Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
and yes pc is mine as you can see from my name & pc user name ..... how ever i managed to get my password recover as i completly forgot
sorry Guestolo m late on response
but i had changed my laptop password & forget it unfortunately
can you please first guide me how to remove the password i have checked & done some tutorials form internet but failed to do so ...
please its off the topic but guide me to remove the pasword so i could perform your asked steps from last post
Thanks
system seems to be running good now........ but
have you found any such traces on my system after these logs.....
Again the Extras.txt didn\'t popped up & also it is not on desktop
what should i do ?
# AdwCleaner v2.306 - Logfile created 07/25/2013 at 04:36:30
couldn\'t locate the extras.log of otl scan & it also didn\'t popped up
My system got infected with viruses
& hijack no producing the log got the error see the attachment
and i have doubts some one had put his script in my system as he his hacking my system & email ids
******************************************************************************************************************************************************************
OTL Extras logfile created on: 7/2/2013 2:07:24 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\\Documents and Settings\\Administrator\\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1015.35 Mb Total Physical Memory | 535.04 Mb Available Physical Memory | 52.70% Memory free
2.38 Gb Paging File | 1.97 Gb Available in Paging File | 82.79% Paging File free
Paging file location(s): C:\\pagefile.sys 1524 3048 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\\WINDOWS | %ProgramFiles% = C:\\Program Files
Drive C: | 24.99 Gb Total Space | 14.65 Gb Free Space | 58.61% Space Free | Partition Type: FAT32
Drive D: | 25.00 Gb Total Space | 3.98 Gb Free Space | 15.93% Space Free | Partition Type: NTFS
Drive E: | 49.70 Gb Total Space | 2.90 Gb Free Space | 5.84% Space Free | Partition Type: NTFS
Drive F: | 49.34 Gb Total Space | 3.59 Gb Free Space | 7.27% Space Free | Partition Type: NTFS
Computer Name: HP-AC60887941E4 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL \"%1\",%*
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\<key>\\shell\\[command]\\command]
batfile [open] -- \"%1\" %*
cmdfile [open] -- \"%1\" %*
comfile [open] -- \"%1\" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL \"%1\",%*
exefile [open] -- \"%1\" %*
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- \"%1\" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- \"%1\"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- \"%1\" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\\system32\\rundll32.exe %SystemRoot%\\system32\\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- \"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file --playlist-enqueue \"%1\" ()
Directory [Bridge] -- C:\\Program Files\\Adobe\\Adobe Bridge CS5\\Bridge.exe \"%L\" (Adobe Systems, Inc.)
Directory [find] -- %SystemRoot%\\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- \"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file --no-playlist-enqueue \"%1\" ()
Folder [open] -- %SystemRoot%\\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center]
\"FirstRunDisabled\" = 1
\"AntiVirusDisableNotify\" = 1
\"FirewallDisableNotify\" = 1
\"UpdatesDisableNotify\" = 1
\"AntiVirusOverride\" = 0
\"FirewallOverride\" = 0
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\Monitoring]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\Monitoring\\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\Monitoring\\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\Monitoring\\KasperskyAntiVirus]
\"DisableMonitoring\" = 1
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\Monitoring\\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\Monitoring\\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\Monitoring\\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\Monitoring\\PandaFirewall]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\Monitoring\\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\Monitoring\\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\Monitoring\\SymantecFirewall]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\Monitoring\\TinyFirewall]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\Monitoring\\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\Monitoring\\TrendFirewall]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\Monitoring\\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore]
\"DisableSR\" = 1
[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Sr]
\"Start\" = 4
[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SrService]
\"Start\" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\DomainProfile]
[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile]
\"EnableFirewall\" = 1
\"DoNotAllowExceptions\" = 0
\"DisableNotifications\" = 0
[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\GloballyOpenPorts\\List]
\"1900:UDP\" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
\"2869:TCP\" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\DomainProfile\\AuthorizedApplications\\List]
\"%windir%\\system32\\sessmgr.exe\" = %windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
\"C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe\" = C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe:*:Enabled:McAfee Framework Service
[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List]
\"C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe\" = C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe:*:Enabled:McAfee Framework Service
\"C:\\Program Files\\Internet Download Manager\\IDMan.exe\" = C:\\Program Files\\Internet Download Manager\\IDMan.exe:*:Enabled:Internet Download Manager (IDM) -- (Tonec Inc.)
\"C:\\Documents and Settings\\Administrator\\Application Data\\uTorrent\\uTorrent.exe\" = C:\\Documents and Settings\\Administrator\\Application Data\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent Inc.)
