OTL logfile created on: 2012-12-11 06:50:57 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\108003109\Desktop 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000415 | Country: Poland | Language: PLK | Date Format: yyyy-MM-dd 3,88 Gb Total Physical Memory | 2,03 Gb Available Physical Memory | 52,33% Memory free 7,77 Gb Paging File | 5,73 Gb Available in Paging File | 73,74% Paging File free Paging file location(s): C:\PageFile.sys 0 0 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 298,09 Gb Total Space | 226,05 Gb Free Space | 75,83% Space Free | Partition Type: NTFS Computer Name: NGW-PLWALTOS1 | User Name: 108003109 | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - File not found -- PRC - [2012-12-10 14:02:20 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\108003109\Desktop\OTL.exe PRC - [2012-12-05 18:10:34 | 002,403,352 | ---- | M] () -- C:\ProgramData\Browser Manager\2.5.976.107\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.exe PRC - [2012-10-27 13:46:02 | 023,119,272 | ---- | M] (VoipDiscount) -- C:\Program Files (x86)\VoipDiscount.com\VoipDiscount\voipdiscount.exe PRC - [2012-10-24 19:52:06 | 000,606,208 | ---- | M] (General Electric) -- C:\Program Files (x86)\Common Files\GE\ITAM\AgentChk.exe PRC - [2012-10-03 07:22:26 | 000,201,808 | ---- | M] (Somoto) -- C:\Program Files (x86)\FilesFrog Update Checker\update_checker.exe PRC - [2012-09-20 11:25:51 | 000,202,240 | ---- | M] () -- C:\Users\108003109\AppData\Roaming\Akqus\kodou.exe PRC - [2012-08-03 15:06:06 | 001,086,376 | ---- | M] (Nokia) -- C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe PRC - [2012-08-01 15:07:16 | 000,724,888 | ---- | M] (Nokia) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe PRC - [2012-08-01 15:06:58 | 000,148,888 | ---- | M] (Nokia) -- C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe PRC - [2012-07-20 00:33:08 | 000,670,832 | ---- | M] (Juniper Networks) -- C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe PRC - [2012-07-12 10:31:51 | 000,232,472 | ---- | M] (Sophos Plc) -- C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe PRC - [2012-07-12 09:55:38 | 000,128,240 | ---- | M] (Sophos Plc) -- C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFManager.exe PRC - [2012-07-12 09:55:37 | 000,032,496 | ---- | M] (Sophos Plc) -- C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFService.exe PRC - [2012-07-12 09:55:29 | 000,097,520 | ---- | M] (Sophos Plc) -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe PRC - [2012-07-12 09:55:26 | 000,163,056 | ---- | M] (Sophos Plc) -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe PRC - [2012-07-12 09:55:23 | 000,806,912 | ---- | M] (Sophos Plc) -- C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe PRC - [2012-07-12 09:55:23 | 000,282,624 | ---- | M] (Sophos Plc) -- C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe PRC - [2012-07-05 17:41:46 | 003,048,136 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe PRC - [2012-06-11 15:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.EXE PRC - [2012-06-04 08:31:40 | 001,466,760 | ---- | M] (Garmin) -- C:\Program Files (x86)\Garmin\Lifetime Updater\GarminLifetime.exe PRC - [2011-11-15 21:06:00 | 000,345,664 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe PRC - [2011-11-15 21:06:00 | 000,132,672 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe PRC - [2011-08-22 14:44:00 | 000,024,576 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\V0610Mon.exe PRC - [2011-06-17 16:30:20 | 000,859,448 | ---- | M] (WebEx Communications Inc.) -- C:\Program Files (x86)\WebEx\Connect\apUpdate.exe PRC - [2011-04-25 01:24:16 | 000,726,976 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe PRC - [2011-04-25 01:22:40 | 000,305,088 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\concentr.exe PRC - [2011-04-08 07:51:42 | 000,503,955 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Creative Live! Cam\Live! Central 3\CTLVCentral3.exe PRC - [2011-03-14 16:27:28 | 000,236,384 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\ProgramData\DataCardService\DCSHelper.exe PRC - [2010-11-21 04:24:27 | 000,257,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wbem\WmiPrvSE.exe PRC - [2010-11-21 04:23:51 | 000,179,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\schtasks.exe PRC - [2010-09-30 12:08:32 | 000,439,536 | ---- | M] (Sophos Plc) -- C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe PRC - [2010-04-26 20:27:20 | 000,230,664 | ---- | M] (CA, Inc.) -- C:\Program Files (x86)\CA\DSM\bin\amswmagt.exe PRC - [2010-04-26 19:19:40 | 000,245,512 | ---- | M] (CA, Inc.) -- C:\Program Files (x86)\CA\DSM\bin\ccnfAgent.exe PRC - [2010-04-26 19:19:26 | 000,037,128 | ---- | M] (CA, Inc.) -- C:\Program Files (x86)\CA\DSM\bin\ccsmagtd.exe PRC - [2010-04-26 19:16:16 | 000,208,648 | ---- | M] (CA, Inc.) -- C:\Program Files (x86)\CA\DSM\bin\CAF.exe PRC - [2010-04-26 19:16:16 | 000,156,424 | ---- | M] (CA, Inc.) -- C:\Program Files (x86)\CA\DSM\bin\cfnotsrvd.exe PRC - [2010-04-26 19:16:16 | 000,033,544 | ---- | M] (CA, Inc.) -- C:\Program Files (x86)\CA\DSM\bin\cfFTPlugin.exe PRC - [2010-04-26 19:16:16 | 000,017,672 | ---- | M] (CA, Inc.) -- C:\Program Files (x86)\CA\DSM\bin\cfsmsmd.exe PRC - [2010-03-09 22:25:30 | 000,181,512 | ---- | M] (CA, Inc.) -- C:\Program Files (x86)\CA\SC\CAM\bin\cam.exe PRC - [2010-03-05 16:06:26 | 000,169,224 | ---- | M] (CA Inc.) -- C:\Program Files (x86)\CA\SC\Csam\SockAdapter\bin\CSAMPmux.exe PRC - [2009-10-02 10:19:16 | 000,380,988 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\Endpoint Encryption for PC\SbClientManager.exe PRC - [2009-08-19 14:20:52 | 000,069,632 | ---- | M] () -- C:\Program Files (x86)\SafeBoot Tray Manager\SbTrayManager.