OTL logfile created on: 2014-03-08 02:19:42 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\marlena\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16635) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 3,98 Gb Total Physical Memory | 2,35 Gb Available Physical Memory | 59,20% Memory free 7,95 Gb Paging File | 5,99 Gb Available in Paging File | 75,39% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 186,30 Gb Total Space | 125,24 Gb Free Space | 67,22% Space Free | Partition Type: NTFS Drive D: | 254,46 Gb Total Space | 185,88 Gb Free Space | 73,05% Space Free | Partition Type: NTFS Drive F: | 35,83 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: MARLENA-KOMP | User Name: marlena | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2014-03-08 02:12:07 | 009,547,240 | ---- | M] (TeamSpeak Systems GmbH) -- C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe PRC - [2014-03-08 01:55:54 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\marlena\Desktop\OTL.exe PRC - [2014-02-26 20:38:32 | 000,425,104 | ---- | M] (Taiwan Shui Mu Chih Ching Technology Limited.) -- C:\Program Files (x86)\WinZipper\winzipersvc.exe PRC - [2014-02-26 09:30:22 | 000,501,904 | ---- | M] (Cherished Technololgy LIMITED) -- C:\ProgramData\WPM\wprotectmanager.exe PRC - [2014-02-26 07:44:20 | 000,508,016 | ---- | M] (Cherished Technololgy LIMITED) -- C:\ProgramData\IePluginService\PluginService.exe PRC - [2014-02-19 12:13:32 | 000,807,800 | ---- | M] (Spigot, Inc.) -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe PRC - [2014-02-14 13:54:20 | 000,275,568 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2014-01-20 17:12:02 | 000,514,048 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\Mobile Partner.exe PRC - [2014-01-20 17:12:02 | 000,218,624 | ---- | M] () -- C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe PRC - [2013-08-29 01:23:38 | 001,861,968 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe PRC - [2013-06-29 22:02:26 | 001,855,880 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe PRC - [2013-06-26 18:21:50 | 000,207,528 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe PRC - [2013-06-26 18:21:46 | 000,523,944 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe PRC - [2013-02-03 23:15:21 | 000,151,552 | ---- | M] () -- C:\Windows\KMService.exe PRC - [2013-02-03 23:15:21 | 000,008,192 | ---- | M] () -- C:\Windows\SysWOW64\srvany.exe PRC - [2012-12-14 10:17:04 | 004,103,672 | ---- | M] (TeamViewer GmbH) -- c:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Desktop.exe PRC - [2012-12-14 10:17:04 | 003,467,768 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe PRC - [2012-12-14 10:17:03 | 009,876,472 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe PRC - [2012-12-14 10:08:24 | 000,190,968 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe PRC - [2012-06-11 20:38:39 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2012-02-03 15:24:50 | 000,277,120 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe PRC - [2012-02-03 14:40:42 | 000,277,120 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe PRC - [2011-12-22 18:58:42 | 000,318,080 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe PRC - [2011-12-20 20:12:54 | 000,061,440 | RHS- | M] () -- C:\Windows\SysWOW64\secpro.exe PRC - [2011-11-30 10:40:44 | 003,058,304 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe PRC - [2011-11-21 13:22:08 | 000,080,512 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe PRC - [2011-11-21 13:19:50 | 000,096,896 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe PRC - [2011-08-02 23:31:22 | 000,146,592 | ---- | M] (Atheros) -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe PRC - [2010-12-21 03:24:38 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2010-12-21 03:24:36 | 000,325,656 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe PRC - [2010-11-16 14:37:30 | 000,230,912 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\ProgramData\DatacardService\DCSHelper.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2014-03-08 02:12:07 | 000,237,032 | ---- | M] () -- C:\Program Files (x86)\TeamSpeak 3 Client\soundbackends\windowsaudiosession_win32.dll MOD - [2014-03-08 02:12:06 | 000,555,496 | ---- | M] () -- C:\Program Files (x86)\TeamSpeak 3 Client\plugins\teamspeak_control_plugin.dll MOD - [2014-03-08 02:12:06 | 000,431,080 | ---- | M] () -- C:\Program Files (x86)\TeamSpeak 3 Client\plugins\clientquery_plugin.dll MOD - [2014-03-08 02:12:06 | 000,230,376 | ---- | M] () -- C:\Program Files (x86)\TeamSpeak 3 Client\soundbackends\directsound_win32.dll MOD - [2014-02-14 13:54:20 | 003,578,992 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll MOD - [2014-01-20 17:12:03 | 009,515,520 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\QtGui4.dll MOD - [2014-01-20 17:12:03 | 002,415,104 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\QtCore4.dll MOD - [2014-01-20 17:12:03 | 001,148,416 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\QtNetwork4.dll MOD - [2014-01-20 17:12:03 | 001,101,824 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\NDISAPI.dll MOD - [2014-01-20 17:12:03 | 000,777,728 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\SMSUIPlugin.dll MOD - [2014-01-20 17:12:03 | 000,670,720 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\SmsAppPlugin.dll MOD - [2014-01-20 17:12:03 | 000,545,280 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\PluginContainer.dll MOD - [2014-01-20 17:12:03 | 000,449,536 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\NetInfoUIExPlugin.dll MOD - [2014-01-20 17:12:03 | 000,379,392 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\Proxy.dll MOD - [2014-01-20 17:12:03 | 000,370,176 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\plugins\imageformats\qtiff4.dll MOD - [2014-01-20 17:12:03 | 000,350,720 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\plugins\imageformats\qmng4.dll MOD - [2014-01-20 17:12:03 | 000,331,776 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\NetConnectPlugin.dll MOD - [2014-01-20 17:12:03 | 000,314,368 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\StatusBarMgrPlugin.dll MOD - [2014-01-20 17:12:03 | 000,275,456 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\NetInfoSrvPlugin.dll MOD - [2014-01-20 17:12:03 | 000,258,560 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\sdk.dll MOD - [2014-01-20 17:12:03 | 000,245,760 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\MenuMgrPlugin.dll MOD - [2014-01-20 17:12:03 | 000,239,104 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\LiveUpdateInterface.dll MOD - [2014-01-20 17:12:03 | 000,229,376 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\ToolBarMgrPlugin.dll MOD - [2014-01-20 17:12:03 | 000,225,280 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\NetSrvPlugin.dll MOD - [2014-01-20 17:12:03 | 000,217,600 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\SmsSrvPlugin.dll MOD - [2014-01-20 17:12:03 | 000,192,000 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\plugins\imageformats\qjpeg4.dll MOD - [2014-01-20 17:12:03 | 000,185,856 