\"C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Facebook\\Video\\Skype\\FacebookVideoCalling.exe\" = C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Facebook\\Video\\Skype\\FacebookVideoCalling.exe:*:Disabled:Facebook Video Calling Plugin -- (Skype Limited)
\"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE\" = C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Disabled:Microsoft Office Groove -- (Microsoft Corporation)
\"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE\" = C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Disabled:Microsoft Office OneNote -- (Microsoft Corporation)
\"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE\" = C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Disabled:Microsoft Office Outlook -- (Microsoft Corporation)
\"C:\\WINDOWS\\system32\\sessmgr.exe\" = C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall]
\"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}\" = Microsoft_VC90_ATL_x86
\"{08D2E121-7F6A-43EB-97FD-629B44903403}\" = Microsoft_VC90_CRT_x86
\"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}\" = Adobe Community Help
\"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}\" = Microsoft_VC80_ATL_x86
\"{15FEDA5F-141C-4127-8D7E-B962D1742728}\" = Adobe Photoshop CS5
\"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\" = WebFldrs XP
\"{45A66726-69BC-466B-A7A4-12FCBA4883D7}\" = HiJackThis
\"{560985FB-4B76-4121-9189-7A2CDC7886D6}\" = Kaspersky Anti-Virus 2013
\"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}\" = Microsoft_VC90_MFC_x86
\"{8A708DD8-A5E6-11D4-A706-000629E95E20}\" = Intel(R) Graphics Media Accelerator Driver
\"{90120000-0010-0409-0000-0000000FF1CE}\" = Microsoft Software Update for Web Folders (English) 12
\"{90120000-0015-0409-0000-0000000FF1CE}\" = Microsoft Office Access MUI (English) 2007
\"{90120000-0016-0409-0000-0000000FF1CE}\" = Microsoft Office Excel MUI (English) 2007
\"{90120000-0018-0409-0000-0000000FF1CE}\" = Microsoft Office PowerPoint MUI (English) 2007
\"{90120000-0019-0409-0000-0000000FF1CE}\" = Microsoft Office Publisher MUI (English) 2007
\"{90120000-001A-0409-0000-0000000FF1CE}\" = Microsoft Office Outlook MUI (English) 2007
\"{90120000-001B-0409-0000-0000000FF1CE}\" = Microsoft Office Word MUI (English) 2007
\"{90120000-001F-0409-0000-0000000FF1CE}\" = Microsoft Office Proof (English) 2007
\"{90120000-001F-040C-0000-0000000FF1CE}\" = Microsoft Office Proof (French) 2007
\"{90120000-001F-0C0A-0000-0000000FF1CE}\" = Microsoft Office Proof (Spanish) 2007
\"{90120000-002C-0409-0000-0000000FF1CE}\" = Microsoft Office Proofing (English) 2007
\"{90120000-0030-0000-0000-0000000FF1CE}\" = Microsoft Office Enterprise 2007
\"{90120000-0044-0409-0000-0000000FF1CE}\" = Microsoft Office InfoPath MUI (English) 2007
\"{90120000-006E-0409-0000-0000000FF1CE}\" = Microsoft Office Shared MUI (English) 2007
\"{90120000-00A1-0409-0000-0000000FF1CE}\" = Microsoft Office OneNote MUI (English) 2007
\"{90120000-00BA-0409-0000-0000000FF1CE}\" = Microsoft Office Groove MUI (English) 2007
\"{90120000-0114-0409-0000-0000000FF1CE}\" = Microsoft Office Groove Setup Metadata MUI (English) 2007
\"{90120000-0115-0409-0000-0000000FF1CE}\" = Microsoft Office Shared Setup Metadata MUI (English) 2007
\"{90120000-0117-0409-0000-0000000FF1CE}\" = Microsoft Office Access Setup Metadata MUI (English) 2007
\"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}\" = Microsoft_VC80_CRT_x86
\"{A2BCA9F1-566C-4805-97D1-7FDC93386723}\" = Adobe AIR
\"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}\" = PDF Settings CS5
\"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}\" = Facebook Video Calling 1.2.0.287
\"{D1A19B02-817E-4296-A45B-07853FD74D57}\" = Microsoft_VC80_MFC_x86
\"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}\" = Microsoft_VC80_MFCLOC_x86
\"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}\" = Adobe Media Player
\"{F0C2AD51-9F09-4B75-82EE-74DA80F708D8}\" = Nitro PDF Professional
\"6AF27CD11B617BED2F81E26729D33AF8338D453C\" = Windows Driver Package - Hewlett-Packard hp scanjet 3600 series (04/26/2007 9.0.0.0)
\"Adobe AIR\" = Adobe AIR
\"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\" = Adobe Community Help
\"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\" = Adobe Media Player
\"ENTERPRISE\" = Microsoft Office Enterprise 2007
\"Foxit Reader\" = Foxit Reader
\"GOM Player\" = GOM Player
\"InstallWIX_{560985FB-4B76-4121-9189-7A2CDC7886D6}\" = Kaspersky Anti-Virus 2013
\"Internet Download Manager\" = Internet Download Manager
\"KLiteCodecPack_is1\" = K-Lite Mega Codec Pack 1.53
\"USB Disk Security_is1\" = USB Disk Security
\"uTorrent\" = µTorrent
\"VLC media player\" = VLC media player 1.1.11
\"WinRAR archiver\" = WinRAR archiver
\"ZTEWireless-101_is1\" = EVDO BROADBAND PTCL
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall]
\"Google Chrome\" = Google Chrome
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 6/29/2013 3:04:08 AM | Computer Name = HP-AC60887941E4 | Source = Google Update | ID = 20
Description =
Error - 6/29/2013 3:08:01 AM | Computer Name = HP-AC60887941E4 | Source = LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The Error code is the first DWORD in Data section.
Error - 6/29/2013 3:08:04 AM | Computer Name = HP-AC60887941E4 | Source = LoadPerf | ID = 3006
Description = Unable to read the performance counter strings of the 009 language
ID. The Win32 status returned by the call is the first DWORD in Data section.
Error - 6/29/2013 3:11:33 AM | Computer Name = HP-AC60887941E4 | Source = Google Update | ID = 20
Description =
Error - 6/29/2013 5:07:03 AM | Computer Name = HP-AC60887941E4 | Source = Google Update | ID = 20
Description =
Error - 6/29/2013 5:10:43 AM | Computer Name = HP-AC60887941E4 | Source = LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The Error code is the first DWORD in Data section.
Error - 6/29/2013 5:10:46 AM | Computer Name = HP-AC60887941E4 | Source = LoadPerf | ID = 3006
Description = Unable to read the performance counter strings of the 009 language
ID. The Win32 status returned by the call is the first DWORD in Data section.
Error - 6/29/2013 5:11:04 AM | Computer Name = HP-AC60887941E4 | Source = LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The Error code is the first DWORD in Data section.
