fbi warning no safe mode

uza · January 19, 2013

I seem to have been infected by the fbi warning virus in my attempts to remove the virus i have not been able to access any form of safe mode. I have been able to access the repair feature from the boot menu and get a command prompt running but as far as locating the files or anything else im pretty much stuck. I noticed a few other threads related to this virus on this forum so i'm just hoping i can get some sort of help and it would be much appreciated.

gringo_pr · January 19, 2013

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your malware problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

How to tell > 32 or 64 bit

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

- Startup Repair
  System Restore
  Windows Complete PC Restore
  Windows Memory Diagnostic Tool
  Command Prompt

[*]Select Command Prompt

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst64.exe and press Enter

Note: Replace letter e with the drive letter of your flash drive.

[*]The tool will start to run.

[*]When the tool opens click Yes to disclaimer.

[*]First Press the Scan button.

[*]It will make a log (FRST.txt)

[*]Second Type the following in the edit box after "Search:". services.exe

[*]Click the Search button

[*]It will make a log (Search.txt)

I want you to poste Both the FRST.txt report and the Search.txt into your reply to me

Gringo

uza · January 19, 2013

Thank you for replying i'm doing the scan right now and will reply back with the logs when finished.

uza · January 19, 2013

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-01-2013

Ran by SYSTEM at 19-01-2013 14:20:59

Running from H:\

Windows 7 Home Premium (X64) OS Language: English(US)

The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11369576 2010-08-10] (Realtek Semiconductor)

HKLM\...\Run: [intelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray [1931024 2010-10-18] (Intel® Corporation)

HKLM\...\Run: [intelWirelessWiMAX] "C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe" /tasktray /nosplash [1449984 2010-08-31] (Intel® Corporation)

HKLM\...\Run: [ETDCtrl] %ProgramFiles%\Elantech\ETDCtrl.exe [2581384 2010-08-30] (ELAN Microelectronics Corp.)

HKLM\...\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2399632 2011-04-13] (Microsoft Corporation)

HKLM\...\Run: [intelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" [4156 2010-04-16] ()

HKLM\...\Run: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2818856 2011-08-25] (Synaptics Incorporated)

HKLM\...\Run: [Logitech Download Assistant] C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch [1580368 2010-11-03] (Logitech, Inc.)

HKLM-x32\...\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-05-31] (Symantec Corporation)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35696 2009-02-27] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [updateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5" [222504 2009-05-19] (CyberLink Corp.)

HKLM-x32\...\Run: [CLMLServer] "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [103720 2009-06-03] (CyberLink)

HKLM-x32\...\Run: [updateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [222504 2009-05-19] (CyberLink Corp.)

HKLM-x32\...\Run: [updatePDRShortCut] "C:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\7.0" [222504 2008-01-03] (CyberLink Corp.)

HKLM-x32\...\Run: [RemoteControl8] "C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe" [91432 2009-04-15] (CyberLink Corp.)

HKLM-x32\...\Run: [PDVD8LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe" [50472 2009-04-15] (CyberLink Corp.)

HKLM-x32\...\Run: [updatePPShortCut] "C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0" [218408 2008-12-03] (CyberLink Corp.)

HKLM-x32\...\Run: [updatePSTShortCut] "C:\Program Files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter" [210216 2009-07-20] (CyberLink Corp.)

HKLM-x32\...\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume [439568 2010-05-09] (Microsoft Corporation)

HKLM-x32\...\Run: [uCam_Menu] "C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0" [222504 2009-05-19] (CyberLink Corp.)

HKLM-x32\...\Run: [iObit Malware Fighter] "C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe" /autostart [4453208 2012-01-12] (IObit)

HKLM-x32\...\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray [449584 2011-07-06] (Malwarebytes Corporation)

HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2010-11-29] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2011-07-19] (Apple Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)

HKLM-x32\...\Run: [] [x]

HKU\Seth\...\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [4240760 2010-11-10] (Microsoft Corporation)

HKU\Seth\...\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" [399736 2011-06-03] (BitTorrent, Inc.)

HKU\Seth\...\Run: [Advanced SystemCare 4] "C:\Program Files (x86)\IObit\Advanced SystemCare 4\ASCTray.exe" [412560 2011-05-28] (IObit)

HKU\Seth\...\Run: [GoTrusted] C:\Program Files (x86)\GoTrusted.com\GoTrusted Secure Tunnel v2.3.0.5\GoTrusted Secure Tunnel.exe [188488 2011-04-12] (GoTrusted.com)

HKU\Seth\...\Run: [MurGee.com Auto Clicker] C:\Program Files (x86)\Auto Clicker\AutoClicker.exe :silent [40960 2011-05-04] (MurGee.com)

HKU\Seth\...\Run: [Xicaysr] C:\Users\Seth\AppData\Roaming\Feipki\iryn.exe [204800 2012-01-20] ()

HKU\Seth\...\Run: [AutoTyperMurGee] C:\Program Files (x86)\Auto Typer by MurGee\AutoTyper.exe :settings [55656 2012-02-28] (MurGee.com)

HKU\Seth\...\Run: [ieodjrzotp] C:\Users\Seth\AppData\Roaming\phxzbypky [x]

HKU\Seth\...\Policies\system: [DisableTaskMgr] 1

HKLM\...\Winlogon: [shell] explorer.exe, C:\ProgramData\phxzbypky [x ] ()

Tcpip\Parameters: [DhcpNameServer] 75.75.76.76 75.75.75.75

AppInit_DLLs: C:\windows\system32\nvinitx.dll

Startup: C:\Users\All Users\Start Menu\Programs\Startup\SRS Premium Sound.lnk

ShortcutTarget: SRS Premium Sound.lnk -> C:\windows\Installer\{340BE65B-7621-4B0B-B0F9-DBCCD8D70887}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe (Acresso Software Inc.)

