Results from dds.com scan 176.74.176.179 blocking

connellbsd · February 15, 2014

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 11.0.9600.16384 BrowserJavaVersion: 10.51.2

Run by Bill at 10:37:04 on 2014-02-15

Microsoft Windows 8.1 Pro 6.3.9600.0.1252.1.1033.18.16336.14035 [GMT -8:00]

.

AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k RPCSS

C:\WINDOWS\system32\dwm.exe

C:\WINDOWS\system32\nvvsvc.exe

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\WINDOWS\system32\nvvsvc.exe

C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\System32\spoolsv.exe

C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe

C:\Program Files\CrashPlan\CrashPlanService.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\WINDOWS\system32\dashost.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\System32\WUDFHost.exe

C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\SearchIndexer.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Windows\System32\skydrive.exe

C:\WINDOWS\system32\taskhostex.exe

C:\Program Files\TrueCrypt\TrueCrypt.exe

C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe

C:\Program Files\CrashPlan\CrashPlanTray.exe

C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe

C:\Program Files (x86)\Evernote\Evernote\EvernoteTray.exe

C:\Program Files (x86)\Evernote\Evernote\Evernote.exe

C:\Program Files\Microsoft Office\Office15\OUTLOOK.EXE

C:\Program Files (x86)\Microsoft\BingDesktop\BDExtHost.exe

C:\Program Files (x86)\Microsoft\BingDesktop\BDAppHost.exe

C:\Program Files (x86)\Microsoft\BingDesktop\BDRuntimeHost.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\SysWOW64\NOTEPAD.EXE

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\WINDOWS\System32\svchost.exe -k WerSvcGroup

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = about:Tabs

uProxyServer = hxxp=198.27.97.214:3127

mWinlogon: Userinit = userinit.exe,

BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: Evernote extension: {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll

BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

uRun: [TrueCrypt] "C:\Program Files\TrueCrypt\TrueCrypt.exe" /q preferences /a logon /a favorites

mRun: [bingDesktop] C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe /fromkey

StartupFolder: C:\Users\Bill\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\EVERNO~1.LNK - C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe

StartupFolder: C:\Users\Bill\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\EVERNO~2.LNK - C:\Program Files (x86)\Evernote\Evernote\EvernoteTray.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\StartUp\CRASHP~1.LNK - C:\Program Files\CrashPlan\CrashPlanTray.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-System: PromptOnSecureDesktop = dword:0

mPolicies-System: ConsentPromptBehaviorAdmin = dword:0

IE: Clip image - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=4

IE: Clip selection - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=3

IE: Clip this page - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=1

IE: Clip URL - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=0

IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE/3000

IE: New note - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\NewNote.html

IE: Save to &CryptMagic - C:\Program Files (x86)\CryptMagicDesktop\IEExt.dll/CONTEXT.HTM

IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~1\Office15\ONBttnIE.dll/105

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll

IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll

IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\AddNote.html

TCP: NameServer = 68.94.157.1 68.94.156.1

TCP: Interfaces\{E4C25A2D-235C-4C0A-85C5-0D03EB34BC80} : DHCPNameServer = 68.94.157.1 68.94.156.1

Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL

SSODL: WebCheck - <orphaned>

LSA: Security Packages = ""

x64-BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll

x64-BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL

x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

x64-Run: [Nvtmru] "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"

x64-Run: [shadowPlay] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\nvspcap64.dll,ShadowPlayOnSystemStart

x64-mPolicies-System: PromptOnSecureDesktop = dword:0

x64-mPolicies-System: ConsentPromptBehaviorAdmin = dword:0

x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll

x64-IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll

x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll

x64-IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\AddNote.html

x64-Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL

x64-Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL

x64-SSODL: WebCheck - <orphaned>

x64-mASetup: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - /UserInstall

x64-mASetup: {89820200-ECBD-11cf-8B85-00AA005B4340} - U

.

============= SERVICES / DRIVERS ===============

.

R0 intelpep;Intel® Power Engine Plug-in Driver;C:\WINDOWS\System32\drivers\intelpep.sys [2013-12-14 39768]

R1 ahcache;Application Compatibility Cache;C:\WINDOWS\System32\drivers\ahcache.sys [2013-8-22 76800]

R2 BingDesktopUpdate;Bing Desktop Update service;C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [2013-11-1 173272]

R2 CrashPlanService;CrashPlan Backup Service;C:\Program Files\CrashPlan\CrashPlanService.exe [2013-4-8 222720]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-12-14 418376]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-12-14 701512]

R3 MBAMProtector;MBAMProtector;C:\WINDOWS\System32\drivers\mbam.sys [2013-12-14 25928]

R3 NcbService;Network Connection Broker;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2013-8-22 37768]

R3 NdisVirtualBus;Microsoft Virtual Network Adapter Enumerator;C:\WINDOWS\System32\drivers\NdisVirtualBus.sys [2013-8-22 16384]

R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\WINDOWS\System32\drivers\nvvad64v.sys [2013-12-14 39200]

R3 RTL8168;Realtek 8168 NT Driver;C:\WINDOWS\System32\drivers\Rt630x64.sys [2013-8-21 591360]

R3 WdNisDrv;Windows Defender Network Inspection System Driver;C:\WINDOWS\System32\drivers\WdNisDrv.sys [2013-8-22 124256]

R3 WdNisSvc;Windows Defender Network Inspection Service;C:\Program Files\Windows Defender\NisSrv.exe [2013-8-22 346872]

R3 WUDFWpdComp;WUDFWpdComp;C:\WINDOWS\System32\drivers\WUDFRd.sys [2013-8-22 230912]

R3 WUDFWpdMtp;WUDFWpdMtp;C:\WINDOWS\System32\drivers\WUDFRd.sys [2013-8-22 230912]

S3 ADP80XX;ADP80XX;C:\WINDOWS\System32\drivers\adp80xx.sys [2013-8-21 782176]

S3 AppReadiness;App Readiness;C:\WINDOWS\System32\svchost.exe -k AppReadiness [2013-8-22 37768]

S3 AppXSvc;AppX Deployment Service (AppXSVC);C:\WINDOWS\System32\svchost.exe -k wsappx [2013-8-22 37768]

S3 bcmfn2;bcmfn2 Service;C:\WINDOWS\System32\drivers\bcmfn2.sys [2013-8-21 17624]

S3 iaLPSSi_GPIO;Intel® Serial IO GPIO Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_GPIO.sys [2013-8-21 24568]

S3 iaLPSSi_I2C;Intel® Serial IO I2C Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_I2C.sys [2013-8-21 99320]

S3 iaStorAV;Intel® SATA RAID Controller Windows;C:\WINDOWS\System32\drivers\iaStorAV.sys [2013-8-21 651248]

S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\WINDOWS\System32\ieetwcollector.exe [2013-12-14 111616]

S3 kbldfltr;kbldfltr;C:\WINDOWS\System32\drivers\kbldfltr.sys [2013-9-29 22272]

S3 lfsvc;Windows Location Framework Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2013-8-22 37768]

S3 LSI_SAS3;LSI_SAS3;C:\WINDOWS\System32\drivers\lsi_sas3.sys [2013-8-21 81760]

S3 netvsc;netvsc;C:\WINDOWS\System32\drivers\netvsc63.sys [2013-8-22 87040]

S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE [2012-10-1 178824]

S3 ReFS;ReFS;C:\WINDOWS\System32\drivers\refs.sys [2013-8-22 924512]

S3 ScDeviceEnum;Smart Card Device Enumeration Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2013-8-22 37768]

S3 SerCx2;Serial UART Support Library;C:\WINDOWS\System32\drivers\SerCx2.sys [2013-12-14 146776]

S3 smphost;Microsoft Storage Spaces SMP;C:\WINDOWS\System32\svchost.exe -k smphost [2013-8-22 37768]

S3 stornvme;Microsoft Standard NVM Express Driver;C:\WINDOWS\System32\drivers\stornvme.sys [2013-12-14 57176]

S3 UEFI;Microsoft UEFI Driver;C:\WINDOWS\System32\drivers\uefi.sys [2013-8-22 26976]

S3 vmbusr;Virtual Machine Bus Provider;C:\WINDOWS\System32\drivers\vmbusr.sys [2013-9-29 129536]

S3 vmicguestinterface;Hyper-V Guest Service Interface;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2013-8-22 37768]

S3 WEPHOSTSVC;Windows Encryption Provider Host Service;C:\WINDOWS\System32\svchost.exe -k WepHostSvcGroup [2013-8-22 37768]

S4 MsKeyboardFilter;Microsoft Keyboard Filter;C:\WINDOWS\System32\svchost.exe -k netsvcs [2013-8-22 37768]

S4 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-12-14 15125280]

.

=============== Created Last 30 ================

.

2014-02-15 15:59:45 10315576 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8C17E778-69AF-400B-9BD7-22449A744C2F}\mpengine.dll

2014-02-15 07:07:13 -------- d-----w- C:\Users\Bill\AppData\Local\Mozilla

2014-02-14 10:47:28 10315576 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

2014-02-08 06:07:11 -------- d-----w- C:\Users\Bill\AppData\Roaming\JAM Software

2014-02-02 22:05:29 252688 ----a-w- C:\WINDOWS\System32\drivers\VBoxDrv.sys

2014-02-02 22:05:29 126736 ----a-w- C:\WINDOWS\System32\drivers\VBoxUSBMon.sys

2014-02-02 21:02:26 -------- d-----w- C:\Users\Bill\AppData\Local\Apps

2014-01-26 17:12:34 -------- d-----w- C:\ProgramData\Synology

2014-01-25 21:59:55 -------- d-----w- C:\Users\Bill\AppData\Roaming\Mp3tag

2014-01-25 21:58:55 -------- d-----w- C:\Program Files (x86)\Mp3tag

2014-01-25 06:33:06 -------- d-----w- C:\Users\Bill\AppData\Local\LogMeIn

2014-01-25 06:33:06 -------- d-----w- C:\ProgramData\LogMeIn

2014-01-25 02:24:43 -------- d-----w- C:\Users\Bill\AppData\Local\LogMeIn Client

2014-01-23 18:50:05 965000 ------w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{F85E5219-26C2-4982-98A3-F1696EA2226A}\gapaengine.dll

2014-01-22 05:56:25 -------- d-----w- C:\Users\Bill\AppData\Local\Diagnostics

2014-01-19 18:14:40 627600 ----a-w- C:\WINDOWS\System32\deployJava1.dll

2014-01-19 18:06:47 96168 ----a-w- C:\WINDOWS\SysWow64\WindowsAccessBridge-32.dll

2014-01-19 17:58:09 -------- d-----w- C:\WINDOWS\System32\appmgmt

.