Error - 6/29/2013 5:11:07 AM | Computer Name = HP-AC60887941E4 | Source = LoadPerf | ID = 3006
Description = Unable to read the performance counter strings of the 009 language
ID. The Win32 status returned by the call is the first DWORD in Data section.
Error - 6/29/2013 7:03:32 AM | Computer Name = HP-AC60887941E4 | Source = Google Update | ID = 20
Description =
[ System Events ]
Error - 7/1/2013 9:06:37 AM | Computer Name = HP-AC60887941E4 | Source = Service Control Manager | ID = 7034
Description = The McAfee Validation Trust Protection Service service terminated
unexpectedly. It has done this 1 time(s).
Error - 7/1/2013 9:08:10 AM | Computer Name = HP-AC60887941E4 | Source = Service Control Manager | ID = 7031
Description = The McAfee McShield service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 5000 milliseconds:
Restart the service.
Error - 7/1/2013 9:15:54 AM | Computer Name = HP-AC60887941E4 | Source = Service Control Manager | ID = 7032
Description = The Service Control Manager tried to take a corrective action (Restart
the service) after the unexpected termination of the Windows Management Instrumentation
service, but this action failed with the following error: %%1056
Error - 7/1/2013 9:19:14 AM | Computer Name = HP-AC60887941E4 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.100.114 for the Network Card with network
address 0015604FC4CD has been denied by the DHCP server 0.0.0.0 (The DHCP Server
sent a DHCPNACK message).
Error - 7/1/2013 9:20:04 AM | Computer Name = HP-AC60887941E4 | Source = Service Control Manager | ID = 7034
Description = The McAfee Framework Service service terminated unexpectedly. It
has done this 1 time(s).
Error - 7/1/2013 9:23:26 AM | Computer Name = HP-AC60887941E4 | Source = Service Control Manager | ID = 7031
Description = The McAfee McShield service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 5000 milliseconds:
Restart the service.
Error - 7/1/2013 9:26:44 AM | Computer Name = HP-AC60887941E4 | Source = Service Control Manager | ID = 7034
Description = The StarWind iSCSI Service service terminated unexpectedly. It has
done this 1 time(s).
Error - 7/1/2013 9:32:56 AM | Computer Name = HP-AC60887941E4 | Source = Service Control Manager | ID = 7034
Description = The UDisk Monitor service terminated unexpectedly. It has done this
1 time(s).
Error - 7/1/2013 11:38:49 AM | Computer Name = HP-AC60887941E4 | Source = LDMS | ID = 16780239
Description = The Logical Disk Manager Service failed while registering for device
handle notifications on device \\\\?\\usbstor#cdrom&ven_zte&prod_usb_storage_fff1&rev_2.31#000000000002&0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}.
Win32 Error: 2.
Error - 7/1/2013 2:02:50 PM | Computer Name = HP-AC60887941E4 | Source = PSched | ID = 14107
Description = QoS [Adapter NDISWANIP]: The Packet Scheduler could not initialize
the virtual miniport with NDIS.
< End of report >
*******************************************************************************************************************************************************
OTL logfile created on: 7/2/2013 2:07:24 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\\Documents and Settings\\Administrator\\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1015.35 Mb Total Physical Memory | 535.04 Mb Available Physical Memory | 52.70% Memory free
2.38 Gb Paging File | 1.97 Gb Available in Paging File | 82.79% Paging File free
Paging file location(s): C:\\pagefile.sys 1524 3048 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\\WINDOWS | %ProgramFiles% = C:\\Program Files
Drive C: | 24.99 Gb Total Space | 14.65 Gb Free Space | 58.61% Space Free | Partition Type: FAT32
Drive D: | 25.00 Gb Total Space | 3.98 Gb Free Space | 15.93% Space Free | Partition Type: NTFS
Drive E: | 49.70 Gb Total Space | 2.90 Gb Free Space | 5.84% Space Free | Partition Type: NTFS
Drive F: | 49.34 Gb Total Space | 3.59 Gb Free Space | 7.27% Space Free | Partition Type: NTFS
Computer Name: HP-AC60887941E4 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013/07/02 13:25:56 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\\Documents and Settings\\Administrator\\Desktop\\OTL.exe
PRC - [2013/06/17 09:41:20 | 001,045,072 | ---- | M] (BitTorrent Inc.) -- C:\\Documents and Settings\\Administrator\\Application Data\\uTorrent\\uTorrent.exe
PRC - [2013/05/10 07:53:34 | 003,487,128 | ---- | M] (Tonec Inc.) -- C:\\Program Files\\Internet Download Manager\\IDMan.exe
PRC - [2013/01/14 14:41:14 | 000,356,376 | ---- | M] (Kaspersky Lab ZAO) -- C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 2013\\avp.exe
PRC - [2011/01/29 15:52:10 | 000,623,520 | ---- | M] (Zbshareware Lab) -- C:\\Program Files\\USB Disk Security\\USBGuard.exe
PRC - [2010/05/25 05:28:58 | 000,263,600 | ---- | M] (Tonec Inc.) -- C:\\Program Files\\Internet Download Manager\\IEMonitor.exe
PRC - [2009/08/25 09:15:12 | 000,262,144 | ---- | M] () -- C:\\Program Files\\EVDO BROADBAND PTCL\\bin\\MonServiceUDisk.exe
PRC - [2004/08/04 00:56:50 | 001,032,192 | ---- | M] (Microsoft Corporation) -- C:\\WINDOWS\\explorer.exe
========== Modules (No Company Name) ==========
MOD - [2013/01/14 14:41:16 | 001,310,136 | ---- | M] () -- C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 2013\\kpcengine.2.2.dll
MOD - [2012/08/17 21:38:56 | 000,479,160 | ---- | M] () -- C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 2013\\dblite.dll
MOD - [2009/08/25 09:15:12 | 000,262,144 | ---- | M] () -- C:\\Program Files\\EVDO BROADBAND PTCL\\bin\\MonServiceUDisk.exe
MOD - [2004/01/22 18:36:28 | 000,120,832 | ---- | M] () -- C:\\Program Files\\WinRAR\\RarExt.dll
========== Services (SafeList) ==========
SRV - [2013/01/14 14:41:14 | 000,356,376 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 2013\\avp.exe -- (AVP)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\\Program Files\\Common Files\\Adobe\\SwitchBoard\\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/08/25 09:15:12 | 000,262,144 | ---- | M] () [Auto | Running] -- C:\\Program Files\\EVDO BROADBAND PTCL\\bin\\MonServiceUDisk.exe -- (UDisk Monitor)
SRV - [2007/02/21 17:26:40 | 000,151,552 | ---- | M] () [On_Demand | Stopped] -- C:\\Program Files\\Common Files\\BCL Technologies\\easyPDF 5\\bepldr.exe -- (bepldr)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2013/02/13 14:26:02 | 000,033,512 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\\WINDOWS\\system32\\drivers\\taphss.sys -- (taphss)
