please check log my friends after fight with MoneyPak Virus

January 28, 2013

hi, please check logs after fight with MoneyPak Virus from my friends

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 8.0.6001.18702

Run by jaroslav at 19:43:21 on 2013-01-27

.

============== Running Processes ================

.

C:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

C:\WINDOWS\System32\HPZipm12.exe

C:\WINDOWS\system32\slserv.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\WINDOWS\System32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\System32\svchost.exe -k LocalService

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.landing.savetubevideo.com/index.php?from=3

uInternet Connection Wizard,ShellNext = hxxp://www.msn.co.uk/

uProxyServer = 81.89.63.129:8080

uProxyOverride = <local>

uURLSearchHooks: {2877A654-1C9F-4cb5-8438-16022B2FDD9C} - <orphaned>

uURLSearchHooks: PC Tools Browser Guard: {472734EA-242A-422b-ADF8-83D1E48CC825} - c:\program files\pc tools\pc tools security\bdt\PCTBrowserDefender.dll

mURLSearchHooks: {2877A654-1C9F-4cb5-8438-16022B2FDD9C} - <orphaned>

uWinlogon: Userinit = c:\windows\system32\userinit.exe

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: PC Tools Browser Guard BHO: {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - c:\program files\pc tools\pc tools security\bdt\PCTBrowserDefender.dll

TB: PC Tools Browser Guard: {472734EA-242A-422B-ADF8-83D1E48CC825} - c:\program files\pc tools\pc tools security\bdt\PCTBrowserDefender.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - <orphaned>

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"

mRun: [switchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe

mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

uPolicies-Explorer: NoDriveTypeAutoRun = dword:323

uPolicies-Explorer: NoResolveTrack = dword:1

uPolicies-Explorer: NoDriveAutoRun = dword:67108863

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoResolveTrack = dword:1

mPolicies-Explorer: NoDriveAutoRun = dword:-1

mPolicies-Explorer: NoDriveTypeAutoRun = dword:255

mPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: MaxRecentDocs = dword:0

mPolicies-Explorer: NoWinKey = dword:0

mPolicies-Explorer: NoNetConnextDisconnect = dword:0

mPolicies-Explorer: NoWindowsUpdate = dword:0

mPolicies-Explorer: NoSMConfigurePrograms = dword:0

mPolicies-Explorer: NoControlPanle = dword:0

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

mPolicies-System: NoAdminPage = dword:0

IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: Pridat do Anti-Banner - <no file>

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

INFO: HKLM has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

TCP: NameServer = 88.81.100.2 88.81.98.4

TCP: Interfaces\{FA3B0640-3A31-4E85-B706-48EB089FFE08} : DHCPNameServer = 88.81.100.2 88.81.98.4

Notify: igfxcui - igfxsrvc.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

Hosts: 127.0.0.1 www.spywareinfo.com

.

============= SERVICES / DRIVERS ===============

.

=============== Created Last 30 ================

.

2013-01-27 18:15:50 29904 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{629a965a-9028-456a-9bb7-fd41e86da9ad}\MpKslf3062d86.sys

2013-01-27 18:14:29 60872 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{629a965a-9028-456a-9bb7-fd41e86da9ad}\offreg.dll

2013-01-27 18:08:26 6991832 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{629a965a-9028-456a-9bb7-fd41e86da9ad}\mpengine.dll

2013-01-27 14:09:22 -------- d---a-w- C:\Kaspersky Rescue Disk 10.0

2013-01-25 13:54:49 -------- d-----w- c:\documents and settings\jaroslav\local settings\application data\Threat Expert

2013-01-24 16:15:37 6991832 ------w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll

2013-01-14 16:40:23 -------- d-----w- c:\program files\GreenScreenWizardPro6

2013-01-14 16:18:34 24229936 ----a-w- c:\documents and settings\jaroslav\application data\SetupGSW6Demo.exe

.

==================== Find3M ====================

.

2013-01-18 10:31:42 697864 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-01-18 10:31:40 74248 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-12-16 12:23:59 290560 ----a-w- c:\windows\system32\atmfd.dll

2012-11-13 01:25:12 1866368 ----a-w- c:\windows\system32\win32k.sys

2012-11-06 02:01:39 1371648 ------w- c:\windows\system32\msxml6.dll

2012-11-02 02:02:42 375296 ----a-w- c:\windows\system32\dpnet.dll

2012-11-01 15:35:14 202280 ----a-w- c:\windows\system32\drivers\PCTSD.sys

2012-11-01 12:17:54 916992 ----a-w- c:\windows\system32\wininet.dll

2012-11-01 12:17:54 43520 ----a-w- c:\windows\system32\licmgr10.dll

2012-11-01 12:17:54 1469440 ------w- c:\windows\system32\inetcpl.cpl

2012-11-01 00:35:34 385024 ----a-w- c:\windows\system32\html.iec

.

