OTL.txt Continued......

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/06/26 12:33:26 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Peter\Desktop\OTL.exe
[2012/06/25 10:31:47 | 000,000,000 | ---D | C] -- C:\Users\Peter\AppData\Local\Macromedia
[2012/06/25 10:30:17 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/06/25 10:02:34 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012/06/22 12:14:26 | 000,000,000 | ---D | C] -- C:\Users\Peter\Desktop\PC Fix Stuff
[2012/06/22 11:11:39 | 004,568,098 | R--- | C] (Swearware) -- C:\Users\Peter\Desktop\ComboFix.exe
[2012/06/14 22:07:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012/06/14 22:07:10 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2012/06/13 22:39:52 | 000,011,352 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\System32\drivers\kl2.sys
[2012/06/13 22:39:50 | 000,133,208 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\System32\drivers\kl1.sys
[2012/06/13 22:39:42 | 000,468,272 | ---- | C] (Kaspersky Lab) -- C:\Windows\System32\drivers\klif.sys
[2012/06/13 22:38:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Check Point
[2012/06/13 22:38:00 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2012/06/13 19:38:25 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2012/06/13 19:38:25 | 000,000,000 | ---D | C] -- C:\Users\Peter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2012/06/13 10:07:00 | 000,000,000 | ---D | C] -- C:\Users\Peter\AppData\Roaming\DriverCure
[2012/06/13 10:06:59 | 000,000,000 | ---D | C] -- C:\Users\Peter\AppData\Roaming\SpeedMaxPc
[2012/06/13 10:06:44 | 000,000,000 | ---D | C] -- C:\ProgramData\SpeedMaxPc
[2012/06/07 19:23:21 | 000,000,000 | ---D | C] -- C:\Users\Peter\Desktop\Angry Bird Games
[2012/05/30 12:56:26 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/05/30 12:56:26 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/05/30 12:56:26 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/05/30 12:56:02 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012/05/30 12:55:53 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/05/27 14:39:02 | 000,000,000 | ---D | C] -- C:\f4ef9b7705419548d20f362e93
[2011/09/26 16:03:55 | 003,480,352 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup310.exe
[2011/02/10 14:17:54 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\Peter\AppData\Roaming\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2012/06/26 12:56:55 | 000,003,264 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/26 12:56:55 | 000,003,264 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/26 12:42:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/26 12:33:26 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Peter\Desktop\OTL.exe
[2012/06/26 12:02:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/26 08:58:43 | 000,027,839 | ---- | M] () -- C:\Users\Peter\AppData\Roaming\nvModes.001
[2012/06/26 08:57:35 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/26 08:56:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/06/26 00:13:39 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012/06/25 10:21:22 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012/06/25 10:01:05 | 004,568,098 | R--- | M] (Swearware) -- C:\Users\Peter\Desktop\ComboFix.exe
[2012/06/21 10:23:38 | 000,441,448 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/06/21 10:07:08 | 000,604,502 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/06/21 10:07:08 | 000,104,170 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/06/21 09:28:54 | 293,174,266 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/06/14 00:23:25 | 000,001,083 | ---- | M] () -- C:\Users\Peter\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/06/13 23:43:24 | 000,001,356 | ---- | M] () -- C:\Users\Peter\AppData\Local\d3d9caps.dat
[2012/06/13 22:42:48 | 000,415,933 | ---- | M] () -- C:\Windows\System32\drivers\vsconfig.xml
[2012/06/13 22:38:28 | 000,000,639 | ---- | M] () -- C:\Users\Peter\Desktop\ZoneAlarm Security.lnk
[2012/06/13 22:37:09 | 000,000,612 | ---- | M] () -- C:\user.js
[2012/06/13 21:27:35 | 000,000,761 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.old
[2012/06/08 15:39:41 | 000,002,371 | ---- | M] () -- C:\Users\Peter\Application Data\Microsoft\Internet Explorer\Quick Launch\SyncToy.lnk
[2012/06/07 19:24:46 | 000,001,740 | ---- | M] () -- C:\Users\Peter\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Washer (2).lnk
[2012/06/07 13:43:23 | 000,002,637 | ---- | M] () -- C:\Users\Peter\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Word 2010.lnk
[2012/05/28 20:25:03 | 000,073,728 | ---- | M] () -- C:\Users\Peter\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/05/27 19:01:32 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt

========== Files Created - No Company Name ==========

[2012/06/13 22:38:28 | 000,000,639 | ---- | C] () -- C:\Users\Peter\Desktop\ZoneAlarm Security.lnk
[2012/06/07 19:24:46 | 000,001,740 | ---- | C] () -- C:\Users\Peter\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Washer (2).lnk
[2012/05/30 12:56:26 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/05/30 12:56:26 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/05/30 12:56:26 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/05/30 12:56:26 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/05/30 12:56:26 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/04/29 19:36:16 | 000,000,000 | ---- | C] () -- C:\Users\Peter\AppData\Roaming\log.sflog
[2012/02/20 13:22:01 | 000,000,288 | ---- | C] () -- C:\Users\Peter\AppData\Roaming\.backup.dm
[2011/11/22 22:23:49 | 000,000,981 | ---- | C] () -- C:\Windows\QUICKEN.INI
[2011/11/03 16:44:29 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2011/11/03 16:42:25 | 000,024,227 | ---- | C] () -- C:\Users\Peter\AppData\Roaming\UserTile.png
[2011/09/22 13:08:30 | 000,012,984 | ---- | C] () -- C:\Windows\System32\drivers\SWDUMon.sys
[2011/09/20 13:04:01 | 000,009,896 | ---- | C] () -- C:\Windows\System32\716xCoInstaller.dll
[2011/02/10 14:17:54 | 000,007,887 | ---- | C] () -- C:\Users\Peter\AppData\Roaming\pcouffin.cat
[2011/02/10 14:17:54 | 000,001,144 | ---- | C] () -- C:\Users\Peter\AppData\Roaming\pcouffin.inf
[2010/11/24 14:18:25 | 000,819,200 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2010/11/24 14:18:24 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2010/11/22 14:22:16 | 000,000,011 | ---- | C] () -- C:\ProgramData\.tv6
[2010/09/22 21:51:47 | 000,073,728 | ---- | C] () -- C:\Users\Peter\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/08/16 18:00:03 | 000,027,839 | ---- | C] () -- C:\Users\Peter\AppData\Roaming\nvModes.001
[2010/08/16 17:59:59 | 000,027,839 | ---- | C] () -- C:\Users\Peter\AppData\Roaming\nvModes.dat
[2010/07/31 21:29:10 | 000,000,000 | ---- | C] () -- C:\Users\Peter\AppData\Roaming\Default.PLS
[2010/07/28 00:14:19 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2010/07/27 23:37:09 | 000,000,216 | ---- | C] () -- C:\Windows\System32\drivers\SamSfPa.dat
[2010/07/21 15:11:21 | 001,749,760 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2010/07/21 15:11:21 | 000,180,224 | ---- | C] ( ) -- C:\Windows\System32\rsnp2uvc.dll
[2010/07/21 15:11:21 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini
[2010/07/21 15:11:20 | 000,176,128 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll
[2010/07/21 15:11:20 | 000,028,160 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2010/07/21 15:11:20 | 000,000,036 | ---- | C] () -- C:\Windows\PidList.ini
[2010/07/18 14:48:45 | 000,000,552 | ---- | C] () -- C:\Users\Peter\AppData\Local\d3d8caps.dat
[2010/07/08 09:58:07 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2010/07/08 09:39:57 | 000,045,056 | ---- | C] () -- C:\Windows\System32\PresentationHHost.exe
[2010/07/07 08:57:51 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010/07/07 08:57:51 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010/07/06 21:00:45 | 000,001,356 | ---- | C] () -- C:\Users\Peter\AppData\Local\d3d9caps.dat