Startup: C:\Users\Default\Start Menu\Programs\Startup\Best Buy pc app.lnk

ShortcutTarget: Best Buy pc app.lnk -> C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)

Startup: C:\Users\Default User\Start Menu\Programs\Startup\Best Buy pc app.lnk

ShortcutTarget: Best Buy pc app.lnk -> C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)

==================== Services (Whitelisted) ===================

2 AdvancedSystemCareService; C:\Program Files (x86)\IObit\Advanced SystemCare 4\ASCService.exe [353168 2011-05-28] (IObit)

2 IMFservice; C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [821592 2012-01-09] (IObit)

2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [366640 2011-07-06] (Malwarebytes Corporation)

2 MSSQL$SONY_MEDIAMGR; C:\Program Files (x86)\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -sSONY_MEDIAMGR [7520337 2002-12-17] (Microsoft Corporation)

3 MSSQLServerADHelper; C:\Program Files (x86)\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe [66112 2002-12-17] (Microsoft Corporation)

4 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-10-18] ()

2 NIS; "C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe" /s "NIS" /m "C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\diMaster.dll" /prefetch:1 [262584 2011-03-31] (Symantec Corporation)

2 NOBU; "C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe" SERVICE [2804568 2010-05-31] (Symantec Corporation)

4 RichVideo; "C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe" [247152 2009-07-07] ()

3 SQLAgent$SONY_MEDIAMGR; C:\Program Files (x86)\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -i SONY_MEDIAMGR [311872 2002-12-17] (Microsoft Corporation)

==================== Drivers (Whitelisted) =====================

1 BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.0.0.128\Definitions\BASHDefs\20110701.001\BHDrvx64.sys [1143416 2011-05-19] (Symantec Corporation)

1 eeCtrl; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [481912 2011-05-22] (Symantec Corporation)

3 EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [136824 2011-05-29] (Symantec Corporation)

3 FileMonitor; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys [21384 2012-01-05] (IObit)

1 HWiNFO32; \??\C:\windows\SysWOW64\drivers\HWiNFO64A.SYS [30592 2012-10-27] (REALiX)

1 IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.0.0.128\Definitions\IPSDefs\20110720.031\IDSvia64.sys [488056 2011-07-08] (Symantec Corporation)

3 KeyScrambler; C:\Windows\System32\Drivers\KeyScrambler.sys [273088 2011-04-24] (QFX Software Corporation)

3 MBAMProtector; \??\C:\windows\system32\drivers\mbam.sys [25912 2011-07-06] (Malwarebytes Corporation)

3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.0.0.128\Definitions\VirusDefs\20110720.022\ENG64.SYS [117880 2011-05-29] (Symantec Corporation)

3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.0.0.128\Definitions\VirusDefs\20110720.022\EX64.SYS [2011768 2011-05-29] (Symantec Corporation)

3 RegFilter; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys [33184 2011-09-20] (IObit.com)

3 rtport; C:\Windows\SysWow64\Drivers\rtport.sys [15144 2011-04-18] (Windows ® 2003 DDK 3790 provider)

0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [18232 2011-02-23] ()

3 SRTSP; C:\Windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS [744568 2011-03-30] (Symantec Corporation)

1 SRTSPX; C:\Windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS [40568 2011-03-30] (Symantec Corporation)

0 SymDS; C:\Windows\System32\drivers\NISx64\1207020.003\SYMDS64.SYS [450680 2011-01-26] (Symantec Corporation)

0 SymEFA; C:\Windows\System32\drivers\NISx64\1207020.003\SYMEFA64.SYS [912504 2011-03-14] (Symantec Corporation)

3 SymEvent; \??\C:\windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2011-05-22] (Symantec Corporation)

1 SymIRON; C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [171128 2011-01-26] (Symantec Corporation)

1 SymNetS; C:\Windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS [386168 2011-04-20] (Symantec Corporation)

2 TurboB; C:\Windows\System32\Drivers\TurboB.sys [13832 2010-04-16] ()

3 UrlFilter; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\UrlFilter.sys [21872 2011-09-20] (IObit.com)

==================== NetSvcs (Whitelisted) ====================

==================== One Month Created Files and Folders ========

2013-01-19 14:20 - 2013-01-19 14:20 - 00000000 ____D C:\FRST

2013-01-19 11:29 - 2013-01-19 12:09 - 00114688 ____A (Nok) C:\Users\Seth\AppData\Roaming\phxzbypky.exe

2013-01-19 11:19 - 2013-01-19 12:11 - 00114688 ____A (Nok) C:\Users\All Users\phxzbypky.exe

2013-01-19 11:19 - 2013-01-19 12:09 - 00114688 ____A (Nok) C:\Users\Seth\AppData\Local\phxzbypky.exe

2013-01-19 08:23 - 2013-01-19 08:23 - 00000000 ____D C:\Users\Seth\AppData\Local\{7C1322AC-6329-41E9-90F6-5F0EFEDC8484}

2013-01-18 15:10 - 2013-01-18 15:10 - 00000000 ____D C:\Users\Seth\AppData\Local\{9D35A75A-1956-4A20-8593-873F9FBE7752}

2013-01-18 03:09 - 2013-01-18 03:09 - 00000000 ____D C:\Users\Seth\AppData\Local\{1A2639EF-0469-4A30-BACD-0EEB63B9E438}

2013-01-17 23:26 - 2013-01-18 21:45 - 323247714 ____A C:\Users\Seth\Documents\clip0245.avi

2013-01-17 22:01 - 2013-01-17 23:24 - 3016358100 ____A C:\Users\Seth\Documents\clip0244.avi

2013-01-17 15:17 - 2013-01-17 20:04 - 3341176018 ____A C:\Users\Seth\Documents\clip0243.avi

2013-01-17 15:09 - 2013-01-17 15:09 - 00000000 ____D C:\Users\Seth\AppData\Local\{F0232D0D-701F-4519-95B8-0580E2157717}

2013-01-17 03:05 - 2013-01-17 03:05 - 00000000 ____D C:\Users\Seth\AppData\Local\{04D85E6C-5E69-44EB-8230-0A61B0F0EE89}

2013-01-16 15:05 - 2013-01-16 15:05 - 00000000 ____D C:\Users\Seth\AppData\Local\{40BD1701-2D36-4BBB-9A99-42E832C3AD88}

2013-01-16 01:21 - 2013-01-16 01:21 - 00000000 ____D C:\Users\Seth\AppData\Local\{B504EEE2-6693-491F-AC18-8D9870D1E5B1}

2013-01-15 21:32 - 2013-01-15 23:05 - 101383118 ____A C:\Users\Seth\Documents\clip0242.avi

2013-01-15 13:20 - 2013-01-15 13:21 - 00000000 ____D C:\Users\Seth\AppData\Local\{73A2483E-106A-40ED-B042-DE138288C51C}

2013-01-14 15:27 - 2013-01-14 15:27 - 00000000 ____D C:\Users\Seth\AppData\Local\{8C4F64A5-A46E-47CE-9AFE-2950D6AFC650}

2013-01-14 03:26 - 2013-01-14 03:26 - 00000000 ____D C:\Users\Seth\AppData\Local\{92C1560E-359C-4BAA-8F26-31456B7EB4DB}

2013-01-13 18:40 - 2013-01-14 05:14 - 3934091438 ____A C:\Users\Seth\Documents\clip0241.avi

