OTL logfile created on: 24/05/2013 10:11:19 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: dd/MM/yyyy
2.99 Gb Total Physical Memory | 2.43 Gb Available Physical Memory | 81.13% Memory free
4.83 Gb Paging File | 4.30 Gb Available in Paging File | 89.03% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 9.82 Gb Free Space | 4.22% Space Free | Partition Type: NTFS
Drive E: | 80.00 Gb Total Space | 0.87 Gb Free Space | 1.09% Space Free | Partition Type: NTFS
Drive F: | 74.52 Gb Total Space | 0.20 Gb Free Space | 0.27% Space Free | Partition Type: NTFS
Computer Name: MOONLIGHTINGPRO | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ========== PRC - [2013/05/24 09:54:13 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
PRC - [2012/12/14 04:17:04 | 003,467,768 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
PRC - [2012/05/03 18:37:54 | 001,226,096 | ---- | M] (Lavasoft Limited) -- C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe
PRC - [2012/05/03 18:37:50 | 020,221,792 | ---- | M] (Lavasoft Limited) -- C:\Program Files\Ad-Aware Antivirus\AdAware.exe
PRC - [2012/03/30 10:49:44 | 008,174,080 | ---- | M] () -- C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe
PRC - [2012/01/06 08:35:22 | 000,569,072 | ---- | M] (CrossLoop) -- C:\Documents and Settings\Administrator\Local Settings\Application Data\CrossLoop\CrossLoopService.exe
PRC - [2011/12/19 13:20:06 | 003,289,032 | ---- | M] (GFI Software) -- C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe
PRC - [2010/03/16 15:13:45 | 000,341,280 | ---- | M] () -- C:\Program Files\SiteAdvisor\6173\SAService.exe
PRC - [2009/02/20 09:46:52 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
PRC - [2008/08/07 07:57:54 | 000,202,048 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
PRC - [2008/04/14 07:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/04/07 10:10:52 | 000,576,024 | ---- | M] (PDF Complete Inc) -- C:\Program Files\PDF Complete\pdfsvc.exe
PRC - [2000/09/11 05:01:58 | 000,040,960 | ---- | M] () -- C:\Program Files\Microangelo\muamgr.exe
PRC - [1997/07/11 00:00:00 | 000,051,984 | ---- | M] () -- C:\Program Files\Microsoft Office\Office\OSA.EXE
========== Modules (No Company Name) ========== MOD - [2012/03/30 10:49:44 | 008,174,080 | ---- | M] () -- C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe
MOD - [2012/02/05 13:41:50 | 000,181,616 | ---- | M] () -- C:\Program Files\Ad-Aware Antivirus\Definitions\libMachoUniv.dll
MOD - [2012/02/05 13:41:48 | 000,210,288 | ---- | M] () -- C:\Program Files\Ad-Aware Antivirus\Definitions\libBase64.dll
MOD - [2011/09/27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/09/27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010/03/16 15:13:45 | 000,341,280 | ---- | M] () -- C:\Program Files\SiteAdvisor\6173\SAService.exe
MOD - [2008/08/07 07:23:24 | 000,025,088 | ---- | M] () -- C:\Program Files\McAfee\Managed VirusScan\Agent\Res\0409\AgtRes_l.dll
MOD - [2000/09/20 14:59:04 | 000,045,056 | ---- | M] () -- C:\WINDOWS\system32\muadisp.dll
MOD - [2000/09/11 05:01:58 | 000,040,960 | ---- | M] () -- C:\Program Files\Microangelo\muamgr.exe
MOD - [1997/07/11 00:00:00 | 003,782,416 | ---- | M] () -- C:\Program Files\Microsoft Office\Office\MSO97.DLL
MOD - [1997/07/11 00:00:00 | 000,051,984 | ---- | M] () -- C:\Program Files\Microsoft Office\Office\OSA.EXE
========== Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\10.0.6\ToolbarUpdater.exe -- (vToolbarUpdater)
SRV - [2013/05/17 12:07:26 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/05/15 09:52:47 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/14 04:17:04 | 003,467,768 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe -- (TeamViewer8)
SRV - [2012/05/03 18:37:54 | 001,226,096 | ---- | M] (Lavasoft Limited) [Auto | Running] -- C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe -- (Ad-Aware Service)
SRV - [2012/03/30 10:49:44 | 008,174,080 | ---- | M] () [Auto | Running] -- C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe -- (MoonSQL)
SRV - [2012/01/06 08:35:22 | 000,569,072 | ---- | M] (CrossLoop) [Auto | Running] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\CrossLoop\CrossLoopService.exe -- (CrossLoopService)
SRV - [2011/12/19 13:20:06 | 003,289,032 | ---- | M] (GFI Software) [Auto | Stopped] -- C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe -- (SBAMSvc)
SRV - [2010/07/21 07:50:26 | 000,814,080 | ---- | M] (GlavSoft LLC.) [On_Demand | Stopped] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\CrossLoop\tvnserver.exe -- (tvnserver)
SRV - [2010/03/16 15:13:45 | 000,341,280 | ---- | M] () [Auto | Running] -- C:\Program Files\SiteAdvisor\6173\SAService.exe -- (SiteAdvisor Service)
SRV - [2010/01/25 16:57:54 | 000,121,416 | ---- | M] (SmithMicro Inc.) [On_Demand | Stopped] -- C:\Program Files\AT&T\Communication Manager\RcAppSvc.exe -- (ATTRcAppSvc)
SRV - [2009/02/20 09:46:52 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)
SRV - [2008/08/07 07:57:54 | 000,202,048 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.Exe -- (myAgtSvc)
SRV - [2008/04/07 10:10:52 | 000,576,024 | ---- | M] (PDF Complete Inc) [Auto | Running] -- C:\Program Files\PDF Complete\pdfsvc.exe -- (pdfcDispatcher)
SRV - [2001/02/14 10:00:00 | 000,106,552 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\pcAnywhere\AWHOST32.EXE -- (awhost32)
========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | Boot | Stopped] -- System32\drivers\xiypeuit.sys -- (vspawbrj)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- C:\DOCUME~1\Kevin\LOCALS~1\Temp\VSPE.sys -- (EterlogicVirtualSerialDriver)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\avgidsshimx.sys -- (AVGIDSShim)
DRV - File not found [Kernel | Boot | Stopped] -- system32\DRIVERS\avgidshx.sys -- (AVGIDSHX)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\avgidsfilterx.sys -- (AVGIDSFilter)