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\XFramePlugin.dll MOD - [2014-01-20 17:12:03 | 000,179,712 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\NDISPlugin.dll MOD - [2014-01-20 17:12:03 | 000,159,232 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\XCodec.dll MOD - [2014-01-20 17:12:03 | 000,158,720 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\NetConnectSrvPlugin.dll MOD - [2014-01-20 17:12:03 | 000,156,672 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\STKSrvPlugin.dll MOD - [2014-01-20 17:12:03 | 000,142,336 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\USSDSrvPlugin.dll MOD - [2014-01-20 17:12:03 | 000,135,168 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\Trace.dll MOD - [2014-01-20 17:12:03 | 000,133,120 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\OSDialup.dll MOD - [2014-01-20 17:12:03 | 000,131,072 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\OSNDIS.dll MOD - [2014-01-20 17:12:03 | 000,106,496 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\Win7Support.dll MOD - [2014-01-20 17:12:03 | 000,101,376 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\OSAdapt.dll MOD - [2014-01-20 17:12:03 | 000,093,184 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\NotifyServicePlugin.dll MOD - [2014-01-20 17:12:03 | 000,082,944 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\plugins\imageformats\qgif4.dll MOD - [2014-01-20 17:12:03 | 000,081,920 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\plugins\imageformats\qico4.dll MOD - [2014-01-20 17:12:03 | 000,065,536 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\OSPowerMgr.dll MOD - [2014-01-20 17:12:03 | 000,062,976 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\OSCall.dll MOD - [2014-01-20 17:12:03 | 000,011,362 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\mingwm10.dll MOD - [2014-01-20 17:12:02 | 001,077,248 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\AddrBookPlugin.dll MOD - [2014-01-20 17:12:02 | 000,739,840 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\AddrBookUIPlugin.dll MOD - [2014-01-20 17:12:02 | 000,550,400 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\CallAppPlugin.dll MOD - [2014-01-20 17:12:02 | 000,547,840 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\CallLogSrvPlugin.dll MOD - [2014-01-20 17:12:02 | 000,514,048 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\Mobile Partner.exe MOD - [2014-01-20 17:12:02 | 000,495,104 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\DeviceMgrUIPlugin.dll MOD - [2014-01-20 17:12:02 | 000,414,720 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\DialupUIPlugin.dll MOD - [2014-01-20 17:12:02 | 000,352,768 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\core.dll MOD - [2014-01-20 17:12:02 | 000,337,408 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\DeviceAppPlugin.dll MOD - [2014-01-20 17:12:02 | 000,300,544 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\DeviceSrvPlugin.dll MOD - [2014-01-20 17:12:02 | 000,264,704 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\AddrBookSrvPlugin.dll MOD - [2014-01-20 17:12:02 | 000,238,592 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\AtCodec.dll MOD - [2014-01-20 17:12:02 | 000,218,112 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\Common.dll MOD - [2014-01-20 17:12:02 | 000,211,456 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\DialUpPlugin.dll MOD - [2014-01-20 17:12:02 | 000,175,104 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\CallSrvPlugin.dll MOD - [2014-01-20 17:12:02 | 000,157,184 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\DataServicePlugin.dll MOD - [2014-01-20 17:12:02 | 000,123,392 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\ATR2SMgr.dll MOD - [2014-01-20 17:12:02 | 000,117,760 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\LayoutPlugin.dll MOD - [2014-01-20 17:12:02 | 000,043,008 | ---- | M] () -- C:\Program Files (x86)\Mobile Partner\libgcc_s_dw2-1.dll MOD - [2013-08-29 01:25:02 | 000,100,688 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll MOD - [2013-08-29 01:23:38 | 001,861,968 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe MOD - [2013-06-29 22:02:25 | 016,033,160 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll MOD - [2013-04-04 01:09:40 | 004,300,456 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF MOD - [2012-07-30 15:13:00 | 000,195,584 | ---- | M] () -- C:\Program Files (x86)\TeamSpeak 3 Client\imageformats\_old_qjpeg4.dll MOD - [2012-07-30 15:13:00 | 000,025,600 | ---- | M] () -- C:\Program Files (x86)\TeamSpeak 3 Client\imageformats\_old_qgif4.dll [color=#E56717]========== Services (SafeList) ==========[/color] SRV:[b]64bit:[/b] - File not found [Auto | Stopped] -- C:\Program Files\Web Assistant\ExtensionUpdaterService.exe -- (Web Assistant Updater) SRV:[b]64bit:[/b] - File not found [On_Demand | Stopped] -- C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe -- (Amsp) SRV:[b]64bit:[/b] - [2014-01-16 01:42:12 | 000,289,256 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe -- (McComponentHostService) SRV:[b]64bit:[/b] - [2013-05-27 06:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:[b]64bit:[/b] - [2012-02-29 03:19:40 | 001,890,568 | ---- | M] (Raxco Software, Inc.) [Auto | Running] -- C:\Program Files\Raxco\PerfectDisk\PDAgent.exe -- (PDAgent) SRV:[b]64bit:[/b] - [2012-02-29 03:19:30 | 003,291,912 | ---- | M] (Raxco Software, Inc.) [On_Demand | Running] -- C:\Program Files\Common Files\Raxco\Shared\PDEngine.exe -- (PDEngine) SRV:[b]64bit:[/b] - [2012-01-21 04:11:26 | 000,235,520 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:[b]64bit:[/b] - [2011-03-04 01:57:58 | 000,379,520 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Windows\SysNative\FBAgent.exe -- (AFBAgent) SRV:[b]64bit:[/b] - [2010-09-23 02:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV:[b]64bit:[/b] - [2010-09-17 09:32:56 | 000,241,488 | ---- | M] (Trend Micro Inc.) [On_Demand | Running] -- C:\Program Files\Trend Micro\Titanium\TiMiniService.exe -- (TiMiniService) SRV - [2014-03-07 19:44:44 | 000,146,920 | ---- | M] (SaveSense) [On_Demand | Stopped] -- C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe -- (savesenselivem) SRV - [2014-03-07 19:44:44 | 000,146,920 | ---- | M] (SaveSense) [Auto | Stopped] -- C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe -- (savesenselive) SRV - [2014-02-26 20:38:32 | 000,425,104 | ---- | M] (Taiwan Shui Mu Chih Ching Technology Limited.) [Auto | Running] -- C:\Program Files (x86)\WinZipper\winzipersvc.exe -- (winzipersvc) SRV - [2014-02-26 09:30:22 | 000,501,904 | ---- | M] (Cherished Technololgy LIMITED) [Auto | Running] -- C:\ProgramData\WPM\wprotectmanager.exe -- (Wpm) SRV - [2014-02-26 07:44:20 | 000,508,016 | ---- | M] (Cherished Technololgy LIMITED) [Auto | Running] -- C:\ProgramData\IePluginService\PluginService.exe -- (IePluginService) SRV - [2014-02-19 12:13:32 | 000,807,800 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe -- (Application Updater) SRV - [2014-02-14 13:54:20 | 000,118,896 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2014-01-20 