brando223

Those steps completed okay, is there anything else I should look at before everything is all said and done?

FixLog: Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-11-2013 01 Ran by Brandon at 2013-11-11 14:46:58 Run:1 Running from C:\Users\Brandon\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** Start MountPoints2: {7d6312d7-5b28-11e2-a35b-c485087b4d81} - F:\MotoCastSetup.exe -a MountPoints2: {a99f57c0-1250-11e2-a8eb-806e6f6e6963} - E:\autorun.exe SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF C:\Users\Brandon\AppData\Roaming\Camdata.ini C:\Users\Brandon\AppData\Roaming\CamLayout.ini C:\Users\Brandon\AppData\Roaming\CamShapes.ini C:\Users\Brandon\jagex_cl_oldschool_LIVE.dat C:\Users\Brandon\jagex_cl_runescape_LIVE.dat C:\Users\Brandon\jagex_cl_runescape_LIVE1.dat C:\Users\Brandon\jagex_cl_runescape_LIVE_BETA.dat C:\Users\Brandon\random.dat 2009-07-13 21:34 - 2013-11-02 19:54 - 00000986 ____A C:\Windows\system32\Drivers\etc\hosts End ***************** HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d6312d7-5b28-11e2-a35b-c485087b4d81} => Key deleted successfully. HKCR\CLSID\{7d6312d7-5b28-11e2-a35b-c485087b4d81} => Key not found. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a99f57c0-1250-11e2-a8eb-806e6f6e6963} => Key deleted successfully. HKCR\CLSID\{a99f57c0-1250-11e2-a8eb-806e6f6e6963} => Key not found. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827} => Key deleted successfully. HKCR\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827} => Key deleted successfully. HKCR\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827} => Key not found. C:\Users\Brandon\AppData\Roaming\Camdata.ini => Moved successfully. C:\Users\Brandon\AppData\Roaming\CamLayout.ini => Moved successfully. C:\Users\Brandon\AppData\Roaming\CamShapes.ini => Moved successfully. C:\Users\Brandon\jagex_cl_oldschool_LIVE.dat => Moved successfully. C:\Users\Brandon\jagex_cl_runescape_LIVE.dat => Moved successfully. C:\Users\Brandon\jagex_cl_runescape_LIVE1.dat => Moved successfully. C:\Users\Brandon\jagex_cl_runescape_LIVE_BETA.dat => Moved successfully. C:\Users\Brandon\random.dat => Moved successfully. C:\Windows\system32\Drivers\etc\hosts => Moved successfully. ==== End of Fixlog ==== ADW CLEANER: # AdwCleaner v3.012 - Report created 11/11/2013 at 14:52:36 # Updated 11/11/2013 by Xplode # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits) # Username : Brandon - BRANDON-HP # Running from : C:\Users\Brandon\Desktop\AdwCleaner.exe # Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220222622276} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660266626676} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3} Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660266626676} Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671} Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3} Key Deleted : HKCU\Software\APN PIP Key Deleted : HKCU\Software\Cr_Installer Key Deleted : HKCU\Software\installedbrowserextensions Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider Key Deleted : HKLM\Software\PIP ***** [ Browsers ] ***** -\\ Internet Explorer v0.0.0.0 -\\ Mozilla Firefox v25.0 (en-US) [ File : C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\prefs.js ] Line Deleted : user_pref("extensions.crossrider.bic", "13dc8d8943234a7ac588a42349ce30a7"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationThankYouPage", true); Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationTime", 1364874243); Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationUserSettings.searchUserConifrmation", false); Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationUserSettings.setHomepage", false); Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationUserSettings.setNewTab", false); Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationUserSettings.setSearch", false); Line Deleted : user_pref("extensions.crossriderapp26276.26276.active", true); Line Deleted : user_pref("extensions.crossriderapp26276.26276.addressbar", "NA"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.addressbarenhanced", ""); Line Deleted : user_pref("extensions.crossriderapp26276.26276.asyncdb_dbWasSet", true); Line Deleted : user_pref("extensions.crossriderapp26276.26276.asyncdb_dbWasSet_FF25_FIX", true); Line Deleted : user_pref("extensions.crossriderapp26276.26276.asyncinternaldb_dbWasSet", true); Line Deleted : user_pref("extensions.crossriderapp26276.26276.asyncinternaldb_dbWasSet_FF25_FIX", true); Line Deleted : user_pref("extensions.crossriderapp26276.26276.backgroundjs", "\n\n//\n"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.backgroundver", 11); Line Deleted : user_pref("extensions.crossriderapp26276.26276.can_run_bg_code", true); Line Deleted : user_pref("extensions.crossriderapp26276.26276.certdomaininstaller", ""); Line Deleted : user_pref("extensions.crossriderapp26276.26276.changeprevious", false); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie.InstallationTime.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie.InstallationTime.value", "1364874243"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_aoi.value", "1364874243"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_arbitrary_code.expiration", "Mon Nov 11 2013 14:52:14 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_arbitrary_code.value", "%22%28function%28%29%7B_GPL_PLUGIN.st%3D%7B%5C%2274052%26pid%3D1269%5C%22%3A%7Bs%3A%5B%5C%2274052%26pid%3D1695%5C%22%[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_blocklist.expiration", "Mon Nov 11 2013 14:52:14 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_blocklist.value", "%22bing.com%2Cfacebook.com%2Cnonexistantdomain.com%22"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_country_code.expiration", "Wed Nov 13 2013 22:27:05 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_country_code.value", "%22US%22"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_crr.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_crr.value", "1384199238"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_currenttime.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_currenttime.value", "%221383332399%22"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_hotfix20111102645.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_hotfix20111102645.value", "%221%22"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_delay.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_delay.value", "24"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_disclosure.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_disclosure.value", "1367856897"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_list.expiration", "Mon Nov 11 2013 16:18:39 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_list.value", "%7B%22f7610cf2b37067876b694a05c56f32e2%22%3A%7B%22p%22%3A%22/%22%7D%2C%22d763717b4b2e0a17a877cc642fb80ee4%22%3A%7B%22p%22%3A[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_t.expiration", "Mon Nov 11 2013 20:14:40 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_t.value", "%22hxxp%3A//download.bleepingcomputer.com/dl/166f9bbb082732c4270bfb13eac5f7d1/52802f7c/windows/security/security-utilities/f/fa[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_installer_params.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_installer_params.value", "%7B%22source_id%22%3A%22142732%22%2C%22sub_id%22%3A%22default%22%2C%22uzid%22%3A%22142732%26subid%3D%26pid%3D1384%2[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_installtime.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_installtime.value", "%221364833255%22"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_parent_zoneid.value", "%2214019%22"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_pc_20120828.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_pc_20120828.value", "1364874491204"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_product_id.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_product_id.value", "%221347%22"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_zoneid.value", "%22165991%22"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie.dbtest.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie.dbtest.value", "1364874380692"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.description", "Deal Spy"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.domain", ""); Line Deleted : user_pref("extensions.crossriderapp26276.26276.enablesearch", false); Line Deleted : user_pref("extensions.crossriderapp26276.26276.homepage", ""); Line Deleted : user_pref("extensions.crossriderapp26276.26276.iframe", false); Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.InstallerIdentifiers.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.InstallerIdentifiers.value", "%7B%22installer_bic%22%3A%2236DB0BA830CC42F2AEA6A0310D105C93IE%22%2C%22installer_verifier%22%3A%2214a03f09cabe5b[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_appVer.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_appVer.value", "17"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_lastVersion.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_lastVersion.value", "1"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_meta.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_meta.value", "%7B%7D"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_nextCheck.expiration", "Mon Nov 11 2013 16:18:29 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_nextCheck.value", "true"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_queue.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_queue.value", "%7B%7D"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_remote_resources.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_remote_resources.value", "%7B%22remoteId%22%3A0%7D"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.SoftwareDetected.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.SoftwareDetected.value", "%7B%22AnySoftware%22%3Afalse%2C%22Wireshark%22%3Afalse%2C%22VirtualBox%22%3Afalse%2C%22VMWare%22%3Afalse%2C%22Inside[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GPL_=function(){_GPL_PLUGIN.started||_GPL_PLUGIN.prepare({pid:1347,baseCDN:\"dealspy-a.akamaihd.net\[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.lastDailyReport", "1384183109255"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.lastUpdate", "1384183108690"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.manifesturl", ""); Line Deleted : user_pref("extensions.crossriderapp26276.26276.name", "Deal Spy"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.newtab", ""); Line Deleted : user_pref("extensions.crossriderapp26276.26276.opensearch", ""); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1.code", "appAPI._cr_config={appID:function(){var a=appAPI.appInfo;if(a){return appAPI.appInfo.id;}else{return appAPI.appID;}}};$jquery.ex[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1.name", "base"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1.ver", 6); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000014.code", "Array.prototype.indexOf||(Array.prototype.indexOf=function(b){if(void 0===this||null===this)throw new TypeError;var c=Obje[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000014.name", "GPL Plugin (Loader)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000014.ver", 16); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000015.code", "var a=appAPI.db.getList(),cf_ran=!1,_GPL_BG={vars:{},rules:{},started:!1,allowed:!1,log:function(b){console.log(b)},factor[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000015.name", "GPL Background (BG)"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000015.ver", 39); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_13.code", "(function(a){a.selectedText=function(e,c){function d(){if(window.getSelection){return window.getSelection();}else{if(document.g[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_13.name", "CrossriderAppUtils"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_13.ver", 3); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefined\"){appAPI={};}var CR__bIsIEWindow=false;if(typeof window!==\"undefined\"&&typeof window.navigat[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_14.name", "CrossriderUtils"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_14.ver", 8); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_16.code", "if((typeof isBackground===\"undefined\"||isBackground!==true)&&(typeof _firefoxVersion!==\"undefined\"&&_firefoxVersion>14)&&ty[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_16.name", "FFAppAPIWrapper"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_16.ver", 9); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_17.name", "jQuery"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_17.ver", 4); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_21.code", "var CrossriderDebugManager=(function(h){var f={appId:appAPI._cr_config.appID(),url:appAPI._cr_config.debug_app};return h.Class.[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_21.name", "debug"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_21.ver", 4); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_22.code", "(function(a){appAPI.queueManager={queue:[],register:function(b){this.queue.push(b);}};appAPI.ready=function(c,b){a.when.apply(n[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_22.name", "resources"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_22.ver", 4); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_28.code", "var CrossriderInitializerPlugin=(function(e){var c={appId:appAPI._cr_config.appID()},b,g=new e.Deferred(),f;return e.Class.exte[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_28.name", "initializer"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_28.ver", 3); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_4.code", "var jQuery = $jquery_171 = $jquery = null;\n\nif (document && typeof document.getElementById !== \"undefined\") {\n\n/*! jQuery [...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_4.name", "jquery_1_7_1"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_4.ver", 4); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_47.code", "(function(){appAPI.ready=function(a){appAPI.resources.isReady(a);};}());var CrossRiderResourcesManager=(function(){var C={appId[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_47.name", "resources_background"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_47.ver", 3); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_64.code", "(function(){var h=\"__CR_EMPTY_CHANNEL__\";var d=function(j){return(typeof j===\"object\"&&j!==null);};var b=function(j){return[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_64.name", "appApiMessage"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_64.ver", 2); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_72.code", "if(appAPI.__should_activate_validation__===true){(function(){var k={};var f=appAPI.appInfo.name;var l=function(s,r,t){var q=\"[[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_72.name", "appApiValidation"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_72.ver", 3); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_78.code", "if(typeof jQuery!==\"undefined\"&&(jQuery)&&typeof navigator!==\"undefined\"&&typeof navigator.userAgent!==\"undefined\"){(func[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_78.name", "CrossriderInfo"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_78.ver", 3); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_98.code", "(function(){var b=\"cr_\"+appAPI.appID+\"internalMessage\";var a=function(){var d=function(g){if(g===true){unsafeWindow.appAPI=[...] Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_98.name", "omniCommands"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_98.ver", 2); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins_lists.plugins_0", "4,14,78,16,64,47,72,98,1000015"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins_lists.plugins_1", "17,14,78,13,16,64,4,1,21,22,72,98,1000014,28"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins_lists.plugins_5", "4,14,78,13,16,64,47,72"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.pluginsversion", 15); Line Deleted : user_pref("extensions.crossriderapp26276.26276.publisher", "Innovative Apps"); Line Deleted : user_pref("extensions.crossriderapp26276.26276.searchstatus", 0); Line Deleted : user_pref("extensions.crossriderapp26276.26276.setnewtab", false); Line Deleted : user_pref("extensions.crossriderapp26276.26276.thankyou", ""); Line Deleted : user_pref("extensions.crossriderapp26276.26276.updateinterval", 360); Line Deleted : user_pref("extensions.crossriderapp26276.26276.ver", 17); Line Deleted : user_pref("extensions.crossriderapp26276.adsOldValue", -1); Line Deleted : user_pref("extensions.crossriderapp26276.apps", "26276"); Line Deleted : user_pref("extensions.crossriderapp26276.bic", "13dc8d8943234a7ac588a42349ce30a7"); Line Deleted : user_pref("extensions.crossriderapp26276.cid", 26276); Line Deleted : user_pref("extensions.crossriderapp26276.firstrun", false); Line Deleted : user_pref("extensions.crossriderapp26276.hadappinstalled", true); Line Deleted : user_pref("extensions.crossriderapp26276.installationdate", 1364874270); Line Deleted : user_pref("extensions.crossriderapp26276.lastcheck", 23062968); Line Deleted : user_pref("extensions.crossriderapp26276.lastcheckitem", 23063233); Line Deleted : user_pref("extensions.crossriderapp26276.modetype", "production"); Line Deleted : user_pref("extensions.crossriderapp26276.reportInstall", true); Line Deleted : user_pref("extensions.crossriderapp26276.statsDailyCounter", 473); -\\ Google Chrome v30.0.1599.101 [ File : C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [21769 octets] - [11/11/2013 14:48:20] AdwCleaner[s0].txt - [22348 octets] - [11/11/2013 14:52:36] ########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [22409 octets] ########## The Malwarebytes log file did not display any threats. ESET Online Scan log: C:\Program Files (x86)\Deal Spy\ButtonUtil.dll a variant of Win32/Toolbar.CrossRider.G application C:\Program Files (x86)\Deal Spy\Deal Spy-bg.exe a variant of Win32/Toolbar.CrossRider.E application C:\Program Files (x86)\Deal Spy\Deal Spy.exe a variant of Win32/Toolbar.CrossRider.E application C:\Program Files (x86)\Deal Spy\Uninstall.exe multiple threats C:\Users\Brandon\.frostwire5\updates\frostwire-5.6.6.windows.exe multiple threats C:\Users\Brandon\Downloads\cbsidlm-cbsi5_3_0_96-Free_RAR_Extract_Frog-SEO-10804840.exe probably a variant of Win32/CNETInstaller.A application C:\Users\Brandon\Downloads\cbsidlm-tr1_11-Text_To_Wav-SEO-10788300.exe Win32/DownloadAdmin.G application Checkup log: Results of screen317's Security Check version 0.99.77 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Norton 360 WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Deal Spy Malwarebytes Anti-Malware version 1.75.0.1300 Java 7 Update 25 Java version out of Date! Adobe Flash Player 11.9.900.117 Adobe Reader 10.1.2 Adobe Reader out of Date! Mozilla Firefox (25.0) Google Chrome 30.0.1599.101 Google Chrome 30.0.1599.69 ````````Process Check: objlist.exe by Laurent```````` Norton ccSvcHst.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 1% ````````````````````End of Log``````````````````````