2013-01-13 18:05 - 2013-01-13 18:36 - 526400494 ____A C:\Users\Seth\Documents\clip0240.avi

2013-01-13 15:25 - 2013-01-13 15:25 - 00000000 ____D C:\Users\Seth\AppData\Local\{00FFCA2C-5A9C-4FAC-AE10-9731361D9C69}

2013-01-13 14:37 - 2013-01-13 14:38 - 00000000 ____D C:\Users\Seth\AppData\Local\{F254E3A4-133E-40E6-A35E-89FC968D713F}

2013-01-13 03:00 - 2013-01-13 06:59 - 1350985966 ____A C:\Users\Seth\Documents\clip0239.avi

2013-01-13 01:44 - 2013-01-13 01:44 - 00000000 ____D C:\Users\Seth\AppData\Local\{7ACD8BC9-8E7F-428F-B725-5E2D0D9DB6D5}

2013-01-12 19:20 - 2013-01-13 02:53 - 300635508 ____A C:\Users\Seth\Documents\clip0238.avi

2013-01-12 13:44 - 2013-01-12 13:44 - 00000000 ____D C:\Users\Seth\AppData\Local\{364956B0-7DDB-4AA3-BF56-EDCB669CA77C}

2013-01-12 01:27 - 2013-01-12 01:27 - 00000000 ____D C:\Users\Seth\AppData\Local\{AB756463-A2CE-4546-86CF-966E651D32D5}

2013-01-11 18:05 - 2013-01-11 22:35 - 1720657302 ____A C:\Users\Seth\Documents\clip0237.avi

2013-01-11 13:26 - 2013-01-11 13:26 - 00000000 ____D C:\Users\Seth\AppData\Local\{0BA4B800-18E2-4B3B-9168-50F80150B409}

2013-01-11 01:25 - 2013-01-11 01:26 - 00000000 ____D C:\Users\Seth\AppData\Local\{DD292471-D65D-48CB-8959-A8C9546FC7B7}

2013-01-10 16:05 - 2013-01-11 00:22 - 3813037850 ____A C:\Users\Seth\Documents\clip0236.avi

2013-01-10 13:25 - 2013-01-10 13:25 - 00000000 ____D C:\Users\Seth\AppData\Local\{8A18A555-EBE3-4EC4-9262-8A438BFC145B}

2013-01-10 01:24 - 2013-01-10 01:24 - 00000000 ____D C:\Users\Seth\AppData\Local\{B02D8267-DD6C-4653-9EAE-46E5F5A5405C}

2013-01-09 21:38 - 2013-01-09 21:38 - 00000000 ____D C:\Users\Seth\AppData\Local\Proxure

2013-01-09 21:38 - 2013-01-09 21:38 - 00000000 ____D C:\Users\All Users\ClubSanDisk

2013-01-09 15:41 - 2013-01-10 00:20 - 2396297530 ____A C:\Users\Seth\Documents\clip0235.avi

2013-01-09 13:29 - 2012-12-07 05:20 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\Wpc.dll

2013-01-09 13:29 - 2012-12-07 05:15 - 02746368 ____A (Microsoft Corporation) C:\Windows\System32\gameux.dll

2013-01-09 13:29 - 2012-12-07 04:26 - 00308736 ____A (Microsoft Corporation) C:\Windows\SysWOW64\Wpc.dll

2013-01-09 13:29 - 2012-12-07 04:20 - 02576384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\gameux.dll

2013-01-09 13:29 - 2012-12-07 03:20 - 00045568 ____A (Microsoft) C:\Windows\System32\oflc-nz.rs

2013-01-09 13:29 - 2012-12-07 03:20 - 00044544 ____A (Microsoft) C:\Windows\System32\pegibbfc.rs

2013-01-09 13:29 - 2012-12-07 03:20 - 00043520 ____A (Microsoft) C:\Windows\System32\csrr.rs

2013-01-09 13:29 - 2012-12-07 03:20 - 00030720 ____A (Microsoft) C:\Windows\System32\usk.rs

2013-01-09 13:29 - 2012-12-07 03:20 - 00020480 ____A (Microsoft) C:\Windows\System32\pegi-pt.rs

2013-01-09 13:29 - 2012-12-07 03:19 - 00046592 ____A (Microsoft) C:\Windows\System32\fpb.rs

2013-01-09 13:29 - 2012-12-07 03:19 - 00040960 ____A (Microsoft) C:\Windows\System32\cob-au.rs

2013-01-09 13:29 - 2012-12-07 03:19 - 00021504 ____A (Microsoft) C:\Windows\System32\grb.rs

2013-01-09 13:29 - 2012-12-07 03:19 - 00020480 ____A (Microsoft) C:\Windows\System32\pegi.rs

2013-01-09 13:29 - 2012-12-07 03:19 - 00015360 ____A (Microsoft) C:\Windows\System32\djctq.rs

2013-01-09 13:29 - 2012-12-07 02:46 - 00046592 ____A (Microsoft) C:\Windows\SysWOW64\fpb.rs

2013-01-09 13:29 - 2012-12-07 02:46 - 00045568 ____A (Microsoft) C:\Windows\SysWOW64\oflc-nz.rs

2013-01-09 13:29 - 2012-12-07 02:46 - 00044544 ____A (Microsoft) C:\Windows\SysWOW64\pegibbfc.rs

2013-01-09 13:29 - 2012-12-07 02:46 - 00043520 ____A (Microsoft) C:\Windows\SysWOW64\csrr.rs

2013-01-09 13:29 - 2012-12-07 02:46 - 00040960 ____A (Microsoft) C:\Windows\SysWOW64\cob-au.rs

2013-01-09 13:29 - 2012-12-07 02:46 - 00030720 ____A (Microsoft) C:\Windows\SysWOW64\usk.rs

2013-01-09 13:29 - 2012-12-07 02:46 - 00021504 ____A (Microsoft) C:\Windows\SysWOW64\grb.rs

2013-01-09 13:29 - 2012-12-07 02:46 - 00020480 ____A (Microsoft) C:\Windows\SysWOW64\pegi-pt.rs

2013-01-09 13:29 - 2012-12-07 02:46 - 00020480 ____A (Microsoft) C:\Windows\SysWOW64\pegi.rs

2013-01-09 13:29 - 2012-12-07 02:46 - 00015360 ____A (Microsoft) C:\Windows\SysWOW64\djctq.rs

2013-01-09 13:29 - 2012-11-21 21:44 - 00800768 ____A (Microsoft Corporation) C:\Windows\System32\usp10.dll