17:12:02 | 000,218,624 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe -- (Mobile Partner. RunOuc) SRV - [2013-10-18 00:13:43 | 000,148,976 | ---- | M] (BonanzaDeals) [On_Demand | Stopped] -- C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe -- (bonanzadealslivem) SRV - [2013-10-18 00:13:43 | 000,148,976 | ---- | M] (BonanzaDeals) [Auto | Stopped] -- C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe -- (bonanzadealslive) SRV - [2013-09-11 21:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2013-06-26 18:21:50 | 000,207,528 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa) SRV - [2013-06-26 18:21:46 | 000,523,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist) SRV - [2013-05-21 22:42:44 | 001,015,984 | ---- | M] (AVG Secure Search) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe -- (vToolbarUpdater15.2.0) SRV - [2013-02-03 23:15:21 | 000,008,192 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\srvany.exe -- (KMService) SRV - [2012-12-14 10:17:04 | 003,467,768 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe -- (TeamViewer8) SRV - [2012-08-01 15:07:16 | 000,724,888 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2012-06-11 20:38:39 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2012-02-03 15:24:50 | 000,277,120 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe -- (ASUS InstantOn) SRV - [2011-12-20 20:12:54 | 000,061,440 | RHS- | M] () [Auto | Running] -- C:\Windows\SysWOW64\secpro.exe -- (SecStore) SRV - [2011-11-21 13:22:08 | 000,080,512 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe -- (ASLDRService) SRV - [2011-11-21 13:19:50 | 000,096,896 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv) SRV - [2011-08-02 23:31:22 | 000,146,592 | ---- | M] (Atheros) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe -- (Atheros Bt&Wlan Coex Agent) SRV - [2011-08-02 23:13:24 | 000,103,584 | ---- | M] (Atheros Commnucations) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\AdminService.exe -- (AtherosSvc) SRV - [2010-12-21 03:24:38 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2010-12-21 03:24:36 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2010-11-16 14:38:16 | 000,339,456 | ---- | M] () [Auto | Running] -- C:\ProgramData\DatacardService\HWDeviceService64.exe -- (HWDeviceService64.exe) SRV - [2009-06-10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV:[b]64bit:[/b] - [2014-01-20 17:12:03 | 000,256,000 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ewusbnet.sys -- (ewusbnet) DRV:[b]64bit:[/b] - [2014-01-20 17:12:03 | 000,121,600 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard) DRV:[b]64bit:[/b] - [2014-01-20 17:12:03 | 000,117,248 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev) DRV:[b]64bit:[/b] - [2014-01-20 17:12:03 | 000,085,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator) DRV:[b]64bit:[/b] - [2014-01-20 17:12:03 | 000,013,952 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_usbenumfilter.sys -- (ew_usbenumfilter) DRV:[b]64bit:[/b] - [2013-06-26 18:21:50 | 000,023,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol) DRV:[b]64bit:[/b] - [2013-06-26 18:21:48 | 000,028,840 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir) DRV:[b]64bit:[/b] - [2013-06-26 18:21:46 | 000,273,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay) DRV:[b]64bit:[/b] - [2013-06-26 18:21:44 | 000,767,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs) DRV:[b]64bit:[/b] - [2013-05-21 22:42:44 | 000,045,856 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp) DRV:[b]64bit:[/b] - [2013-03-07 09:49:18 | 000,017,480 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\epmntdrv.sys -- (epmntdrv) DRV:[b]64bit:[/b] - [2013-03-07 09:49:18 | 000,009,800 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\EuGdiDrv.sys -- (EuGdiDrv) DRV:[b]64bit:[/b] - [2013-02-12 05:12:06 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx) DRV:[b]64bit:[/b] - [2013-02-02 16:42:22 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV:[b]64bit:[/b] - [2012-06-27 14:18:52 | 000,026,112 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd) DRV:[b]64bit:[/b] - [2012-03-01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:[b]64bit:[/b] - [2012-02-28 11:25:54 | 000,081,424 | ---- | M] (Raxco Software, Inc.) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\PDFsFilter.sys -- (PDFSFilter) DRV:[b]64bit:[/b] - [2012-01-21 04:48:08 | 010,818,048 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:[b]64bit:[/b] - [2012-01-21 03:11:36 | 000,327,168 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:[b]64bit:[/b] - [2012-01-17 17:12:28 | 000,140,816 | ---- | M] (Raxco Software, Inc.) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\DefragFs.sys -- (DefragFS) DRV:[b]64bit:[/b] - [2012-01-09 16:28:20 | 000,171,008 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdnsux64.sys -- (nmwcdnsux64) DRV:[b]64bit:[/b] - [2012-01-09 16:28:20 | 000,019,968 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbx64.sys -- (nmwcd) DRV:[b]64bit:[/b] - [2012-01-09 16:28:20 | 000,012,800 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdnsucx64.sys -- (nmwcdnsucx64) DRV:[b]64bit:[/b] - [2012-01-09 16:28:20 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt) DRV:[b]64bit:[/b] - [2012-01-09 16:28:20 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys -- (upperdev) DRV:[b]64bit:[/b] - [2012-01-09 16:28:18 | 000,027,136 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbox64.sys -- (nmwcdc) DRV:[b]64bit:[/b] - [2011-12-05 20:47:30 | 000,095,248 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:[b]64bit:[/b] - [2011-10-03 22:49:32 | 002,770,944 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:[b]64bit:[/b] - [2011-08-02 23:22:52 | 000,511,136 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btfilter.sys -- (BtFilter) DRV:[b]64bit:[/b] - [2011-08-02 23:22:06 | 000,280,992 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_rcp.sys -- (BTATH_RCP) DRV:[b]64bit:[/b] - [2011-08-02 23:21:50 | 000,068,256 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_lwflt.sys -- (BTATH_LWFLT) DRV:[b]64bit:[/b] - [2011-08-02 23:21:20 | 000,167,584 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_hcrp.sys -- (BTATH_HCRP) DRV:[b]64bit:[/b] - [2011-08-02 23:21:04 | 000,036,000 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_flt.sys -- (AthBTPort) DRV:[b]64bit:[/b] - [2011-08-02 23:20:50 | 000,030,368 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_bus.sys -- (BTATH_BUS) DRV:[b]64bit:[/b] - [2011-08-02 23:20:34 | 000,110,240 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_avdt.sys -- (btath_avdt) DRV:[b]64bit:[/b] - [2011-08-02 23:20:18 | 000,330,912 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_a2dp.sys -- (BTATH_A2DP) DRV:[b]64bit:[/b] - [2011-06-02 19:32:50 | 000,401,896 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci) DRV:[b]64bit:[/b] - [2011-06-02 19:32:50 | 000,128,488 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3) DRV:[b]64bit:[/b] - [2011-04-26 04:07:36 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:[b]64bit:[/b] - [2011-03-18 06:36:18 | 000,074,840 