============= FINISH: 19:44:37.56 ===============

Attach.txt

kevinf80 · January 28, 2013

Do you know of this proxy server that is active on the system.... uProxyServer = 81.89.63.129:8080 Its registered somewhere in Bratislava, Slovakia?

Do the following:

Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from the following link :-

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Ensure that Combofix is saved directly to the Desktop <--- Very important
Disable all security programs as they will have a negative effect on Combofix, instructions available here http://www.bleepingcomputer.com/forums/topic114351.html if required. Be aware the list may not have all programs listed, if you need more help please ask.
Close any open browsers and any other programs you might have running
Double click the icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator)
Instructions for running Combofix available here http://www.bleepingcomputer.com/combofix/how-to-use-combofix if required.
If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.

Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read here http://thespykiller.co.uk/index.php?page=20 why disabling autoruns is recommended.

*EXTRA NOTES*

If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Post the log in next reply please...

Kevin

January 29, 2013

ComboFix 13-01-29.01 - jaroslav 01/29/2013 13:18:11.2.1 - x86

Running from: c:\documents and settings\jaroslav\Desktop\WAREZ\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\qSbbERd.pad

c:\documents and settings\All Users\Application Data\TEMP

c:\documents and settings\jaroslav\Application Data\Toolbar4

c:\documents and settings\jaroslav\WINDOWS

c:\windows\system32\SET688C.tmp

c:\windows\system32\SET6891.tmp

c:\windows\system32\SET6898.tmp

c:\windows\system32\SET68A5.tmp

c:\windows\system32\SET68DB.tmp

.

((((((((((((((((((((((((( Files Created from 2012-12-28 to 2013-01-29 )))))))))))))))))))))))))))))))

.

2013-01-29 07:55 . 2012-12-14 16:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-01-29 07:44 . 2013-01-29 07:44 60872 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{94001A9D-7ACE-4B9D-9B95-C60FDC3A9D0C}\offreg.dll

2013-01-29 07:44 . 2013-01-29 07:44 29904 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{94001A9D-7ACE-4B9D-9B95-C60FDC3A9D0C}\MpKsl29176867.sys

2013-01-29 01:41 . 2013-01-08 04:57 6991832 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{94001A9D-7ACE-4B9D-9B95-C60FDC3A9D0C}\mpengine.dll

2013-01-27 18:08 . 2013-01-08 04:57 6991832 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2013-01-27 14:09 . 2013-01-27 17:41 -------- d---a-w- C:\Kaspersky Rescue Disk 10.0

2013-01-25 19:54 . 2013-01-27 04:18 -------- d-----w- c:\documents and settings\Administrator

2013-01-25 13:54 . 2013-01-25 13:54 -------- d-----w- c:\documents and settings\jaroslav\Local Settings\Application Data\Threat Expert

2013-01-14 16:40 . 2013-01-15 07:45 -------- d-----w- c:\program files\GreenScreenWizardPro6

2013-01-14 16:18 . 2013-01-14 16:20 24229936 ----a-w- c:\documents and settings\jaroslav\Application Data\SetupGSW6Demo.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-01-18 10:31 . 2012-04-11 07:26 697864 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-01-18 10:31 . 2011-05-15 07:50 74248 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-12-16 12:23 . 2004-06-15 14:33 290560 ----a-w- c:\windows\system32\atmfd.dll

2012-11-13 01:25 . 2004-06-15 14:34 1866368 ----a-w- c:\windows\system32\win32k.sys

2012-11-06 02:01 . 2009-08-24 02:46 1371648 ------w- c:\windows\system32\msxml6.dll

2012-11-02 02:02 . 2002-12-11 23:14 375296 ----a-w- c:\windows\system32\dpnet.dll

2012-11-01 15:35 . 2012-12-23 03:13 202280 ----a-w- c:\windows\system32\drivers\PCTSD.sys

2012-11-01 12:17 . 2006-06-23 10:33 916992 ----a-w- c:\windows\system32\wininet.dll

2012-11-01 12:17 . 2004-06-15 14:33 43520 ----a-w- c:\windows\system32\licmgr10.dll

2012-11-01 12:17 . 2004-06-15 14:33 1469440 ------w- c:\windows\system32\inetcpl.cpl

2012-11-01 00:35 . 2004-08-04 05:59 385024 ----a-w- c:\windows\system32\html.iec

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-22 402432]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"EnableUIADesktopToggle"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

.

