OTL logfile created on: 2014-11-04 19:45:36 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Asus\Downloads Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.11.9600.17358) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1011,95 Mb Total Physical Memory | 254,92 Mb Available Physical Memory | 25,19% Memory free 1,99 Gb Paging File | 0,66 Gb Available in Paging File | 33,31% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 114,90 Gb Total Space | 93,62 Gb Free Space | 81,48% Space Free | Partition Type: NTFS Drive D: | 183,07 Gb Total Space | 182,89 Gb Free Space | 99,90% Space Free | Partition Type: NTFS Drive E: | 46,77 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: ASUS-KOMPUTER | User Name: Asus | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2014-11-04 19:18:56 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Asus\Downloads\OTL.exe PRC - [2014-11-04 17:32:29 | 000,123,680 | ---- | M] () -- C:\ProgramData\d7a0fe93-7bf3-4f3d-89c3-fe4e144b2eb8\maintainer.exe PRC - [2014-10-22 05:05:02 | 000,854,344 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe PRC - [2012-11-23 03:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2012-11-06 06:42:55 | 000,085,088 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\Internet Manager.exe PRC - [2012-05-20 16:04:02 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2011-06-17 12:04:16 | 000,224,096 | ---- | M] () -- C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe PRC - [2011-03-14 16:27:28 | 000,236,384 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\ProgramData\DataCardService\DCSHelper.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2014-10-22 05:04:57 | 008,910,664 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\38.0.2125.111\pdf.dll MOD - [2014-10-22 05:04:51 | 001,042,760 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\38.0.2125.111\libglesv2.dll MOD - [2014-10-22 05:04:49 | 000,211,272 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\38.0.2125.111\libegl.dll MOD - [2014-10-22 05:04:48 | 001,681,224 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\38.0.2125.111\ffmpegsumo.dll MOD - [2012-11-06 06:42:55 | 000,085,088 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\Internet Manager.exe MOD - [2012-11-06 05:31:00 | 000,148,992 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\VPNPlugin.dll MOD - [2012-11-06 05:30:42 | 000,110,080 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\ServiceUIPlugin.dll MOD - [2012-11-06 05:30:10 | 000,139,776 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\HelpUIPlugin.dll MOD - [2012-11-06 05:29:07 | 000,423,424 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\USSDUIPlugin.dll MOD - [2012-11-06 05:24:22 | 000,303,104 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\SettingUIPlugin.dll MOD - [2012-11-06 05:14:06 | 000,142,336 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\USSDSrvPlugin.dll MOD - [2012-09-25 02:05:39 | 000,820,104 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\MiniFramePlugin.dll MOD - [2012-09-24 12:51:37 | 000,309,128 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\XFramePlugin.dll MOD - [2012-09-24 12:51:35 | 000,174,984 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\XCodec.dll MOD - [2012-09-24 12:51:30 | 000,141,704 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\Trace.dll MOD - [2012-09-24 12:51:29 | 000,325,000 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\StatusBarMgrPlugin.dll MOD - [2012-09-24 12:51:27 | 000,845,704 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\SMSUIPlugin.dll MOD - [2012-09-24 12:51:25 | 000,225,160 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\SmsSrvPlugin.dll MOD - [2012-09-24 12:51:23 | 000,692,104 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\SmsAppPlugin.dll MOD - [2012-09-24 12:51:18 | 000,281,992 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\sdk.dll MOD - [2012-09-24 12:51:16 | 000,396,168 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\Proxy.dll MOD - [2012-09-24 12:51:14 | 000,551,304 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\PluginContainer.dll MOD - [2012-09-24 12:51:13 | 000,071,560 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\OSPowerMgr.dll MOD - [2012-09-24 12:51:11 | 000,137,608 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\OSNDIS.dll MOD - [2012-09-24 12:51:09 | 000,139,656 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\OSDialup.dll MOD - [2012-09-24 12:51:06 | 000,107,912 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\OSAdapt.dll MOD - [2012-09-24 12:51:04 | 000,103,304 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\NotifyServicePlugin.dll MOD - [2012-09-24 12:51:02 | 000,242,568 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\NetSrvPlugin.dll MOD - [2012-09-24 12:51:01 | 000,506,760 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\NetSettingPlugin.dll MOD - [2012-09-24 12:50:59 | 000,523,656 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\NetInfoUIExPlugin.dll MOD - [2012-09-24 12:50:57 | 000,301,960 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\NetInfoSrvPlugin.dll MOD - [2012-09-24 12:50:55 | 000,314,760 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\NetInfoRecordUIPlugin.dll MOD - [2012-09-24 12:50:54 | 000,164,744 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\NetConnectSrvPlugin.dll MOD - [2012-09-24 12:50:52 | 000,336,264 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\NetConnectPlugin.dll MOD - [2012-09-24 12:50:50 | 000,185,224 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\NDISPlugin.dll MOD - [2012-09-24 12:50:47 | 000,277,384 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\MenuMgrPlugin.dll MOD - [2012-09-24 12:50:45 | 000,123,272 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\LayoutPlugin.dll MOD - [2012-09-24 12:50:41 | 000,424,840 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\DialupUIPlugin.dll MOD - [2012-09-24 12:50:40 | 000,217,992 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\DialUpPlugin.dll MOD - [2012-09-24 12:50:38 | 000,418,184 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\DiagnosisPlugin.dll MOD - [2012-09-24 12:50:36 | 000,306,568 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\DeviceSrvPlugin.dll MOD - [2012-09-24 12:50:34 | 000,565,640 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\DeviceMgrUIPlugin.dll MOD - [2012-09-24 12:50:32 | 000,343,432 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\DeviceAppPlugin.dll MOD - [2012-09-24 12:50:26 | 000,163,208 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\DataServicePlugin.dll MOD - [2012-09-24 12:50:23 | 000,432,008 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\core.dll MOD - [2012-09-24 12:50:21 | 000,106,376 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\CompressRatePlugin.dll MOD - [2012-09-24 12:50:19 | 000,228,232 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\Common.dll MOD - [2012-09-24 12:50:18 | 000,129,928 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\ATR2SMgr.dll MOD - [2012-09-24 12:50:16 | 000,245,128 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\AtCodec.dll MOD - [2012-09-24 12:50:14 | 000,811,912 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\AddrBookUIPlugin.dll MOD - [2012-09-24 12:50:08 | 000,268,680 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\AddrBookSrvPlugin.dll MOD - [2012-09-24 12:50:06 | 001,093,000 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\AddrBookPlugin.dll MOD - [2012-05-18 01:40:24 | 000,120,192 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\Win7Support.dll MOD - [2012-05-18 01:39:11 | 001,107,328 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\NDISAPI.dll MOD - [2012-05-18 01:38:59 | 000,250,752 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\LiveUpdateInterface.dll MOD - [2010-06-04 10:31:46 | 000,082,944 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\plugins\imageformats\qgif4.dll MOD - [2010-06-04 10:31:46 | 000,081,920 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\plugins\imageformats\qico4.dll MOD - [2010-05-05 09:47:36 | 002,415,104 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\QtCore4.dll MOD - [2010-02-10 15:43:38 | 009,515,520 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\QtGui4.dll MOD - [2010-02-10 15:10:26 | 001,148,416 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\QtNetwork4.dll MOD - [2010-02-10 15:06:52 | 000,398,336 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\QtXml4.dll MOD - [2009-06-22 19:42:42 | 000,043,008 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\libgcc_s_dw2-1.dll MOD - [2009-01-10 11:32:40 | 000,011,362 | ---- | M] () -- C:\Program Files\T-Mobile\InternetManager_H\mingwm10.dll [color=#E56717]========== Services (SafeList) ==========[/color] SRV - [2014-11-04 17:32:29 | 000,123,680 | ---- | M] () [Auto | Running] -- C:\ProgramData\d7a0fe93-7bf3-4f3d-89c3-fe4e144b2eb8\maintainer.exe -- (MaintainerSvc2.02.5636706) SRV - [2014-10-14 12:37:18 | 000,114,288 | ---- | M] (Mozilla Foundation) [Disabled | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2014-09-19 01:50:15 | 000,108,032 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\IEEtwCollector.exe -- (IEEtwCollectorService) SRV - [2014-05-08 12:10:32 | 000,257,712 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013-05-27 05:57:27 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2013-02-04 17:43:22 | 000,155,824 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion) SRV - [2012-09-23 19:43:34 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012-01-11 00:41:30 | 000,224,680 | ---- | M] () [Disabled | Stopped] -- C:\Windows\System32\AsusService.exe -- (AsusService) SRV - [2011-08-02 13:31:22 | 000,146,592 | ---- | M] (Atheros) [Disabled | Stopped] -- C:\Program Files\Bluetooth Suite\Ath_CoexAgent.exe -- (Atheros Bt&Wlan Coex Agent) SRV - [2011-08-02 12:54:52 | 000,082,592 | ---- | M] (Atheros Commnucations) [Disabled | Stopped] -- C:\Program Files\Bluetooth Suite\AdminService.exe -- (AtherosSvc) SRV - [2011-06-17 12:04:16 | 000,224,096 | ---- | M] () [Auto | Stopped] -- C:\Program Files\T-Mobile\InternetManager_H\UpdateDog\ouc.exe -- (Internet Manager. RunOuc) SRV - [2011-03-14 16:27:28 | 000,271,712 | ---- | M] () [Auto | Stopped] -- C:\ProgramData\DataCardService\HWDeviceService.exe -- (HWDeviceService.exe) SRV - [2010-11-05 22:54:22 | 000,013,336 | ---- | M] (Intel Corporation) [Disabled | Stopped] -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | System | Stopped] -- C:\Windows\system32\drivers\tcpipBM.sys -- (tcpipBM) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbnet.sys -- (ewusbnet) DRV - File not found [Kernel | Boot | Stopped] -- system32\drivers\BMLoad.sys -- (BMLoad) DRV - [2014-10-29 14:50:46 | 000,043,200 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\System32\drivers\{7e4355b8-96cd-43eb-b59a-82af29f01b16}w.sys -- ({7e4355b8-96cd-43eb-b59a-82af29f01b16}w) DRV - [2014-07-13 16:59:22 | 000,110,296 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy) DRV - [2014-05-08 12:55:30 | 000,013,880 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr) DRV - [2014-05-08 12:55:27 | 000,278,528 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcDAud.sys -- (IntcDAud) DRV - [2014-05-08 12:55:02 | 001,344,512 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\igddim32.sys -- (igddim32) DRV - [2014-05-08 12:54:42 | 000,087,152 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1C60x86.sys -- (L1C) DRV - [2013-02-21 14:20:36 | 000,068,480 | ---- | M] (MediaTek Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usb2ser.sys -- (wdf_usb) DRV - [2012-12-13 02:49:54 | 000,172,544 | ---- | M] (MediaTek Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mtkmbim7.sys -- (mtkmbim) DRV - [2012-09-18 09:20:45 | 000,203,264 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_juwwanecm.sys -- (huawei_wwanecm) DRV - [2012-08-20 01:54:19 | 000,027,520 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_juextctrl.sys -- (huawei_ext_ctrl) DRV - [2012-08-20 01:54:18 | 000,096,000 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_jucdcacm.sys -- (huawei_cdcacm) DRV - [2012-08-20 01:54:18 | 000,076,544 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_jubusenum.sys -- (huawei_enumerator) DRV - [2011-12-31 02:20:23 | 000,199,168 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2011-08-10 11:56:46 | 000,067,968 | ---- | M] (ZTE) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\zte_cdc_acm.sys -- (zte_cdc_acm) DRV - [2011-08-10 11:56:46 | 000,009,984 | ---- | M] (ZTE) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\zte_cpo.sys -- (zte_cpo) DRV - [2011-08-02 13:02:18 | 000,025,248 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btath_bus.sys -- (BTATH_BUS) DRV - [2010-11-20 22:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010-11-20 22:29:03 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2010-11-20 22:29:03 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbGD.sys -- (TsUsbGD) DRV - [2010-07-27 02:52:02 | 000,102,784 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ew_hwusbdev.sys -- (ew_hwusbdev) DRV - [2010-03-20 05:06:58 | 000,011,136 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_usbenumfilter.sys -- (ew_usbenumfilter) DRV - [2009-07-13 23:02:46 | 001,096,704 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = www.google.