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor) DRV:[b]64bit:[/b] - [2011-03-11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:[b]64bit:[/b] - [2011-03-11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:[b]64bit:[/b] - [2011-03-04 04:42:20 | 001,413,168 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:[b]64bit:[/b] - [2010-11-20 14:33:36 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:[b]64bit:[/b] - [2010-11-20 12:07:06 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:[b]64bit:[/b] - [2010-11-20 12:07:06 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:[b]64bit:[/b] - [2010-11-20 11:43:58 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser) DRV:[b]64bit:[/b] - [2010-10-20 01:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) DRV:[b]64bit:[/b] - [2010-09-23 08:36:48 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr) DRV:[b]64bit:[/b] - [2010-09-17 09:52:28 | 000,144,464 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\tmcomm.sys -- (tmcomm) DRV:[b]64bit:[/b] - [2010-09-17 09:52:28 | 000,105,552 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tmtdi.sys -- (tmtdi) DRV:[b]64bit:[/b] - [2010-09-17 09:52:28 | 000,090,704 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\tmactmon.sys -- (tmactmon) DRV:[b]64bit:[/b] - [2010-09-17 09:52:28 | 000,067,664 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\tmevtmgr.sys -- (tmevtmgr) DRV:[b]64bit:[/b] - [2010-08-24 10:55:44 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) DRV:[b]64bit:[/b] - [2009-07-20 10:29:40 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kbfiltr.sys -- (kbfiltr) DRV:[b]64bit:[/b] - [2009-07-14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:[b]64bit:[/b] - [2009-07-14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:[b]64bit:[/b] - [2009-07-14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:[b]64bit:[/b] - [2009-07-14 01:21:35 | 000,064,512 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BthMtpEnum.sys -- (BthMtpEnum) DRV:[b]64bit:[/b] - [2009-06-10 21:35:57 | 000,056,832 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SiSG664.sys -- (SiSGbeLH) DRV:[b]64bit:[/b] - [2009-06-10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:[b]64bit:[/b] - [2009-06-10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:[b]64bit:[/b] - [2009-06-10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:[b]64bit:[/b] - [2009-06-10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:[b]64bit:[/b] - [2008-05-23 16:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr) DRV - [2013-03-07 09:49:20 | 000,014,920 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\epmntdrv.sys -- (epmntdrv) DRV - [2013-03-07 09:49:20 | 000,009,160 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\EuGdiDrv.sys -- (EuGdiDrv) DRV - [2011-09-07 08:55:04 | 000,017,536 | ---- | M] (ASUS) [Kernel | System | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys -- (ATKWMIACPIIO_) DRV - [2009-07-14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2009-07-02 16:36:14 | 000,015,416 | ---- | M] (ASUS) [Kernel | Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86} IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=NP06&src=IE-SearchBox IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=ST9500325AS_S2W72X2SXXXXS2W72X2S&ts=1393443455&type=default&q={searchTerms} IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=390&systemid=406&sr=0&q={searchTerms} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=vsl&s={searchTerms}&f=4 IE - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=NP06&src=IE-SearchBox IE - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=ST9500325AS_S2W72X2SXXXXS2W72X2S&ts=1393443455&type=default&q={searchTerms} IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=390&systemid=406&sr=0&q={searchTerms} IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&crg=3.1010000&st=12&q={searchTerms}&barid={1535BDEE-9173-4B4D-88EC-22CE9D8139AB} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www.doko-search.com/?babsrc=HP_ss&mntrId=008E001E101F1838&affID=125839&tsp=5038 IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\..\URLSearchHook: {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files (x86)\Dealio Toolbar\IE\8.8\dealioToolbarIE.dll (Spigot, Inc.) IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86} IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = http://start.facemoods.com/?a=vsl&s={searchTerms}&f=4 IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://www.delta-search.com/?q={searchTerms}&affID=119816&tt=3712_1&babsrc=SP_ss&mntrId=008edbb0000000000000001e101fd318 IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\..\SearchScopes\{1A765F6F-B138-4A85-A6D4-79987161F830}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=847320&p={searchTerms} IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\..\SearchScopes\{1FD14DB0-29D6-4E0A-A01A-DF738A2EFD17}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=F4A865D8-1FD3-45BF-AEBA-6E9915E20A2E&apn_sauid=F80F3B84-9DEE-4185-9431-89739E9DEE04 IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=ST9500325AS_S2W72X2SXXXXS2W72X2S&ts=1393443455&type=default&q={searchTerms} IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = http://securedsearch2.lavasoft.com/results.php?pr=vmn&id=adawaretb&v=3_8&idate=2014-03-04&hsimp=yhs-lavasoft&ent=ch&q={searchTerms} IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={9966863D-AB1C-4B6D-9F55-E299BAC10A44}&mid=a0976be9078147d08b74359c7b647a0b-0b19ba19d08890d75b505c77d285cb7acc1d6cc7&lang=&ds=&pr=&d=&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms} IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=390&systemid=406&sr=0&q={searchTerms} IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = http://www.daemon-search.com/search?q={searchTerms} IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredibar.com/mb174/?search={searchTerms}&loc=IB_DS&a=6R8F7bhhXe&i=26 IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&st=6&barid={1535BDEE-9173-4B4D-88EC-22CE9D8139AB} IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultenginename: "SecureSearch" FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&ilc=12&type=847320" FF - prefs.js..browser.search.selectedEngine: "SecureSearch" FF - prefs.js..browser.startup.homepage: "http://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_8&idate=2014-03-04&ent=hp&u=59E308408CF310382FB0B75316221DC0" FF - prefs.js..extensions.enabledAddons: %7Bf9d03c26-0575-497e-821d-f7956d23e0ca%7D:3.1 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:27.0.1 FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=847320&p=" FF - user.js - File not found FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.2.0\\npsitesafety.