2013-01-09 13:29 - 2012-11-21 20:45 - 00626688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2013-01-09 13:29 - 2012-11-19 21:48 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll

2013-01-09 13:29 - 2012-11-19 20:51 - 00220160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2013-01-09 13:29 - 2012-11-08 21:45 - 00750592 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll

2013-01-09 13:29 - 2012-11-08 20:43 - 00492032 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll

2013-01-09 13:29 - 2012-10-31 21:43 - 02002432 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll

2013-01-09 13:29 - 2012-10-31 21:43 - 01882624 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll

2013-01-09 13:29 - 2012-10-31 20:47 - 01389568 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2013-01-09 13:29 - 2012-10-31 20:47 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2013-01-09 13:28 - 2012-12-07 03:20 - 00023552 ____A (Microsoft) C:\Windows\System32\oflc.rs

2013-01-09 13:28 - 2012-12-07 03:20 - 00020480 ____A (Microsoft) C:\Windows\System32\pegi-fi.rs

2013-01-09 13:28 - 2012-12-07 03:19 - 00055296 ____A (Microsoft) C:\Windows\System32\cero.rs

2013-01-09 13:28 - 2012-12-07 03:19 - 00051712 ____A (Microsoft) C:\Windows\System32\esrb.rs

2013-01-09 13:28 - 2012-12-07 02:46 - 00055296 ____A (Microsoft) C:\Windows\SysWOW64\cero.rs

2013-01-09 13:28 - 2012-12-07 02:46 - 00051712 ____A (Microsoft) C:\Windows\SysWOW64\esrb.rs

2013-01-09 13:28 - 2012-12-07 02:46 - 00023552 ____A (Microsoft) C:\Windows\SysWOW64\oflc.rs

2013-01-09 13:28 - 2012-12-07 02:46 - 00020480 ____A (Microsoft) C:\Windows\SysWOW64\pegi-fi.rs

2013-01-09 13:28 - 2012-11-29 21:45 - 00362496 ____A (Microsoft Corporation) C:\Windows\System32\wow64win.dll

2013-01-09 13:28 - 2012-11-29 21:45 - 00243200 ____A (Microsoft Corporation) C:\Windows\System32\wow64.dll

2013-01-09 13:28 - 2012-11-29 21:45 - 00215040 ____A (Microsoft Corporation) C:\Windows\System32\winsrv.dll

2013-01-09 13:28 - 2012-11-29 21:45 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\wow64cpu.dll

2013-01-09 13:28 - 2012-11-29 21:43 - 00016384 ____A (Microsoft Corporation) C:\Windows\System32\ntvdm64.dll

2013-01-09 13:28 - 2012-11-29 21:41 - 01161216 ____A (Microsoft Corporation) C:\Windows\System32\kernel32.dll

2013-01-09 13:28 - 2012-11-29 21:41 - 00424448 ____A (Microsoft Corporation) C:\Windows\System32\KernelBase.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00006144 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00005120 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 21:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:54 - 00005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2013-01-09 13:28 - 2012-11-29 20:53 - 01114112 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2013-01-09 13:28 - 2012-11-29 20:53 - 00274944 ____A (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00005120 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 20:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 19:23 - 00338432 ____A (Microsoft Corporation) C:\Windows\System32\conhost.exe

2013-01-09 13:28 - 2012-11-29 18:44 - 00025600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2013-01-09 13:28 - 2012-11-29 18:44 - 00014336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2013-01-09 13:28 - 2012-11-29 18:44 - 00007680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2013-01-09 13:28 - 2012-11-29 18:44 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2013-01-09 13:28 - 2012-11-29 18:38 - 00006144 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 18:38 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 18:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 18:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2013-01-09 13:28 - 2012-11-29 15:17 - 00420064 ____A C:\Windows\SysWOW64\locale.nls

2013-01-09 13:28 - 2012-11-29 15:15 - 00420064 ____A C:\Windows\System32\locale.nls

2013-01-09 13:28 - 2012-11-22 19:26 - 03149824 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2013-01-09 13:28 - 2012-11-22 19:13 - 00068608 ____A (Microsoft Corporation) C:\Windows\System32\taskhost.exe

2013-01-09 13:23 - 2013-01-09 13:23 - 00000000 ____D C:\Users\Seth\AppData\Local\{3B747E28-BA07-4F05-B300-AD443CAC12AE}

2013-01-09 01:18 - 2013-01-09 01:19 - 00000000 ____D C:\Users\Seth\AppData\Local\{348929C1-258E-41BF-B3CC-D9DAE1764589}

2013-01-08 13:18 - 2013-01-08 13:18 - 00000000 ____D C:\Users\Seth\AppData\Local\{6B157F5B-AE77-4197-8461-9F5FB1E6825A}

2013-01-08 01:16 - 2013-01-08 01:16 - 00000000 ____D C:\Users\Seth\AppData\Local\{F097FD4A-87F1-4FA7-BB9D-DB037DE523E2}

2013-01-07 21:20 - 2013-01-07 23:56 - 129232340 ____A C:\Users\Seth\Documents\clip0234.avi

2013-01-07 13:15 - 2013-01-07 13:15 - 00000000 ____D C:\Users\Seth\AppData\Local\{5AD7F760-130C-4F01-8147-7927C2E72B8F}

2013-01-07 01:14 - 2013-01-07 01:15 - 00000000 ____D C:\Users\Seth\AppData\Local\{96086C7C-DFE2-4FB0-BE82-846ED8C01C0E}

2013-01-06 18:01 - 2013-01-06 23:42 - 1616220352 ____A C:\Users\Seth\Documents\clip0233.avi

2013-01-05 20:27 - 2013-01-06 00:01 - 516711460 ____A C:\Users\Seth\Documents\clip0232.avi

2013-01-05 20:26 - 2013-01-05 20:26 - 01081024 ____A C:\Users\Seth\Documents\clip0231.avi

2013-01-05 20:25 - 2013-01-05 20:26 - 146481760 ____A C:\Users\Seth\Documents\clip0230.avi

2013-01-05 18:17 - 2013-01-05 20:24 - 1576009778 ____A C:\Users\Seth\Documents\clip0229.avi

2013-01-03 18:43 - 2013-01-04 02:26 - 3025026844 ____A C:\Users\Seth\Documents\clip0227.avi

2013-01-03 18:03 - 2013-01-03 18:43 - 933991268 ____A C:\Users\Seth\Documents\clip0225.avi

2013-01-01 23:10 - 2013-01-01 23:20 - 01398010 ____A C:\Users\Seth\Documents\clip0223.avi