==================== Find3M ====================

.

2014-01-30 20:47:26 693240 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerApp.exe

2014-01-30 20:47:26 105464 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerCPLApp.cpl

2014-01-19 07:38:24 270496 ------w- C:\WINDOWS\System32\MpSigStub.exe

2014-01-15 02:36:05 442880 ----a-w- C:\WINDOWS\apppatch\AcSpecfc.dll

2013-12-19 01:16:44 154896 ----a-w- C:\WINDOWS\System32\drivers\VBoxNetFlt.sys

2013-12-19 01:16:44 140560 ----a-w- C:\WINDOWS\System32\drivers\VBoxNetAdp.sys

2013-12-19 01:13:30 204048 ----a-w- C:\WINDOWS\System32\VBoxNetFltNobj.dll

2013-12-14 16:43:52 231376 ----a-w- C:\WINDOWS\System32\drivers\truecrypt.sys

2013-12-14 16:37:42 410976 ----a-w- C:\WINDOWS\SysWow64\deploytk.dll

2013-12-14 16:35:19 133120 ----a-w- C:\WINDOWS\System32\telnet.exe

2013-12-11 07:55:14 115712 ----a-w- C:\WINDOWS\System32\winbici.dll

2013-12-09 00:34:48 1227264 ----a-w- C:\WINDOWS\System32\mispace.dll

2013-12-09 00:15:28 787968 ----a-w- C:\WINDOWS\System32\uDWM.dll

2013-12-09 00:04:10 980480 ----a-w- C:\WINDOWS\SysWow64\mispace.dll

2013-11-27 15:36:30 3395920 ----a-w- C:\WINDOWS\System32\WSService.dll

2013-11-27 15:34:07 3210528 ----a-w- C:\WINDOWS\System32\msmpeg2vdec.dll

2013-11-27 15:27:07 809872 ----a-w- C:\WINDOWS\System32\mfmp4srcsnk.dll

2013-11-27 14:00:58 663680 ----a-w- C:\WINDOWS\SysWow64\mfmp4srcsnk.dll

2013-11-27 13:47:47 2804528 ----a-w- C:\WINDOWS\SysWow64\msmpeg2vdec.dll

2013-11-27 12:02:29 142848 ----a-w- C:\WINDOWS\System32\drivers\ipnat.sys

2013-11-27 11:41:57 84480 ----a-w- C:\WINDOWS\System32\WSCollect.exe

2013-11-27 10:54:00 461824 ----a-w- C:\WINDOWS\System32\XpsGdiConverter.dll

2013-11-27 10:34:10 138240 ----a-w- C:\WINDOWS\System32\OEMLicense.dll

2013-11-27 10:24:07 306688 ----a-w- C:\WINDOWS\System32\msieftp.dll

2013-11-27 10:12:00 303104 ----a-w- C:\WINDOWS\apppatch\apppatch64\AcGenral.dll

2013-11-27 10:08:24 336384 ----a-w- C:\WINDOWS\SysWow64\XpsGdiConverter.dll

2013-11-27 09:54:03 103936 ----a-w- C:\WINDOWS\SysWow64\OEMLicense.dll

2013-11-27 09:46:27 273920 ----a-w- C:\WINDOWS\SysWow64\msieftp.dll

2013-11-27 09:41:57 136704 ----a-w- C:\WINDOWS\System32\psmsrv.dll

2013-11-27 09:36:24 2415104 ----a-w- C:\WINDOWS\apppatch\AcGenral.dll

2013-11-27 09:17:40 263168 ----a-w- C:\WINDOWS\System32\bisrv.dll

2013-11-27 09:10:26 273408 ----a-w- C:\WINDOWS\System32\Windows.Graphics.dll

2013-11-27 08:58:05 1503232 ----a-w- C:\WINDOWS\System32\wlansvc.dll

2013-11-27 08:56:33 218112 ----a-w- C:\WINDOWS\SysWow64\Windows.Graphics.dll

2013-11-27 08:48:43 249856 ----a-w- C:\WINDOWS\System32\Windows.ApplicationModel.Store.TestingFramework.dll

2013-11-27 08:45:47 206336 ----a-w- C:\WINDOWS\System32\WSClient.dll

2013-11-27 08:40:50 189952 ----a-w- C:\WINDOWS\SysWow64\Windows.ApplicationModel.Store.TestingFramework.dll

2013-11-27 08:38:39 174592 ----a-w- C:\WINDOWS\SysWow64\WSClient.dll

2013-11-27 08:20:34 4106240 ----a-w- C:\WINDOWS\System32\SyncEngine.dll

2013-11-27 08:17:21 695808 ----a-w- C:\WINDOWS\SysWow64\WSShared.dll

2013-11-27 08:12:11 848384 ----a-w- C:\WINDOWS\System32\WSShared.dll

2013-11-26 13:22:55 1928144 ----a-w- C:\WINDOWS\System32\combase.dll

2013-11-26 13:20:00 2131120 ----a-w- C:\WINDOWS\System32\mfcore.dll

2013-11-26 13:20:00 1399176 ----a-w- C:\WINDOWS\System32\winmde.dll

2013-11-26 11:50:47 1371312 ----a-w- C:\WINDOWS\SysWow64\combase.dll

2013-11-26 11:44:40 2142936 ----a-w- C:\WINDOWS\SysWow64\mfcore.dll

2013-11-26 11:44:40 1204968 ----a-w- C:\WINDOWS\SysWow64\winmde.dll

2013-11-26 10:13:36 4191232 ----a-w- C:\WINDOWS\System32\win32k.sys

2013-11-26 09:21:52 18577920 ----a-w- C:\WINDOWS\System32\Windows.UI.Xaml.dll

2013-11-26 08:35:02 5769216 ----a-w- C:\WINDOWS\System32\jscript9.dll

2013-11-26 08:28:23 13925888 ----a-w- C:\WINDOWS\SysWow64\Windows.UI.Xaml.dll

2013-11-26 08:16:12 4243968 ----a-w- C:\WINDOWS\SysWow64\jscript9.dll

2013-11-26 08:02:16 1995264 ----a-w- C:\WINDOWS\System32\inetcpl.cpl

2013-11-26 07:32:06 1928192 ----a-w- C:\WINDOWS\SysWow64\inetcpl.cpl

2013-11-26 07:07:57 2334208 ----a-w- C:\WINDOWS\System32\wininet.dll

2013-11-26 06:33:33 1820160 ----a-w- C:\WINDOWS\SysWow64\wininet.dll

2013-11-25 01:32:57 1119064 ----a-w- C:\WINDOWS\System32\drivers\ndis.sys

2013-11-24 23:30:55 513536 ----a-w- C:\WINDOWS\SysWow64\rastls.dll

2013-11-24 23:28:23 589824 ----a-w- C:\WINDOWS\System32\rastls.dll

2013-11-23 19:26:48 61216 ----a-w- C:\WINDOWS\System32\OpenCL.dll

2013-11-23 19:26:48 53024 ----a-w- C:\WINDOWS\SysWow64\OpenCL.dll

2013-11-23 19:26:48 1884448 ----a-w- C:\WINDOWS\System32\nvdispco6433193.dll

2013-11-23 19:26:48 1511712 ----a-w- C:\WINDOWS\System32\nvdispgenco6433193.dll

2013-11-23 12:47:42 32088 ----a-w- C:\WINDOWS\System32\ploptin.dll

2013-11-23 07:13:57 24064 ----a-w- C:\WINDOWS\System32\bi.dll

2013-11-23 07:13:50 19456 -c--a-w- C:\WINDOWS\System32\drivers\BtaMPM.sys

2013-11-23 07:08:19 403456 ----a-w- C:\WINDOWS\System32\drivers\mrxsmb.sys

2013-11-23 04:50:00 282112 ----a-w- C:\WINDOWS\System32\SystemEventsBrokerServer.dll

2013-11-23 04:34:43 393216 ----a-w- C:\WINDOWS\System32\WMPhoto.dll

2013-11-23 04:13:51 348160 ----a-w- C:\WINDOWS\SysWow64\WMPhoto.dll

2013-11-23 03:57:14 637952 ----a-w- C:\WINDOWS\System32\SettingSyncHost.exe

2013-11-23 03:48:55 479744 ----a-w- C:\WINDOWS\SysWow64\SettingSyncHost.exe

2013-11-23 03:25:58 584192 ----a-w- C:\WINDOWS\SysWow64\SettingSyncCore.dll

2013-11-23 03:25:57 744448 ----a-w- C:\WINDOWS\System32\SettingSyncCore.dll

2013-11-23 03:19:54 2617344 ----a-w- C:\WINDOWS\System32\authui.dll

2013-11-23 03:15:13 2295808 ----a-w- C:\WINDOWS\SysWow64\authui.dll

2013-11-23 03:10:49 568832 ----a-w- C:\WINDOWS\System32\SkyDrive.exe

2013-11-21 06:58:12 207872 ----a-w- C:\WINDOWS\System32\deviceregistration.dll

2013-11-21 06:26:46 1415680 ----a-w- C:\WINDOWS\System32\lsasrv.dll

.