Thank you! FRST log Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-11-2013 01 Ran by Brandon (administrator) on BRANDON-HP on 10-11-2013 20:25:35 Running from C:\Users\Brandon\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US) Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe (Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe (AMD) C:\Windows\system32\atieclxx.exe (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Proximity Sensor\HPPRXSVC.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe (Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ccSvcHst.exe (Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ccSvcHst.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe (Microsoft Corporation) C:\Users\Brandon\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett Packard) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Audio\HPWA.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe (SecureW2 B.V.) C:\Program Files (x86)\SecureW2\sw2_tray.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Microsoft Corp.) C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\mswinext.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE (Intel® Corporation) C:\Program Files\Intel\TurboBoost\TurboBoost.exe (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe (Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Aestan Software) C:\wamp\wampmanager.exe (Apache Software Foundation) c:\wamp\bin\apache\apache2.4.4\bin\httpd.exe () c:\wamp\bin\mysql\mysql5.6.12\bin\mysqld.exe (Apache Software Foundation) C:\wamp\bin\apache\apache2.4.4\bin\httpd.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (Google) C:\Users\Brandon\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe (Microsoft Corporation) C:\Windows\system32\msiexec.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] () HKLM\...\Run: [bLEServicesCtrl] - C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [177936 2012-02-17] (Intel Corporation) HKLM\...\Run: [bTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2885904 2012-02-23] (Synaptics Incorporated) HKLM\...\Run: [sysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-01-04] (IDT, Inc.) HKLM\...\Run: [setDefault] - C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-20] (Hewlett-Packard Development Company, L.P.) HKLM\...\Run: [intelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4123 2012-05-30] () HKLM\...\RunOnce: [NCPluginUpdater] - "c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\NCPluginUpdater.exe" Update [21720 2013-11-05] (Hewlett-Packard) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKCU\...\Run: [steam] - C:\Program Files (x86)\Steam\Steam.exe [1635752 2013-05-03] (Valve Corporation) HKCU\...\Run: [Google Update] - C:\Users\Brandon\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-02-18] (Google Inc.) HKCU\...\Run: [skyDrive] - C:\Users\Brandon\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [257136 2013-10-11] (Microsoft Corporation) MountPoints2: {7d6312d7-5b28-11e2-a35b-c485087b4d81} - F:\MotoCastSetup.exe -a MountPoints2: {a99f57c0-1250-11e2-a8eb-806e6f6e6963} - E:\autorun.exe HKLM-x32\...\Run: [uSB3MON] - C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-26] (Intel Corporation) HKLM-x32\...\Run: [startCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [636032 2012-03-26] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [AMD AVT] - C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [10752 2012-01-31] () HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-30] (CyberLink Corp.) HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-03] (Adobe Systems Incorporated) HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [HP CoolSense] - C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1342008 2011-08-26] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [secureW2 Tray] - C:\Program Files (x86)\SecureW2\sw2_tray.exe [287112 2012-02-22] (SecureW2 B.V.) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [151952 2012-11-29] (Apple Inc.) HKLM-x32\...\Run: [bCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation) HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [54576 2009-11-18] (Hewlett-Packard) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [MSN Toolbar] - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\mswinext.exe [240992 2009-11-16] (Microsoft Corp.) HKLM-x32\...\Run: [Microsoft Default Manager] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [288080 2009-07-17] (Microsoft Corporation) HKLM-x32\...\Run: [hpqSRMon] - C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe [150528 2008-07-22] (Hewlett-Packard) HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation) Startup: C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel® Turbo Boost Technology Monitor 2.6.lnk ShortcutTarget: Intel® Turbo Boost Technology Monitor 2.6.lnk -> C:\Program Files\Intel\TurboBoost\SignalIslandUi.exe (Intel® Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1 SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms} BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\coieplg.dll (Symantec Corporation) BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation) BHO-x32: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation) BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: MSN Toolbar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\npwinext.dll (Microsoft Corporation) BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.) Toolbar: HKLM-x32 - MSN Toolbar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\npwinext.dll (Microsoft Corporation) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\coieplg.dll (Symantec Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll () FF Plugin: @java.com/DTPlugin,version=10.6.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.6.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @Microsoft.com/NpWinExt,version=4.0 - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\npwinext.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @stonetrip.com/ShiVaWebPlayer,version=1.8.0.0 - C:\Users\Brandon\AppData\Roaming\..\LocalLow\StoneTrip\Web Player\npShiVa3D.dll (StoneTrip) FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Brandon\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google) FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Brandon\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google) FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Brandon\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll () FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Brandon\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Brandon\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Brandon\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF SearchPlugin: C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\searchplugins\safeguard-secure-search.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml FF Extension: Deal Spy - C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\Extensions\cca2b8f2-77b0-4282-9533-b31982107a80@ef5174e8-db70-4d61-88df-24b975460bd0.com FF Extension: WOT - C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} FF Extension: HP Detect - C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\Extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2} FF Extension: noscript - C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\coFFPlgn\ FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\coFFPlgn\ FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF HKLM-x32\...\Firefox\Extensions: [msntoolbar@msn.com] - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\Firefox FF Extension: MSN Toolbar - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\Firefox FF HKLM-x32\...\Firefox\Extensions: [{27182e60-b5f3-411c-b545-b44205977502}] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ FF Extension: Search Helper Extension - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\IPSFF FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\IPSFF FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 Chrome: ======= CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\pdf.dll () CHR Plugin: (Norton Identity Safe) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.2.1.36_0\npcoplgn.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll No File CHR Plugin: (Intel\u00AE Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) CHR Plugin: (Intel\u00AE Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) CHR Plugin: (Java Platform SE 7 U9) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll No File CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll No File CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File CHR Extension: (Google Docs) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0 CHR Extension: (Google Drive) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0 CHR Extension: (YouTube) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0 CHR Extension: (Google Search) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 CHR Extension: (Deal Spy) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\dieckmbeafcedhihaiadnaanclccfihd\1.25.16_0 CHR Extension: (Norton Identity Protection) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.4.3.4_0 CHR Extension: (Google Wallet) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0 CHR Extension: (Gmail) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0 CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\Exts\Chrome.crx ==================== Services (Whitelisted) ================= R2 HPPRXSVC; C:\Program Files (x86)\Hewlett-Packard\HP Proximity Sensor\HPPRXSVC.exe [37432 2012-03-06] (Hewlett-Packard Development Company, L.P.) R2 ISCTAgent; C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe [133632 2012-02-09] () R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2011-12-16] (Intel Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-02-26] () R2 N360; C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-20] (Symantec Corporation) R3 wampapache; c:\wamp\bin\apache\apache2.4.4\bin\httpd.exe [24576 2013-06-23] (Apache Software Foundation) R3 wampmysqld; c:\wamp\bin\mysql\mysql5.6.12\bin\mysqld.exe [12867584 2013-06-23] () R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-02-26] (Intel® Corporation) ==================== Drivers (Whitelisted) ==================== R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [31872 2012-02-01] (Advanced Micro Devices, Inc.) R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\Definitions\BASHDefs\20131101.003\BHDrvx64.sys [1524824 2013-10-22] (Symantec Corporation) R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1404000.028\ccSetx64.sys [169048 2013-04-15] (Symantec Corporation) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-09-02] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-10-28] (Symantec Corporation) R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\Definitions\IPSDefs\20131110.002\IDSvia64.sys [521816 2013-10-25] (Symantec Corporation) R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [25536 2012-02-09] () R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [25536 2012-02-09] () R2 IntelHaxm; C:\Windows\System32\DRIVERS\IntelHaxm.sys [85008 2012-05-22] () R3 ISCT; C:\Windows\system32\drivers\ISCTD64.sys [44992 2012-02-09] () R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\Definitions\VirusDefs\20131109.006\ENG64.SYS [126040 2013-11-04] (Symantec Corporation) R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\Definitions\VirusDefs\20131109.006\EX64.SYS [2099288 2013-11-04] (Symantec Corporation) S3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [260712 2012-01-30] (Realtek Semiconductor Corp.) S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-13] (Brother Industries Ltd.) R3 SmbDrv; C:\Windows\system32\drivers\Smb_driver.sys [21264 2012-02-23] (Synaptics Incorporated) R3 SRTSP; C:\Windows\System32\Drivers\N360x64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1404000.028\SRTSPX64.SYS [36952 2013-03-04] (Symantec Corporation) R0 SymDS; C:\Windows\System32\drivers\N360x64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\N360x64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation) R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-17] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\N360x64\1404000.028\Ironx64.SYS [224416 2013-03-04] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1404000.028\SYMNETS.SYS [433752 2013-04-24] (Symantec Corporation) S3 uxddrv; C:\nbutils\QuickT\wow64\uxddrv64.sys [7256 2009-05-14] () R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2013-11-08] () ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-11-10 20:23 - 2013-11-10 20:23 - 00000000 ____D C:\Users\Brandon\Desktop\Torrent Data 2013-11-10 20:14 - 2013-11-10 20:14 - 01957590 _____ (Farbar) C:\Users\Brandon\Desktop\FRST64.exe 2013-11-10 20:14 - 2013-11-10 20:14 - 00000000 ____D C:\FRST 2013-11-08 18:20 - 2013-11-08 18:43 - 00000053 _____ C:\Users\Brandon\Desktop\VGD.txt 2013-11-08 11:47 - 2013-11-08 11:47 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp 2013-11-07 22:54 - 2013-11-07 22:54 - 00975932 _____ C:\Users\Brandon\Downloads\AMIDST-3.4.exe 2013-11-06 10:00 - 2013-11-06 10:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-11-05 16:26 - 2013-11-05 16:26 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Brandon\Downloads\mbam-setup-1.75.0.1300.exe 2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\Malwarebytes 2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-11-05 16:26 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-11-03 14:43 - 2013-11-03 17:39 - 00000000 ____D C:\Users\Brandon\Desktop\export2 2013-11-03 12:34 - 2013-11-03 12:43 - 704643072 _____ C:\Users\Brandon\Desktop\ubuntu-13.10-server-amd64.iso 2013-11-03 11:18 - 2013-11-03 12:32 - 00000000 ____D C:\Users\Brandon\VirtualBox VMs 2013-11-03 11:17 - 2013-11-10 16:35 - 00000000 ____D C:\Users\Brandon\.VirtualBox 2013-11-03 11:16 - 2013-11-03 11:16 - 00001076 _____ C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk 2013-11-03 11:16 - 2013-11-03 11:16 - 00000000 ____D C:\Program Files\Oracle 2013-11-03 11:16 - 2013-11-01 15:13 - 00252688 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys 2013-11-03 11:16 - 2013-11-01 15:10 - 00126736 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys 2013-11-03 11:14 - 2013-11-03 11:15 - 106230544 _____ (Oracle Corporation) C:\Users\Brandon\Downloads\VirtualBox-4.3.2-90405-Win.exe 2013-11-03 08:59 - 2013-11-03 08:59 - 00000018 _____ C:\Users\Brandon\Desktop\New Text Document.txt 2013-11-02 20:45 - 2013-11-03 14:38 - 00000000 ____D C:\Users\Brandon\Desktop\export 2013-11-02 20:21 - 2013-11-03 17:39 - 00000000 ____D C:\Users\Brandon\Desktop\backup 2013-11-02 19:53 - 2013-11-02 19:54 - 00000000 ____D C:\wamp 2013-11-02 19:40 - 2013-11-02 19:40 - 00001639 _____ C:\Users\Brandon\Desktop\register.php 2013-11-02 19:39 - 2013-11-02 19:39 - 00000000 _____ C:\Users\Brandon\Desktop\default_position.php 2013-11-02 19:13 - 2013-11-02 19:14 - 40603386 _____ (Hervé Leclerc (HeL) ) C:\Users\Brandon\Downloads\Wampserver2.4-x64(1).exe 2013-11-02 17:42 - 2013-11-02 17:42 - 04812567 _____ (Tim Kosse) C:\Users\Brandon\Downloads\FileZilla_3.7.3_win32-setup.exe 2013-11-02 16:08 - 2013-11-02 20:12 - 00000000 ____D C:\Users\Brandon\Desktop\MultiplayerTechTest 2013-11-02 14:50 - 2013-11-02 16:00 - 00177290 _____ C:\Users\Brandon\Desktop\TEST.capx 2013-11-02 14:50 - 2013-11-02 15:56 - 00177286 _____ C:\Users\Brandon\Desktop\TEST.capx.backup1 2013-11-02 14:42 - 2013-11-02 14:50 - 862987318 _____ C:\Users\Brandon\Desktop\TechTest.capx.backup1 2013-11-02 14:18 - 2013-11-02 14:48 - 00000973 _____ C:\Users\Brandon\Desktop\TechTest.uistate.xml 2013-11-02 14:18 - 2013-11-02 14:18 - 00003884 _____ C:\Users\Brandon\Desktop\TechTest.caproj 2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Layouts 2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Event sheets 2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Animations 2013-11-01 15:10 - 2013-11-01 15:10 - 00154896 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetFlt.sys 2013-11-01 15:10 - 2013-11-01 15:10 - 00140560 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys 2013-11-01 15:07 - 2013-11-01 15:07 - 00204048 _____ (Oracle Corporation) C:\Windows\system32\VBoxNetFltNobj.dll 2013-11-01 10:26 - 2013-11-01 10:26 - 00000000 ____D C:\Users\Brandon\Desktop\rex_date 2013-10-31 19:56 - 2013-10-31 19:57 - 128683080 _____ (Scirra ) C:\Users\Brandon\Downloads\construct2-r148-setup_18543583.exe 2013-10-31 19:55 - 2013-10-31 19:55 - 00000000 ____D C:\Users\Brandon\Desktop\7_Textbox_addon 2013-10-30 22:40 - 2013-10-30 22:40 - 02769432 _____ C:\Users\Brandon\Desktop\Ride.3gp.mp4 2013-10-30 22:29 - 2013-10-30 22:29 - 02803140 _____ C:\Users\Brandon\Desktop\Ride.mp4 2013-10-30 15:04 - 2013-10-30 15:04 - 01058176 _____ (PassMark Software ) C:\Users\Brandon\Downloads\diskcheckup.exe 2013-10-30 15:04 - 2013-10-30 15:04 - 00000000 ____D C:\Program Files (x86)\DiskCheckup 2013-10-30 12:17 - 2013-10-30 12:17 - 04668633 _____ C:\Users\Brandon\Downloads\p95v279.win64.zip 2013-10-30 12:16 - 2013-10-30 12:16 - 00425667 _____ C:\Users\Brandon\Downloads\memtest86-iso.zip 2013-10-29 09:57 - 2013-10-31 16:12 - 00000061 _____ C:\Users\Brandon\Desktop\COLLEGEWORK.txt 2013-10-23 16:34 - 2013-10-28 22:46 - 00000000 ____D C:\Users\Brandon\Documents\javascript-sdk-template 2013-10-20 15:35 - 2013-10-20 15:35 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem (1).zip 2013-10-20 15:33 - 2013-10-20 15:33 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem(3).zip 2013-10-20 15:31 - 2013-10-20 15:31 - 00000000 ____D C:\Users\Brandon\Desktop\Truth is - Copy 2013-10-20 15:26 - 2013-10-20 15:26 - 00025270 _____ C:\Users\Brandon\Downloads\login_error(1).zip 2013-10-20 15:03 - 2013-10-20 15:03 - 00000000 ____D C:\Users\Brandon\Documents\Add-in Express 2013-10-20 14:50 - 2013-10-20 20:45 - 00000000 ____D C:\ProgramData\AVG SafeGuard toolbar 2013-10-20 14:50 - 2013-10-20 20:45 - 00000000 ____D C:\Program Files (x86)\AVG SafeGuard toolbar 2013-10-20 14:50 - 2013-10-20 14:50 - 00003746 _____ C:\Program Files (x86)\Mozilla Firefoxsafeguard-secure-search.xml 2013-10-20 14:50 - 2013-10-20 14:50 - 00000000 ____D C:\Users\Brandon\AppData\Local\AVG SafeGuard toolbar 2013-10-19 21:47 - 2013-10-19 21:47 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem(2).zip 2013-10-19 21:37 - 2013-10-19 21:37 - 00045129 _____ C:\Users\Brandon\Downloads\RegistrationForm.zip 2013-10-19 21:12 - 2013-10-19 21:12 - 00130763 _____ C:\Users\Brandon\Downloads\logintest(1).zip 2013-10-19 21:10 - 2013-10-19 21:10 - 00018387 _____ C:\Users\Brandon\Downloads\loginsystem(1).zip 2013-10-19 21:04 - 2013-10-19 21:04 - 00002553 _____ C:\Users\Brandon\Downloads\login_error.zip 2013-10-19 20:45 - 2013-10-19 20:45 - 00130763 _____ C:\Users\Brandon\Downloads\logintest.zip 2013-10-19 20:37 - 2013-10-19 20:37 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem.zip 2013-10-14 19:02 - 2013-10-14 19:04 - 176553561 _____ C:\Users\Brandon\Downloads\6043 - Pokemon - White 2 (v01)(DSi Enhanced) (J).zip 2013-10-14 13:58 - 2013-10-14 13:59 - 00000000 ____D C:\Program Files (x86)\SpeedFan 2013-10-14 13:58 - 2013-10-14 13:58 - 00001007 _____ C:\Users\Brandon\Desktop\SpeedFan.lnk 2013-10-14 13:58 - 2013-10-14 13:58 - 00000045 _____ C:\Windows\SysWOW64\initdebug.nfo 2013-10-14 13:57 - 2013-10-14 13:57 - 02143832 _____ C:\Users\Brandon\Downloads\instsf449.exe 2013-10-11 16:34 - 2013-11-08 11:48 - 00000000 ___RD C:\Users\Brandon\Documents\SkyDrive 2013-10-11 16:26 - 2013-10-11 16:34 - 00000000 ___RD C:\Users\Brandon\SkyDrive 2013-10-11 16:26 - 2013-10-11 16:26 - 00002164 _____ C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk 2013-10-11 16:26 - 2013-10-11 16:26 - 00002100 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk 2013-10-11 16:26 - 2013-10-11 16:26 - 00002100 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk 2013-10-11 16:26 - 2013-10-11 16:26 - 00000000 ____D C:\Program Files (x86)\Microsoft SkyDrive 2013-10-11 16:26 - 2013-10-11 16:25 - 06040688 _____ (Microsoft Corporation) C:\Users\Brandon\Downloads\SkyDriveSetup.exe 2013-10-11 16:25 - 2013-10-11 16:25 - 00000000 ____D C:\ProgramData\Microsoft SkyDrive 2013-10-11 12:17 - 2013-10-11 12:17 - 00000065 _____ C:\Users\Brandon\Documents\PWOOptions.ini 2013-10-11 11:57 - 2013-10-11 11:58 - 33405439 _____ C:\Users\Brandon\Downloads\PWO181.zip ==================== One Month Modified Files and Folders ======= 2013-11-10 20:24 - 2013-04-28 13:42 - 00000000 ____D C:\Users\Brandon\stuff 2013-11-10 20:23 - 2013-11-10 20:23 - 00000000 ____D C:\Users\Brandon\Desktop\Torrent Data 2013-11-10 20:23 - 2012-12-06 11:56 - 00000000 ____D C:\Users\Brandon 2013-11-10 20:21 - 2009-07-13 21:34 - 00000438 _____ C:\Windows\win.ini 2013-11-10 20:14 - 2013-11-10 20:14 - 01957590 _____ (Farbar) C:\Users\Brandon\Desktop\FRST64.exe 2013-11-10 20:14 - 2013-11-10 20:14 - 00000000 ____D C:\FRST 2013-11-10 20:00 - 2012-10-09 17:14 - 01581865 _____ C:\Windows\WindowsUpdate.log 2013-11-10 19:48 - 2013-04-01 15:14 - 00000916 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001UA.job 2013-11-10 19:30 - 2013-02-18 13:22 - 00000900 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-11-10 19:29 - 2013-09-19 17:11 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-11-10 18:32 - 2012-12-09 12:50 - 00000000 ____D C:\Users\Brandon\AppData\Local\CrashDumps 2013-11-10 16:48 - 2013-04-01 15:14 - 00000864 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001Core.job 2013-11-10 16:35 - 2013-11-03 11:17 - 00000000 ____D C:\Users\Brandon\.VirtualBox 2013-11-10 12:02 - 2013-04-12 18:25 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\.minecraft 2013-11-10 01:39 - 2013-02-18 13:22 - 00000896 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-11-09 00:49 - 2012-12-06 12:19 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\Mozilla 2013-11-08 20:13 - 2013-06-07 19:29 - 00003198 _____ C:\Windows\System32\Tasks\HPCeeScheduleForBrandon 2013-11-08 20:13 - 2013-06-07 19:29 - 00000340 _____ C:\Windows\Tasks\HPCeeScheduleForBrandon.job 2013-11-08 20:13 - 2013-04-05 19:14 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2013-11-08 20:13 - 2012-12-06 21:47 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log 2013-11-08 18:43 - 2013-11-08 18:20 - 00000053 _____ C:\Users\Brandon\Desktop\VGD.txt 2013-11-08 17:20 - 2012-12-06 11:56 - 00003942 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{F38B13B5-4481-4906-A8A1-35CBF3A4D70B} 2013-11-08 11:54 - 2009-07-13 23:45 - 00031472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-11-08 11:54 - 2009-07-13 23:45 - 00031472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-11-08 11:53 - 2009-07-14 00:13 - 00779724 _____ C:\Windows\system32\PerfStringBackup.INI 2013-11-08 11:48 - 2013-10-11 16:34 - 00000000 ___RD C:\Users\Brandon\Documents\SkyDrive 2013-11-08 11:48 - 2012-12-15 22:38 - 00000000 ____D C:\Program Files (x86)\Steam 2013-11-08 11:47 - 2013-11-08 11:47 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp 2013-11-08 11:47 - 2012-10-09 14:48 - 00034752 _____ C:\Windows\system32\Drivers\WPRO_41_2001.sys 2013-11-08 11:47 - 2009-07-14 00:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-11-08 11:47 - 2009-07-13 23:51 - 00057233 _____ C:\Windows\setupact.log 2013-11-08 11:46 - 2012-12-06 12:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-11-08 11:46 - 2010-11-20 22:47 - 00700692 _____ C:\Windows\PFRO.log 2013-11-08 11:45 - 2013-04-01 22:44 - 00000000 ____D C:\Program Files (x86)\Deal Spy 2013-11-07 22:54 - 2013-11-07 22:54 - 00975932 _____ C:\Users\Brandon\Downloads\AMIDST-3.4.exe 2013-11-06 10:00 - 2013-11-06 10:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-11-05 16:26 - 2013-11-05 16:26 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Brandon\Downloads\mbam-setup-1.75.0.1300.exe 2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\Malwarebytes 2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-11-03 21:07 - 2013-01-02 13:42 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\FileZilla 2013-11-03 18:54 - 2013-04-28 13:42 - 00000000 ____D C:\Users\Brandon\.frostwire5 2013-11-03 17:39 - 2013-11-03 14:43 - 00000000 ____D C:\Users\Brandon\Desktop\export2 2013-11-03 17:39 - 2013-11-02 20:21 - 00000000 ____D C:\Users\Brandon\Desktop\backup 2013-11-03 14:38 - 2013-11-02 20:45 - 00000000 ____D C:\Users\Brandon\Desktop\export 2013-11-03 12:43 - 2013-11-03 12:34 - 704643072 _____ C:\Users\Brandon\Desktop\ubuntu-13.10-server-amd64.iso 2013-11-03 12:32 - 2013-11-03 11:18 - 00000000 ____D C:\Users\Brandon\VirtualBox VMs 2013-11-03 11:16 - 2013-11-03 11:16 - 00001076 _____ C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk 2013-11-03 11:16 - 2013-11-03 11:16 - 00000000 ____D C:\Program Files\Oracle 2013-11-03 11:15 - 2013-11-03 11:14 - 106230544 _____ (Oracle Corporation) C:\Users\Brandon\Downloads\VirtualBox-4.3.2-90405-Win.exe 2013-11-03 11:15 - 2013-10-02 23:19 - 00000000 ____D C:\Users\Brandon\Downloads\Windows Server 2008 R2 Standard, Enterprise, Datacenter, and Web (x64) - DVD (English) 2013-11-03 08:59 - 2013-11-03 08:59 - 00000018 _____ C:\Users\Brandon\Desktop\New Text Document.txt 2013-11-02 20:12 - 2013-11-02 16:08 - 00000000 ____D C:\Users\Brandon\Desktop\MultiplayerTechTest 2013-11-02 19:54 - 2013-11-02 19:53 - 00000000 ____D C:\wamp 2013-11-02 19:40 - 2013-11-02 19:40 - 00001639 _____ C:\Users\Brandon\Desktop\register.php 2013-11-02 19:39 - 2013-11-02 19:39 - 00000000 _____ C:\Users\Brandon\Desktop\default_position.php 2013-11-02 19:14 - 2013-11-02 19:13 - 40603386 _____ (Hervé Leclerc (HeL) ) C:\Users\Brandon\Downloads\Wampserver2.4-x64(1).exe 2013-11-02 17:43 - 2013-03-06 22:53 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client 2013-11-02 17:42 - 2013-11-02 17:42 - 04812567 _____ (Tim Kosse) C:\Users\Brandon\Downloads\FileZilla_3.7.3_win32-setup.exe 2013-11-02 16:00 - 2013-11-02 14:50 - 00177290 _____ C:\Users\Brandon\Desktop\TEST.capx 2013-11-02 15:56 - 2013-11-02 14:50 - 00177286 _____ C:\Users\Brandon\Desktop\TEST.capx.backup1 2013-11-02 14:50 - 2013-11-02 14:42 - 862987318 _____ C:\Users\Brandon\Desktop\TechTest.capx.backup1 2013-11-02 14:48 - 2013-11-02 14:18 - 00000973 _____ C:\Users\Brandon\Desktop\TechTest.uistate.xml 2013-11-02 14:18 - 2013-11-02 14:18 - 00003884 _____ C:\Users\Brandon\Desktop\TechTest.caproj 2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Layouts 2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Event sheets 2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Animations 2013-11-01 15:13 - 2013-11-03 11:16 - 00252688 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys 2013-11-01 15:10 - 2013-11-03 11:16 - 00126736 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys 2013-11-01 15:10 - 2013-11-01 15:10 - 00154896 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetFlt.sys 2013-11-01 15:10 - 2013-11-01 15:10 - 00140560 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys 2013-11-01 15:07 - 2013-11-01 15:07 - 00204048 _____ (Oracle Corporation) C:\Windows\system32\VBoxNetFltNobj.dll 2013-11-01 10:26 - 2013-11-01 10:26 - 00000000 ____D C:\Users\Brandon\Desktop\rex_date 2013-10-31 19:58 - 2013-10-07 15:23 - 00000843 _____ C:\Users\Public\Desktop\Construct 2.lnk 2013-10-31 19:58 - 2012-12-07 20:12 - 00000000 ____D C:\Program Files\Construct 2 2013-10-31 19:57 - 2013-10-31 19:56 - 128683080 _____ (Scirra ) C:\Users\Brandon\Downloads\construct2-r148-setup_18543583.exe 2013-10-31 19:55 - 2013-10-31 19:55 - 00000000 ____D C:\Users\Brandon\Desktop\7_Textbox_addon 2013-10-31 16:12 - 2013-10-29 09:57 - 00000061 _____ C:\Users\Brandon\Desktop\COLLEGEWORK.txt 2013-10-30 22:40 - 2013-10-30 22:40 - 02769432 _____ C:\Users\Brandon\Desktop\Ride.3gp.mp4 2013-10-30 22:29 - 2013-10-30 22:29 - 02803140 _____ C:\Users\Brandon\Desktop\Ride.mp4 2013-10-30 15:04 - 2013-10-30 15:04 - 01058176 _____ (PassMark Software ) C:\Users\Brandon\Downloads\diskcheckup.exe 2013-10-30 15:04 - 2013-10-30 15:04 - 00000000 ____D C:\Program Files (x86)\DiskCheckup 2013-10-30 12:17 - 2013-10-30 12:17 - 04668633 _____ C:\Users\Brandon\Downloads\p95v279.win64.zip 2013-10-30 12:16 - 2013-10-30 12:16 - 00425667 _____ C:\Users\Brandon\Downloads\memtest86-iso.zip 2013-10-29 21:15 - 2013-08-27 13:39 - 00000000 ____D C:\Users\Brandon\Desktop\New folder (2) 2013-10-28 22:47 - 2012-12-06 11:56 - 00000000 ____D C:\Users\Brandon\AppData\Local\VirtualStore 2013-10-28 22:46 - 