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]

"NoAdminPage"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveTrack"= 1 (0x1)

"NoChangeStartMenu"= 00000000

"MaxRecentDocs"= 0 (0x0)

"NoWinKey"= 0 (0x0)

"NoNetConnextDisconnect"= 0 (0x0)

"NoSMConfigurePrograms"= 0 (0x0)

"NoControlPanle"= 0 (0x0)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveTrack"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-12-03 07:35 946352 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]

2003-06-03 10:01 496640 ----a-w- c:\windows\zHotkey.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2005-06-21 15:44 126976 ----a-w- c:\windows\system32\hkcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

2005-06-21 15:48 155648 ----a-w- c:\windows\system32\igfxtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]

2012-09-12 17:19 947176 ----a-w- c:\program files\Microsoft Security Client\msseces.exe

.

R1 afeogwpb;afeogwpb;c:\windows\system32\drivers\afeogwpb.sys

S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe

S3 anvsnddrv;AnvSoft Virtual Sound Device;c:\windows\system32\drivers\anvsnddrv.sys

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - MBAMPROTECTOR

*NewlyCreated* - MBAMSCHEDULER

*NewlyCreated* - MBAMSERVICE

*NewlyCreated* - MPKSL29176867

.

Contents of the 'Scheduled Tasks' folder

.

2013-01-18 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 10:31]

.

2013-01-29 c:\windows\Tasks\AdobeAAMUpdater-1.0-JAKE-jaroslav.job

- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2012-11-28 03:44]

.

2013-01-27 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job

- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 17:25]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.landing.savetubevideo.com/index.php?from=3

uInternet Connection Wizard,ShellNext = hxxp://www.msn.co.uk/

uInternet Settings,ProxyOverride = <local>

uInternet Settings,ProxyServer = 81.89.63.129:8080

IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Pridat do Anti-Banner

IE: Pridat do Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm

TCP: DhcpNameServer = 88.81.100.2 88.81.98.4

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

.

- - - - ORPHANS REMOVED - - - -

.

MSConfigStartUp-InCD - c:\program files\Ahead\InCD\InCD.exe

MSConfigStartUp-YouTube Mini - c:\program files\YoutubeDownloader.org\YouTubeDownloader\YouTube Mini.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2013-01-29 13:31

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(568)

c:\windows\system32\igfxsrvc.dll

c:\windows\system32\hccutils.DLL

.

Completion time: 2013-01-29 13:36:27

ComboFix-quarantined-files.txt 2013-01-29 13:36

.

Pre-Run: 34,905,477,120 bytes free

Post-Run: 34,940,424,192 bytes free

.

- - End Of File - - 3A8BEC18759FE35887CD1379EFA14156

kevinf80 · January 29, 2013

What about this proxy server, uInternet Settings,ProxyServer = 81.89.63.129:8080 is it known to you or not??

January 29, 2013

no my friends do not know this IP address and proxy server

kevinf80 · January 29, 2013

Run the following please, unfortunately there are issues with Combofix, we cannot use that until the Developer gives the all clear..

Download OTL from any of the following links and save to your desktop.

http://itxassociates.com/OT-Tools/OTL.com

http://oldtimer.geekstogo.com/OTL.exe

http://www.itxassociates.com/OT-Tools/OTL.scr

Double click the icon to start the tool. (Note: If you are running on Vista or Windows 7 accept UAC alert)

When the window appears, underneath Output at the top, make sure Standard output is selected.
Select Scan all users
Under the Extra Registry section, check Use SafeList
In the lower right corner, checkmark "LOP Check" and checkmark "Purity Check".
Click Run Scan and let the program run uninterrupted.
When the scan is complete, two text files will be created on your Desktop.
OTL.Txt <- this one will be opened
Extras.txt <- this one will be minimized

Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of OTL.Txt and the Extras.txt in your next reply.