============= FINISH: 10:37:13.23 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 8.1 Pro

Boot Device: \Device\HarddiskVolume1

Install Date: 12/14/2013 8:28:38 AM

System Uptime: 2/15/2014 10:22:10 AM (0 hours ago)

.

Motherboard: ASUSTeK COMPUTER INC. | | P8Z77-V LE PLUS

Processor: Intel® Core i7-3770K CPU @ 3.50GHz | LGA1155 | 3501/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 60 GiB total, 15.203 GiB free.

D: is CDROM ()

F: is FIXED (NTFS) - 2794 GiB total, 1000.715 GiB free.

G: is FIXED (NTFS) - 1397 GiB total, 0.931 GiB free.

H: is FIXED (NTFS) - 2 GiB total, 0.144 GiB free.

P: is FIXED (FAT32) - 2 GiB total, 0.118 GiB free.

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP12: 1/26/2014 2:44:16 AM - Scheduled Checkpoint

RP13: 2/2/2014 1:07:22 PM - Windows Modules Installer

RP14: 2/5/2014 5:19:37 PM - Windows Update

RP15: 2/13/2014 5:25:34 AM - Scheduled Checkpoint

RP16: 2/14/2014 11:05:16 PM - Windows Modules Installer

.

==== Installed Programs ======================

.

7-Zip 9.20 (x64 edition)

Adobe Reader XI (11.0.06)

Bing Desktop

Cisco WebEx Meetings

ClipX

CrashPlan

CryptMagicDesktop

Definition Update for Microsoft Office 2013 (KB2760587) 64-Bit Edition

Evernote v. 5.1.1

GeForce Experience NvStream Client Components

Google Chrome

Google Update Helper

iSEEK AnswerWorks English Runtime

Java 7 Update 51

Java Auto Updater

Java 7 (64-bit)

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft Access MUI (English) 2013

Microsoft Access Setup Metadata MUI (English) 2013

Microsoft DCF MUI (English) 2013

Microsoft Excel MUI (English) 2013

Microsoft Groove MUI (English) 2013

Microsoft InfoPath MUI (English) 2013

Microsoft Lync MUI (English) 2013

Microsoft Office 32-bit Components 2013

Microsoft Office Live Meeting 2007

Microsoft Office OSM MUI (English) 2013

Microsoft Office OSM UX MUI (English) 2013

Microsoft Office Professional Plus 2013

Microsoft Office Proofing (English) 2013

Microsoft Office Proofing Tools 2013 - English

Microsoft Office Proofing Tools 2013 - Español

Microsoft Office Shared 32-bit MUI (English) 2013

Microsoft Office Shared MUI (English) 2013

Microsoft Office Shared Setup Metadata MUI (English) 2013

Microsoft OneNote MUI (English) 2013

Microsoft Outlook MUI (English) 2013

Microsoft PowerPoint MUI (English) 2013

Microsoft Project MUI (English) 2013

Microsoft Project Professional 2013

Microsoft Publisher MUI (English) 2013

Microsoft Silverlight

Microsoft Visio MUI (English) 2013

Microsoft Visio Professional 2013

Microsoft Word MUI (English) 2013

Mp3tag v2.58

Notepad++

NVIDIA 3D Vision Controller Driver 331.93

NVIDIA Control Panel 331.65

NVIDIA GeForce Experience 1.7.1

NVIDIA Install Application

NVIDIA LED Visualizer 1.0

NVIDIA PhysX

NVIDIA PhysX System Software 9.13.0725

NVIDIA ShadowPlay 9.3.21

NVIDIA Update 9.3.21

NVIDIA Update Components

NVIDIA Virtual Audio 1.2.9

Oracle VM VirtualBox 4.3.6

Outils de vérification linguistique 2013 de Microsoft Office - Français

OverDrive Media Console

Quicken 2014

SageTV Client

Security Update for Microsoft Excel 2013 (KB2827238) 64-Bit Edition

Security Update for Microsoft Lync 2013 (KB2850057) 64-Bit Edition

Security Update for Microsoft Office 2013 (KB2768005) 64-Bit Edition

Security Update for Microsoft Office 2013 (KB2810009) 64-Bit Edition

Security Update for Microsoft Office 2013 (KB2850064) 64-Bit Edition

Security Update for Microsoft Word 2013 (KB2827224) 64-Bit Edition

Security Update for Microsoft Word 2013 (KB2863834) 64-Bit Edition

SHIELD Streaming

Synology Assistant (remove only)

TrueCrypt

Update for Microsoft Access 2013 (KB2768008) 64-Bit Edition

Update for Microsoft Access 2013 (KB2827233) 64-Bit Edition

Update for Microsoft InfoPath 2013 (KB2837648) 64-Bit Edition

Update for Microsoft Lync 2013 (KB2817678) 64-Bit Edition

Update for Microsoft Office 2013 (KB2726954) 64-Bit Edition

Update for Microsoft Office 2013 (KB2726996) 64-Bit Edition

Update for Microsoft Office 2013 (KB2738038) 64-Bit Edition

Update for Microsoft Office 2013 (KB2760224) 64-Bit Edition

Update for Microsoft Office 2013 (KB2760242) 64-Bit Edition

Update for Microsoft Office 2013 (KB2760267) 64-Bit Edition

Update for Microsoft Office 2013 (KB2760539) 64-Bit Edition

Update for Microsoft Office 2013 (KB2760553) 64-Bit Edition

Update for Microsoft Office 2013 (KB2760610) 64-Bit Edition

Update for Microsoft Office 2013 (KB2767845) 64-Bit Edition

Update for Microsoft Office 2013 (KB2768016) 64-Bit Edition

Update for Microsoft Office 2013 (KB2817314) 64-Bit Edition

Update for Microsoft Office 2013 (KB2817316) 64-Bit Edition

Update for Microsoft Office 2013 (KB2817490) 64-Bit Edition

Update for Microsoft Office 2013 (KB2817626) 64-Bit Edition

Update for Microsoft Office 2013 (KB2826004) 64-Bit Edition

Update for Microsoft Office 2013 (KB2827225) 64-Bit Edition

Update for Microsoft Office 2013 (KB2827227) 64-Bit Edition

Update for Microsoft Office 2013 (KB2827230) 64-Bit Edition

Update for Microsoft Office 2013 (KB2827239) 64-Bit Edition

Update for Microsoft Office 2013 (KB2837626) 64-Bit Edition

Update for Microsoft Office 2013 (KB2837637) 64-Bit Edition

Update for Microsoft Office 2013 (KB2837638) 64-Bit Edition

Update for Microsoft Office 2013 (KB2837655) 64-Bit Edition

Update for Microsoft Office 2013 (KB2850066) 64-Bit Edition

Update for Microsoft OneNote 2013 (KB2850063) 64-Bit Edition

Update for Microsoft Outlook 2013 (KB2850061) 64-Bit Edition

Update for Microsoft PowerPoint 2013 (KB2767850) 64-Bit Edition

Update for Microsoft Project 2013 (KB2727085) 64-Bit Edition

Update for Microsoft Publisher 2013 (KB2837635) 64-Bit Edition

Update for Microsoft SkyDrive Pro (KB2817495) 64-Bit Edition

Update for Microsoft SkyDrive Pro (KB2837652) 64-Bit Edition

Update for Microsoft Visio 2013 (KB2817306) 64-Bit Edition

Update for Microsoft Visio Viewer 2013 (KB2768338) 64-Bit Edition

Update for Microsoft Word 2013 (KB2837647) 64-Bit Edition

ViceVersa Plus

VLC media player 2.1.2

Wondershare Video Editor(Build 3.5.0)

.

==== Event Viewer Messages From Past Week ========

.

2/15/2014 9:30:50 AM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

2/15/2014 9:19:53 AM, Error: Service Control Manager [7034] - The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s).

2/15/2014 10:21:41 AM, Error: Ntfs [137] - The default transaction resource manager on volume H: encountered a non-retryable error and could not start. The data contains the error code.

2/13/2014 5:09:09 AM, Error: disk [11] - The driver detected a controller error on \Device\Harddisk3\DR8.

2/10/2014 9:49:10 PM, Error: Schannel [36888] - A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 43. The Windows SChannel error state is 252.

.

==== End Of File ===========================

MrCharlie · February 15, 2014

Welcome to the forum.

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes and use the default font)

General Forum P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
2. If you have illegal/cracked software, cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.
Failure to remove such software will result in your topic being closed and no further assistance being provided.

MrC

Note:

Please read all of my instructions completely including these.

Make sure system restore is turned on and running, please create a new restore point

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

connellbsd · February 16, 2014

Glad I asked about how long it should take... In safe mode, It ran really fast. It actually never got to the spot where I had to click scan, It was doing some prescan routine, now that i worked correctly.

It created a folder with some .dat files and one .ini file. I did see a report that could be run, but nothing was already , so that is what I pasted in below.

RogueKiller V8.8.7 _x64_ [Feb 11 2014] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://forum.adlice.com

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9600 ) 64 bits version

Started in : Safe mode

User : Bill [Admin rights]

Mode : Scan -- Date : 02/15/2014 18:08:17

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 5 ¤¤¤

[PROXY IE][PUM] HKCU\[...]\Internet Settings : ProxyServer (hxxp=198.27.97.214:3127 [Country: , City: ]) -> FOUND

[HJ POL][PUM] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) SAMSUNG 470 Series SSD +++++

--- User ---

[MBR] 0663236f978dacf404f0889522b60b93

[bSP] fd57992c14ace7b3451f23406d763e03 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 61055 Mo

User = LL1 ... OK!

User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ IDE) ST3000DM001-9YN166 +++++

--- User ---

[MBR] 3fdb2e01b61e116abc1cb0c2078ab7ad

[bSP] 480558eee9a21db76e6882415766db90 : Empty MBR Code

Partition table:

0 - [XXXXXX] UNKNOWN (0x00) [VISIBLE] Offset (sectors): 1 | Size: 2097152 Mo

User = LL1 ... OK!