2013-10-23 16:34 - 00000000 ____D C:\Users\Brandon\Documents\javascript-sdk-template 2013-10-28 22:46 - 2013-09-15 21:15 - 00000000 ____D C:\Users\Brandon\Desktop\osx 2013-10-28 22:46 - 2012-12-06 14:23 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\SoftGrid Client 2013-10-28 22:46 - 2012-12-06 12:18 - 00000000 ____D C:\.jagex_cache_32 2013-10-28 22:46 - 2012-12-06 11:57 - 00000000 ____D C:\Users\Brandon\AppData\Local\Hewlett-Packard 2013-10-28 22:46 - 2012-10-09 14:54 - 00000000 ____D C:\ProgramData\Norton 2013-10-28 22:46 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\registration 2013-10-28 22:46 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\AppCompat 2013-10-28 22:45 - 2012-12-06 14:28 - 00000000 __RHD C:\MSOCache 2013-10-20 20:45 - 2013-10-20 14:50 - 00000000 ____D C:\ProgramData\AVG SafeGuard toolbar 2013-10-20 20:45 - 2013-10-20 14:50 - 00000000 ____D C:\Program Files (x86)\AVG SafeGuard toolbar 2013-10-20 15:35 - 2013-10-20 15:35 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem (1).zip 2013-10-20 15:33 - 2013-10-20 15:33 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem(3).zip 2013-10-20 15:31 - 2013-10-20 15:31 - 00000000 ____D C:\Users\Brandon\Desktop\Truth is - Copy 2013-10-20 15:26 - 2013-10-20 15:26 - 00025270 _____ C:\Users\Brandon\Downloads\login_error(1).zip 2013-10-20 15:03 - 2013-10-20 15:03 - 00000000 ____D C:\Users\Brandon\Documents\Add-in Express 2013-10-20 14:50 - 2013-10-20 14:50 - 00003746 _____ C:\Program Files (x86)\Mozilla Firefoxsafeguard-secure-search.xml 2013-10-20 14:50 - 2013-10-20 14:50 - 00000000 ____D C:\Users\Brandon\AppData\Local\AVG SafeGuard toolbar 2013-10-19 21:47 - 2013-10-19 21:47 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem(2).zip 2013-10-19 21:37 - 2013-10-19 21:37 - 00045129 _____ C:\Users\Brandon\Downloads\RegistrationForm.zip 2013-10-19 21:12 - 2013-10-19 21:12 - 00130763 _____ C:\Users\Brandon\Downloads\logintest(1).zip 2013-10-19 21:10 - 2013-10-19 21:10 - 00018387 _____ C:\Users\Brandon\Downloads\loginsystem(1).zip 2013-10-19 21:04 - 2013-10-19 21:04 - 00002553 _____ C:\Users\Brandon\Downloads\login_error.zip 2013-10-19 20:45 - 2013-10-19 20:45 - 00130763 _____ C:\Users\Brandon\Downloads\logintest.zip 2013-10-19 20:37 - 2013-10-19 20:37 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem.zip 2013-10-19 20:26 - 2012-12-06 12:18 - 00000024 _____ C:\Users\Brandon\random.dat 2013-10-19 18:46 - 2012-12-06 12:18 - 00000024 _____ C:\Users\Brandon\jagexappletviewer.preferences 2013-10-19 18:45 - 2012-12-06 12:18 - 00000046 _____ C:\Users\Brandon\jagex_cl_runescape_LIVE.dat 2013-10-14 21:45 - 2013-01-27 18:16 - 00002004 ____H C:\Users\Brandon\Documents\Default.rdp 2013-10-14 19:04 - 2013-10-14 19:02 - 176553561 _____ C:\Users\Brandon\Downloads\6043 - Pokemon - White 2 (v01)(DSi Enhanced) (J).zip 2013-10-14 13:59 - 2013-10-14 13:58 - 00000000 ____D C:\Program Files (x86)\SpeedFan 2013-10-14 13:58 - 2013-10-14 13:58 - 00001007 _____ C:\Users\Brandon\Desktop\SpeedFan.lnk 2013-10-14 13:58 - 2013-10-14 13:58 - 00000045 _____ C:\Windows\SysWOW64\initdebug.nfo 2013-10-14 13:57 - 2013-10-14 13:57 - 02143832 _____ C:\Users\Brandon\Downloads\instsf449.exe 2013-10-12 00:39 - 2013-01-02 12:20 - 00000000 ____D C:\Users\Brandon\.gimp-2.8 2013-10-11 16:34 - 2013-10-11 16:26 - 00000000 ___RD C:\Users\Brandon\SkyDrive 2013-10-11 16:26 - 2013-10-11 16:26 - 00002164 _____ C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk 2013-10-11 16:26 - 2013-10-11 16:26 - 00002100 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk 2013-10-11 16:26 - 2013-10-11 16:26 - 00002100 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk 2013-10-11 16:26 - 2013-10-11 16:26 - 00000000 ____D C:\Program Files (x86)\Microsoft SkyDrive 2013-10-11 16:25 - 2013-10-11 16:26 - 06040688 _____ (Microsoft Corporation) C:\Users\Brandon\Downloads\SkyDriveSetup.exe 2013-10-11 16:25 - 2013-10-11 16:25 - 00000000 ____D C:\ProgramData\Microsoft SkyDrive 2013-10-11 12:17 - 2013-10-11 12:17 - 00000065 _____ C:\Users\Brandon\Documents\PWOOptions.ini 2013-10-11 11:58 - 2013-10-11 11:57 - 33405439 _____ C:\Users\Brandon\Downloads\PWO181.zip Files to move or delete: ==================== C:\Users\Brandon\AppData\Roaming\Camdata.ini C:\Users\Brandon\AppData\Roaming\CamLayout.ini C:\Users\Brandon\AppData\Roaming\CamShapes.ini C:\Users\Brandon\jagex_cl_oldschool_LIVE.dat C:\Users\Brandon\jagex_cl_runescape_LIVE.dat C:\Users\Brandon\jagex_cl_runescape_LIVE1.dat C:\Users\Brandon\jagex_cl_runescape_LIVE_BETA.dat C:\Users\Brandon\random.dat ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-11-10 04:16 ==================== End Of Log ============================ Addition.txt: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-11-2013 01 Ran by Brandon at 2013-11-10 20:26:08 Running from C:\Users\Brandon\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Norton 360 (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Norton 360 (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202} FW: Norton 360 (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} ==================== Installed Programs ====================== 64 Bit HP CIO Components Installer (Version: 7.2.4) 7-Zip 9.22beta (x32) Adobe AIR (x32 Version: 2.6.0.19140) Adobe Community Help (x32 Version: 3.5.23) Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117) Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117) Adobe Reader X (10.1.2) MUI (x32 Version: 10.1.2) Adobe Shockwave Player 11.6 (x32 Version: 11.6.3.633) Age of Empires III (x32 Version: 1.00.0000) AIO_Scan (x32 Version: 130.0.365.000) AMD Accelerated Video Transcoding (Version: 2.00.0002) AMD APP SDK Runtime (Version: 10.0.898.1) AMD Catalyst Install Manager (Version: 3.0.868.0) Apple Application Support (x32 Version: 2.3.2) Apple Mobile Device Support (Version: 6.0.1.3) Apple Software Update (x32 Version: 2.1.3.127) Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.0.12.13) Audacity 2.0.3 (x32 Version: 2.0.3) BioShock Infinite (x32) Bonjour (Version: 3.0.0.10) BufferChm (x32 Version: 140.0.212.000) C310 (x32 Version: 140.0.304.000) C4200 (x32 Version: 130.0.365.000) c4200_Help (x32 Version: 82.0.210.000) CamStudio version 2.7 (x32 Version: 2.7) Catalyst Control Center - Branding (x32 Version: 1.00.0000) Catalyst Control Center (x32 Version: 2012.0326.310.3601) Catalyst Control Center Graphics Previews Common (x32 Version: 2012.0326.310.3601) Catalyst Control Center InstallProxy (x32 Version: 2012.0326.310.3601) Catalyst Control Center Localization All (x32 Version: 2012.0326.310.3601) Catalyst Control Center Profiles Mobile (x32 Version: 2012.0326.310.3601) CCC Help Chinese Standard (x32 Version: 2012.0326.0309.3601) CCC Help Chinese Traditional (x32 Version: 2012.0326.0309.3601) CCC Help Czech (x32 Version: 2012.0326.0309.3601) CCC Help Danish (x32 Version: 2012.0326.0309.3601) CCC Help Dutch (x32 Version: 2012.0326.0309.3601) CCC Help English (x32 Version: 2012.0326.0309.3601) CCC Help Finnish (x32 Version: 2012.0326.0309.3601) CCC Help French (x32 Version: 2012.0326.0309.3601) CCC Help German (x32 Version: 2012.0326.0309.3601) CCC Help Greek (x32 Version: 2012.0326.0309.3601) CCC Help Hungarian (x32 Version: 2012.0326.0309.3601) CCC Help Italian (x32 Version: 2012.0326.0309.3601) CCC Help Japanese (x32 Version: 2012.0326.0309.3601) CCC Help Korean (x32 Version: 2012.0326.0309.3601) CCC Help Norwegian (x32 Version: 2012.0326.0309.3601) CCC Help Polish (x32 Version: 2012.0326.0309.3601) CCC Help Portuguese (x32 Version: 2012.0326.0309.3601) CCC Help Russian (x32 Version: 2012.0326.0309.3601) CCC Help Spanish (x32 Version: 2012.0326.0309.3601) CCC Help Swedish (x32 Version: 2012.0326.0309.3601) CCC Help Thai (x32 Version: 2012.0326.0309.3601) CCC Help Turkish (x32 Version: 2012.0326.0309.3601) ccc-utility64 (Version: 2012.0326.310.3601) Chivalry: Medieval Warfare (x32) Cisco Connect (x32 Version: 1.4.12284.0) Construct 2 r148 (Version: 1.0.148.0) Copy (x32 Version: 130.0.428.000) Counter-Strike: Global Offensive (x32) Coupon Printer for Windows (x32 Version: 5.0.0.0) CyberLink PowerDVD (x32 Version: 10.0.5.3817) CyberLink YouCam (x32 Version: 3.5.3.5018) D3DX10 (x32 Version: 15.4.2368.0902) Deal Spy (x32 Version: 1.26.153.1) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32) Destinations (x32 Version: 140.0.77.000) DeviceDiscovery (x32 Version: 140.0.212.000) DiskCheckup v3.1 (x32 Version: 3.1.1007) DocProc (x32 Version: 13.0.0.0) Empires Dawn of the Modern World (x32) ESU for Microsoft Windows 7 SP1 (x32 Version: 5.1.4) FileZilla Client 3.7.3 (x32 Version: 3.7.3) Free RAR Extract Frog (x32 Version: 4.70) GameSpy Arcade (x32) GIMP 2.8.2 (Version: 2.8.2) Google Chrome (x32 Version: 30.0.1599.101) Google Talk Plugin (x32 Version: 4.9.1.16010) Google Update Helper (x32 Version: 1.3.21.165) GPBaseService2 (x32 Version: 140.0.211.000) Grand Theft Auto (x32) Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000) HP 3D DriveGuard (Version: 4.1.12.1) HP CoolSense (x32 Version: 2.10.3) HP Customer Experience Enhancements (x32 Version: 6.0.1.8) HP Customer Participation Program 14.0 (Version: 14.0) HP Documentation (x32 Version: 1.1.0.0) HP Imaging Device Functions 14.0 (Version: 14.0) HP Launch Box (Version: 1.1.5) HP On Screen Display (x32 Version: 1.3.5) HP Photo Creations (x32 Version: 1.0.0.2024) HP Photosmart C4200 All-In-One Driver Software 13.0 Rel. 1 (Version: 13.0) HP Photosmart Essential 3.5 (Version: 3.5) HP Photosmart Prem C310 All-In-One Driver Software 14.0 Rel. 7 (Version: 14.0) HP Power Manager (x32 Version: 1.4.8) HP Product Detection (x32 Version: 11.14.0004) HP Proximity Sensor Utility (x32 Version: 1.0.19) HP Quick Launch (x32 Version: 2.7.2) HP Recovery Manager (x32 Version: 2.0.0) HP Setup (x32 Version: 8.7.4751.3798) HP Smart Web Printing 4.60 (Version: 4.60) HP Software Framework (x32 Version: 4.5.6.1) HP Solution Center 14.0 (Version: 14.0) HP Support Assistant (x32 Version: 7.0.39.15) HP Update (x32 Version: 5.002.002.002) HP Wireless Audio Manager 1.1.4 (x32 Version: 1.1.4) HPAppStudio (x32 Version: 140.0.95.000) HPPhotoGadget (x32 Version: 140.0.524.000) HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000) HPPhotosmartEssential (x32 Version: 2.04.0000) HPProductAssistant (x32 Version: 140.0.212.000) HPSSupply (x32 Version: 140.0.211.000) IDT Audio (x32 Version: 1.0.6381.0) Inkscape 0.48.4 (x32 Version: 0.48.4) Intel PROSet Wireless Intel® Control Center (x32 Version: 1.2.1.1007) Intel® Display Audio Driver (x32 Version: 6.14.00.3090) Intel® Management Engine Components (x32 Version: 8.0.0.1351) Intel® PROSet/Wireless for Bluetooth® + High Speed (Version: 15.1.0.0096) Intel® PROSet/Wireless Software for Bluetooth® Technology (Version: 2.1.0.0140) Intel® Rapid Storage Technology (x32 Version: 11.0.0.1032) Intel® Smart Connect Technology 2.0 x64 (Version: 2.0.1083.0) Intel® Turbo Boost Technology Monitor 2.6 (Version: 2.6.2.0) Intel® USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.4.225) Intel® WiDi (x32 Version: 3.0.13.0) Intel® Wireless Display Intel® Hardware Accelerated Execution Manager (Version: 1.0.1) Intel® PROSet/Wireless WiFi Software (Version: 15.01.0500.0903) Intel® Trusted Connect Service Client (Version: 1.23.216.0) ISO to USB (x32) iTunes (Version: 11.0.0.163) Java 7 Update 25 (x32 Version: 7.0.250) Java 7 Update 6 (64-bit) (Version: 7.0.60) Java Auto Updater (x32 Version: 2.1.9.5) Left 4 Dead 2 (x32) Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300) MarketResearch (x32 Version: 140.0.212.000) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Extended (Version: 4.0.30319) Microsoft Access 2010 (x32 Version: 14.0.6029.1000) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Default Manager (x32 Version: 2.1.54.0) Microsoft Office 2010 (x32 Version: 14.0.4763.1000) Microsoft Office 2010 Language Pack Service Pack 1 (SP1) (x32) Microsoft Office 2010 Service Pack 1 (SP1) (x32) Microsoft Office Access 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Access MUI (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Access Setup Metadata MUI (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Click-to-Run 2010 (Version: 14.0.4763.1000) Microsoft Office Click-to-Run 2010 (x32 Version: 14.0.4763.1000) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000) Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (Spanish) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proofing (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.6029.1000) Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.6029.1000) Microsoft Office Shared MUI (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Shared Setup Metadata MUI (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Starter 2010 - English (x32 Version: 14.0.5139.5005) Microsoft Office Visio 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Visio MUI (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Rise Of Nations (x32) Microsoft Search Enhancement Pack (x32 Version: 3.0.126.0) Microsoft Silverlight (Version: 5.1.20913.0) Microsoft SkyDrive (HKCU Version: 17.0.2015.0811) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visio 2010 Service Pack 1 (SP1) (x32) Microsoft Visio Professional 2010 (x32 Version: 14.0.6029.1000) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Microsoft Visual Studio 6.0 Professional Edition (x32) Microsoft Web Publishing Wizard 1.53 (x32) Movie Maker (x32 Version: 16.4.3505.0912) Mozilla Firefox 25.0 (x86 en-US) (x32 Version: 25.0) Mozilla Maintenance Service (x32 Version: 25.0) MSN Toolbar (x32 Version: 4.0.0357.1) MSN Toolbar Platform (x32 Version: 4.0.0357.1) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT110 (x32 Version: 16.4.1108.0727) MSVCRT110_amd64 (Version: 16.4.1109.0912) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) MSXML4 Parser (x32 Version: 1.0.0) MX Simulator Demo (x32) Network64 (Version: 140.0.215.000) NOOK Study (x32 Version: 2.1.2.28770) Norton 360 (x32 Version: 20.4.0.40) Notepad++ (x32 Version: 6.2.2) OCR Software by I.R.I.S. 13.0 (Version: 13.0) Opera Mobile Emulator (x32) Oracle VM VirtualBox 4.3.2 (Version: 4.3.2) Paint.NET v3.5.10 (Version: 3.60.0) Photo Gallery (x32 Version: 16.4.3505.0912) Power2Go (x32 Version: 6.1.6224) Project64 1.6 (x32 Version: 1.6) PS_AIO_07_C310_SW_Min (x32 Version: 140.0.304.000) PS_AIO_Software_min (x32 Version: 130.0.365.000) PX Profile Update (x32 Version: 1.00.1.) QuickTransfer (x32 Version: 140.0.98.000) Realtek PCIE Card Reader (x32 Version: 6.1.7601.29011) RuneScape Launcher 1.2.3 (x32 Version: 1.2.3) S3D Web Player (Version: 1.8.0.1) Scan (x32 Version: 140.0.80.000) Secure Download Manager (x32 Version: 3.1.10) SecureW2 Enterprise Client 3.5.7 (x32) Shop for HP Supplies (Version: 14.0) SketchUp 8 (x32 Version: 3.0.16846) Skype™ 6.7 (x32 Version: 6.7.102) SmartWebPrinting (x32 Version: 140.0.186.000) SolutionCenter (x32 Version: 140.0.214.000) SpeedFan (remove only) (x32) SSH Secure Shell (x32) Status (x32 Version: 140.0.256.000) Steam (x32 Version: 1.0.0.0) swMSM (x32 Version: 12.0.0.1) Synaptics Pointing Device Driver (Version: 16.0.1.0) Team Fortress 2 (x32) TheHunt (x32 Version: TheHunt) Toolbox (x32 Version: 140.0.428.000) TrayApp (x32 Version: 140.0.212.000) Unity Web Player (HKCU Version: ) UnloadSupport (x32 Version: 11.0.0) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3) Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3) Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32) Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2566458) (x32) Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32) Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32) Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32) WampServer 2.4 (x32) WebReg (x32 Version: 140.0.212.017) Windows Live Communications Platform (x32 Version: 16.4.3505.0912) Windows Live Essentials (x32 Version: 16.4.3505.0912) Windows Live ID Sign-in Assistant (Version: 7.250.4311.0) Windows Live Installer (x32 Version: 16.4.3505.0912) Windows Live Photo Common (x32 Version: 16.4.3505.0912) Windows Live PIMT Platform (x32 Version: 16.4.3505.0912) Windows Live SOXE (x32 Version: 16.4.3505.0912) Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912) Windows Live UX Platform (x32 Version: 16.4.3505.0912) Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912) ==================== Restore Points ========================= 17-10-2013 10:20:11 Scheduled Checkpoint 20-10-2013 20:02:44 Removed WinZip 17.5 21-10-2013 01:43:02 Restore Operation 21-10-2013 02:45:51 HOTLLAMA Media Player Installation 29-10-2013 03:42:01 Restore Operation 03-11-2013 16:16:04 Installed Oracle VM VirtualBox 4.3.2 11-11-2013 01:21:36 Removed Microsoft Device Emulator (64 bit) version 3.0 - ENU ==================== Hosts content: ========================== 2009-07-13 21:34 - 2013-11-02 19:54 - 00000986 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost 127.0.0.1 localhost 127.0.0.1 localhost 127.0.0.1 localhost 127.0.0.1 localhost 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {11A89BD3-98EC-4CC7-A45C-94281112FD8F} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Cyberlink\YouCam\YCMMirage.exe [2012-02-21] (CyberLink) Task: {2189B92C-2E1B-4B40-99DD-A36E670F2334} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\wscstub.exe [2013-06-03] (Symantec Corporation) Task: {336628F0-5EC6-4B35-9AEE-CB9C10D33C57} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-18] (Google Inc.) Task: {4ADA26AE-C183-43D8-8397-A7AA74C9DEDC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-09-05] (Hewlett-Packard Company) Task: {53D42EB3-6919-41A6-84FE-478B5B7B08E8} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-08-09] (Hewlett-Packard) Task: {6B62729E-FE48-4BB0-9A9C-B79D6E808767} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\symerr.exe [2013-06-03] (Symantec Corporation) Task: {6C4AE5B8-3192-42F7-B629-ABDE6A9C9408} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\symerr.exe [2013-06-03] (Symantec Corporation) Task: {8D6311F2-6070-4BEB-88DC-D6C89CD7E415} - System32\Tasks\SecureW2 Task => C:\Program Files (x86)\SecureW2\sw2_tray.exe [2012-02-22] (SecureW2 B.V.) Task: {91F54832-1A12-4D5A-8EC7-F2C0B685D930} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company) Task: {BA9611FB-6F29-42DE-9D8E-C324967EE4CA} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-06-27] () Task: {BDD1F95D-D7C0-4159-8531-760290E4C0AB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company) Task: {BFA5D592-7014-4B47-9D82-0FA2F23434EB} - System32\Tasks\HPCeeScheduleForBrandon => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard) Task: {C627FC5B-851F-4F0B-8866-510ED592FF86} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated) Task: {D94F17DB-1C5F-4957-B1A5-E74738BD9288} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001UA => C:\Users\Brandon\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-18] (Google Inc.) Task: {E0E8A6F7-2A5C-4EF4-AEE6-4923D85E62B4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-18] (Google Inc.) Task: {F06FF55F-8619-4CE2-BDEA-0F60D3639353} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {F6A98AC2-4397-4C9C-9FBE-D5C9326BD33A} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001Core => C:\Users\Brandon\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-18] (Google Inc.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001Core.job => C:\Users\Brandon\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001UA.job => C:\Users\Brandon\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\HPCeeScheduleForBrandon.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe ==================== Loaded Modules (whitelisted) ============= 2012-02-09 18:26 - 2012-02-09 18:26 - 00048128 _____ () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\NetworkHeuristic.dll 2012-02-09 18:26 - 2012-02-09 18:26 - 00036864 _____ () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\ISCTNetDetect.dll 2010-01-02 09:42 - 2010-01-02 09:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll 2012-02-28 02:07 - 2012-02-28 02:07 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2012-02-03 15:33 - 2012-02-03 15:33 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll 2012-03-26 05:03 - 2012-03-26 05:03 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll 2013-11-02 19:53 - 2013-06-23 10:09 - 00131072 _____ () c:\wamp\bin\apache\apache2.4.4\bin\pcre.dll 2013-11-02 19:53 - 2013-06-23 10:09 - 00131072 _____ () C:\wamp\bin\apache\apache2.4.4\bin\pcre.dll 2012-11-28 14:13 - 2012-11-28 14:13 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2012-11-28 14:13 - 2012-11-28 14:13 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2013-08-07 14:25 - 2013-08-07 14:25 - 00093696 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll 2013-06-17 18:39 - 2012-05-30 09:51 - 00699280 ____R () C:\PROGRAM FILES (X86)\NORTON 360\ENGINE\20.4.0.40\wincfi39.dll 2012-02-26 22:39 - 2012-02-26 22:39 - 00025608 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Wireless Audio\CustomControls.dll 2013-03-12 16:10 - 2013-04-23 21:30 - 00652800 _____ () C:\Program Files (x86)\Steam\SDL2.dll 2012-12-15 22:39 - 2013-05-03 18:35 - 01114536 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL 2012-12-15 22:39 - 2013-03-26 19:16 - 20341672 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll 2012-12-15 22:39 - 2012-12-11 12:51 - 01100800 _____ () C:\Program Files (x86)\Steam\bin\avcodec-53.dll 2012-12-15 22:39 - 2012-12-11 12:51 - 00124416 _____ () C:\Program Files (x86)\Steam\bin\avutil-51.dll 2012-12-15 22:39 - 2012-12-11 12:51 - 00192000 _____ () C:\Program Files (x86)\Steam\bin\avformat-53.dll 2013-08-14 02:32 - 2013-08-14 02:32 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\991a8d378a3e64b31c0f4770ba9ae071\IsdiInterop.ni.dll 2012-10-09 14:43 - 2011-11-29 22:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll 2012-10-09 14:43 - 2011-12-16 13:39 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll 2013-11-06 10:00 - 2013-11-06 10:00 - 03368048 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll 2013-10-09 09:29 - 2013-10-09 09:29 - 16233864 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= Name: Microsoft Virtual WiFi Miniport Adapter #2 Description: Microsoft Virtual WiFi Miniport Adapter Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: vwifimp Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. Name: Photosmart Prem C310 series Description: Photosmart Prem C310 series Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318} Manufacturer: HP Service: Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. Name: Photosmart Prem C310 series Description: Photosmart Prem C310 series Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f} Manufacturer: HP Service: StillCam Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ==================== Event log errors: ========================= Application errors: ================== Error: (11/10/2013 06:32:00 PM) (Source: Application Error) (User: ) Description: Windows cannot access the file for one of the following reasons: there is a problem with the network connection, the disk that the file is stored on, or the storage drivers installed on this computer; or the disk is missing. Windows closed the program Protection Stub because of this error. Program: Protection Stub File: The error value is listed in the Additional Data section. User Action 1. Open the file again. This situation might be a temporary problem that corrects itself when the program runs again. 2. If the file still cannot be accessed and - It is on the network, your network administrator should verify that there is not a problem with the network and that the server can be contacted. - It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer. 3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER. 4. If the problem persists, restore the file from a backup copy. 5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for further assistance. Additional Data Error value: 00000000 Disk type: 0 Error: (11/10/2013 06:32:00 PM) (Source: Application Error) (User: ) Description: Faulting application name: ins5FD8.tmp, version: 3.0.0.0, time stamp: 0x40daa4fa Faulting module name: ins5FD8.tmp, version: 3.0.0.0, time stamp: 0x40daa4fa Exception code: 0xc000001d Fault offset: 0x00058b94 Faulting process id: 0x25c8 Faulting application start time: 0xins5FD8.tmp0 Faulting application path: ins5FD8.tmp1 Faulting module path: ins5FD8.tmp2 Report Id: ins5FD8.tmp3 Error: (11/10/2013 06:21:36 PM) (Source: Application Error) (User: ) Description: Faulting application name: Power2Go.exe, version: 6.1.0.6224, time stamp: 0x4d8c05b5 Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea8e7 Exception code: 0xc0000008 Fault offset: 0x00082808 Faulting process id: 0x228c Faulting application start time: 0xPower2Go.exe0 Faulting application path: Power2Go.exe1 Faulting module path: Power2Go.exe2 Report Id: Power2Go.exe3 Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 998 Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 998 Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 2012 Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 2012 Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (11/09/2013 10:40:45 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 1014 System errors: ============= Error: (11/08/2013 11:46:10 AM) (Source: DCOM) (User: ) Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} Error: (11/03/2013 10:51:25 AM) (Source: DCOM) (User: ) Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} Error: (11/03/2013 10:27:47 AM) (Source: DCOM) (User: ) Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} Error: (11/03/2013 10:16:24 AM) (Source: DCOM) (User: ) Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} Error: (11/03/2013 09:59:18 AM) (Source: DCOM) (User: ) Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} Error: (11/03/2013 09:23:27 AM) (Source: DCOM) (User: ) Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} Error: (11/03/2013 09:15:44 AM) (Source: DCOM) (User: ) Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} Error: (11/03/2013 08:59:40 AM) (Source: DCOM) (User: ) Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} Error: (11/02/2013 08:30:06 PM) (Source: EventLog) (User: ) Description: The previous system shutdown at 9:26:38 PM on ‎11/‎2/‎2013 was unexpected. Error: (11/02/2013 07:51:05 PM) (Source: Service Control Manager) (User: ) Description: The wampapache service terminated with service-specific error %%1. Microsoft Office Sessions: ========================= Error: (11/10/2013 06:32:00 PM) (Source: Application Error)(User: ) Description: Protection Stub000000000 Error: (11/10/2013 06:32:00 PM) (Source: Application Error)(User: ) Description: ins5FD8.tmp3.0.0.040daa4fains5FD8.tmp3.0.0.040daa4fac000001d00058b9425c801cede6cfe4cce22C:\Users\Brandon\AppData\Local\Temp\ins5FD8.tmpC:\Users\Brandon\AppData\Local\Temp\ins5FD8.tmp4b49016f-4a60-11e3-9362-949ec074d51b Error: (11/10/2013 06:21:36 PM) (Source: Application Error)(User: ) Description: Power2Go.exe6.1.0.62244d8c05b5ntdll.dll6.1.7601.18247521ea8e7c000000800082808228c01cede6b6ae2ec65C:\Program Files (x86)\CyberLink\Power2Go\Power2Go.exeC:\Windows\SysWOW64\ntdll.dlld79ce4ce-4a5e-11e3-9362-949ec074d51b Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 998 Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 998 Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 2012 Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 2012 Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (11/09/2013 10:40:45 AM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 1014 ==================== Memory info =========================== Percentage of memory in use: 27% Total physical RAM: 16286.36 MB Available physical RAM: 11796.82 MB Total Pagefile: 32570.89 MB Available Pagefile: 27807.62 MB Total Virtual: 8192 MB Available Virtual: 8191.8 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:677.52 GB) (Free:430.31 GB) NTFS ==>[system with boot components (obtained from reading drive)] Drive d: (Recovery) (Fixed) (Total:20.82 GB) (Free:2.53 GB) NTFS ==>[system with boot components (obtained from reading drive)] Drive e: (AOE III DISC 1) (CDROM) (Total:0.59 GB) (Free:0 GB) CDFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 00815C00) Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=678 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=21 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=102 MB) - (Type=0C) ==================== End Of Log ============================

