color=#A23BEC]< MD5 for: CNGAUDIT.DLL >[/color]
  245. [2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
  246. [2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
  247. [2009/07/14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
  248. [2009/07/14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
  249.  
  250. [color=#A23BEC]< MD5 for: IASTORV.SYS >[/color]
  251. [2010/11/21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\drivers\iaStorV.sys
  252. [2010/11/21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
  253. [2010/11/21 05:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
  254.  
  255. [color=#A23BEC]< MD5 for: NETLOGON.DLL >[/color]
  256. [2010/11/21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
  257. [2010/11/21 05:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
  258. [2010/11/21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
  259. [2010/11/21 05:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
  260.  
  261. [color=#A23BEC]< MD5 for: NVSTOR.SYS >[/color]
  262. [2010/11/21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\drivers\nvstor.sys
  263. [2010/11/21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
  264. [2010/11/21 05:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
  265.  
  266. [color=#A23BEC]< MD5 for: SCECLI.DLL >[/color]
  267. [2010/11/21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
  268. [2010/11/21 05:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
  269. [2010/11/21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
  270. [2010/11/21 05:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
  271.  
  272. [color=#A23BEC]< %systemroot%\*. /mp /s >[/color]
  273.  
  274. [color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color]
  275.  
  276. < End of report >
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!