2013-01-01 01:51 - 2013-01-06 13:14 - 00000000 ____D C:\Users\Seth\AppData\Local\{A9F22823-E0FD-4EEE-8F33-9E65208212C2}

2012-12-31 20:13 - 2012-12-31 20:13 - 16244432 ____A C:\Users\Seth\Documents\clip0222.avi

2012-12-31 19:39 - 2012-12-31 20:04 - 682159956 ____A C:\Users\Seth\Documents\clip0220.avi

2012-12-31 18:39 - 2012-12-31 19:33 - 1509365760 ____A C:\Users\Seth\Documents\clip0228.avi

2012-12-31 18:39 - 2012-12-31 18:39 - 00780000 ____A C:\Users\Seth\Documents\clip0228.avi.bak

2012-12-31 13:50 - 2012-12-31 13:50 - 00000000 ____D C:\Users\Seth\AppData\Local\{00A7A675-3F79-4F9E-8EF0-E29B9640B1C3}

2012-12-31 01:49 - 2012-12-31 01:49 - 00000000 ____D C:\Users\Seth\AppData\Local\{66033721-BF64-4350-982A-31AE63232128}

2012-12-30 17:48 - 2012-12-30 17:48 - 24051536 ____A (Igor Pavlov) C:\Users\Seth\Downloads\tor-browser-2.3.25-1_en-US.exe

2012-12-30 13:49 - 2012-12-30 13:49 - 00000000 ____D C:\Users\Seth\AppData\Local\{5975B5B9-B095-4B1F-A2FD-C3C64FBB8489}

2012-12-30 01:13 - 2012-12-30 01:13 - 00000000 ____D C:\Users\Seth\AppData\Local\{E58B1B68-83E5-4866-A909-338B27009E6A}

2012-12-29 19:36 - 2012-12-29 21:59 - 416586690 ____A C:\Users\Seth\Documents\clip0226.avi

2012-12-29 13:12 - 2012-12-29 13:13 - 00000000 ____D C:\Users\Seth\AppData\Local\{5E0BD7B2-2460-4AE8-8DAB-B3CFA9DA7164}

2012-12-29 01:12 - 2012-12-29 01:12 - 00000000 ____D C:\Users\Seth\AppData\Local\{BABF4D70-0AE7-496F-B722-5867CB27F3F0}

2012-12-28 13:11 - 2012-12-28 13:11 - 00000000 ____D C:\Users\Seth\AppData\Local\{EB0E18AA-6ED5-4D77-8BB3-12F35920C5EE}

2012-12-28 01:10 - 2012-12-28 01:10 - 00000000 ____D C:\Users\Seth\AppData\Local\{61691EEC-D809-47A6-85F1-EDF1A1174CA9}

2012-12-28 00:14 - 2012-12-28 01:55 - 196939446 ____A C:\Users\Seth\Documents\clip0224.avi

2012-12-27 15:56 - 2012-12-27 17:17 - 796200178 ____A C:\Users\Seth\Documents\clip0221.avi

2012-12-27 13:09 - 2012-12-27 13:10 - 00000000 ____D C:\Users\Seth\AppData\Local\{9CF78ED8-EC5B-4A1F-B761-76CE7AF7C49D}

2012-12-27 00:04 - 2012-12-27 00:04 - 00000000 ____D C:\Users\Seth\AppData\Local\{C3B69C06-38DA-40B6-AF56-46FC9175891F}

2012-12-26 12:03 - 2012-12-26 12:03 - 00000000 ____D C:\Users\Seth\AppData\Local\{87E11902-7A2F-4267-A5B9-5437058F3F94}

2012-12-25 15:37 - 2012-12-25 15:38 - 00000000 ____D C:\Users\Seth\AppData\Local\{DFC57AF4-CFB4-4B43-8A94-EEAA0F3092D8}

2012-12-24 22:57 - 2012-12-24 22:57 - 00000000 ____D C:\Users\Seth\AppData\Local\{397FBBF5-B2CB-46D0-AC75-4C0426768A9D}

2012-12-23 21:16 - 2012-12-24 10:56 - 00000000 ____D C:\Users\Seth\AppData\Local\{7D2EEB3B-0F12-4759-84F6-1CE936206ED4}

2012-12-23 11:28 - 2012-12-23 11:28 - 00300432 ____A C:\Windows\Minidump\122312-65270-01.dmp

2012-12-23 09:16 - 2012-12-23 09:16 - 00000000 ____D C:\Users\Seth\AppData\Local\{1C6BAA68-259D-41A0-99E4-FD953DB508A9}

2012-12-22 14:07 - 2012-12-22 14:07 - 00000000 ____D C:\Users\Seth\AppData\Local\{A545814A-81FC-4339-A95C-D6E3417F43D1}

2012-12-22 02:06 - 2012-12-22 02:06 - 00000000 ____D C:\Users\Seth\AppData\Local\{E164E73E-B3D4-44A0-B4CC-6D38EAA0DB24}

2012-12-22 00:06 - 2012-12-22 01:40 - 1716601472 ____A C:\Users\Seth\Documents\clip0219.avi

2012-12-21 16:10 - 2012-12-21 18:23 - 2109928458 ____A C:\Users\Seth\Documents\clip0218.avi

2012-12-21 14:05 - 2012-12-21 14:05 - 00000000 ____D C:\Users\Seth\AppData\Local\{8F9C832D-013F-47A0-A25C-F7177F9C185B}

2012-12-21 02:04 - 2012-12-21 02:04 - 00000000 ____D C:\Users\Seth\AppData\Local\{D3F4CE74-3366-46E7-AE39-62100F0F9C98}

2012-12-21 02:01 - 2012-12-16 09:11 - 00046080 ____A (Adobe Systems) C:\Windows\System32\atmlib.dll

2012-12-21 02:01 - 2012-12-16 06:45 - 00367616 ____A (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll

2012-12-21 02:01 - 2012-12-16 06:13 - 00295424 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll

2012-12-21 02:01 - 2012-12-16 06:13 - 00034304 ____A (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll

2012-12-20 16:22 - 2012-12-21 00:34 - 2730890940 ____A C:\Users\Seth\Documents\clip0217.avi

2012-12-20 14:03 - 2012-12-20 14:04 - 00000000 ____D C:\Users\Seth\AppData\Local\{6B0DB087-506F-4439-950B-7116F5C6FDB7}

==================== One Month Modified Files and Folders =======

2013-01-19 14:20 - 2013-01-19 14:20 - 00000000 ____D C:\FRST

2013-01-19 12:11 - 2013-01-19 11:19 - 00114688 ____A (Nok) C:\Users\All Users\phxzbypky.exe