Kevin

February 1, 2013

OTL logfile created on: 1/31/2013 11:12:05 PM - Run 1

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\jaroslav\Desktop\WAREZ

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.49 Gb Total Physical Memory | 0.93 Gb Available Physical Memory | 62.63% Memory free

3.35 Gb Paging File | 3.00 Gb Available in Paging File | 89.68% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 74.53 Gb Total Space | 29.12 Gb Free Space | 39.07% Space Free | Partition Type: NTFS

Drive E: | 74.53 Gb Total Space | 63.82 Gb Free Space | 85.63% Space Free | Partition Type: NTFS

Drive J: | 76.33 Gb Total Space | 28.64 Gb Free Space | 37.52% Space Free | Partition Type: NTFS

Computer Name: JAKE | User Name: jaroslav | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/01/31 22:08:52 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\jaroslav\Desktop\WAREZ\OTL.exe

PRC - [2012/10/23 17:40:06 | 000,580,728 | ---- | M] (Threat Expert Ltd.) -- C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe

PRC - [2012/09/12 17:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\MsMpEng.exe

PRC - [2008/09/30 12:48:28 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

PRC - [2008/04/14 00:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2004/02/29 21:20:20 | 000,045,056 | ---- | M] ( ) -- C:\WINDOWS\system32\slserv.exe

========== Modules (No Company Name) ==========

MOD - [2012/10/23 17:40:08 | 000,109,688 | ---- | M] () -- C:\Program Files\PC Tools\PC Tools Security\BDT\BSPatch.dll

MOD - [2012/10/23 17:40:00 | 000,769,144 | ---- | M] () -- C:\WINDOWS\BDTSupport.dll

MOD - [2012/07/19 18:56:08 | 000,172,544 | ---- | M] () -- C:\WINDOWS\system32\libbluray.dll

MOD - [2012/07/19 18:56:02 | 006,894,331 | ---- | M] () -- C:\WINDOWS\system32\avcodec-lav-54.dll

MOD - [2012/07/19 18:56:02 | 001,111,581 | ---- | M] () -- C:\WINDOWS\system32\avformat-lav-54.dll

MOD - [2012/07/19 18:56:02 | 000,232,895 | ---- | M] () -- C:\WINDOWS\system32\avutil-lav-51.dll

MOD - [2012/07/17 08:34:18 | 003,479,552 | ---- | M] () -- C:\WINDOWS\system32\ffdshow.ax

MOD - [2011/11/03 15:28:36 | 001,292,288 | ---- | M] () -- C:\WINDOWS\system32\quartz.dll

MOD - [2008/10/11 21:18:46 | 000,319,488 | ---- | M] () -- C:\Program Files\WinRAR\rarlng.dll

MOD - [2008/09/16 19:18:06 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll

MOD - [2008/05/08 06:37:14 | 000,352,256 | ---- | M] () -- C:\Program Files\Photo DVD Maker Professional\MPAudioSplitter_pdm.ax

MOD - [2008/04/14 00:12:03 | 000,562,176 | ---- | M] () -- C:\WINDOWS\system32\qedit.dll

MOD - [2008/04/14 00:11:51 | 000,059,904 | ---- | M] () -- C:\WINDOWS\system32\devenum.dll

MOD - [2007/04/12 13:19:50 | 000,129,024 | ---- | M] () -- C:\WINDOWS\system32\AVERM.dll

========== Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)

SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)

SRV - [2013/01/18 10:31:42 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012/10/23 17:40:06 | 000,580,728 | ---- | M] (Threat Expert Ltd.) [Auto | Running] -- C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe -- (Browser Defender Update Service)

SRV - [2012/09/12 17:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)

SRV - [2008/09/30 12:48:28 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)

SRV - [2008/04/21 17:04:54 | 000,073,728 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe -- (Sony SCSI Helper Service)

SRV - [2007/11/06 20:22:26 | 000,092,792 | ---- | M] (CACE Technologies) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd)

SRV - [2007/08/09 07:27:52 | 000,073,728 | ---- | M] (HP) [Auto | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)

SRV - [2004/02/29 21:20:20 | 000,045,056 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\slserv.exe -- (SLService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)

DRV - File not found [Kernel | On_Demand | Stopped] -- System32\DRIVERS\wanatw4.sys -- (wanatw)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\sunkfiltp.sys -- (Sunkfiltp)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)

DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)

DRV - File not found [Kernel | On_Demand | Unknown] -- C:\ComboFix\mbr.sys -- (mbr)

DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)

DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\FreshDevices\FreshDiagnose\FreshIO.sys -- (FreshIO)

DRV - File not found [Kernel | System | Stopped] -- -- (Changer)

DRV - File not found [Kernel | On_Demand | Running] -- C:\DOCUME~1\jaroslav\LOCALS~1\Temp\catchme.sys -- (catchme)

DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\afeogwpb.sys -- (afeogwpb)