Dont want to remove items without consulting people on the forums first.

Hello! I have reently been infected by a number of viruses. Here is my Malwarebytes log: I appreciate any help I can get! -Brandon Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.11.05.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Brandon :: BRANDON-HP [administrator] 11/5/2013 4:27:30 PM MBAM-log-2013-11-05 (17-20-58).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 208765 Time elapsed: 5 minute(s), 5 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 11 HKCR\CrossriderApp0026276.BHO (PUP.Optional.CrossRider.A) -> No action taken. HKCR\CrossriderApp0026276.BHO.1 (PUP.Optional.CrossRider.A) -> No action taken. HKCR\CrossriderApp0026276.Sandbox (PUP.Optional.CrossRider.A) -> No action taken. HKCR\CrossriderApp0026276.Sandbox.1 (PUP.Optional.CrossRider.A) -> No action taken. HKCU\Software\Cr_Installer\26276 (PUP.Optional.CrossRider.A) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110211621176} (PUP.Optional.CrossRider.M) -> No action taken. HKCR\CLSID\{11111111-1111-1111-1111-110211621176} (PUP.Optional.CrossRider.M) -> No action taken. HKCR\TypeLib\{44444444-4444-4444-4444-440244624476} (PUP.Optional.CrossRider.M) -> No action taken. HKCR\Interface\{55555555-5555-5555-5555-550255625576} (PUP.Optional.CrossRider.M) -> No action taken. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110211621176} (PUP.Optional.CrossRider.M) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110211621176} (PUP.Optional.CrossRider.M) -> No action taken. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 2 C:\Users\Brandon\Downloads\frostwire-5.5.6.windows.exe (PUP.Optional.OpenCandy) -> No action taken. C:\Program Files (x86)\Deal Spy\Deal Spy.dll (PUP.Optional.CrossRider.M) -> No action taken. (end)

Thank you for your help!