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Web Player Plug-In,version=1.0.0: C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.122.0: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files (x86)\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.bdupdater.com/BonanzaDealsLive Update;version=3: C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals) FF - HKLM\Software\MozillaPlugins\@tools.bdupdater.com/BonanzaDealsLive Update;version=9: C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.updaterss.com/SaveSenseLive Update;version=3: C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll (SaveSense) FF - HKLM\Software\MozillaPlugins\@tools.updaterss.com/SaveSenseLive Update;version=9: C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll (SaveSense) FF - HKLM\Software\MozillaPlugins\ZEON/PDF,version=2.0: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation) FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\marlena\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\ [2011-04-01 10:25:03 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\FireFoxExt\15.2.0.5 [2013-05-21 22:43:18 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\quick_start@gmail.com: C:\Users\marlena\AppData\Roaming\Mozilla\Firefox\Profiles\i38wm3od.default-1362675341698\extensions\quick_start@gmail.com [2014-03-07 20:22:52 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2014-02-14 13:54:07 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014-02-14 13:54:08 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2014-02-14 13:54:07 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014-02-14 13:54:08 | 000,000,000 | ---D | M] [2012-07-19 19:29:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\marlena\AppData\Roaming\Mozilla\Extensions [2014-03-07 20:22:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\marlena\AppData\Roaming\Mozilla\Firefox\Profiles\i38wm3od.default-1362675341698\extensions [2014-03-07 19:44:42 | 000,000,000 | ---D | M] (SaveSense) -- C:\Users\marlena\AppData\Roaming\Mozilla\Firefox\Profiles\i38wm3od.default-1362675341698\extensions\{2d7886a0-85bb-4bf2-b684-ba92b4b21d23} [2014-03-07 20:22:52 | 000,000,000 | ---D | M] ("Quick Start") -- C:\Users\marlena\AppData\Roaming\Mozilla\Firefox\Profiles\i38wm3od.default-1362675341698\extensions\quick_start@gmail.com [2014-02-21 18:41:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\marlena\AppData\Roaming\Mozilla\Firefox\Profiles\s2egdwrw.default\extensions [2013-03-07 17:56:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\marlena\AppData\Roaming\Mozilla\Firefox\Profiles\s2egdwrw.default\extensions\{0c3110f6-a2e6-4b6f-9516-6dc345e1f7ef} [2014-01-09 21:21:01 | 000,007,373 | ---- | M] () (No name found) -- C:\Users\marlena\AppData\Roaming\Mozilla\Firefox\Profiles\i38wm3od.default-1362675341698\extensions\{badea1ae-72ed-4f6a-8c37-4db9a4ac7bc9}.xpi [2013-12-18 19:43:26 | 000,002,839 | ---- | M] () (No name found) -- C:\Users\marlena\AppData\Roaming\Mozilla\Firefox\Profiles\i38wm3od.default-1362675341698\extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca}.xpi [2013-09-05 19:39:18 | 000,000,904 | ---- | M] () -- C:\Users\marlena\AppData\Roaming\Mozilla\Firefox\Profiles\i38wm3od.default-1362675341698\searchplugins\yahoo.xml [2014-02-14 13:54:08 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2014-03-06 20:24:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions [2014-02-14 13:54:20 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [color=#E56717]========== Chrome ==========[/color] CHR - homepage: http://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_8&idate=2014-03-04&ent=hp&u=59E308408CF310382FB0B75316221DC0 CHR - default_search_provider: delta-homes (Enabled) CHR - default_search_provider: search_url = http://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=ST9500325AS_S2W72X2SXXXXS2W72X2S&ts=1393443455&type=default&q={searchTerms} CHR - default_search_provider: suggest_url = CHR - homepage: http://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_8&idate=2014-03-04&ent=hp&u=59E308408CF310382FB0B75316221DC0 CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\pdf.dll CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL CHR - plugin: ESN Launch Mozilla Plugin (Enabled) = C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll CHR - plugin: ESN Sonar API (Enabled) = C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll CHR - plugin: Zeon Plus (Enabled) = C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll CHR - plugin: Java(TM) Platform SE 7 U5 (Enabled) = C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll CHR - plugin: Java Deployment Toolkit 7.0.50.255 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll CHR - plugin: Windows Live Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\marlena\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll CHR - plugin: Error reading preferences file CHR - Extension: BonanzaDeals = C:\Users\marlena\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieadcoanfjloocmfafkebdnfefmohngj\3.5.0.0_0\ CHR - Extension: No name found = C:\Users\marlena\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo\1.1.6.6_0\ CHR - Extension: AVG Security Toolbar = C:\Users\marlena\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\14.2.0.1_0\ CHR - Extension: AVG Security Toolbar = C:\Users\marlena\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\ CHR - Extension: Extended Protection = C:\Users\marlena\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_0\ CHR - Extension: BonanzaDeals = C:\Users\marlena\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieadcoanfjloocmfafkebdnfefmohngj\3.5.0.0_0\ CHR - Extension: No name found = C:\Users\marlena\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo\1.1.6.6_0\ CHR - Extension: AVG Security Toolbar = C:\Users\marlena\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\14.2.0.1_0\ CHR - Extension: AVG Security Toolbar = C:\Users\marlena\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.2.0.5_0\ CHR - Extension: Extended Protection = C:\Users\marlena\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_0\ O1 HOSTS File: ([2009-06-10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:[b]64bit:[/b] - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.) O2:[b]64bit:[/b] - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:[b]64bit:[/b] - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll (Bandoo Media, inc) O2:[b]64bit:[/b] - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.) O2:[b]64bit:[/b] - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files (x86)\Dealio Toolbar\IE\8.8\dealioToolbarIE.dll (Spigot, Inc.) O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.) O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.) O2 - BHO: (IETabPage Class) - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited) O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll (facemoods.com BHO) O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll (Montera Technologeis LTD) O2 - BHO: (SaveSense) - {71e129ff-6c2a-4984-818c-7e2c998b8d99} - C:\Users\marlena\AppData\Local\SaveSense\SaveSenseIE.dll (SaveSense) O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.2.0.5\AVG Secure Search_toolbar.dll (AVG Secure Search) O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll () O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc) O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (IplexToALLPlayer) - {DF925EF3-7A87-44E4-9CAF-8D7B280BF616} - C:\Program Files (x86)\ALLPlayer\Iplex\IplexToALLPlayer.dll (ALLCinema Ltd.) O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll (Yontoo LLC) O2 - BHO: (BonanzaDeals) - {fe063412-bea4-4d76-8ed3-183be6220d17} - C:\Program Files (x86)\BonanzaDeals\BonanzaDealsIE.dll (BonanzaDeals) O3:[b]64bit:[/b] - HKLM\..