DRV - [2013/01/31 22:18:48 | 000,029,904 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{526BF133-DBA2-40BE-8E78-628A0FD068E2}\MpKsl9b5135ee.sys -- (MpKsl9b5135ee)

DRV - [2012/10/23 17:40:32 | 000,062,688 | ---- | M] (PC Tools) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PCTBD.sys -- (PCTBD)

DRV - [2011/11/28 13:51:44 | 000,032,896 | ---- | M] (AnvSoft Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\anvsnddrv.sys -- (anvsnddrv)

DRV - [2010/02/25 17:51:02 | 000,025,216 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tap0901.sys -- (tap0901)

DRV - [2010/02/19 23:24:20 | 000,104,768 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AnyDVD.sys -- (AnyDVD)

DRV - [2009/02/10 16:23:02 | 000,082,320 | ---- | M] (EZB Systems, Inc.) [File_System | System | Running] -- C:\Program Files\UltraISO\drivers\ISODrive.sys -- (ISODrive)

DRV - [2008/09/24 09:40:22 | 004,122,368 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcxwdm.sys -- (ALCXWDM)

DRV - [2008/04/13 18:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)

DRV - [2007/11/06 20:22:06 | 000,034,064 | ---- | M] (CACE Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\npf.sys -- (NPF)

DRV - [2004/06/15 07:49:37 | 000,008,552 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\asctrm.sys -- (ASCTRM)

DRV - [2004/06/07 23:38:00 | 000,391,424 | ---- | M] (Sensaura Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS)

DRV - [2004/06/07 23:30:00 | 000,069,504 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnic51.sys -- (RTL8023)

DRV - [2004/04/11 17:35:22 | 001,301,080 | ---- | M] ( ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mtlstrm.sys -- (Mtlstrm)

DRV - [2004/04/11 05:42:56 | 000,095,800 | ---- | M] ( ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\slnthal.sys -- (SlNtHal)

DRV - [2004/04/11 05:40:38 | 000,635,280 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\slntamr.sys -- (Slntamr)

DRV - [2004/04/02 07:21:52 | 000,013,840 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\RecAgent.sys -- (RecAgent)

DRV - [2004/03/22 10:27:20 | 000,042,936 | ---- | M] (Alcor Micro Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Sunkfilt39.sys -- (SunkFilt39)

DRV - [2004/03/22 10:01:38 | 000,040,564 | ---- | M] (Alcor Micro Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Sunkfilt.sys -- (SunkFilt)

DRV - [2004/02/29 20:00:10 | 000,230,584 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mtlmnt5.sys -- (Mtlmnt5)

DRV - [2004/02/29 19:38:52 | 000,180,592 | ---- | M] ( ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ntmtlfax.sys -- (NtMtlFax)

DRV - [2004/02/29 19:27:58 | 000,013,248 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\slwdmsup.sys -- (SlWdmSup)

DRV - [1999/09/10 11:06:00 | 000,025,244 | ---- | M] (Adaptec) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\ASPI32.SYS -- (ASPI32)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {2877A654-1C9F-4cb5-8438-16022B2FDD9C} - No CLSID value found

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.co.uk

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.co.uk

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1644146276-2351038451-96131757-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.landing.savetubevideo.com/index.php?from=3

IE - HKU\S-1-5-21-1644146276-2351038451-96131757-1005\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)

IE - HKU\S-1-5-21-1644146276-2351038451-96131757-1005\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-1644146276-2351038451-96131757-1005\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC

IE - HKU\S-1-5-21-1644146276-2351038451-96131757-1005\..\SearchScopes\{2877A654-1C9F-4cb5-8438-16022B2FDD9C}: "URL" = http://www.landing.savetubevideo.com/results.php?q={searchTerms}

IE - HKU\S-1-5-21-1644146276-2351038451-96131757-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1644146276-2351038451-96131757-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

IE - HKU\S-1-5-21-1644146276-2351038451-96131757-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 81.89.63.129:8080

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@parallelgraphics.com/Cortona: C:\Program Files\Common Files\ParallelGraphics\Cortona\npCortona.dll (ParallelGraphics)

FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\ [2012/12/23 04:54:28 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird

========== Chrome ==========

O1 HOSTS File: ([2013/01/31 22:41:51 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)

O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)

O3 - HKU\S-1-5-21-1644146276-2351038451-96131757-1005\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)

O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4 - HKLM..\Run: [switchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Reg Error present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskBar = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileMenu = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = [binary data]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MaxRecentDocs = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoNetHood = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWinKey = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFavoritesMenu = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanle = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: Explorer = Reg Error: Value error. File not found