User = LL2 ... OK!

+++++ PhysicalDrive2: (\\.\PHYSICALDRIVE2 @ USB) Seagate FreeAgent GoFlex USB Device +++++

--- User ---

[MBR] ee736a7cc8bc15d5e01f9e0b871eebec

[bSP] 1c190a5c7fdbed373c17e94567fa23e5 : Empty MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 1430796 Mo

User = LL1 ... OK!

Error reading LL2 MBR! ([0x32] The request is not supported. )

Finished : << RKreport[0]_S_02152014_180817.txt >>

MrCharlie · February 16, 2014

Post in your other topic, this one is going to be closed:

https://forums.malwarebytes.org/index.php?showtopic=142366

MrC

connellbsd · February 16, 2014

When I click that link I get a "You do not have permission to view this topic."

connellbsd · February 16, 2014

My other topic is missing. This appear to be my only topic today. I tried the links from the emails i received and get that same message no permissions or not found...

MrCharlie · February 16, 2014

The wrong topic was closed, I have no control over that.

Please make sure you have created a new system restore point.

Then......

If you're sure that the proxy is not needed, just disable it, if you have a problem getting connected..just restore it:

http://www.thewindowsclub.com/how-to-configure-proxy-server-settings-in-windows-8-1

Then........

Lets clean out any adware/spyware now: (this will require a reboot so save all your work)

Please download AdwCleaner from HERE or HERE to your desktop.

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
When it's done you'll see: Pending: Please uncheck elements you don't want removed.
Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
Look over the log especially under Files/Folders for any program you want to save.
If there's a program you may want to save, just uncheck it from AdwCleaner.
If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
If you're ready to clean it all up.....click the Clean button.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.
Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
To restore an item that has been deleted:
Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Then..................

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

connellbsd · February 16, 2014

I have do not have a proxy defined, but i saw something about a proxy in the original scans text. I have no idea where that is defined. I ran the adwcleaner and posted that last night, but i assume its gone, I am reposting it below the MWB quickscan after PUP change.

Malwarebytes Anti-Malware (PRO) 1.75.0.1300
www.malwarebytes.org

Database version: v2014.02.16.04

Windows 8 x64 NTFS
Internet Explorer 11.0.9600.16476
Bill :: BILLSWORKPCHOME [administrator]

Protection: Enabled

2/16/2014 9:53:31 AM
mbam-log-2014-02-16 (09-53-31).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 232211
Time elapsed: 1 minute(s), 47 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

# AdwCleaner v3.018 - Report created 15/02/2014 at 23:28:23
# Updated 28/01/2014 by Xplode
# Operating System : Windows 8.1 Pro (64 bits)
# Username : Bill - BILLSWORKPCHOME
# Running from : C:\Users\Bill\Downloads\adwcleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16384

-\\ Google Chrome v32.0.1700.107

[ File : C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [826 octets] - [15/02/2014 23:17:11]
AdwCleaner[R1].txt - [885 octets] - [15/02/2014 23:27:48]
AdwCleaner[s0].txt - [809 octets] - [15/02/2014 23:28:23]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [868 octets] ##########

MrCharlie · February 16, 2014

RogueKiller shows it:

uProxyServer = hxxp=198.27.97.214:3127

Is it disabled??

How are the IP blocks??

MrC

connellbsd · February 16, 2014

Here is some more info. I decided to uninstall Chrome just to see if those blocks stopped, after the thread was gone I figured we were probably hosed anyway. After I rebooted, the blocking log entries stopped for more that 15 minutes, which was quite a long time when I checked the MWB logs. So as a test i brought up a virtual machine (under virtualbox) and clicked on the chrome icon. Immediatly MWB (on the primary host, not the vm) blocked that IP again. I just shut down the vm and will reboot to see if it comes back.

connellbsd · February 16, 2014

I cannot find that proxy defined anywhere. Its not in the IE place for proxies. Nothing is checked in there.

MrCharlie · February 16, 2014

OK, so you're OK now??

MrC

connellbsd · February 16, 2014

I tried to paste in an screen print of the Lan Settings dialog box, showing its empty, but this site prevents me from posting it, I uncheck those immediatly after I build a machine for home. Is there someother place they can be defined? Where did that program find that entry?

MrCharlie · February 16, 2014

paste it as an attachment

connellbsd · February 16, 2014

Won't allow it. BTW, I am still seeing this blocking occurring.

MrCharlie · February 16, 2014

Do a "print screen" and copy it into word...zip it up and attach it.

connellbsd · February 16, 2014

oops... i just needed to click on the more options button.. im an idiot.

proxydialogbox.zip

MrCharlie · February 16, 2014

Looks OK......do this:

Please download Farbar Recovery Scan Tool (FRST) and save it to a folder.

(use correct version for your system.....Which system am I using?)

FRST <----for 32 bit systems

FRST64 <----for 64 bit systems

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

If the logs are large, you can attach them:

To attach a log:

Bottom right corner of this page.

New window that comes up.

MrC

connellbsd · February 16, 2014

I will download and run that. I just found this entry which may be that proxy. I will be disabling and rebooting. Probably not related to the blocked ip, but an unknown to my proxy makes me paranoid.

connellbsd · February 16, 2014

Here is FRST pasted and addition.txt attached. -Bill

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-02-2014 01
Ran by Bill (administrator) on BILLSWORKPCHOME on 16-02-2014 11:25:29
Running from C:\Users\Bill\Downloads
Windows 8.1 Pro (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe
(NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe
(CrashPlan) C:\Program Files\CrashPlan\CrashPlanService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Microsoft Corporation) C:\WINDOWS\system32\dashost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\skydrive.exe
(TrueCrypt Foundation) C:\Program Files\TrueCrypt\TrueCrypt.exe
(Code 42 Software, Inc.) C:\Program Files\CrashPlan\CrashPlanTray.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteTray.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\Evernote.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDExtHost.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDAppHost.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BDRuntimeHost.exe
(PortableApps.com) P:\PortableApps\PortableApps.com\PortableAppsPlatform.exe
(Don HO don.h@free.fr) C:\Program Files (x86)\Notepad++\notepad++.exe
(PortableApps.com) P:\PortableApps\FirefoxPortable\FirefoxPortable.exe
(Mozilla Corporation) P:\PortableApps\FirefoxPortable\App\firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM-x32\...\Run: [bingDesktop] - C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2353880 2013-11-01] (Microsoft Corp.)
HKU\S-1-5-21-3885451084-569218164-1676833623-1001\...\Run: [TrueCrypt] - C:\Program Files\TrueCrypt\TrueCrypt.exe [1516496 2013-12-14] (TrueCrypt Foundation)
HKU\S-1-5-21-3885451084-569218164-1676833623-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\Users\Bill\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\Bill\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteTray.lnk
ShortcutTarget: EvernoteTray.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteTray.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

==================== Internet (Whitelisted) ====================

ProxyServer: http=198.27.97.214:3127
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://t.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1CEFC8594115CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US,en;q=0.5
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 68.94.157.1 68.94.156.1