2013-01-19 12:09 - 2013-01-19 11:29 - 00114688 ____A (Nok) C:\Users\Seth\AppData\Roaming\phxzbypky.exe

2013-01-19 12:09 - 2013-01-19 11:19 - 00114688 ____A (Nok) C:\Users\Seth\AppData\Local\phxzbypky.exe

2013-01-19 12:09 - 2012-10-14 20:25 - 00000890 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-01-19 12:09 - 2011-06-03 22:34 - 00000000 ____D C:\Users\Seth\AppData\Roaming\uTorrent

2013-01-19 12:03 - 2010-12-02 17:18 - 00000050 ____A C:\Windows\System32\SupplicantTest.log

2013-01-19 12:03 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2013-01-19 12:02 - 2011-11-27 14:23 - 00020752 ____A C:\Windows\setupact.log

2013-01-19 11:26 - 2010-12-02 17:16 - 01924027 ____A C:\Windows\WindowsUpdate.log

2013-01-19 11:23 - 2011-05-29 23:49 - 00000000 ____D C:\Users\Seth\Tracing

2013-01-19 11:22 - 2012-11-10 12:19 - 00002259 ____A C:\Users\Seth\Desktop\Google Chrome.lnk

2013-01-19 11:22 - 2012-03-12 12:46 - 00000000 ____D C:\Users\Seth\AppData\Roaming\Waywv

2013-01-19 11:21 - 2011-12-15 01:43 - 00011906 ____A C:\Windows\PFRO.log

2013-01-19 10:54 - 2012-10-14 20:25 - 00000894 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-01-19 08:23 - 2013-01-19 08:23 - 00000000 ____D C:\Users\Seth\AppData\Local\{7C1322AC-6329-41E9-90F6-5F0EFEDC8484}

2013-01-19 08:23 - 2011-05-30 11:49 - 00000000 ____D C:\Users\Seth\AppData\Local\Windows Live

2013-01-19 08:23 - 2011-05-22 13:22 - 00000000 ____D C:\Users\Seth\AppData\Roaming\TS3Client

2013-01-18 21:45 - 2013-01-17 23:26 - 323247714 ____A C:\Users\Seth\Documents\clip0245.avi

2013-01-18 20:24 - 2012-11-29 15:26 - 00000032 ____A C:\Users\Seth\jagex_cl_runescape_LIVE.dat

2013-01-18 15:10 - 2013-01-18 15:10 - 00000000 ____D C:\Users\Seth\AppData\Local\{9D35A75A-1956-4A20-8593-873F9FBE7752}

2013-01-18 03:09 - 2013-01-18 03:09 - 00000000 ____D C:\Users\Seth\AppData\Local\{1A2639EF-0469-4A30-BACD-0EEB63B9E438}

2013-01-17 23:24 - 2013-01-17 22:01 - 3016358100 ____A C:\Users\Seth\Documents\clip0244.avi

2013-01-17 20:04 - 2013-01-17 15:17 - 3341176018 ____A C:\Users\Seth\Documents\clip0243.avi

2013-01-17 15:09 - 2013-01-17 15:09 - 00000000 ____D C:\Users\Seth\AppData\Local\{F0232D0D-701F-4519-95B8-0580E2157717}

2013-01-17 15:09 - 2011-05-22 13:20 - 00000000 ____D C:\Program Files (x86)\SwiftKit

2013-01-17 03:05 - 2013-01-17 03:05 - 00000000 ____D C:\Users\Seth\AppData\Local\{04D85E6C-5E69-44EB-8230-0A61B0F0EE89}

2013-01-16 17:16 - 2009-07-13 20:45 - 00014144 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-01-16 17:16 - 2009-07-13 20:45 - 00014144 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-01-16 15:05 - 2013-01-16 15:05 - 00000000 ____D C:\Users\Seth\AppData\Local\{40BD1701-2D36-4BBB-9A99-42E832C3AD88}

2013-01-16 01:21 - 2013-01-16 01:21 - 00000000 ____D C:\Users\Seth\AppData\Local\{B504EEE2-6693-491F-AC18-8D9870D1E5B1}

2013-01-15 23:05 - 2013-01-15 21:32 - 101383118 ____A C:\Users\Seth\Documents\clip0242.avi

2013-01-15 13:21 - 2013-01-15 13:20 - 00000000 ____D C:\Users\Seth\AppData\Local\{73A2483E-106A-40ED-B042-DE138288C51C}

2013-01-14 15:27 - 2013-01-14 15:27 - 00000000 ____D C:\Users\Seth\AppData\Local\{8C4F64A5-A46E-47CE-9AFE-2950D6AFC650}

2013-01-14 05:14 - 2013-01-13 18:40 - 3934091438 ____A C:\Users\Seth\Documents\clip0241.avi

2013-01-14 03:26 - 2013-01-14 03:26 - 00000000 ____D C:\Users\Seth\AppData\Local\{92C1560E-359C-4BAA-8F26-31456B7EB4DB}

2013-01-13 18:36 - 2013-01-13 18:05 - 526400494 ____A C:\Users\Seth\Documents\clip0240.avi

2013-01-13 15:25 - 2013-01-13 15:25 - 00000000 ____D C:\Users\Seth\AppData\Local\{00FFCA2C-5A9C-4FAC-AE10-9731361D9C69}

2013-01-13 14:38 - 2013-01-13 14:37 - 00000000 ____D C:\Users\Seth\AppData\Local\{F254E3A4-133E-40E6-A35E-89FC968D713F}

2013-01-13 06:59 - 2013-01-13 03:00 - 1350985966 ____A C:\Users\Seth\Documents\clip0239.avi

2013-01-13 02:53 - 2013-01-12 19:20 - 300635508 ____A C:\Users\Seth\Documents\clip0238.avi

2013-01-13 01:44 - 2013-01-13 01:44 - 00000000 ____D C:\Users\Seth\AppData\Local\{7ACD8BC9-8E7F-428F-B725-5E2D0D9DB6D5}

2013-01-12 13:44 - 2013-01-12 13:44 - 00000000 ____D C:\Users\Seth\AppData\Local\{364956B0-7DDB-4AA3-BF56-EDCB669CA77C}

2013-01-12 01:27 - 2013-01-12 01:27 - 00000000 ____D C:\Users\Seth\AppData\Local\{AB756463-A2CE-4546-86CF-966E651D32D5}

2013-01-11 22:35 - 2013-01-11 18:05 - 1720657302 ____A C:\Users\Seth\Documents\clip0237.avi