DRV - [2013/01/14 14:41:12 | 000,586,584 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\\WINDOWS\\system32\\drivers\\klif.sys -- (KLIF)
DRV - [2013/01/14 14:41:12 | 000,043,608 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\\WINDOWS\\system32\\drivers\\kltdi.sys -- (kltdi)
DRV - [2013/01/14 14:41:12 | 000,024,920 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\\WINDOWS\\system32\\drivers\\klmouflt.sys -- (klmouflt)
DRV - [2013/01/14 14:41:12 | 000,024,408 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\\WINDOWS\\system32\\drivers\\klkbdflt.sys -- (klkbdflt)
DRV - [2012/08/13 16:49:44 | 000,144,344 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\\WINDOWS\\system32\\drivers\\kneps.sys -- (kneps)
DRV - [2012/06/27 14:09:08 | 000,035,672 | ---- | M] (Kaspersky Lab ZAO) [Kernel | On_Demand | Running] -- C:\\WINDOWS\\system32\\drivers\\klim5.sys -- (klim5)
DRV - [2012/06/19 17:28:12 | 000,136,024 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\\WINDOWS\\system32\\drivers\\kl1.sys -- (kl1)
DRV - [2012/04/23 04:26:26 | 000,108,448 | ---- | M] (Tonec Inc.) [Kernel | System | Running] -- C:\\WINDOWS\\system32\\drivers\\idmtdi.sys -- (IDMTDI)
DRV - [2009/07/21 16:04:16 | 000,104,704 | ---- | M] (ZTEMT Incorporated) [Kernel | On_Demand | Stopped] -- C:\\WINDOWS\\system32\\drivers\\CT_ZTEMT_U_USBSER.sys -- (ztemtusbser)
DRV - [2008/12/09 21:56:18 | 000,187,392 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\\WINDOWS\\system32\\drivers\\b57xp32.sys -- (b57w2k)
DRV - [2005/01/07 17:07:16 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\\WINDOWS\\system32\\drivers\\Hdaudio.sys -- (HdAudAddService)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Main,Local Page = %SystemRoot%\\system32\\blank.htm
IE - HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Main,Start Page = about:blank
IE - HKCU\\SOFTWARE\\Microsoft\\Internet Explorer\\Main,Start Page = about:blank
IE - HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings: \"ProxyEnable\" = 0
========== FireFox ==========
FF - HKLM\\Software\\MozillaPlugins\\@real.com/nppl3260;version=6.0.11.2321: C:\\Program Files\\K-Lite Codec Pack\\Real\\browser\\plugins\\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\\Software\\MozillaPlugins\\@real.com/nprpjplug;version=6.0.12.1483: C:\\Program Files\\K-Lite Codec Pack\\Real\\browser\\plugins\\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\\Software\\MozillaPlugins\\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKCU\\Software\\MozillaPlugins\\@Skype Limited.com/Facebook Video Calling Plugin: C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Facebook\\Video\\Skype\\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\\Software\\MozillaPlugins\\@tools.google.com/Google Update;version=3: C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Update\\1.3.21.145\\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\\Software\\MozillaPlugins\\@tools.google.com/Google Update;version=9: C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Update\\1.3.21.145\\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINE\\software\\mozilla\\Firefox\\Extensions\\\\[email protected]: C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 2013\\FFExt\\[email protected] [2013/07/01 23:02:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\\software\\mozilla\\Firefox\\Extensions\\\\[email protected]: C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 2013\\FFExt\\[email protected] [2013/07/01 23:02:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\\software\\mozilla\\Firefox\\Extensions\\\\[email protected]: C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 2013\\FFExt\\[email protected] [2013/07/01 23:02:14 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\\software\\mozilla\\SeaMonkey\\Extensions\\\\[email protected]: C:\\Documents and Settings\\Administrator\\Application Data\\IDM\\idmmzcc5 [2013/05/10 07:49:06 | 000,000,000 | ---D | M]
========== Chrome ==========
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - homepage: http://www.google.com/\'>http://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Chrome\\Application\\27.0.1453.116\\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Chrome\\Application\\27.0.1453.116\\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Chrome\\Application\\27.0.1453.116\\gcswf32.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\\Program Files\\Windows Media Player\\npdsplay.dll
CHR - plugin: Microsoft\\u00AE DRM (Enabled) = C:\\Program Files\\Windows Media Player\\npwmsdrm.dll
CHR - plugin: Microsoft\\u00AE DRM (Enabled) = C:\\Program Files\\Windows Media Player\\npdrmv2.dll
CHR - Extension: Kaspersky URL Advisor = C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\dchlnpcodkpfdpacogkljefecpegganj\\13.0.1.4190_0\\
CHR - Extension: Content Blocker = C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\hghkgaeecgjhjkannahfamoehjmkjail\\13.0.1.4190_0\\
CHR - Extension: Virtual Keyboard = C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\jagncdcchgajhfhijbbhecadmaiegcmh\\13.0.1.4190_0\\
CHR - Extension: Gmail = C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\7_1\\
O1 HOSTS File: ([2001/08/23 14:00:00 | 000,000,734 | ---- | M]) - C:\\WINDOWS\\system32\\drivers\\etc\\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (IDM integration (IDMIEHlprObj Class)) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\\Program Files\\Internet Download Manager\\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
O2 - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 2013\\IEExt\\ContentBlocker\\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 2013\\IEExt\\VirtualKeyboard\\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 2013\\IEExt\\UrlAdvisor\\klwtbbho.dll (Kaspersky Lab ZAO)
O4 - HKLM..\\Run: [AVP] C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 2013\\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\\Run: [USB Security] C:\\Program Files\\USB Disk Security\\USBGuard.exe (Zbshareware Lab)
O4 - HKCU..\\Run: [IDMan] C:\\Program Files\\Internet Download Manager\\IDMan.exe (Tonec Inc.)