==================== Services (Whitelisted) =================

R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173272 2013-11-01] (Microsoft Corp.)
R2 CrashPlanService; C:\Program Files\CrashPlan\CrashPlanService.exe [222720 2013-04-08] (CrashPlan)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S4 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15125280 2013-11-08] (NVIDIA Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-12] (Windows ® Win 7 DDK provider)
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-09] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-10] (Microsoft Corporation)
S3 kbldfltr; C:\Windows\System32\drivers\kbldfltr.sys [22272 2013-09-29] (Microsoft Corporation)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-09-27] (NVIDIA Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-25] (Microsoft Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
R3 WUDFWpdComp; C:\Windows\system32\DRIVERS\WUDFRd.sys [230912 2013-08-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-02-16 11:25 - 2014-02-16 11:25 - 00008557 _____ () C:\Users\Bill\Downloads\FRST.txt
2014-02-16 11:25 - 2014-02-16 11:25 - 00000000 ____D () C:\FRST
2014-02-16 11:24 - 2014-02-16 11:24 - 02152960 _____ (Farbar) C:\Users\Bill\Downloads\FRST64.exe
2014-02-16 11:21 - 2014-02-16 11:21 - 00000000 ____D () C:\Users\Bill\AppData\Local\Mozilla
2014-02-16 10:51 - 2014-02-06 04:16 - 23170048 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-02-16 10:51 - 2014-02-06 03:30 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2014-02-16 10:51 - 2014-02-06 03:30 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwcollectorres.dll
2014-02-16 10:51 - 2014-02-06 03:12 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-02-16 10:51 - 2014-02-06 03:07 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll
2014-02-16 10:51 - 2014-02-06 03:06 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwproxystub.dll
2014-02-16 10:51 - 2014-02-06 02:57 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2014-02-16 10:51 - 2014-02-06 02:56 - 00033792 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll
2014-02-16 10:51 - 2014-02-06 02:49 - 00139264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieUnatt.exe
2014-02-16 10:51 - 2014-02-06 02:48 - 00708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2014-02-16 10:51 - 2014-02-06 02:48 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwcollector.exe
2014-02-16 10:51 - 2014-02-06 02:38 - 17103872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-02-16 10:51 - 2014-02-06 02:32 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-02-16 10:51 - 2014-02-06 02:20 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2014-02-16 10:51 - 2014-02-06 02:17 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll
2014-02-16 10:51 - 2014-02-06 02:11 - 05768704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-02-16 10:51 - 2014-02-06 02:01 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll
2014-02-16 10:51 - 2014-02-06 02:00 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieetwproxystub.dll
2014-02-16 10:51 - 2014-02-06 01:57 - 02168320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-02-16 10:51 - 2014-02-06 01:57 - 00627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-02-16 10:51 - 2014-02-06 01:52 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2014-02-16 10:51 - 2014-02-06 01:52 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll
2014-02-16 10:51 - 2014-02-06 01:50 - 02041856 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-02-16 10:51 - 2014-02-06 01:47 - 00112128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieUnatt.exe
2014-02-16 10:51 - 2014-02-06 01:46 - 00553472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2014-02-16 10:51 - 2014-02-06 01:25 - 04244480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-02-16 10:51 - 2014-02-06 01:25 - 00164864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll
2014-02-16 10:51 - 2014-02-06 01:24 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-02-16 10:51 - 2014-02-06 01:22 - 13051392 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-02-16 10:51 - 2014-02-06 01:13 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-02-16 10:51 - 2014-02-06 01:09 - 01964032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-02-16 10:51 - 2014-02-06 01:03 - 11266048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-02-16 10:51 - 2014-02-06 00:55 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-02-16 10:51 - 2014-02-06 00:41 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-02-16 10:51 - 2014-02-06 00:40 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-02-16 10:51 - 2014-02-06 00:36 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-02-16 10:51 - 2014-02-06 00:34 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-02-16 10:50 - 2014-01-09 00:25 - 02804224 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2014-02-16 10:50 - 2014-01-08 23:59 - 01020928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2014-02-16 10:50 - 2014-01-08 23:59 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll
2014-02-16 10:50 - 2014-01-08 23:49 - 00919040 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-02-16 10:50 - 2014-01-08 23:44 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveTelemetry.dll
2014-02-16 10:50 - 2014-01-08 23:43 - 00121344 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveShell.dll
2014-02-16 10:50 - 2014-01-08 23:29 - 00105984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SkyDriveShell.dll
2014-02-16 10:50 - 2014-01-08 23:28 - 04217344 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll
2014-02-16 10:50 - 2014-01-08 23:28 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-02-16 10:50 - 2014-01-08 23:18 - 00870912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe
2014-02-16 10:50 - 2014-01-06 21:00 - 02397184 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2014-02-16 10:50 - 2014-01-06 20:30 - 02071552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2014-02-16 10:50 - 2014-01-04 12:50 - 01462216 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll
2014-02-16 10:50 - 2014-01-04 11:22 - 01202888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\propsys.dll
2014-02-16 10:50 - 2014-01-04 06:30 - 13209088 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2014-02-16 10:50 - 2014-01-04 06:23 - 11702272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2014-02-16 10:50 - 2014-01-04 05:42 - 01105408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFolder.dll
2014-02-16 10:50 - 2014-01-04 05:40 - 07416832 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2014-02-16 10:50 - 2014-01-04 05:36 - 00830976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFolder.dll
2014-02-16 10:50 - 2014-01-04 05:28 - 04961792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2014-02-16 10:50 - 2013-12-20 18:10 - 00009701 _____ () C:\WINDOWS\SysWOW64\connectedsearch-results.searchconnector-ms
2014-02-16 10:50 - 2013-12-20 18:10 - 00009701 _____ () C:\WINDOWS\system32\connectedsearch-results.searchconnector-ms
2014-02-16 10:50 - 2013-12-20 02:10 - 01113040 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2014-02-16 10:50 - 2013-12-19 22:13 - 00835584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2014-02-16 10:50 - 2013-12-08 18:57 - 00548864 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-02-16 10:50 - 2013-12-08 17:51 - 00454656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-02-16 10:50 - 2013-12-08 16:27 - 02152448 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2014-02-16 10:50 - 2013-12-08 16:19 - 00570880 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdrm.dll
2014-02-16 10:50 - 2013-12-08 15:55 - 00444928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msdrm.dll
2014-02-16 10:50 - 2013-12-08 15:54 - 01317376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2014-02-16 10:50 - 2013-11-20 22:42 - 04604416 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2014-02-16 10:50 - 2013-11-20 21:44 - 03936256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2014-02-16 10:49 - 2014-01-06 23:03 - 00018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcaui.exe
2014-02-16 10:49 - 2014-01-06 21:59 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pcaui.exe
2014-02-16 10:46 - 2014-01-07 17:46 - 00325464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2014-02-16 10:46 - 2014-01-07 17:41 - 01530712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2014-02-16 10:46 - 2014-01-07 17:41 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2014-02-16 10:46 - 2014-01-04 07:54 - 00138240 _____ () C:\WINDOWS\system32\OEMLicense.dll
2014-02-16 10:46 - 2014-01-04 07:08 - 00103936 _____ () C:\WINDOWS\SysWOW64\OEMLicense.dll
2014-02-16 10:46 - 2014-01-04 06:08 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll
2014-02-16 10:46 - 2014-01-04 05:53 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll
2014-02-16 10:46 - 2014-01-02 15:54 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll
2014-02-16 10:46 - 2014-01-02 15:48 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsGdiConverter.dll