2013-01-11 13:26 - 2013-01-11 13:26 - 00000000 ____D C:\Users\Seth\AppData\Local\{0BA4B800-18E2-4B3B-9168-50F80150B409}

2013-01-11 05:12 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache

2013-01-11 01:26 - 2013-01-11 01:25 - 00000000 ____D C:\Users\Seth\AppData\Local\{DD292471-D65D-48CB-8959-A8C9546FC7B7}

2013-01-11 00:22 - 2013-01-10 16:05 - 3813037850 ____A C:\Users\Seth\Documents\clip0236.avi

2013-01-10 13:25 - 2013-01-10 13:25 - 00000000 ____D C:\Users\Seth\AppData\Local\{8A18A555-EBE3-4EC4-9262-8A438BFC145B}

2013-01-10 12:19 - 2011-06-03 09:12 - 00000000 ____D C:\Users\Seth\AppData\Local\CrashDumps

2013-01-10 02:46 - 2009-07-13 21:13 - 00753608 ____A C:\Windows\System32\PerfStringBackup.INI

2013-01-10 02:42 - 2009-07-13 20:45 - 00279680 ____A C:\Windows\System32\FNTCACHE.DAT

2013-01-10 02:11 - 2012-09-22 13:09 - 00000118 ____A C:\Windows\System32\MRT.INI

2013-01-10 02:05 - 2011-06-03 23:23 - 67599240 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

2013-01-10 01:24 - 2013-01-10 01:24 - 00000000 ____D C:\Users\Seth\AppData\Local\{B02D8267-DD6C-4653-9EAE-46E5F5A5405C}

2013-01-10 00:20 - 2013-01-09 15:41 - 2396297530 ____A C:\Users\Seth\Documents\clip0235.avi

2013-01-09 21:38 - 2013-01-09 21:38 - 00000000 ____D C:\Users\Seth\AppData\Local\Proxure

2013-01-09 21:38 - 2013-01-09 21:38 - 00000000 ____D C:\Users\All Users\ClubSanDisk

2013-01-09 13:23 - 2013-01-09 13:23 - 00000000 ____D C:\Users\Seth\AppData\Local\{3B747E28-BA07-4F05-B300-AD443CAC12AE}

2013-01-09 01:19 - 2013-01-09 01:18 - 00000000 ____D C:\Users\Seth\AppData\Local\{348929C1-258E-41BF-B3CC-D9DAE1764589}

2013-01-08 13:18 - 2013-01-08 13:18 - 00000000 ____D C:\Users\Seth\AppData\Local\{6B157F5B-AE77-4197-8461-9F5FB1E6825A}

2013-01-08 01:16 - 2013-01-08 01:16 - 00000000 ____D C:\Users\Seth\AppData\Local\{F097FD4A-87F1-4FA7-BB9D-DB037DE523E2}

2013-01-07 23:56 - 2013-01-07 21:20 - 129232340 ____A C:\Users\Seth\Documents\clip0234.avi

2013-01-07 13:15 - 2013-01-07 13:15 - 00000000 ____D C:\Users\Seth\AppData\Local\{5AD7F760-130C-4F01-8147-7927C2E72B8F}

2013-01-07 01:15 - 2013-01-07 01:14 - 00000000 ____D C:\Users\Seth\AppData\Local\{96086C7C-DFE2-4FB0-BE82-846ED8C01C0E}

2013-01-06 23:42 - 2013-01-06 18:01 - 1616220352 ____A C:\Users\Seth\Documents\clip0233.avi

2013-01-06 13:44 - 2012-12-02 17:20 - 00019897 ____A C:\Users\Seth\12.2.txt

2013-01-06 13:14 - 2013-01-01 01:51 - 00000000 ____D C:\Users\Seth\AppData\Local\{A9F22823-E0FD-4EEE-8F33-9E65208212C2}

2013-01-06 00:01 - 2013-01-05 20:27 - 516711460 ____A C:\Users\Seth\Documents\clip0232.avi

2013-01-05 20:26 - 2013-01-05 20:26 - 01081024 ____A C:\Users\Seth\Documents\clip0231.avi

2013-01-05 20:26 - 2013-01-05 20:25 - 146481760 ____A C:\Users\Seth\Documents\clip0230.avi

2013-01-05 20:24 - 2013-01-05 18:17 - 1576009778 ____A C:\Users\Seth\Documents\clip0229.avi

2013-01-04 17:32 - 2011-05-22 16:43 - 00000000 ____D C:\.jagex_cache_32

2013-01-04 02:26 - 2013-01-03 18:43 - 3025026844 ____A C:\Users\Seth\Documents\clip0227.avi

2013-01-03 18:43 - 2013-01-03 18:03 - 933991268 ____A C:\Users\Seth\Documents\clip0225.avi

2013-01-01 23:20 - 2013-01-01 23:10 - 01398010 ____A C:\Users\Seth\Documents\clip0223.avi

2012-12-31 20:13 - 2012-12-31 20:13 - 16244432 ____A C:\Users\Seth\Documents\clip0222.avi

2012-12-31 20:04 - 2012-12-31 19:39 - 682159956 ____A C:\Users\Seth\Documents\clip0220.avi

2012-12-31 19:33 - 2012-12-31 18:39 - 1509365760 ____A C:\Users\Seth\Documents\clip0228.avi

2012-12-31 18:39 - 2012-12-31 18:39 - 00780000 ____A C:\Users\Seth\Documents\clip0228.avi.bak

2012-12-31 13:50 - 2012-12-31 13:50 - 00000000 ____D C:\Users\Seth\AppData\Local\{00A7A675-3F79-4F9E-8EF0-E29B9640B1C3}

2012-12-31 01:49 - 2012-12-31 01:49 - 00000000 ____D C:\Users\Seth\AppData\Local\{66033721-BF64-4350-982A-31AE63232128}

2012-12-30 17:48 - 2012-12-30 17:48 - 24051536 ____A (Igor Pavlov) C:\Users\Seth\Downloads\tor-browser-2.3.25-1_en-US.exe

2012-12-30 13:49 - 2012-12-30 13:49 - 00000000 ____D C:\Users\Seth\AppData\Local\{5975B5B9-B095-4B1F-A2FD-C3C64FBB8489}

2012-12-30 01:13 - 2012-12-30 01:13 - 00000000 ____D C:\Users\Seth\AppData\Local\{E58B1B68-83E5-4866-A909-338B27009E6A}

2012-12-29 21:59 - 2012-12-29 19:36 - 416586690 ____A C:\Users\Seth\Documents\clip0226.avi

2012-12-29 13:13 - 2012-12-29 13:12 - 00000000 ____D C:\Users\Seth\AppData\Local\{5E0BD7B2-2460-4AE8-8DAB-B3CFA9DA7164}