DRV - [2012/04/09 16:27:34 | 000,299,024 | ---- | M] (EldoS Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cbfs3.sys -- (cbfs3)
DRV - [2011/12/19 12:44:24 | 000,335,224 | ---- | M] (GFI Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\SbFw.sys -- (SbFw)
DRV - [2011/12/19 12:44:24 | 000,217,976 | ---- | M] (GFI Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\sbtis.sys -- (sbtis)
DRV - [2011/12/19 12:44:24 | 000,093,816 | ---- | M] (GFI Software) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sbhips.sys -- (sbhips)
DRV - [2011/11/29 06:59:52 | 000,077,816 | ---- | M] (GFI Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\sbapifs.sys -- (sbapifs)
DRV - [2011/11/29 06:59:48 | 000,021,240 | ---- | M] (GFI Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\sbaphd.sys -- (sbaphd)
DRV - [2011/10/26 14:23:40 | 000,101,112 | ---- | M] (GFI Software) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\SBREDrv.sys -- (SBRE)
DRV - [2011/09/29 12:16:18 | 000,094,584 | ---- | M] (GFI Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SbFwIm.sys -- (SBFWIMCLMP)
DRV - [2011/09/29 12:16:18 | 000,094,584 | ---- | M] (GFI Software) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SbFwIm.sys -- (SBFWIMCL)
DRV - [2011/06/02 11:08:34 | 000,011,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\SystemRequirementsLab\cpudrv.sys -- (cpudrv)
DRV - [2011/05/15 23:29:58 | 000,063,712 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\Symantec\SYMEVENT.SYS -- (SymEvent)
DRV - [2010/02/11 07:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2010/01/25 16:50:24 | 000,024,064 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\tcpipBM.sys -- (tcpipBM)
DRV - [2010/01/25 16:49:36 | 000,032,408 | ---- | M] (Smith Micro Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\PCTINDIS5.sys -- (PCTINDIS5)
DRV - [2010/01/05 11:50:40 | 000,027,520 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbdmodem.sys -- (USBSADModem)
DRV - [2010/01/05 11:50:40 | 000,022,400 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbdobex.sys -- (UsbSADObex)
DRV - [2010/01/05 11:50:40 | 000,019,072 | ---- | M] (Icera Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgcpo.sys -- (lgcpo)
DRV - [2010/01/05 11:50:38 | 000,058,624 | ---- | M] (Jungo) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\dc_enum.sys -- (USBSANDIS)
DRV - [2010/01/05 11:50:38 | 000,045,568 | ---- | M] (Jungo) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\cdc_ecm.sys -- (cdc_ecm)
DRV - [2010/01/05 11:50:38 | 000,022,400 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbddiag.sys -- (UsbSADDiag)
DRV - [2009/03/30 04:09:28 | 000,239,336 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\RsFx0103.sys -- (RsFx0103)
DRV - [2008/08/22 10:05:42 | 000,026,760 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\swmsflt.sys -- (swmsflt)
DRV - [2008/04/14 02:26:08 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2008/04/13 19:04:34 | 000,019,455 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wVchNTxx.sys -- (iAimFP4)
DRV - [2008/04/13 19:04:32 | 000,012,063 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wSiINTxx.sys -- (iAimFP3)
DRV - [2008/04/13 19:04:30 | 000,033,599 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV04nt.sys -- (iAimTV3)
DRV - [2008/04/13 19:04:30 | 000,029,311 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV01nt.sys -- (iAimTV0)
DRV - [2008/04/13 19:04:30 | 000,025,471 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV10nt.sys -- (iAimTV5)
DRV - [2008/04/13 19:04:30 | 000,023,615 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wCh7xxNT.sys -- (iAimTV4)
DRV - [2008/04/13 19:04:30 | 000,022,271 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV06nt.sys -- (iAimTV6)
DRV - [2008/04/13 19:04:30 | 000,019,551 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV02NT.sys -- (iAimTV1)
DRV - [2008/04/13 19:04:28 | 000,161,020 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\i81xnt5.sys -- (i81x)
DRV - [2008/04/13 19:04:28 | 000,012,415 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV01nt.sys -- (iAimFP0)
DRV - [2008/04/13 19:04:28 | 000,012,127 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV02NT.sys -- (iAimFP1)
DRV - [2008/04/13 19:04:28 | 000,011,871 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV09NT.sys -- (iAimFP7)
DRV - [2008/04/13 19:04:28 | 000,011,807 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV07nt.sys -- (iAimFP5)
DRV - [2008/04/13 19:04:28 | 000,011,775 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV05NT.sys -- (iAimFP2)
DRV - [2008/04/13 19:04:28 | 000,011,295 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV08NT.sys -- (iAimFP6)
DRV - [2008/01/03 17:10:16 | 000,105,856 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2007/11/06 12:23:56 | 004,622,848 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)
DRV - [2007/08/23 06:29:48 | 000,106,792 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sscdmdm.sys -- (sscdmdm)
DRV - [2007/08/23 06:29:48 | 000,080,552 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sscdbus.sys -- (sscdbus)
DRV - [2007/08/23 06:29:48 | 000,011,944 | R--- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sscdmdfl.sys -- (sscdmdfl)
DRV - [2004/04/01 16:30:46 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc)
DRV - [2002/04/04 01:32:06 | 000,028,416 | R--- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\symmpi.sys -- (Symmpi)
DRV - [2001/08/17 15:54:20 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)
DRV - [2001/08/17 15:54:20 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)
DRV - [2000/09/11 10:00:00 | 000,030,398 | ---- | M] (Symantec Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\AW_HOST5.SYS -- (AW_HOST)
DRV - [2000/09/11 10:00:00 | 000,014,032 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\GERNUWA.SYS -- (Gernuwa)