O4 - HKCU..\\Run: [uTorrent] C:\\Documents and Settings\\Administrator\\Application Data\\uTorrent\\uTorrent.exe (BitTorrent Inc.)
O6 - HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\Explorer: NoDriveTypeAutoRun = 60
O7 - HKCU\\Software\\Policies\\Microsoft\\Internet Explorer\\Control Panel present
O7 - HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\Explorer: NoDriveTypeAutoRun = 36
O7 - HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\policies\\Explorer: NoDriveAutoRun = FF FF FF FF [binary data]
O8 - Extra context menu item: Download all links with IDM - C:\\Program Files\\Internet Download Manager\\IEGetAll.htm ()
O8 - Extra context menu item: Download with IDM - C:\\Program Files\\Internet Download Manager\\IEExt.htm ()
O9 - Extra Button: Virtual Keyboard - {0C4CC089-D306-440D-9772-464E226F6539} - C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 2013\\IEExt\\VirtualKeyboard\\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O9 - Extra Button: URLs check - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 2013\\IEExt\\UrlAdvisor\\klwtbbho.dll (Kaspersky Lab ZAO)
O17 - HKLM\\System\\CCS\\Services\\Tcpip\\Parameters\\Interfaces\\{03E48A69-FD25-4691-9BDC-99CDA7FFF656}: DhcpNameServer = 192.168.100.254
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\\WINDOWS\\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\\WINDOWS\\system32\\userinit.exe) - C:\\WINDOWS\\system32\\userinit.exe (Microsoft Corporation)
O20 - Winlogon\\Notify\\klogon: DllName - (C:\\WINDOWS\\system32\\klogon.dll) - C:\\WINDOWS\\system32\\klogon.dll (Kaspersky Lab ZAO)
O24 - Desktop WallPaper: C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Microsoft\\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Microsoft\\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2013/03/18 07:27:18 | 000,000,000 | ---- | M] () - C:\\AUTOEXEC.BAT -- [ FAT32 ]
O32 - AutoRun File - [2013/07/01 16:18:14 | 000,000,000 | ---D | M] - C:\\autorun.inf -- [ FAT32 ]
O32 - AutoRun File - [2013/07/01 16:18:13 | 000,000,000 | ---D | M] - D:\\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2013/07/01 16:18:13 | 000,000,000 | ---D | M] - E:\\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2013/07/01 16:18:14 | 000,000,000 | ---D | M] - F:\\autorun.inf -- [ NTFS ]
O33 - MountPoints2\\{05c568a4-8f9b-11e2-9fba-806d6172696f}\\Shell - \"\" = AutoRun
O33 - MountPoints2\\{05c568a4-8f9b-11e2-9fba-806d6172696f}\\Shell\\AutoRun - \"\" = Auto&Play
O33 - MountPoints2\\{05c568a4-8f9b-11e2-9fba-806d6172696f}\\Shell\\AutoRun\\command - \"\" = G:\\setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\\..comfile [open] -- \"%1\" %*
O35 - HKLM\\..exefile [open] -- \"%1\" %*
O37 - HKLM\\...com [@ = comfile] -- \"%1\" %*
O37 - HKLM\\...exe [@ = exefile] -- \"%1\" %*
O38 - SubSystems\\\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2095/07/22 18:41:56 | 000,000,000 | -HSD | C] -- C:\\FOUND.014
[2033/09/30 21:36:46 | 000,000,000 | -HSD | C] -- C:\\FOUND.018
[2013/07/02 14:07:05 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\\Documents and Settings\\Administrator\\Desktop\\OTL.exe
[2013/07/02 12:16:27 | 000,000,000 | RH-D | C] -- C:\\Documents and Settings\\Administrator\\Recent
[2013/07/02 12:05:06 | 000,000,000 | -HSD | C] -- C:\\FOUND.028
[2013/07/01 23:03:12 | 000,000,000 | ---D | C] -- C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Kaspersky Anti-Virus 2013
[2013/07/01 23:02:12 | 000,000,000 | ---D | C] -- C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab
[2013/07/01 23:02:00 | 000,586,584 | ---- | C] (Kaspersky Lab) -- C:\\WINDOWS\\System32\\drivers\\klif.sys
[2013/07/01 23:02:00 | 000,074,072 | ---- | C] (Kaspersky Lab) -- C:\\WINDOWS\\System32\\drivers\\klflt.sys
[2013/07/01 22:56:14 | 000,000,000 | -HSD | C] -- C:\\FOUND.027
[2013/07/01 20:47:00 | 000,000,000 | ---D | C] -- C:\\Documents and Settings\\All Users\\Application Data\\StarApp
[2013/07/01 20:46:42 | 000,000,000 | ---D | C] -- C:\\Documents and Settings\\All Users\\Application Data\\InstallMate
[2013/07/01 20:18:36 | 000,000,000 | ---D | C] -- C:\\Program Files\\Trend Micro