Im thinking I may just re-format. Would be the easy way out.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 4.9.4 (05.06.2013:1) OS: Windows 7 Home Premium x64 Ran by peg on Thu 05/16/2013 at 13:55:56.98 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\Software\smartbar ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\Users\peg\appdata\local\strongvault online backup" Failed to delete: [Folder] "C:\Program Files (x86)\recipehub_2j" Failed to delete: [Folder] "C:\Program Files (x86)\strongvault online backup" ~~~ FireFox Successfully deleted: [Folder] C:\Users\peg\AppData\Roaming\mozilla\firefox\profiles\w8013kzv.default\smartbar Successfully deleted: [Folder] C:\Users\peg\AppData\Roaming\mozilla\firefox\profiles\w8013kzv.default\extensions\staged Successfully deleted the following from C:\Users\peg\AppData\Roaming\mozilla\firefox\profiles\w8013kzv.default\prefs.js user_pref("CT3277370.1000234.weatherData", "{\"icon\":\"34.png\",\"temperature\":\"75°F\",\"temperatureClear\":\"75°F\",\"highTemperature\":\"80°F\",\"lowTemperature\":\"51 user_pref("CT3277370.embeddedsData", "[{\"appId\":\"130021582164426878\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"get user_pref("CT3277370.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit.com/?ctid=CT3277370&octid=CT3277370&SearchSource=15&CUI=UN2743726527155421 user_pref("CT3277370.search.searchAppId", "130021582164426878"); user_pref("CT3277370.search.searchCount", "0"); user_pref("CT3277370.smartbar.CTID", "CT3277370"); user_pref("CT3277370.smartbar.Uninstall", "0"); user_pref("CT3277370.smartbar.toolbarName", "InternetHelper3 "); user_pref("CT3289847.embeddedsData", "[{\"appId\":\"130068661007799818\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"get user_pref("CT3289847.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit.com/?ctid=CT3289847&octid=CT3289847&SearchSource=15&CUI=UN2447261197201281 user_pref("CT3289847.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fforums.malwarebytes.org%2Findex.php%3Fshowtopic%3D125897\",\"EB_MAIN_FRAME_TITLE\":\"I%20th user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://WhiteSmokeNew.OurToolbar.com//xpi\"}"); user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"WhiteSmoke New\"}"); user_pref("extensions.crossriderapp19962.19962.backgroundjs", "\n\n//\n"); user_pref("extensions.crossriderapp19962.19962.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GPL_=function(){_GPL_PLUGIN.started||_GPL_PLUGIN.prepare({pid:1340,baseCDN: user_pref("extensions.crossriderapp19962.19962.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefined\"){appAPI={};}var CR__bIsIEWindow=false;if(typeof window!==\"undefined user_pref("extensions.crossriderapp19962.19962.plugins.plugin_16.code", "if((typeof isBackground===\"undefined\"||isBackground!==true)&&(typeof _firefoxVersion!==\"undefined\" user_pref("extensions.crossriderapp19962.19962.plugins.plugin_17.code", "if(typeof window!==\"undefined\"){\n/*!\n * jQuery JavaScript Library v1.4.2\n * hxxp://jquery.com/\n user_pref("extensions.crossriderapp19962.19962.plugins.plugin_22.code", "(function(a){appAPI.queueManager={queue:[],register:function(b){this.queue.push(b);}};appAPI.ready=fun user_pref("extensions.crossriderapp19962.19962.plugins.plugin_4.code", "var jQuery = $jquery_171 = $jquery = null;\n\nif (document && typeof document.getElementById !== \"unde user_pref("extensions.crossriderapp19962.19962.plugins.plugin_64.code", "(function(){var h=\"__CR_EMPTY_CHANNEL__\";var d=function(j){return(typeof j===\"object\"&&j!==null);} user_pref("extensions.crossriderapp19962.19962.plugins.plugin_78.code", "if(typeof jQuery!==\"undefined\"&&(jQuery)&&typeof navigator!==\"undefined\"&&typeof navigator.userAge user_pref("extensions.crossriderapp19962.19962.plugins.plugin_98.code", "(function(){var b=\"cr_\"+appAPI.appID+\"internalMessage\";var a=function(){var d=function(g){if(g===t user_pref("smartbar.machineId", "UHZACU7OVIWN/S30C/HX5TS0QUERFH6SHSTWCQHOZVZ4Q4JMDZ0QXR3GODXE7PIUYJQYDVWQ46Q9F2STYBDXZW"); user_pref("sweetim.toolbar.scripts.0.domain-whitelist", "hxxp://(www.|apps.)?facebook\\.com.*"); user_pref("sweetim.toolbar.scripts.1.domain-whitelist", "hxxps://(www.|apps.)?facebook\\.com.*"); user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"hxxp://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://sear user_pref("{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}.ScriptData_WSG_whiteList", "{\"search.babylon.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home. Emptied folder: C:\Users\peg\AppData\Roaming\mozilla\firefox\profiles\w8013kzv.default\minidumps [4 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Thu 05/16/2013 at 14:01:21.19 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Malwarebytes Anti-Malware (Trial) 1.75.0.1300 www.malwarebytes.org Database version: v2013.05.15.11 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16540 peg :: PEG-PC [administrator] Protection: Enabled 5/15/2013 5:20:20 PM MBAM-log-2013-05-15 (17-37-01).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 222007 Time elapsed: 16 minute(s), 20 second(s) Memory Processes Detected: 2 C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> 2804 -> No action taken. C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> 3620 -> No action taken. Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 4 HKCR\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} (PUP.Software.Updater) -> No action taken. HKCR\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} (PUP.Software.Updater) -> No action taken. HKCR\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} (PUP.Software.Updater) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} (PUP.Software.Updater) -> No action taken. Registry Values Detected: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ctfmon.exe (Trojan.Agent.Gen) -> Data: C:\PROGRA~3\rundll32.exe C:\PROGRA~3\43d3.dat,FG00 -> No action taken. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 6 C:\ProgramData\43d3.dat (Trojan.FakeMS) -> No action taken. C:\ProgramData\39ri.dat (Trojan.FakeMS) -> No action taken. C:\Users\peg\AppData\Local\Temp\ofi3jZF.exe (Trojan.FakeMS) -> No action taken. C:\Users\peg\AppData\Local\Temp\DIQ\FlashPlayer_151\software\SupremeSavings.exe (Heuristics.Shuriken) -> No action taken. C:\Windows\Tasks\AmiUpdXp.job (PUP.Software.Updater) -> No action taken. C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> No action taken. (end) # AdwCleaner v2.300 - Logfile created 05/16/2013 at 14:54:05 # Updated 28/04/2013 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : peg - PEG-PC # Boot Mode : Normal # Running from : C:\Users\peg\Desktop\adwcleaner.exe # Option [search] ***** [services] ***** ***** [Files / Folders] ***** Folder Found : C:\Program Files\DomaIQ Uninstaller Folder Found : C:\Users\peg\AppData\Local\APN Folder Found : C:\Users\peg\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihkeoookbpemkdccdccdmacnidhooohk Folder Found : C:\Users\peg\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj Folder Found : C:\Users\peg\AppData\Local\Temp\CT3277370 Folder Found : C:\Users\peg\AppData\Local\Updater19962 Folder Found : C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\CT3277370 Folder Found : C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c} Folder Found : C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\Smartbar Folder Found : C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\SweetPacksToolbarData ***** [Registry] ***** Key Found : HKCU\Software\AppDataLow\Software\SmartBar Key Found : HKCU\Software\AppDataLow\Software\Supreme Savings Key Found : HKCU\Software\Conduit Key Found : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0} Key Found : HKCU\Software\SearchProtect Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874} Key Found : HKLM\Software\Classes\Installer\Features\90C64EA18BA25EE488BF80DCF07F2FFD Key Found : HKLM\Software\Classes\Installer\Products\90C64EA18BA25EE488BF80DCF07F2FFD Key Found : HKLM\SOFTWARE\Classes\TypeLib\{03119103-0854-469D-807A-171568457991} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56} Key Found : HKLM\Software\GamesBarSetup Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Found : HKLM\Software\SearchProtect Key Found : HKLM\Software\Supreme Savings Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{13119113-0854-469D-807A-171568457991} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{33119133-0854-469D-807A-171568457991} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23119123-0854-469D-807A-171568457991} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E} Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DomaIQ Uninstaller Key Found : HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991} Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456} Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92} Key Found : HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF Key Found : HKLM\SOFTWARE\Tarma Installer Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}] Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}] ***** [internet Browsers] ***** -\\ Internet Explorer v10.0.9200.16576 [OK] Registry is clean. -\\ Mozilla Firefox v20.0.1 (en-US) File : C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\prefs.js Found : user_pref("CT3277370.1000082.isPlayDisplay", "true"); Found : user_pref("CT3277370.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description[...] Found : user_pref("CT3277370.1000234.TWC_TMP_city", "ALLENTOWN"); Found : user_pref("CT3277370.1000234.TWC_TMP_country", "US"); Found : user_pref("CT3277370.1000234.TWC_country", "UNITED STATES"); Found : user_pref("CT3277370.1000234.TWC_locId", "USPA0025"); Found : user_pref("CT3277370.1000234.TWC_location", "Allentown, PA"); Found : user_pref("CT3277370.1000234.TWC_region", "US"); Found : user_pref("CT3277370.1000234.TWC_temp_dis", "f"); Found : user_pref("CT3277370.1000234.TWC_wind_dis", "mph"); Found : user_pref("CT3277370.1000234.weatherData", "{\"icon\":\"34.png\",\"temperature\":\"79°F\",\"temperat[...] Found : user_pref("CT3277370.CT3277370ads1.enc", "JTdCJTIyYWRzJTIyJTNBJTVCJTdCJTIyYWlkJTIyJTNBJTIyNDQ5NzAlMj[...] Found : user_pref("CT3277370.CT3277370current_term.enc", ""); Found : user_pref("CT3277370.CT3277370sdate.enc", "MTY="); Found : user_pref("CT3277370.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}"); Found : user_pref("CT3277370.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...] Found : user_pref("CT3277370.FF19Solved", "true"); Found : user_pref("CT3277370.FirstTime", "true"); Found : user_pref("CT3277370.FirstTimeFF3", "true"); Found : user_pref("CT3277370.UserID", "UN27437265271554213"); Found : user_pref("CT3277370.addressBarTakeOverEnabledInHidden", "true"); Found : user_pref("CT3277370.autoDisableScopes", -1); Found : user_pref("CT3277370.browser.search.defaultthis.engineName", "true"); Found : user_pref("CT3277370.defaultSearch", "true"); Found : user_pref("CT3277370.embeddedsData", "[{\"appId\":\"130021582164426878\",\"apiPermissions\":{\"cross[...] Found : user_pref("CT3277370.enableAlerts", "true"); Found : user_pref("CT3277370.enableFix404ByUser", "FALSE"); Found : user_pref("CT3277370.enableSearchFromAddressBar", "true"); Found : user_pref("CT3277370.firstTimeDialogOpened", "true"); Found : user_pref("CT3277370.fixPageNotFoundError", "true"); Found : user_pref("CT3277370.fixPageNotFoundErrorByUser", "true"); Found : user_pref("CT3277370.fixPageNotFoundErrorInHidden", "true"); Found : user_pref("CT3277370.fixUrls", true); Found : user_pref("CT3277370.hxxp___pinterest_aot_im.isEnabled.enc", "WQ=="); Found : user_pref("CT3277370.installDate", "21/4/2013 18:47:25"); Found : user_pref("CT3277370.installId", "stub.exe"); Found : user_pref("CT3277370.installSessionId", "{2860EC0F-FF88-4E1B-893F-82C19D399F3A}"); Found : user_pref("CT3277370.installSp", "TRUE"); Found : user_pref("CT3277370.installUsage", "2013-04-22T02:10:33.3749993+03:00"); Found : user_pref("CT3277370.installUsageEarly", "2013-04-22T02:10:30.2237589+03:00"); Found : user_pref("CT3277370.installerVersion", "1.4.1.3"); Found : user_pref("CT3277370.isCheckedStartAsHidden", true); Found : user_pref("CT3277370.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}"); Found : user_pref("CT3277370.isFirstTimeToolbarLoading", "false"); Found : user_pref("CT3277370.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}"); Found : user_pref("CT3277370.keyword", "true"); Found : user_pref("CT3277370.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit[...] Found : user_pref("CT3277370.lastVersion", "10.16.1.521"); Found : user_pref("CT3277370.mam_gk_installer_preapproved.enc", "ZmFsc2U="); Found : user_pref("CT3277370.migrateAppsAndComponents", true); Found : user_pref("CT3277370.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"\",\"[...] Found : user_pref("CT3277370.openThankYouPage", "false"); Found : user_pref("CT3277370.openUninstallPage", "true"); Found : user_pref("CT3277370.revertSettingsEnabled", "false"); Found : user_pref("CT3277370.search.searchAppId", "130021582164426878"); Found : user_pref("CT3277370.search.searchCount", "0"); Found : user_pref("CT3277370.searchFromAddressBarEnabledByUser", "true"); Found : user_pref("CT3277370.searchInNewTabEnabledByUser", "true"); Found : user_pref("CT3277370.searchInNewTabEnabledInHidden", "true"); Found : user_pref("CT3277370.searchRevert", "false"); Found : user_pref("CT3277370.searchUserMode", "2"); Found : user_pref("CT3277370.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}"); Found : user_pref("CT3277370.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...] Found : user_pref("CT3277370.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...] Found : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...] Found : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...] Found : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...] Found : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...] Found : user_pref("CT3277370.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1368652166791"); Found : user_pref("CT3277370.serviceLayer_services_appsMetadata_lastUpdate", "1368729106334"); Found : user_pref("CT3277370.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1367897403133"); Found : user_pref("CT3277370.serviceLayer_services_installUsage_ToolbarInstallEarly_lastUpdate", "1366585829[...] Found : user_pref("CT3277370.serviceLayer_services_installUsage_ToolbarInstall_lastUpdate", "1366585833392")[...] Found : user_pref("CT3277370.serviceLayer_services_location_lastUpdate", "1368652166571"); Found : user_pref("CT3277370.serviceLayer_services_login_10.15.2.23_lastUpdate", "1366838100366"); Found : user_pref("CT3277370.serviceLayer_services_login_10.15.2.523_lastUpdate", "1368233827490"); Found : user_pref("CT3277370.serviceLayer_services_login_10.16.1.521_lastUpdate", "1368729223368"); Found : user_pref("CT3277370.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1367897387442"); Found : user_pref("CT3277370.serviceLayer_services_searchAPI_lastUpdate", "1368652166605"); Found : user_pref("CT3277370.serviceLayer_services_serviceMap_lastUpdate", "1368652166391"); Found : user_pref("CT3277370.serviceLayer_services_toolbarContextMenu_lastUpdate", "1367897392177"); Found : user_pref("CT3277370.serviceLayer_services_toolbarSettings_lastUpdate", "1368729106171"); Found : user_pref("CT3277370.serviceLayer_services_translation_lastUpdate", "1368652166783"); Found : user_pref("CT3277370.settingsINI", true); Found : user_pref("CT3277370.shouldFirstTimeDialog", "false"); Found : user_pref("CT3277370.showToolbarPermission", "false"); Found : user_pref("CT3277370.smartbar.CTID", "CT3277370"); Found : user_pref("CT3277370.smartbar.Uninstall", "0"); Found : user_pref("CT3277370.smartbar.toolbarName", "InternetHelper3 "); Found : user_pref("CT3277370.startPage", "true"); Found : user_pref("CT3277370.toolbarBornServerTime", "22-4-2013"); Found : user_pref("CT3277370.toolbarCurrentServerTime", "16-5-2013"); Found : user_pref("CT3277370.toolbarLoginClientTime", "Sun Apr 21 2013 19:10:34 GMT-0400 (Eastern Daylight T[...] Found : user_pref("CT3277370.versionFromInstaller", "10.15.2.23"); Found : user_pref("CT3277370_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...] Found : user_pref("CT3289847.1000082.isPlayDisplay", "true"); Found : user_pref("CT3289847.1000082.state", "{\"state\":\"stopped\",\"text\":\"1.FM (Cou...\",\"description[...] Found : user_pref("CT3289847.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}"); Found : user_pref("CT3289847.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...] Found : user_pref("CT3289847.FF19Solved", "true"); Found : user_pref("CT3289847.FirstTime", "true"); Found : user_pref("CT3289847.FirstTimeFF3", "true"); Found : user_pref("CT3289847.PG_ENABLE", "dHJ1ZQ=="); Found : user_pref("CT3289847.PG_ENABLE.enc", "dHJ1ZQ=="); Found : user_pref("CT3289847.SF_JUST_INSTALLED.enc", "RkFMU0U="); Found : user_pref("CT3289847.SF_STATUS.enc", "RU5BQkxFRA=="); Found : user_pref("CT3289847.SF_USER_ID.enc", "Y2lkXzI4NDIwMTMxMDE2NzUwODU0ODQ="); Found : user_pref("CT3289847.UserID", "UN24472611972012819"); Found : user_pref("CT3289847.addressBarTakeOverEnabledInHidden", "true"); Found : user_pref("CT3289847.browser.search.defaultthis.engineName", "true"); Found : user_pref("CT3289847.cb_experience_000.enc", "NA=="); Found : user_pref("CT3289847.cb_firstuse0100.enc", "MQ=="); Found : user_pref("CT3289847.cb_user_id_000.enc", "Q0I2Mjc0OTIwNTY4ODVfMTM2ODM5MDQwMTA1M19GaXJlZm94"); Found : user_pref("CT3289847.cbfirsttime.enc", "U3VuIE1heSAxMiAyMDEzIDE2OjI2OjQxIEdNVC0wNDAwIChFYXN0ZXJuIERh[...] Found : user_pref("CT3289847.defaultSearch", "true"); Found : user_pref("CT3289847.embeddedsData", "[{\"appId\":\"130068661007799818\",\"apiPermissions\":{\"cross[...] Found : user_pref("CT3289847.enableAlerts", "true"); Found : user_pref("CT3289847.enableFix404ByUser", "TRUE"); Found : user_pref("CT3289847.enableSearchFromAddressBar", "true"); Found : user_pref("CT3289847.firstTimeDialogOpened", "true"); Found : user_pref("CT3289847.first_time_search.enc", "MQ=="); Found : user_pref("CT3289847.fixPageNotFoundError", "true"); Found : user_pref("CT3289847.fixPageNotFoundErrorByUser", "true"); Found : user_pref("CT3289847.fixPageNotFoundErrorInHidden", "true"); Found : user_pref("CT3289847.fixUrls", true); Found : user_pref("CT3289847.hxxp___api16_similarsites_com.pid2.enc", "OTllYjk1OWRkZTk5YmFjOQ=="); Found : user_pref("CT3289847.hxxp___api18_similarsites_com.pid2.enc", "OTllYjk1OWRkZTk5YmFjOQ=="); Found : user_pref("CT3289847.hxxp___api28_starwebnet_com.pid2.enc", "NzZlOTUzYTMtN2Q5Zi1jY2YzLTcxZTktZDI1ZDV[...] Found : user_pref("CT3289847.hxxp___api29_starwebnet_com.pid2.enc", "YmI3MGRlODYtM2Q5Yy1mNDJkLWRjYjYtMWMxYTc[...] Found : user_pref("CT3289847.hxxp___api30_starwebnet_com.pid2.enc", "NGYxNTJlNTAtN2M4My1kM2I5LWJlZGMtNWU4YTl[...] Found : user_pref("CT3289847.hxxp___api31_starwebnet_com.pid2.enc", "ODMxNzM1MTEtYzNlNS1lODY0LTBjMjQtMmQ1NDg[...] Found : user_pref("CT3289847.hxxp___api32_starwebnet_com.pid2.enc", "MWU0NjIyYjgtYWFkOS05MTA5LTU0OTUtOGZiMDJ[...] Found : user_pref("CT3289847.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_defaultGui.enc", "eyJndWkiOltdLC[...] Found : user_pref("CT3289847.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_settings.enc", "eyJpbml0VXJsIjoi[...] Found : user_pref("CT3289847.hxxp___toolbar_jollywallet_com_tlb_2.jw_token.enc", "ZTc3MDExY2UtYmI1MS1lNDA0LT[...] Found : user_pref("CT3289847.hxxp___toolbar_jollywallet_com_tlb_2.key_list_id.enc", "MjAxMjA4MDItMDAw"); Found : user_pref("CT3289847.installDate", "14/4/2013 0:31:48"); Found : user_pref("CT3289847.installId", "9818"); Found : user_pref("CT3289847.installerVersion", "1.3.7.3"); Found : user_pref("CT3289847.isCheckedStartAsHidden", true); Found : user_pref("CT3289847.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}"); Found : user_pref("CT3289847.isFirstTimeToolbarLoading", "false"); Found : user_pref("CT3289847.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}"); Found : user_pref("CT3289847.keyword", "true"); Found : user_pref("CT3289847.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit[...] Found : user_pref("CT3289847.lastVersion", "10.15.0.562"); Found : user_pref("CT3289847.mam_gk_appStateReportTime.enc", "MTM2ODM5MDM0NjMzMA=="); Found : user_pref("CT3289847.mam_gk_appState_CouponBuddy.enc", "b24="); Found : user_pref("CT3289847.mam_gk_appState_PriceGong.enc", "b24="); Found : user_pref("CT3289847.mam_gk_appsDefaultEnabled.enc", "bnVsbA=="); Found : user_pref("CT3289847.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IkNvdXBvbkJ1ZGR5Iiw[...] Found : user_pref("CT3289847.mam_gk_currentVersion.enc", "MS40LjQuNg=="); Found : user_pref("CT3289847.mam_gk_eventsCache.enc", "eyJjMDVhNTk2NS1iM2JkLTQyOTYtOTFjZC01NjNkYzczMDc3YjIiO[...] Found : user_pref("CT3289847.mam_gk_first_time.enc", "MQ=="); Found : user_pref("CT3289847.mam_gk_gadgetOpen.enc", "d2VsY29tZQ=="); Found : user_pref("CT3289847.mam_gk_installer_preapproved.enc", "ZmFsc2U="); Found : user_pref("CT3289847.mam_gk_lastLoginTime.enc", "MTM2ODM5MDM0MjMyMw=="); Found : user_pref("CT3289847.mam_gk_localization.enc", "eyJnYWRnZXRDb250ZW50UG9saWN5Ijp7IlRleHQiOiJDb250ZW50[...] Found : user_pref("CT3289847.mam_gk_pgUnloadedOnce.enc", "dHJ1ZQ=="); Found : user_pref("CT3289847.mam_gk_settings1.4.4.6.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVyd[...] Found : user_pref("CT3289847.mam_gk_showCloseButton.enc", "dHJ1ZQ=="); Found : user_pref("CT3289847.mam_gk_showWelcomeGadget.enc", "ZmFsc2U="); Found : user_pref("CT3289847.mam_gk_userId.enc", "YTkxNWMzN2QtNzNhNy00MmNhLTg0NzYtMmNhMWIxMzQxMWZh"); Found : user_pref("CT3289847.migrateAppsAndComponents", true); Found : user_pref("CT3289847.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fforums.malwareby[...] Found : user_pref("CT3289847.newSettings", "{\"dataType\":\"boolean\",\"data\":\"true\"}"); Found : user_pref("CT3289847.openThankYouPage", "false"); Found : user_pref("CT3289847.openUninstallPage", "true"); Found : user_pref("CT3289847.price-gong.isManagedApp", "true"); Found : user_pref("CT3289847.revertSettingsEnabled", "true"); Found : user_pref("CT3289847.searchFromAddressBarEnabledByUser", "true"); Found : user_pref("CT3289847.searchInNewTabEnabledByUser", "true"); Found : user_pref("CT3289847.searchInNewTabEnabledInHidden", "true"); Found : user_pref("CT3289847.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}"); Found : user_pref("CT3289847.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...] Found : user_pref("CT3289847.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...] Found : user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...] Found : user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...] Found : user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...] Found : user_pref("CT3289847.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...] Found : user_pref("CT3289847.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1367779252531"); Found : user_pref("CT3289847.serviceLayer_services_appsMetadata_lastUpdate", "1368372970736"); Found : user_pref("CT3289847.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1368372970418"); Found : user_pref("CT3289847.serviceLayer_services_location_lastUpdate", "1368372983417"); Found : user_pref("CT3289847.serviceLayer_services_login_10.14.380.14_lastUpdate", "1366065463117"); Found : user_pref("CT3289847.serviceLayer_services_login_10.15.0.562_lastUpdate", "1368390457264"); Found : user_pref("CT3289847.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1368372970744"); Found : user_pref("CT3289847.serviceLayer_services_searchAPI_lastUpdate", "1368372983453"); Found : user_pref("CT3289847.serviceLayer_services_serviceMap_lastUpdate", "1368372970725"); Found : user_pref("CT3289847.serviceLayer_services_setupAPI_lastUpdate", "1365939823647"); Found : user_pref("CT3289847.serviceLayer_services_toolbarContextMenu_lastUpdate", "1368372970199"); Found : user_pref("CT3289847.serviceLayer_services_toolbarSettings_lastUpdate", "1368390456864"); Found : user_pref("CT3289847.serviceLayer_services_translation_lastUpdate", "1368372970948"); Found : user_pref("CT3289847.settingsINI", true); Found : user_pref("CT3289847.shouldFirstTimeDialog", "false"); Found : user_pref("CT3289847.showToolbarPermission", "false"); Found : user_pref("CT3289847.startPage", "true"); Found : user_pref("CT3289847.toolbarBornServerTime", "14-4-2013"); Found : user_pref("CT3289847.toolbarCurrentServerTime", "12-5-2013"); Found : user_pref("CT3289847.toolbarLoginClientTime", "Mon Apr 15 2013 18:39:13 GMT-0400 (Eastern Daylight T[...] Found : user_pref("CT3289847.url_history0001.enc", "aHR0cDovL2NsYXNzaWZpZWRzLnBlbm5zd29vZHMubmV0L2NsYXNzaWZp[...] Found : user_pref("CT3289847_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...] Found : user_pref("extensions.asktb.ff-original-keyword-url", ""); Found : user_pref("extensions.crossriderapp19962.19962.backgroundjs", "\n\n//\n"); Found : user_pref("extensions.crossriderapp19962.19962.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _[...] Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_14.code", "if(typeof(appAPI)===\"undef[...] Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_16.code", "if((typeof isBackground===\[...] Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_17.code", "if(typeof window!==\"undefi[...] Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_22.code", "(function(a){appAPI.queueMa[...] Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_4.code", "var jQuery = $jquery_171 = $[...] Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_64.code", "(function(){var h=\"__CR_EM[...] Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_78.code", "if(typeof jQuery!==\"undefi[...] Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_98.code", "(function(){var b=\"cr_\"+a[...] Found : user_pref("smartbar.machineId", "UHZACU7OVIWN/S30C/HX5TS0QUERFH6SHSTWCQHOZVZ4Q4JMDZ0QXR3GODXE7PIUYJQ[...] Found : user_pref("sweetim.toolbar.scripts.0.domain-whitelist", "hxxp://(www.|apps.)?facebook\\.com.*"); Found : user_pref("sweetim.toolbar.scripts.1.domain-whitelist", "hxxps://(www.|apps.)?facebook\\.com.*"); Found : user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engin[...] Found : user_pref("{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...] -\\ Google Chrome v26.0.1410.64 File : C:\Users\peg\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] File is clean. ************************* AdwCleaner[R1].txt - [25279 octets] - [12/05/2013 17:26:52] AdwCleaner[R2].txt - [24260 octets] - [16/05/2013 14:34:47] AdwCleaner[R3].txt - [24321 octets] - [16/05/2013 14:53:36] AdwCleaner[R4].txt - [24265 octets] - [16/05/2013 14:54:05] ########## EOF - C:\AdwCleaner[R4].txt - [24326 octets] ########## RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy mail : tigzyRK<at>gmail<dot>com Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/ Website : http://tigzy.geekstogo.com/roguekiller.php Blog : http://tigzyrk.blogspot.com/ Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version Started in : Normal mode User : peg [Admin rights] Mode : Scan -- Date : 05/16/2013 14:44:43 | ARK || FAK || MBR | ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 5 ¤¤¤ [TASK][sUSP PATH] Updater19962.exe : C:\Users\peg\AppData\Local\Updater19962\Updater19962.exe /extensionid=19962 /extensionname="Supreme Savings" /chromeid=ihkeoookbpemkdccdccdmacnidhooohk [7] -> FOUND [HJPOL] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND [HJPOL] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Particular Files / Folders: ¤¤¤ [ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-18\$3c42eb883e76c42fe757e3ec8d556822\@ [-] --> FOUND [ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-21-1531084523-3685658873-1988755905-1000\$3c42eb883e76c42fe757e3ec8d556822\@ [-] --> FOUND [ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-18\$3c42eb883e76c42fe757e3ec8d556822\U --> FOUND [ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-1531084523-3685658873-1988755905-1000\$3c42eb883e76c42fe757e3ec8d556822\U --> FOUND [ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-18\$3c42eb883e76c42fe757e3ec8d556822\L --> FOUND [ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-1531084523-3685658873-1988755905-1000\$3c42eb883e76c42fe757e3ec8d556822\L --> FOUND ¤¤¤ Driver : [NOT LOADED] ¤¤¤ ¤¤¤ Infection : ZeroAccess ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> C:\Windows\system32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: WDC WD3200BPVT-80JJ5T0 +++++ --- User --- [MBR] 2d7d94ba8776bd501073fc5c5b67dc55 [bSP] 6038da5abdb86a32e945c2c6aa172f56 : Windows 7/8 MBR Code Partition table: 0 - [XXXXXX] FAT32-LBA (0x1c) [HIDDEN!] Offset (sectors): 2048 | Size: 25600 Mo 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 52430848 | Size: 122098 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 302487552 | Size: 157545 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[1]_S_05162013_02d1444.txt >> RKreport[1]_S_05162013_02d1444.txt . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 1/17/2012 2:14:02 AM System Uptime: 5/16/2013 2:26:51 PM (0 hours ago) . Motherboard: ASUSTeK Computer Inc. | | K54C Processor: Intel® Core i3-2350M CPU @ 2.30GHz | CPU 1 | 2300/100mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 119 GiB total, 76.408 GiB free. D: is FIXED (NTFS) - 154 GiB total, 153.759 GiB free. E: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP110: 5/10/2013 5:30:02 PM - Removed Internet Explorer Toolbar 4.7 by SweetPacks RP111: 5/10/2013 5:31:13 PM - Removed Internet Explorer Toolbar 4.7 by SweetPacks RP112: 5/12/2013 4:27:52 PM - Installed HiJackThis RP113: 5/16/2013 10:26:57 AM - Windows Update . ==== Installed Programs ====================== . ??????? Windows Live Mesh ActiveX ??(????) ??????? Windows Live Mesh ActiveX ??? Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Reader XI (11.0.03) Alcor Micro USB Card Reader Ask Toolbar Ask Toolbar Updater Asmedia ASM104x USB 3.0 Host Controller Driver ASUS AI Recovery ASUS FaceLogon ASUS FancyStart ASUS LifeFrame3 ASUS Live Update ASUS Power4Gear Hybrid ASUS Virtual Camera ASUS WebStorage ASUS_Screensaver AsusVibe2.0 ATK Package Bejeweled 2 Deluxe Bing Bar Contrôle ActiveX Windows Live Mesh pour connexions à distance Control ActiveX de Windows Live Mesh para conexiones remotas Controlo ActiveX do Windows Live Mesh para Ligações Remotas CyberLink LabelPrint CyberLink Media Suite CyberLink Power2Go D3DX10 DomaIQ Driver Pro v3.0 Facebook Video Calling 1.2.0.287 Fast Boot Galeria de Fotografias do Windows Live Galerie de photos Windows Live Galería fotográfica de Windows Live Google Chrome Google Update Helper HiJackThis InstantOn for NB Intel® Control Center Intel® Management Engine Components Intel® Processor Graphics Java 7 Update 17 Java Auto Updater JavaFX 2.1.1 Junk Mail filter update Malwarebytes Anti-Malware version 1.75.0.1300 Mesh Runtime Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Extended Microsoft Application Error Reporting Microsoft Office 2010 Microsoft Office Click-to-Run 2010 Microsoft Office Starter 2010 - English Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Mozilla Firefox 20.0.1 (x86 en-US) Mozilla Maintenance Service MSVCRT MSVCRT_amd64 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Norton AntiVirus Norton Identity Safe Nuance PDF Reader Optimizer Pro v3.0 PC Health Kit v3.2 Qualcomm Atheros WiFi Driver Installation Realtek High Definition Audio Driver Recipe Hub toolbar Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449) Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428) Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019) Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595) Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642) Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576) Security Update for Microsoft .NET Framework 4 Extended (KB2487367) Security Update for Microsoft .NET Framework 4 Extended (KB2656351) Security Update for Microsoft .NET Framework 4 Extended (KB2736428) Security Update for Microsoft .NET Framework 4 Extended (KB2742595) Sonic Focus Strongvault Online Backup Synaptics Pointing Device Driver Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft .NET Framework 4 Extended (KB2468871) Update for Microsoft .NET Framework 4 Extended (KB2533523) Update for Microsoft .NET Framework 4 Extended (KB2600217) VAFPlayer Windows Live Windows Live ??? Windows Live ???? Windows Live Communications Platform Windows Live Essentials Windows Live Family Safety Windows Live ID Sign-in Assistant Windows Live Installer Windows Live Language Selector Windows Live Mail Windows Live Mesh Windows Live Mesh ActiveX Control for Remote Connections Windows Live Messenger Windows Live MIME IFilter Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live Remote Client Windows Live Remote Client Resources Windows Live Remote Service Windows Live Remote Service Resources Windows Live SOXE Windows Live SOXE Definitions Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources WinFlash Wireless Console 3 Yahoo! Software Update Yahoo! Toolbar . ==== Event Viewer Messages From Past Week ======== . 5/16/2013 2:29:55 PM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143. 5/16/2013 2:28:27 PM, Error: Service Control Manager [7024] - The Windows Firewall service terminated with service-specific error Access is denied.. . ==== End Of File =========================== DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 10.0.9200.16576 BrowserJavaVersion: 10.17.2 Run by peg at 14:56:02 on 2013-05-16 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4000.2030 [GMT -4:00] . AV: Norton AntiVirus *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Norton AntiVirus *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} . ============== Running Processes =============== . C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\FBAgent.exe C:\Windows\system32\WLANExt.exe C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\PROGRA~2\RECIPE~2\bar\1.bin\2jbarsvc.exe C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\system32\Dwm.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskhost.exe C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe C:\Windows\system32\taskeng.exe C:\Program Files\ASUS\P4G\BatteryLife.exe C:\Windows\system32\taskeng.exe C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe C:\Program Files (x86)\ASUS\FaceLogon\sensorsrv.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Windows\System32\igfxpers.exe C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe C:\Windows\AsScrPro.exe C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Windows\system32\consent.exe C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe C:\Users\peg\Desktop\RogueKillerX64.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.yahoo.com/?fr=fp-yie10 uWindow Title = Windows Internet Explorer provided by Yahoo! uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie10 mStart Page = hxxp://www.google.com uProxyOverride = <local> uURLSearchHooks: <No Name>: {cc8ae5b8-005b-4b1a-a27d-307eddffe5c8} - uURLSearchHooks: YTNavAssistPlugin Class: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll BHO: Toolbar BHO: {06e3475c-5521-4de8-bb12-50720f21631c} - BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\IPS\IPSBHO.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Norton Identity Protection: {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll BHO: Search Assistant BHO: {b7acdf9c-c4f9-4d5d-998e-b147866b4d4c} - BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll TB: Norton Identity Safe Toolbar: {A13C2648-91D4-4BF3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - TB: Recipe Hub: {cf51de5b-eb36-4114-bb69-84df63fbadb4} - TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll TB: Norton Identity Safe Toolbar: {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll uRun: [Facebook Update] "C:\Users\peg\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver uRun: [backupAgent] C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe uRun: [Driver Pro] C:\Program Files (x86)\Driver Pro\DPLauncher.exe mRun: [Nuance PDF Reader-reminder] "C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini" mRun: [ASUSPRP] "C:\Program Files (x86)\ASUS\APRP\APRP.EXE" mRun: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe /S mRun: [sonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe mRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe mRun: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [EKIJ5000StatusMonitor] C:\Windows\System32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ASUSVI~1.LNK - C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FANCYS~1.LNK - C:\Windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe mPolicies-Explorer: NoActiveDesktop = dword:1 mPolicies-Explorer: NoActiveDesktopChanges = dword:1 mPolicies-System: ConsentPromptBehaviorAdmin = dword:5 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll TCP: NameServer = 192.168.0.1 TCP: Interfaces\{E4EE1EFE-5953-489B-9C59-8FD50AAFCDA2} : DHCPNameServer = 192.168.0.1 Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll SSODL: WebCheck - <orphaned> mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - C:\Windows\System32\rundll32.exe C:\Windows\System32\advpack.dll,LaunchINFSectionEx C:\Program Files (x86)\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12 x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe x64-Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe x64-Run: [synAsusAcpi] C:\Program Files (x86)\Synaptics\SynTP\SynAsusAcpi.exe x64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SF3 x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe x64-Run: [EKIJ5000StatusMonitor] C:\Windows\System32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned> x64-Notify: igfxcui - igfxdev.dll x64-SSODL: WebCheck - <orphaned> . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\ FF - prefs.js: browser.search.selectedEngine - Norton Safe Search FF - prefs.js: network.proxy.type - 0 FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\Users\peg\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll FF - plugin: C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}\plugins\np-mswmp.dll FF - plugin: C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}\plugins\npConduitFirefoxPlugin.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll FF - plugin: C:\Windows\SysWOW64\npmproxy.dll FF - ExtSQL: 2013-04-21 18:47; {b920380d-fbe7-45c7-96ab-37e9870a566c}; C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c} FF - ExtSQL: 2013-05-06 21:20; {BBDA0591-3099-440a-AA10-41764D9DB4DB}; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\IPSFFPlgn FF - ExtSQL: 2013-05-06 21:54; {F04D2D30-776C-4d02-8627-8E4385ECA58D}; C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2013.3.3.19\coFFPlgn . ============= SERVICES / DRIVERS =============== . R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NAVx64\1403010.016\SymDS64.sys [2013-5-6 493656] R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NAVx64\1403010.016\SymEFA64.sys [2013-5-6 1139800] R1 ATKWMIACPIIO_;ATKWMIACPI Driver_;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-9-7 17536] R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\Definitions\BASHDefs\20130502.001\BHDrvx64.sys [2013-5-7 1390680] R1 ccSet_NAV;Norton AntiVirus Settings Manager;C:\Windows\System32\drivers\NAVx64\1403010.016\ccSetx64.sys [2013-5-6 168096] R1 ccSet_NST;Norton Identity Safe Settings Manager;C:\Windows\System32\drivers\NSTx64\7DD03030.013\ccSetx64.sys [2013-5-6 168096] R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\Definitions\IPSDefs\20130515.001\IDSviA64.sys [2013-5-15 513184] R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NAVx64\1403010.016\Ironx64.sys [2013-5-6 224416] R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\NAVx64\1403010.016\symnets.sys [2013-5-6 432800] R2 AFBAgent;AFBAgent;C:\Windows\System32\FBAgent.exe [2011-12-10 379520] R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-2 15416] R2 ASUS InstantOn;ASUS InstantOn Service;C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe [2012-2-16 277120] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624] R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-5-15 418376] R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-5-15 701512] R2 NAV;Norton AntiVirus;C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe [2013-5-6 144520] R2 NCO;Norton Identity Safe;C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe [2013-5-6 144520] R2 RecipeHub_2jService;Recipe HubService;C:\PROGRA~2\RECIPE~2\bar\1.bin\2jbarsvc.exe [2013-3-16 42504] R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776] R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-12-10 2656280] R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\System32\drivers\asmthub3.sys [2011-11-22 130024] R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\System32\drivers\asmtxhci.sys [2011-11-22 395752] R3 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.EXE [2012-6-11 240208] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-5-7 138912] R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-11-3 317440] R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2011-10-17 76912] R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-5-15 25928] R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2011-10-1 764264] R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648] R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960] R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2011-10-1 22376] R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496] S2 BBSvc;BingBar Service;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.EXE [2012-6-11 193616] S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2011-10-18 48488] S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2011-5-13 1492840] S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\System32\drivers\SiSG664.sys [2009-6-10 56832] S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-2-18 59392] S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2011-2-18 31232] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-1-20 1255736] S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184] . =============== Created Last 30 ================ . 2013-05-15 21:17:44 -------- d-----w- C:\Users\peg\AppData\Roaming\Malwarebytes 2013-05-15 21:17:32 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys 2013-05-15 21:17:32 -------- d-----w- C:\ProgramData\Malwarebytes 2013-05-15 21:17:31 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-05-12 21:17:30 -------- d-----w- C:\Users\peg\AppData\Local\ Online Backup 2013-05-12 20:30:28 -------- d-----w- C:\Windows\ERUNT 2013-05-12 20:30:22 -------- d-----w- C:\JRT 2013-05-12 20:29:22 388096 ----a-r- C:\Users\peg\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2013-05-12 20:29:22 -------- d-----w- C:\Program Files (x86)\Trend Micro 2013-05-07 21:01:19 -------- d-----w- C:\Users\peg\AppData\Local\NPE 2013-05-07 01:54:11 168096 ----a-r- C:\Windows\System32\drivers\NSTx64\7DD03030.013\ccSetx64.sys 2013-05-07 01:54:03 -------- d-----w- C:\Windows\System32\drivers\NSTx64\7DD03030.013 2013-05-07 01:54:03 -------- d-----w- C:\Windows\System32\drivers\NSTx64 2013-05-07 01:54:02 -------- d-----w- C:\Program Files (x86)\Norton Identity Safe 2013-05-07 01:53:55 177312 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS 2013-05-07 01:53:54 -------- d-----w- C:\Program Files\Symantec 2013-05-07 01:53:54 -------- d-----w- C:\Program Files\Common Files\Symantec Shared 2013-05-07 01:52:57 432800 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\symnets.sys 2013-05-07 01:52:57 23448 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymELAM.sys 2013-05-07 01:52:57 1139800 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymEFA64.sys 2013-05-07 01:52:56 796248 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\srtsp64.sys 2013-05-07 01:52:56 493656 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymDS64.sys 2013-05-07 01:52:56 36952 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\srtspx64.sys 2013-05-07 01:52:56 224416 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\Ironx64.sys 2013-05-07 01:52:56 168096 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\ccSetx64.sys 2013-05-07 01:52:23 -------- d-----w- C:\Windows\System32\drivers\NAVx64\1403010.016 2013-05-07 01:52:23 -------- d-----w- C:\Windows\System32\drivers\NAVx64 2013-05-07 01:52:22 -------- d-----w- C:\Program Files (x86)\Norton AntiVirus 2013-05-07 01:46:35 -------- d-----w- C:\ProgramData\PCSettings 2013-05-07 01:22:26 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared 2013-05-07 01:15:55 -------- d-----w- C:\ProgramData\NortonInstaller 2013-05-07 01:15:55 -------- d-----w- C:\Program Files (x86)\NortonInstaller 2013-05-07 00:32:41 -------- d-----w- C:\ProgramData\Norton 2013-04-23 23:23:34 1656680 ----a-w- C:\Windows\System32\drivers\ntfs.sys 2013-04-22 23:12:40 -------- d-----w- C:\Windows\pss 2013-04-21 22:49:21 -------- d-----w- C:\Users\peg\AppData\Roaming\PC Health Kit 2013-04-21 22:49:17 -------- d-----w- C:\Program Files (x86)\PC Health Kit . ==================== Find3M ==================== . 2013-05-15 23:31:12 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2013-05-15 23:31:12 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2013-04-13 05:49:23 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll 2013-04-13 05:49:19 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll 2013-04-13 05:49:19 308736 ----a-w- C:\Windows\apppatch\AppPatch64\AcGenral.dll 2013-04-13 05:49:19 111104 ----a-w- C:\Windows\apppatch\AppPatch64\acspecfc.dll 2013-04-13 04:45:16 474624 ----a-w- C:\Windows\apppatch\AcSpecfc.dll 2013-04-13 04:45:15 2176512 ----a-w- C:\Windows\apppatch\AcGenral.dll 2013-04-11 14:22:56 770384 ----a-w- C:\Windows\SysWow64\msvcr100.dll 2013-04-11 14:22:56 421200 ----a-w- C:\Windows\SysWow64\msvcp100.dll 2013-04-10 06:01:54 265064 ----a-w- C:\Windows\System32\drivers\dxgmms1.sys 2013-04-10 06:01:53 983400 ----a-w- C:\Windows\System32\drivers\dxgkrnl.sys 2013-04-10 03:30:50 3153920 ----a-w- C:\Windows\System32\win32k.sys 2013-04-05 06:52:14 2242048 ----a-w- C:\Windows\System32\wininet.dll 2013-04-05 06:50:36 3958784 ----a-w- C:\Windows\System32\jscript9.dll 2013-04-05 06:50:31 67072 ----a-w- C:\Windows\System32\iesetup.dll 2013-04-05 06:50:31 136704 ----a-w- C:\Windows\System32\iesysprep.dll 2013-04-05 05:28:24 1767424 ----a-w- C:\Windows\SysWow64\wininet.dll 2013-04-05 05:26:26 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll 2013-04-05 05:26:21 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll 2013-04-05 05:26:21 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll 2013-04-05 04:43:00 2706432 ----a-w- C:\Windows\System32\mshtml.tlb 2013-04-05 04:29:45 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb 2013-04-05 03:51:11 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe 2013-04-05 03:38:25 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe 2013-03-29 22:57:50 9728 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-03-19 06:04:06 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe 2013-03-19 05:53:58 48640 ----a-w- C:\Windows\System32\wwanprotdim.dll 2013-03-19 05:53:58 230400 ----a-w- C:\Windows\System32\wwansvc.dll 2013-03-19 05:46:56 43520 ----a-w- C:\Windows\System32\csrsrv.dll 2013-03-19 05:04:13 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2013-03-19 05:04:10 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe 2013-03-19 04:47:50 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll 2013-03-19 03:06:33 112640 ----a-w- C:\Windows\System32\smss.exe 2013-03-17 17:42:31 95648 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll 2013-03-17 17:42:31 861088 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll 2013-03-17 17:42:31 782240 ----a-w- C:\Windows\SysWow64\deployJava1.dll 2013-02-27 06:02:44 111448 ----a-w- C:\Windows\System32\consent.exe 2013-02-27 05:48:00 1930752 ----a-w- C:\Windows\System32\authui.dll 2013-02-27 05:47:10 70144 ----a-w- C:\Windows\System32\appinfo.dll 2013-02-27 04:49:24 1796096 ----a-w- C:\Windows\SysWow64\authui.dll . ============= FINISH: 14:58:05.67 ===============