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.google.com IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://rocket-find.com/results.php?f=4&q={searchTerms}&a=rckt_ir_14_30_ch&cd=2XzuyEtN2Y1L1Qzu0D0CzzyD0D0EtCtD0Czz0CyB0BtA0BtAtN0D0Tzu0SzytAzztN1L2XzutAtFtDtFtBtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyB0ByCyC0DyCyCyDtG0AyDyB0CtGyCtCzyzytGtBtBzy0BtGyBtDzyzzyB0ByDtAzy0AyCtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2StC0D0A0E0EyEyDtAtGtDzyzz0BtG0CyD0DtBtGtB0CtAzytGyByB0CtC0D0DyCtCzz0F0F0F2Q&cr=34284458&ir= IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://speedial.com/results.php?f=4&q={searchTerms}&a=spd_ir_14_25_ff&cd=2XzuyEtN2Y1L1Qzu0D0CzzyD0D0EtCtD0Czz0CyB0BtA0BtAtN0D0Tzu0SzytDtBtN1L2XzutBtFtBtCtFyEtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StD0CyEyC0CtD0D0AtGtB0FyDyDtGyC0E0E0CtGzztB0D0FtGtAyCtAyB0FtB0FzzzytDyE0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StC0D0A0E0EyEyDtAtGtDzyzz0BtG0CyD0DtBtGtB0CtAzytGyByB0CtC0D0DyCtCzz0F0F0F2Q&cr=745011580&ir= IE - HKLM\..\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}: "URL" = http://feed.helperbar.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HzGso_TVx83Je_T_BzMLRIWufTx2Q_wNtRzzyCUETChR6PtXKymOTNCsIJaq9GTUIA2kFiHjYtwzpuW0XgZC2U2bwL1UuZDksHE8Xtk2OIVbg5kqWU6p4gVmMR5BRbXSu9iIEEhwIjhv8cZ7_bB-Q,,&q={searchTerms} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback> IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:51496;https=127.0.0.1:51496 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback> IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:51496;https=127.0.0.1:51496 IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3886030683-2889538507-278638460-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank IE - HKU\S-1-5-21-3886030683-2889538507-278638460-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9ho0X2xYDGc_QKYgplvE5AaQJzeB2jLGE-NmAMe2pSqyMGjluaNMH2Lwui4h00BhpjYKICu2Pnpv-lsq1y9QEQ5ND3aP10UZdhn9oleyYVod4v05SvQQ_TEYpag8GxERTDYS_NHRY0Y1w4w2KPvEauee6zxqPpc6yLbww,,&q={searchTerms} IE - HKU\S-1-5-21-3886030683-2889538507-278638460-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9ho0X2xYDGc_QKYgplvE5AaQJzeB2jLGE-NmAMe2pSqyMGjluaNMH2Lwui4h00BhpjYKICu2Pnpv-lsq1y9QEQ5ND3aP10UZdhn9oleyYVod4v05SvQQ_TEYpag8GxERTDYS_NHRY0Y1w4w2KPvEauee6zxqPpc6yLbww,,&q={searchTerms} IE - HKU\S-1-5-21-3886030683-2889538507-278638460-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://rts.dsrlte.com IE - HKU\S-1-5-21-3886030683-2889538507-278638460-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9ho0X2xYDGc_QKYgplvE5AaQJzeB2jLGE-NmAMe2pSqyMGjluaNMH2Lwui4h00BhpjYKICu2Pnpv-lsq1y9QEQ5ND3aP10UZdhn9oleyYVod4v05SvQQ_TEYpag8GxERTDYS_NHRY0Y1w4w2KPvEauee6zxqPpc6yLbww,,&q={searchTerms} IE - HKU\S-1-5-21-3886030683-2889538507-278638460-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9ho0X2xYDGc_QKYgplvE5AaQJzeB2jLGE-NmAMe2pSqyMGjluaNMH2Lwui4h00BhpjYKICu2Pnpv-lsq1y9QEQ5ND3aP10UZdhn9oleyYVod4v05SvQQ_TEYpag8GxERTDYS_NHRY0Y1w4w2KPvEauee6zxqPpc6yLbww,,&q={searchTerms} IE - HKU\S-1-5-21-3886030683-2889538507-278638460-1000\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} IE - HKU\S-1-5-21-3886030683-2889538507-278638460-1000\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9ho0X2xYDGc_QKYgplvE5AaQJzeB2jLGE-NmAMe2pSqyMGjluaNMH2Lwui4h00BhpjYKICu2Pnpv-lsq1y9QEQ5ND3aP10UZdhn9oleyYVod4v05SvQQ_TEYpag8GxERTDYS_NHRY0Y1w4w2KPvEauee6zxqPpc6yLbww,,&q={searchTerms} IE - HKU\S-1-5-21-3886030683-2889538507-278638460-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://speedial.com/results.php?f=4&q={searchTerms}&a=spd_ir_14_25_ff&cd=2XzuyEtN2Y1L1Qzu0D0CzzyD0D0EtCtD0Czz0CyB0BtA0BtAtN0D0Tzu0SzytDtBtN1L2XzutBtFtBtCtFyEtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StD0CyEyC0CtD0D0AtGtB0FyDyDtGyC0E0E0CtGzztB0D0FtGtAyCtAyB0FtB0FzzzytDyE0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StC0D0A0E0EyEyDtAtGtDzyzz0BtG0CyD0DtBtGtB0CtAzytGyByB0CtC0D0DyCtCzz0F0F0F2Q&cr=745011580&ir= IE - HKU\S-1-5-21-3886030683-2889538507-278638460-1000\..\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR IE - HKU\S-1-5-21-3886030683-2889538507-278638460-1000\..\SearchScopes\{67B8B507-6308-4F8C-9088-BB9F905A8E16}: "URL" = https://www.google.com/search?q={searchTerms} IE - HKU\S-1-5-21-3886030683-2889538507-278638460-1000\..\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}: "URL" = http://feed.helperbar.