[2013/07/01 20:18:36 | 000,000,000 | ---D | C] -- C:\\Documents and Settings\\Administrator\\Start Menu\\Programs\\HiJackThis
[2013/07/01 18:53:20 | 000,000,000 | -HSD | C] -- C:\\FOUND.026
[2013/07/01 18:28:57 | 000,000,000 | ---D | C] -- C:\\Avenger
[2013/07/01 18:20:49 | 000,000,000 | ---D | C] -- C:\\WINDOWS\\pss
[2013/07/01 16:43:01 | 000,000,000 | ---D | C] -- C:\\Program Files\\Kaspersky Lab
[2013/07/01 16:42:16 | 000,000,000 | ---D | C] -- C:\\KAV
[2013/07/01 16:41:08 | 000,000,000 | ---D | C] -- C:\\Documents and Settings\\All Users\\Application Data\\Windows Genuine Advantage
[2013/07/01 16:18:13 | 000,000,000 | ---D | C] -- C:\\autorun.inf
[2013/07/01 16:06:14 | 000,000,000 | -HSD | C] -- C:\\FOUND.025
[2013/06/30 11:09:54 | 000,000,000 | -HSD | C] -- C:\\FOUND.024
[2013/06/29 14:06:18 | 000,000,000 | -HSD | C] -- C:\\FOUND.023
[2013/06/28 20:46:53 | 000,000,000 | ---D | C] -- C:\\Documents and Settings\\Administrator\\Application Data\\Adobe Mini Bridge CS5
[2013/06/28 20:46:52 | 000,000,000 | ---D | C] -- C:\\Documents and Settings\\Administrator\\Application Data\\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2013/06/28 06:49:28 | 000,000,000 | -HSD | C] -- C:\\FOUND.022
[2013/06/27 18:50:37 | 000,000,000 | ---D | C] -- C:\\Documents and Settings\\All Users\\Application Data\\regid.1986-12.com.adobe
[2013/06/27 18:45:29 | 000,000,000 | ---D | C] -- C:\\Program Files\\Adobe Media Player
[2013/06/27 18:45:29 | 000,000,000 | ---D | C] -- C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Adobe
[2013/06/27 18:43:30 | 000,000,000 | ---D | C] -- C:\\Program Files\\Common Files\\Adobe AIR
[2013/06/27 18:39:35 | 000,000,000 | ---D | C] -- C:\\Documents and Settings\\All Users\\Application Data\\Adobe
[2013/06/27 18:39:28 | 000,000,000 | ---D | C] -- C:\\Program Files\\Common Files\\Adobe
[2013/06/27 18:39:01 | 000,000,000 | ---D | C] -- C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Adobe
[2013/06/27 10:44:39 | 000,286,720 | ---- | C] (Indigo Rose Corporation) -- C:\\WINDOWS\\iun503.exe
[2013/06/27 10:40:35 | 000,000,000 | ---D | C] -- C:\\Program Files\\Alcohol Soft
[2013/06/27 10:07:04 | 000,000,000 | -HSD | C] -- C:\\FOUND.021
[2013/06/24 23:00:58 | 000,000,000 | -HSD | C] -- C:\\FOUND.020
[2013/06/23 18:52:32 | 000,000,000 | -HSD | C] -- C:\\FOUND.019
[2013/06/22 11:14:10 | 000,000,000 | -HSD | C] -- C:\\FOUND.017
[2013/06/22 06:27:38 | 000,000,000 | -HSD | C] -- C:\\FOUND.016
[2013/06/17 10:33:46 | 000,000,000 | ---D | C] -- C:\\WINDOWS\\System32\\appmgmt
[2013/06/17 10:09:48 | 000,000,000 | ---D | C] -- C:\\Documents and Settings\\LocalService\\Application Data\\Hotspot Shield
[2013/06/17 09:24:39 | 000,000,000 | ---D | C] -- C:\\Documents and Settings\\Administrator\\Application Data\\uTorrent
[2013/06/17 08:28:24 | 000,000,000 | -HSD | C] -- C:\\FOUND.015
[2013/06/16 12:40:09 | 000,000,000 | ---D | C] -- C:\\Documents and Settings\\Administrator\\Application Data\\Nitro PDF
[2013/06/16 11:41:48 | 000,000,000 | ---D | C] -- C:\\Program Files\\Common Files\\BCL Technologies
[2013/06/16 11:41:34 | 000,000,000 | ---D | C] -- C:\\Program Files\\Nitro PDF
[2013/06/16 11:41:34 | 000,000,000 | ---D | C] -- C:\\Documents and Settings\\All Users\\Application Data\\Nitro PDF
[2013/06/16 11:40:46 | 000,000,000 | ---D | C] -- C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Downloaded Installations
[2013/06/13 09:11:55 | 000,000,000 | ---D | C] -- C:\\Program Files\\DIFX
[2013/06/09 04:03:26 | 000,000,000 | -HSD | C] -- C:\\FOUND.013
[2013/06/08 06:19:14 | 000,000,000 | -HSD | C] -- C:\\FOUND.012
[3 C:\\WINDOWS\\*.tmp files -> C:\\WINDOWS\\*.tmp -> ]
[2 C:\\WINDOWS\\System32\\*.tmp files -> C:\\WINDOWS\\System32\\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013/07/02 14:04:02 | 000,002,048 | --S- | M] () -- C:\\WINDOWS\\bootstat.dat
[2013/07/02 14:04:00 | 1064,747,008 | -HS- | M] () -- C:\\hiberfil.sys
[2013/07/02 13:25:56 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\\Documents and Settings\\Administrator\\Desktop\\OTL.exe
[2013/07/02 00:21:08 | 000,000,542 | ---- | M] () -- C:\\Documents and Settings\\All Users\\Desktop\\Four Star.lnk