Thanks for the help! Here is DDS Attach: . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 1/17/2012 2:14:02 AM System Uptime: 5/15/2013 2:03:45 PM (3 hours ago) . Motherboard: ASUSTeK Computer Inc. | | K54C Processor: Intel® Core i3-2350M CPU @ 2.30GHz | CPU 1 | 782/100mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 119 GiB total, 75.749 GiB free. D: is FIXED (NTFS) - 154 GiB total, 153.759 GiB free. E: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . . ==== Installed Programs ====================== . ??????? Windows Live Mesh ActiveX ??(????) ??????? Windows Live Mesh ActiveX ??? Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Reader XI (11.0.02) Alcor Micro USB Card Reader Ask Toolbar Ask Toolbar Updater Asmedia ASM104x USB 3.0 Host Controller Driver ASUS AI Recovery ASUS FaceLogon ASUS FancyStart ASUS LifeFrame3 ASUS Live Update ASUS Power4Gear Hybrid ASUS Virtual Camera ASUS WebStorage ASUS_Screensaver AsusVibe2.0 ATK Package Bejeweled 2 Deluxe Bing Bar Contrôle ActiveX Windows Live Mesh pour connexions à distance Control ActiveX de Windows Live Mesh para conexiones remotas Controlo ActiveX do Windows Live Mesh para Ligações Remotas CyberLink LabelPrint CyberLink Media Suite CyberLink Power2Go D3DX10 DomaIQ Driver Pro v3.0 Facebook Video Calling 1.2.0.287 Fast Boot Galeria de Fotografias do Windows Live Galerie de photos Windows Live Galería fotográfica de Windows Live Google Chrome Google Update Helper HiJackThis InstantOn for NB Intel® Control Center Intel® Management Engine Components Intel® Processor Graphics InternetHelper3 Firefox Toolbar Java 7 Update 17 Java Auto Updater JavaFX 2.1.1 Junk Mail filter update Malwarebytes Anti-Malware version 1.75.0.1300 Mesh Runtime Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Extended Microsoft Application Error Reporting Microsoft Office 2010 Microsoft Office Click-to-Run 2010 Microsoft Office Starter 2010 - English Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Mozilla Firefox 20.0.1 (x86 en-US) Mozilla Maintenance Service MSVCRT MSVCRT_amd64 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Norton AntiVirus Norton Identity Safe Nuance PDF Reader Optimizer Pro v3.0 PC Health Kit v3.2 Qualcomm Atheros WiFi Driver Installation Realtek High Definition Audio Driver Recipe Hub toolbar Search Protect by conduit Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449) Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428) Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019) Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595) Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642) Security Update for Microsoft .NET Framework 4 Extended (KB2487367) Security Update for Microsoft .NET Framework 4 Extended (KB2656351) Security Update for Microsoft .NET Framework 4 Extended (KB2736428) Security Update for Microsoft .NET Framework 4 Extended (KB2742595) Software Version Updater Sonic Focus Strongvault Online Backup Supreme Savings Synaptics Pointing Device Driver Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft .NET Framework 4 Extended (KB2468871) Update for Microsoft .NET Framework 4 Extended (KB2533523) Update for Microsoft .NET Framework 4 Extended (KB2600217) Updater By SweetPacks 2.0.0.566 VAFPlayer Windows Live Windows Live ??? Windows Live ???? Windows Live Communications Platform Windows Live Essentials Windows Live Family Safety Windows Live ID Sign-in Assistant Windows Live Installer Windows Live Language Selector Windows Live Mail Windows Live Mesh Windows Live Mesh ActiveX Control for Remote Connections Windows Live Messenger Windows Live MIME IFilter Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live Remote Client Windows Live Remote Client Resources Windows Live Remote Service Windows Live Remote Service Resources Windows Live SOXE Windows Live SOXE Definitions Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources WinFlash Wireless Console 3 Yahoo! Software Update Yahoo! Toolbar Yontoo 2.051 . ==== End Of File =========================== Here is the other log: DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 10.0.9200.16537 BrowserJavaVersion: 10.17.2 Run by peg at 17:22:03 on 2013-05-15 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4000.1059 [GMT -4:00] . AV: Norton AntiVirus *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Norton AntiVirus *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} . ============== Running Processes =============== . C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\FBAgent.exe C:\Windows\system32\WLANExt.exe C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\PROGRA~2\RECIPE~2\bar\1.bin\2jbarsvc.exe C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe C:\Windows\system32\taskhost.exe C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe C:\Windows\system32\taskeng.exe C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\ASUS\P4G\BatteryLife.exe C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe C:\Program Files (x86)\ASUS\FaceLogon\sensorsrv.exe C:\Windows\system32\Dwm.exe C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe C:\Windows\Explorer.EXE C:\Windows\AsScrPro.exe C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe C:\Windows\System32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe C:\PROGRA~3\rundll32.exe C:\PROGRA~3\rundll32.exe C:\Windows\SysWOW64\rundll32.exe C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Windows\system32\ctfmon.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Windows\servicing\TrustedInstaller.exe C:\Windows\system32\wuauclt.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.yahoo.com/?fr=fp-yie10 uWindow Title = Windows Internet Explorer provided by Yahoo! uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie10 mStart Page = hxxp://www.google.com uProxyOverride = <local> uURLSearchHooks: <No Name>: {cc8ae5b8-005b-4b1a-a27d-307eddffe5c8} - uURLSearchHooks: YTNavAssistPlugin Class: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll mWinlogon: Userinit = C:\Windows\System32\userinit.exe BHO: Toolbar BHO: {06e3475c-5521-4de8-bb12-50720f21631c} - BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\IPS\IPSBHO.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Norton Identity Protection: {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll BHO: Search Assistant BHO: {b7acdf9c-c4f9-4d5d-998e-b147866b4d4c} - BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll TB: Norton Identity Safe Toolbar: {A13C2648-91D4-4BF3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - TB: Recipe Hub: {cf51de5b-eb36-4114-bb69-84df63fbadb4} - TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll TB: Norton Identity Safe Toolbar: {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll uRun: [Facebook Update] "C:\Users\peg\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver uRun: [backupAgent] C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe uRun: [Driver Pro] C:\Program Files (x86)\Driver Pro\DPLauncher.exe uRun: [ctfmon.exe] C:\PROGRA~3\rundll32.exe C:\PROGRA~3\43d3.dat,FG00 mRun: [Nuance PDF Reader-reminder] "C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini" mRun: [ASUSPRP] "C:\Program Files (x86)\ASUS\APRP\APRP.EXE" mRun: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe /S mRun: [sonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe mRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe mRun: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [EKIJ5000StatusMonitor] C:\Windows\System32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe mRunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent StartupFolder: C:\Users\peg\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\msconfig.lnk - C:\Windows\System32\rundll32.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ASUSVI~1.LNK - C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FANCYS~1.LNK - C:\Windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe mPolicies-Explorer: NoActiveDesktop = dword:1 mPolicies-Explorer: NoActiveDesktopChanges = dword:1 mPolicies-System: ConsentPromptBehaviorAdmin = dword:5 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll TCP: NameServer = 192.168.0.1 TCP: Interfaces\{E4EE1EFE-5953-489B-9C59-8FD50AAFCDA2} : DHCPNameServer = 192.168.0.1 Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll SSODL: WebCheck - <orphaned> mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - C:\Windows\System32\rundll32.exe C:\Windows\System32\advpack.dll,LaunchINFSectionEx C:\Program Files (x86)\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12 x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll x64-BHO: Updater By SweetPacks: {C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD} - C:\Program Files\Updater By SweetPacks\Extension64.dll x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe x64-Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe x64-Run: [synAsusAcpi] C:\Program Files (x86)\Synaptics\SynTP\SynAsusAcpi.exe x64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SF3 x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe x64-Run: [EKIJ5000StatusMonitor] C:\Windows\System32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned> x64-Notify: igfxcui - igfxdev.dll x64-SSODL: WebCheck - <orphaned> . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\ FF - prefs.js: browser.search.selectedEngine - Norton Safe Search FF - prefs.js: network.proxy.type - 0 FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\Users\peg\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll FF - plugin: C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}\plugins\np-mswmp.dll FF - plugin: C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}\plugins\npConduitFirefoxPlugin.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll FF - plugin: C:\Windows\SysWOW64\npmproxy.dll FF - ExtSQL: 2013-04-21 18:47; {b920380d-fbe7-45c7-96ab-37e9870a566c}; C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c} FF - ExtSQL: 2013-05-06 21:20; {BBDA0591-3099-440a-AA10-41764D9DB4DB}; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\IPSFFPlgn FF - ExtSQL: 2013-05-06 21:54; {F04D2D30-776C-4d02-8627-8E4385ECA58D}; C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2013.3.3.19\coFFPlgn . ============= SERVICES / DRIVERS =============== . R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NAVx64\1403010.016\SymDS64.sys [2013-5-6 493656] R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NAVx64\1403010.016\SymEFA64.sys [2013-5-6 1139800] R1 ATKWMIACPIIO_;ATKWMIACPI Driver_;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-9-7 17536] R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\Definitions\BASHDefs\20130502.001\BHDrvx64.sys [2013-5-7 1390680] R1 ccSet_NAV;Norton AntiVirus Settings Manager;C:\Windows\System32\drivers\NAVx64\1403010.016\ccSetx64.sys [2013-5-6 168096] R1 ccSet_NST;Norton Identity Safe Settings Manager;C:\Windows\System32\drivers\NSTx64\7DD03030.013\ccSetx64.sys [2013-5-6 168096] R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\Definitions\IPSDefs\20130514.001\IDSviA64.sys [2013-5-15 513184] R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NAVx64\1403010.016\Ironx64.sys [2013-5-6 224416] R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\NAVx64\1403010.016\symnets.sys [2013-5-6 432800] R2 AFBAgent;AFBAgent;C:\Windows\System32\FBAgent.exe [2011-12-10 379520] R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-2 15416] R2 ASUS InstantOn;ASUS InstantOn Service;C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe [2012-2-16 277120] R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624] R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-5-15 418376] R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-5-15 701512] R2 NAV;Norton AntiVirus;C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe [2013-5-6 144520] R2 NCO;Norton Identity Safe;C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe [2013-5-6 144520] R2 RecipeHub_2jService;Recipe HubService;C:\PROGRA~2\RECIPE~2\bar\1.bin\2jbarsvc.exe [2013-3-16 42504] R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776] R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-12-10 2656280] R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\System32\drivers\asmthub3.sys [2011-11-22 130024] R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\System32\drivers\asmtxhci.sys [2011-11-22 395752] R3 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.EXE [2012-6-11 240208] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-5-7 138912] R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-11-3 317440] R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2011-10-17 76912] R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-5-15 25928] R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2011-10-1 764264] R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648] R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960] R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2011-10-1 22376] R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496] S2 BBSvc;BingBar Service;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.EXE [2012-6-11 193616] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2011-10-18 48488] S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2011-5-13 1492840] S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\System32\drivers\SiSG664.sys [2009-6-10 56832] S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-2-18 59392] S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2011-2-18 31232] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-1-20 1255736] S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184] . =============== Created Last 30 ================ . 2013-05-15 21:17:44 -------- d-----w- C:\Users\peg\AppData\Roaming\Malwarebytes 2013-05-15 21:17:32 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys 2013-05-15 21:17:32 -------- d-----w- C:\ProgramData\Malwarebytes 2013-05-15 21:17:31 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-05-12 21:17:30 -------- d-----w- C:\Users\peg\AppData\Local\ Online Backup 2013-05-12 20:30:28 -------- d-----w- C:\Windows\ERUNT 2013-05-12 20:30:22 -------- d-----w- C:\JRT 2013-05-12 20:29:22 388096 ----a-r- C:\Users\peg\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2013-05-12 20:29:22 -------- d-----w- C:\Program Files (x86)\Trend Micro 2013-05-07 21:01:19 -------- d-----w- C:\Users\peg\AppData\Local\NPE 2013-05-07 01:54:11 168096 ----a-r- C:\Windows\System32\drivers\NSTx64\7DD03030.013\ccSetx64.sys 2013-05-07 01:54:03 -------- d-----w- C:\Windows\System32\drivers\NSTx64\7DD03030.013 2013-05-07 01:54:03 -------- d-----w- C:\Windows\System32\drivers\NSTx64 2013-05-07 01:54:02 -------- d-----w- C:\Program Files (x86)\Norton Identity Safe 2013-05-07 01:53:55 177312 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS 2013-05-07 01:53:54 -------- d-----w- C:\Program Files\Symantec 2013-05-07 01:53:54 -------- d-----w- C:\Program Files\Common Files\Symantec Shared 2013-05-07 01:52:57 432800 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\symnets.sys 2013-05-07 01:52:57 23448 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymELAM.sys 2013-05-07 01:52:57 1139800 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymEFA64.sys 2013-05-07 01:52:56 796248 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\srtsp64.sys 2013-05-07 01:52:56 493656 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymDS64.sys 2013-05-07 01:52:56 36952 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\srtspx64.sys 2013-05-07 01:52:56 224416 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\Ironx64.sys 2013-05-07 01:52:56 168096 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\ccSetx64.sys 2013-05-07 01:52:23 -------- d-----w- C:\Windows\System32\drivers\NAVx64\1403010.016 2013-05-07 01:52:23 -------- d-----w- C:\Windows\System32\drivers\NAVx64 2013-05-07 01:52:22 -------- d-----w- C:\Program Files (x86)\Norton AntiVirus 2013-05-07 01:46:35 -------- d-----w- C:\ProgramData\PCSettings 2013-05-07 01:22:26 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared 2013-05-07 01:15:55 -------- d-----w- C:\ProgramData\NortonInstaller 2013-05-07 01:15:55 -------- d-----w- C:\Program Files (x86)\NortonInstaller 2013-05-07 00:32:41 -------- d-----w- C:\ProgramData\Norton 2013-05-01 00:58:15 140800 ----a-w- C:\ProgramData\39ri.dat 2013-05-01 00:58:12 44544 ----a-w- C:\ProgramData\rundll32.exe 2013-05-01 00:58:12 140800 ----a-w- C:\ProgramData\43d3.dat 2013-04-23 23:23:34 1656680 ----a-w- C:\Windows\System32\drivers\ntfs.sys 2013-04-22 23:12:40 -------- d-----w- C:\Windows\pss 2013-04-21 22:49:21 -------- d-----w- C:\Users\peg\AppData\Roaming\PC Health Kit 2013-04-21 22:49:17 -------- d-----w- C:\Program Files (x86)\PC Health Kit 2013-04-15 22:38:16 -------- d-----w- C:\Program Files (x86)\MSXML 4.0 . ==================== Find3M ==================== . 2013-04-21 22:51:30 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2013-04-21 22:51:30 691592 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2013-04-11 14:22:56 770384 ----a-w- C:\Windows\SysWow64\msvcr100.dll 2013-04-11 14:22:56 421200 ----a-w- C:\Windows\SysWow64\msvcp100.dll 2013-03-29 22:57:50 9728 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-03-19 06:04:06 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe 2013-03-19 05:46:56 43520 ----a-w- C:\Windows\System32\csrsrv.dll 2013-03-19 05:04:13 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2013-03-19 05:04:10 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe 2013-03-19 04:47:50 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll 2013-03-19 03:06:33 112640 ----a-w- C:\Windows\System32\smss.exe 2013-03-17 17:42:31 95648 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll 2013-03-17 17:42:31 861088 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll 2013-03-17 17:42:31 782240 ----a-w- C:\Windows\SysWow64\deployJava1.dll 2013-03-01 03:36:04 3153408 ----a-w- C:\Windows\System32\win32k.sys 2013-02-21 10:30:16 1766912 ----a-w- C:\Windows\SysWow64\wininet.dll 2013-02-21 10:29:39 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll 2013-02-21 10:29:37 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll 2013-02-21 10:29:37 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll 2013-02-21 10:15:07 2240512 ----a-w- C:\Windows\System32\wininet.dll 2013-02-21 10:14:09 3958784 ----a-w- C:\Windows\System32\jscript9.dll 2013-02-21 10:14:05 67072 ----a-w- C:\Windows\System32\iesetup.dll 2013-02-21 10:14:05 136704 ----a-w- C:\Windows\System32\iesysprep.dll 2013-02-19 12:01:03 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb 2013-02-19 11:42:14 2706432 ----a-w- C:\Windows\System32\mshtml.tlb 2013-02-19 11:10:53 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe 2013-02-19 10:51:18 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe 2013-02-15 06:08:40 44032 ----a-w- C:\Windows\System32\tsgqec.dll 2013-02-15 06:06:11 3717632 ----a-w- C:\Windows\System32\mstscax.dll 2013-02-15 06:02:26 158720 ----a-w- C:\Windows\System32\aaclient.dll 2013-02-15 04:37:10 3217408 ----a-w- C:\Windows\SysWow64\mstscax.dll 2013-02-15 04:34:10 131584 ----a-w- C:\Windows\SysWow64\aaclient.dll 2013-02-15 03:25:51 36864 ----a-w- C:\Windows\SysWow64\tsgqec.dll . ============= FINISH: 17:29:51.33 =============== Also here is MBam's log on quick scan: Malwarebytes Anti-Malware (Trial) 1.75.0.1300 www.malwarebytes.org Database version: v2013.05.15.11 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16540 peg :: PEG-PC [administrator] Protection: Enabled 5/15/2013 5:20:20 PM MBAM-log-2013-05-15 (17-37-01).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 222007 Time elapsed: 16 minute(s), 20 second(s) Memory Processes Detected: 2 C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> 2804 -> No action taken. C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> 3620 -> No action taken. Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 4 HKCR\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} (PUP.Software.Updater) -> No action taken. HKCR\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} (PUP.Software.Updater) -> No action taken. HKCR\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} (PUP.Software.Updater) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} (PUP.Software.Updater) -> No action taken. Registry Values Detected: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ctfmon.exe (Trojan.Agent.Gen) -> Data: C:\PROGRA~3\rundll32.exe C:\PROGRA~3\43d3.dat,FG00 -> No action taken. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 6 C:\ProgramData\43d3.dat (Trojan.FakeMS) -> No action taken. C:\ProgramData\39ri.dat (Trojan.FakeMS) -> No action taken. C:\Users\peg\AppData\Local\Temp\ofi3jZF.exe (Trojan.FakeMS) -> No action taken. C:\Users\peg\AppData\Local\Temp\DIQ\FlashPlayer_151\software\SupremeSavings.exe (Heuristics.Shuriken) -> No action taken. C:\Windows\Tasks\AmiUpdXp.job (PUP.Software.Updater) -> No action taken. C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> No action taken. (end)