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2012-12-05 18:10:34 | 002,403,352 | ---- | M] () -- C:\ProgramData\Browser Manager\2.5.976.107\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.exe MOD - [2012-12-05 18:09:41 | 002,148,376 | ---- | M] () -- C:\ProgramData\Browser Manager\2.5.976.107\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.dll MOD - [2012-11-16 11:33:41 | 000,391,680 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\f00266885fe06957c91db45476aec15b\System.Xml.Linq.ni.dll MOD - [2012-11-16 11:33:08 | 001,801,216 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\0b801691747989b5fc13d01a4e77fc1f\System.Xaml.ni.dll MOD - [2012-11-16 07:24:28 | 018,000,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\ea6c5347136d9b78d6b5a9f00ea7f570\PresentationFramework.ni.dll MOD - [2012-11-16 07:24:16 | 000,595,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\99411977c0cadb9fb6498de49a115085\PresentationFramework.Aero.ni.dll MOD - [2012-11-16 07:24:15 | 011,451,904 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\9449584edbf7fe06cc994200930cd8c7\PresentationCore.ni.dll MOD - [2012-11-16 07:24:15 | 000,729,088 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Security\8d19674dedf8ffa51d54cb9e3448c011\System.Security.ni.dll MOD - [2012-11-16 07:24:11 | 013,197,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\f177e23504c88f09268b8096b60e3f50\System.Windows.Forms.ni.dll MOD - [2012-11-16 07:24:07 | 007,052,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\85de9d99776ec89231c32b278902c085\System.Core.ni.dll MOD - [2012-11-16 07:24:06 | 005,618,176 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\dd73fc37a7f30d5cdb9cb52f89dd5ce0\System.Xml.ni.dll MOD - [2012-11-16 07:24:03 | 003,856,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\23337265154a53b88147465d510f06f2\WindowsBase.ni.dll MOD - [2012-11-16 07:24:00 | 001,666,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\9e991f406612b87641919631724c2139\System.Drawing.ni.dll MOD - [2012-11-16 07:23:58 | 009,092,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\159cdf862129dcb9f9f7513b345163b0\System.ni.dll MOD - [2012-11-16 07:23:53 | 014,413,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\685f73e04393b5342bd1cebe701496ad\mscorlib.ni.dll MOD - [2012-09-20 11:25:51 | 000,202,240 | ---- | M] () -- C:\Users\108003109\AppData\Roaming\Akqus\kodou.exe MOD - [2012-08-03 15:07:06 | 000,276,392 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\phonon4.dll MOD - [2012-08-03 15:06:50 | 002,652,584 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\QtXmlPatterns4.dll MOD - [2012-08-03 15:06:50 | 000,363,944 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\QtXml4.dll MOD - [2012-08-03 15:06:48 | 011,166,120 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\QtWebKit4.dll MOD - [2012-08-03 15:06:46 | 000,205,736 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\QtSql4.dll MOD - [2012-08-03 15:06:44 | 001,346,472 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\QtScript4.dll MOD - [2012-08-03 15:06:44 | 000,720,296 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\QtOpenGL4.dll MOD - [2012-08-03 15:06:42 | 008,506,792 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\QtGui4.dll MOD - [2012-08-03 15:06:42 | 001,013,672 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\QtNetwork4.dll MOD - [2012-08-03 15:06:42 | 000,520,104 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\QtMultimediaKit1.dll MOD - [2012-08-03 15:06:40 | 002,480,552 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\QtDeclarative4.dll MOD - [2012-08-03 15:06:40 | 002,353,576 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\QtCore4.dll MOD - [2012-08-03 15:06:36 | 000,445,864 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\sqldrivers\qsqlite4.dll MOD - [2012-08-03 15:06:32 | 000,206,760 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\Imageformats\qjpeg4.dll MOD - [2012-08-03 15:06:32 | 000,035,240 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\Imageformats\qico4.dll MOD - [2012-08-03 15:06:30 | 000,032,680 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\Imageformats\qgif4.dll MOD - [2012-08-03 15:06:02 | 000,437,672 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\NService.dll MOD - [2012-08-03 15:05:24 | 000,604,072 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\CommonUpdateChecker.dll MOD - [2012-07-02 10:29:08 | 000,391,600 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\ssoengine.dll MOD - [2012-07-02 10:29:08 | 000,059,280 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\securestorage.dll MOD - [2012-07-02 10:28:20 | 000,110,080 | ---- | M] () -- C:\Program Files (x86)\Nokia\Nokia Suite\mediaservice\dsengine.dll MOD - [2011-03-17 05:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF MOD - [2010-10-20 20:45:26 | 008,801,120 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll MOD - [2009-08-19 14:20:52 | 000,069,632 | ---- | M] () -- C:\Program Files (x86)\SafeBoot Tray Manager\SbTrayManager.exe [color=#E56717]========== Services (SafeList) ==========[/color] SRV:[b]64bit:[/b] - [2011-08-10 06:20:08 | 000,072,296 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Windows\SysNative\drivers\o2flash.exe -- (O2FLASH) SRV:[b]64bit:[/b] - [2009-07-14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:[b]64bit:[/b] - [2009-07-14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012-12-05 18:10:34 | 002,403,352 | ---- | M] () [Auto | Running] -- C:\ProgramData\Browser Manager\2.5.976.107\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.exe -- (Browser Manager) SRV - [2012-11-16 07:29:52 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012-08-01 15:07:16 | 000,724,888 | ---- | M] (Nokia) [On_Demand | Running] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2012-07-20 00:33:08 | 000,670,832 | ---- | M] (Juniper Networks) [Auto | Running] -- C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe -- (dsNcService) SRV - [2012-07-12 10:31:51 | 000,232,472 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe -- (Sophos AutoUpdate Service) SRV - [2012-07-12 10:26:09 | 001,543,704 | ---- | M] (Sophos Plc) [Disabled | Stopped] -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe -- (swi_service) SRV - [2012-07-12 09:55:38 | 000,128,240 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFManager.exe -- (Sophos Client Firewall Manager) SRV - [2012-07-12 09:55:37 | 000,032,496 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFService.exe -- (Sophos Client Firewall) SRV - [2012-07-12 09:55:29 | 000,097,520 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe -- (SAVService) SRV - [2012-07-12 09:55:26 | 000,163,056 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe -- (SAVAdminService) SRV - [2012-07-12 09:55:23 | 