========== LOP Check ==========

[2012/03/30 22:27:14 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\Akhra
[2012/01/20 14:00:36 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\Arkadium
[2011/10/13 14:48:32 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\AVG2012
[2012/01/20 01:19:01 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\Awem
[2012/04/19 14:38:05 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\Azureus
[2012/05/07 16:47:22 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\BitComet
[2012/03/27 10:22:15 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\CheckPoint
[2010/11/27 19:04:41 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\CometPlayer
[2012/06/13 10:07:00 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\DriverCure
[2012/02/23 17:50:22 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\GameHouse
[2012/01/23 19:04:07 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\GameMill Entertainment
[2011/03/15 15:57:42 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\Gygan
[2011/04/14 10:07:14 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\Leadertech
[2011/02/25 19:21:27 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\Leawo
[2012/03/09 12:11:31 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\Meridian93
[2011/02/25 19:21:29 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\Moyea
[2012/03/07 14:39:47 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\Mystery of Mortlake Mansion
[2011/11/03 16:42:25 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\PeerNetworking
[2012/02/28 21:20:06 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\PopCapv1001
[2012/03/11 12:15:19 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\PopCapv1004
[2012/02/26 13:39:56 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\PopCapv1006
[2011/07/16 19:31:00 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\Registry Mechanic
[2012/05/07 11:40:47 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\Rovio
[2012/01/12 16:42:40 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\Sahmon Games
[2011/11/22 17:53:36 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\SerpentOfIsis
[2012/06/13 10:06:59 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\SpeedMaxPc
[2011/05/15 15:02:29 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\SpinTop
[2012/04/22 12:34:01 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\SpinTop Games
[2012/06/04 16:56:20 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\Spotify
[2012/03/20 20:03:30 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\tigerplayer
[2012/01/21 22:02:18 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\TitanicMystery
[2012/02/18 13:14:41 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\TOMI3
[2012/06/26 08:57:19 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\TwonkyMedia
[2012/05/01 17:18:31 | 000,000,000 | ---D | M] -- C:\Users\Peter\AppData\Roaming\Vso
[2012/06/26 00:13:40 | 000,032,644 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< &#37;SYSTEMDRIVE%\*.* >
[2010/06/09 12:33:30 | 000,177,127 | ---- | M] () -- C:\aaw7boot.log
[2006/09/18 22:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009/04/11 07:36:36 | 000,333,257 | R-S- | M] () -- C:\bootmgr
[2010/07/06 21:14:58 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2012/06/25 10:30:03 | 000,017,830 | ---- | M] () -- C:\ComboFix.txt
[2006/09/18 22:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2009/05/07 21:53:36 | 000,000,000 | R-S- | M] () -- C:\IO.SYS
[2009/02/17 14:38:16 | 000,002,488 | ---- | M] () -- C:\LOGFILE.TXT
[2010/07/25 21:56:58 | 000,003,739 | ---- | M] () -- C:\MP4debug.log
[2009/05/07 21:53:36 | 000,000,000 | R-S- | M] () -- C:\MSDOS.SYS
[2012/06/26 08:56:47 | 3533,373,440 | -HS- | M] () -- C:\pagefile.sys
[2010/07/07 11:31:24 | 000,001,113 | ---- | M] () -- C:\rollback.ini
[2011/01/07 12:50:33 | 000,009,599 | ---- | M] () -- C:\scramble.log
[2012/06/13 22:37:09 | 000,000,612 | ---- | M] () -- C:\user.js

< %systemroot%\Fonts\*.com >
[2006/11/02 13:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 13:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 13:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2010/07/09 19:15:10 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 22:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/11/02 13:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/11/10 02:28:46 | 000,301,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2011/09/26 15:26:11 | 003,480,352 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup310.exe
[2010/07/07 00:38:31 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 11:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >
[2011/12/09 17:07:18 | 000,000,000 | ---D | M] -- C:\Program Files\Home_Accountz_2012\BAK

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/04/14 14:59:09 | 000,000,286 | -HS- | M] () -- C:\Users\Peter\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2012/06/25 10:01:05 | 004,568,098 | R--- | M] (Swearware) -- C:\Users\Peter\Desktop\ComboFix.exe
[2012/06/26 12:33:26 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Peter\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >
[2006/05/19 11:53:02 | 000,013,022 | ---- | M] () -- C:\Windows\snp2uvc.src

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\tasks\*.* >
[2012/06/26 13:02:04 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/26 08:57:35 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/26 12:42:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/26 08:57:03 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2012/06/26 00:13:40 | 000,032,644 | ---- | M] () -- C:\Windows\tasks\SCHEDLGU.TXT

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >
[2012/06/21 09:34:26 | 000,008,192 | ---- | M] () -- C:\Windows\SECURITY\Database\edb.chk
[2012/06/21 09:33:56 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edb.log
[2012/06/21 09:33:56 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edbres00001.jrs
[2012/06/21 09:33:56 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edbres00002.jrs
[2012/06/21 09:33:56 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edbtmp.log
[2012/06/21 09:33:56 | 001,056,768 | ---- | M] () -- C:\Windows\SECURITY\Database\tmp.edb

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2010/07/06 21:01:03 | 000,000,402 | -HS- | M] () -- C:\Users\Peter\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2010/11/22 14:22:16 | 000,000,011 | ---- | M] () -- C:\ProgramData\.tv6

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP48500F8
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:5C6EBC69
@Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:5D351BC6
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:55422315
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:2F4A0A6B
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:8BD8CD95
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:0B4227B4
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:5311B0B8
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:C22C13A5
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:57DC3B52
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:77A023CE
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:7C60A173
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP1B5B4F1
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:A5CD91DF
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:0441DB7A
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:11411CE5
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:302376F2
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMPA18FD1D
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:211ED887
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:A3E39C6A

< End of report >