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HKEY_USERS = Reg Error: Value error. File not found

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1644146276-2351038451-96131757-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-1644146276-2351038451-96131757-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-21-1644146276-2351038451-96131757-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1

O7 - HKU\S-1-5-21-1644146276-2351038451-96131757-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-21-1644146276-2351038451-96131757-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: Pridat do Anti-Banner - Reg Error: Value error. File not found

O8 - Extra context menu item: Přidat do Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm File not found

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 88.81.100.2 88.81.98.4

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FA3B0640-3A31-4E85-B706-48EB089FFE08}: DhcpNameServer = 88.81.100.2 88.81.98.4

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)

O24 - Desktop WallPaper: C:\Documents and Settings\jaroslav\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\jaroslav\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/01/31 23:10:38 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2013/01/31 23:10:09 | 000,000,000 | --SD | C] -- C:\ComboFix

[2013/01/30 18:46:11 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\jaroslav\Recent

[2013/01/29 13:14:17 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2013/01/29 13:14:17 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2013/01/29 13:14:17 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2013/01/29 13:14:16 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2013/01/29 13:13:42 | 000,000,000 | ---D | C] -- C:\Qoobox

[2013/01/29 13:12:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt

[2013/01/27 14:09:22 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0

[2013/01/25 13:54:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\jaroslav\Local Settings\Application Data\Threat Expert

[2013/01/14 16:40:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\jaroslav\Start Menu\Programs\GreenScreenWizard

[2013/01/14 16:40:23 | 000,000,000 | ---D | C] -- C:\Program Files\GreenScreenWizardPro6

[2013/01/14 16:40:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\jaroslav\My Documents\Green Screen Wizard

[2009/08/17 21:52:04 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\jaroslav\Application Data\pcouffin.sys

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/01/31 22:41:51 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2013/01/31 22:28:45 | 000,023,040 | ---- | M] () -- C:\Documents and Settings\jaroslav\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2013/01/31 02:00:02 | 000,000,348 | ---- | M] () -- C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-JAKE-jaroslav.job

[2013/01/29 14:13:09 | 000,000,396 | -H-- | M] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job

[2013/01/29 14:02:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2013/01/29 14:02:00 | 1601,753,088 | -HS- | M] () -- C:\hiberfil.sys

[2013/01/18 10:31:43 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job

[2013/01/18 10:31:42 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe

[2013/01/18 10:31:40 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl

[2013/01/15 07:38:48 | 003,716,696 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2013/01/09 10:40:59 | 000,435,688 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2013/01/09 10:40:59 | 000,068,584 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2013/01/08 14:54:57 | 000,002,848 | ---- | M] () -- C:\WINDOWS\ACROREAD.INI

[2013/01/06 05:34:35 | 006,009,856 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/01/29 13:14:18 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2013/01/29 13:14:17 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2013/01/29 13:14:17 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2013/01/29 13:14:17 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2013/01/29 13:14:17 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2013/01/25 21:18:54 | 1601,753,088 | -HS- | C] () -- C:\hiberfil.sys

[2013/01/14 16:19:02 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\jaroslav\Application Data\chrtmp

[2013/01/09 11:05:21 | 000,002,347 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk

[2012/12/23 04:53:31 | 000,769,144 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll

[2012/11/22 08:00:17 | 000,000,000 | ---- | C] () -- C:\WINDOWS\AUTORUN.INI

[2012/11/22 07:58:30 | 000,074,528 | ---- | C] () -- C:\WINDOWS\MSCOMSTF.DLL

[2012/11/22 07:58:30 | 000,065,440 | ---- | C] () -- C:\WINDOWS\MSINSSTF.DLL

[2012/11/22 07:58:30 | 000,024,544 | ---- | C] () -- C:\WINDOWS\MSDETSTF.DLL

[2012/11/22 07:58:30 | 000,017,068 | ---- | C] () -- C:\WINDOWS\REGAION.EXE

[2012/11/22 07:58:30 | 000,014,928 | ---- | C] () -- C:\WINDOWS\MSSHLSTF.DLL

[2012/11/22 07:58:30 | 000,006,144 | ---- | C] () -- C:\WINDOWS\MSUILSTF.DLL

[2012/11/22 07:58:22 | 000,002,848 | ---- | C] () -- C:\WINDOWS\ACROREAD.INI

[2012/08/18 21:01:07 | 000,000,067 | ---- | C] () -- C:\WINDOWS\Easy DVD Creator.INI