2012-12-29 01:12 - 2012-12-29 01:12 - 00000000 ____D C:\Users\Seth\AppData\Local\{BABF4D70-0AE7-496F-B722-5867CB27F3F0}

2012-12-28 13:11 - 2012-12-28 13:11 - 00000000 ____D C:\Users\Seth\AppData\Local\{EB0E18AA-6ED5-4D77-8BB3-12F35920C5EE}

2012-12-28 01:55 - 2012-12-28 00:14 - 196939446 ____A C:\Users\Seth\Documents\clip0224.avi

2012-12-28 01:10 - 2012-12-28 01:10 - 00000000 ____D C:\Users\Seth\AppData\Local\{61691EEC-D809-47A6-85F1-EDF1A1174CA9}

2012-12-27 17:17 - 2012-12-27 15:56 - 796200178 ____A C:\Users\Seth\Documents\clip0221.avi

2012-12-27 13:10 - 2012-12-27 13:09 - 00000000 ____D C:\Users\Seth\AppData\Local\{9CF78ED8-EC5B-4A1F-B761-76CE7AF7C49D}

2012-12-27 00:04 - 2012-12-27 00:04 - 00000000 ____D C:\Users\Seth\AppData\Local\{C3B69C06-38DA-40B6-AF56-46FC9175891F}

2012-12-26 12:03 - 2012-12-26 12:03 - 00000000 ____D C:\Users\Seth\AppData\Local\{87E11902-7A2F-4267-A5B9-5437058F3F94}

2012-12-25 15:38 - 2012-12-25 15:37 - 00000000 ____D C:\Users\Seth\AppData\Local\{DFC57AF4-CFB4-4B43-8A94-EEAA0F3092D8}

2012-12-24 22:57 - 2012-12-24 22:57 - 00000000 ____D C:\Users\Seth\AppData\Local\{397FBBF5-B2CB-46D0-AC75-4C0426768A9D}

2012-12-24 10:56 - 2012-12-23 21:16 - 00000000 ____D C:\Users\Seth\AppData\Local\{7D2EEB3B-0F12-4759-84F6-1CE936206ED4}

2012-12-23 11:28 - 2012-12-23 11:28 - 00300432 ____A C:\Windows\Minidump\122312-65270-01.dmp

2012-12-23 11:28 - 2011-08-10 14:45 - 00000000 ____D C:\Windows\Minidump

2012-12-23 09:16 - 2012-12-23 09:16 - 00000000 ____D C:\Users\Seth\AppData\Local\{1C6BAA68-259D-41A0-99E4-FD953DB508A9}

2012-12-22 14:07 - 2012-12-22 14:07 - 00000000 ____D C:\Users\Seth\AppData\Local\{A545814A-81FC-4339-A95C-D6E3417F43D1}

2012-12-22 02:06 - 2012-12-22 02:06 - 00000000 ____D C:\Users\Seth\AppData\Local\{E164E73E-B3D4-44A0-B4CC-6D38EAA0DB24}

2012-12-22 01:40 - 2012-12-22 00:06 - 1716601472 ____A C:\Users\Seth\Documents\clip0219.avi

2012-12-22 00:50 - 2012-12-19 22:44 - 00008250 ____A C:\Users\Seth\12.19.txt

2012-12-21 18:23 - 2012-12-21 16:10 - 2109928458 ____A C:\Users\Seth\Documents\clip0218.avi

2012-12-21 14:05 - 2012-12-21 14:05 - 00000000 ____D C:\Users\Seth\AppData\Local\{8F9C832D-013F-47A0-A25C-F7177F9C185B}

2012-12-21 02:04 - 2012-12-21 02:04 - 00000000 ____D C:\Users\Seth\AppData\Local\{D3F4CE74-3366-46E7-AE39-62100F0F9C98}

2012-12-21 00:34 - 2012-12-20 16:22 - 2730890940 ____A C:\Users\Seth\Documents\clip0217.avi

2012-12-20 14:04 - 2012-12-20 14:03 - 00000000 ____D C:\Users\Seth\AppData\Local\{6B0DB087-506F-4439-950B-7116F5C6FDB7}

==================== Known DLLs (Whitelisted) =================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

==================== Memory info ===========================

Percentage of memory in use: 18%

Total physical RAM: 3882.09 MB

Available physical RAM: 3161.2 MB

Total Pagefile: 3880.23 MB

Available Pagefile: 3157.23 MB

Total Virtual: 8192 MB

Available Virtual: 8191.9 MB

==================== Partitions =============================

1 Drive c: () (Fixed) (Total:232 GB) (Free:9.87 GB) NTFS

2 Drive d: () (Fixed) (Total:346.39 GB) (Free:345.14 GB) NTFS

3 Drive f: (SAMSUNG_REC) (Fixed) (Total:17.68 GB) (Free:0.94 GB) NTFS ==>[system with boot components (obtained from reading drive)]

5 Drive h: () (Removable) (Total:29.8 GB) (Free:21.15 GB) FAT32

6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

7 Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt

-------- ------------- ------- ------- --- ---

Disk 0 Online 596 GB 1024 KB

Disk 1 Online 29 GB 0 B

Partitions of Disk 0:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 100 MB 1024 KB

Partition 2 Primary 232 GB 101 MB

Partition 0 Extended 346 GB 232 GB

Partition 4 Logical 346 GB 232 GB

Partition 3 Recovery 17 GB 578 GB

==================================================================================

Disk: 0

Partition 1

Type : 07

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 1 Y SYSTEM NTFS Partition 100 MB Healthy

=========================================================

Disk: 0

Partition 2

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 2 C NTFS Partition 232 GB Healthy

=========================================================

Disk: 0

Partition 4

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 3 D NTFS Partition 346 GB Healthy

=========================================================

Disk: 0

Partition 3

Type : 27

Hidden: Yes

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 4 F SAMSUNG_REC NTFS Partition 17 GB Healthy Hidden

=========================================================

Partitions of Disk 1:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 29 GB 16 KB

==================================================================================

Disk: 1

Partition 1

Type : 0C

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 5 H FAT32 Removable 29 GB Healthy

=========================================================

Last Boot: 2013-01-14 09:46

==================== End Of Log =============================

Farbar Recovery Scan Tool (x64) Version: 15-01-2013

Ran by SYSTEM at 2013-01-19 14:22:43

Running from H:\

================== Search: "Search.txt" ===================

====== End Of Search ======

uza · January 19, 2013

sorry just realized i did the search wrong ill fix it.

uza · January 19, 2013