2014-02-16 10:46 - 2014-01-02 15:40 - 05770752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2014-02-16 10:46 - 2014-01-02 15:38 - 06640640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2014-02-16 10:46 - 2013-12-31 17:55 - 01720560 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2014-02-16 10:46 - 2013-12-31 17:52 - 00481944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2014-02-16 10:46 - 2013-12-31 16:56 - 01472048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2014-02-16 10:46 - 2013-12-31 16:55 - 00381168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2014-02-16 10:46 - 2013-12-31 15:59 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2014-02-16 10:46 - 2013-12-31 15:57 - 01214976 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2014-02-16 10:46 - 2013-12-31 15:56 - 00960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2014-02-16 10:46 - 2013-12-30 15:34 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sti.dll
2014-02-16 10:46 - 2013-12-30 15:33 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll
2014-02-16 10:46 - 2013-12-30 15:32 - 00303616 _____ (Microsoft Corporation) C:\WINDOWS\system32\sti.dll
2014-02-16 10:46 - 2013-12-30 15:31 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2014-02-16 10:46 - 2013-12-30 15:31 - 00914944 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll
2014-02-16 10:46 - 2013-12-27 07:09 - 00419160 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2014-02-16 10:46 - 2013-12-27 02:38 - 01057280 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll
2014-02-16 10:46 - 2013-12-27 00:57 - 00842752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll
2014-02-16 10:46 - 2013-12-27 00:57 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2014-02-16 10:46 - 2013-12-27 00:23 - 00749056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2014-02-16 10:46 - 2013-12-27 00:16 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll
2014-02-16 10:46 - 2013-12-26 23:03 - 00630272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll
2014-02-16 10:46 - 2013-12-26 23:03 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2014-02-16 10:46 - 2013-12-26 22:37 - 00588800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2014-02-16 10:46 - 2013-12-20 23:21 - 00376320 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnrpsvc.dll
2014-02-16 10:46 - 2013-12-16 23:21 - 00408576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2014-02-16 10:46 - 2013-12-13 22:31 - 13949440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2014-02-16 10:46 - 2013-12-13 22:19 - 18576384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2014-02-16 10:46 - 2013-12-13 02:54 - 00131160 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe
2014-02-16 10:46 - 2013-12-12 22:36 - 00178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll
2014-02-16 10:46 - 2013-12-12 21:32 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\easwrt.dll
2014-02-16 10:46 - 2013-12-09 00:05 - 21199256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2014-02-16 10:46 - 2013-12-08 20:51 - 18643560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2014-02-16 10:46 - 2013-12-08 19:25 - 04190720 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-02-16 09:47 - 2014-02-16 09:47 - 00001308 _____ () C:\WINDOWS\PFRO.log
2014-02-15 23:16 - 2014-02-15 23:28 - 00000000 ____D () C:\AdwCleaner
2014-02-15 23:15 - 2014-02-15 23:15 - 01166132 _____ () C:\Users\Bill\Downloads\adwcleaner.exe
2014-02-15 15:40 - 2014-02-15 18:09 - 00000000 ____D () C:\Users\Bill\Desktop\RK_Quarantine
2014-02-15 15:39 - 2014-02-15 15:40 - 04408320 _____ () C:\Users\Bill\Downloads\RogueKillerX64.exe
2014-02-15 10:37 - 2014-02-15 10:37 - 00020236 _____ () C:\Users\Bill\Desktop\dds.txt
2014-02-15 10:37 - 2014-02-15 10:37 - 00007305 _____ () C:\Users\Bill\Desktop\attach.txt
2014-02-15 10:32 - 2014-02-15 10:32 - 00688992 ____R (Swearware) C:\Users\Bill\Downloads\dds.com
2014-02-15 08:11 - 2014-02-15 08:11 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Safer-Networking
2014-02-10 22:33 - 2014-02-10 22:33 - 06571615 _____ () C:\Users\Bill\Downloads\FVS318G_V3.1.1-14.zip
2014-02-10 22:07 - 2014-02-10 22:08 - 46973712 _____ (Intuit ) C:\Users\Bill\Downloads\QW2014R6Patch.exe
2014-02-08 07:13 - 2014-02-08 07:13 - 00005483 _____ () C:\Users\Bill\Downloads\Parasite9781478926047.odm
2014-02-07 22:07 - 2014-02-07 22:07 - 00000000 ____D () C:\Users\Bill\AppData\Roaming\JAM Software
2014-02-06 21:15 - 2014-02-06 21:18 - 128430152 _____ (McAfee, Inc.) C:\Users\Bill\Downloads\7341xdat.exe
2014-02-05 17:52 - 2014-02-05 17:52 - 00005243 _____ () C:\Users\Bill\Downloads\ReaganDiariesExtendedSelections9780061262685.odm
2014-02-04 21:15 - 2014-02-05 09:50 - 00003330 _____ () C:\Users\Bill\Documents\2013-2014PRP.txt
2014-02-04 21:15 - 2014-02-04 21:15 - 00009131 _____ () C:\Users\Bill\Documents\2012-2013_Performance_Review_PDS.txt
2014-02-03 11:39 - 2014-02-03 11:39 - 00004986 _____ () C:\Users\Bill\Downloads\UndertheBannerofHeaven9780739329788.odm
2014-02-02 14:05 - 2013-12-18 17:19 - 00252688 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxDrv.sys
2014-02-02 14:05 - 2013-12-18 17:16 - 00126736 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxUSBMon.sys
2014-02-02 13:02 - 2014-02-02 13:02 - 00000000 ____D () C:\Users\Bill\AppData\Local\Apps\2.0
2014-02-02 11:16 - 2014-02-02 11:16 - 00007711 _____ () C:\Users\Bill\Downloads\DangerousWomen-57870 (1).odm
2014-02-02 11:07 - 2014-02-02 11:07 - 00009792 _____ () C:\Users\Bill\Downloads\AStormofSwords9780739353479.odm
2014-02-02 00:35 - 2014-02-02 00:35 - 00007711 _____ () C:\Users\Bill\Downloads\DangerousWomen-57870.odm
2014-02-02 00:35 - 2014-02-02 00:35 - 00004990 _____ () C:\Users\Bill\Downloads\InColdBlood0739333658.odm
2014-02-02 00:31 - 2014-02-02 00:31 - 00004553 _____ () C:\Users\Bill\Downloads\OntheRoad9781433298554.odm
2014-01-26 21:43 - 2014-01-26 21:43 - 00006300 _____ () C:\Users\Bill\Downloads\RiseofTheodoreRoosevelt-56070.odm
2014-01-26 12:56 - 2014-02-15 07:56 - 00000428 __RSH () C:\Users\Bill\ntuser.pol
2014-01-26 09:12 - 2014-01-26 09:12 - 00000000 ____D () C:\ProgramData\Synology
2014-01-26 08:39 - 2014-01-26 08:40 - 08861848 _____ () C:\Users\Bill\Downloads\SynologyAssistantSetup-4.3-4359.exe
2014-01-25 17:36 - 2014-01-25 17:36 - 00007654 _____ () C:\Users\Bill\Downloads\HouseofCards9781400181681.odm
2014-01-25 13:59 - 2014-01-25 14:01 - 00000000 ____D () C:\Users\Bill\AppData\Roaming\Mp3tag
2014-01-25 13:58 - 2014-01-25 13:58 - 02634152 _____ () C:\Users\Bill\Downloads\mp3tagv258setup.exe
2014-01-25 13:58 - 2014-01-25 13:58 - 00000991 _____ () C:\Users\Public\Desktop\Mp3tag.lnk
2014-01-25 13:58 - 2014-01-25 13:58 - 00000000 ____D () C:\Program Files (x86)\Mp3tag
2014-01-24 22:33 - 2014-01-24 22:33 - 00000000 ____D () C:\ProgramData\LogMeIn
2014-01-24 18:24 - 2014-01-24 18:24 - 03715768 _____ (LogMeIn, Inc.) C:\Users\Bill\Downloads\LogMeIn Client (1).exe
2014-01-24 17:34 - 2014-01-24 17:34 - 00004931 _____ () C:\Users\Bill\Downloads\WeAreSoldiersStill9780061702594.odm
2014-01-24 09:48 - 2014-01-24 09:48 - 00004800 _____ () C:\Users\Bill\Downloads\EndOfMoney.odm
2014-01-24 08:38 - 2014-01-24 08:38 - 00214736 _____ (Microsoft Corporation) C:\Users\Bill\Downloads\PortQryUI.exe
2014-01-23 07:46 - 2014-01-23 07:46 - 00001524 _____ () C:\Users\Bill\Documents\open ssl creation text.txt
2014-01-19 10:14 - 2014-01-19 10:14 - 00627600 _____ (Oracle Corporation) C:\WINDOWS\system32\deployJava1.dll
2014-01-19 10:14 - 2014-01-19 10:14 - 00252296 _____ (Oracle Corporation) C:\WINDOWS\system32\javaws.exe
2014-01-19 10:14 - 2014-01-19 10:14 - 00188808 _____ (Oracle Corporation) C:\WINDOWS\system32\javaw.exe
2014-01-19 10:14 - 2014-01-19 10:14 - 00188808 _____ (Oracle Corporation) C:\WINDOWS\system32\java.exe
2014-01-19 10:14 - 2014-01-19 10:14 - 00000000 ____D () C:\Program Files\Java
2014-01-19 10:12 - 2014-01-19 10:13 - 21323656 _____ (Oracle Corporation) C:\Users\Bill\Downloads\jre-7-windows-x64.exe
2014-01-19 10:09 - 2014-01-19 10:09 - 02682880 _____ () C:\Users\Bill\Downloads\AdbeRdrSecUpd11005.msp
2014-01-19 10:07 - 2014-01-19 10:07 - 00000000 ____D () C:\Users\Bill\AppData\Roaming\Macromedia
2014-01-19 10:06 - 2014-01-19 10:06 - 00264616 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2014-01-19 10:06 - 2014-01-19 10:06 - 00175016 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2014-01-19 10:06 - 2014-01-19 10:06 - 00174504 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2014-01-19 10:06 - 2014-01-19 10:06 - 00096168 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2014-01-19 10:06 - 2014-01-19 10:06 - 00000000 ____D () C:\Program Files (x86)\Java
2014-01-19 10:05 - 2014-01-19 10:05 - 00921000 _____ (Oracle Corporation) C:\Users\Bill\Downloads\chromeinstall-7u51.exe
2014-01-19 09:58 - 2014-01-19 09:58 - 00000000 ____D () C:\WINDOWS\system32\appmgmt
2014-01-18 14:41 - 2014-01-18 14:41 - 00002523 _____ () C:\Users\Public\Desktop\Evernote.lnk
2014-01-18 14:32 - 2014-02-16 10:53 - 00004982 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for BILLSWORKPCHOME-Bill BillsWorkPCHome
2014-01-18 09:10 - 2014-02-16 09:19 - 00000000 ____D () C:\Users\Bill\AppData\Roaming\vlc