[2012/08/18 19:10:59 | 000,000,034 | -H-- | C] () -- C:\WINDOWS\System32\Converter_sysquict.dat

[2012/07/19 18:56:08 | 000,172,544 | ---- | C] () -- C:\WINDOWS\System32\libbluray.dll

[2012/07/19 18:56:02 | 006,894,331 | ---- | C] () -- C:\WINDOWS\System32\avcodec-lav-54.dll

[2012/07/19 18:56:02 | 001,111,581 | ---- | C] () -- C:\WINDOWS\System32\avformat-lav-54.dll

[2012/07/19 18:56:02 | 000,401,685 | ---- | C] () -- C:\WINDOWS\System32\swscale-lav-2.dll

[2012/07/19 18:56:02 | 000,232,895 | ---- | C] () -- C:\WINDOWS\System32\avutil-lav-51.dll

[2012/07/19 18:56:02 | 000,162,743 | ---- | C] () -- C:\WINDOWS\System32\avfilter-lav-3.dll

[2012/07/19 18:56:02 | 000,101,820 | ---- | C] () -- C:\WINDOWS\System32\avresample-lav-0.dll

[2012/07/17 08:35:20 | 003,978,240 | ---- | C] () -- C:\WINDOWS\System32\ffmpeg.dll

[2012/07/17 08:34:30 | 000,112,640 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll

[2012/07/17 08:33:48 | 000,271,360 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll

[2012/07/17 08:33:28 | 000,157,184 | ---- | C] () -- C:\WINDOWS\System32\ff_unrar.dll

[2012/07/17 08:33:28 | 000,099,840 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll

[2012/07/17 08:33:26 | 001,525,760 | ---- | C] () -- C:\WINDOWS\System32\ff_samplerate.dll

[2012/07/17 08:33:26 | 000,211,968 | ---- | C] () -- C:\WINDOWS\System32\ff_libdts.dll

[2012/07/17 08:33:26 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ff_libmad.dll

[2012/07/17 08:33:26 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\ff_liba52.dll

[2012/07/17 08:33:24 | 000,330,240 | ---- | C] () -- C:\WINDOWS\System32\ff_libfaad2.dll

[2012/06/17 21:15:04 | 000,198,144 | ---- | C] () -- C:\WINDOWS\System32\spdif_test.exe

[2012/06/17 21:14:58 | 000,097,792 | ---- | C] () -- C:\WINDOWS\System32\ac3config.exe

[2012/06/17 21:14:42 | 001,021,440 | ---- | C] () -- C:\WINDOWS\System32\ac3filter_intl.dll

[2012/06/04 14:40:50 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\AVERM.dll

[2012/06/04 14:40:49 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\AVEQT.dll

[2012/05/12 22:42:16 | 001,272,320 | ---- | C] () -- C:\WINDOWS\System32\avcodec-53.dll

[2012/05/12 22:42:16 | 000,146,432 | ---- | C] () -- C:\WINDOWS\System32\avutil-51.dll

[2012/02/15 05:31:36 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

[2011/12/07 19:32:24 | 000,216,064 | ---- | C] ( ) -- C:\WINDOWS\System32\Lagarith.dll

[2011/10/19 17:11:59 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll

[2011/09/08 14:00:52 | 000,150,528 | ---- | C] () -- C:\WINDOWS\System32\mkx.dll

[2011/09/08 14:00:48 | 000,142,336 | ---- | C] () -- C:\WINDOWS\System32\mp4.dll

[2011/09/08 14:00:42 | 000,123,392 | ---- | C] () -- C:\WINDOWS\System32\ogm.dll

[2011/09/08 14:00:38 | 000,249,856 | ---- | C] () -- C:\WINDOWS\System32\dxr.dll

[2011/09/08 14:00:34 | 000,113,152 | ---- | C] () -- C:\WINDOWS\System32\dsmux.exe

[2011/09/08 14:00:24 | 000,154,624 | ---- | C] () -- C:\WINDOWS\System32\ts.dll

[2011/09/08 14:00:10 | 000,137,728 | ---- | C] () -- C:\WINDOWS\System32\mkv2vfr.exe

[2011/09/08 14:00:06 | 000,358,400 | ---- | C] () -- C:\WINDOWS\System32\gdsmux.exe

[2011/09/08 13:59:54 | 000,080,384 | ---- | C] () -- C:\WINDOWS\System32\mkzlib.dll