DRV - [2000/09/11 10:00:00 | 000,010,816 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AWLEGACY.SYS -- (awlegacy)
DRV - [2000/04/04 13:27:38 | 000,019,824 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\Parclass.sys -- (Parclass)
DRV - [1997/12/22 20:02:46 | 000,023,936 | ---- | M] (Adaptec) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\aspi32.sys -- (Aspi32)
========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.google.comIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = Reg Error: Value error.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = Reg Error: Value error.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.comIE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" =
http://www.bing.com/search IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.hp.comIE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.hp.com IE - HKU\S-1-5-21-1920358730-1913087698-391787831-500\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.google.comIE - HKU\S-1-5-21-1920358730-1913087698-391787831-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.com/IE - HKU\S-1-5-21-1920358730-1913087698-391787831-500\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1920358730-1913087698-391787831-500\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" =
http://www.bing.com/searchIE - HKU\S-1-5-21-1920358730-1913087698-391787831-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1920358730-1913087698-391787831-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ========== FF - prefs.js..extensions.enabledAddons: %7B79c50f9a-2ffe-4ee0-8a37-fae4f5dacd4f%7D:4.9.7
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.15.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/05/17 12:07:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/05/24 09:45:58 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{1650a312-02bc-40ee-977e-83f158701739}: C:\Program Files\SiteAdvisor\6173\FF\ [2010/03/16 15:13:46 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\singalong@xenophesoft.com: C:\Program Files\SingAlong\FF\ [2013/05/22 10:00:56 | 000,000,000 | ---D | M]
[2010/07/22 21:03:32 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2010/04/27 19:24:34 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2013/05/24 09:58:44 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mdn6j4lo.default\extensions
[2011/07/24 22:12:30 | 000,000,000 | ---D | M] (MR Tech Toolkit) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mdn6j4lo.default\extensions\{9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC}
[2012/04/04 22:53:27 | 000,020,591 | ---- | M] () (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mdn6j4lo.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
[2013/02/10 12:37:18 | 000,137,731 | ---- | M] () (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mdn6j4lo.default\extensions\{79c50f9a-2ffe-4ee0-8a37-fae4f5dacd4f}.xpi
[2013/05/24 09:48:32 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/05/17 12:07:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/05/17 12:07:27 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2012/03/14 22:01:53 | 000,003,766 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
========== Chrome ========== CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - homepage:
http://search.conduit.com/?ctid=CT32947 ... 10110&UM=2CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.93\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.93\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\27.0.1453.93\pdf.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Google Search = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: Gmail = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
O1 HOSTS File: ([2012/12/14 23:10:29 | 000,000,083 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Reg Error: Value error.) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6173\SiteAdv.dll ()
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Sing Along) - {6492E171-2427-4932-B414-33574A089F5E} - C:\Program Files\SingAlong\singalng.dll (Xenophesoft)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6173\SiteAdv.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-1920358730-1913087698-391787831-500\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Ad-Aware Antivirus] C:\Program Files\Ad-Aware Antivirus\AdAwareLauncher.exe (Lavasoft Limited)
O4 - HKLM..\Run: [Ad-Aware Browsing Protection] C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AT&T Communication Manager] C:\Program Files\AT&T\Communication Manager\ATTCM.exe (ATT)
O4 - HKLM..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe" File not found
O4 - HKLM..\RunOnce: [SpUninstallCleanUp] REG delete HKEY_CURRENT_USER\Software\SearchProtect /f File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microangelo Desktop.lnk = C:\Program Files\Microangelo\muamgr.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1920358730-1913087698-391787831-500\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1920358730-1913087698-391787831-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1920358730-1913087698-391787831-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1920358730-1913087698-391787831-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {EB5FBF0C-B650-41DD-8A69-2A4717FDA737}
http://50.26.154.14:81/codebase/TVN20Ne ... eX_V23.cab (TVN20RealPlayActiveX23 Control)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9}
https://secure.logmein.com/activex/ractrl.cab?lmi=100 (Performance Viewer Activex Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FFC621CA-ECA7-429E-86BB-90F0D9C9D319}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\myrm {4D034FC3-013F-4b95-B544-44D49ABE3E76} - C:\Program Files\McAfee\Managed VirusScan\Agent\myRmProt4.9.0.387.dll (McAfee, Inc.)