000,806,912 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe -- (Sophos Message Router) SRV - [2012-07-12 09:55:23 | 000,282,624 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe -- (Sophos Agent) SRV - [2012-07-05 17:41:46 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service) SRV - [2012-07-03 12:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012-06-11 15:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.EXE -- (BBUpdate) SRV - [2012-06-11 15:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.EXE -- (BBSvc) SRV - [2011-11-15 21:06:00 | 000,132,672 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe -- (McAfeeFramework) SRV - [2011-06-17 16:30:20 | 000,859,448 | ---- | M] (WebEx Communications Inc.) [Auto | Running] -- C:\Program Files (x86)\WebEx\Connect\apUpdate.exe -- (Cisco WebEx Connect Upgrade Service) SRV - [2011-03-14 16:27:34 | 000,346,976 | ---- | M] () [Auto | Running] -- C:\ProgramData\DataCardService\HWDeviceService64.exe -- (HWDeviceService64.exe) SRV - [2011-01-04 15:22:24 | 012,994,376 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\MANDIANT\MANDIANT Intelligent Response Agent\MAVservice.exe -- (IAScan) SRV - [2010-04-26 19:16:16 | 000,208,648 | ---- | M] (CA, Inc.) [Auto | Running] -- C:\Program Files (x86)\CA\DSM\bin\caf.exe -- (caf) SRV - [2010-03-18 18:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010-03-09 22:25:30 | 000,181,512 | ---- | M] (CA, Inc.) [Auto | Running] -- C:\Program Files (x86)\CA\SC\CAM\bin\cam.exe -- (CA-MessageQueuing) SRV - [2010-03-05 16:06:26 | 000,169,224 | ---- | M] (CA Inc.) [Auto | Running] -- C:\Program Files (x86)\CA\SC\Csam\SockAdapter\bin\CSAMPmux.exe -- (CA-SAM-Pmux) SRV - [2009-10-02 10:19:16 | 000,380,988 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files (x86)\McAfee\Endpoint Encryption for PC\SbClientManager.exe -- (SafeBootClientManager) SRV - [2009-06-10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV:[b]64bit:[/b] - [2012-07-12 09:55:40 | 000,099,832 | ---- | M] (Sophos Plc) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\scfdriver.sys -- (scfdriver) DRV:[b]64bit:[/b] - [2012-07-12 09:55:40 | 000,049,656 | ---- | M] (Sophos Plc) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\scflwf.sys -- (scflwf) DRV:[b]64bit:[/b] - [2012-07-12 09:55:35 | 000,025,592 | ---- | M] (Sophos Plc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdcfilter.sys -- (sdcfilter) DRV:[b]64bit:[/b] - [2012-07-12 09:55:32 | 000,142,328 | ---- | M] (Sophos Plc) [File_System | System | Running] -- C:\Windows\SysNative\drivers\savonaccess.sys -- (SAVOnAccess) DRV:[b]64bit:[/b] - [2012-07-12 09:55:25 | 000,025,608 | ---- | M] (Sophos Plc) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\SophosBootDriver.sys -- (SophosBootDriver) DRV:[b]64bit:[/b] - [2012-06-27 14:18:52 | 000,026,112 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd) DRV:[b]64bit:[/b] - [2012-04-20 11:00:36 | 000,415,744 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbwwan.sys -- (ewusbmbb) DRV:[b]64bit:[/b] - [2012-04-20 11:00:36 | 000,222,464 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard) DRV:[b]64bit:[/b] - [2012-04-20 11:00:36 | 000,117,248 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev) DRV:[b]64bit:[/b] - [2012-04-20 11:00:36 | 000,086,016 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator) DRV:[b]64bit:[/b] - [2012-04-20 11:00:36 | 000,013,952 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_usbenumfilter.sys -- (ew_usbenumfilter) DRV:[b]64bit:[/b] - [2012-04-18 14:05:16 | 000,019,304 | ---- | M] (GARMIN Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\grmnusb.sys -- (grmnusb) DRV:[b]64bit:[/b] - [2012-03-01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:[b]64bit:[/b] - [2012-01-13 12:06:14 | 000,032,768 | ---- | M] (Juniper Networks) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dsNcAdpt.sys -- (dsNcAdpt) DRV:[b]64bit:[/b] - [2012-01-09 16:28:20 | 000,171,008 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdnsux64.sys -- (nmwcdnsux64) DRV:[b]64bit:[/b] - [2012-01-09 16:28:20 | 000,019,968 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbx64.sys -- (nmwcd) DRV:[b]64bit:[/b] - [2012-01-09 16:28:20 | 000,012,800 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdnsucx64.sys -- (nmwcdnsucx64) DRV:[b]64bit:[/b] - [2012-01-09 16:28:20 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt) DRV:[b]64bit:[/b] - [2012-01-09 16:28:20 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys -- (upperdev) DRV:[b]64bit:[/b] - [2012-01-09 16:28:18 | 000,027,136 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbox64.sys -- (nmwcdc) DRV:[b]64bit:[/b] - [2011-09-02 00:01:02 | 000,323,136 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\V0610Vid.sys -- (V0610Vid) DRV:[b]64bit:[/b] - [2011-08-10 06:21:24 | 004,719,680 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX) DRV:[b]64bit:[/b] - [2011-08-10 06:20:36 | 012,230,912 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:[b]64bit:[/b] - [2011-08-10 06:20:28 | 000,045,672 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cvusbdrv.sys -- (cvusbdrv) DRV:[b]64bit:[/b] - [2011-08-10 06:20:08 | 000,083,560 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\o2sdjw7x64.sys -- (O2SDJRDR) DRV:[b]64bit:[/b] - [2011-08-10 06:20:08 | 000,074,984 | ---- | M] (O2Micro ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\O2MDRw7x64.sys -- (O2MDRRDR) DRV:[b]64bit:[/b] - [2011-08-10 06:20:08 | 000,072,808 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\o2mdfw7x64.sys -- (O2MDFRDR) DRV:[b]64bit:[/b] - [2011-08-10 06:20:04 | 000,027,760 | ---- | M] (ST Microelectronics) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\accelern.sys -- (Acceler) DRV:[b]64bit:[/b] - [2011-07-20 15:37:56 | 000,342,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress) DRV:[b]64bit:[/b] - [2011-07-16 05:31:22 | 000,022,128 | ---- | M] (ST Microelectronics) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stdcfltn.sys -- (stdcfltn) DRV:[b]64bit:[/b] - [2011-04-25 00:49:16 | 000,087,600 | ---- | M] (Citrix Systems, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ctxusbm.sys -- (ctxusbm) DRV:[b]64bit:[/b] - [2011-03-24 13:29:52 | 000,179,648 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt) DRV:[b]64bit:[/b] - [2011-02-11 