[2013/07/02 00:17:12 | 000,000,211 | -HS- | M] () -- C:\\boot.ini
[2013/07/01 23:42:00 | 000,002,463 | ---- | M] () -- C:\\Documents and Settings\\Administrator\\Desktop\\HiJackThis.lnk
[2013/07/01 23:02:58 | 000,000,755 | ---- | M] () -- C:\\Documents and Settings\\All Users\\Desktop\\Kaspersky Anti-Virus 2013.lnk
[2013/07/01 23:01:26 | 000,002,251 | ---- | M] () -- C:\\Documents and Settings\\Administrator\\Desktop\\Google Chrome.lnk
[2013/07/01 20:51:48 | 000,001,008 | ---- | M] () -- C:\\WINDOWS\\tasks\\FacebookUpdateTaskUserS-1-5-21-776561741-725345543-708340629-500Core.job
[2013/07/01 18:14:18 | 000,017,408 | ---- | M] () -- C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/07/01 16:41:10 | 000,002,206 | ---- | M] () -- C:\\WINDOWS\\System32\\wpa.dbl
[2013/07/01 00:02:06 | 000,389,376 | ---- | M] () -- C:\\Documents and Settings\\Administrator\\My Documents\\managers-officers-coordinators-accountants-healthcare-staff-admin-staff-engineers-and-lot-of-other-important-staff-jobs-in-public-sector-organization-6-207042.jpg
[2013/06/30 09:17:34 | 000,093,367 | ---- | M] () -- C:\\Documents and Settings\\Administrator\\Desktop\\d.jpg
[2013/06/30 02:00:04 | 000,000,358 | ---- | M] () -- C:\\WINDOWS\\tasks\\AdobeAAMUpdater-1.0-HP-AC60887941E4-Administrator.job
[2013/06/29 05:14:20 | 000,286,720 | ---- | M] (Indigo Rose Corporation) -- C:\\WINDOWS\\iun503.exe
[2013/06/28 07:23:30 | 000,017,769 | ---- | M] () -- C:\\Documents and Settings\\Administrator\\Desktop\\c.jpg
[2013/06/27 21:19:08 | 003,568,328 | ---- | M] () -- C:\\WINDOWS\\System32\\FNTCACHE.DAT
[2013/06/22 19:36:52 | 000,002,269 | ---- | M] () -- C:\\Documents and Settings\\Administrator\\Application Data\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk
[2013/06/21 09:21:50 | 000,049,652 | ---- | M] () -- C:\\Documents and Settings\\Administrator\\Desktop\\Brasil.jpg
[2013/06/16 01:25:02 | 000,035,833 | ---- | M] () -- C:\\Documents and Settings\\Administrator\\Desktop\\b.jpg
[2013/06/15 23:34:16 | 003,933,337 | ---- | M] () -- C:\\Documents and Settings\\Administrator\\Desktop\\[SongsPK.info] Table No 21 - 05 - Man Mera (Remix).mp3
[2013/06/15 23:27:34 | 005,286,589 | ---- | M] () -- C:\\Documents and Settings\\Administrator\\Desktop\\[SongsPK.info] Aashiqui 2 - 01 - Tum Hi Ho_2.mp3
[2013/06/15 05:20:00 | 004,847,451 | ---- | M] () -- C:\\Documents and Settings\\Administrator\\Desktop\\[Songs.PK] 02 - Rani Tu Mein Raja.mp3
[2013/06/15 04:38:30 | 014,930,814 | ---- | M] () -- C:\\Documents and Settings\\Administrator\\Desktop\\Balma Full Song (Khiladi 786) ,Akshay Kumar _ Tune.pk.flv
[2013/06/13 09:03:20 | 000,007,287 | ---- | M] () -- C:\\Documents and Settings\\Administrator\\My Documents\\shez.JPG
[3 C:\\WINDOWS\\*.tmp files -> C:\\WINDOWS\\*.tmp -> ]
[2 C:\\WINDOWS\\System32\\*.tmp files -> C:\\WINDOWS\\System32\\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013/07/02 00:57:34 | 1064,747,008 | -HS- | C] () -- C:\\hiberfil.sys
[2013/07/02 00:21:06 | 000,000,542 | ---- | C] () -- C:\\Documents and Settings\\All Users\\Desktop\\Four Star.lnk
[2013/07/01 23:03:12 | 000,000,755 | ---- | C] () -- C:\\Documents and Settings\\All Users\\Desktop\\Kaspersky Anti-Virus 2013.lnk
[2013/07/01 20:18:36 | 000,002,463 | ---- | C] () -- C:\\Documents and Settings\\Administrator\\Desktop\\HiJackThis.lnk
[2013/07/01 16:13:23 | 000,033,585 | -HS- | C] () -- C:\\Documents and Settings\\Administrator\\Application Data\\ofbdgevejc..vbs
[2013/07/01 00:02:07 | 000,389,376 | ---- | C] () -- C:\\Documents and Settings\\Administrator\\My Documents\\managers-officers-coordinators-accountants-healthcare-staff-admin-staff-engineers-and-lot-of-other-important-staff-jobs-in-public-sector-organization-6-207042.jpg
[2013/06/30 09:17:40 | 000,093,367 | ---- | C] () -- C:\\Documents and Settings\\Administrator\\Desktop\\d.jpg
[2013/06/28 20:14:30 | 000,000,358 | ---- | C] () -- C:\\WINDOWS\\tasks\\AdobeAAMUpdater-1.0-HP-AC60887941E4-Administrator.job
[2013/06/28 07:23:36 | 000,017,769 | ---- | C] () -- C:\\Documents and Settings\\Administrator\\Desktop\\c.jpg