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HzGso_TVx83Je_T_BzMLRIWufTx2Q_wNtRzzyCUETChR6PtXKymOTNCsIJaq9GTUIA2kFiHjYtwzpuW0XgZC2U2bwL1UuZDksHE8Xtk2OIVbg5kqWU6p4gVmMR5BRbXSu9iIEEhwIjhv8cZ7_bB-Q,,&q={searchTerms} IE - HKU\S-1-5-21-3886030683-2889538507-278638460-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultenginename: "Search The Web (SearchTape)" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..extensions.enabledAddons: %7B7e4355b8-96cd-43eb-b59a-82af29f01b16%7D:1.0.1 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:32.0.3 FF - prefs.js..keyword.URL: "" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_206.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.60.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.60.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Asus\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files\T-Mobile\InternetManager_Z\Bin\addon [2010-04-01 13:29:34 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 32.0.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 32.0.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2014-05-08 12:03:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Asus\AppData\Roaming\mozilla\Extensions [2014-10-30 03:16:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Asus\AppData\Roaming\mozilla\Firefox\Profiles\52afl2u5.default\extensions [2014-10-30 03:16:26 | 000,008,525 | ---- | M] () (No name found) -- C:\Users\Asus\AppData\Roaming\mozilla\firefox\profiles\52afl2u5.default\extensions\{7e4355b8-96cd-43eb-b59a-82af29f01b16}.xpi [2014-11-04 16:44:41 | 000,001,148 | ---- | M] () -- C:\Users\Asus\AppData\Roaming\mozilla\firefox\profiles\52afl2u5.default\searchplugins\dsrlte.xml [2014-10-12 19:08:11 | 000,022,883 | ---- | M] () -- C:\Users\Asus\AppData\Roaming\mozilla\firefox\profiles\52afl2u5.default\searchplugins\SafeFinder Search.xml [2014-08-27 15:48:05 | 000,002,822 | ---- | M] () -- C:\Users\Asus\AppData\Roaming\mozilla\firefox\profiles\52afl2u5.default\searchplugins\WSE Rocket.xml [2014-05-08 11:59:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions [2014-10-14 12:37:20 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [color=#E56717]========== Chrome ==========[/color] CHR - default_search_provider: () CHR - default_search_provider: search_url = CHR - default_search_provider: suggest_url = CHR - plugin: Error reading preferences file CHR - Extension: No name found = C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_1\ CHR - Extension: No name found = C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_1\ CHR - Extension: No name found = C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1\ CHR - Extension: No name found = C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_1\ CHR - Extension: No name found = C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_2\ O1 HOSTS File: ([2009-06-10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) O13 - gopher Prefix: missing O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{44261C52-54FD-47E0-9F84-01316CF8FB1A}: DhcpNameServer = 192.168.178.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7C183F64-6487-46E8-97A3-142BBD721386}: DhcpNameServer = 192.168.42.129 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C924E81D-8DB8-418C-ABB0-E953B3C096A3}: DhcpNameServer = 192.168.2.1 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-06-10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2011-03-20 08:27:22 | 000,148,320 | R--- | M] () - E:\AutoRun.exe -- [ CDFS ] O32 - AutoRun File - [2009-10-01 19:46:52 | 000,000,045 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{1618f30a-de92-11e3-b54f-10bf489a8d3b}\Shell - "" = AutoRun O33 - MountPoints2\{1618f30a-de92-11e3-b54f-10bf489a8d3b}\Shell\AutoRun\command - "" = G:\Startme.exe O33 - MountPoints2\{1618f33c-de92-11e3-b54f-10bf489a8d3b}\Shell - "" = AutoRun O33 - MountPoints2\{1618f33c-de92-11e3-b54f-10bf489a8d3b}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2011-03-20 08:27:22 | 000,148,320 | R--- | M] () O33 - MountPoints2\{1618f34a-de92-11e3-b54f-10bf489a8d3b}\Shell - "" = AutoRun O33 - MountPoints2\{1618f34a-de92-11e3-b54f-10bf489a8d3b}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2011-03-20 08:27:22 | 000,148,320 | R--- | M] () O33 - MountPoints2\{277c053a-e138-11e3-b73e-aeb3223b5bbe}\Shell - "" = AutoRun O33 - MountPoints2\{277c053a-e138-11e3-b73e-aeb3223b5bbe}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2011-03-20 08:27:22 | 000,148,320 | R--- | M] () O33 - MountPoints2\{277c0556-e138-11e3-b73e-10bf489a8d3b}\Shell - "" = AutoRun O33 - MountPoints2\{277c0556-e138-11e3-b73e-10bf489a8d3b}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2011-03-20 08:27:22 | 000,148,320 | R--- | M] () O33 - MountPoints2\{277c0594-e138-11e3-b73e-10bf489a8d3b}\Shell - "" = AutoRun O33 - MountPoints2\{277c0594-e138-11e3-b73e-10bf489a8d3b}\Shell\AutoRun\command - "" = E:\windows\Install\Install.exe O33 - MountPoints2\{277c05b3-e138-11e3-b73e-10bf489a8d3b}\Shell - "" = AutoRun O33 - MountPoints2\{277c05b3-e138-11e3-b73e-10bf489a8d3b}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2011-03-20 08:27:22 | 000,148,320 | R--- | M] () O33 - MountPoints2\{9bf34857-56c4-11e4-b516-10bf489a8d3b}\Shell - "" = AutoRun O33 - MountPoints2\{9bf34857-56c4-11e4-b516-10bf489a8d3b}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2011-03-20 08:27:22 | 000,148,320 | R--- | M] () O33 - MountPoints2\{9bf34889-56c4-11e4-b516-10bf489a8d3b}\Shell - "" = AutoRun O33 - MountPoints2\{9bf34889-56c4-11e4-b516-10bf489a8d3b}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2011-03-20 08:27:22 | 000,148,320 | R--- | M] () O33 - MountPoints2\{c138974a-f27d-11e3-99f7-10bf489a8d3b}\Shell - "" = AutoRun O33 - MountPoints2\{c138974a-f27d-11e3-99f7-10bf489a8d3b}\Shell\AutoRun\command - "" = F:\.\StartModem.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2014-11-04 19:21:14 | 000,000,000 | ---D | C] -- C:\FRST [2014-11-04 15:41:19 | 000,000,000 | ---D | C] -- C:\Users\Asus\AppData\Local\Pay-By-Ads [2014-10-30 03:16:35 | 000,000,000 | ---D | C] -- C:\ProgramData\d7a0fe93-7bf3-4f3d-89c3-fe4e144b2eb8 [2014-10-30 02:46:49 | 000,043,200 | ---- | C] (StdLib) -- C:\Windows\System32\drivers\{7e4355b8-96cd-43eb-b59a-82af29f01b16}w.sys [2014-10-30 02:29:58 | 000,000,000 | ---D | C] -- C:\Windows\pss [2014-10-30 02:23:50 | 000,000,000 | ---D | C] -- C:\Windows\Minidump [2014-10-30 00:03:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Internet Manager [2014-10-30 00:02:09 | 000,861,696 | ---- | C] (DiBcom SA) -- C:\Windows\System32\drivers\mod7700.sys [2014-10-30 00:02:09 | 000,378,880 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ewusbwwan.sys [2014-10-30 00:02:09 | 000,203,264 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_juwwanecm.sys [2014-10-30 00:02:09 | 000,199,168 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ewusbmdm.sys [2014-10-30 00:02:09 | 000,102,784 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_hwusbdev.sys [2014-10-30 00:02:09 | 000,096,000 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_jucdcacm.sys [2014-10-30 00:02:09 | 000,076,544 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_jubusenum.sys [2014-10-30 00:02:09 | 000,069,760 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_jucdcecm.sys [2014-10-30 00:02:09 | 000,027,520 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_juextctrl.sys [2014-10-30 00:02:09 | 000,025,856 | ---- | C] (Huawei Tech. Co., Ltd.) -- C:\Windows\System32\drivers\ewdcsc.sys [2014-10-30 00:02:09 | 000,019,200 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_hwupgrade.sys [2014-10-30 00:02:09 | 000,011,136 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\System32\drivers\ew_usbenumfilter.sys [2014-10-14 22:00:41 | 000,108,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieetwcollector.exe [2014-10-14 22:00:41 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieetwproxystub.dll [2014-10-14 22:00:40 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\JavaScriptCollectionAgent.dll [2014-10-14 22:00:39 | 000,646,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MsSpellCheckingFacility.exe [2014-10-14 22:00:39 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2014-10-14 22:00:39 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2014-10-14 22:00:38 | 000,365,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll [2014-10-14 22:00:38 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieetwcollectorres.dll [2014-10-14 22:00:34 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll [2014-10-14 22:00:33 | 000,440,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2014-10-14 22:00:31 | 001,068,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmlmedia.dll [2014-10-14 22:00:29 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MshtmlDac.dll [2014-10-14 22:00:25 | 000,597,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9diag.dll [2014-10-14 22:00:24 | 004,201,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2014-10-14 22:00:17 | 000,677,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2014-10-14 