[2011/09/08 13:59:52 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\mkunicode.dll

[2011/07/17 20:36:14 | 000,000,169 | ---- | C] () -- C:\WINDOWS\RtlRack.ini

[2011/07/17 20:28:56 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe

[2011/07/15 17:12:12 | 000,000,629 | ---- | C] () -- C:\Documents and Settings\jaroslav\Application Data\AutoGK.ini

[2011/07/15 17:09:31 | 000,043,602 | ---- | C] () -- C:\WINDOWS\System32\xvid-uninstall.exe

[2011/05/30 13:42:50 | 000,240,640 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

[2011/05/23 07:46:30 | 000,645,632 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll

[2011/04/27 19:53:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ViewNX.INI

[2011/04/27 19:42:53 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLdw.DAT

[2011/04/27 19:42:53 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\jaroslav\Application Data\StatusSheet

[2011/04/27 19:41:20 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT

[2011/04/27 19:41:20 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\jaroslav\Application Data\StartupItems

[2011/03/03 11:39:56 | 000,109,568 | ---- | C] () -- C:\WINDOWS\System32\avi.dll

[2011/03/03 11:38:10 | 000,097,792 | ---- | C] () -- C:\WINDOWS\System32\avs.dll

[2011/03/03 11:37:50 | 000,093,184 | ---- | C] () -- C:\WINDOWS\System32\avss.dll

[2010/11/28 10:48:58 | 000,001,536 | ---- | C] () -- C:\Documents and Settings\jaroslav\Local Settings\Application Data\SRDownloader.nast

[2010/11/28 10:46:29 | 000,165,581 | ---- | C] () -- C:\Documents and Settings\jaroslav\Local Settings\Application Data\SRDownloader.err

[2010/02/25 19:11:31 | 000,000,040 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\.zreglib

[2010/02/14 22:41:21 | 000,000,243 | ---- | C] () -- C:\Documents and Settings\jaroslav\styles.css

[2009/12/19 10:44:47 | 000,000,035 | ---- | C] () -- C:\Program Files\sm.def

[2009/08/18 07:08:25 | 000,023,040 | ---- | C] () -- C:\Documents and Settings\jaroslav\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009/08/17 21:52:04 | 000,081,920 | ---- | C] () -- C:\Documents and Settings\jaroslav\Application Data\ezpinst.exe

[2009/08/17 21:52:04 | 000,007,176 | ---- | C] () -- C:\Documents and Settings\jaroslav\Application Data\pcouffin.cat

[2009/08/17 21:52:04 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\jaroslav\Application Data\pcouffin.inf

========== ZeroAccess Check ==========

[2011/11/15 21:34:24 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 00:12:05 | 001,499,136 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 12:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 00:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

========== LOP Check ==========

[2009/09/05 13:09:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Anvsoft

[2012/05/10 14:27:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ask

[2011/11/17 15:08:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Babylon

[2009/09/26 12:28:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Cadsoft

[2011/11/15 21:45:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Driver Tool

[2011/10/09 19:50:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DriverScanner

[2011/04/27 19:42:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EnterNHelp

[2012/10/29 07:16:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ErrorEND

[2009/10/25 19:10:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ESET

[2013/01/27 18:28:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FaceOnBody

[2010/03/13 16:07:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FireGlow

[2012/11/25 12:56:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FirmTools

[2010/03/07 22:00:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GameXzone

[2010/12/18 19:35:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Gogii

[2009/10/23 21:39:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HideAndSecret3

[2009/10/17 10:24:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\JollyBear

[2010/01/29 21:34:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\kinoma

[2010/12/27 21:22:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LittleGamesCompany

[2009/10/17 10:50:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Merscom

[2009/08/27 08:23:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir

[2009/08/30 11:23:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound

[2009/10/09 19:54:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PlayFirst

[2012/11/27 23:29:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe

[2012/11/24 20:15:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Samsung

[2010/02/25 19:11:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SlySoft

[2010/10/01 14:07:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir

[2011/07/15 17:06:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Tarma Installer

[2011/04/27 19:42:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ultima_T15

[2004/06/15 07:50:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint

[2011/06/17 07:27:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip

[2012/12/23 17:14:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jaroslav\Application Data\AC3Filter

[2012/08/19 08:07:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jaroslav\Application Data\AnvSoft

[2012/05/10 15:00:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jaroslav\Application Data\Ask.com

[2012/08/18 2

February 1, 2013

OTL Extras logfile created on: 1/31/2013 11:12:05 PM - Run 1