22:23:34 | 000,035,344 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\npf.sys -- (npf) DRV:[b]64bit:[/b] - [2011-01-06 01:47:12 | 000,343,160 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService) DRV:[b]64bit:[/b] - [2010-11-21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:[b]64bit:[/b] - [2010-11-21 04:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc) DRV:[b]64bit:[/b] - [2010-11-21 04:23:48 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser) DRV:[b]64bit:[/b] - [2010-11-21 04:23:47 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:[b]64bit:[/b] - [2010-11-21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:[b]64bit:[/b] - [2010-11-21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:[b]64bit:[/b] - [2010-11-21 04:23:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:[b]64bit:[/b] - [2010-10-19 15:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) DRV:[b]64bit:[/b] - [2009-10-02 10:18:32 | 000,013,440 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\sbregflt.sys -- (SbRegFlt) DRV:[b]64bit:[/b] - [2009-10-02 10:18:28 | 000,013,440 | ---- | M] (McAfee, Inc.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\sbfslock.sys -- (SbFsLock) DRV:[b]64bit:[/b] - [2009-10-02 10:18:25 | 000,055,936 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\rsvlock.sys -- (RsvLock) DRV:[b]64bit:[/b] - [2009-10-02 10:18:19 | 000,021,120 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\sbflop.sys -- (SbFlop) DRV:[b]64bit:[/b] - [2009-10-02 10:18:08 | 000,054,400 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\safeboot.sys -- (SafeBoot) DRV:[b]64bit:[/b] - [2009-07-14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:[b]64bit:[/b] - [2009-07-14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:[b]64bit:[/b] - [2009-07-14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:[b]64bit:[/b] - [2009-06-10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:[b]64bit:[/b] - [2009-06-10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:[b]64bit:[/b] - [2009-06-10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:[b]64bit:[/b] - [2009-06-10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:[b]64bit:[/b] - [2008-08-13 18:51:44 | 000,060,128 | ---- | M] (SafeBoot N.V.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sbalg.sys -- (SBAlg) DRV - [2012-07-12 22:29:48 | 000,024,656 | ---- | M] () [Kernel | On_Demand | Running] -- C:\ProgramData\MANDIANT\MANDIANT Intelligent Response Agent\mktools.sys -- (Mandiant_Tools) DRV - [2009-10-02 10:18:32 | 000,013,440 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysWow64\drivers\SbRegFlt.sys -- (SbRegFlt) DRV - [2009-10-02 10:18:28 | 000,013,440 | ---- | M] (McAfee, Inc.) [File_System | Boot | Running] -- C:\Windows\SysWow64\drivers\SbFsLock.sys -- (SbFsLock) DRV - [2009-10-02 10:18:25 | 000,055,936 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysWow64\drivers\RsvLock.sys -- (RsvLock) DRV - [2009-10-02 10:18:19 | 000,021,120 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysWow64\drivers\SbFlop.sys -- (SbFlop) DRV - [2009-10-02 10:18:08 | 000,054,400 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysWow64\drivers\SafeBoot.sys -- (SafeBoot) DRV - [2009-07-14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2008-08-13 18:51:44 | 000,060,128 | ---- | M] (SafeBoot N.V.) [Kernel | Boot | Running] -- C:\Windows\SysWow64\drivers\SbAlg.sys -- (SBAlg) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_medium=fft&from=fft&uid=WD-WX71C2256777_WDCWD3200BEKT-75PVMT1&ts=1354394589 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_medium=fft&from=fft&uid=WD-WX71C2256777_WDCWD3200BEKT-75PVMT1&ts=1354394589 IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3214568 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2134593322-311254797-883519231-132049\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = http://supportcentral.ge.com/products/sup_products.asp?prod_id=212526 IE - HKU\S-1-5-21-2134593322-311254797-883519231-132049\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_medium=fft&from=fft&uid=WD-WX71C2256777_WDCWD3200BEKT-75PVMT1&ts=1354394589 IE - HKU\S-1-5-21-2134593322-311254797-883519231-132049\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://aviation.home.ge.com/portal/site/insidege IE - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..\URLSearchHook: {adca5064-9e30-43fe-9856-58b07a3149fe} - No CLSID value found IE - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=117023&tt=261112_set2_4812_3&babsrc=SP_ss&mntrId=d4847c6b00000000000000ff10e04004 IE - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://search.v9.com/web/?q={searchTerms} IE - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..\SearchScopes\{6AA605FE-7BE2-41E7-9F5E-5358C1B08061}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=FF&o=14594&src=crm&q={searchTerms}&locale=en_NL&apn_ptnrs=^FV&apn_dtid=^YYYYYY^YY^NL&apn_uid=af49a12f-0ebb-4249-8a11-2ca1774f2285&apn_sauid=A7761406-A01F-4997-B212-54522CE70BAE IE - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..\SearchScopes\{718FD974-56B7-4315-B193-DBF59362A97C}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?} IE - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3214568 IE - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..\SearchScopes\{E779E137-A8C4-4FD7-B1E7-51DA8B512FA4}: "URL" = http://www.bing.com/search?FORM=NP24DF&PC=NP24&q={searchTerms}&src=IE-SearchBox IE - HKU\S-1-5-21-2134593322-311254797-883519231-132049\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2134593322-311254797-883519231-132049\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = http://ps.setpac.ge.com/pac.pac [color=#E56717]========== FireFox ==========[/color] FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_110.dll File not found FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre1.6.0_22\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nokia.com/EnablerPlugin: C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( ) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{58bd07eb-0ee0-4df0-8121-dc9b693373df}: C:\ProgramData\Browser Manager\2.5.976.107\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension [2012-12-07 10:58:03 | 000,000,000 | ---D | M] [2012-12-01 21:44:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions O1 HOSTS File: ([2012-11-03 19:56:54 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:[b]64bit:[/b] - BHO: (Sophos Web Content Scanner) - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SophosBHOX64.dll (Sophos Plc) O2 - BHO: (Sophos Web Content Scanner) - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SophosBHO.dll (Sophos Plc) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.6.0_22\bin\jp2ssv.dll (Sun Microsystems, Inc.) O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..