==================== One Month Modified Files and Folders =======

2014-02-16 11:25 - 2014-02-16 11:25 - 00008557 _____ () C:\Users\Bill\Downloads\FRST.txt
2014-02-16 11:25 - 2014-02-16 11:25 - 00000000 ____D () C:\FRST
2014-02-16 11:24 - 2014-02-16 11:24 - 02152960 _____ (Farbar) C:\Users\Bill\Downloads\FRST64.exe
2014-02-16 11:23 - 2013-09-29 20:14 - 00818732 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-02-16 11:21 - 2014-02-16 11:21 - 00000000 ____D () C:\Users\Bill\AppData\Local\Mozilla
2014-02-16 11:21 - 2013-12-16 07:07 - 00000000 ____D () C:\Users\Bill\AppData\Roaming\Mozilla
2014-02-16 11:19 - 2013-12-14 08:28 - 01293726 _____ () C:\WINDOWS\WindowsUpdate.log
2014-02-16 11:19 - 2013-10-24 17:34 - 00000000 __RDO () C:\Users\Bill\SkyDrive
2014-02-16 11:19 - 2013-08-22 06:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-02-16 11:00 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-02-16 10:57 - 2013-08-22 07:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-02-16 10:57 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\MediaViewer
2014-02-16 10:57 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\FileManager
2014-02-16 10:57 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\Camera
2014-02-16 10:53 - 2014-01-18 14:32 - 00004982 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for BILLSWORKPCHOME-Bill BillsWorkPCHome
2014-02-16 10:52 - 2013-12-14 17:10 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-02-16 10:51 - 2013-12-14 17:10 - 88567024 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-02-16 10:48 - 2013-12-14 08:28 - 00000000 ___RD () C:\Users\Bill\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-16 10:48 - 2013-12-14 08:28 - 00000000 ___RD () C:\Users\Bill\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-02-16 10:48 - 2013-08-22 06:44 - 00474816 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-02-16 10:47 - 2013-08-22 05:25 - 01310720 ___SH () C:\WINDOWS\system32\config\BBI
2014-02-16 10:27 - 2013-10-25 05:50 - 00000000 ____D () C:\Users\Bill\.VirtualBox
2014-02-16 10:13 - 2013-12-14 08:34 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3885451084-569218164-1676833623-1001
2014-02-16 09:47 - 2014-02-16 09:47 - 00001308 _____ () C:\WINDOWS\PFRO.log
2014-02-16 09:38 - 2013-12-23 18:33 - 00000000 ____D () C:\WINDOWS\Minidump
2014-02-16 09:38 - 2013-12-14 08:20 - 00000000 ___DC () C:\WINDOWS\Panther
2014-02-16 09:21 - 2013-12-14 08:39 - 00000000 ____D () C:\Program Files (x86)\Google
2014-02-16 09:19 - 2014-01-18 09:10 - 00000000 ____D () C:\Users\Bill\AppData\Roaming\vlc
2014-02-15 23:28 - 2014-02-15 23:16 - 00000000 ____D () C:\AdwCleaner
2014-02-15 23:15 - 2014-02-15 23:15 - 01166132 _____ () C:\Users\Bill\Downloads\adwcleaner.exe
2014-02-15 18:19 - 2013-11-20 06:42 - 00002230 ____H () C:\Users\Bill\Documents\Default.rdp
2014-02-15 18:09 - 2014-02-15 15:40 - 00000000 ____D () C:\Users\Bill\Desktop\RK_Quarantine
2014-02-15 15:40 - 2014-02-15 15:39 - 04408320 _____ () C:\Users\Bill\Downloads\RogueKillerX64.exe
2014-02-15 10:58 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-02-15 10:37 - 2014-02-15 10:37 - 00020236 _____ () C:\Users\Bill\Desktop\dds.txt
2014-02-15 10:37 - 2014-02-15 10:37 - 00007305 _____ () C:\Users\Bill\Desktop\attach.txt
2014-02-15 10:32 - 2014-02-15 10:32 - 00688992 ____R (Swearware) C:\Users\Bill\Downloads\dds.com
2014-02-15 09:55 - 2013-10-24 17:33 - 00000000 ____D () C:\Users\Bill\AppData\Local\Packages
2014-02-15 08:11 - 2014-02-15 08:11 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Safer-Networking
2014-02-15 07:56 - 2014-01-26 12:56 - 00000428 __RSH () C:\Users\Bill\ntuser.pol
2014-02-15 07:56 - 2013-12-14 08:28 - 00000000 ____D () C:\Users\Bill
2014-02-14 23:05 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-02-14 07:45 - 2013-12-16 07:07 - 00000000 ____D () C:\Users\Bill\AppData\Roaming\webex
2014-02-12 22:37 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-02-10 22:33 - 2014-02-10 22:33 - 06571615 _____ () C:\Users\Bill\Downloads\FVS318G_V3.1.1-14.zip
2014-02-10 22:14 - 2013-12-14 09:28 - 00000000 ____D () C:\Program Files (x86)\Quicken
2014-02-10 22:08 - 2014-02-10 22:07 - 46973712 _____ (Intuit ) C:\Users\Bill\Downloads\QW2014R6Patch.exe
2014-02-08 07:13 - 2014-02-08 07:13 - 00005483 _____ () C:\Users\Bill\Downloads\Parasite9781478926047.odm
2014-02-07 22:07 - 2014-02-07 22:07 - 00000000 ____D () C:\Users\Bill\AppData\Roaming\JAM Software
2014-02-06 21:18 - 2014-02-06 21:15 - 128430152 _____ (McAfee, Inc.) C:\Users\Bill\Downloads\7341xdat.exe
2014-02-06 04:16 - 2014-02-16 10:51 - 23170048 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-02-06 03:30 - 2014-02-16 10:51 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2014-02-06 03:30 - 2014-02-16 10:51 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwcollectorres.dll
2014-02-06 03:12 - 2014-02-16 10:51 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-02-06 03:07 - 2014-02-16 10:51 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll
2014-02-06 03:06 - 2014-02-16 10:51 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwproxystub.dll
2014-02-06 02:57 - 2014-02-16 10:51 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2014-02-06 02:56 - 2014-02-16 10:51 - 00033792 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll
2014-02-06 02:49 - 2014-02-16 10:51 - 00139264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieUnatt.exe
2014-02-06 02:48 - 2014-02-16 10:51 - 00708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2014-02-06 02:48 - 2014-02-16 10:51 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwcollector.exe
2014-02-06 02:38 - 2014-02-16 10:51 - 17103872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-02-06 02:32 - 2014-02-16 10:51 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-02-06 02:20 - 2014-02-16 10:51 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2014-02-06 02:17 - 2014-02-16 10:51 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll
2014-02-06 02:11 - 2014-02-16 10:51 - 05768704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-02-06 02:01 - 2014-02-16 10:51 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll
2014-02-06 02:00 - 2014-02-16 10:51 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieetwproxystub.dll
2014-02-06 01:57 - 2014-02-16 10:51 - 02168320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-02-06 01:57 - 2014-02-16 10:51 - 00627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-02-06 01:52 - 2014-02-16 10:51 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2014-02-06 01:52 - 2014-02-16 10:51 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll
2014-02-06 01:50 - 2014-02-16 10:51 - 02041856 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-02-06 01:47 - 2014-02-16 10:51 - 00112128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieUnatt.exe
2014-02-06 01:46 - 2014-02-16 10:51 - 00553472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2014-02-06 01:25 - 2014-02-16 10:51 - 04244480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-02-06 01:25 - 2014-02-16 10:51 - 00164864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll
2014-02-06 01:24 - 2014-02-16 10:51 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-02-06 01:22 - 2014-02-16 10:51 - 13051392 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-02-06 01:13 - 2014-02-16 10:51 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-02-06 01:09 - 2014-02-16 10:51 - 01964032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-02-06 01:03 - 2014-02-16 10:51 - 11266048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-02-06 00:55 - 2014-02-16 10:51 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-02-06 00:41 - 2014-02-16 10:51 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-02-06 00:40 - 2014-02-16 10:51 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-02-06 00:36 - 2014-02-16 10:51 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-02-06 00:34 - 2014-02-16 10:51 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-02-05 17:52 - 2014-02-05 17:52 - 00005243 _____ () C:\Users\Bill\Downloads\ReaganDiariesExtendedSelections9780061262685.odm
2014-02-05 09:50 - 2014-02-04 21:15 - 00003330 _____ () C:\Users\Bill\Documents\2013-2014PRP.txt
2014-02-04 21:15 - 2014-02-04 21:15 - 00009131 _____ () C:\Users\Bill\Documents\2012-2013_Performance_Review_PDS.txt
2014-02-03 11:39 - 2014-02-03 11:39 - 00004986 _____ () C:\Users\Bill\Downloads\UndertheBannerofHeaven9780739329788.odm
2014-02-02 14:05 - 2013-12-14 09:16 - 00001092 _____ () C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2014-02-02 13:10 - 2013-12-14 16:42 - 00000649 _____ () C:\Users\Bill\Desktop\Start.exe.lnk
2014-02-02 13:02 - 2014-02-02 13:02 - 00000000 ____D () C:\Users\Bill\AppData\Local\Apps\2.0
2014-02-02 11:48 - 2013-12-23 19:16 - 00000605 _____ () C:\Users\Bill\scanner.ini
2014-02-02 11:16 - 2014-02-02 11:16 - 00007711 _____ () C:\Users\Bill\Downloads\DangerousWomen-57870 (1).odm
2014-02-02 11:07 - 2014-02-02 11:07 - 00009792 _____ () C:\Users\Bill\Downloads\AStormofSwords9780739353479.odm
2014-02-02 00:35 - 2014-02-02 00:35 - 00007711 _____ () C:\Users\Bill\Downloads\DangerousWomen-57870.odm
2014-02-02 00:35 - 2014-02-02 00:35 - 00004990 _____ () C:\Users\Bill\Downloads\InColdBlood0739333658.odm
2014-02-02 00:31 - 2014-02-02 00:31 - 00004553 _____ () C:\Users\Bill\Downloads\OntheRoad9781433298554.odm
2014-01-30 12:47 - 2013-08-22 07:38 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-01-30 12:47 - 2013-08-22 07:38 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-26 21:43 - 2014-01-26 21:43 - 00006300 _____ () C:\Users\Bill\Downloads\RiseofTheodoreRoosevelt-56070.odm
2014-01-26 12:55 - 2013-08-22 07:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-01-26 09:12 - 2014-01-26 09:12 - 00000000 ____D () C:\ProgramData\Synology
2014-01-26 09:12 - 2013-12-14 08:43 - 00001176 _____ () C:\Users\Public\Desktop\Synology Assistant.lnk
2014-01-26 08:40 - 2014-01-26 08:39 - 08861848 _____ () C:\Users\Bill\Downloads\SynologyAssistantSetup-4.3-4359.exe
2014-01-25 17:36 - 2014-01-25 17:36 - 00007654 _____ () C:\Users\Bill\Downloads\HouseofCards9781400181681.odm
2014-01-25 14:01 - 2014-01-25 13:59 - 00000000 ____D () C:\Users\Bill\AppData\Roaming\Mp3tag
2014-01-25 13:58 - 2014-01-25 13:58 - 02634152 _____ () C:\Users\Bill\Downloads\mp3tagv258setup.exe
2014-01-25 13:58 - 2014-01-25 13:58 - 00000991 _____ () C:\Users\Public\Desktop\Mp3tag.lnk
2014-01-25 13:58 - 2014-01-25 13:58 - 00000000 ____D () C:\Program Files (x86)\Mp3tag
2014-01-24 22:33 - 2014-01-24 22:33 - 00000000 ____D () C:\ProgramData\LogMeIn
2014-01-24 18:24 - 2014-01-24 18:24 - 03715768 _____ (LogMeIn, Inc.) C:\Users\Bill\Downloads\LogMeIn Client (1).exe
2014-01-24 17:34 - 2014-01-24 17:34 - 00004931 _____ () C:\Users\Bill\Downloads\WeAreSoldiersStill9780061702594.odm
2014-01-24 09:48 - 2014-01-24 09:48 - 00004800 _____ () C:\Users\Bill\Downloads\EndOfMoney.odm
2014-01-24 08:38 - 2014-01-24 08:38 - 00214736 _____ (Microsoft Corporation) C:\Users\Bill\Downloads\PortQryUI.exe
2014-01-23 07:46 - 2014-01-23 07:46 - 00001524 _____ () C:\Users\Bill\Documents\open ssl creation text.txt
2014-01-21 21:56 - 2013-08-22 07:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2014-01-19 10:14 - 2014-01-19 10:14 - 00627600 _____ (Oracle Corporation) C:\WINDOWS\system32\deployJava1.dll
2014-01-19 10:14 - 2014-01-19 10:14 - 00252296 _____ (Oracle Corporation) C:\WINDOWS\system32\javaws.exe
2014-01-19 10:14 - 2014-01-19 10:14 - 00188808 _____ (Oracle Corporation) C:\WINDOWS\system32\javaw.exe
2014-01-19 10:14 - 2014-01-19 10:14 - 00188808 _____ (Oracle Corporation) C:\WINDOWS\system32\java.exe
2014-01-19 10:14 - 2014-01-19 10:14 - 00000000 ____D () C:\Program Files\Java
2014-01-19 10:13 - 2014-01-19 10:12 - 21323656 _____ (Oracle Corporation) C:\Users\Bill\Downloads\jre-7-windows-x64.exe
2014-01-19 10:09 - 2014-01-19 10:09 - 02682880 _____ () C:\Users\Bill\Downloads\AdbeRdrSecUpd11005.msp
2014-01-19 10:07 - 2014-01-19 10:07 - 00000000 ____D () C:\Users\Bill\AppData\Roaming\Macromedia
2014-01-19 10:06 - 2014-01-19 10:06 - 00264616 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2014-01-19 10:06 - 2014-01-19 10:06 - 00175016 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2014-01-19 10:06 - 2014-01-19 10:06 - 00174504 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2014-01-19 10:06 - 2014-01-19 10:06 - 00096168 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2014-01-19 10:06 - 2014-01-19 10:06 - 00000000 ____D () C:\Program Files (x86)\Java
2014-01-19 10:06 - 2013-12-14 16:39 - 00000000 ____D () C:\ProgramData\Oracle
2014-01-19 10:05 - 2014-01-19 10:05 - 00921000 _____ (Oracle Corporation) C:\Users\Bill\Downloads\chromeinstall-7u51.exe
2014-01-19 09:58 - 2014-01-19 09:58 - 00000000 ____D () C:\WINDOWS\system32\appmgmt
2014-01-18 23:38 - 2013-12-14 16:59 - 00270496 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-01-18 14:41 - 2014-01-18 14:41 - 00002523 _____ () C:\Users\Public\Desktop\Evernote.lnk

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-02-09 03:59

==================== End Of Log ============================

Addition.txt

MrCharlie · February 16, 2014

Not seeing anything, when do the blocks occur?? What browser is open if any??