[2013/06/27 18:48:32 | 000,000,761 | ---- | C] () -- C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Adobe Photoshop CS5.lnk
[2013/06/27 18:47:36 | 000,000,723 | ---- | C] () -- C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Adobe Bridge CS5.lnk
[2013/06/27 18:47:08 | 000,000,816 | ---- | C] () -- C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Adobe Device Central CS5.lnk
[2013/06/27 18:44:49 | 000,000,907 | ---- | C] () -- C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Adobe Extension Manager CS5.lnk
[2013/06/27 18:44:37 | 000,001,051 | ---- | C] () -- C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Adobe ExtendScript Toolkit CS5.lnk
[2013/06/27 18:43:33 | 000,000,635 | ---- | C] () -- C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Adobe Help.lnk
[2013/06/21 09:22:03 | 000,049,652 | ---- | C] () -- C:\\Documents and Settings\\Administrator\\Desktop\\Brasil.jpg
[2013/06/16 11:41:36 | 000,001,671 | ---- | C] () -- C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Nitro PDF Professional.lnk
[2013/06/16 01:25:06 | 000,035,833 | ---- | C] () -- C:\\Documents and Settings\\Administrator\\Desktop\\b.jpg
[2013/06/15 23:33:12 | 003,933,337 | ---- | C] () -- C:\\Documents and Settings\\Administrator\\Desktop\\[SongsPK.info] Table No 21 - 05 - Man Mera (Remix).mp3
[2013/06/15 23:26:12 | 005,286,589 | ---- | C] () -- C:\\Documents and Settings\\Administrator\\Desktop\\[SongsPK.info] Aashiqui 2 - 01 - Tum Hi Ho_2.mp3
[2013/06/15 05:11:43 | 004,847,451 | ---- | C] () -- C:\\Documents and Settings\\Administrator\\Desktop\\[Songs.PK] 02 - Rani Tu Mein Raja.mp3
[2013/06/15 04:18:49 | 014,930,814 | ---- | C] () -- C:\\Documents and Settings\\Administrator\\Desktop\\Balma Full Song (Khiladi 786) ,Akshay Kumar _ Tune.pk.flv
[2013/06/13 09:03:18 | 000,007,287 | ---- | C] () -- C:\\Documents and Settings\\Administrator\\My Documents\\shez.JPG
[2013/05/17 12:50:53 | 000,157,696 | ---- | C] () -- C:\\WINDOWS\\System32\\unrar.dll
[2013/05/17 12:50:49 | 000,568,850 | ---- | C] () -- C:\\WINDOWS\\System32\\x264vfw.dll
[2013/05/17 12:50:48 | 000,856,064 | ---- | C] () -- C:\\WINDOWS\\System32\\xvidcore.dll
[2013/05/17 12:50:48 | 000,217,088 | ---- | C] () -- C:\\WINDOWS\\System32\\xvidvfw.dll
[2013/05/17 12:50:46 | 003,596,288 | ---- | C] () -- C:\\WINDOWS\\System32\\qt-dx331.dll
[2013/05/17 12:50:44 | 000,005,120 | ---- | C] () -- C:\\WINDOWS\\System32\\ff_vfw.dll
[2013/05/10 05:33:25 | 000,017,408 | ---- | C] () -- C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/03/18 08:30:39 | 000,000,376 | ---- | C] () -- C:\\WINDOWS\\ODBC.INI
[2013/03/18 07:38:59 | 000,147,456 | ---- | C] () -- C:\\WINDOWS\\System32\\igfxCoIn_v4926.dll
[2013/03/18 07:30:57 | 000,002,048 | --S- | C] () -- C:\\WINDOWS\\bootstat.dat
[2013/03/18 07:24:15 | 000,021,640 | ---- | C] () -- C:\\WINDOWS\\System32\\emptyregdb.dat
[2013/03/18 07:18:34 | 000,004,161 | ---- | C] () -- C:\\WINDOWS\\ODBCINST.INI
[2013/03/18 07:17:23 | 003,568,328 | ---- | C] () -- C:\\WINDOWS\\System32\\FNTCACHE.DAT
========== ZeroAccess Check ==========
[HKEY_CURRENT_USER\\Software\\Classes\\clsid\\{42aedc87-2188-41fd-b9a3-0c966feabec1}\\InProcServer32]
[HKEY_CURRENT_USER\\Software\\Classes\\clsid\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\InProcServer32]
[HKEY_LOCAL_MACHINE\\Software\\Classes\\clsid\\{42aedc87-2188-41fd-b9a3-0c966feabec1}\\InProcServer32]
\"\" = %SystemRoot%\\system32\\shdocvw.dll -- [2004/08/04 00:56:46 | 001,483,264 | ---- | M] (Microsoft Corporation)
\"ThreadingModel\" = Apartment
[HKEY_LOCAL_MACHINE\\Software\\Classes\\clsid\\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\\InProcServer32]
\"\" = C:\\WINDOWS\\system32\\wbem\\fastprox.dll -- [2004/08/03 16:56:44 | 000,472,064 | ---- | M] (Microsoft Corporation)
\"ThreadingModel\" = Free
[HKEY_LOCAL_MACHINE\\Software\\Classes\\clsid\\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\\InProcServer32]
\"\" = C:\\WINDOWS\\system32\\wbem\\wbemess.dll -- [2004/08/03 16:56:48 | 000,273,920 | ---- | M] (Microsoft Corporation)
\"ThreadingModel\" = Both
< End of report >