22:00:17 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2014-10-14 22:00:15 | 000,678,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll [2014-10-14 22:00:15 | 000,331,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2014-10-14 22:00:14 | 002,724,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2014-10-14 22:00:14 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2014-10-14 22:00:12 | 002,017,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2014-10-14 22:00:11 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll [2014-10-14 22:00:11 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2014-10-14 21:57:23 | 002,379,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2014-10-14 21:55:25 | 000,156,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscorier.dll [2014-10-14 21:55:24 | 000,081,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscories.dll [2014-10-14 21:54:49 | 000,130,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll [2014-10-14 21:54:48 | 000,131,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\aaclient.dll [2014-10-14 21:54:47 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll [2014-10-14 21:53:34 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll [2014-10-14 21:52:50 | 000,744,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\blackbox.dll [2014-10-14 21:52:49 | 000,988,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drmv2clt.dll [2014-10-14 21:52:48 | 000,617,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmdrmsdk.dll [2014-10-14 21:52:38 | 003,208,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mf.dll [2014-10-14 21:52:33 | 000,442,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\AUDIOKSE.dll [2014-10-14 21:52:33 | 000,406,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drmmgrtn.dll [2014-10-14 21:52:32 | 000,521,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winload.exe [2014-10-14 21:52:32 | 000,455,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winresume.exe [2014-10-14 21:52:32 | 000,409,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ci.dll [2014-10-14 21:52:32 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\AudioSes.dll [2014-10-14 21:52:31 | 003,970,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2014-10-14 21:52:31 | 000,275,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDump.dll [2014-10-14 21:52:30 | 003,914,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2014-10-14 21:52:29 | 001,329,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll [2014-10-14 21:52:29 | 000,489,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\evr.dll [2014-10-14 21:52:28 | 000,354,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfplat.dll [2014-10-14 21:52:27 | 000,516,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll [2014-10-14 21:52:26 | 000,374,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\AudioEng.dll [2014-10-14 21:52:25 | 000,504,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msscp.dll [2014-10-14 21:52:25 | 000,265,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msnetobj.dll [2014-10-14 21:52:25 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\audiodg.exe [2014-10-14 21:52:24 | 000,103,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfps.dll [2014-10-14 21:52:24 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\appidpolicyconverter.exe [2014-10-14 21:52:24 | 000,050,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\appidapi.dll [2014-10-14 21:52:24 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\setbcdlocale.dll [2014-10-14 21:52:24 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rrinstaller.exe [2014-10-14 21:52:24 | 000,023,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfpmp.exe [2014-10-14 21:52:23 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\appidcertstorecheck.exe [2014-10-14 21:52:21 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spwmp.dll [2014-10-14 21:52:20 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdxm.ocx [2014-10-14 21:52:20 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxmasf.dll [2014-10-14 21:52:20 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mferror.dll [2014-10-14 21:52:19 | 012,625,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2014-11-04 19:55:01 | 000,020,720 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2014-11-04 19:55:01 | 000,020,720 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2014-11-04 