O18 - Protocol\Handler\siteadvisor {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6173\SiteAdv.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O21 - SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\WINDOWS\system32\CbFsMntNtf3.dll (EldoS Corporation)
O22 - SharedTaskScheduler: {5FF49FE8-B332-4CB9-B102-FB6951629E55} - Virtual Storage Mount Notification - C:\WINDOWS\system32\CbFsMntNtf3.dll (EldoS Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/07/17 20:30:10 | 000,000,000 | ---D | M] - C:\AutoPlay Menu Studio 3.0 -- [ NTFS ]
O32 - AutoRun File - [2005/07/16 14:27:54 | 000,000,000 | -H-- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2005/12/19 14:09:06 | 000,000,000 | ---D | M] - E:\AutoPlay Menu Studio 3.0 -- [ NTFS ]
O32 - AutoRun File - [2002/06/06 00:36:20 | 000,000,000 | -H-- | M] () - F:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ========== [2013/05/24 09:55:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2013/05/24 09:55:02 | 000,000,000 | ---D | C] -- C:\JRT
[2013/05/24 09:54:07 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2013/05/22 10:05:03 | 000,000,000 | ---D | C] -- C:\Program Files\Uninstaller
[2013/05/22 10:03:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\CRE
[2013/05/22 10:01:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2013/05/22 10:00:56 | 000,000,000 | ---D | C] -- C:\Program Files\SingAlong
[2013/05/17 12:07:03 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012/03/26 21:53:55 | 001,393,736 | ---- | C] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Documents and Settings\Administrator\gotomypc_635.exe
[2012/01/25 20:36:44 | 000,726,008 | ---- | C] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Documents and Settings\Administrator\gotomypc_438.exe
[2012/01/04 01:14:09 | 001,393,736 | ---- | C] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Documents and Settings\Administrator\gotomypc_626.exe
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ========== [2013/05/24 10:06:01 | 000,000,900 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/24 10:01:15 | 000,000,338 | ---- | M] () -- C:\WINDOWS\tasks\lf.job
[2013/05/24 09:54:13 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2013/05/24 09:52:51 | 000,000,384 | ---- | M] () -- C:\WINDOWS\tasks\Sing Along Update.job
[2013/05/24 09:52:01 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/05/24 09:44:00 | 000,000,982 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1920358730-1913087698-391787831-1011UA.job
[2013/05/24 09:39:01 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/05/24 09:37:35 | 000,001,675 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Ad-Aware Antivirus.lnk
[2013/05/24 09:36:31 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/24 09:36:04 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/05/24 09:35:58 | 3210,985,472 | -HS- | M] () -- C:\hiberfil.sys
[2013/05/24 00:06:22 | 000,001,873 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/05/23 22:16:19 | 000,025,088 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\codecheck.exe
[2013/05/23 14:25:00 | 000,000,930 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1920358730-1913087698-391787831-1011Core.job
[2013/05/23 13:56:00 | 000,000,294 | ---- | M] () -- C:\WINDOWS\tasks\DealPlyUpdate.job
[2013/05/22 11:55:44 | 000,003,141 | ---- | M] () -- C:\WINDOWS\UEDIT32.INI
[2013/05/22 11:42:23 | 000,090,624 | ---- | M] () -- C:\WINDOWS\System32\MSHFLXGD.oca
[2013/05/22 11:42:22 | 000,069,632 | ---- | M] () -- C:\WINDOWS\System32\MSDATLST.oca
[2013/05/22 11:42:22 | 000,035,840 | ---- | M] () -- C:\WINDOWS\System32\MSADODC.oca
[2013/05/22 11:42:21 | 000,065,536 | ---- | M] () -- C:\WINDOWS\System32\MSDATGRD.oca
[2013/05/22 11:42:21 | 000,017,408 | ---- | M] () -- C:\WINDOWS\System32\SYSINFO.oca
[2013/05/22 11:42:20 | 000,063,488 | ---- | M] () -- C:\WINDOWS\System32\MCI32.oca
[2013/05/22 11:42:20 | 000,018,944 | ---- | M] () -- C:\WINDOWS\System32\PICCLP32.oca
[2013/05/22 11:42:19 | 000,166,400 | ---- | M] () -- C:\WINDOWS\System32\MSCHRT20.oca
[2013/05/22 11:42:18 | 000,064,000 | ---- | M] () -- C:\WINDOWS\System32\RICHTX32.oca
[2013/05/20 17:48:01 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013/05/19 02:00:06 | 000,000,960 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Antivirus Scheduled Scan.job
[2013/05/18 14:14:25 | 019,407,872 | ---- | M] () -- C:\WINDOWS\outlook.pst
[2013/05/18 10:50:43 | 000,001,416 | ---- | M] () -- C:\WINDOWS\CDPlayer.ini