Hello, I got a computer that is infected with many viruses/ trojans. It is getting many pop-ups and it needs to be fixed, but I need some help. All help is appreciated. Thanks, Brandon

Alright, I think I got it! Thanks for your help!

ComboFix 12-11-08.01 - Brandon 11/08/2012 10:16:35.12.2 - x64 Running from: c:\users\Brandon\Desktop\ComboFix.exe * Created a new restore point . . ((((((((((((((((((((((((( Files Created from 2012-10-08 to 2012-11-08 ))))))))))))))))))))))))))))))) . . 2012-11-08 15:28 . 2012-11-08 15:28 -------- d-----w- c:\users\Public\AppData\Local\temp 2012-11-08 15:28 . 2012-11-08 15:28 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-11-08 02:42 . 2012-11-08 02:42 -------- d-----w- c:\program files (x86)\Common Files\Java 2012-11-08 02:41 . 2012-11-08 02:39 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2012-10-30 21:09 . 2012-10-30 21:09 -------- d-----w- c:\program files (x86)\Total Video Converter 2012-10-16 07:09 . 2012-10-16 07:09 -------- d-----w- c:\program files (x86)\MSXML 4.0 2012-10-15 17:23 . 2012-08-29 11:40 4699520 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-10-15 17:23 . 2012-06-29 16:20 648192 ----a-w- c:\windows\system32\netapi32.dll 2012-10-14 23:52 . 2012-11-08 15:15 -------- d-----w- C:\32788R22FWJFW 2012-10-14 18:49 . 2012-10-14 18:48 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll 2012-10-14 18:48 . 2012-10-14 18:48 -------- d-----w- c:\programdata\McAfee 2012-10-12 13:41 . 2012-10-12 13:41 -------- d-----w- c:\program files\Penn State Wireless v2 2012-10-09 19:00 . 2012-10-09 19:03 -------- d-----w- c:\users\Brandon\AppData\Roaming\mIRC . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-11-08 02:38 . 2010-07-28 00:42 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll 2012-10-17 16:46 . 2009-01-03 12:24 45056 ----a-w- c:\windows\system32\acovcnt.exe 2012-10-08 21:40 . 2012-07-12 02:32 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-10-08 21:40 . 2012-07-06 18:03 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-09-30 00:54 . 2011-08-08 19:48 25928 ----a-w- c:\windows\system32\drivers\mbam.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968] "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392] "Steam"="c:\program files (x86)\Steam\Steam.exe" [2012-08-31 1353080] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-19 104936] "P2Go_Menu"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216] "HControlUser"="c:\program files (x86)\ASUS\ATK Hotkey\HControlUser.exe" [2008-01-12 98304] "ATKOSD2"="c:\program files (x86)\ASUS\ATKOSD2\ATKOSD2.exe" [2008-07-15 7651328] "ATKMEDIA"="c:\program files (x86)\ASUS\ATK Media\DMedia.exe" [2008-06-25 159744] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2009-11-11 417792] "TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" [2011-04-01 273544] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280] "iTunesHelper"="D:\iTunesHelper.exe" [2012-06-07 421776] "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer5"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0200804] IME File REG_SZ IMSC12.IME . --- Other Services/Drivers In Memory --- . *NewlyCreated* - 35718442 *Deregistered* - 35718442 *Deregistered* - aswMBR . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs Themes . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2008-06-09 17:14 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder . 2012-11-08 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 21:40] . 2012-11-07 c:\windows\Tasks\ReclaimerUpdateFiles_Brandon.job - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22] . 2012-11-07 c:\windows\Tasks\ReclaimerUpdateXML_Brandon.job - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22] . 2012-11-07 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_Brandon.job - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="RAVCpl64.exe" [2008-07-03 6342688] "Skytel"="Skytel.exe" [2007-11-20 1826816] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1216808] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://oc-startpage.aol.com/ mLocal Page = c:\windows\SysWOW64\blank.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.0.1 CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll FF - ProfilePath - c:\users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\g6jhj5ri.default\ FF - prefs.js: browser.startup.homepage - google.com FF - prefs.js: network.proxy.type - 0 FF - ExtSQL: 2012-09-10 13:08; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; c:\program files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF - ExtSQL: !HIDDEN! 2009-06-24 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(yahoo.ytff.general.dontshowhpoffer, true . - - - - ORPHANS REMOVED - - - - . AddRemove-Adobe Shockwave Player - c:\windows\System32\Adobe\SHOCKW~1\UNWISE.EXE AddRemove-DVD Flick_is1 - c:\program files (x86)\DVD Flick\unins000.exe AddRemove-mIRC - c:\program files (x86)\mIRC\uninstall.exe AddRemove-SecureW2 Enterprise Client - c:\program files (x86)\SecureW2\Uninstall.exe AddRemove-Tiled - c:\program files (x86)\Tiled\uninstall.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\NAV] "ImagePath"="\"c:\program files (x86)\Norton AntiVirus\Engine\17.9.0.12\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files (x86)\Norton AntiVirus\Engine\17.9.0.12\diMaster.dll\" /prefetch:1" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2012-11-08 10:32:13 ComboFix-quarantined-files.txt 2012-11-08 15:32 ComboFix2.txt 2012-11-08 14:48 ComboFix3.txt 2012-11-07 21:17 ComboFix4.txt 2012-11-07 18:59 ComboFix5.txt 2012-11-08 15:15 . Pre-Run: 544,768,000 bytes free Post-Run: 494,596,096 bytes free . - - End Of File - - F93023D4626450227C536BFCD2CF88EF

With the last CFScript? Or run by itself?