19:43:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2014-11-04 19:30:03 | 000,001,036 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2014-11-04 19:09:02 | 000,000,930 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2014-11-04 19:07:03 | 000,000,288 | ---- | M] () -- C:\Windows\tasks\Rocket Updater.job [2014-11-04 17:19:55 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3886030683-2889538507-278638460-1000UA.job [2014-11-04 17:13:59 | 000,687,828 | ---- | M] () -- C:\Windows\System32\perfh015.dat [2014-11-04 17:13:59 | 000,607,190 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2014-11-04 17:13:59 | 000,131,382 | ---- | M] () -- C:\Windows\System32\perfc015.dat [2014-11-04 17:13:59 | 000,103,568 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2014-11-04 17:01:32 | 000,000,266 | RHS- | M] () -- C:\ProgramData\ntuser.pol [2014-11-04 17:01:30 | 000,001,032 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2014-11-04 17:01:03 | 795,824,128 | -HS- | M] () -- C:\hiberfil.sys [2014-11-04 16:45:49 | 000,000,244 | ---- | M] () -- C:\Windows\tasks\RegClean Pro_DEFAULT.job [2014-11-04 16:44:25 | 000,001,338 | ---- | M] () -- C:\Users\Asus\Desktop\Wyczyść rejestr za darmo!.lnk [2014-11-04 00:07:12 | 000,000,099 | ---- | M] () -- C:\Users\Asus\AppData\Roaming\WB.CFG [2014-10-30 22:58:00 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3886030683-2889538507-278638460-1000Core.job [2014-10-30 02:23:31 | 164,604,988 | ---- | M] () -- C:\Windows\MEMORY.DMP [2014-10-30 00:59:33 | 000,002,095 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2014-10-30 00:03:09 | 000,001,159 | ---- | M] () -- C:\Users\Public\Desktop\Internet Manager.lnk [2014-10-29 14:50:46 | 000,043,200 | ---- | M] (StdLib) -- C:\Windows\System32\drivers\{7e4355b8-96cd-43eb-b59a-82af29f01b16}w.sys [2014-10-28 06:35:00 | 000,229,000 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe [2014-10-18 13:46:20 | 000,266,064 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2014-10-18 08:55:49 | 000,000,252 | ---- | M] () -- C:\Windows\tasks\RegClean Pro_UPDATES.job [2014-10-07 03:04:46 | 000,331,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [color=#E56717]========== Files Created - No Company Name ==========[/color] [2014-11-04 17:01:32 | 000,000,266 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2014-10-30 02:23:31 | 164,604,988 | ---- | C] () -- C:\Windows\MEMORY.DMP [2014-10-30 00:03:09 | 000,001,159 | ---- | C] () -- C:\Users\Public\Desktop\Internet Manager.lnk [2014-08-03 21:02:15 | 000,000,099 | ---- | C] () -- C:\Users\Asus\AppData\Roaming\WB.CFG [2014-07-22 19:15:32 | 000,018,280 | ---- | C] () -- C:\Windows\System32\roboot.exe [2014-05-08 14:26:18 | 000,224,680 | ---- | C] () -- C:\Windows\System32\AsusService.exe [2014-05-08 14:26:17 | 000,025,616 | ---- | C] () -- C:\Windows\AsAcpiSvrLang.ini [2014-05-08 14:01:23 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [color=#E56717]========== ZeroAccess Check ==========[/color] [2009-07-14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2014-03-25 03:09:54 | 012,874,240 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010-11-20 22:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009-07-14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [color=#E56717]========== LOP Check ==========[/color] [2014-06-13 18:20:52 | 000,000,000 | ---D | M] -- C:\Users\Asus\AppData\Roaming\AVG [2014-05-08 15:05:28 | 000,000,000 | ---D | M] -- C:\Users\Asus\AppData\Roaming\AVG2014 [2014-10-30 02:26:16 | 000,000,000 | ---D | M] -- C:\Users\Asus\AppData\Roaming\GG [2014-06-12 22:59:17 | 000,000,000 | ---D | M] -- C:\Users\Asus\AppData\Roaming\InternetManager_Z [2014-06-22 14:16:36 | 000,000,000 | ---D | M] -- C:\Users\Asus\AppData\Roaming\Opera Software [2014-05-21 21:25:15 | 000,000,000 | ---D | M] -- C:\Users\Asus\AppData\Roaming\PLAY ONLINE [2014-07-27 09:07:38 | 000,000,000 | ---D | M] -- C:\Users\Asus\AppData\Roaming\RocketUpdater [2014-07-22 19:15:43 | 000,000,000 | ---D | M] -- C:\Users\Asus\AppData\Roaming\Systweak [2014-05-08 15:04:32 | 000,000,000 | ---D | M] -- C:\Users\Asus\AppData\Roaming\TuneUp Software [2014-06-28 11:04:47 | 000,000,000 | ---D | M] -- C:\Users\Asus\AppData\Roaming\{6f5d0382-9e3f-36f0-bd24-a17e270b8543} [2014-06-05 22:04:24 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\TuneUp Software [2014-06-05 22:04:24 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\TuneUp Software [color=#E56717]========== Purity Check ==========[/color] < End of report >