[2013/05/16 03:31:34 | 000,439,736 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/05/16 03:13:59 | 000,619,362 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/05/16 03:13:59 | 000,132,314 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/05/16 03:05:28 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013/05/15 09:52:47 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/05/15 09:52:47 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/05/10 11:42:15 | 000,061,952 | ---- | M] () -- C:\WINDOWS\System32\MMWaveX2.oca
[2013/05/10 11:42:15 | 000,019,968 | ---- | M] () -- C:\WINDOWS\System32\HyperLabel.oca
[2013/05/10 11:42:14 | 000,135,168 | ---- | M] () -- C:\WINDOWS\System32\MSCOMCT2.oca
[2013/05/10 11:42:14 | 000,048,640 | ---- | M] () -- C:\WINDOWS\System32\MSMASK32.oca
[2013/05/10 11:42:14 | 000,023,552 | ---- | M] () -- C:\WINDOWS\System32\ctcombo.oca
[2013/05/10 11:42:14 | 000,014,336 | ---- | M] () -- C:\WINDOWS\System32\ctimage.oca
[2013/05/10 11:42:13 | 000,240,128 | ---- | M] () -- C:\WINDOWS\System32\COMCTL32.oca
[2013/05/10 11:42:13 | 000,076,288 | ---- | M] () -- C:\WINDOWS\System32\MSFLXGRD.oca
[2013/05/10 11:42:13 | 000,069,120 | ---- | M] () -- C:\WINDOWS\System32\DBLIST32.oca
[2013/05/10 11:42:13 | 000,019,968 | ---- | M] () -- C:\WINDOWS\System32\cthtml.oca
[2013/05/10 11:42:12 | 000,062,464 | ---- | M] () -- C:\WINDOWS\System32\DBGRID32.oca
[2013/05/10 11:42:12 | 000,042,496 | ---- | M] () -- C:\WINDOWS\System32\ctmonth.oca
[2013/05/10 11:42:12 | 000,026,112 | ---- | M] () -- C:\WINDOWS\System32\ctnedit.oca
[2013/05/10 11:42:12 | 000,023,552 | ---- | M] () -- C:\WINDOWS\System32\ctcheck.oca
[2013/05/10 11:42:12 | 000,022,528 | ---- | M] () -- C:\WINDOWS\System32\ctfill.oca
[2013/05/10 11:42:11 | 000,043,520 | ---- | M] () -- C:\WINDOWS\System32\Ctlist.oca
[2013/05/10 11:42:11 | 000,023,040 | ---- | M] () -- C:\WINDOWS\System32\ctpush.oca
[2013/05/10 11:42:11 | 000,022,016 | ---- | M] () -- C:\WINDOWS\System32\Cttips.oca
[2013/05/10 11:42:11 | 000,020,992 | ---- | M] () -- C:\WINDOWS\System32\ctcalc.oca
[2013/05/10 11:42:11 | 000,019,456 | ---- | M] () -- C:\WINDOWS\System32\Cthyplnk.oca
[2013/05/10 11:42:11 | 000,009,216 | ---- | M] () -- C:\WINDOWS\System32\ctwave.oca
[2013/05/10 11:42:10 | 000,031,232 | ---- | M] () -- C:\WINDOWS\System32\ctdate.oca
[2013/05/10 11:42:10 | 000,026,112 | ---- | M] () -- C:\WINDOWS\System32\ctvlist.oca
[2013/05/10 11:42:10 | 000,023,040 | ---- | M] () -- C:\WINDOWS\System32\ctradio.oca
[2013/05/10 11:42:10 | 000,023,040 | ---- | M] () -- C:\WINDOWS\System32\ctmeter.oca
[2013/05/10 11:42:10 | 000,021,504 | ---- | M] () -- C:\WINDOWS\System32\ctdial.oca
[2013/05/10 11:42:10 | 000,014,336 | ---- | M] () -- C:\WINDOWS\System32\ctcpick.oca
[2013/05/10 11:42:09 | 000,029,184 | ---- | M] () -- C:\WINDOWS\System32\Ctyear.oca
[2013/05/10 11:42:09 | 000,023,552 | ---- | M] () -- C:\WINDOWS\System32\ctsize.oca
[2013/05/10 11:42:09 | 000,023,552 | ---- | M] () -- C:\WINDOWS\System32\ctgauge.oca
[2013/05/10 11:42:09 | 000,022,528 | ---- | M] () -- C:\WINDOWS\System32\ctclock.oca
[2013/05/10 11:42:09 | 000,019,968 | ---- | M] () -- C:\WINDOWS\System32\ctgroup.oca
[2013/05/10 11:42:09 | 000,007,680 | ---- | M] () -- C:\WINDOWS\System32\ctmenu.oca
[2013/05/10 11:42:08 | 000,027,648 | ---- | M] () -- C:\WINDOWS\System32\ctdedit.oca
[2013/05/10 11:42:08 | 000,025,088 | ---- | M] () -- C:\WINDOWS\System32\ctslide.oca
[2013/05/10 11:42:08 | 000,011,264 | ---- | M] () -- C:\WINDOWS\System32\ctPrint.oca
[2013/05/10 11:42:08 | 000,010,240 | ---- | M] () -- C:\WINDOWS\System32\ctfile.oca
[2013/05/10 11:42:08 | 000,009,728 | ---- | M] () -- C:\WINDOWS\System32\ctcolor.oca
[2013/05/10 11:42:08 | 000,009,216 | ---- | M] () -- C:\WINDOWS\System32\ctTray.oca
[2013/05/10 11:42:07 | 000,023,040 | ---- | M] () -- C:\WINDOWS\System32\Ctfold.oca
[2013/05/10 11:42:07 | 000,021,504 | ---- | M] () -- C:\WINDOWS\System32\ctsplit.oca
[2013/05/10 11:42:07 | 000,021,504 | ---- | M] () -- C:\WINDOWS\System32\ctscroll.oca
[2013/05/10 11:42:07 | 000,018,944 | ---- | M] () -- C:\WINDOWS\System32\ctspin.oca
[2013/05/10 11:42:07 | 000,012,800 | ---- | M] () -- C:\WINDOWS\System32\ctformfx.oca
[2013/05/10 11:42:07 | 000,009,728 | ---- | M] () -- C:\WINDOWS\System32\ctfont.oca
[2013/05/10 11:42:06 | 000,051,200 | ---- | M] () -- C:\WINDOWS\System32\cttree.oca
[2013/05/10 11:42:06 | 000,030,720 | ---- | M] () -- C:\WINDOWS\System32\ctbutton.oca
[2013/05/10 11:42:06 | 000,023,040 | ---- | M] () -- C:\WINDOWS\System32\ctruler.oca