\Toolbar: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files (x86)\Dealio Toolbar\IE\8.8\dealioToolbarIE64.dll (Spigot, Inc.) O3:[b]64bit:[/b] - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll () O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files (x86)\Dealio Toolbar\IE\8.8\dealioToolbarIE.dll (Spigot, Inc.) O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.2.0.5\AVG Secure Search_toolbar.dll (AVG Secure Search) O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll () O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll (facemoods.com) O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll File not found O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD) O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll File not found O4:[b]64bit:[/b] - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.) O4 - HKLM..\Run: [] File not found O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKLM..\RunOnce: [Del32171165] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:[b]64bit:[/b] - Extra context menu item: Download with &Media Finder - C:\Program Files (x86)\Media Finder\hook.html File not found O8 - Extra context menu item: Download with &Media Finder - C:\Program Files (x86)\Media Finder\hook.html File not found O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) O13[b]64bit:[/b] - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\..Trusted Domains: aeriagames.com ([]http in Trusted sites) O15 - HKU\S-1-5-21-3771276668-3479054325-1734754795-1000\..Trusted Domains: aeriagames.com ([]https in Trusted sites) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{26B4C05C-C127-426F-BB75-A559CF678F12}: DhcpNameServer = 217.172.224.160 89.231.1.206 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F4C9A2D5-7948-4FDB-BB31-02582A6BF4E2}: NameServer = 217.116.104.104 217.116.100.100 O18:[b]64bit:[/b] - Protocol\Handler\livecall - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\ms-help - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\msnim - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.) O18:[b]64bit:[/b] - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.) O18:[b]64bit:[/b] - Protocol\Handler\viprotocol - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\wlmailhtml - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.) O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.) O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.2.0\ViProtocol.dll (AVG Secure Search) O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010-11-18 22:37:37 | 000,142,336 | R--- | M] () - F:\AutoRun.exe -- [ CDFS ] O32 - AutoRun File - [2008-10-09 18:12:34 | 000,000,045 | R--- | M] () - F:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{1807a8af-2beb-11e2-b2cb-001e101fe70e}\Shell - "" = AutoRun O33 - MountPoints2\{1807a8af-2beb-11e2-b2cb-001e101fe70e}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010-11-18 22:37:37 | 000,142,336 | R--- | M] () O33 - MountPoints2\{1badbd6e-b406-11e1-a1d8-e4d53d8093f8}\Shell - "" = AutoRun O33 - MountPoints2\{1badbd6e-b406-11e1-a1d8-e4d53d8093f8}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010-11-18 22:37:37 | 000,142,336 | R--- | M] () O33 - MountPoints2\{1badbd7d-b406-11e1-a1d8-e4d53d8093f8}\Shell - "" = AutoRun O33 - MountPoints2\{1badbd7d-b406-11e1-a1d8-e4d53d8093f8}\Shell\AutoRun\command - "" = H:\AutoRun.exe O33 - MountPoints2\{5dad1d42-7bc5-11e3-bde7-001e101f63cf}\Shell - "" = AutoRun O33 - MountPoints2\{5dad1d42-7bc5-11e3-bde7-001e101f63cf}\Shell\AutoRun\command - "" = I:\AutoRunCardDetector.exe O33 - MountPoints2\{5dad1d5d-7bc5-11e3-bde7-001e101f63cf}\Shell - "" = AutoRun O33 - MountPoints2\{5dad1d5d-7bc5-11e3-bde7-001e101f63cf}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010-11-18 22:37:37 | 000,142,336 | R--- | M] () O33 - MountPoints2\{5dad1f7e-7bc5-11e3-bde7-001e101f63cf}\Shell - "" = AutoRun O33 - MountPoints2\{5dad1f7e-7bc5-11e3-bde7-001e101f63cf}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010-11-18 22:37:37 | 000,142,336 | R--- | M] () O33 - MountPoints2\{8c222e5d-0a39-11e2-8ca8-e4d53d8093f8}\Shell - "" = AutoRun O33 - MountPoints2\{8c222e5d-0a39-11e2-8ca8-e4d53d8093f8}\Shell\AutoRun\command - "" = F:\_AUTORUN\AUTORUN.EXE O33 - MountPoints2\{a614874e-0d3f-11e2-b2ae-e4d53d8093f8}\Shell - "" = AutoRun O33 - MountPoints2\{a614874e-0d3f-11e2-b2ae-e4d53d8093f8}\Shell\AutoRun\command - "" = G:\_AUTORUN\AUTORUN.EXE O33 - MountPoints2\{a6148757-0d3f-11e2-b2ae-e4d53d8093f8}\Shell - "" = AutoRun O33 - MountPoints2\{a6148757-0d3f-11e2-b2ae-e4d53d8093f8}\Shell\AutoRun\command - "" = F:\_AUTORUN\AUTORUN.EXE O33 - MountPoints2\{a6148766-0d3f-11e2-b2ae-e4d53d8093f8}\Shell - "" = AutoRun O33 - MountPoints2\{a6148766-0d3f-11e2-b2ae-e4d53d8093f8}\Shell\AutoRun\command - "" = G:\_AUTORUN\AUTORUN.EXE O33 - MountPoints2\{be5074d3-b5a5-11e1-8cb5-001e101f8aaa}\Shell - "" = AutoRun O33 - MountPoints2\{be5074d3-b5a5-11e1-8cb5-001e101f8aaa}\Shell\AutoRun\command - "" = H:\AutoRun.exe O33 - MountPoints2\{c4aeacfa-23bc-11e2-9b7a-e4d53d8093f8}\Shell - "" = AutoRun O33 - MountPoints2\{c4aeacfa-23bc-11e2-9b7a-e4d53d8093f8}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010-11-18 22:37:37 | 000,142,336 | R--- | M] () O33 - MountPoints2\{e19ea246-101a-11e2-a150-e4d53d8093f8}\Shell - "" = AutoRun O33 - MountPoints2\{e19ea246-101a-11e2-a150-e4d53d8093f8}\Shell\AutoRun\command - "" = H:\NokiaPCIA_Autorun.exe O33 - MountPoints2\{e831f184-6d4e-11e2-a06c-e4d53d8093f8}\Shell - "" = AutoRun O33 - MountPoints2\{e831f184-6d4e-11e2-a06c-e4d53d8093f8}\Shell\AutoRun\command - "" = G:\setup.exe O33 - MountPoints2\{f054f3c8-81ec-11e3-a5e7-001e101f82a0}\Shell - "" = AutoRun O33 - MountPoints2\{f054f3c8-81ec-11e3-a5e7-001e101f82a0}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010-11-18 22:37:37 | 000,142,336 | R--- | M] () O33 - MountPoints2\H\Shell - "" = AutoRun O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\AutoRun.exe O33 - MountPoints2\I\Shell - "" = AutoRun O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\AutoRun.exe O34 - HKLM BootExecute: (PDBoot.exe) O34 - HKLM BootExecute: (autocheck autochk *) O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %* O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2014-03-08 01:55:53 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\marlena\Desktop\OTL.exe [2014-03-07 19:45:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EaseUS Partition Master 9.3.0 [2014-03-07 19:45:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EaseUS [2014-03-07 19:44:44 | 000,000,000 | ---D | C] -- C:\Users\marlena\AppData\Local\SaveSenseLive [2014-03-07 19:44:44 | 000,000,000 | ---D | C] -- C:\ProgramData\SaveSenseLive [2014-03-07 19:44:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SaveSenseLive [2014-03-07 19:44:43 | 000,000,000 | ---D | C] -- C:\Users\marlena\AppData\Roaming\SaveSense [2014-03-07 19:44:42 | 000,000,000 | ---D | C] -- C:\Users\marlena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense [2014-03-07 19:44:42 | 000,000,000 | ---D | C] -- C:\Users\marlena\AppData\Local\SaveSense [2014-03-07 19:26:09 | 000,000,000 | ---D | C] -- C:\totalcmd [2014-03-07 19:26:09 | 000,000,000 | ---D | C] -- C:\Users\marlena\AppData\Roaming\GHISLER [2014-03-07 19:25:03 | 006,344,480 | ---- | C] (Ghisler Software GmbH) -- C:\Users\marlena\Desktop\tcm850x32_64.exe [2014-03-05 11:03:54 | 000,000,000 | ---D | C] -- C:\Windows\pss [2014-03-04 20:32:17 | 000,000,000 | ---D | C] -- C:\Users\marlena\AppData\Roaming\LavasoftStatistics [2014-03-04 19:57:51 | 000,000,000 | ---D | C] -- C:\Users\marlena\AppData\Roaming\SecureSearch [2014-03-04 19:57:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lavasoft [2014-03-04 19:54:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft [2014-03-04 19:50:31 | 000,000,000 | ---D | C] -- C:\Users\marlena\AppData\Roaming\Opera Software [2014-03-04 19:50:31 | 000,000,000 | ---D | C] -- C:\Users\marlena\AppData\Local\Opera Software [2014-03-04 19:48:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Opera [2014-03-02 12:32:33 | 000,000,000 | ---D | C] -- C:\Users\marlena\Desktop\aaaaaa [2014-02-26 20:38:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZipper [2014-02-26 20:38:35 | 000,000,000 | ---D | C] -- C:\Users\marlena\AppData\Roaming\WinZipper [2014-02-26 20:38:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinZipper [2014-02-26 20:38:29 | 000,000,000 | ---D | C] -- C:\ProgramData\IePluginService [2014-02-26 20:38:28 | 000,000,000 | ---D | C] -- C:\Users\marlena\AppData\Roaming\SupTab [2014-02-26 20:38:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SupTab [2014-02-26 09:12:19 | 000,000,000 | ---D | C] -- C:\Windows\Migration [2014-02-21 18:41:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Spigot [2014-02-21 18:41:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Dealio Toolbar [2014-02-21 18:41:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Application Updater [2014-02-20 18:09:35 | 000,000,000 | ---D | C] -- C:\Users\marlena\Desktop\Nowy folder [2014-02-18 19:44:48 | 000,000,000 | ---D | C] -- C:\Users\marlena\Desktop\reszel [2014-02-16 19:06:32 | 000,000,000 | ---D | C] -- C:\Users\marlena\Desktop\peugeot [2014-02-15 10:32:33 | 000,000,000 | ---D | C] -- C:\Users\marlena\AppData\Roaming\UpdateBonanza [2014-02-15 10:14:13 | 000,000,000 | ---D | C] -- C:\Users\marlena\AppData\Roaming\DigitalSites [2014-02-15 10:13:40 | 000,000,000 | ---D | C] -- C:\Users\marlena\Desktop\wywołać [2014-02-14 13:54:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2014-02-12 16:13:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus [2014-02-12 16:12:56 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee Security Scan [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2014-03-08 02:19:00 | 000,000,928 | ---- | M] () -- C:\Windows\tasks\BonanzaDealsLiveUpdateTaskMachineUA.job [2014-03-08 02:17:00 | 000,001,050 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2014-03-08 02:17:00 | 000,001,046 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2014-03-08 02:14:00 | 000,000,300 | ---- | M] () -- C:\Windows\tasks\Digital Sites.job [2014-03-08 02:13:00 | 000,000,300 | ---- | M] () -- C:\Windows\tasks\DigitalSite.job [2014-03-08 02:10:30 | 000,001,128 | ---- | M] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk [2014-03-08 01:55:54 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\marlena\Desktop\OTL.exe [2014-03-08 01:49:00 | 000,001,086 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3771276668-3479054325-1734754795-1000UA.job [2014-03-08 01:49:00 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3771276668-3479054325-1734754795-1000Core.job [2014-03-08 01:49:00 | 000,000,934 | ---- | M] () -- C:\Windows\tasks\SaveSenseLiveUpdateTaskMachineUA.job [2014-03-08 01:44:00 | 000,000,300 | ---- | M] () -- C:\Windows\tasks\SaveSense.job [2014-03-08 01:32:00 | 000,000,300 | ---- | M] () -- C:\Windows\tasks\Update Bonanza.job [2014-03-08 01:32:00 | 000,000,298 | ---- | M] () -- C:\Windows\tasks\Bonanza.job [2014-03-08 01:25:58 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\BonanzaDealsLiveUpdateTaskMachineCore.job [2014-03-08 01:25:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2014-03-08 00:02:19 | 000,000,062 | ---- | M] () -- C:\Users\marlena\AppData\Roaming\WB.CFG [2014-03-08 00:01:34 | 3202,449,408 | -HS- | M] () -- C:\hiberfil.sys [2014-03-07 19:49:00 | 000,000,930 | ---- | M] () -- C:\Windows\tasks\SaveSenseLiveUpdateTaskMachineCore.job [2014-03-07 19:45:13 | 000,001,303 | ---- | M] () -- C:\Users\Public\Desktop\EaseUS Partition Master 9.3.0.lnk [2014-03-07 19:43:38 | 000,597,632 | ---- | M] ( ) -- C:\Users\marlena\Desktop\EASEUS Partition Master Professional Edition 9.3.0_isdmgr.exe [2014-03-07 19:41:41 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2014-03-07 19:41:41 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2014-03-07 19:26:10 | 000,000,648 | ---- | M] () -- C:\Users\marlena\Desktop\Total Commander 64 bit.lnk [2014-03-07 19:26:10 | 000,000,634 | ---- | M] () -- C:\Users\marlena\Desktop\Total Commander.lnk [2014-03-07 19:25:03 | 006,344,480 | ---- | M] (Ghisler Software GmbH) -- C:\Users\marlena\Desktop\tcm850x32_64.exe [2014-03-06 16:01:37 | 000,002,792 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini [2014-03-05 11:56:22 | 000,001,746 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini [2014-03-05 11:55:37 | 416,270,178 | ---- | M] () -- C:\Windows\MEMORY.DMP [2014-03-04 19:53:46 | 000,673,248 | ---- | M] ( ) -- C:\Users\marlena\AdAware-Free-Antivirus(12969).exe [2014-03-04 19:47:14 | 000,673,248 | ---- | M] ( ) -- C:\Users\marlena\9lab-Removal-Tool(42788).exe [2014-02-28 11:08:08 | 001,703,170 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2014-02-28 11:08:08 | 000,752,552 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat [2014-02-28 11:08:08 | 000,666,344 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2014-02-28 11:08:08 | 000,160,176 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat [2014-02-28 11:08:08 | 000,126,298 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2014-02-27 11:33:07 | 001,675,776 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2014-02-17 16:37:31 | 000,079,872 | -H-- | M] () -- C:\Users\marlena\Desktop\photothumb.db [2014-02-12 16:13:06 | 000,001,933 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2014-03-08 00:01:34 | 3202,449,408 | -HS- | C] () -- C:\hiberfil.sys [2014-03-07 19:45:13 | 000,016,256 | ---- | C] () -- C:\Windows\SysNative\EuEpmGdi.dll [2014-03-07 19:45:13 | 000,001,303 | ---- | C] () -- C:\Users\Public\Desktop\EaseUS Partition Master 9.3.0.lnk [2014-03-07 19:45:12 | 003,381,832 | ---- | C] () -- C:\Windows\SysNative\BootMan.exe [2014-03-07 19:45:12 | 002,499,656 | ---- | C] () -- C:\Windows\SysWow64\BootMan.exe [2014-03-07 19:45:12 | 000,100,936 | ---- | C] () -- C:\Windows\SysNative\setupempdrvx64.exe [2014-03-07 19:45:12 | 000,087,112 | ---- | C] () -- C:\Windows\SysWow64\setupempdrv03.exe [2014-03-07 19:45:12 | 000,019,840 | ---- | C] () -- C:\Windows\SysWow64\EuEpmGdi.dll [2014-03-07 19:45:12 | 000,017,480 | ---- | C] () -- C:\Windows\SysNative\epmntdrv.sys [2014-03-07 19:45:12 | 000,014,920 | ---- | C] () -- C:\Windows\SysWow64\epmntdrv.sys [2014-03-07 19:45:12 | 000,009,800 | ---- | C] () -- C:\Windows\SysNative\EuGdiDrv.sys [2014-03-07 19:45:12 | 000,009,160 | ---- | C] () -- C:\Windows\SysWow64\EuGdiDrv.sys [2014-03-07 19:44:51 | 000,000,934 | ---- | C] () -- C:\Windows\tasks\SaveSenseLiveUpdateTaskMachineUA.job [2014-03-07 19:44:50 | 000,000,930 | ---- | C] () -- C:\Windows\tasks\SaveSenseLiveUpdateTaskMachineCore.job [2014-03-07 19:44:43 | 000,000,300 | ---- | C] () -- C:\Windows\tasks\SaveSense.job [2014-03-07 19:43:38 | 000,597,632 | ---- | C] ( ) -- C:\Users\marlena\Desktop\EASEUS Partition Master Professional Edition 9.3.0_isdmgr.exe [2014-03-07 19:26:10 | 000,000,648 | ---- | C] () -- C:\Users\marlena\Desktop\Total Commander 64 bit.lnk [2014-03-07 19:26:10 | 000,000,634 | ---- | C] () -- C:\Users\marlena\Desktop\Total Commander.lnk [2014-03-04 19:53:45 | 000,673,248 | ---- | C] ( ) -- C:\Users\marlena\AdAware-Free-Antivirus(12969).exe [2014-03-04 19:47:13 | 000,673,248 | ---- | C] ( ) -- C:\Users\marlena\9lab-Removal-Tool(42788).exe [2014-02-15 10:32:34 | 000,000,300 | ---- | C] () -- C:\Windows\tasks\Update Bonanza.job [2014-02-15 10:14:13 | 000,000,300 | ---- | C] () -- C:\Windows\tasks\Digital Sites.job [2013-10-18 02:14:57 | 000,000,062 | ---- | C] () -- C:\Users\marlena\AppData\Roaming\WB.CFG [2013-10-18 00:15:04 | 000,645,632 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll [2013-10-18 00:15:04 | 000,240,640 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll [2013-10-18 00:14:25 | 000,178,688 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll [2013-10-18 00:14:12 | 000,079,360 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2013-10-18 00:14:08 | 000,216,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lagarith.dll [2013-10-18 00:14:06 | 000,715,038 | ---- | C] () -- C:\Windows\unins000.exe [2013-10-18 00:14:05 | 000,001,996 | ---- | C] () -- C:\Windows\unins000.dat [2013-05-21 22:42:52 | 000,003,688 | ---- | C] () -- C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml [2013-02-03 23:15:45 | 000,151,552 | ---- | C] () -- C:\Windows\KMService.exe [2013-02-03 23:15:45 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\srvany.exe [2012-10-09 16:33:15 | 000,077,690 | ---- | C] () -- C:\ProgramData\qeyslszmmxtuxix [2012-09-16 17:50:23 | 000,235,008 | RHS- | C] () -- C:\Windows\SysWow64\FltEng.dll [2012-09-16 17:50:23 | 000,061,440 | RHS- | C] () -- C:\Windows\SysWow64\secpro.exe [2012-08-16 16:16:37 | 000,258,048 | ---- | C] () -- C:\Windows\SysWow64\libFLAC.dll [2012-06-13 22:27:34 | 001,675,776 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012-06-11 20:35:52 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\acovcnt.exe [2012-06-11 19:34:47 | 000,283,304 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012-06-11 19:34:46 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011-04-01 10:21:01 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe [color=#E56717]========== ZeroAccess Check ==========[/color] [2009-07-14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013-02-27 06:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013-02-27 05:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009-07-14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010-11-20 13:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009-07-14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] [color=#E56717]========== LOP Check ==========[/color] [2012-10-04 15:24:46 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\(B8-D9-CE-B1-0F-04) [2012-08-18 21:50:44 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\.minecraft [2013-10-18 00:14:25 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z [2012-11-23 23:36:37 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\Aeria Games & Entertainment [2014-03-03 16:53:53 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\AIMP3 [2012-06-11 21:51:56 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\ASUS WebStorage [2013-10-18 12:13:09 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\BabSolution [2012-07-05 18:57:56 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\Babylon [2013-12-29 20:32:13 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\Bonanza [2013-10-18 00:14:11 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\CDXReader [2013-05-11 17:23:12 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\DAEMON Tools Lite [2012-10-02 18:15:46 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\DAEMON Tools Pro [2013-10-18 00:13:12 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\DigitalSite [2014-02-15 10:14:13 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\DigitalSites [2012-12-04 19:33:29 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\Gadu-Gadu 10 [2014-03-07 19:26:09 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\GHISLER [2012-10-02 18:24:47 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\InterTrust [2013-02-17 20:57:19 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\KTW [2013-10-18 00:14:19 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\LavFilters [2012-10-06 14:17:47 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\Media Finder [2012-11-04 22:25:08 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\Nokia [2012-11-04 22:25:08 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\Nokia Suite [2012-08-08 19:45:20 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\Nuance [2012-06-23 23:20:02 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\OpenFM [2014-03-06 20:22:32 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\Opera Software [2012-06-11 16:31:51 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\Origin [2012-10-07 05:27:34 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\PC Suite [2014-02-16 22:33:12 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\PhotoScape [2012-10-09 02:51:21 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\Samsung [2014-03-07 19:44:43 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\SaveSense [2014-03-04 19:57:51 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\SecureSearch [2014-01-20 16:24:47 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\SoftGrid Client [2014-02-26 20:38:28 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\SupTab [2012-06-13 22:28:18 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\TP [2014-03-08 02:13:04 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\TS3Client [2014-02-15 10:32:33 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\UpdateBonanza [2013-07-30 12:26:38 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\uTorrent [2014-02-26 20:38:35 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\WinZipper [2012-07-11 22:09:28 | 000,000,000 | ---D | M] -- C:\Users\marlena\AppData\Roaming\Zeon [color=#E56717]========== Purity Check ==========[/color] < End of report >