ComboFix 12-11-08.01 - Brandon 11/08/2012 9:33.11.2 - x64 Running from: c:\users\Brandon\Desktop\ComboFix.exe Command switches used :: c:\users\Brandon\Desktop\CFScript.txt * Created a new restore point . FILE :: "c:\programdata\Microsoft\Windows\DRM\B82B.tmp.dat" . . ((((((((((((((((((((((((( Files Created from 2012-10-08 to 2012-11-08 ))))))))))))))))))))))))))))))) . . 2012-11-08 14:44 . 2012-11-08 14:44 -------- d-----w- c:\users\Public\AppData\Local\temp 2012-11-08 14:44 . 2012-11-08 14:44 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-11-08 02:42 . 2012-11-08 02:42 -------- d-----w- c:\program files (x86)\Common Files\Java 2012-11-08 02:41 . 2012-11-08 02:39 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2012-10-30 21:09 . 2012-10-30 21:09 -------- d-----w- c:\program files (x86)\Total Video Converter 2012-10-16 07:09 . 2012-10-16 07:09 -------- d-----w- c:\program files (x86)\MSXML 4.0 2012-10-15 17:23 . 2012-08-29 11:40 4699520 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-10-15 17:23 . 2012-06-29 16:20 648192 ----a-w- c:\windows\system32\netapi32.dll 2012-10-14 23:52 . 2012-11-08 14:31 -------- d-----w- C:\32788R22FWJFW 2012-10-14 18:49 . 2012-10-14 18:48 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll 2012-10-14 18:48 . 2012-10-14 18:48 -------- d-----w- c:\programdata\McAfee 2012-10-12 13:41 . 2012-10-12 13:41 -------- d-----w- c:\program files\Penn State Wireless v2 2012-10-09 19:00 . 2012-10-09 19:03 -------- d-----w- c:\users\Brandon\AppData\Roaming\mIRC . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-11-08 02:38 . 2010-07-28 00:42 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll 2012-10-17 16:46 . 2009-01-03 12:24 45056 ----a-w- c:\windows\system32\acovcnt.exe 2012-10-08 21:40 . 2012-07-12 02:32 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-10-08 21:40 . 2012-07-06 18:03 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-10-07 19:03 . 2012-10-07 19:03 133120 ----a-w- c:\programdata\Microsoft\Windows\DRM\B82B.tmp.dat 2012-09-30 00:54 . 2011-08-08 19:48 25928 ----a-w- c:\windows\system32\drivers\mbam.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968] "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392] "Steam"="c:\program files (x86)\Steam\Steam.exe" [2012-08-31 1353080] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-19 104936] "P2Go_Menu"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216] "HControlUser"="c:\program files (x86)\ASUS\ATK Hotkey\HControlUser.exe" [2008-01-12 98304] "ATKOSD2"="c:\program files (x86)\ASUS\ATKOSD2\ATKOSD2.exe" [2008-07-15 7651328] "ATKMEDIA"="c:\program files (x86)\ASUS\ATK Media\DMedia.exe" [2008-06-25 159744] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2009-11-11 417792] "TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" [2011-04-01 273544] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280] "iTunesHelper"="D:\iTunesHelper.exe" [2012-06-07 421776] "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer5"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0200804] IME File REG_SZ IMSC12.IME . --- Other Services/Drivers In Memory --- . *NewlyCreated* - 35718442 *Deregistered* - 35718442 *Deregistered* - aswMBR . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs Themes . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2008-06-09 17:14 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder . 2012-11-08 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 21:40] . 2012-11-07 c:\windows\Tasks\ReclaimerUpdateFiles_Brandon.job - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22] . 2012-11-07 c:\windows\Tasks\ReclaimerUpdateXML_Brandon.job - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22] . 2012-11-07 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_Brandon.job - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="RAVCpl64.exe" [2008-07-03 6342688] "Skytel"="Skytel.exe" [2007-11-20 1826816] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1216808] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://oc-startpage.aol.com/ mLocal Page = c:\windows\SysWOW64\blank.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.0.1 CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll FF - ProfilePath - c:\users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\g6jhj5ri.default\ FF - prefs.js: browser.startup.homepage - google.com FF - prefs.js: network.proxy.type - 0 FF - ExtSQL: 2012-09-10 13:08; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; c:\program files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF - ExtSQL: !HIDDEN! 2009-06-24 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(yahoo.ytff.general.dontshowhpoffer, true . - - - - ORPHANS REMOVED - - - - . AddRemove-Adobe Shockwave Player - c:\windows\System32\Adobe\SHOCKW~1\UNWISE.EXE AddRemove-DVD Flick_is1 - c:\program files (x86)\DVD Flick\unins000.exe AddRemove-mIRC - c:\program files (x86)\mIRC\uninstall.exe AddRemove-SecureW2 Enterprise Client - c:\program files (x86)\SecureW2\Uninstall.exe AddRemove-Tiled - c:\program files (x86)\Tiled\uninstall.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\NAV] "ImagePath"="\"c:\program files (x86)\Norton AntiVirus\Engine\17.9.0.12\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files (x86)\Norton AntiVirus\Engine\17.9.0.12\diMaster.dll\" /prefetch:1" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2012-11-08 09:48:36 ComboFix-quarantined-files.txt 2012-11-08 14:48 ComboFix2.txt 2012-11-07 21:17 ComboFix3.txt 2012-11-07 18:59 ComboFix4.txt 2012-10-15 00:09 . Pre-Run: 561,094,656 bytes free Post-Run: 497,094,656 bytes free . - - End Of File - - 18454213A365F90EC62C26F9784C3186

Here you go! C:\ProgramData\Microsoft\Windows\DRM\B82B.tmp.dat a variant of Win32/Kryptik.ANBY trojan C:\Users\All Users\Microsoft\Windows\DRM\B82B.tmp.dat a variant of Win32/Kryptik.ANBY trojan

Will do. Your like the Ghost Busters of Malware aren't you.

Could that of affected my computers performance issues that much?

As in a bad piece of malware? Could you explain what it was?

Thanks by the way. Also for just curiosity, how many viruses/malware did you see on my computer?

Malwarebytes scanned - no malicious found. Doing ESET Scanner right now.

Computer runs fine, nothing has broke yet ComboFix 12-11-06.03 - Brandon 11/07/2012 16:03:02.10.2 - x64 Running from: c:\users\Brandon\Desktop\ComboFix.exe Command switches used :: c:\users\Brandon\Desktop\CFScript.txt * Created a new restore point . FILE :: "c:\programdata\Microsoft\Windows\DRM\B82B.tmp.dat" . . ((((((((((((((((((((((((( Files Created from 2012-10-07 to 2012-11-07 ))))))))))))))))))))))))))))))) . . 2012-11-07 21:14 . 2012-11-07 21:14 -------- d-----w- c:\users\Public\AppData\Local\temp 2012-11-07 21:14 . 2012-11-07 21:14 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-10-30 21:09 . 2012-10-30 21:09 -------- d-----w- c:\program files (x86)\Total Video Converter 2012-10-16 07:09 . 2012-10-16 07:09 -------- d-----w- c:\program files (x86)\MSXML 4.0 2012-10-15 17:23 . 2012-08-29 11:40 4699520 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-10-15 17:23 . 2012-06-29 16:20 648192 ----a-w- c:\windows\system32\netapi32.dll 2012-10-14 23:52 . 2012-11-07 21:01 -------- d-----w- C:\32788R22FWJFW 2012-10-14 18:49 . 2012-10-14 18:49 -------- d-----w- c:\program files (x86)\Common Files\Java 2012-10-14 18:49 . 2012-10-14 18:48 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll 2012-10-14 18:49 . 2012-10-14 18:49 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2012-10-14 18:48 . 2012-10-14 18:48 -------- d-----w- c:\programdata\McAfee 2012-10-12 13:41 . 2012-10-12 13:41 -------- d-----w- c:\program files\Penn State Wireless v2 2012-10-09 19:00 . 2012-10-09 19:03 -------- d-----w- c:\users\Brandon\AppData\Roaming\mIRC . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-10-17 16:46 . 2009-01-03 12:24 45056 ----a-w- c:\windows\system32\acovcnt.exe 2012-10-14 18:48 . 2010-07-28 00:42 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll 2012-10-08 21:40 . 2012-07-12 02:32 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-10-08 21:40 . 2012-07-06 18:03 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-10-07 19:03 . 2012-10-07 19:03 133120 ----a-w- c:\programdata\Microsoft\Windows\DRM\B82B.tmp.dat 2012-09-30 00:54 . 2011-08-08 19:48 25928 ----a-w- c:\windows\system32\drivers\mbam.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968] "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392] "Steam"="c:\program files (x86)\Steam\Steam.exe" [2012-08-31 1353080] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-19 104936] "P2Go_Menu"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216] "HControlUser"="c:\program files (x86)\ASUS\ATK Hotkey\HControlUser.exe" [2008-01-12 98304] "ATKOSD2"="c:\program files (x86)\ASUS\ATKOSD2\ATKOSD2.exe" [2008-07-15 7651328] "ATKMEDIA"="c:\program files (x86)\ASUS\ATK Media\DMedia.exe" [2008-06-25 159744] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2009-11-11 417792] "TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" [2011-04-01 273544] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280] "iTunesHelper"="D:\iTunesHelper.exe" [2012-06-07 421776] "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer5"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0200804] IME File REG_SZ IMSC12.IME . --- Other Services/Drivers In Memory --- . *NewlyCreated* - 35718442 *Deregistered* - 35718442 *Deregistered* - aswMBR . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs Themes . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2008-06-09 17:14 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder . 2012-11-07 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 21:40] . 2012-11-07 c:\windows\Tasks\ReclaimerUpdateFiles_Brandon.job - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22] . 2012-11-07 c:\windows\Tasks\ReclaimerUpdateXML_Brandon.job - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22] . 2012-11-07 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_Brandon.job - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="RAVCpl64.exe" [2008-07-03 6342688] "Skytel"="Skytel.exe" [2007-11-20 1826816] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1216808] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://oc-startpage.aol.com/ mLocal Page = c:\windows\SysWOW64\blank.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.0.1 CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll FF - ProfilePath - c:\users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\g6jhj5ri.default\ FF - prefs.js: browser.startup.homepage - google.com FF - prefs.js: network.proxy.type - 0 FF - ExtSQL: 2012-09-10 13:08; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; c:\program files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF - ExtSQL: !HIDDEN! 2009-06-24 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(yahoo.ytff.general.dontshowhpoffer, true . - - - - ORPHANS REMOVED - - - - . AddRemove-Adobe Shockwave Player - c:\windows\System32\Adobe\SHOCKW~1\UNWISE.EXE AddRemove-DVD Flick_is1 - c:\program files (x86)\DVD Flick\unins000.exe AddRemove-mIRC - c:\program files (x86)\mIRC\uninstall.exe AddRemove-SecureW2 Enterprise Client - c:\program files (x86)\SecureW2\Uninstall.exe AddRemove-Tiled - c:\program files (x86)\Tiled\uninstall.exe . . . Completion time: 2012-11-07 16:17:00 ComboFix-quarantined-files.txt 2012-11-07 21:17 ComboFix2.txt 2012-11-07 18:59 ComboFix3.txt 2012-10-15 00:09 . Pre-Run: 210,878,464 bytes free Post-Run: 196,222,976 bytes free . - - End Of File - - 2486E8EC7EE9EDA073237DD4F5ED1D15

Log is attached TDSSKiller.2.8.15.0_07.11.2012_14.17.55_log.txt

https://www.virustotal.com/file/18da2e30c75ea4512a734fea9104ba7806830a5fcf5aaad62c2f86f1f6718b28/analysis/1352315511/

ComboFix 12-11-06.03 - Brandon 11/07/2012 13:45:02.9.2 - x64 Running from: c:\users\Brandon\Desktop\ComboFix.exe * Created a new restore point . . ((((((((((((((((((((((((( Files Created from 2012-10-07 to 2012-11-07 ))))))))))))))))))))))))))))))) . . 2012-11-07 18:56 . 2012-11-07 18:56 -------- d-----w- c:\users\Public\AppData\Local\temp 2012-11-07 18:56 . 2012-11-07 18:56 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-10-30 21:09 . 2012-10-30 21:09 -------- d-----w- c:\program files (x86)\Total Video Converter 2012-10-16 07:09 . 2012-10-16 07:09 -------- d-----w- c:\program files (x86)\MSXML 4.0 2012-10-15 17:23 . 2012-08-29 11:40 4699520 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-10-15 17:23 . 2012-06-29 16:20 648192 ----a-w- c:\windows\system32\netapi32.dll 2012-10-14 23:52 . 2012-11-07 18:43 -------- d-----w- C:\32788R22FWJFW 2012-10-14 18:49 . 2012-10-14 18:49 -------- d-----w- c:\program files (x86)\Common Files\Java 2012-10-14 18:49 . 2012-10-14 18:48 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll 2012-10-14 18:49 . 2012-10-14 18:49 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2012-10-14 18:48 . 2012-10-14 18:48 -------- d-----w- c:\programdata\McAfee 2012-10-12 13:41 . 2012-10-12 13:41 -------- d-----w- c:\program files\Penn State Wireless v2 2012-10-09 19:00 . 2012-10-09 19:03 -------- d-----w- c:\users\Brandon\AppData\Roaming\mIRC . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-10-17 16:46 . 2009-01-03 12:24 45056 ----a-w- c:\windows\system32\acovcnt.exe 2012-10-14 18:48 . 2010-07-28 00:42 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll 2012-10-08 21:40 . 2012-07-12 02:32 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-10-08 21:40 . 2012-07-06 18:03 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-10-07 19:03 . 2012-10-07 19:03 133120 ----a-w- c:\programdata\Microsoft\Windows\DRM\B82B.tmp.dat 2012-09-30 00:54 . 2011-08-08 19:48 25928 ----a-w- c:\windows\system32\drivers\mbam.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968] "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392] "Steam"="c:\program files (x86)\Steam\Steam.exe" [2012-08-31 1353080] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-19 104936] "P2Go_Menu"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216] "HControlUser"="c:\program files (x86)\ASUS\ATK Hotkey\HControlUser.exe" [2008-01-12 98304] "ATKOSD2"="c:\program files (x86)\ASUS\ATKOSD2\ATKOSD2.exe" [2008-07-15 7651328] "ATKMEDIA"="c:\program files (x86)\ASUS\ATK Media\DMedia.exe" [2008-06-25 159744] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2009-11-11 417792] "TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" [2011-04-01 273544] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280] "iTunesHelper"="D:\iTunesHelper.exe" [2012-06-07 421776] "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer5"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0200804] IME File REG_SZ IMSC12.IME . --- Other Services/Drivers In Memory --- . *Deregistered* - aswMBR . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs Themes . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2008-06-09 17:14 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder . 2012-11-07 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 21:40] . 2012-11-07 c:\windows\Tasks\ReclaimerUpdateFiles_Brandon.job - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22] . 2012-11-07 c:\windows\Tasks\ReclaimerUpdateXML_Brandon.job - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22] . 2012-11-07 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_Brandon.job - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="RAVCpl64.exe" [2008-07-03 6342688] "Skytel"="Skytel.exe" [2007-11-20 1826816] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1216808] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://oc-startpage.aol.com/ mLocal Page = c:\windows\SysWOW64\blank.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.0.1 CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll FF - ProfilePath - c:\users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\g6jhj5ri.default\ FF - prefs.js: browser.startup.homepage - google.com FF - prefs.js: network.proxy.type - 0 FF - ExtSQL: 2012-09-10 13:08; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; c:\program files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF - ExtSQL: !HIDDEN! 2009-06-24 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(yahoo.ytff.general.dontshowhpoffer, true . - - - - ORPHANS REMOVED - - - - . AddRemove-Adobe Shockwave Player - c:\windows\System32\Adobe\SHOCKW~1\UNWISE.EXE AddRemove-DVD Flick_is1 - c:\program files (x86)\DVD Flick\unins000.exe AddRemove-mIRC - c:\program files (x86)\mIRC\uninstall.exe AddRemove-SecureW2 Enterprise Client - c:\program files (x86)\SecureW2\Uninstall.exe AddRemove-Tiled - c:\program files (x86)\Tiled\uninstall.exe . . . Completion time: 2012-11-07 13:59:31 ComboFix-quarantined-files.txt 2012-11-07 18:59 ComboFix2.txt 2012-10-15 00:09 . Pre-Run: 99,586,048 bytes free Post-Run: 229,724,160 bytes free . - - End Of File - - FCE1889BE94CFBB0249135F5A27739F2

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-11-06 21:03:37 ----------------------------- 21:03:37.751 OS Version: Windows x64 6.0.6002 Service Pack 2 21:03:37.752 Number of processors: 2 586 0xF0D 21:03:37.753 ComputerName: BRANDON-PC UserName: Brandon 21:03:39.208 Initialize success 21:04:34.629 AVAST engine defs: 12110602 21:04:45.441 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 21:04:45.443 Disk 0 Vendor: ST925082 3.AA Size: 238475MB BusType: 3 21:04:45.465 Disk 0 MBR read successfully 21:04:45.468 Disk 0 MBR scan 21:04:45.484 Disk 0 unknown MBR code 21:04:45.488 Disk 0 Partition 1 00 1C Hidd FAT32 LBA MSDOS5.0 10997 MB offset 63 21:04:45.502 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 119232 MB offset 22523130 21:04:45.509 Disk 0 Partition - 00 0F Extended LBA 108244 MB offset 266711280 21:04:45.552 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 108244 MB offset 266711324 21:04:45.651 Disk 0 scanning C:\Windows\system32\drivers 21:05:07.480 Service scanning 21:06:13.195 Modules scanning 21:06:13.203 Disk 0 trace - called modules: 21:06:13.557 ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys iaStor.sys hal.dll 21:06:13.562 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006a33790] 21:06:13.566 3 CLASSPNP.SYS[fffffa6000fc7c33] -> nt!IofCallDriver -> [0xfffffa8004bcc2d0] 21:06:13.571 5 acpi.sys[fffffa6000901fde] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004bcf050] 21:06:15.651 AVAST engine scan C:\Windows 21:06:22.241 AVAST engine scan C:\Windows\system32 21:14:45.357 AVAST engine scan C:\Windows\system32\drivers 21:15:06.041 AVAST engine scan C:\Users\Brandon 21:39:09.550 AVAST engine scan C:\ProgramData 21:42:28.297 File: C:\ProgramData\Microsoft\Windows\DRM\B82B.tmp.dat **INFECTED** Win32:Dropper-gen [Drp] 21:45:59.099 Scan finished successfully 22:19:03.309 Disk 0 MBR has been saved successfully to "C:\Users\Brandon\Desktop\MBR.dat" 22:19:03.314 The log file has been saved successfully to "C:\Users\Brandon\Desktop\aswMBR.txt"