[2013/05/10 11:42:06 | 000,022,016 | ---- | M] () -- C:\WINDOWS\System32\ctsched.oca
[2013/05/10 11:42:06 | 000,020,480 | ---- | M] () -- C:\WINDOWS\System32\cttabs.oca
[2013/05/10 11:42:05 | 000,028,160 | ---- | M] () -- C:\WINDOWS\System32\ctlstbar.oca
[2013/05/10 11:42:05 | 000,025,088 | ---- | M] () -- C:\WINDOWS\System32\ctmedit.oca
[2013/05/10 11:42:05 | 000,023,552 | ---- | M] () -- C:\WINDOWS\System32\ctpaper.oca
[2013/05/10 11:42:05 | 000,020,480 | ---- | M] () -- C:\WINDOWS\System32\Ctframe.oca
[2013/05/10 11:42:05 | 000,019,456 | ---- | M] () -- C:\WINDOWS\System32\ctrotate.oca
[2013/05/10 11:42:05 | 000,018,944 | ---- | M] () -- C:\WINDOWS\System32\ctclip.oca
[2013/05/10 11:42:04 | 000,024,576 | ---- | M] () -- C:\WINDOWS\System32\cttext.oca
[2013/05/10 11:42:04 | 000,024,064 | ---- | M] () -- C:\WINDOWS\System32\ctspiral.oca
[2013/05/10 11:42:04 | 000,023,040 | ---- | M] () -- C:\WINDOWS\System32\ctbanner.oca
[2013/05/10 11:42:04 | 000,020,480 | ---- | M] () -- C:\WINDOWS\System32\ctdata.oca
[2013/05/10 11:42:03 | 000,022,016 | ---- | M] () -- C:\WINDOWS\System32\ctmove.oca
[2013/05/08 09:01:08 | 000,000,019 | ---- | M] () -- C:\WINDOWS\info067
[2013/05/08 09:01:08 | 000,000,019 | ---- | M] () -- C:\WINDOWS\info066
[2013/05/08 09:01:07 | 000,000,019 | ---- | M] () -- C:\WINDOWS\info070
[2013/05/08 09:01:07 | 000,000,019 | ---- | M] () -- C:\WINDOWS\info069
[2013/05/08 09:01:07 | 000,000,019 | ---- | M] () -- C:\WINDOWS\info068
[2013/05/08 09:01:07 | 000,000,019 | ---- | M] () -- C:\WINDOWS\info051
[2013/05/08 09:01:07 | 000,000,019 | ---- | M] () -- C:\WINDOWS\info049
[2013/05/08 08:52:54 | 000,265,728 | ---- | M] () -- C:\WINDOWS\System32\MSCOMCTL.oca
[2013/05/08 01:10:12 | 000,770,384 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcr100.dll
[2013/05/08 01:10:12 | 000,421,200 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcp100.dll
[2013/05/06 23:27:31 | 006,015,488 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2013/05/04 12:47:18 | 000,065,024 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/05/02 22:19:50 | 000,576,460 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\MidlandMortgage_KevinMoon_LoanNumber_53107673.pdf
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ========== [2013/05/23 22:16:19 | 000,025,088 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\codecheck.exe
[2013/05/22 11:42:21 | 000,017,408 | ---- | C] () -- C:\WINDOWS\System32\SYSINFO.oca
[2013/05/22 11:42:20 | 000,063,488 | ---- | C] () -- C:\WINDOWS\System32\MCI32.oca
[2013/05/22 11:42:20 | 000,018,944 | ---- | C] () -- C:\WINDOWS\System32\PICCLP32.oca
[2013/05/22 11:42:19 | 000,166,400 | ---- | C] () -- C:\WINDOWS\System32\MSCHRT20.oca
[2013/05/22 11:42:18 | 000,064,000 | ---- | C] () -- C:\WINDOWS\System32\RICHTX32.oca
[2013/05/22 10:00:59 | 000,000,384 | ---- | C] () -- C:\WINDOWS\tasks\Sing Along Update.job
[2013/05/08 09:01:08 | 000,000,019 | ---- | C] () -- C:\WINDOWS\info067
[2013/05/08 09:01:08 | 000,000,019 | ---- | C] () -- C:\WINDOWS\info066
[2013/05/08 09:01:07 | 000,000,019 | ---- | C] () -- C:\WINDOWS\info070
[2013/05/08 09:01:07 | 000,000,019 | ---- | C] () -- C:\WINDOWS\info069
[2013/05/08 09:01:07 | 000,000,019 | ---- | C] () -- C:\WINDOWS\info068
[2013/05/08 09:01:07 | 000,000,019 | ---- | C] () -- C:\WINDOWS\info051
[2013/05/08 09:01:07 | 000,000,019 | ---- | C] () -- C:\WINDOWS\info049
[2013/05/02 22:19:50 | 000,576,460 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\MidlandMortgage_KevinMoon_LoanNumber_53107673.pdf
[2012/12/16 20:48:19 | 000,000,013 | ---- | C] () -- C:\WINDOWS\ffs.dat
[2012/12/15 19:42:12 | 000,111,234 | ---- | C] () -- C:\Program Files\9876~20121215_184210.new
[2012/11/19 18:09:44 | 000,357,378 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1920358730-1913087698-391787831-1012-0.dat
[2012/10/15 10:46:35 | 000,000,588 | ---- | C] () -- C:\WINDOWS\vbv4.ini
[2012/10/15 10:46:31 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\VBV32hh.dll
[2012/09/09 20:07:52 | 000,090,500 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2012/09/01 22:16:20 | 000,038,498 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Comma Separated Values (DOS).ADR
[2012/09/01 21:06:06 | 000,037,898 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Comma Separated Values (Windows).ADR
[2012/08/27 21:17:43 | 000,000,022 | ---- | C] () -- C:\WINDOWS\exchng.ini
[2012/04/28 01:22:12 | 000,018,251 | ---- | C] () -- C:\WINDOWS\wise.ini