\Toolbar\WebBrowser: (no name) - {ADCA5064-9E30-43FE-9856-58B07A3149FE} - No CLSID value found. O3 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4:[b]64bit:[/b] - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.) O4:[b]64bit:[/b] - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.) O4 - HKLM..\Run: [FastAccess Web Alert] C:\Program Files (x86)\Creative\Creative Live! Cam\Live! Central 3\FAInstaller\FAtry.exe (Microsoft) O4 - HKLM..\Run: [Garmin Lifetime Updater] C:\Program Files (x86)\Garmin\Lifetime Updater\GarminLifetime.exe (Garmin) O4 - HKLM..\Run: [Live! Central 3] C:\Program Files (x86)\Creative\Creative Live! Cam\Live! Central 3\CTLVCentral3.exe (Creative Technology Ltd) O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Program Files (x86)\McAfee\Common Framework\udaterui.exe (McAfee, Inc.) O4 - HKLM..\Run: [Plus Internet] C:\Program Files (x86)\Plus Internet\PlusInternetChecker.exe () O4 - HKLM..\Run: [SafeBootTokenWatcher] C:\Program Files (x86)\McAfee\Endpoint Encryption for PC\SbTokWatch.exe (McAfee, Inc.) O4 - HKLM..\Run: [SafeBootTrayManager] C:\Program Files (x86)\SafeBoot Tray Manager\SbTrayManager.exe () O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe (Sophos Plc) O4 - HKLM..\Run: [V0610Mon.exe] C:\Windows\V0610Mon.exe (Creative Technology Ltd.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-2134593322-311254797-883519231-132049..\Run: [] File not found O4 - HKU\S-1-5-21-2134593322-311254797-883519231-132049..\Run: [NokiaSuite.exe] C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe (Nokia) O4 - HKU\S-1-5-21-2134593322-311254797-883519231-132049..\Run: [Pesueh] C:\Users\108003109\AppData\Roaming\Akqus\kodou.exe () O4 - HKU\S-1-5-21-2134593322-311254797-883519231-132049..\Run: [SDP] C:\Program Files (x86)\FilesFrog Update Checker\update_checker.exe (Somoto) O4 - HKU\S-1-5-21-2134593322-311254797-883519231-132049..\Run: [VoipDiscount] C:\Program Files (x86)\VoipDiscount.com\VoipDiscount\voipdiscount.exe (VoipDiscount) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoPublishingWizard = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWebServices = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Main present O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispScrSavPage = 0 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Main present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispScrSavPage = 0 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Main present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispScrSavPage = 0 O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Main present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispScrSavPage = 0 O7 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\Software\Policies\Microsoft\Internet Explorer\Main present O7 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present O7 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 181 O7 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuMyGames = 1 O7 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1 O7 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 1 O7 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoPublishingWizard = 1 O7 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWebServices = 1 O7 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O7 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogonScripts = 1 O7 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispScrSavPage = 0 O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O13[b]64bit:[/b] - gopher Prefix: missing O13 - gopher Prefix: missing O15:[b]64bit:[/b] - ..Trusted Domains: vetco.com ([]* in Local intranet) O15:[b]64bit:[/b] - ..Trusted Domains: vetcogray.com ([]* in Local intranet) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: aravo.com ([gegsl] http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: aravo.com ([gegsltraining] http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: bdasites.com ([www] http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: bdasites.com ([www] https in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: brassring.com ([]* in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: dell.com ([premier] http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: dell.com ([premier] https in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: directory.concursolutions.com ([]http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: ecomagination.com ([]http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: equanet.co.uk ([www] http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: equanet.co.uk ([www] https in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: fastenal.com ([fastconnect] http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: fastenal.com ([fastconnect] https in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: fishersci.com ([www] http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: fishersci.com ([www] https in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: ge.com ([]* in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: gebrandcentral.com ([]http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: gecareers.com ([]* in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: gecompany.com ([]* in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: gedigitalmedia.com ([]http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: gemediacentral.com ([]http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: genewscenter.com ([]http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: gensurvey.com ([]* in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: geolympiccentral.com ([]http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: geready.com ([]http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: ge-registrar.com ([]http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: gereports.com ([]http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: gexprosupply.com ([www] http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: gexprosupply.com ([www] https in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: globalempservices.com ([]http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: grainger.com ([www] http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: grainger.com ([www] https in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: grandandtoy.com ([www] http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: grandandtoy.com ([www] https in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: healthymagination.com ([]http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: insight.com ([www] http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: insight.com ([www] https in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: logmeinrescue-enterprise.com ([Secure] http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: logmeinrescue-enterprise.com ([Secure] https in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: merrillshop.com ([www] http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: merrillshop.com ([www] https in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: misco.co.uk ([www] http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: misco.co.uk ([www] https in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: mylearning-ge.plateau.com ([]http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: netserviceeurope.com ([]http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: np.com ([]* in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: pcconnection.com ([www] http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: pcconnection.com ([www] https in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: service-now.com ([]* in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: staplesadvantage.com ([ac-order] http in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: staplesadvantage.com ([ac-order] https in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: vetco.com ([]* in Local intranet) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: vetcogray.com ([]* in Local intranet) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: webex.com ([]* in Trusted sites) O15 - HKU\S-1-5-21-2134593322-311254797-883519231-132049\..Trusted Domains: webexconnect.com ([]* in Trusted sites) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.) O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://amsterdam.connectge.com/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class) O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/4.0.3.0/GarminAxControl_32.CAB (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 3.27.112.68 3.27.48.233 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = genpitfi01.og.ge.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{202EAFB8-EC8F-4B23-B55F-F4D598D84E3E}: NameServer = 212.2.96.53 212.2.96.54 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BEBAF681-4066-41B3-80EC-EC1966A4C0A2}: DhcpNameServer = 3.27.112.68 3.27.48.233 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E698E95B-1A8D-4B29-813A-9BEF27488B61}: DhcpNameServer = 3.27.69.69 151.95.52.54 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FCFB873C-CA03-4706-BF4B-F05FE7DFCD32}: NameServer = 212.2.96.53 212.2.96.54 O18:[b]64bit:[/b] - Protocol\Handler\ms-help - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\skype4com - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:[b]64bit:[/b] - Protocol\Filter\application/x-ica - No CLSID value found O18:[b]64bit:[/b] - Protocol\Filter\application/x-ica; charset=euc-jp - No CLSID value found O18:[b]64bit:[/b] - Protocol\Filter\application/x-ica; charset=ISO-8859-1 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Filter\application/x-ica; charset=MS936 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Filter\application/x-ica; charset=MS949 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Filter\application/x-ica; charset=MS950 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Filter\application/x-ica; charset=UTF8 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Filter\application/x-ica; charset=UTF-8 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Filter\application/x-ica;charset=euc-jp - No CLSID value found O18:[b]64bit:[/b] - Protocol\Filter\application/x-ica;charset=ISO-8859-1 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Filter\application/x-ica;charset=MS936 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Filter\application/x-ica;charset=MS949 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Filter\application/x-ica;charset=MS950 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Filter\application/x-ica;charset=UTF8 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Filter\application/x-ica;charset=UTF-8 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Filter\ica - No CLSID value found O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:[b]64bit:[/b] - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{46ff2e1f-e238-11e1-8461-001e101f8924}\Shell - "" = AutoRun O33 - MountPoints2\{46ff2e1f-e238-11e1-8461-001e101f8924}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{5cc94e96-2362-11e2-b935-001e101f57d0}\Shell - "" = AutoRun O33 - MountPoints2\{5cc94e96-2362-11e2-b935-001e101f57d0}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{5cc94ea2-2362-11e2-b935-001e101f57d0}\Shell - "" = AutoRun O33 - MountPoints2\{5cc94ea2-2362-11e2-b935-001e101f57d0}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{607988f4-e1ea-11e1-989e-e006e60e4b8b}\Shell - "" = AutoRun O33 - MountPoints2\{607988f4-e1ea-11e1-989e-e006e60e4b8b}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{6079890b-e1ea-11e1-989e-e006e60e4b8b}\Shell - "" = AutoRun O33 - MountPoints2\{6079890b-e1ea-11e1-989e-e006e60e4b8b}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{60798918-e1ea-11e1-989e-e006e60e4b8b}\Shell - "" = AutoRun O33 - MountPoints2\{60798918-e1ea-11e1-989e-e006e60e4b8b}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{60798930-e1ea-11e1-989e-e006e60e4b8b}\Shell - "" = AutoRun O33 - MountPoints2\{60798930-e1ea-11e1-989e-e006e60e4b8b}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{80e50cfc-e130-11e1-998f-e006e60e4b8b}\Shell - "" = AutoRun O33 - MountPoints2\{80e50cfc-e130-11e1-998f-e006e60e4b8b}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{880b1b6a-e12e-11e1-929c-e006e60e4b8b}\Shell - "" = AutoRun O33 - MountPoints2\{880b1b6a-e12e-11e1-929c-e006e60e4b8b}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{880b1b83-e12e-11e1-929c-e006e60e4b8b}\Shell - "" = AutoRun O33 - MountPoints2\{880b1b83-e12e-11e1-929c-e006e60e4b8b}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{987ca10c-14a5-11e2-881b-e006e60e4b8b}\Shell - "" = AutoRun O33 - MountPoints2\{987ca10c-14a5-11e2-881b-e006e60e4b8b}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{987ca110-14a5-11e2-881b-e006e60e4b8b}\Shell - "" = AutoRun O33 - MountPoints2\{987ca110-14a5-11e2-881b-e006e60e4b8b}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{991d6438-cd0b-11e1-beb1-d4bed91bc158}\Shell - "" = AutoRun O33 - MountPoints2\{991d6438-cd0b-11e1-beb1-d4bed91bc158}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{ad5c5feb-e1e8-11e1-a77d-e006e60e4b8b}\Shell - "" = AutoRun O33 - MountPoints2\{ad5c5feb-e1e8-11e1-a77d-e006e60e4b8b}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{b65a3cf3-cdb4-11e1-9811-e006e60e4b8b}\Shell - "" = AutoRun O33 - MountPoints2\{b65a3cf3-cdb4-11e1-9811-e006e60e4b8b}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{b65a3dbc-cdb4-11e1-9811-001e101f4da1}\Shell - "" = AutoRun O33 - MountPoints2\{b65a3dbc-cdb4-11e1-9811-001e101f4da1}\Shell\AutoRun\command - "" = G:\HPLauncher.exe O33 - MountPoints2\E\Shell - "" = AutoRun O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %* O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2012-12-11 06:48:56 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\108003109\Desktop\OTL.exe [2012-12-07 19:47:17 | 000,000,000 | ---D | C] -- C:\Users\108003109\AppData\Roaming\Wadihy [2012-12-07 19:47:17 | 000,000,000 | ---D | C] -- C:\Users\108003109\AppData\Roaming\Uwly [2012-12-07 19:47:17 | 000,000,000 | ---D | C] -- C:\Users\108003109\AppData\Roaming\Akqus [2012-12-07 19:32:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sothink Web Video Downloader Stand-alone [2012-12-02 17:12:10 | 000,000,000 | ---D | C] -- C:\Users\108003109\Documents\Downloads [2012-12-01 23:58:23 | 000,000,000 | ---D | C] -- C:\Users\108003109\AppData\Roaming\dvdcss [2012-12-01 21:47:56 | 000,000,000 | ---D | C] -- C:\Users\108003109\Documents\FormatFactory [2012-12-01 21:46:04 | 000,000,000 | -HSD | C] -- C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F} [2012-12-01 21:44:35 | 000,000,000 | ---D | C] -- C:\Users\108003109\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FilesFrog Update Checker [2012-12-01 21:44:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FilesFrog Update Checker [2012-12-01 21:44:29 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\searchplugins [2012-12-01 21:44:29 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Extensions [2012-12-01 21:44:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Browser Manager [2012-12-01 21:44:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2012-12-01 21:43:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\v9Soft [2012-12-01 21:43:09 | 000,000,000 | ---D | C] -- C:\Users\108003109\Documents\FFOutput [2012-12-01 21:42:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FreeTime [2012-12-01 21:39:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip [2012-12-01 21:39:26 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip [2012-11-25 17:18:09 | 000,000,000 | ---D | C] -- C:\Users\108003109\Documents\Dziwne rzeczy [2012-11-16 07:30:30 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Adobe [2012-11-16 07:29:44 | 000,697,272 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012-11-16 07:29:44 | 000,073,656 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012-11-16 07:16:38 | 000,095,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\synceng.dll [2012-11-16 07:16:38 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\synceng.dll [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2012-12-11 06:49:54 | 000,019,120 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012-12-11 06:49:54 | 000,019,120 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012-12-11 06:42:54 | 000,001,050 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012-12-11 06:42:53 | 000,000,446 | -H-- | M] () -- C:\Windows\tasks\ITAM Agent Check.job [2012-12-11 06:42:43 | 000,000,142 | ---- | M] () -- C:\Windows\ODBC.INI [2012-12-11 06:42:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012-12-11 06:38:01 | 000,001,054 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012-12-10 16:32:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012-12-10 14:07:29 | 000,778,834 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012-12-10 14:07:29 | 000,652,148 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012-12-10 14:07:29 | 000,121,080 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012-12-10 14:02:20 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\108003109\Desktop\OTL.exe [2012-12-10 13:32:21 | 000,000,424 | -H-- | M] () -- C:\Windows\tasks\ITAM Agent Check Daily.job [2012-12-08 04:20:41 | 095,023,320 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad [2012-12-07 23:17:18 | 000,001,063 | ---- | M] () -- C:\Users\108003109\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk [2012-12-07 11:19:47 | 000,000,198 | ---- | M] () -- C:\Users\108003109\client.cfg [2012-12-06 12:42:13 | 000,000,060 | ---- | M] () -- C:\Windows\wpd99.drv [2012-12-03 12:00:00 | 000,000,542 | ---- | M] () -- C:\Windows\tasks\Workstation.job [2012-11-24 19:45:46 | 000,001,514 | ---- | M] () -- C:\Users\108003109\.recently-used.xbel [2012-11-22 14:17:27 | 001,531,049 | ---- | M] () -- C:\Users\108003109\Desktop\SOM6754639.pdf [2012-11-17 21:07:33 | 000,089,557 | ---- | M] () -- C:\Users\108003109\Documents\Cornelia.jpg [2012-11-17 13:44:53 | 000,800,995 | ---- | M] () -- C:\Users\108003109\Documents\puzzle.rar [2012-11-16 07:56:30 | 000,437,952 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012-11-16 07:29:52 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012-11-16 07:29:52 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [color=#E56717]========== Files Created - No Company Name ==========[/color] [2012-12-07 23:17:18 | 000,001,063 | ---- | C] () -- C:\Users\108003109\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk [2012-12-07 23:17:16 | 095,023,320 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad [2012-11-24 19:45:46 | 000,001,514 | ---- | C] () -- C:\Users\108003109\.recently-used.xbel [2012-11-22 14:17:27 | 001,531,049 | ---- | C] () -- C:\Users\108003109\Desktop\SOM6754639.pdf [2012-11-17 21:08:05 | 000,089,557 | ---- | C] () -- C:\Users\108003109\Documents\Cornelia.jpg [2012-11-17 13:44:52 | 000,800,995 | ---- | C] () -- C:\Users\108003109\Documents\puzzle.rar [2012-11-16 07:29:45 | 000,000,830 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012-11-03 20:56:31 | 000,005,091 | ---- | C] () -- C:\ProgramData\naosxsca.elx [2012-09-17 14:53:56 | 000,048,586 | ---- | C] () -- C:\ProgramData\xpif-v02030a.dtd [2012-09-02 10:15:15 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2012-07-29 15:35:00 | 000,002,027 | ---- | C] () -- C:\Users\108003109\PhotoStudio 5.5.lnk [2012-07-29 15:31:02 | 000,000,000 | ---- | C] () -- C:\Windows\OpPrintServer.INI [2012-07-29 15:30:28 | 000,002,645 | ---- | C] () -- C:\Users\108003109\ZoomBrowser EX.lnk [2012-07-29 15:29:27 | 000,002,162 | ---- | C] () -- C:\Users\108003109\Digital Photo Professional.lnk [2012-07-19 12:54:24 | 000,000,198 | ---- | C] () -- C:\Users\108003109\client.cfg [2012-07-18 12:51:13 | 000,000,060 | ---- | C] () -- C:\Windows\wpd99.drv [2012-07-18 12:51:12 | 000,047,616 | ---- | C] () -- C:\Windows\SysWow64\pdf995mon64.dll [2012-07-16 07:36:46 | 000,016,384 | ---- | C] ( ) -- C:\Windows\SysWow64\iniman.exe [2012-07-16 07:36:46 | 000,000,600 | ---- | C] () -- C:\Users\108003109\AppData\Local\PUTTY.RND [2012-07-15 06:45:52 | 000,001,152 | ---- | C] () -- C:\Users\108003109\VoipDiscount.lnk [2012-07-15 06:39:03 | 000,002,517 | ---- | C] () -- C:\Users\108003109\Skype.lnk [2012-07-15 06:22:17 | 000,001,980 | ---- | C] () -- C:\Users\108003109\Garmin Lifetime Updater.lnk [2012-07-13 08:42:56 | 000,023,820 | RHS- | C] () -- C:\Users\108003109\ntuser.pol [2012-07-12 14:59:45 | 000,000,000 | ---- | C] () -- C:\Windows\SOCL7006-06-US.EXE [2012-07-12 14:55:49 | 000,168,412 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2012-07-12 14:55:12 | 000,764,378 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012-07-12 10:00:13 | 000,000,142 | ---- | C] () -- C:\Windows\ODBC.INI [2012-02-29 11:34:06 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin [2012-02-29 11:34:03 | 000,218,304 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin [2012-02-29 11:33:58 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll [2012-02-29 11:33:55 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin [2012-02-29 11:33:50 | 013,906,944 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll [2011-02-11 22:23:34 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll [color=#E56717]========== ZeroAccess Check ==========[/color] [2009-07-14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012-06-09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012-06-09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009-07-14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010-11-21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009-07-14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] [color=#E56717]========== LOP Check ==========[/color] [2012-07-13 09:05:20 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\09D849B6-32D3-4a40-85EE-6B84BA29E35B [2012-12-07 19:47:17 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\Akqus [2012-07-21 10:11:09 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\Babylon [2012-07-29 15:37:49 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\Canon [2012-07-16 06:17:23 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\Connect [2012-07-15 05:57:26 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\Garmin [2012-11-24 19:45:46 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\gtk-2.0 [2012-07-16 12:14:16 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\ICAClient [2012-11-03 19:37:27 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\Juniper Networks [2012-08-18 20:44:52 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\Nokia [2012-12-01 21:44:51 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\OpenCandy [2012-08-18 20:39:37 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\PC Suite [2012-07-18 12:53:23 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\pdf995 [2012-10-31 15:06:34 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\Plus Internet [2012-12-08 04:10:00 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\SourceTec [2012-07-18 09:34:16 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\teamcenter [2012-12-01 21:46:13 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\TuneUp Software [2012-12-07 19:48:02 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\Uwly [2012-11-04 12:09:46 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\VoipDiscount [2012-12-07 19:47:17 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\Wadihy [2012-11-30 09:07:07 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\WebEx [2012-12-07 10:05:11 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\WebEx Connect [2012-09-21 09:59:46 | 000,000,000 | ---D | M] -- C:\Users\108003109\AppData\Roaming\Xerox [2012-12-10 13:32:28 | 000,000,000 | ---D | M] -- C:\Users\501805673\AppData\Roaming\09D849B6-32D3-4a40-85EE-6B84BA29E35B [2012-12-10 13:33:46 | 000,000,000 | ---D | M] -- C:\Users\501805673\AppData\Roaming\Garmin [2012-12-10 13:33:42 | 000,000,000 | ---D | M] -- C:\Users\501805673\AppData\Roaming\ICAClient [2012-07-12 14:23:32 | 000,000,000 | ---D | M] -- C:\Users\501956509\AppData\Roaming\CA [2012-07-12 09:03:44 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\CA [2012-07-12 09:20:32 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\WebEx Connect [color=#E56717]========== Purity Check ==========[/color] < End of report >