MrC

connellbsd · February 16, 2014

Here is a list of current blockes this morning. Chrome had shown up as Process about 10% of the time. Its still uninstalled and they are still coming. I used process explorer yesterday to look at the svchost.exe process, but there are a few of them and nothing stood out to me. I have attached my MWB logs zipped for the last 6 days. You will see this started on the 14th after a sig update from 13.09 to 14.07 below:

2014/02/14 11:40:08 -0800 BILLSWORKPCHOME Bill MESSAGE Scheduled update executed successfully: database updated from version v2014.02.13.09 to version v2014.02.14.07

And on another note, my wifes laptop started doing it this morning. I think the MWB sig got updated. Its odd, but i wouldn't think we would both get the same malware as she doesn't click on much.

2014/02/16 10:03:15 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:18:11 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:18:11 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:18:19 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:18:19 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:18:19 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:18:19 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:18:27 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:18:27 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:33:24 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:33:24 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:33:32 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:33:32 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:33:40 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:33:40 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:36:04 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing, Port: 8)
2014/02/16 10:36:04 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing, Port: 8)
2014/02/16 10:44:12 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing, Port: 50389, Process: svchost.exe)
2014/02/16 10:44:28 -0800   BILLSWORKPCHOME   (null)   IP-BLOCK   176.74.176.179 (Type: outgoing, Port: 50393, Process: svchost.exe)
2014/02/16 10:45:02 -0800   BILLSWORKPCHOME   (null)   MESSAGE   Starting protection
2014/02/16 10:45:02 -0800   BILLSWORKPCHOME   (null)   MESSAGE   Protection started successfully
2014/02/16 10:45:02 -0800   BILLSWORKPCHOME   (null)   MESSAGE   Starting IP protection
2014/02/16 10:45:02 -0800   BILLSWORKPCHOME   (null)   MESSAGE   IP Protection started successfully
2014/02/16 10:45:10 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing, Port: 49173, Process: svchost.exe)
2014/02/16 10:45:10 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:45:10 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:45:10 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:45:10 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:45:10 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing, Port: 49207, Process: svchost.exe)
2014/02/16 10:45:18 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing, Port: 49209, Process: svchost.exe)
2014/02/16 10:45:18 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:45:18 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:45:18 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:45:18 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:46:30 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing, Port: 49294, Process: svchost.exe)
2014/02/16 10:48:17 -0800   BILLSWORKPCHOME   (null)   MESSAGE   Starting protection
2014/02/16 10:48:17 -0800   BILLSWORKPCHOME   (null)   MESSAGE   Protection started successfully
2014/02/16 10:48:17 -0800   BILLSWORKPCHOME   (null)   MESSAGE   Starting IP protection
2014/02/16 10:48:18 -0800   BILLSWORKPCHOME   (null)   MESSAGE   IP Protection started successfully
2014/02/16 10:48:25 -0800   BILLSWORKPCHOME   (null)   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:48:25 -0800   BILLSWORKPCHOME   (null)   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:48:25 -0800   BILLSWORKPCHOME   (null)   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:48:33 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:48:34 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:48:34 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:58:20 -0800   BILLSWORKPCHOME   (null)   MESSAGE   Starting protection
2014/02/16 10:58:20 -0800   BILLSWORKPCHOME   (null)   MESSAGE   Protection started successfully
2014/02/16 10:58:20 -0800   BILLSWORKPCHOME   (null)   MESSAGE   Starting IP protection
2014/02/16 10:58:21 -0800   BILLSWORKPCHOME   (null)   MESSAGE   IP Protection started successfully
2014/02/16 10:58:28 -0800   BILLSWORKPCHOME   (null)   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:58:28 -0800   BILLSWORKPCHOME   (null)   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:58:28 -0800   BILLSWORKPCHOME   (null)   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:58:36 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:58:36 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:58:36 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 10:59:48 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing, Port: 49291, Process: svchost.exe)
2014/02/16 11:09:48 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing, Port: 50029, Process: svchost.exe)
2014/02/16 11:13:33 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:13:33 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:13:41 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:13:41 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:13:41 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:13:41 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:13:49 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:13:49 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:19:20 -0800   BILLSWORKPCHOME   (null)   MESSAGE   Starting protection
2014/02/16 11:19:20 -0800   BILLSWORKPCHOME   (null)   MESSAGE   Protection started successfully
2014/02/16 11:19:20 -0800   BILLSWORKPCHOME   (null)   MESSAGE   Starting IP protection
2014/02/16 11:19:21 -0800   BILLSWORKPCHOME   (null)   MESSAGE   IP Protection started successfully
2014/02/16 11:19:28 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing, Port: 49173, Process: svchost.exe)
2014/02/16 11:19:28 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:19:28 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:19:28 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:19:28 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:19:28 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing, Port: 49208, Process: svchost.exe)
2014/02/16 11:19:36 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing, Port: 49211, Process: svchost.exe)
2014/02/16 11:19:36 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:19:36 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:19:36 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:19:36 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:19:52 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing, Port: 49236, Process: svchost.exe)
2014/02/16 11:20:48 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing, Port: 49253, Process: svchost.exe)
2014/02/16 11:34:40 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:34:40 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:34:40 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:34:40 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:34:48 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:34:48 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:34:48 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:34:48 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:36:43 -0800   BILLSWORKPCHOME   Bill   MESSAGE   Executing scheduled update: Daily
2014/02/16 11:36:47 -0800   BILLSWORKPCHOME   Bill   MESSAGE   Scheduled update executed successfully: database updated from version v2014.02.16.04 to version v2014.02.16.05
2014/02/16 11:36:47 -0800   BILLSWORKPCHOME   Bill   MESSAGE   Starting database refresh
2014/02/16 11:36:48 -0800   BILLSWORKPCHOME   Bill   MESSAGE   Stopping IP protection
2014/02/16 11:36:48 -0800   BILLSWORKPCHOME   Bill   MESSAGE   IP Protection stopped successfully
2014/02/16 11:36:50 -0800   BILLSWORKPCHOME   Bill   MESSAGE   Database refreshed successfully
2014/02/16 11:36:50 -0800   BILLSWORKPCHOME   Bill   MESSAGE   Starting IP protection
2014/02/16 11:36:50 -0800   BILLSWORKPCHOME   Bill   MESSAGE   IP Protection started successfully
2014/02/16 11:49:54 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:49:54 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:49:54 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:49:54 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:50:02 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:50:02 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:50:02 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 11:50:02 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 12:05:06 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 12:05:06 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 12:05:06 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 12:05:06 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 12:05:14 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 12:05:14 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 12:05:14 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)
2014/02/16 12:05:14 -0800   BILLSWORKPCHOME   Bill   IP-BLOCK   176.74.176.179 (Type: outgoing)

Logs.zip

MrCharlie · February 16, 2014

What browser is open when you get the blocks???

MrC

connellbsd · February 16, 2014

I would say 80 % of the time it was chrome. Other times no browser was in memory. Since this morning its been Firefox. as I am using now.

MrCharlie · February 17, 2014

Run RogueKiller again and click Scan
When the scan completes > click on the Registry tab
Put a check next to all of these and uncheck the rest: (if found)

[PROXY IE][PUM] HKCU\[...]\Internet Settings : ProxyServer (hxxp=198.27.97.214:3127 [Country: , City: ]) -> FOUND

Now click Delete on the right hand column under Options

Next.........

Download the attached fixlist.txt to the same folder as FRST.
Run FRST.exe and click Fix only once and wait
The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

Next.........

Download, install and run CCleaner free to clean out temp files.
Here's a Tutorial if needed.
Usually the present settings are good for now, You may want to uncheck "cookies" and please stay away from the registry cleaner.

Last...... (This will take some to time to run)

Please run a free online scan with the ESET Online Scanner (it may take a while to run)
Note: You will need to use Internet Explorer for this scan.
First please Disable any Antivirus you have active, as shown in This Topic

Note: Don't forget to re-enable it after the scan.
http://www.eset.eu/online-scanner
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats is unchecked and the option Scan unwanted applications is checked
Click Advanced settings and select the following:

Scan potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth technology

Click Start
Wait for the scan to finish
If threats were found:
Click on "list of threats found"
Click on "export to text file" and save it as ESET SCAN and save to the desktop
Click on back
Put a checkmark in "Uninstall application on close"
Click on finish
Post back the log.....MrC

Results from dds.com scan 176.74.176.179 blocking

Recommended Posts

Link to post

Share on other sites

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Posted Images

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information