[2012/02/28 13:38:35 | 000,000,028 | ---- | C] () -- C:\WINDOWS\Wise32.INI
[2012/02/15 04:28:28 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/01/09 22:30:20 | 000,000,288 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\.backup.dm
[2012/01/02 20:49:33 | 000,013,868 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\vfa226ni8vdg40wc4k082i1bxnspx1sa1vpji
[2011/12/20 20:50:26 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/12/20 20:50:26 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/12/20 20:50:26 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/12/20 20:50:26 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/12/20 20:50:26 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/12/20 01:02:06 | 000,013,132 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\b2ml23h4pd6pnu
[2011/12/16 18:00:46 | 000,001,416 | ---- | C] () -- C:\WINDOWS\CDPlayer.ini
[2011/12/16 17:59:43 | 000,164,352 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall.exe
[2011/12/16 17:59:43 | 000,020,898 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall-dBpowerAMP Music Converter.dat
[2011/10/06 20:11:40 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\fusioncache.dat
[2011/10/02 23:28:25 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\muangsys.dll
[2011/10/02 23:28:25 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\muadisp.dll
[2011/09/18 19:04:09 | 000,137,572 | ---- | C] () -- C:\WINDOWS\cep1unin.exe
[2011/09/18 19:02:36 | 000,000,163 | ---- | C] () -- C:\WINDOWS\cool.ini
[2011/09/18 15:12:16 | 000,000,135 | ---- | C] () -- C:\WINDOWS\VB5.INI
[2011/09/18 14:56:50 | 000,012,048 | ---- | C] () -- C:\WINDOWS\System32\Ppmon.exe
[2011/09/18 14:56:50 | 000,007,440 | ---- | C] () -- C:\WINDOWS\System32\Ppmon.dll
[2011/09/18 14:55:41 | 000,748,160 | ---- | C] () -- C:\WINDOWS\System32\Co2c40en.dll
[2011/09/18 14:55:41 | 000,131,072 | ---- | C] () -- C:\WINDOWS\System32\P2sodbc.dll
[2011/09/18 14:55:41 | 000,054,272 | ---- | C] () -- C:\WINDOWS\System32\P2irdao.dll
[2011/09/18 14:55:41 | 000,050,176 | ---- | C] () -- C:\WINDOWS\System32\P2ctdao.dll
[2011/09/18 14:55:41 | 000,036,352 | ---- | C] () -- C:\WINDOWS\System32\P2bbnd.dll
[2011/09/18 14:55:41 | 000,018,944 | ---- | C] ( ) -- C:\WINDOWS\System32\Implode.dll
[2011/08/14 23:16:29 | 000,003,141 | ---- | C] () -- C:\WINDOWS\UEDIT32.INI
[2011/08/11 03:10:15 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2011/07/17 21:25:07 | 000,038,400 | ---- | C] () -- C:\WINDOWS\System32\AXDIST.EXE
[2011/05/16 18:58:39 | 000,000,022 | ---- | C] () -- C:\Documents and Settings\Administrator\com10
[2011/02/14 19:11:44 | 000,000,272 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~xQc8sJtHMfo7
[2011/02/14 19:11:44 | 000,000,160 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~xQc8sJtHMfo7r
[2011/02/14 19:11:35 | 000,000,520 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\xQc8sJtHMfo7
[2011/02/14 08:29:55 | 001,547,458 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1920358730-1913087698-391787831-500-0.dat
[2011/02/14 08:29:54 | 000,357,378 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2011/02/11 21:03:54 | 000,000,264 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~0pGQnODnIBa
[2011/02/11 21:03:54 | 000,000,144 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~0pGQnODnIBar
[2011/02/11 21:03:48 | 000,000,344 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\0pGQnODnIBa
[2010/07/23 10:15:28 | 000,065,024 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
========== ZeroAccess Check ========== [2010/03/16 14:52:16 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 07:42:06 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 07:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/14 07:42:10 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
========== LOP Check ========== [2012/04/27 12:15:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\.minecraft
[2012/09/29 00:19:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Ad-Aware Antivirus
[2011/04/05 09:28:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\AT&T
[2012/09/22 20:49:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Audacity
[2012/03/26 23:53:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Avery
[2012/08/21 20:57:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\DiskAid
[2011/04/05 10:25:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\FrostWire
[2012/12/16 21:09:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\GSplit
[2013/05/18 15:06:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\iFunbox_UserCache
[2012/05/03 11:41:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\MySQL
[2011/07/24 13:31:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\MZTools Software
[2012/08/25 16:33:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\redsn0w
[2011/10/06 21:26:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\SMSSender
[2012/04/27 12:29:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\SystemRequirementsLab
[2013/02/08 18:04:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\TeamViewer
[2010/04/27 23:04:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Thunderbird
[2012/08/21 22:56:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\WindSolutions
[2012/08/22 21:44:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Xilisoft
[2012/12/25 11:43:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2012/09/24 01:39:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection
[2011/03/15 23:01:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AT&T
[2012/06/10 14:12:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/03/26 23:52:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Avery
[2012/03/14 22:49:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG Secure Search
[2012/06/10 14:02:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG2012
[2011/03/15 07:58:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2012/01/09 22:30:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ClubSanDisk
[2011/12/20 21:29:57 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/03/16 07:49:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LG
[2011/05/15 23:30:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LogMeIn
[2012/06/10 14:00:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2012/08/21 20:50:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MGTEK
[2011/07/24 22:40:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Motorola Media Link
[2012/05/02 13:52:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MySQL
[2013/05/22 10:01:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2012/08/21 22:55:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WindSolutions
[2010/12/20 18:04:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/06/23 17:21:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Andrew\Application Data\AT&T
[2010/05/24 14:27:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Andrew\Application Data\Weather Defender
[2011/03/15 07:59:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kevin\Application Data\AT&T
[2011/03/15 07:56:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kevin\Application Data\Sierra Wireless
[2010/05/24 14:26:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kevin\Application Data\Weather Defender
[2012/06/11 21:13:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Ad-Aware Antivirus
[2013/03/19 01:09:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Matthew\Application Data\.minecraft
[2011/12/20 07:11:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Matthew\Application Data\3E6D0
[2012/06/12 02:58:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Matthew\Application Data\Ad-Aware Antivirus
[2011/03/15 08:11:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Matthew\Application Data\AT&T
[2012/01/01 14:27:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Matthew\Application Data\AVG Secure Search
[2012/03/14 22:03:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Matthew\Application Data\AVG2012
[2011/12/20 01:03:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Matthew\Application Data\D00B6
[2012/01/01 15:22:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Matthew\Application Data\MP3Rocket
[2013/05/23 16:16:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Matthew\Application Data\PriceGong
[2013/05/23 16:11:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Matthew\Application Data\SearchProtect
[2012/02/25 23:13:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Matthew\Application Data\TeamViewer
[2011/03/16 22:05:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Melanie\Application Data\AT&T
[2011/03/15 08:01:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Bytemobile
[2011/09/14 13:04:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\TightVNC
========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 7024 bytes -> C:\Documents and Settings\Administrator\My Documents\18413787.gif:Q30lsldxJoudresxAaaqpcawXc
< End of report >